last executing test programs: 24m0.082194496s ago: executing program 32 (id=64): r0 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000240)={0x0, 0x1b6c, 0x80, 0x1024002, 0x804d}, &(0x7f0000000000)=0x0, &(0x7f0000000380)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xfffffffffffffffb, &(0x7f00000000c0), 0x1, 0x40}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000800)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x98c8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x4, 0x412, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1e0}}}, 0x0) syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) syz_io_uring_complete(r1, r2) r8 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0xe, 0x0, 0x0}, 0x94) r9 = getpid() sched_setscheduler(r9, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r10, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r11, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_route(0x10, 0x3, 0x0) r12 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000100)={0x18, 0x1401, 0x1, 0x70bd2d, 0x25dfdbfb, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x6}]}, 0x18}, 0x1, 0x0, 0x0, 0x180d1}, 0x49010) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) ioctl$VIDIOC_S_FREQUENCY(r8, 0x402c5639, &(0x7f0000000080)={0x0, 0x4, 0x927bf}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0xf60, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x180}}}, 0x0) 23m54.696942923s ago: executing program 33 (id=74): bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000240)={0x18, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB], 0x0, 0x7, 0x0, 0x0, 0x41000, 0x8, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x40004}, 0x94) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, 0x0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$inet(r1, &(0x7f0000000020)={0x2, 0x257, @loopback}, 0x10) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0xf, 0x4, 0x4, 0x1, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0xe, 0x6, &(0x7f0000000400)=@raw=[@map_fd={0x18, 0x2, 0x1, 0x0, r2}, @generic={0xb7, 0x3}, @generic={0xb7, 0x4}, @generic={0x85, 0x0, 0x0, 0x0, 0x34}, @exit], &(0x7f0000000500)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = syz_open_dev$vim2m(&(0x7f0000000080), 0x4, 0x2) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f00000000c0)={0x2, @meta={0x43465052, 0x2d715ecd, 0xe154, 0xf1ed, 0x37a95797}}) set_mempolicy(0x3, 0x0, 0x6) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000040)={0x80000001, 0x1, 0x4}) creat(&(0x7f00000002c0)='./file0\x00', 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0x2) syz_open_dev$MSR(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r5 = syz_open_dev$MSR(&(0x7f0000000280), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) r6 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCBRDELBR(r6, 0x89a2, 0x0) r7 = socket(0xa, 0x1, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r7, 0x0, 0x485, 0x0, 0x0) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000240)=0x1) bpf$BPF_PROG_ATTACH(0x8, &(0x7f0000000600)={@map=r2, r3, 0x26, 0x0, 0x0, @void, @value=0x0}, 0x20) bpf$MAP_UPDATE_ELEM(0x2, 0x0, 0x0) recvmsg(r0, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) 21m44.052886114s ago: executing program 34 (id=223): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x1f, 0xb, &(0x7f0000000740)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002000000000000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000003000000b703000009000080850000007100000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x15, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000000c0)={r1, 0x5, 0x1100, 0x0, 0x0, 0x0, 0x149c, 0x503, 0xffffff81, 0x0, 0x0, 0x0, 0x7, 0xffff80fe}, 0x7) r2 = socket$pppoe(0x18, 0x1, 0x0) r3 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000180)={0x10, 0x1411, 0x1, 0x70bd29, 0x20003}, 0x10}}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000003c0)={r3, 0x0, 0x0}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x48) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x20000011) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000500)=@xdp={0x2c, 0x7, 0x0, 0x7}, 0x80, 0x0}, 0x4000011) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc01100, 0x0, 0x0, 0x0, 0x2) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000000000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x8040044}, 0x40050) sendmsg$RDMA_NLDEV_CMD_DELLINK(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000015c0)=ANY=[@ANYBLOB="18000000041401002dbd7000fedbdf250800010000000000ba30b28e994c1a08786eb807e0000000000000000000009fe70ba83a7a66e67a0bae5cfaccbbb81e28d7b568", @ANYRESHEX, @ANYRESOCT], 0x18}, 0x1, 0x0, 0x0, 0x671ec167a4b72164}, 0x0) r7 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$SOCK_DIAG_BY_FAMILY(r7, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000d00)={&(0x7f0000000880)=ANY=[@ANYBLOB="c7710000140005de25bc70006bdbdf25110018736256549e4004290d000100c80e4501a254722eaea6d93916f8d66cffe8ef8d000069e7dd50f73838eb6600004cb18b02397187e20fafca87d8e038c7fe5b59b93b1812e3f9feebe558aa6c41a1e18e9704375dfaf2bd7b872c10a26e49d597ac120fdd1e7776da990eea4fe0f161ae2e4fcf61e4bc9ae60b7c51c7cd3230ac9c8216b633eec886e7c56cda06383e82f0b10000000077f2ba155d64b9f2ece734460886cec0cfc62d82c15e860d16b53d55073004f6dd9ba1e1c65fcbc5f98e57be539cdcd19e6585"], 0x24}, 0x1, 0x0, 0x0, 0x40002}, 0x4054081) connect$pppoe(r2, &(0x7f0000000100)={0x18, 0x0, {0x4, @local, 'ip_vti0\x00'}}, 0x1e) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="30000000100001006c4789ec390bca4900000000", @ANYRES32=0x0, @ANYBLOB="211000000300000008001b0000000000080004000180"], 0x30}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) 19m33.501977636s ago: executing program 35 (id=374): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) r3 = inotify_init1(0x80800) inotify_add_watch(r3, &(0x7f0000000640)='.\x00', 0x80000001) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x40) fallocate(r4, 0x0, 0x8e14, 0x8ffff) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRESDEC=r3], &(0x7f0000000000)='GPL\x00', 0x8, 0x9f, &(0x7f0000000540)=""/159, 0x41000, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000003}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240), 0x620000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) 18m59.314731051s ago: executing program 36 (id=436): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8880}, 0x55) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xdcc4069e8be0ce0a}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000001000), r0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0xc, 0x0, &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0x10) close(0x3) r4 = socket(0x10, 0x803, 0x0) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r6, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000000180)={r6, r6, 0x7, 0x1, &(0x7f0000000240)='l', 0x7, 0x4, 0x7, 0x7, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r5, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) syz_init_net_socket$x25(0x9, 0x2, 0x10) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r7, &(0x7f0000000800)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x28, 0x2, 0x8, 0x801, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x21}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x2400c014}, 0x20000000) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400eeffff11", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c00010062726964"], 0x3c}}, 0x0) accept4$unix(r4, 0x0, &(0x7f0000000600), 0x800) 16m34.42249341s ago: executing program 37 (id=633): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_GET_SPECULATION_CTRL(0x34, 0x0, 0x8) r3 = openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) ioctl$TCSETSF2(r3, 0x402c542d, 0x0) r4 = syz_ublk_setup_io_uring(0x20, 0x0, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0) r8 = mq_open(&(0x7f0000000000)='e_1\x00', 0x8c2, 0x30, &(0x7f0000000080)={0x8000000040000000, 0x4, 0x2, 0x9}) mq_timedsend(r8, 0x0, 0x0, 0x5, 0x0) r9 = epoll_create1(0x0) r10 = socket$inet(0x2, 0x80001, 0x84) setsockopt$sock_int(r10, 0x1, 0xf, &(0x7f0000000280)=0xf58, 0x4) bind$inet(r10, &(0x7f0000000180)={0x2, 0xce20, @empty}, 0x10) listen(r10, 0x3) r11 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r11, 0x1, 0xf, &(0x7f0000fee000)=0x1, 0x4) bind$inet6(r11, &(0x7f0000000140)={0xa, 0x4e20, 0x0, @empty, 0xfffffffe}, 0x1c) listen(r11, 0x50) epoll_ctl$EPOLL_CTL_ADD(r9, 0x1, r8, &(0x7f00000000c0)={0x18}) mq_timedreceive(r8, &(0x7f0000001140)=""/170, 0xaa, 0x0, 0x0) syz_ublk_add_dev(r4, r5, r6, r7, &(0x7f0000000200)={0x2e, 0xc, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000500)=@new_dev={0x1, 0x104}}}, 0x0) 15m10.850885027s ago: executing program 5 (id=792): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000040)='sysfs\x00', 0x0, 0x0) sendmsg$GTP_CMD_DELPDP(0xffffffffffffffff, 0x0, 0x24000080) r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x5, &(0x7f0000000200), 0x2, 0x9}}, 0xfffffffffffffed0) r1 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, &(0x7f0000000240)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x2, 0x6}}, 0x20) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000080), 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) write$RDMA_USER_CM_CMD_QUERY(r0, &(0x7f0000000500)={0x13, 0x10, 0xfa00, {&(0x7f0000000300), r2, 0x1}}, 0x18) bind$bt_hci(r3, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x2}, 0x6) write$bt_hci(r3, &(0x7f0000000300)=ANY=[], 0x6) r6 = landlock_create_ruleset(&(0x7f0000000040)={0x4010, 0x3}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_NET_PORT(r6, 0x2, &(0x7f0000000240)={0x3, 0x3}, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000640)={{0x1, 0x1, 0x18, r6}, './sys/devices/system/machinecheck/machinecheck0/cmci_disabled\x00'}) readv(r7, &(0x7f0000000940), 0x0) close_range(r6, 0xffffffffffffffff, 0x0) r8 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r8, 0x29, 0x40, &(0x7f0000000980)=@raw={'raw\x00', 0x3c1, 0x3, 0x430, 0x360, 0x2b8, 0xb0000010, 0x270, 0x5c8f0200, 0x360, 0x3a8, 0x3a8, 0x360, 0x3a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x228, 0x270, 0x700, {}, [@common=@inet=@hashlimit3={{0x158}, {'geneve1\x00', {0xf1, 0x0, 0x33, 0x0, 0xffffff80, 0x1, 0x7fffffff}}}, @common=@unspec=@cgroup0={{0x28}, {0x6}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x0, 'syz1\x00'}}}, {{@uncond, 0x0, 0xd0, 0xf0, 0x0, {}, [@inet=@rpfilter={{0x28}}]}, @unspec=@NOTRACK={0x20}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x490) r9 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./sys/devices/system/machinecheck/machinecheck0/cmci_disabled\x00', 0x1, 0x0) write(r9, &(0x7f0000000100)='1\n', 0x2) write(r9, &(0x7f0000000200)='0\n\x00', 0x2) 15m6.279628153s ago: executing program 5 (id=779): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) r3 = dup2(r2, r2) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r3, &(0x7f0000002480)={0x2020}, 0x2020) write$vhost_msg_v2(r3, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/104, 0x68, 0x0, 0x1, 0x2}}, 0x48) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\x06\x00[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0xc0, 0x11b, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1f, 0x1000, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x4}, 0x50) r4 = open(&(0x7f0000000380)='./bus\x00', 0x109240, 0x145) r5 = creat(&(0x7f0000000200)='./bus\x00', 0x0) r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000240)=ANY=[], 0x2b) sendfile(r6, r4, 0x0, 0x4000000053d2) close(r0) sendmmsg(r1, &(0x7f0000000500)=[{{&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0}}], 0x1, 0x4000000) 15m2.285282058s ago: executing program 5 (id=781): r0 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000240)={0x0, 0x1b6c, 0x80, 0x1024002, 0x804d}, &(0x7f0000000000)=0x0, &(0x7f0000000380)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xfffffffffffffffb, &(0x7f00000000c0), 0x1, 0x40}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000800)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x98c8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x4, 0x412, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1e0}}}, 0x0) syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) r8 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0xe, 0x0, 0x0}, 0x94) r9 = getpid() sched_setscheduler(r9, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r11, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x14, r13, 0x701, 0x2070bd24, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x40850}, 0x4000) ioctl$VIDIOC_S_FREQUENCY(r8, 0x402c5639, &(0x7f0000000080)={0x0, 0x4, 0x927bf}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0xf60, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x180}}}, 0x0) 15m1.020046595s ago: executing program 5 (id=785): times(0xfffffffffffffffe) syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x4076, 0x101301) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0x2, 0x8, 0xd780, 0xa1, 0x0, 0x6, 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) setns(0xc9, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000140)={&(0x7f0000000300), 0xc, &(0x7f00000000c0)={&(0x7f0000000040), 0x2c}}, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, 0x0, 0x0) bind$rds(r3, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000240), 0x4) bind$rds(r4, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = io_uring_setup(0x5ba8, &(0x7f0000000000)={0x0, 0xfca0, 0x10, 0x1, 0x4}) exit(0x1ff) io_uring_register$IORING_REGISTER_RING_FDS(r5, 0x13, &(0x7f0000001bc0), 0x2) connect$rds(r3, &(0x7f0000000500)={0x2, 0x4e22, @loopback}, 0x10) sendto(r3, &(0x7f0000000600)='hello world', 0xb, 0x0, 0x0, 0x0) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x7, 0x8, 0x1014}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xd, 0x4, 0x4, 0x7, 0x100, r8, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) 14m55.237215789s ago: executing program 5 (id=795): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000640)='.\x00', 0x80000001) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x40) fallocate(r3, 0x0, 0x8e14, 0x8ffff) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x8, 0x9f, &(0x7f0000000540)=""/159, 0x41000, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000003}, 0x94) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000140)}], 0x1, 0x8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240), 0x620000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) 14m53.755149613s ago: executing program 5 (id=798): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0xa0000, 0x0) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000400)={0x9, 0x80006, 0x9e9c, 0x406, 0x7, "0ab45e60000a0904000000000000008000", 0x4, 0x2008386}) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) setpriority(0x0, r1, 0x4) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x541c, &(0x7f0000000100)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getpeername$packet(r6, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000000000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r9], 0x4c}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000240)={@local, @ipv4={'\x00', '\xff\xff', @empty}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c200a2, r7}) fcntl$getown(0xffffffffffffffff, 0x9) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000001900110100000000000000000a"], 0x1c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f00000000c0)="85f08d57786bed67a4fd346eee8fd8a06d3f20b212", 0x15) setsockopt$sock_int(r2, 0x1, 0x0, &(0x7f0000000040)=0x3ff, 0x4) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r12}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x2, 0x300}, {0x6e}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9, 0x0, 0x0, 0x10000000}, {0x3, 0x0, 0x6, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r11}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 14m45.658470388s ago: executing program 38 (id=784): r0 = socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r2 = openat(0xffffffffffffff9c, 0x0, 0x8040, 0x20) ioctl$FS_IOC_GET_ENCRYPTION_PWSALT(r2, 0x40081271, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet6_int(r2, 0x29, 0x18, &(0x7f0000000100)=0x7, 0x4) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x4c0c8) tkill(0x0, 0xb) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/rcu_expedited', 0x10000, 0x10) getsockname$packet(r6, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000000280)=0x14) r7 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000300), 0x20600, 0x0) r8 = epoll_create(0x2) epoll_ctl$EPOLL_CTL_ADD(r8, 0x1, r7, &(0x7f0000009b80)={0x40000012}) read$FUSE(r7, &(0x7f0000002540)={0x2020}, 0xfffffecf) syz_open_dev$tty1(0xc, 0x4, 0x1) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=@newlink={0x34, 0x10, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2031}, [@IFLA_XDP={0x14, 0x2b, 0x0, 0x1, [@IFLA_XDP_FD={0x8}, @IFLA_XDP_FLAGS={0x8, 0x3, 0x2}]}]}, 0x34}, 0x1, 0x0, 0x0, 0x20048054}, 0x0) 14m37.021452119s ago: executing program 39 (id=798): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0xa0000, 0x0) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000400)={0x9, 0x80006, 0x9e9c, 0x406, 0x7, "0ab45e60000a0904000000000000008000", 0x4, 0x2008386}) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) setpriority(0x0, r1, 0x4) ioctl$TIOCL_GETKMSGREDIRECT(r0, 0x541c, &(0x7f0000000100)) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xf0667000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_udp(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r6 = dup(r5) getpeername$packet(r6, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000040)=0x14) r8 = socket$netlink(0x10, 0x3, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_route(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[@ANYBLOB="4c0000001800010d00000000000000850a000000000000000500000014000500200100000000000000000100000000001c00090008000000", @ANYRES32=r9], 0x4c}}, 0x0) ioctl$sock_inet6_SIOCADDRT(r4, 0x890b, &(0x7f0000000240)={@local, @ipv4={'\x00', '\xff\xff', @empty}, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20c200a2, r7}) fcntl$getown(0xffffffffffffffff, 0x9) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000001c0)=ANY=[@ANYBLOB="1c0000001900110100000000000000000a"], 0x1c}, 0x1, 0x0, 0x0, 0x24000010}, 0x0) r11 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240), 0x50) prctl$PR_SET_MM_AUXV(0x23, 0xc, &(0x7f00000000c0)="85f08d57786bed67a4fd346eee8fd8a06d3f20b212", 0x15) setsockopt$sock_int(r2, 0x1, 0x0, &(0x7f0000000040)=0x3ff, 0x4) r12 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x7, 0x1c, &(0x7f00000002c0)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r12}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x4, 0x9, 0x0, 0x2, 0x300}, {0x6e}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfff0}, {0x5, 0x0, 0xc, 0x9, 0x0, 0x0, 0x10000000}, {0x3, 0x0, 0x6, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {}, {0x18, 0x2, 0x2, 0x0, r11}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 14m35.712596461s ago: executing program 7 (id=818): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) inotify_init1(0x80800) fallocate(0xffffffffffffffff, 0x0, 0x8e14, 0x8ffff) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240), 0x620000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) 14m33.411827354s ago: executing program 7 (id=819): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) r3 = dup2(r2, r2) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r3, &(0x7f0000002480)={0x2020}, 0x2020) write$vhost_msg_v2(r3, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/104, 0x68, 0x0, 0x1, 0x2}}, 0x48) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\x06\x00[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0xc0, 0x11b, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1f, 0x1000, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x4}, 0x50) r4 = open(&(0x7f0000000380)='./bus\x00', 0x109240, 0x145) r5 = creat(&(0x7f0000000200)='./bus\x00', 0x0) r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000240)=ANY=[], 0x2b) sendfile(r6, r4, 0x0, 0x4000000053d2) close(r0) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 14m24.57139044s ago: executing program 2 (id=832): syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 14m23.497656079s ago: executing program 7 (id=833): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x1000}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./my_configfs\x00', &(0x7f0000000200)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000300)='./my_sysfs\x00', 0x1ff) mkdir(&(0x7f0000000600)='./my_dev\x00', 0x1ff) mount(0x0, &(0x7f0000000700)='./my_dev\x00', &(0x7f0000000800)='devtmpfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000900)='./my_configfs/dlm/cluster1\x00', 0x1ff) write(0xffffffffffffffff, &(0x7f0000000b00)='cluster1\x00', 0x9) mkdir(&(0x7f0000000d00)='./my_configfs/dlm/cluster1/comms/1\x00', 0x1ff) r4 = openat(0xffffffffffffff9c, &(0x7f0000000e00)='./my_configfs/dlm/cluster1/comms/1/local\x00', 0x2, 0x0) write(r4, &(0x7f0000000f00)='1\x00', 0x2) r5 = openat(0xffffffffffffff9c, &(0x7f0000001000)='./my_configfs/dlm/cluster1/comms/1/addr\x00', 0x1, 0x0) write(r5, &(0x7f0000001100)="0200"/128, 0x80) r6 = openat(0xffffffffffffff9c, 0x0, 0x2, 0x0) write(r6, &(0x7f0000001300)='1\x00', 0x2) r7 = openat(0xffffffffffffff9c, &(0x7f0000001400)='./my_configfs/dlm/cluster1/scan_secs\x00', 0x2, 0x0) write(r7, &(0x7f0000001500), 0x0) mkdir(&(0x7f0000001700)='./my_configfs/dlm/cluster1/spaces/ls1\x00', 0x1ff) mkdir(&(0x7f0000001900)='./my_configfs/dlm/cluster1/spaces/ls1/nodes/1\x00', 0x1ff) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x10}}, [@TCA_RATE={0x6, 0x5, {0x0, 0x8}}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40040c0}, 0x20040084) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@newtfilter={0x4c, 0x2c, 0xd27, 0x60bd24, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x4, 0xa}, {}, {0xffff}}, [@filter_kind_options=@f_bpf={{0x8}, {0x20, 0x2, [@TCA_BPF_OPS={{0x6, 0x4, 0x1}, {0xc, 0x5, [{0x6, 0xd, 0x5, 0x4}]}}, @TCA_BPF_CLASSID={0x8, 0x3, {0x1, 0xb}}]}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) socket(0x400000000010, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) 14m23.120728063s ago: executing program 2 (id=834): r0 = socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) r1 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) fcntl$notify(r1, 0x402, 0x4) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fcntl$notify(r2, 0x402, 0x30) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x40000, 0x0) fcntl$notify(r3, 0x402, 0x40000029) writev(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000380)="d4c440070073008c4eed60c8e3fd7ba68e3e169042239e63b223a563a0fd7032a2c10ca83cb818f6d4acd3aff33261a3853027b9ca0ab86c7871608a00e9db0303bccbaf2b77a08475d9ce4870b2769eebbd662fd96d0dbaf9d8e1cd3a1a9d19dd40a8fc95056f5833b9877c087fd0a5744842a52d12cc9b8ff85cd0cbf6369c2c71febfc43ee3aac60f6af6d2617f78b3edf230c0136fdc11dac21786869bf2df0c8e407f1a9defc1a837d4aecc866055c558c8a1080fa670c9ada3a605c26e26631cc8fa1750f7ab26673618b14a44cb4c8aaeda593121e065afbd650897a077807abc53de6725bb584a9b528f83ac1e069fffbc87fb9a39c09d77a20ce1c6fef075eec86f697acbf810c9b99f948661650dba80979aec467d786f3ff7db5d797dcdb5ede5f7d9527f7b", 0x12b}], 0x1) r4 = socket$nl_generic(0x10, 0x3, 0x10) add_key(&(0x7f0000000e80)='rxrpc\x00', 0x0, &(0x7f0000000f00)="791cc5909359f56bab7b1ac0ca86ffcb9f03ecc67f05f08d7b34cbc422", 0x1d, 0xfffffffffffffffc) syz_genetlink_get_family_id$tipc2(&(0x7f0000000300), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r4, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000480)=ANY=[], 0x94}}, 0x0) r5 = creat(&(0x7f0000000080)='./file0\x00', 0x111) bind$inet(r0, &(0x7f0000000280)={0x2, 0x4e60, @dev={0xac, 0x14, 0x14, 0x35}}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev, @in=@rand_addr=0x64010101, 0x0, 0x0, 0xffff, 0x0, 0x2, 0x0, 0x20}, {0x0, 0x28c, 0x4}, {0x2000000000000007, 0x20000, 0x2}, 0x0, 0x0, 0x1}, {{@in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x2000000, 0x33}, 0x0, @in6=@private2={0xfc, 0x2, '\x00', 0x1}, 0x2, 0x3, 0x3, 0xb5, 0x0, 0x7fffffd}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) sendmsg$inet(0xffffffffffffffff, 0x0, 0xfffe) sendmmsg(0xffffffffffffffff, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(r1, 0x89f3, &(0x7f0000000200)={'syztnl0\x00', &(0x7f00000001c0)={'ip_vti0\x00', 0x0, 0x20, 0x8, 0x7, 0x7, {{0x7, 0x4, 0x0, 0x20, 0x1c, 0x67, 0x0, 0x6, 0x2f, 0x0, @private=0xa010102, @local, {[@generic={0x86, 0x7, "2c3c5f1cb2"}]}}}}}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), r7) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r7, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_DAT_CACHE(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x1c, r8, 0x305, 0x70bd26, 0x0, {0x7}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r9}]}, 0x1c}}, 0x24044080) r10 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r10, 0x107, 0xf, &(0x7f0000000100)=0x207, 0x4) ioctl$sock_SIOCGIFINDEX(r10, 0x8933, &(0x7f0000000040)={'ip6tnl0\x00', 0x0}) sendto$packet(r10, &(0x7f00000002c0)="05031600d3fc140000", 0x9, 0x4, &(0x7f0000000140)={0x11, 0x86dd, r11, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$ETHTOOL_MSG_EEE_GET(r5, &(0x7f00000007c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000700)={&(0x7f0000000540)={0x88, 0x0, 0x300, 0x70bd2a, 0x25dfdbff, {}, [@HEADER={0x4}, @HEADER={0x4}, @HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'pim6reg1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}]}, @HEADER={0x48, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r6}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'virt_wifi0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r9}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x4}]}, 0x88}, 0x1, 0x0, 0x0, 0x1}, 0x4000800) 14m11.938750659s ago: executing program 7 (id=848): mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x21c0, 0x103) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000100)='./file3\x00', 0xc1c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file4\x00', 0x11c0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000180)='./file5\x00', 0x61c0, 0x700) symlinkat(&(0x7f00000001c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file6\x00') r0 = landlock_create_ruleset(&(0x7f0000000240)={0x1fff}, 0x30, 0x0) prctl$PR_SET_NO_NEW_PRIVS(0x26, 0x1) landlock_restrict_self(r0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x1, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./file2\x00', 0x0, 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0, 0x0) unlinkat(0xffffffffffffff9c, &(0x7f0000000380)='./file1\x00', 0x200) unlinkat(0xffffffffffffff9c, &(0x7f00000003c0)='./file2\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000400)='./file7\x00', 0x21c0, 0x103) renameat2(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000480)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000500)='./file7\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000540)='./file7\x00', 0x1c0) renameat2(0xffffffffffffff9c, &(0x7f0000000580)='./file1\x00', 0xffffffffffffff9c, &(0x7f00000005c0)='./file7\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000600)='./file7\x00', 0x81c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000640)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000680)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f00000006c0)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000700)='./file7\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000740)='./file7\x00', 0xc1c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000780)='./file3\x00', 0xffffffffffffff9c, &(0x7f00000007c0)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000800)='./file3\x00', 0xffffffffffffff9c, &(0x7f0000000840)='./file7\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000880)='./file7\x00', 0x11c0, 0x0) renameat2(0xffffffffffffff9c, &(0x7f00000008c0)='./file4\x00', 0xffffffffffffff9c, &(0x7f0000000900)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000940)='./file4\x00', 0xffffffffffffff9c, &(0x7f0000000980)='./file7\x00', 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000009c0)='./file7\x00', 0x61c0, 0x700) renameat2(0xffffffffffffff9c, &(0x7f0000000a00)='./file5\x00', 0xffffffffffffff9c, &(0x7f0000000a40)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000a80)='./file5\x00', 0xffffffffffffff9c, &(0x7f0000000ac0)='./file7\x00', 0x0) symlinkat(&(0x7f0000000b00)='./file2\x00', 0xffffffffffffff9c, &(0x7f0000000b40)='./file7\x00') renameat2(0xffffffffffffff9c, &(0x7f0000000b80)='./file6\x00', 0xffffffffffffff9c, &(0x7f0000000bc0)='./file7\x00', 0x0) linkat(0xffffffffffffff9c, &(0x7f0000000c00)='./file6\x00', 0xffffffffffffff9c, &(0x7f0000000c40)='./file7\x00', 0x0) 14m11.936420499s ago: executing program 2 (id=849): syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYBLOB="040e04573120b3"], 0x7) 14m9.949021679s ago: executing program 2 (id=836): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) r3 = dup2(r2, r2) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r3, &(0x7f0000002480)={0x2020}, 0x2020) write$vhost_msg_v2(r3, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/104, 0x68, 0x0, 0x1, 0x2}}, 0x48) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\x06\x00[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0xc0, 0x11b, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1f, 0x1000, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x4}, 0x50) r4 = open(&(0x7f0000000380)='./bus\x00', 0x109240, 0x145) r5 = creat(&(0x7f0000000200)='./bus\x00', 0x0) r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000240)=ANY=[], 0x2b) sendfile(r6, r4, 0x0, 0x4000000053d2) sendmmsg(r1, &(0x7f0000000500)=[{{&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0}}], 0x1, 0x4000000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 14m9.947376657s ago: executing program 7 (id=837): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) r3 = inotify_init1(0x80800) inotify_add_watch(r3, &(0x7f0000000640)='.\x00', 0x80000001) r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x40) fallocate(r4, 0x0, 0x8e14, 0x8ffff) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0xd, &(0x7f0000000340)=ANY=[@ANYBLOB, @ANYRESDEC=r3], &(0x7f0000000000)='GPL\x00', 0x8, 0x9f, &(0x7f0000000540)=""/159, 0x41000, 0x9, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x80000003}, 0x94) vmsplice(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000140)}], 0x1, 0x8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240), 0x620000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) 14m6.843252617s ago: executing program 7 (id=840): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d20bddda7d1db9342de76eec7967fe97751f13a23aeaacb0565c1c2251560ed1"}}) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000940)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000008c0)=[0x0], &(0x7f0000000900), 0x0, 0x1, 0x0, 0x0, r2}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYRES16=r4, @ANYBLOB="01000000000000000000010000001c000180060001000200000008000300640101010800060006000000"], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = syz_open_procfs(0x0, 0x0) pread64(r6, &(0x7f0000000500)=""/31, 0x1f, 0x6677) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000000300)=""/102400, 0x19000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x46032, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') preadv(r8, &(0x7f0000000340)=[{&(0x7f0000003200)=""/4096, 0x1000}], 0x1, 0x2c2, 0xca) close(r5) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/profiling', 0x1, 0x1cc) writev(r9, &(0x7f00000001c0)=[{&(0x7f0000000400)="392c000013000347", 0x8}], 0x1) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r9, 0x114, 0xa, &(0x7f0000019300)=ANY=[@ANYBLOB="03bb0354c497ce8ea30222944779ea6d7ab87c96ae1c3361e469ca1476b664aa4da519378e3a9ede7f5b1df166f1242459c650bb9c01d7cbe038331467cdc4b7422c6aeea554821cdd691ec8bb958302bf976b09ad30baafabbfff824d41a67a8eeeda98def17d55c633b29e7344f6c22e7fddaf9959d906956438ceaebaa5f288efd8367b327d55c300285ea04d825a57f84fad8a75354cfd140e43acc8de9c65a431100572b499dbbfb1a8a79b2a2d3a9a338860c9c65a2efc90d45677f3779375324b1148b0239cae840ec8742afd69ad9f727890b32a0aef496eb9327b52378ead6266a159bc93d235442c5c03aa3bb3082c6c136c174c74fc7b4f6fcc6cb4a2f0481116e3d3"], 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) syz_open_procfs(0x0, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0xf, 0x183043) 14m5.019196522s ago: executing program 2 (id=842): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x3) syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) inotify_init1(0x80800) fallocate(0xffffffffffffffff, 0x0, 0x8e14, 0x8ffff) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240), 0x620000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) 13m59.930731185s ago: executing program 2 (id=845): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) r3 = dup2(r2, r2) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r3, &(0x7f0000002480)={0x2020}, 0x2020) write$vhost_msg_v2(r3, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/104, 0x68, 0x0, 0x1, 0x2}}, 0x48) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\x06\x00[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0xc0, 0x11b, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1f, 0x1000, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x4}, 0x50) r4 = open(&(0x7f0000000380)='./bus\x00', 0x109240, 0x145) r5 = creat(&(0x7f0000000200)='./bus\x00', 0x0) r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000240)=ANY=[], 0x2b) sendfile(r6, r4, 0x0, 0x4000000053d2) sendmmsg(r1, &(0x7f0000000500)=[{{&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0}}], 0x1, 0x4000000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 13m51.61410181s ago: executing program 40 (id=840): r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f0000000200)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_SETCRTC(r0, 0xc06864a2, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x59, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "d20bddda7d1db9342de76eec7967fe97751f13a23aeaacb0565c1c2251560ed1"}}) r1 = syz_open_dev$dri(&(0x7f0000000140), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000009c0)={0x0, 0x0, &(0x7f0000000940)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r1, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f00000008c0)=[0x0], &(0x7f0000000900), 0x0, 0x1, 0x0, 0x0, r2}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000180)=ANY=[@ANYRES16=r4, @ANYBLOB="01000000000000000000010000001c000180060001000200000008000300640101010800060006000000"], 0x30}, 0x1, 0x0, 0x0, 0xaa34a4cfdf933201}, 0x10) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = syz_open_procfs(0x0, 0x0) pread64(r6, &(0x7f0000000500)=""/31, 0x1f, 0x6677) sched_setaffinity(0x0, 0x8, &(0x7f0000000000)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000000300)=""/102400, 0x19000) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x46032, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000000)='smaps\x00') preadv(r8, &(0x7f0000000340)=[{&(0x7f0000003200)=""/4096, 0x1000}], 0x1, 0x2c2, 0xca) close(r5) r9 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/kernel/profiling', 0x1, 0x1cc) writev(r9, &(0x7f00000001c0)=[{&(0x7f0000000400)="392c000013000347", 0x8}], 0x1) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r9, 0x114, 0xa, &(0x7f0000019300)=ANY=[@ANYBLOB="03bb0354c497ce8ea30222944779ea6d7ab87c96ae1c3361e469ca1476b664aa4da519378e3a9ede7f5b1df166f1242459c650bb9c01d7cbe038331467cdc4b7422c6aeea554821cdd691ec8bb958302bf976b09ad30baafabbfff824d41a67a8eeeda98def17d55c633b29e7344f6c22e7fddaf9959d906956438ceaebaa5f288efd8367b327d55c300285ea04d825a57f84fad8a75354cfd140e43acc8de9c65a431100572b499dbbfb1a8a79b2a2d3a9a338860c9c65a2efc90d45677f3779375324b1148b0239cae840ec8742afd69ad9f727890b32a0aef496eb9327b52378ead6266a159bc93d235442c5c03aa3bb3082c6c136c174c74fc7b4f6fcc6cb4a2f0481116e3d3"], 0x4) socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r5, &(0x7f0000000040)={0xa, 0x4e22, 0x8, @empty, 0x2}, 0x1c) syz_open_procfs(0x0, 0x0) syz_open_dev$loop(&(0x7f0000000000), 0xf, 0x183043) 13m44.647132122s ago: executing program 41 (id=845): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, &(0x7f0000000080)=0x200000000) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) r3 = dup2(r2, r2) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r3, &(0x7f0000002480)={0x2020}, 0x2020) write$vhost_msg_v2(r3, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/104, 0x68, 0x0, 0x1, 0x2}}, 0x48) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\x06\x00[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0xc0, 0x11b, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1f, 0x1000, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x4}, 0x50) r4 = open(&(0x7f0000000380)='./bus\x00', 0x109240, 0x145) r5 = creat(&(0x7f0000000200)='./bus\x00', 0x0) r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000240)=ANY=[], 0x2b) sendfile(r6, r4, 0x0, 0x4000000053d2) sendmmsg(r1, &(0x7f0000000500)=[{{&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0}}], 0x1, 0x4000000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 12m10.823941598s ago: executing program 3 (id=1019): syz_mount_image$msdos(&(0x7f0000000200), &(0x7f0000000000)='./file1\x00', 0x0, &(0x7f0000000080)={[{@fat=@nfs}, {@fat=@dos1xfloppy}, {@dots}, {@fat=@nocase}, {@fat=@tz_utc}]}, 0x0, 0x1fd, &(0x7f0000000440)="$eJzs3E1rU1kYB/DTTt+mMy1ZDcwsZg7jRjcX27ULi7RQDCjaiC8gpDTFkJjU3CwSEYxbV34OEdwILgRx4bbfwl0RSleuvKKxrS2tVu1LqL/fJg/8zyHnuRcOl3Phrpx5dLuymCaLYSSEkb7QfzZ0wlAIudAf1nXCqadX1x5evnb9/FQ+P30pxpmpuYnJGP8d/+/ljXtP/n/V/OPKs/EXw2E5d3NldfLN8l/Lf6+8n7tVTmM5jbV6MxbjfL3eLM5XS3GhnFaSGC9WS8W0FMu1tNTYki9W60tL7VisLYyNLjVKaRqLtXaslNqxWY/NRjsW74cQYpIkcWw0sIM/9zqw8PhdloXVLMuy4U7Ismz3oa/3aW30lD3ff46lLzb1kRDedlqFVqH7281nZvPTp+Mnuc1Za61W4beNfKKbx635YBj9nE/umA+Fkye6+cfs3IX8tvz3sHDw7QMAAAAAwLGUxA07nu8nyW55t5qZXX9PvP18fyD8M3AoLQAAAADfkLbvVorVaqnxw8VgCOEnpvdIcTy62L140BvL2JeiLxzkX+SOvMHnPXGdj3pnAgAA9tvmQ/93TrzTd0ArAgAAAAAAAAAAAAAAAAAAgF/PYXxO7Kh7BAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4mg8BAAD//+HNaaM=") 12m10.144060726s ago: executing program 3 (id=1022): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) socket$l2tp(0x2, 0x2, 0x73) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket(0x23, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$dri(0x0, 0x1ff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x1a0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 0x9}, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000080)='pstore\x00', 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x40008004) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x3, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x20, 0x61, 0x11, 0x8c}}, 0x0, 0x6, 0x0, 0x0, 0x41000}, 0x94) socket$nl_rdma(0x10, 0x3, 0x14) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, 0x0, 0x95, 0x102) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, 0x0) shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 12m4.11203225s ago: executing program 3 (id=1034): syz_emit_vhci(&(0x7f0000000240)=ANY=[@ANYBLOB="02c90012000e00050014fc0a"], 0x17) 12m3.544579597s ago: executing program 3 (id=1039): syz_mount_image$udf(&(0x7f0000000080), &(0x7f0000000740)='./file1\x00', 0xa00004, &(0x7f0000000280)={[{@iocharset={'iocharset', 0x3d, 'cp863'}}, {@uid_forget}, {@anchor={'anchor', 0x3d, 0xb}}, {@shortad}, {@nostrict}, {@lastblock={'lastblock', 0x3d, 0x40}}, {@gid_ignore}, {}, {@volume={'volume', 0x3d, 0x3}}, {@anchor={'anchor', 0x3d, 0x82}}, {@rootdir={'rootdir', 0x3d, 0xd}}, {@longad}, {@nostrict}]}, 0x5, 0xc6d, &(0x7f0000002600)="$eJzs3U9sHNd9B/DfG5LiSm4rJk4VJ42DTVuksmK5+hdTtgp3VdNsA8iyEIq5BeBKpNSFKZIgqUY23JbppYceAhRFDzkRaIUCKRoYTRH0yLQukFx8KHLqiWhhIyh6YIsAAVq4G8zsW3FFkZYsiiIlfz429d2deW/mvZnVDEXwzQsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIOJ3Xjl77HjaZEXfLjQGAHgozo999diJze7/AMBj6+JW//4HAAAAAAAAAAAAAAD2ihRFPBkp5s6vpYnqfUftXGvg+o3xkdHNq+1PVc2+qnz5VTt+4uSpLz8/fLqb51ozH1L/QftsvDZ28Wz95dlrc/NTCwtTk/Xxmdbl2cmpe97CdutvdKQ6APVrr1+fvHJloX7iuZO3rb4x9P7gE4eGzgw/c/TpbtnxkdHRsfUitd7y/ffdkI6tRnjsiyKORopnv/uT1IyIIrZ/LGoP99xvtL/qxJGqE+Mjo1VHplvNmcVy5YXugSgi6j2VGt1jtPm5iP6Bh9qHrTUilsrmlw0+UnZvbK4537w0PVW/0JxfbC22ZmcupE5ry/7Uo4jTKWI5IlYH79zcQBTRHym+fXAtXcpP/aiOw5eqgcFbt6PYwT7eg7Kd9YGI5eIROGd72GAU8Wqk+Ok7h+Nyvs5U15ovRrxa5vcjbpb5UkQqPxinIt7b5HPEo6k/iviz8vyfWUuT1fWge10597X6V2auzPaU7V5XPuL94Y4rxS7dH/ZvyIdjj1+balFEs7rir6X7/2YHAAAAAAAAAAAAAAAAgAdtfxTxmUjxyr/+QTWuOKpx6QfPDP/u0C/2jhl/6i7bKcs+FxFLxb2Nyd2XBwZeSBdS2uWxxB9ntSjiD/P4v2/udmMAAAAAAAAAAAAAAAAAAAA+1or4caR48d3DaTl65xRvzVytX2xemu7MCtud+7c7Z3q73W7XUycbOSdyLuVczrmSczVnFLl+zkbOiZxLOZdzruRczRl9uX7ORs6JnEs5l3Ou5FzNGf25fs5GzomcSzmXc67kXM0Ze2TuXgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACAx0kRRXwQKb71jbUUKSIaERPRyZXB3W4dAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFAaTEV8L1LUf69xa1l/RKTq/47D5R+norGvzE9GY7jMl6JxNmezyv7GN3eh/WzPQCriR5FisPb2rROez/9A592tj0HcfGv93Wf7O9nXXTn0/uAThw6eGR79/FNbvU6bNeDIudbM9Rv18ZHR0bGexf1575/sWTaU91s8mK4TEQtvvPl6c3p6av7+X5Qfgfus3j2T29j7w3yR+ne5qf+/Bw7Cx+lF9O/e3nf778Xt14naLlyb2Hnl/f+9SPGb7/5b94bfuf/X4hc6727d4eNnf7R+/39x44bu8f7fv7Fevv+Xd4LN7v9P9ix7MX83MtAfUVu8NjdwKKK28MabR1vXmlenrk7NnDp27IXh4RdOHhvYF1G70pqe6nn1QA4XAAAAAAAAAAAAAAAAwMOTivjtSNH80VqqR8SNarzW0JnhZ44+3Rd91Xir28ZtvzZ28Wz95dlrc/NTCwtTk/Xxmdbl2cmpe91drRruNT4yuiOduav9O9z+/bWXZ+femG9d/f3FTdcfqJ29tLA437y8+erYH0VEo3fJkarB4yOjVaOnW82ZquqFTQfTf3QDqYh/jxSXT9XTF/KyPP5/4wj/uPnWC7c+C0sbN/QAx/9//sD6+L9P9BQt95lSET+LFL/x50/FF6p2Hog7jlku99eR4sjpz+Vysa8s121D57kCnZGBZdn/jhR//8HtZbvjIZ9cL3v8Ix3cR0B5/g9Giu/96XfiV/Oy25//0Hv+14/fgY0b2qHnP3yqZ9mB255XsO2uk8//0Ujx0pNvx69VS/73Q5//0X1iw+FO4fXnc+zQ+f/lnmVDeb+//qA6DwAAAAAAAAAA8AgbSEX8TaT4wWh/ej4vu5ff/5vcuKEd+v2vT/csm3ww8xXd9cW2DyoAAAAA7BEDqYgfR4qri2/fGkN9+/jvnvGfv7U+/nMkbVhb/Zzvl6rnBjzIn//1Gsr7ndh+twEAAAAAAAAAAAAAAAAAAGBPSamI5/N86hPVeP7JLedTX4kUr/zns7lcOlSW684DP1T9WTs/O3P07PT0bC0Wm5emp+pjc83LU2XdT0WKtb/6XK5bVPOrd+eb78zxvj4X+3ykGP3bbtnOXOzduck784HX2u2I42XZT0SK//i728vmqanz3NHVdk+UZf8yUnz9Hzcve2i97Mmy7HcixQ+/Xu+WPVCW7T4f9dPrZZ+7PFvswFkBAAAAAAAAAAAAAAAAAADg42YgFfEnkeK/ri3fGsuf5/8f6HlbuflWz3z/G9yo5vkfqub/3+r1/cz/Xz1XYGmrvQIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAwOMpRRFvRoq582tpZbB831E715q5fmN8ZHTzavtTVbOvKl9+1Y6fOHnqy88Pn+7mh9d/0D4Tr41dPFt/efba3PzUwsLUZH18pnV5dnLqnrew3fobHakOQP3a69cnr1xZqJ947uRtq28MvT/4xKGhM8PPHH26W3Z8ZHR0rKdM/8B97/0OaYvl+6KIv4gUz373J+kHgxFFbP9Y3OWzs9P2V504UnVifGS06sh0qzmzWK680D0QRUS9p1Kje4zuei7+r91uP6yubKIRsVQ2v2zwkbJ7Y3PN+eal6an6heb8YmuxNTtzIXVaW/anHkWcThHLEbE6eOfmBqKI1yPFtw+upX8ajOjrHocvnR/76rETW7ej2ME+3oOynfWBiOXiXs4ZWxmMIv4hUvz0ncPxz4MR/dH5ii9GvFrm9yNuRud8p/KDcSrivU0+Rzya+qOI/ynP/5m19M5geT3oXlfOfa3+lZkrsz1lu9eVbd4f2u32H5e5e/eHh2mPX5tqUcQPqyv+WvoXf68BAAAAAAAAAAAAAAAA9pAifiVSvPju4VSND741prg1c7V+sXlpujOsrzv2rztmut1ut+upk42cEzmXci7nXMm5mjOKXD9no8xauz2R3y/lXM65knM1Z/Tl+n3VcMV2I7+fyLmUcznnSs7VnNGf6+ds5JzIuZRzOedKztWcsUfG7gEAAAAAAAAAAAAAAAAAAI+Xovovxbe+sZbag535pSeikyvmA33s/TwAAP//9xz3UA==") 11m57.916058823s ago: executing program 3 (id=1045): r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$int_in(r0, 0x5452, &(0x7f0000000000)=0x6) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e20, @broadcast}, 0x10) openat$uinput(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) getpid() syz_clone(0x600, 0x0, 0x33, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x400000bce) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000032680)=""/102400, 0x19000) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) r2 = inotify_init1(0x80800) inotify_add_watch(r2, &(0x7f0000000640)='.\x00', 0x80000001) fallocate(0xffffffffffffffff, 0x0, 0x8e14, 0x8ffff) sendto$inet(r0, &(0x7f0000000140), 0xffffffffffffff58, 0x20008005, &(0x7f0000000100)={0x2, 0x4e20}, 0x10) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x11, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00}, 0x94) socket$inet6_tcp(0xa, 0x1, 0x0) socket$netlink(0x10, 0x3, 0x4) openat$vcsa(0xffffffffffffff9c, &(0x7f0000000240), 0x620000, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) syz_clone3(&(0x7f0000000900)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)) 11m53.99409089s ago: executing program 3 (id=1049): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) socket$l2tp(0x2, 0x2, 0x73) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket(0x23, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$dri(0x0, 0x1ff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x1a0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 0x9}, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000080)='pstore\x00', 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x40008004) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x3, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x20, 0x61, 0x11, 0x8c}}, 0x0, 0x6, 0x0, 0x0, 0x41000}, 0x94) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, 0x0, 0x95, 0x102) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, 0x0) shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 11m37.753547349s ago: executing program 42 (id=1049): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) socket$l2tp(0x2, 0x2, 0x73) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket(0x23, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$dri(0x0, 0x1ff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x1a0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 0x9}, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000080)='pstore\x00', 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x40008004) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x3, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x20, 0x61, 0x11, 0x8c}}, 0x0, 0x6, 0x0, 0x0, 0x41000}, 0x94) sendmsg$RDMA_NLDEV_CMD_SYS_SET(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, 0x0, 0x95, 0x102) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, 0x0) shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 16.116868712s ago: executing program 8 (id=2579): syz_usb_connect$sierra_net(0x0, 0x0, 0x0, 0x0) io_uring_setup(0x21e9, 0x0) r0 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, &(0x7f0000000080)={'dt2801\x00', [0x3c4, 0x10, 0x2, 0x3, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0xfe, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3ff, 0x9, 0x200, 0xe2df, 0xaa14, 0x1, 0x4, 0x0, 0xffffa3bc, 0xf58, 0x6]}) 12.744711911s ago: executing program 8 (id=2588): r0 = socket(0x11, 0x2, 0x0) setsockopt(r0, 0x107, 0x14, &(0x7f0000000000)="11106e00", 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000001c0)={'macvlan1\x00', 0x0}) sendmmsg(r0, &(0x7f0000000940)=[{{&(0x7f0000000040)=@ll={0x11, 0xf8, r1, 0x1, 0x6, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x35}}, 0x80, 0x0}}], 0x1, 0x8090) 12.721908213s ago: executing program 0 (id=2589): syz_mount_image$ext4(&(0x7f00000004c0)='ext4\x00', &(0x7f0000000500)='./file0\x00', 0x810, &(0x7f0000000000)={[{@errors_remount}, {@grpquota}]}, 0x8, 0x4fe, &(0x7f0000000a40)="$eJzs3c9vG1kdAPDvTOImm3U3XdgDIGDLslDQqs6P7kYrONC9gNBqJcSKE4duSNwoil1HcVKa0ENy5I5EJU7wJ3DjgNQTB27c4MalHJAqqEANUg9GM54mJoljs03iJv58pPHMe+P4+57t957nJc4LYGhdjYjtiLgUEZ9ExGSRnxRb3Gxv2f2ePrm/sPvk/kISrdbH/0jy81ledPxM5tXiMccj4offi/hJcjhuc3NrZb5Wq64V6an1+upUc3Pr+nJa5MzOzcxNv3/jvdkTq+ub9d8+/u7yhz/6/e++9OhP29/8WVas8s8v5+c663GS2lUvRbkjbzQiPjyNYAMyWrx/OH+y1vaZiHgrb/+TMZK/mv05olkDAOdAqzUZrcnONABw0WXX/+VI0koxF1CONK1U2nN4b8REWms019+ZbGzcWYx8DutKlNLby7XqdDFXeCVKSZaeyY/307MH0jci4vWI+MXYK3m6stCoLQ7ygw8ADLFXD4z//x5rj/8AwAU3PugCAABnzvgPAMPH+A8Aw+f/GP/7/3YgAPBSc/0PAMPH+A8Aw6fn+L9zNuUAAM7EDz76KNtau8X/v168u7nx7fLd64vV5kqlvrFQWWisrVaWGo2lWrWy0Gr1erxao7E68+5esrm5dave2Lizfmu5Pr9UvVUtnXJ9AIDeXn/z4V+SiNj+1iv5Fh1rORir4WJLB10AYGBGBl0AYGB8nweGVx/X+KYB4ILrtZZn1z8RemDxVzivrn3e/D8MK/P/MLw+3fz/d068HMDZM/8Pw6vVSqz5DwBDxhw/8EK//wcAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAhVc63JK3ka4FvZ7dppRJxOSKuRCm5vVyrTkfEaxHx57HSWJaeGXShAYAXlP49Kdb/ujb5dvng2UvJf8byfUT89Fcf//Le/Pr62kyW/8+9/PUHRf7spUFUAADodPNwVnucLvYdF/JPn9xfeL6dZREff9BeXDSLu1ts7TOjMZrvx6MUERP/Sop0W/Z5ZeQE4m/vRMTn9ut/ryNCOZ8Daa98ejB+FvvyKcTff/4Pxk//J36an8v2pfy5+OwJlAWGzcMP2v1k0fayJla0vzSu5vuj2/943kO9uOf93+6h/i/d6/9GDsVP8jZ/dS99fEkev/uH7x/KbE22z+1EfGH0qPjJXvykS//7dp91/OsXv/xWt3OtX0dci6Pjt9XzbnZqvb461dzcur5cn1+qLlXvzM7OzcxNv3/jvdmpfI66ffvHAw//rFjm/rWuz81OxESX+OM96v+1Puv/m2ef/Pgrx8T/xlePfv3fOCZ+NiZ+vc/48xM3uy7fncVf7FL/Xq//O33Gf/S3rcU+7woAnIHm5tbKfK1WXetxkH3W7HUfB+fzILYjXoJi9DpIi7fsy1KeC35wTKeRnlHnBJyq/UY/6JIAAAAAAAAAAAAAAADdNDe3VsbidL9ONOg6AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAcHH9NwAA//8tM9Id") r0 = creat(&(0x7f00000007c0)='./bus\x00', 0x182) r1 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x181242, 0x148) ioctl$EXT4_IOC_MOVE_EXT(r1, 0xc028660f, &(0x7f0000000740)={0xc, r0, 0x6, 0x13, 0xa697, 0x3}) 10.653925984s ago: executing program 8 (id=2592): socketpair(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@base={0x10, 0x4, 0x4, 0x2, 0x4, 0xffffffffffffffff, 0x1}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000180)={{r1}, &(0x7f0000000040), &(0x7f0000000140)=r0}, 0x20) bpf$MAP_DELETE_ELEM(0x3, &(0x7f0000000080)={r1, &(0x7f0000000040)}, 0x20) 10.145177414s ago: executing program 8 (id=2595): times(0xfffffffffffffffe) syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x4076, 0x101301) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0x2, 0x8, 0xd780, 0xa1, 0x0, 0x6, 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) setns(0xc9, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000140)={&(0x7f0000000300), 0xc, &(0x7f00000000c0)={&(0x7f0000000040), 0x2c}}, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, 0x0, 0x0) bind$rds(r3, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000240), 0x4) bind$rds(r4, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = io_uring_setup(0x5ba8, &(0x7f0000000000)={0x0, 0xfca0, 0x10, 0x1, 0x4}) exit(0x1ff) io_uring_register$IORING_REGISTER_RING_FDS(r5, 0x13, &(0x7f0000001bc0), 0x2) connect$rds(r3, &(0x7f0000000500)={0x2, 0x4e22, @loopback}, 0x10) sendto(r3, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x7, 0x8, 0x1014}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xd, 0x4, 0x4, 0x7, 0x100, r8, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) 10.052986252s ago: executing program 1 (id=2596): r0 = socket$inet6(0xa, 0x2, 0x0) close(0x3) socket$l2tp6(0xa, 0x2, 0x73) sendmsg$inet6(r0, &(0x7f00000000c0)={&(0x7f0000000000)={0xa, 0x4e21, 0x20080000, @mcast2, 0x6}, 0x1c, 0x0, 0x0, &(0x7f0000000500)=[@hoplimit={{0x14, 0x29, 0x34, 0x7}}], 0x18}, 0x800) 10.018605977s ago: executing program 0 (id=2597): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000001b80)=ANY=[@ANYBLOB="12010000000000106161154d00000000000109022400010000000009040100010300000009210000800122f80409058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_connect(0x2, 0x113, &(0x7f0000000380)={{0x12, 0x1, 0x300, 0xeb, 0xe1, 0x80, 0xff, 0x7b8d, 0x91a1, 0x8900, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x101, 0x1, 0x80, 0x5, 0x10, 0x1c, "", [{{0x9, 0x4, 0x30, 0x86, 0x2, 0x8, 0x3, 0x1, 0x1, [], [{{0x9, 0x5, 0x6, 0x0, 0x5b7, 0x11, 0xa, 0x7, [@generic={0xa2, 0x31, "2d4b8f0e5cf71c353b2a329b66ee16379f87536158f8c8934e82918f1c02796a8b3ce2b5552d640cb4b1d3bdf477ae5b3094e301d16aea2169a9b18e4fc8520a8bfd6151e7e4274060c2bc5905b6407a00cb84162ea82f8f16aa3640e6dd7c269358d8aaf72521847cef8e1069fee5953b2998cfe2fb9d21356acc9f01bfdd3de040c11ba2c113dcd48199cc9fe093d4ef9e01fca2574e5a5fea4da9191c54cc"}]}}, {{0x9, 0x5, 0x2, 0x10, 0x20, 0x5, 0xb, 0x91, [@generic={0x3b, 0x22, "853db8c633b98c7dd5e39fe65dfdf09ca033c1eb2e5a9242484c27d0a57ac65917ffa23a1968b8ef7f315168882faa2c9083f96644b0548670"}]}}]}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000340)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220508"], 0x0}, 0x0) 9.679583762s ago: executing program 1 (id=2600): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), r0) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000640)={&(0x7f00000001c0)={0x40, r2, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_FRAME={0x22, 0x33, @action={{{}, {0x3}, @broadcast, @device_b, @from_mac=@broadcast, {0x0, 0x400}}, @ext_ch_sw={0x4, 0x4, {{0x0, 0x3, 0xe, 0xf9}, @void}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 9.568829634s ago: executing program 9 (id=2601): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl802154(&(0x7f00000003c0), r0) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000000)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_NEW_SEC_DEVKEY(r0, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)={0x1c, r1, 0x1, 0xfffffffd, 0xfffffffd, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}]}, 0x1c}}, 0x0) 9.462782438s ago: executing program 4 (id=2602): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000002c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000080)={0x6c, r1, 0x1, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_FRAME={0x4e, 0x33, @beacon={{{}, {0x5}, @broadcast, @device_a, @initial, {0x0, 0x5}}, 0x2, @random=0x1, 0x1, @void, @val={0x1, 0x1, [{0x6c}]}, @void, @val={0x4, 0x6, {0x6, 0x15, 0x3, 0x9}}, @val={0x6, 0x2, 0x3}, @void, @val={0x25, 0x3, {0x0, 0x7c, 0x7d}}, @val={0x2a, 0x1}, @val={0x3c, 0x4, {0x0, 0x3, 0xb4, 0x5}}, @void, @void, @val={0x71, 0x7, {0xffffffffffffffff, 0x1, 0x1, 0xffffffffffffffff, 0x2, 0x1, 0x60}}, @void}}]}, 0x6c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20000080) 9.428297757s ago: executing program 6 (id=2603): mkdir(&(0x7f0000000040)='./sys_mount\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./sys_mount\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./sys_mount/block/nullb0/queue/scheduler\x00', 0x2, 0x0) write(r0, &(0x7f0000000200)='bf', 0x2) 9.24704704s ago: executing program 1 (id=2604): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)={0x8c, r2, 0x1, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_CSA_C_OFFSETS_TX={0x4}, @NL80211_ATTR_FRAME={0x6c, 0x33, @beacon={{{0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {0x9}, @device_b, @device_a, @initial, {0xf, 0x5}}, 0xffffffffffffffff, @default, 0x1000, @val={0x0, 0x6, @default_ibss_ssid}, @void, @val={0x3, 0x1, 0x2c}, @void, @val={0x6, 0x2, 0x1ff}, @val={0x5, 0x3, {0x5, 0x97, 0x5}}, @void, @val={0x2a, 0x1, {0x0, 0x0, 0x1}}, @void, @val={0x2d, 0x1a, {0x400, 0x2, 0x5, 0x0, {0x2, 0xb7b, 0x0, 0x347, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x0, 0x100, 0x1}}, @void, @val={0x71, 0x7, {0x69, 0x0, 0x1, 0x0, 0x1, 0x7, 0x20}}, @val={0x76, 0x6, {0x3, 0x0, 0x2f, 0x6}}}}]}, 0x8c}, 0x1, 0x0, 0x0, 0xc0}, 0x0) 9.120031605s ago: executing program 4 (id=2605): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) socket$l2tp(0x2, 0x2, 0x73) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket(0x23, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$dri(0x0, 0x1ff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x1a0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 0x9}, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000080)='pstore\x00', 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x40008004) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x3, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x20, 0x61, 0x11, 0x8c}}, 0x0, 0x6, 0x0, 0x0, 0x41000}, 0x94) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, 0x0, 0x95, 0x102) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, 0x0) shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 9.044132728s ago: executing program 9 (id=2606): socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) socket$l2tp(0x2, 0x2, 0x73) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket(0x23, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$dri(0x0, 0x1ff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x1a0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 0x9}, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000080)='pstore\x00', 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x40008004) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x3, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x20, 0x61, 0x11, 0x8c}}, 0x0, 0x6, 0x0, 0x0, 0x41000}, 0x94) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, 0x0, 0x95, 0x102) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, 0x0) shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 8.620501959s ago: executing program 6 (id=2607): r0 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000180), 0xffffffffffffffff) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000ec0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)={0x48, r0, 0x1, 0x0, 0x0, {}, [@NL802154_ATTR_IFINDEX={0x8, 0x3, r2}, @NL802154_ATTR_SEC_KEY={0x2c, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_ID={0x28, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_IMPLICIT={0x1c, 0x3, 0x0, 0x1, [@NL802154_DEV_ADDR_ATTR_MODE={0x8, 0x2, 0x2}, @NL802154_DEV_ADDR_ATTR_PAN_ID={0x6, 0x1, 0xffff}, @NL802154_DEV_ADDR_ATTR_SHORT={0x6, 0x3, 0xaaa0}]}, @NL802154_KEY_ID_ATTR_MODE={0x8}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004005}, 0x0) 8.619512633s ago: executing program 8 (id=2608): r0 = syz_usb_connect$hid(0x1, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="120100020000000879215300000000000001090224000100000000090401130103000100092100000001220b0009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f00000000c0)={0x20, 0x3, 0xb, {0xb, 0x22, "e749c54c8810b252e9"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) 7.532012565s ago: executing program 0 (id=2609): times(0xfffffffffffffffe) syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x4076, 0x101301) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0x2, 0x8, 0xd780, 0xa1, 0x0, 0x6, 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) setns(0xc9, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000140)={&(0x7f0000000300), 0xc, &(0x7f00000000c0)={&(0x7f0000000040), 0x2c}}, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, 0x0, 0x0) bind$rds(r3, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000240), 0x4) bind$rds(r4, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = io_uring_setup(0x5ba8, 0x0) exit(0x1ff) io_uring_register$IORING_REGISTER_RING_FDS(r5, 0x13, &(0x7f0000001bc0), 0x2) connect$rds(r3, &(0x7f0000000500)={0x2, 0x4e22, @loopback}, 0x10) sendto(r3, &(0x7f0000000600)='hello world', 0xb, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x7, 0x8, 0x1014}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xd, 0x4, 0x4, 0x7, 0x100, r8, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) 7.456293414s ago: executing program 1 (id=2610): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r0, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x3, 0x0}}, @in={0x2, 0x4e24, @remote}]}, &(0x7f0000000340)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000000c0)={r1, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0xce024d}, 0x9c) 7.166826986s ago: executing program 9 (id=2611): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r0, 0x84, 0x1, &(0x7f0000000000)={r1, 0x7fff, 0x2, 0x6e, 0x81}, 0x14) 7.11947237s ago: executing program 6 (id=2612): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000700)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)={0x20, r1, 0x5, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SCAN_SSIDS={0x4}]}, 0x20}}, 0x0) 7.101762385s ago: executing program 4 (id=2613): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000000)={0x30, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @crypto_settings=[@NL80211_ATTR_CIPHER_SUITES_PAIRWISE={0x8, 0x49, [0xfac00]}]]}, 0x30}}, 0x4c8d4) 7.019109151s ago: executing program 1 (id=2614): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/power/state\x00', 0x2, 0x0) write(r0, &(0x7f0000000140)='mem', 0x3) 6.616148875s ago: executing program 6 (id=2615): times(0xfffffffffffffffe) syz_open_dev$I2C(&(0x7f0000000000), 0x2, 0x40402) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000180), 0x4076, 0x101301) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f0000000040)={0x2, 0x8, 0xd780, 0xa1, 0x0, 0x6, 0x0}) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0x401, 0x20000, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8003}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_GENEVE_REMOTE6={0x14, 0x7, @private0}, @IFLA_GENEVE_PORT={0x6, 0x5, 0x4e21}]}}}]}, 0x50}, 0x1, 0x0, 0x0, 0x240008c4}, 0x4054) setns(0xc9, 0x0) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r2, &(0x7f0000000140)={&(0x7f0000000300), 0xc, &(0x7f00000000c0)={&(0x7f0000000040), 0x2c}}, 0x0) r3 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r3, 0x114, 0x8, 0x0, 0x0) bind$rds(r3, &(0x7f0000000400)={0x2, 0x4e21, @loopback}, 0x10) r4 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_TRANSPORT(r4, 0x114, 0x8, &(0x7f0000000240), 0x4) bind$rds(r4, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r5 = io_uring_setup(0x5ba8, &(0x7f0000000000)={0x0, 0xfca0, 0x10, 0x1, 0x4}) exit(0x1ff) io_uring_register$IORING_REGISTER_RING_FDS(r5, 0x13, &(0x7f0000001bc0), 0x2) connect$rds(r3, &(0x7f0000000500)={0x2, 0x4e22, @loopback}, 0x10) sendto(r3, 0x0, 0x0, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r6, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r6, &(0x7f0000000000), 0xd) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) close_range(r7, 0xffffffffffffffff, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000004c0)=@base={0x2, 0x4, 0x7, 0x8, 0x1014}, 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0xd, 0x4, 0x4, 0x7, 0x100, r8, 0x10000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x3}, 0x50) 6.615871923s ago: executing program 4 (id=2616): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x7c}}, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x8880}, 0x55) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x409, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x34, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @immediate={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_IMMEDIATE_DATA={0x10, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xdcc4069e8be0ce0a}]}]}, @NFTA_IMMEDIATE_DREG={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x88}}, 0x0) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000001000), r0) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x3, 0xc, 0x0, &(0x7f0000000500)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, @sched_cls=0x2e, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$int_in(r3, 0x5452, &(0x7f0000000000)=0x10) close(0x3) r4 = socket(0x10, 0x803, 0x0) r5 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r6, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r5, 0x400448c8, &(0x7f0000000180)={r6, r6, 0x7, 0x1, &(0x7f0000000240)='l', 0x7, 0x4, 0x7, 0x7, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r5, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) syz_init_net_socket$x25(0x9, 0x2, 0x10) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r7, &(0x7f0000000800)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000007c0)={&(0x7f0000000700)={0x28, 0x2, 0x8, 0x801, 0x0, 0x0, {0xa, 0x0, 0x5}, [@CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x21}, @CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x28}, 0x1, 0x0, 0x0, 0x2400c014}, 0x20000000) syz_genetlink_get_family_id$mptcp(&(0x7f00000000c0), r4) getsockname$packet(r4, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c000000100001", @ANYRES32=r8, @ANYBLOB="01000000010000001c0012000c00010062726964"], 0x3c}}, 0x0) accept4$unix(r4, 0x0, &(0x7f0000000600), 0x800) 6.603034078s ago: executing program 9 (id=2617): socket$nl_route(0x10, 0x3, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(0x0, 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x100) mkdir(0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r2, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000002100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000003740)=@newtfilter={0x54, 0x2c, 0xf3f, 0x70bd2c, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0xb, 0xfff3}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_flow={{0x9}, {0x24, 0x2, [@TCA_FLOW_KEYS={0x8, 0x1, 0x25cb}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}, @TCA_FLOW_RSHIFT={0x8, 0x4, 0x2}, @TCA_FLOW_ADDEND={0x8, 0x5, 0x8}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20041090}, 0xd0) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x2, 0x42031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x400000, 0x9) r3 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) ioctl$TCSETSF2(0xffffffffffffffff, 0x402c542d, &(0x7f0000000040)={0x82, 0x5, 0x0, 0x717e387b, 0x40, "1ae34e060100000000000000b240794233a5bd", 0x4, 0x2}) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) ioctl$TCSETS(0xffffffffffffffff, 0x404c4701, &(0x7f0000000040)={0x1, 0x0, 0x0, 0x400000, 0x14, "3eccd8000000000000000010000000040100"}) fsconfig$FSCONFIG_CMD_CREATE(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) fsmount(0xffffffffffffffff, 0x0, 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(0xffffffffffffffff, 0x7, 0x0, 0x0, 0x0) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000300)=0xb3) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f00000001c0)=0x8) ioctl$TIOCSTI(0xffffffffffffffff, 0x5412, &(0x7f0000000380)=0x27) getsockopt$WPAN_SECURITY(r3, 0x0, 0x1, 0x0, &(0x7f00000000c0)) r4 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000180), 0x11d402, 0x0) sendmsg$TIPC_NL_SOCK_GET(r4, &(0x7f0000000240)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4000050}, 0x880) 6.174697355s ago: executing program 9 (id=2618): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @empty, 0x4}], 0x1c) sendto$inet6(r0, &(0x7f0000000040)='l', 0x1, 0x7ddfdbdfaba51c5d, &(0x7f0000000100)={0xa, 0x4e23, 0x2, @loopback, 0xffffffff}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000001280)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0xfc1, @rand_addr=' \x01\x00', 0xc09}, 0x1c, &(0x7f0000000440)=[{&(0x7f0000000180)=' ', 0x1}], 0x1}}], 0x1, 0x5) 6.115651952s ago: executing program 0 (id=2619): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0x5, 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000300)={'wg0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000180)="0b03feff4f00021202004788aa96a13bb1000011000088ca1a00", 0x1fffc, 0x0, &(0x7f0000000140)={0x11, 0x0, r1}, 0x14) 5.454198598s ago: executing program 6 (id=2620): r0 = socket(0x11, 0x3, 0x0) setsockopt(r0, 0x107, 0xf, &(0x7f0000000100)="00008634", 0x4) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'hsr0\x00', 0x0}) sendmsg(r0, &(0x7f0000000100)={&(0x7f0000000040)=@ll={0x11, 0x3, r1, 0x1, 0xe5, 0x6, @broadcast}, 0x80, &(0x7f0000000240)=[{&(0x7f00000003c0)="020195ff002d3922ff65b4355e953d23d254f00000008100", 0x18}, {&(0x7f00000001c0)="2cf2565b0e508224b706a643e98dc932f5fc6d8e51626cdbf9ff02dbb8b2d2ca2be0dfa8f2a777f680c590257a0641579678f72a6ff270a8989633cbe781bf372d4a0e61", 0xff87}], 0x2}, 0x44000) 5.348448313s ago: executing program 4 (id=2621): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f00000003c0), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_KEY(r1, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={&(0x7f0000000000)={0x50, r0, 0x801, 0x70bd26, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_KEY={0x28, 0x50, 0x0, 0x1, [@NL80211_KEY_DATA_WEP104={0x11, 0x1, "4abee33908f8eef16f162471f4"}, @NL80211_KEY_IDX={0x5, 0x2, 0x2}, @NL80211_KEY_CIPHER={0x8, 0x3, 0xfac05}]}]}, 0x50}}, 0x0) 1.135765958s ago: executing program 6 (id=2622): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f0000000000)='hybla', 0x5) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000040)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000001b00)="a6", 0x1, 0x20000045, &(0x7f0000000140)={0xa, 0x4001, 0x6, @loopback, 0x5}, 0x1c) 1.133185964s ago: executing program 0 (id=2623): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$SO_BINDTODEVICE(r1, 0x1, 0x19, 0x0, 0x0) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000200)) ioctl$VHOST_SET_FEATURES(r2, 0x4008af00, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000040)=0x1) r3 = dup2(r2, r2) read$FUSE(r3, &(0x7f0000000440)={0x2020}, 0x2020) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x5) read$FUSE(r3, &(0x7f0000002480)={0x2020}, 0x2020) write$vhost_msg_v2(r3, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/104, 0x68, 0x0, 0x1, 0x2}}, 0x48) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\x06\x00[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0xc0, 0x11b, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@base={0x1f, 0x1000, 0x4, 0x2, 0x0, 0xffffffffffffffff, 0x6, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0xffffffff, 0x4}, 0x50) r4 = open(&(0x7f0000000380)='./bus\x00', 0x109240, 0x145) r5 = creat(&(0x7f0000000200)='./bus\x00', 0x0) r6 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$FUSE_NOTIFY_STORE(r5, &(0x7f0000000240)=ANY=[], 0x2b) sendfile(r6, r4, 0x0, 0x4000000053d2) close(r0) sendmmsg(r1, &(0x7f0000000500)=[{{&(0x7f0000000380)=@l2tp6={0xa, 0x0, 0x7080000, @private2={0xfc, 0x2, '\x00', 0xfe}, 0x4, 0x1}, 0x80, 0x0}}], 0x1, 0x4000000) mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) 1.089894237s ago: executing program 8 (id=2624): r0 = syz_ublk_setup_io_uring(0x21, &(0x7f0000000240)={0x0, 0x1b6c, 0x80, 0x1024002, 0x804d}, &(0x7f0000000000)=0x0, &(0x7f0000000380)=0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r1, r2, r3, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xfffffffffffffffb, &(0x7f00000000c0), 0x1, 0x40}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f0000000800)={0x2e, 0x40, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x98c8, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000002c0)=@new_dev={0x4, 0x412, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x1e0}}}, 0x0) syz_io_uring_setup(0xf00, 0x0, &(0x7f0000000100)=0x0, &(0x7f0000000140)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r5, r6, r7, &(0x7f00000001c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x1, {0x2011}}) syz_io_uring_complete(r1, r2) r8 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) syz_genetlink_get_family_id$mptcp(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xc, 0xe, 0x0, 0x0}, 0x94) r9 = getpid() sched_setscheduler(r9, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r11, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r10, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_route(0x10, 0x3, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r12 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(0x0, 0xffffffffffffffff) sendmsg$NL802154_CMD_GET_WPAN_PHY(r12, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0x40850}, 0x4000) ioctl$VIDIOC_S_FREQUENCY(r8, 0x402c5639, &(0x7f0000000080)={0x0, 0x4, 0x927bf}) syz_ublk_add_dev(r0, r1, r2, r3, &(0x7f00000003c0)={0x2e, 0x5, 0x0, r4, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0x9, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x1, 0xf60, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x180}}}, 0x0) 1.067309976s ago: executing program 9 (id=2625): openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000840)={'batadv_slave_0\x00'}) socket$l2tp(0x2, 0x2, 0x73) openat$sequencer2(0xffffffffffffff9c, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) socket(0x23, 0x1, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$dri(0x0, 0x1ff, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15) prctl$PR_SET_MM_AUXV(0x23, 0xc, 0x0, 0x1a0) r1 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) connect$bt_rfcomm(r1, &(0x7f00000000c0)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0xa}, 0x9}, 0xa) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mount(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000080)='pstore\x00', 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, 0x0, 0x0, 0x40008004) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000300)=@bpf_lsm={0x4, 0x3, &(0x7f0000000140)=@framed={{0x66, 0xa, 0x0, 0x0, 0x20, 0x61, 0x11, 0x8c}}, 0x0, 0x6, 0x0, 0x0, 0x41000}, 0x94) r4 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_SYS_SET(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000480)=ANY=[@ANYBLOB="1800000007140100000032c83a110000050042"], 0x18}}, 0x0) mbind(&(0x7f0000051000/0x4000)=nil, 0x4000, 0x3, 0x0, 0x95, 0x102) ioctl$sock_SIOCBRDELBR(r2, 0x89a1, 0x0) shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) ioctl$SNDCTL_FM_LOAD_INSTR(r0, 0x40285107) 1.026797129s ago: executing program 4 (id=2626): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000400), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000600)={0x34, r1, 0x101, 0x4000000, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac=@broadcast}]}, 0x34}, 0x1, 0x0, 0x0, 0x40050}, 0x2400c040) 957.062568ms ago: executing program 1 (id=2627): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./debug\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./debug\x00', &(0x7f0000000300)='debugfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./debug/dynamic_debug/control\x00', 0x2, 0x0) write(r0, &(0x7f0000000500)='file net/sctp/* +', 0x11) 0s ago: executing program 0 (id=2628): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000f80), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_STATION(r0, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000000)={0x30, r1, 0xb97534d5fe9704cf, 0x70bd2b, 0x25dfdbfe, {{0x12}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @device_b}, @NL80211_ATTR_STA_LISTEN_INTERVAL={0x6, 0x12, 0xfff}]}, 0x30}}, 0x0) kernel console output (not intermixed with test programs): r after parsing attributes in process `syz.4.1732'. [ 1263.447744][T15371] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1732'. [ 1264.189337][ T5756] usb 7-1: new high-speed USB device number 13 using dummy_hcd [ 1265.361809][ T5756] usb 7-1: config 0 has an invalid interface number: 50 but max is 0 [ 1266.358339][ T5756] usb 7-1: config 0 has no interface number 0 [ 1266.388792][ T5756] usb 7-1: config 0 interface 50 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1267.730337][ T5756] usb 7-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=e6.fc [ 1267.757576][ T5756] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1267.825364][ T5756] usb 7-1: config 0 descriptor?? [ 1267.860159][ T5756] usb 7-1: can't set config #0, error -71 [ 1267.933554][ T5756] usb 7-1: USB disconnect, device number 13 [ 1270.229269][T15422] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1745'. [ 1271.660250][T15442] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1749'. [ 1271.722332][T15444] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1749'. [ 1273.806608][T14963] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1274.418699][T15479] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1760'. [ 1274.802102][T14963] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1274.827743][T14963] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1274.854895][T14963] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1274.900075][T14963] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1275.820223][T14963] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1276.829720][T14963] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1276.866698][T14963] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1277.077998][T15497] loop1: detected capacity change from 0 to 512 [ 1277.189915][T15497] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1277.266668][T15511] loop6: detected capacity change from 0 to 128 [ 1278.734644][ T30] audit: type=1800 audit(1785631752.194:28): pid=15497 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1763" name="file2" dev="loop1" ino=16 res=0 errno=0 [ 1278.898261][T15497] EXT4-fs error (device loop1): ext4_validate_block_bitmap:423: comm syz.1.1763: bg 0: bad block bitmap checksum [ 1279.011110][T15497] EXT4-fs error (device loop1) in ext4_mb_clear_bb:6679: Filesystem failed CRC [ 1279.247189][T11696] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1281.034354][ T5282] 8021q: adding VLAN 0 to HW filter on device eth20 [ 1281.403840][T15553] loop4: detected capacity change from 0 to 16 [ 1281.443640][T15553] erofs (device loop4): mounted with root inode @ nid 36. [ 1282.933839][T10188] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1282.948419][T10188] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1282.966718][T10188] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1282.978284][T10188] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1282.990298][T10188] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1283.095217][T10970] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1283.104217][T10970] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1283.116919][T10970] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1283.138320][T10970] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1283.150632][T10970] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1283.669361][T15579] netlink: 112 bytes leftover after parsing attributes in process `syz.8.1783'. [ 1284.064564][T15579] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1783'. [ 1285.271051][T10188] Bluetooth: hci3: command tx timeout [ 1287.351064][T10188] Bluetooth: hci3: command tx timeout [ 1288.088392][T15612] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1289.430846][T10188] Bluetooth: hci3: command tx timeout [ 1291.034211][T15636] x_tables: ip_tables: osf match: only valid for protocol 6 [ 1291.512546][T10188] Bluetooth: hci3: command tx timeout [ 1292.673798][T15663] loop4: detected capacity change from 0 to 128 [ 1292.682841][T15663] EXT4-fs: Ignoring removed i_version option [ 1292.737174][T15663] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1292.835418][T15663] ext4 filesystem being mounted at /171/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1293.775935][ T5282] 8021q: adding VLAN 0 to HW filter on device eth9 [ 1294.187219][T11562] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1298.424556][T15710] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1298.461809][T15710] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1298.719927][T15712] loop6: detected capacity change from 0 to 4096 [ 1298.770332][T15712] EXT4-fs (loop6): Test dummy encryption mode enabled [ 1298.926165][T15712] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1299.097320][ T6581] bridge_slave_1: left allmulticast mode [ 1299.127427][ T6581] bridge_slave_1: left promiscuous mode [ 1299.175528][ T6581] bridge0: port 2(bridge_slave_1) entered disabled state [ 1299.223926][T15712] fscrypt: AES-256-CBC-CTS using implementation "cts-cbc-aes-aesni" [ 1299.277948][ T6581] bridge_slave_0: left allmulticast mode [ 1299.331990][ T6581] bridge_slave_0: left promiscuous mode [ 1299.365515][ T6581] bridge0: port 1(bridge_slave_0) entered disabled state [ 1299.425070][T15723] netlink: 'syz.1.1819': attribute type 1 has an invalid length. [ 1299.557737][ T7519] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1299.896763][T15731] loop6: detected capacity change from 0 to 64 [ 1300.611158][ T5790] usb 7-1: new low-speed USB device number 14 using dummy_hcd [ 1300.623389][ T6581] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1300.671722][ T6581] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1300.703029][ T6581] bond0 (unregistering): Released all slaves [ 1300.716333][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1300.726135][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1300.787776][ T5790] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1300.814951][ T5790] usb 7-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 1024, setting to 0 [ 1300.841824][ T5790] usb 7-1: config 1 interface 2 altsetting 1 endpoint 0x82 has invalid maxpacket 8, setting to 0 [ 1300.853172][T15724] ip6erspan0: entered promiscuous mode [ 1300.910051][ T5790] usb 7-1: string descriptor 0 read error: -22 [ 1300.926089][ T5790] usb 7-1: New USB device found, idVendor=2466, idProduct=8010, bcdDevice= 0.40 [ 1300.988949][ T5790] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1301.751296][ T5790] usb 7-1: low speed audio streaming not supported [ 1302.444063][ T6581] hsr_slave_0: left promiscuous mode [ 1302.485561][ T6581] hsr_slave_1: left promiscuous mode [ 1302.502050][ T6581] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1302.532166][ T6581] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1302.648807][ T5790] usb 7-1: USB disconnect, device number 14 [ 1305.440907][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1306.760377][ T6581] team0 (unregistering): Port device team_slave_1 removed [ 1306.792928][ T6581] team0 (unregistering): Port device team_slave_0 removed [ 1307.187521][ T5282] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1307.231796][T15772] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1307.257663][T15772] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1307.328505][T15772] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1309.301553][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1310.140215][T15559] bridge0: port 1(bridge_slave_0) entered blocking state [ 1310.185414][T15559] bridge0: port 1(bridge_slave_0) entered disabled state [ 1310.219370][T15559] bridge_slave_0: entered allmulticast mode [ 1310.270202][T15559] bridge_slave_0: entered promiscuous mode [ 1310.288048][T15559] bridge0: port 2(bridge_slave_1) entered blocking state [ 1310.305886][T15816] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1840'. [ 1310.316111][T15559] bridge0: port 2(bridge_slave_1) entered disabled state [ 1310.332813][T15559] bridge_slave_1: entered allmulticast mode [ 1310.351623][T15559] bridge_slave_1: entered promiscuous mode [ 1310.372800][T15818] netlink: 28 bytes leftover after parsing attributes in process `syz.6.1840'. [ 1310.671938][T15804] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1310.717840][T15559] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1310.732150][T15559] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1310.973839][T15559] team0: Port device team_slave_0 added [ 1311.045944][T15559] team0: Port device team_slave_1 added [ 1311.291694][T15559] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1311.315281][T15559] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1311.466326][T15559] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1311.574101][T15559] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1311.645730][T15559] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1311.920573][T15559] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1312.710858][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1312.981446][T15559] hsr_slave_0: entered promiscuous mode [ 1313.024349][T15559] hsr_slave_1: entered promiscuous mode [ 1313.066501][T15559] debugfs: 'hsr0' already exists in 'hsr' [ 1313.084005][T15559] Cannot create hsr debugfs directory [ 1313.931496][T15853] loop8: detected capacity change from 0 to 16 [ 1314.136033][T15853] erofs (device loop8): mounted with root inode @ nid 36. [ 1314.347945][T15853] erofs (device loop8): readahead error at folio 2 @ nid 89 [ 1314.801390][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1314.869727][T15867] netlink: 'syz.0.1855': attribute type 1 has an invalid length. [ 1315.356052][ T30] audit: type=1800 audit(1785631788.734:29): pid=15853 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.1854" name="file2" dev="loop8" ino=89 res=0 errno=0 [ 1315.401145][T10188] erofs (device loop8): failed to decompress (shifted) -EOPNOTSUPP @ pa 4096 size 4096 => 4868 [ 1316.568559][T15871] xt_connbytes: Forcing CT accounting to be enabled [ 1316.625329][T15871] set match dimension is over the limit! [ 1316.952030][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1318.228771][T15892] loop0: detected capacity change from 0 to 256 [ 1318.815955][T15890] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1320.871180][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1322.950844][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1325.915305][ T5282] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1326.255565][T15928] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1328.240914][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1329.210855][ T186] usb 7-1: new high-speed USB device number 15 using dummy_hcd [ 1329.309942][T15559] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1329.350494][T15559] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1329.387175][T15559] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1329.414925][ T186] usb 7-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 1329.426493][T15559] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1329.457239][ T186] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1329.473437][T15559] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1329.500630][ T186] usb 7-1: Product: syz [ 1329.540547][ T186] usb 7-1: Manufacturer: syz [ 1329.543767][T15559] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1329.550765][ T186] usb 7-1: SerialNumber: syz [ 1329.607522][T15559] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1329.615872][ T186] usb 7-1: config 0 descriptor?? [ 1329.684436][T15559] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1329.748299][T15967] loop1: detected capacity change from 0 to 8 [ 1329.839420][T15967] SQUASHFS error: Failed to read block 0xdfa: -5 [ 1329.881798][T15967] SQUASHFS error: Unable to read metadata cache entry [dfa] [ 1329.950106][ T186] usb 7-1: ignoring: probably an ADSL modem [ 1329.958431][T15967] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1330.058353][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.065418][T15949] loop0: detected capacity change from 0 to 32768 [ 1330.087108][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.117111][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.158528][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.177770][ T186] cxacru 7-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1330.181592][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.191909][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.200170][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.208778][T15967] SQUASHFS error: Failed to read block 0x4de: -5 [ 1330.215862][T15967] SQUASHFS error: Failed to read block 0x4e8: -5 [ 1330.228589][ T30] audit: type=1800 audit(1785631803.684:30): pid=15967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1866" name="file1" dev="loop1" ino=5 res=0 errno=0 [ 1330.304349][ T186] usb 7-1: USB disconnect, device number 15 [ 1330.315356][T15949] XFS (loop0): Mounting V5 Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 1330.382215][T15559] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1330.472934][T15949] XFS (loop0): Ending clean mount [ 1330.638634][ T5627] XFS (loop0): Unmounting Filesystem d7dc424e-7990-42cb-9f91-9cb7200a101d [ 1330.716984][T15990] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1881'. [ 1330.744148][T15559] 8021q: adding VLAN 0 to HW filter on device team0 [ 1330.757481][T15990] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1330.818184][T11165] bridge0: port 1(bridge_slave_0) entered blocking state [ 1330.825470][T11165] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1330.948606][T11165] bridge0: port 2(bridge_slave_1) entered blocking state [ 1330.955878][T11165] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1331.318902][T15998] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1874'. [ 1331.382756][T16000] netlink: 28 bytes leftover after parsing attributes in process `syz.8.1874'. [ 1331.504432][T15996] loop1: detected capacity change from 0 to 4096 [ 1331.585799][T15996] EXT4-fs (loop1): Test dummy encryption mode enabled [ 1331.637204][T15996] EXT4-fs (loop1): bs(8192) > ps(4096) unsupported for encrypt [ 1334.249587][T16013] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1335.426697][T16048] loop1: detected capacity change from 0 to 256 [ 1336.151080][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1338.896264][T16072] loop1: detected capacity change from 0 to 256 [ 1339.555021][T16081] loop4: detected capacity change from 0 to 512 [ 1339.697776][T16081] EXT4-fs (loop4): 1 orphan inode deleted [ 1339.707287][ T5969] Quota error (device loop4): do_check_range: Getting dqdh_entries 15 out of range 0-14 [ 1339.811557][ T5969] EXT4-fs error (device loop4): ext4_release_dquot:7075: comm kworker/u8:10: Failed to release dquot type 1 [ 1339.867031][ T5969] loop4: lost filesystem error report for type 5 error -117 [ 1339.911155][T16081] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1340.006614][T16081] ext4 filesystem being mounted at /188/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1340.347120][T11562] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1340.690669][T16091] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1342.219394][T16112] loop4: detected capacity change from 0 to 256 [ 1342.288602][T16112] exfat: Deprecated parameter 'utf8' [ 1342.349540][T16112] exFAT-fs (loop4): failed to load upcase table (idx : 0x00010000, chksum : 0x72bddf51, utbl_chksum : 0xe619d30d) [ 1342.493946][T10188] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1342.518335][T10188] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1342.534398][T10188] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1342.542411][T16119] loop6: detected capacity change from 0 to 256 [ 1342.545317][T10188] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1342.558571][T10188] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1342.658163][ T30] audit: type=1800 audit(1785631816.104:31): pid=16112 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.4.1908" name="file1" dev="loop4" ino=1049052 res=0 errno=0 [ 1342.691206][T16119] exfat: Deprecated parameter 'utf8' [ 1342.859901][T16119] exFAT-fs (loop6): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d) [ 1342.919524][T16127] loop0: detected capacity change from 0 to 256 [ 1343.028263][ T30] audit: type=1800 audit(1785631816.484:32): pid=16119 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.1911" name="file1" dev="loop6" ino=1049053 res=0 errno=0 [ 1343.278666][T16102] loop1: detected capacity change from 0 to 32768 [ 1343.559973][T16135] loop4: detected capacity change from 0 to 8 [ 1344.009412][T16135] SQUASHFS error: xz decompression failed, data probably corrupt [ 1344.116962][T16135] SQUASHFS error: Failed to read block 0x60: -5 [ 1344.202917][T16135] SQUASHFS error: xz decompression failed, data probably corrupt [ 1344.280387][T16135] SQUASHFS error: Failed to read block 0x60: -5 [ 1344.359815][ T30] audit: type=1800 audit(1785631817.814:33): pid=16135 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.1917" name="file1" dev="loop4" ino=1 res=0 errno=0 [ 1344.424080][T16102] read_mapping_page failed! [ 1344.428938][T16102] diRead: read_metapage failed [ 1344.437660][T16141] loop6: detected capacity change from 0 to 4096 [ 1344.633781][T10188] Bluetooth: hci3: command tx timeout [ 1344.658818][T16144] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1344.948794][T16141] NILFS (loop6): nilfs_sufile_do_free: segment 8 is already clean [ 1345.552623][ T5790] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 1346.229081][T16157] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1923'. [ 1346.271770][ T5790] usb 5-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1346.302526][ T5790] usb 5-1: config 2 interface 0 altsetting 178 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1346.317006][T16160] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1923'. [ 1346.351001][ T5790] usb 5-1: config 2 interface 0 has no altsetting 0 [ 1346.365467][ T5790] usb 5-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=da.47 [ 1346.400164][ T5790] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.447208][ T5790] usb 5-1: Product: syz [ 1346.480848][ T5790] usb 5-1: Manufacturer: syz [ 1346.501676][ T5790] usb 5-1: SerialNumber: syz [ 1346.711535][T10188] Bluetooth: hci3: command tx timeout [ 1346.847983][ T5790] ims_pcu 5-1:2.0: Missing CDC union descriptor [ 1346.864060][T16173] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1346.878942][ T5790] ims_pcu 5-1:2.0: probe with driver ims_pcu failed with error -22 [ 1346.917139][T16173] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1346.989643][ T5790] usb 5-1: USB disconnect, device number 6 [ 1347.371812][T11165] bridge_slave_1: left allmulticast mode [ 1347.390942][T11165] bridge_slave_1: left promiscuous mode [ 1347.402238][T11165] bridge0: port 2(bridge_slave_1) entered disabled state [ 1347.432719][T11165] bridge_slave_0: left allmulticast mode [ 1347.447863][T11165] bridge_slave_0: left promiscuous mode [ 1347.478022][T11165] bridge0: port 1(bridge_slave_0) entered disabled state [ 1347.677576][T16188] loop4: detected capacity change from 0 to 256 [ 1347.687482][T16189] loop6: detected capacity change from 0 to 256 [ 1347.708787][T16188] exFAT-fs (loop4): failed to load upcase table (idx : 0x0001fe89, chksum : 0xeb34f926, utbl_chksum : 0xe619d30d) [ 1348.012684][T16191] loop1: detected capacity change from 0 to 4096 [ 1348.371365][T16191] NILFS (loop1): invalid segment: Checksum error in segment payload [ 1348.482439][T16191] NILFS (loop1): trying rollback from an earlier position [ 1348.780682][T16191] NILFS (loop1): recovery complete [ 1348.791251][T10188] Bluetooth: hci3: command tx timeout [ 1348.846704][T16200] loop8: detected capacity change from 0 to 64 [ 1348.876464][T16203] NILFS (loop1): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1348.948889][T16200] hfs: unable to locate alternate MDB [ 1348.978327][T16191] NILFS (loop1): nilfs_palloc_freev (ino=3): entry number 4098 already freed [ 1348.989562][T16200] hfs: continuing without an alternate MDB [ 1349.116490][T16191] NILFS (loop1): nilfs_sufile_do_free: segment 9 is already clean [ 1349.343148][T16207] loop6: detected capacity change from 0 to 1024 [ 1349.368803][T16207] EXT4-fs (loop6): stripe (65535) is not aligned with cluster size (4096), stripe is disabled [ 1349.745236][T16207] EXT4-fs error (device loop6): ext4_read_block_bitmap_nowait:482: comm syz.6.1933: Invalid block bitmap block 0 in block_group 0 [ 1349.843317][T16207] loop6: lost filesystem error report for type 5 error -117 [ 1349.850780][ C1] EXT4-fs (loop6): error count since last fsck: 1 [ 1349.864609][ C1] EXT4-fs (loop6): initial error at time 1785631823: ext4_read_block_bitmap_nowait:482 [ 1349.874354][ C1] EXT4-fs (loop6): last error at time 1785631823: ext4_read_block_bitmap_nowait:482 [ 1349.967425][T16207] Quota error (device loop6): write_blk: dquota write failed [ 1350.033602][T16207] Quota error (device loop6): qtree_write_dquot: Error -117 occurred while creating quota [ 1350.122792][T11165] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1350.158332][T16207] EXT4-fs error (device loop6): ext4_acquire_dquot:7039: comm syz.6.1933: Failed to acquire dquot type 0 [ 1350.185893][T16207] loop6: lost filesystem error report for type 5 error -117 [ 1350.187443][T16207] EXT4-fs error (device loop6): ext4_free_blocks:6717: comm syz.6.1933: Freeing blocks not in datazone - block = 0, count = 4096 [ 1350.238847][T16207] loop6: lost filesystem error report for type 5 error -117 [ 1350.253356][T16207] EXT4-fs error (device loop6): ext4_read_inode_bitmap:140: comm syz.6.1933: Invalid inode bitmap blk 0 in block_group 0 [ 1350.289465][T11165] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1350.291361][ T7144] Quota error (device loop6): do_check_range: Getting block 0 out of range 1-7 [ 1350.329531][T16207] loop6: lost filesystem error report for type 5 error -117 [ 1350.352234][ T7144] EXT4-fs error (device loop6): ext4_release_dquot:7075: comm kworker/u8:17: Failed to release dquot type 0 [ 1350.379008][T16207] EXT4-fs error (device loop6) in ext4_free_inode:363: Corrupt filesystem [ 1350.433367][T16207] loop6: lost filesystem error report for type 5 error -117 [ 1350.449532][T16207] EXT4-fs (loop6): 1 orphan inode deleted [ 1350.534016][ T7144] loop6: lost filesystem error report for type 5 error -117 [ 1350.871730][T10188] Bluetooth: hci3: command tx timeout [ 1351.004129][T11165] bond0 (unregistering): Released all slaves [ 1351.015581][T16207] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1351.492467][ T7519] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1351.523058][T16226] loop8: detected capacity change from 0 to 512 [ 1351.568969][T16226] [EXT4 FS bs=4096, gc=1, bpg=32768, ipg=32, mo=8856c01c, mo2=0002] [ 1351.585853][T16226] EXT4-fs (loop8): orphan cleanup on readonly fs [ 1351.594404][T16226] EXT4-fs warning (device loop8): ext4_enable_quotas:7272: Failed to enable quota tracking (type=2, err=-22, ino=15). Please run e2fsck to fix. [ 1351.616360][T16226] EXT4-fs (loop8): Cannot turn on quotas: error -22 [ 1351.624503][T16226] EXT4-fs error (device loop8): ext4_ext_check_inode:521: inode #13: comm syz.8.1938: pblk 0 bad header/extent: invalid extent entries - magic f30a, entries 1, max 4(4), depth 0(0) [ 1351.652556][T16226] loop8: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1351.659450][ T5282] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1351.668701][ C1] EXT4-fs (loop8): error count since last fsck: 1 [ 1351.668736][ C1] EXT4-fs (loop8): last error at time 1785631825: ext4_ext_check_inode:521: inode 13 [ 1351.689294][T16214] loop4: detected capacity change from 0 to 32768 [ 1351.698418][T16226] EXT4-fs error (device loop8): ext4_orphan_get:1402: comm syz.8.1938: couldn't read orphan inode 13 (err -117) [ 1351.711033][T16226] loop8: lost filesystem error report for type 5 error -117 [ 1351.731793][T16226] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 ro without journal. Quota mode: writeback. [ 1351.962807][T11165] hsr_slave_0: left promiscuous mode [ 1352.022454][T11165] hsr_slave_1: left promiscuous mode [ 1352.056599][T11165] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1352.106569][T11165] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1352.171205][T16214] JBD2: Ignoring recovery information on journal [ 1352.218991][T16236] loop1: detected capacity change from 0 to 512 [ 1352.223729][T10678] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1352.243864][T16214] ocfs2: Mounting device (7,4) on (node local, slot 0) with ordered data mode. [ 1352.331043][T16238] loop0: detected capacity change from 0 to 256 [ 1352.363641][T16236] EXT4-fs error (device loop1): ext4_clear_blocks:874: inode #13: comm syz.1.1940: attempt to clear invalid blocks 2 len 1 [ 1352.415760][T16238] exFAT-fs (loop0): failed to load upcase table (idx : 0x00010000, chksum : 0xdbae3f17, utbl_chksum : 0xe619d30d) [ 1352.496364][T16236] loop1: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1352.500758][ C0] EXT4-fs (loop1): error count since last fsck: 1 [ 1352.516423][ C0] EXT4-fs (loop1): initial error at time 1785631825: ext4_clear_blocks:874: inode 13 [ 1352.526339][ C0] EXT4-fs (loop1): last error at time 1785631825: ext4_clear_blocks:874: inode 13 [ 1352.604802][T16236] EXT4-fs error (device loop1): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 216 vs 220 free clusters [ 1352.673619][ T30] audit: type=1800 audit(1785631826.114:34): pid=16245 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.1941" name="file1" dev="loop0" ino=1049069 res=0 errno=0 [ 1352.724184][T16236] EXT4-fs error (device loop1): ext4_free_branches:1020: inode #13: comm syz.1.1940: invalid indirect mapped block 1819239214 (level 0) [ 1352.766080][T16236] loop1: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1352.769739][T16236] EXT4-fs error (device loop1): ext4_free_branches:1020: inode #13: comm syz.1.1940: invalid indirect mapped block 1819239214 (level 1) [ 1352.833795][T16236] loop1: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1352.839141][T11562] ocfs2: Unmounting device (7,4) on (node local) [ 1352.858878][T16236] EXT4-fs (loop1): 1 truncate cleaned up [ 1352.897124][T16236] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1353.016049][T16236] EXT4-fs warning (device loop1): ext4_empty_dir:3104: inode #2: comm syz.1.1940: directory missing '..' [ 1353.219766][T11696] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1353.542766][T16253] loop4: detected capacity change from 0 to 64 [ 1353.995403][T16257] loop8: detected capacity change from 0 to 256 [ 1354.023421][T16257] exfat: Deprecated parameter 'utf8' [ 1354.083532][T16257] exFAT-fs (loop8): failed to load upcase table (idx : 0x00010000, chksum : 0xe3908169, utbl_chksum : 0xe619d30d) [ 1354.181385][ T30] audit: type=1800 audit(1785631827.634:35): pid=16257 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.8.1948" name="file1" dev="loop8" ino=1049070 res=0 errno=0 [ 1354.341883][T11165] team0 (unregistering): Port device team_slave_1 removed [ 1354.479956][T11165] team0 (unregistering): Port device team_slave_0 removed [ 1357.075608][T16264] loop8: detected capacity change from 0 to 4096 [ 1357.975038][T16264] NILFS (loop8): error -4 creating segctord thread [ 1358.036490][T16273] loop1: detected capacity change from 0 to 8 [ 1358.106262][T16273] SQUASHFS error: xz decompression failed, data probably corrupt [ 1358.114209][T16273] SQUASHFS error: Failed to read block 0x60: -5 [ 1358.123071][T16273] SQUASHFS error: xz decompression failed, data probably corrupt [ 1358.133467][T16273] SQUASHFS error: Failed to read block 0x60: -5 [ 1358.149330][ T30] audit: type=1800 audit(1785631831.594:36): pid=16273 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.1952" name="file1" dev="loop1" ino=1 res=0 errno=0 [ 1358.460628][T16280] loop8: detected capacity change from 0 to 256 [ 1358.497799][T16280] exfat: Deprecated parameter 'namecase' [ 1358.511475][T16280] exfat: Deprecated parameter 'namecase' [ 1358.540561][T16280] exFAT-fs (loop8): failed to load upcase table (idx : 0x0001fe89, chksum : 0xef5d2b8f, utbl_chksum : 0xe619d30d) [ 1359.184598][T16292] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1956'. [ 1359.236063][T14781] hid-generic 0005:0007:0007.002D: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 1359.611132][ T29] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1359.861823][T16301] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1956'. [ 1359.980898][ T29] usb 9-1: Using ep0 maxpacket: 8 [ 1360.013791][ T29] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1360.098435][ T29] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1360.242551][ T29] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1360.296794][ T29] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1361.269851][ T29] usb 9-1: New USB device found, idVendor=6666, idProduct=8802, bcdDevice= 0.00 [ 1361.451870][ T29] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1361.670201][ T29] usb 9-1: config 0 descriptor?? [ 1361.812322][T16309] loop1: detected capacity change from 0 to 256 [ 1361.834897][T16303] fido_id[16303]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci3/hci3:200/report_descriptor': No such file or directory [ 1361.883618][ T30] audit: type=1800 audit(1785631835.344:37): pid=16309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.1963" name="file1" dev="loop1" ino=1049082 res=0 errno=0 [ 1362.157306][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1362.164321][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1362.237090][T16317] loop6: detected capacity change from 0 to 512 [ 1362.265256][ T29] usbhid 9-1:0.0: can't add hid device: -71 [ 1362.295211][ T29] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1362.347038][ T29] usb 9-1: USB disconnect, device number 7 [ 1362.418101][T16317] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1362.498341][T16317] ext4 filesystem being mounted at /338/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1362.634094][T16324] loop1: detected capacity change from 0 to 1024 [ 1362.886492][ T7519] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1362.973376][ T29] hid-generic 0005:0007:0007.002E: hidraw0: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 1363.036839][T16331] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1969'. [ 1363.388498][T16117] bridge0: port 1(bridge_slave_0) entered blocking state [ 1363.411992][T16335] fido_id[16335]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci3/hci3:200/report_descriptor': No such file or directory [ 1363.428866][T16117] bridge0: port 1(bridge_slave_0) entered disabled state [ 1363.465890][T16117] bridge_slave_0: entered allmulticast mode [ 1363.496052][T16117] bridge_slave_0: entered promiscuous mode [ 1363.558704][T16117] bridge0: port 2(bridge_slave_1) entered blocking state [ 1363.589236][T16117] bridge0: port 2(bridge_slave_1) entered disabled state [ 1363.623503][T16117] bridge_slave_1: entered allmulticast mode [ 1363.640430][T16117] bridge_slave_1: entered promiscuous mode [ 1364.660898][T16117] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1365.602030][T16117] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1365.718403][T16117] team0: Port device team_slave_0 added [ 1365.730649][T16117] team0: Port device team_slave_1 added [ 1366.086080][T16356] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1366.092343][T16356] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1366.117521][T16356] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1366.728043][T16117] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1366.803111][T16117] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1366.909555][T16117] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1366.965125][T16365] loop0: detected capacity change from 0 to 1024 [ 1366.965827][T16117] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1366.971692][T16367] loop4: detected capacity change from 0 to 512 [ 1367.045256][T16367] ext2: Unknown parameter 'pcr' [ 1367.079981][T16117] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1367.089125][T16365] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1367.295241][T16365] EXT4-fs error (device loop0): ext4_empty_dir:3114: inode #11: block 623: comm syz.0.1978: Attempting to read directory block (623) that is past i_size (638464) [ 1367.297395][T16117] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1367.341886][T16375] loop4: detected capacity change from 0 to 256 [ 1367.349501][T16372] loop6: detected capacity change from 0 to 1024 [ 1367.389428][T16365] EXT4-fs (loop0): Remounting filesystem read-only [ 1367.638838][ T5627] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1368.482137][T16386] netlink: 4 bytes leftover after parsing attributes in process `syz.8.1984'. [ 1368.813992][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1368.850194][T16117] hsr_slave_0: entered promiscuous mode [ 1368.859611][T16117] hsr_slave_1: entered promiscuous mode [ 1368.866128][T16117] debugfs: 'hsr0' already exists in 'hsr' [ 1369.750976][T16117] Cannot create hsr debugfs directory [ 1370.651330][T16397] loop8: detected capacity change from 0 to 1764 [ 1370.779874][T16397] iso9660: Corrupted directory entry in block 2 of inode 1920 [ 1370.873283][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1372.358204][T16417] loop8: detected capacity change from 0 to 64 [ 1372.480265][T16417] syz.8.1994: attempt to access beyond end of device [ 1372.480265][T16417] loop8: rw=2049, sector=268435468, nr_sectors = 2 limit=64 [ 1372.660633][T16422] loop6: detected capacity change from 0 to 4096 [ 1372.862034][T16426] NILFS (loop6): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1372.998485][T16419] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1373.357946][ T5783] usb 9-1: new full-speed USB device number 8 using dummy_hcd [ 1373.486900][T16436] loop6: detected capacity change from 0 to 256 [ 1373.614156][ T5783] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1373.684883][ T5783] usb 9-1: config 0 has no interface number 0 [ 1373.697340][ T5783] usb 9-1: New USB device found, idVendor=0b48, idProduct=1003, bcdDevice=7b.54 [ 1373.780780][ T5783] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1373.799667][ T5783] usb 9-1: Product: syz [ 1373.822321][ T5783] usb 9-1: Manufacturer: syz [ 1373.822789][T16436] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001fe89, chksum : 0xbf24f927, utbl_chksum : 0xe619d30d) [ 1373.887655][ T5783] usb 9-1: SerialNumber: syz [ 1373.943349][ T5783] usb 9-1: config 0 descriptor?? [ 1373.972794][ T30] audit: type=1804 audit(1785631847.424:38): pid=16436 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.6.1997" name="/newroot/346/bus/bus" dev="loop6" ino=1049100 res=1 errno=0 [ 1374.051857][ T5783] usb 9-1: selecting invalid altsetting 1 [ 1374.080150][T16444] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1999'. [ 1374.134645][ T5783] dvb_ttusb_budget: ttusb_init_controller: error [ 1374.141275][ T5783] dvbdev: DVB: registering new adapter (Technotrend/Hauppauge Nova-USB) [ 1374.314762][ T5783] DVB: Unable to find symbol stv0299_attach() [ 1374.950927][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1376.464583][ T5783] DVB: Unable to find symbol tda8083_attach() [ 1376.520019][ T5783] dvb_ttusb_budget: no frontend driver found for device [0b48:1003] [ 1376.608325][ T5783] usb 9-1: USB disconnect, device number 8 [ 1376.739833][T16443] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1377.546707][ T5790] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1377.965884][T16117] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1378.000493][ T5790] usb 2-1: Using ep0 maxpacket: 32 [ 1378.209934][ T5790] usb 2-1: config index 0 descriptor too short (expected 156, got 27) [ 1378.337250][ T5790] usb 2-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1378.357723][T16117] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1378.390919][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1378.452426][ T5790] usb 2-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1378.475883][T16117] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1378.583196][ T5790] usb 2-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1378.602838][T16117] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1378.637636][T16117] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1378.701017][ T5790] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1378.709894][T16117] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1378.749948][T16117] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1378.773471][ T5790] usb 2-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1378.815109][T16117] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1378.829048][ T5790] usb 2-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1378.874056][ T5790] usb 2-1: Product: syz [ 1378.896660][ T5790] usb 2-1: Manufacturer: syz [ 1378.924429][ T5790] usb 2-1: SerialNumber: syz [ 1379.893684][ T5790] usb 2-1: config 0 descriptor?? [ 1379.906953][ T5790] ldusb 2-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1380.870853][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1380.902172][ T5790] ldusb 2-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1382.602479][ T804] usb 2-1: USB disconnect, device number 6 [ 1382.710286][ T804] ldusb 2-1:0.0: LD USB Device #0 now disconnected [ 1382.966026][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1384.446949][T16117] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1384.641505][T16117] 8021q: adding VLAN 0 to HW filter on device team0 [ 1384.720753][ T7144] bridge0: port 1(bridge_slave_0) entered blocking state [ 1384.727993][ T7144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1384.849699][ T7144] bridge0: port 2(bridge_slave_1) entered blocking state [ 1384.856948][ T7144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1384.981437][T16517] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2014'. [ 1385.031170][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1385.694719][T16522] netlink: 'syz.8.2011': attribute type 1 has an invalid length. [ 1387.111189][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1388.987291][T16554] loop4: detected capacity change from 0 to 512 [ 1389.053193][T16554] FAT-fs (loop4): Invalid FSINFO signature: 0x41615252, 0x61000000 (sector = 1) [ 1389.828541][T16538] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1390.231728][T16565] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2018'. [ 1390.277335][T16117] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1390.829659][T16565] netdevsim netdevsim4 netdevsim0: entered promiscuous mode [ 1390.995910][T16565] netlink: 152 bytes leftover after parsing attributes in process `syz.4.2018'. [ 1391.060790][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1393.636934][T16595] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2026'. [ 1394.249703][T16601] loop8: detected capacity change from 0 to 1024 [ 1394.370557][T16601] hfsplus: invalid file type 0174377 for inode 21 [ 1394.753073][T16598] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1394.944477][T16611] loop8: detected capacity change from 0 to 1024 [ 1394.998969][T16611] hfsplus: Filesystem was not cleanly unmounted, running fsck.hfsplus is recommended. mounting read-only. [ 1395.119892][T16117] veth0_vlan: entered promiscuous mode [ 1395.284863][T16117] veth1_vlan: entered promiscuous mode [ 1395.541125][T16117] veth0_macvtap: entered promiscuous mode [ 1395.619538][T16117] veth1_macvtap: entered promiscuous mode [ 1395.805824][T16622] tipc: Enabling not permitted [ 1395.829233][T16622] tipc: Enabling of bearer rejected, failed to enable media [ 1395.943093][T16117] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1396.005072][T16117] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1396.032999][T16620] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1396.102272][ T7144] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1396.241336][ T7144] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1396.243383][ T147] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1396.243502][ T147] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1397.780922][ T6153] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1398.098502][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1398.330505][ T6153] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1398.681614][T11165] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1398.769080][T11165] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1399.794288][T16657] loop8: detected capacity change from 0 to 16 [ 1399.871329][T16657] erofs (device loop8): mounted with root inode @ nid 36. [ 1400.001001][T16657] erofs (device loop8): invalid h_shared_count 83 @ nid 46 [ 1400.051377][T16652] loop0: detected capacity change from 0 to 4096 [ 1400.150853][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1400.268903][T16662] NILFS (loop0): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1400.421102][T16661] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1400.429715][ T30] audit: type=1800 audit(1785631873.884:39): pid=16652 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2037" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 1400.491593][ T5282] 8021q: adding VLAN 0 to HW filter on device eth17 [ 1400.802227][T16672] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2040'. [ 1400.883671][T16675] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2041'. [ 1400.951642][T16675] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2041'. [ 1401.135391][T16682] loop0: detected capacity change from 0 to 2048 [ 1401.188022][T16682] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1401.454226][ T5627] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1404.150805][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1406.230869][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1406.330933][T16716] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1407.481217][ T30] audit: type=1800 audit(1785631880.934:40): pid=16732 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.2055" name="qw_sign" dev="configfs" ino=53191 res=0 errno=0 [ 1407.700986][T16731] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1407.798845][T16731] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1407.850415][T16729] loop6: detected capacity change from 0 to 4096 [ 1407.924011][T16729] ntfs3(loop6): Different NTFS sector size (2048) and media sector size (512). [ 1408.953870][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1410.084074][T16739] loop8: detected capacity change from 0 to 256 [ 1410.236897][T16739] exfat: Deprecated parameter 'namecase' [ 1410.362613][T16729] ntfs3(loop6): Failed to read $AttrDef (-4). [ 1410.383710][T16749] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2059'. [ 1410.401476][T16739] exFAT-fs (loop8): failed to load upcase table (idx : 0x0001fe89, chksum : 0xf168f48e, utbl_chksum : 0xe619d30d) [ 1410.728473][T16754] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2061'. [ 1410.767667][T16754] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2061'. [ 1411.066019][ T30] audit: type=1326 audit(1785631884.514:41): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16759 comm="syz.8.2063" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f721b59e019 code=0x0 [ 1411.332913][T16769] loop9: detected capacity change from 0 to 128 [ 1411.529079][T16769] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 1411.631810][T16769] hpfs: filesystem error: improperly stopped [ 1411.692294][T16769] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 1411.765835][T16769] hpfs: You really don't want any checks? You are crazy... [ 1411.844224][T16769] hpfs: hpfs_map_sector(): read error [ 1411.928416][T16769] hpfs: code page support is disabled [ 1412.011960][T16769] hpfs: hpfs_map_4sectors(): unaligned read [ 1412.076184][T16769] hpfs: hpfs_map_4sectors(): unaligned read [ 1412.149355][T16769] hpfs: filesystem error: unable to find root dir [ 1412.178599][T16776] loop0: detected capacity change from 0 to 512 [ 1412.390035][T16776] EXT4-fs error (device loop0): ext4_clear_blocks:874: inode #13: comm syz.0.2067: attempt to clear invalid blocks 2 len 1 [ 1412.583955][T16776] loop0: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1412.588782][T16776] EXT4-fs error (device loop0): ext4_mb_generate_buddy:1314: group 0, [ 1412.598091][ C0] EXT4-fs (loop0): error count since last fsck: 1 [ 1412.598127][ C0] EXT4-fs (loop0): initial error at time 1785631886: ext4_clear_blocks:874: inode 13 [ 1412.598183][ C0] EXT4-fs (loop0): last error at time 1785631886: ext4_clear_blocks:874: inode 13 [ 1412.632472][T16776] block bitmap and bg descriptor inconsistent: 216 vs 220 free clusters [ 1413.240826][T16776] EXT4-fs error (device loop0): ext4_free_branches:1020: inode #13: comm syz.0.2067: invalid indirect mapped block 1819239214 (level 0) [ 1413.326694][T16785] loop6: detected capacity change from 0 to 2048 [ 1413.344897][T16785] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1413.898137][T16776] loop0: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1413.971084][T16776] EXT4-fs error (device loop0): ext4_free_branches:1020: inode #13: comm syz.0.2067: invalid indirect mapped block 1819239214 (level 1) [ 1414.108863][T16789] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1414.240873][T16776] loop0: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1414.247361][T16776] EXT4-fs (loop0): 1 truncate cleaned up [ 1414.368619][T16776] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1416.150910][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1417.028188][ T5627] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1419.532252][T16820] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1419.673979][T16833] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2078'. [ 1420.263521][T16823] loop0: detected capacity change from 0 to 4096 [ 1420.738055][T16823] ntfs3(loop0): Different NTFS sector size (2048) and media sector size (512). [ 1421.270974][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1421.662674][T16823] ntfs3(loop0): Failed to initialize $Extend/$ObjId. [ 1423.120637][T16844] loop9: detected capacity change from 0 to 2048 [ 1423.254312][T16844] NILFS (loop9): broken superblock, retrying with spare superblock (blocksize = 1024) [ 1423.698188][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.837581][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1424.767264][T16860] NILFS (loop9): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1424.847593][T16858] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1424.860229][T13957] udevd[13957]: incorrect nilfs2 checksum on /dev/loop9 [ 1426.870867][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1427.017937][T16847] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1427.429860][T16873] loop0: detected capacity change from 0 to 764 [ 1427.488545][T16877] loop9: detected capacity change from 0 to 512 [ 1427.614283][T16877] EXT4-fs error (device loop9): ext4_clear_blocks:874: inode #13: comm syz.9.2087: attempt to clear invalid blocks 2 len 1 [ 1427.766594][T16877] loop9: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1427.770133][T16877] EXT4-fs error (device loop9): ext4_mb_generate_buddy:1314: group 0, [ 1427.779373][ C0] EXT4-fs (loop9): error count since last fsck: 1 [ 1427.779408][ C0] EXT4-fs (loop9): initial error at time 1785631901: ext4_clear_blocks:874: inode 13 [ 1427.779464][ C0] EXT4-fs (loop9): last error at time 1785631901: ext4_clear_blocks:874: inode 13 [ 1427.815371][T16877] block bitmap and bg descriptor inconsistent: 216 vs 220 free clusters [ 1428.039895][T16877] EXT4-fs error (device loop9): ext4_free_branches:1020: inode #13: comm syz.9.2087: invalid indirect mapped block 1819239214 (level 0) [ 1428.098019][T16877] loop9: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1428.098699][T16877] EXT4-fs error (device loop9): ext4_free_branches:1020: inode #13: comm syz.9.2087: invalid indirect mapped block 1819239214 (level 1) [ 1428.101887][T16892] loop6: detected capacity change from 0 to 256 [ 1428.118767][T16877] loop9: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1428.127773][T16887] team0: Device vlan3 is already an upper device of the team interface [ 1428.149828][T16893] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2092'. [ 1428.195476][T16877] EXT4-fs (loop9): 1 truncate cleaned up [ 1428.242353][T16877] EXT4-fs (loop9): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1428.419022][T16877] EXT4-fs warning (device loop9): ext4_empty_dir:3104: inode #2: comm syz.9.2087: directory missing '..' [ 1428.497976][T16899] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2079'. [ 1428.552171][T16900] netlink: 28 bytes leftover after parsing attributes in process `syz.1.2079'. [ 1428.655047][T16117] EXT4-fs (loop9): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1429.031851][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1429.216206][T16915] loop6: detected capacity change from 0 to 64 [ 1429.248312][T16916] loop0: detected capacity change from 0 to 16 [ 1429.346495][T16916] erofs (device loop0): mounted with root inode @ nid 36. [ 1429.449411][T16918] loop4: detected capacity change from 0 to 128 [ 1429.561271][T16908] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1429.601045][T16918] EXT4-fs (loop4): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1429.666781][T16918] ext4 filesystem being mounted at /223/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1429.835069][T16927] loop1: detected capacity change from 0 to 256 [ 1429.976077][T16924] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1430.129140][T11562] EXT4-fs (loop4): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1431.830910][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1432.170088][T16941] netlink: 24 bytes leftover after parsing attributes in process `syz.9.2105'. [ 1432.499793][T16948] loop6: detected capacity change from 0 to 512 [ 1432.584321][T16951] loop0: detected capacity change from 0 to 1024 [ 1432.709674][T16948] EXT4-fs error (device loop6): ext4_clear_blocks:874: inode #13: comm syz.6.2107: attempt to clear invalid blocks 2 len 1 [ 1433.421059][T16948] loop6: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1433.440803][ C1] EXT4-fs (loop6): error count since last fsck: 1 [ 1433.456501][ C1] EXT4-fs (loop6): initial error at time 1785631906: ext4_clear_blocks:874: inode 13 [ 1433.466059][ C1] EXT4-fs (loop6): last error at time 1785631906: ext4_clear_blocks:874: inode 13 [ 1433.540106][T16948] EXT4-fs error (device loop6): ext4_mb_generate_buddy:1314: group 0, block bitmap and bg descriptor inconsistent: 216 vs 220 free clusters [ 1433.737602][T16948] EXT4-fs error (device loop6): ext4_free_branches:1020: inode #13: comm syz.6.2107: invalid indirect mapped block 1819239214 (level 0) [ 1433.828481][T16948] loop6: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1433.830376][T16948] EXT4-fs error (device loop6): ext4_free_branches:1020: inode #13: comm syz.6.2107: invalid indirect mapped block 1819239214 (level 1) [ 1433.874392][T16970] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2111'. [ 1433.911729][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1434.012424][T16948] loop6: lost file I/O error report for ino 13 type 5 pos 0x0 len 0x0 error -117 [ 1434.016242][T16948] EXT4-fs (loop6): 1 truncate cleaned up [ 1434.129273][T16948] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1434.601637][T16983] loop4: detected capacity change from 0 to 256 [ 1434.704364][T16948] EXT4-fs warning (device loop6): ext4_empty_dir:3104: inode #2: comm syz.6.2107: directory missing '..' [ 1434.833301][T16982] loop8: detected capacity change from 0 to 2048 [ 1434.912982][T16975] loop0: detected capacity change from 0 to 4096 [ 1435.338458][T16982] UDF-fs: error (device loop8): udf_read_tagged: tag checksum failed, block 99: 0x27 != 0x4d [ 1435.349031][T16975] ntfs3(loop0): Different NTFS sector size (4096) and media sector size (512). [ 1435.400622][T16988] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1435.472112][T16982] UDF-fs: error (device loop8): udf_read_tagged: tag checksum failed, block 160: 0xd2 != 0xd4 [ 1435.479834][ T7519] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1435.647015][T16982] UDF-fs: INFO Mounting volume 'LinuxUDF', timestamp 2022/11/22 14:59 (1000) [ 1437.430871][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1437.653772][T16975] ntfs3(loop0): Failed to read $UpCase (-4). [ 1437.944289][T17001] loop6: detected capacity change from 0 to 64 [ 1438.877646][T17006] capability: warning: `syz.9.2121' uses deprecated v2 capabilities in a way that may be insecure [ 1439.108694][T17011] loop8: detected capacity change from 0 to 128 [ 1439.512001][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1439.642136][T17018] netlink: 'syz.0.2123': attribute type 1 has an invalid length. [ 1439.880915][T17020] loop8: detected capacity change from 0 to 2048 [ 1441.378973][T17027] NILFS (loop8): segctord starting. Construction interval = 5 seconds, CP frequency < 30 seconds [ 1444.902539][T17058] loop9: detected capacity change from 0 to 22 [ 1444.909512][T17057] loop6: detected capacity change from 0 to 512 [ 1444.956230][T17057] EXT4-fs (loop6): encrypted files will use data=ordered instead of data journaling mode [ 1444.994058][T17058] MTD: Attempt to mount non-MTD device "/dev/loop9" [ 1445.065989][T17057] EXT4-fs (loop6): 1 truncate cleaned up [ 1445.089370][T17058] romfs: Mounting image 'rom 637cf1fa' through the block layer [ 1445.148052][T17057] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1445.410536][T17065] netlink: 148 bytes leftover after parsing attributes in process `syz.8.2135'. [ 1445.950074][ T7519] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1446.559805][T17073] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1448.310847][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1449.660864][ T29] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1449.850916][ T29] usb 10-1: Using ep0 maxpacket: 8 [ 1450.047745][ T29] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1450.334396][ T29] usb 10-1: New USB device found, idVendor=17ef, idProduct=60a3, bcdDevice= 0.00 [ 1450.508370][ T29] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1450.589761][T17095] loop4: detected capacity change from 0 to 512 [ 1450.799309][T17095] Quota error (device loop4): do_check_range: Getting dqdh_entries 1536 out of range 0-14 [ 1450.830127][ T29] usb 10-1: config 0 descriptor?? [ 1450.830322][T17103] loop1: detected capacity change from 0 to 256 [ 1450.897682][T17095] Quota error (device loop4): qtree_write_dquot: Error -117 occurred while creating quota [ 1450.954309][T17095] EXT4-fs error (device loop4): ext4_acquire_dquot:7039: comm syz.4.2141: Failed to acquire dquot type 1 [ 1450.966335][T17095] loop4: lost filesystem error report for type 5 error -117 [ 1450.970705][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 1450.984463][ C0] EXT4-fs (loop4): last error at time 1785631924: ext4_acquire_dquot:7039 [ 1451.004274][T17095] EXT4-fs (loop4): 1 truncate cleaned up [ 1451.045988][T17095] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1451.073916][T17095] ext4 filesystem being mounted at /232/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1451.082766][ T804] usb 7-1: new high-speed USB device number 16 using dummy_hcd [ 1451.492193][ T804] usb 7-1: config 8 has an invalid interface number: 177 but max is 0 [ 1451.696572][ T804] usb 7-1: config 8 has no interface number 0 [ 1451.821480][ T804] usb 7-1: config 8 interface 177 has no altsetting 0 [ 1451.965604][ T804] usb 7-1: New USB device found, idVendor=04d8, idProduct=fd08, bcdDevice=59.b1 [ 1452.084151][ T804] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1452.673132][T17108] loop8: detected capacity change from 0 to 4096 [ 1452.818667][ T29] hid_parser_main: 84 callbacks suppressed [ 1452.818705][ T29] lenovo 0003:17EF:60A3.002F: unknown main item tag 0x2 [ 1452.867851][ T804] ir_toy 7-1:8.177: required endpoints not found [ 1452.915971][T11562] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1452.972810][ T29] lenovo 0003:17EF:60A3.002F: unknown main item tag 0x1 [ 1453.017052][T17108] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1453.021765][ T804] usb 7-1: USB disconnect, device number 16 [ 1453.163178][ T29] lenovo 0003:17EF:60A3.002F: hidraw0: USB HID v4.09 Device [HID 17ef:60a3] on usb-dummy_hcd.9-1/input0 [ 1453.324033][T10678] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1453.357270][ T29] usb 10-1: USB disconnect, device number 2 [ 1453.604214][T17122] loop4: detected capacity change from 0 to 512 [ 1453.667370][T17122] EXT4-fs (loop4): feature flags set on rev 0 fs, running e2fsck is recommended [ 1453.688650][T17127] loop8: detected capacity change from 0 to 22 [ 1453.711808][ T5790] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1453.736130][T17127] MTD: Attempt to mount non-MTD device "/dev/loop8" [ 1453.746055][T17122] EXT4-fs (loop4): warning: maximal mount count reached, running e2fsck is recommended [ 1453.768338][T17127] romfs: Mounting image 'rom 637cf1fa' through the block layer [ 1453.829280][T17122] EXT4-fs error (device loop4): ext4_orphan_get:1399: comm syz.4.2152: inode #15: comm syz.4.2152: iget: illegal inode # [ 1454.835375][T17122] loop4: lost filesystem error report for type 5 error -117 [ 1454.840716][ C0] EXT4-fs (loop4): error count since last fsck: 1 [ 1454.854554][ C0] EXT4-fs (loop4): initial error at time 1785631928: ext4_orphan_get:1399 [ 1454.863139][ C0] EXT4-fs (loop4): last error at time 1785631928: ext4_orphan_get:1399 [ 1454.884058][ T5790] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1454.913699][T17122] EXT4-fs (loop4): Remounting filesystem read-only [ 1456.052716][ T5790] usb 2-1: config 128 has an invalid interface number: 9 but max is 1 [ 1456.065224][T17122] EXT4-fs (loop4): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1456.186625][ T5790] usb 2-1: config 128 has an invalid interface number: 247 but max is 1 [ 1456.403177][ T5790] usb 2-1: config 128 has no interface number 0 [ 1456.587685][ T5790] usb 2-1: config 128 has no interface number 1 [ 1456.670259][ T5790] usb 2-1: config 128 interface 9 has no altsetting 0 [ 1457.020799][ T5790] usb 2-1: config 128 interface 247 has no altsetting 0 [ 1457.060284][ T5790] usb 2-1: string descriptor 0 read error: -71 [ 1457.068213][ T5790] usb 2-1: New USB device found, idVendor=413c, idProduct=81cb, bcdDevice=9c.3c [ 1457.080450][ T5790] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1457.168753][ T5790] usb 2-1: can't set config #128, error -71 [ 1457.344345][ T5790] usb 2-1: USB disconnect, device number 7 [ 1457.667486][T17152] loop1: detected capacity change from 0 to 64 [ 1457.717598][T17154] loop6: detected capacity change from 0 to 256 [ 1457.729617][T11562] EXT4-fs (loop4): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1458.016475][T17143] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1458.277219][T17154] exFAT-fs (loop6): failed to load upcase table (idx : 0x0000fd4f, chksum : 0xa9435e31, utbl_chksum : 0xe619d30d) [ 1458.529795][T17162] loop4: detected capacity change from 0 to 64 [ 1458.621254][T17148] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1458.952971][T17165] loop1: detected capacity change from 0 to 64 [ 1460.485462][T17179] fido_id[17179]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.9/usb10/report_descriptor': No such file or directory [ 1460.550849][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1462.118011][T17214] loop4: detected capacity change from 0 to 128 [ 1464.347418][T17225] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1466.070819][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1467.532620][T17243] loop1: detected capacity change from 0 to 512 [ 1467.654252][T17243] Quota error (device loop1): do_check_range: Getting dqdh_entries 1536 out of range 0-14 [ 1467.698897][T17243] Quota error (device loop1): qtree_write_dquot: Error -117 occurred while creating quota [ 1467.712882][T17243] EXT4-fs error (device loop1): ext4_acquire_dquot:7039: comm syz.1.2180: Failed to acquire dquot type 1 [ 1467.725641][T17243] loop1: lost filesystem error report for type 5 error -117 [ 1467.730222][T17243] EXT4-fs (loop1): 1 truncate cleaned up [ 1467.737804][ C1] EXT4-fs (loop1): error count since last fsck: 1 [ 1467.737840][ C1] EXT4-fs (loop1): last error at time 1785631941: ext4_acquire_dquot:7039 [ 1467.848619][T17243] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1467.900210][T17243] ext4 filesystem being mounted at /225/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1467.936492][ T5866] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 1468.161015][ T5866] usb 5-1: Using ep0 maxpacket: 8 [ 1468.240484][ T5866] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1468.265220][ T5866] usb 5-1: New USB device found, idVendor=17ef, idProduct=60a3, bcdDevice= 0.00 [ 1468.277186][ T5866] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1468.334625][T11696] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1468.352978][ T5866] usb 5-1: config 0 descriptor?? [ 1468.805043][T17274] loop6: detected capacity change from 0 to 256 [ 1468.902205][T17274] exfat: Deprecated parameter 'utf8' [ 1468.967590][T17274] exfat: Deprecated parameter 'namecase' [ 1469.027625][ T5866] lenovo 0003:17EF:60A3.0030: unknown main item tag 0x2 [ 1469.039130][ T5866] lenovo 0003:17EF:60A3.0030: unknown main item tag 0x1 [ 1469.053090][ T5866] lenovo 0003:17EF:60A3.0030: hidraw0: USB HID v4.09 Device [HID 17ef:60a3] on usb-dummy_hcd.4-1/input0 [ 1469.072959][ T5866] usb 5-1: USB disconnect, device number 7 [ 1469.137426][T17274] exFAT-fs (loop6): failed to load upcase table (idx : 0x0001fe89, chksum : 0x0232f1a3, utbl_chksum : 0xe619d30d) [ 1470.054080][T17281] fido_id[17281]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1470.861163][T17291] netlink: 'syz.6.2193': attribute type 1 has an invalid length. [ 1471.231419][T17298] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1471.663206][T17302] netlink: 'syz.9.2194': attribute type 1 has an invalid length. [ 1471.899993][ T5282] 8021q: adding VLAN 0 to HW filter on device eth18 [ 1473.050004][T17321] loop8: detected capacity change from 0 to 512 [ 1474.025682][T17321] Quota error (device loop8): do_check_range: Getting dqdh_entries 1536 out of range 0-14 [ 1474.071411][T17321] Quota error (device loop8): qtree_write_dquot: Error -117 occurred while creating quota [ 1474.109636][T17321] EXT4-fs error (device loop8): ext4_acquire_dquot:7039: comm syz.8.2199: Failed to acquire dquot type 1 [ 1474.160398][T17321] loop8: lost filesystem error report for type 5 error -117 [ 1474.160714][ C0] EXT4-fs (loop8): error count since last fsck: 1 [ 1474.174565][ C0] EXT4-fs (loop8): last error at time 1785631947: ext4_acquire_dquot:7039 [ 1474.200317][T17321] EXT4-fs (loop8): 1 truncate cleaned up [ 1474.218694][T17321] EXT4-fs (loop8): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1474.232273][T17321] ext4 filesystem being mounted at /283/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1474.339694][T17330] xt_connbytes: Forcing CT accounting to be enabled [ 1474.725774][T10678] EXT4-fs (loop8): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1475.827648][T17360] loop0: detected capacity change from 0 to 64 [ 1476.282530][ T5866] usb 7-1: new full-speed USB device number 17 using dummy_hcd [ 1476.384166][T17370] sd 0:0:1:0: device reset [ 1476.493698][ T5866] usb 7-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1476.542912][ T5866] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1476.580900][ T5866] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1476.605465][ T5866] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1476.639904][ T5866] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1476.673873][ T5866] usb 7-1: Product: syz [ 1476.699224][ T5866] usb 7-1: Manufacturer: syz [ 1476.724525][ T5866] usb 7-1: SerialNumber: syz [ 1476.795570][ T5866] usb 7-1: config 0 descriptor?? [ 1476.849947][T17378] loop0: detected capacity change from 0 to 1024 [ 1476.874259][ T5866] usb 7-1: selecting invalid altsetting 0 [ 1477.057725][T17382] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2216'. [ 1477.137786][T17382] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2216'. [ 1477.571065][T17391] loop0: detected capacity change from 0 to 16 [ 1477.602731][T17391] erofs (device loop0): mounted with root inode @ nid 36. [ 1477.891873][ T5282] 8021q: adding VLAN 0 to HW filter on device eth19 [ 1477.934094][T17393] netlink: 'syz.1.2219': attribute type 1 has an invalid length. [ 1478.065251][ T5866] usb 7-1: USB disconnect, device number 17 [ 1478.544255][T17397] loop6: detected capacity change from 0 to 2048 [ 1478.804493][T17397] EXT4-fs (loop6): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: none. [ 1478.928781][ T30] audit: type=1800 audit(1785631952.384:42): pid=17397 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.6.2220" name="file1" dev="loop6" ino=15 res=0 errno=0 [ 1480.307156][ T7519] EXT4-fs (loop6): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1480.572845][T17428] loop9: detected capacity change from 0 to 256 [ 1480.808801][T17438] loop1: detected capacity change from 0 to 128 [ 1481.697803][T17447] loop0: detected capacity change from 0 to 4096 [ 1481.704998][T17453] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2235'. [ 1481.765482][T17455] netlink: 28 bytes leftover after parsing attributes in process `syz.9.2235'. [ 1481.853059][T17447] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1482.235924][T17463] netlink: 'syz.4.2238': attribute type 1 has an invalid length. [ 1482.591116][ T5627] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1482.871498][T14553] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1483.761099][T14553] usb 9-1: config index 0 descriptor too short (expected 23569, got 27) [ 1483.772522][T14553] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1483.785034][T14553] usb 9-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1483.794431][T14553] usb 9-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1483.803239][T14553] usb 9-1: Manufacturer: syz [ 1483.914897][T14553] usb 9-1: config 0 descriptor?? [ 1484.203554][T14553] rc_core: IR keymap rc-hauppauge not found [ 1484.228588][T14553] Registered IR keymap rc-empty [ 1484.261486][T14553] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 1484.363918][T14553] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input16 [ 1484.435674][ T5282] 8021q: adding VLAN 0 to HW filter on device eth24 [ 1484.946658][ T5866] usb 9-1: USB disconnect, device number 9 [ 1485.034842][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1485.041723][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1485.268151][T17516] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2257'. [ 1485.331638][T17517] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2257'. [ 1487.379066][T17553] loop4: detected capacity change from 0 to 128 [ 1487.494817][T17555] IPv6: addrconf: prefix option has invalid lifetime [ 1488.203784][T17569] netlink: 'syz.6.2268': attribute type 1 has an invalid length. [ 1488.471138][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1488.761025][T17541] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1489.389814][T17580] loop0: detected capacity change from 0 to 1024 [ 1490.550844][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1490.782484][T17593] netlink: 4 bytes leftover after parsing attributes in process `syz.9.2274'. [ 1490.891469][T17598] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2278'. [ 1490.936734][T17598] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2278'. [ 1494.032012][T17635] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1494.923039][T17655] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2294'. [ 1495.671502][T10188] Bluetooth: hci3: command 0x0405 tx timeout [ 1496.602399][T17661] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1497.061925][ T5783] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 1497.212793][T17677] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2297'. [ 1497.258512][T17677] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2297'. [ 1497.300762][ T5783] usb 5-1: Using ep0 maxpacket: 16 [ 1497.324074][ T5783] usb 5-1: too many endpoints for config 0 interface 0 altsetting 16: 254, using maximum allowed: 30 [ 1497.358384][ T5783] usb 5-1: config 0 interface 0 altsetting 16 has 1 endpoint descriptor, different from the interface descriptor's value: 254 [ 1497.413727][ T5783] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1497.447355][ T5783] usb 5-1: New USB device found, idVendor=056a, idProduct=0094, bcdDevice= 0.00 [ 1497.482807][ T5783] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1497.553724][ T5783] usb 5-1: config 0 descriptor?? [ 1498.098407][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.135153][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.202745][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.712584][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.775786][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.783161][T17706] Cannot find del_set index 14804 as target [ 1498.828624][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.867527][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.900157][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.939713][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.974187][ T5783] wacom 0003:056A:0094.0031: unknown main item tag 0x0 [ 1498.996746][ T5783] wacom 0003:056A:0094.0031: Using device in hidraw-only mode [ 1500.017700][ T5783] wacom 0003:056A:0094.0031: hidraw0: USB HID v0.01 Device [HID 056a:0094] on usb-dummy_hcd.4-1/input0 [ 1501.165835][ T5783] usb 5-1: USB disconnect, device number 8 [ 1502.355367][T17731] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1502.374191][T17727] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2309'. [ 1502.447512][T17714] fido_id[17714]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1503.348718][T17752] loop4: detected capacity change from 0 to 1024 [ 1503.431094][T17755] loop0: detected capacity change from 0 to 256 [ 1503.832011][T14553] usb 2-1: new low-speed USB device number 8 using dummy_hcd [ 1504.007038][T17762] loop0: detected capacity change from 0 to 256 [ 1504.040352][T14553] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1504.101812][T14553] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1504.150519][T14553] usb 2-1: New USB device found, idVendor=0c70, idProduct=f0b6, bcdDevice= 0.00 [ 1504.198180][T14553] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1504.254867][T14553] usb 2-1: config 0 descriptor?? [ 1504.321956][T17762] exFAT-fs (loop0): bogus data start sector [ 1504.373802][T17762] exFAT-fs (loop0): failed to read boot sector [ 1504.390875][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1505.043058][T14553] aquacomputer_d5next 0003:0C70:F0B6.0032: item fetching failed at offset 5/7 [ 1505.092475][T14553] aquacomputer_d5next 0003:0C70:F0B6.0032: probe with driver aquacomputer_d5next failed with error -22 [ 1505.241480][T17762] exFAT-fs (loop0): failed to recognize exfat type [ 1505.248119][T14553] usb 2-1: USB disconnect, device number 8 [ 1506.470766][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1506.894148][T17787] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1506.948893][T17787] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1507.093773][T17790] Illegal XDP return value 4294967274 on prog (id 157) dev N/A, expect packet loss! [ 1507.403138][T17797] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2327'. [ 1509.882335][T17819] netlink: 'syz.1.2330': attribute type 1 has an invalid length. [ 1511.187458][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1511.522050][T17826] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1511.965641][T17840] 9p: Bad value for 'rfdno' [ 1512.261697][T17845] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2335'. [ 1512.355596][T17849] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2335'. [ 1512.544563][T17856] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2339'. [ 1512.609755][T17856] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2339'. [ 1512.944016][T17865] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2342'. [ 1513.590893][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1515.205378][ T30] audit: type=1326 audit(1785631988.654:43): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1515.309956][T17899] mmap: syz.0.2350 (17899) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 1515.394715][ T30] audit: type=1326 audit(1785631988.664:44): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1516.612662][ T30] audit: type=1326 audit(1785631988.704:45): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1516.623808][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1517.116186][ T30] audit: type=1326 audit(1785631988.724:46): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1517.149664][ T30] audit: type=1326 audit(1785631988.744:47): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1517.290301][ T30] audit: type=1326 audit(1785631988.754:48): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1517.422711][ T30] audit: type=1326 audit(1785631988.754:49): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1517.514480][T17911] can0: slcan on ttyS3. [ 1517.539319][ T30] audit: type=1326 audit(1785631988.764:50): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1517.631154][ T30] audit: type=1326 audit(1785631988.764:51): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1517.677385][ T3632] usb 2-1: new low-speed USB device number 9 using dummy_hcd [ 1517.695903][ T30] audit: type=1326 audit(1785631988.764:52): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17897 comm="syz.0.2350" exe="/root/ci-upstream-kasan-badwrites-root/syz-executor" sig=0 arch=c000003e syscall=216 compat=0 ip=0x7f872d59e019 code=0x7ffc0000 [ 1517.849257][ T3632] usb 2-1: config 0 interface 0 altsetting 31 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 1517.873256][ T3632] usb 2-1: config 0 interface 0 altsetting 31 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1517.903144][ T3632] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1517.919393][ T3632] usb 2-1: New USB device found, idVendor=5543, idProduct=0003, bcdDevice= 0.00 [ 1517.936190][ T3632] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1517.972985][ T3632] usb 2-1: config 0 descriptor?? [ 1517.992714][T17912] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1518.027663][T14553] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 1518.205469][T17909] can0 (unregistered): slcan off ttyS3. [ 1518.337693][T14553] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1518.394724][T14553] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1518.440411][T14553] usb 10-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 1518.486908][T14553] usb 10-1: too many endpoints for config 1 interface 1 altsetting 76: 188, using maximum allowed: 30 [ 1518.518383][ T3632] hid (null): global environment stack underflow [ 1518.541457][T14553] usb 10-1: config 1 interface 1 altsetting 76 has 0 endpoint descriptors, different from the interface descriptor's value: 188 [ 1518.561850][ T3632] hid (null): unknown global tag 0xe [ 1518.609205][T14553] usb 10-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1518.623169][ T3632] hid_parser_main: 30 callbacks suppressed [ 1518.623206][ T3632] uclogic 0003:5543:0003.0033: unknown main item tag 0x2 [ 1518.668512][T14553] usb 10-1: config 1 interface 1 has no altsetting 0 [ 1518.678932][ T3632] uclogic 0003:5543:0003.0033: global environment stack underflow [ 1518.688940][T17939] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2360'. [ 1518.710596][ T3632] uclogic 0003:5543:0003.0033: item 0 4 1 11 parsing failed [ 1518.711982][ T29] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1518.728522][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1518.744285][ T3632] uclogic 0003:5543:0003.0033: parse failed [ 1518.755124][T14553] usb 10-1: string descriptor 0 read error: -22 [ 1518.776019][T14553] usb 10-1: New USB device found, idVendor=21b4, idProduct=0081, bcdDevice= 0.40 [ 1518.779037][T17939] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2360'. [ 1518.785517][ T3632] uclogic 0003:5543:0003.0033: probe with driver uclogic failed with error -22 [ 1518.806816][T14553] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1518.838500][ T3632] usb 2-1: USB disconnect, device number 9 [ 1518.954448][ T29] usb 9-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 1518.999594][ T29] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1519.050353][ T29] usb 9-1: config 0 descriptor?? [ 1519.498020][ T29] hackrf 9-1:0.0: Board ID: 00 [ 1519.510881][T14553] usb 10-1: 2:0: cannot get min/max values for control 2 (id 2) [ 1519.526441][ T29] hackrf 9-1:0.0: Firmware version: [ 1519.547186][T14553] usb 10-1: Warning! Unlikely big volume step count (=18453), linear volume or wrong cval->res? [ 1519.605250][T14553] usb 10-1: [2] FU [Speaker Playback Volume] ch = 1, val = 0/18453/1 [ 1520.790904][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1521.740462][ T29] hackrf 9-1:0.0: Registered as swradio24 [ 1521.815830][ T29] videodev: could not get a free minor [ 1521.866271][ T29] hackrf 9-1:0.0: Failed to register as video device (-23) [ 1521.905352][T14553] usb 10-1: 2:0: cannot get min/max values for control 2 (id 2) [ 1521.984898][ T29] hackrf 9-1:0.0: probe with driver hackrf failed with error -23 [ 1522.065683][ T29] usb 9-1: USB disconnect, device number 10 [ 1522.125201][T14553] usb 10-1: 2:0: cannot get min/max values for control 2 (id 2) [ 1522.310419][T14553] usb 10-1: USB disconnect, device number 3 [ 1523.731998][T17994] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1525.110610][T18012] netlink: 4 bytes leftover after parsing attributes in process `syz.0.2376'. [ 1525.272785][T18012] netlink: 28 bytes leftover after parsing attributes in process `syz.0.2376'. [ 1525.750767][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1526.793310][T17996] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1527.082157][T15714] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 1528.143562][T15714] usb 9-1: config 0 has an invalid interface number: 41 but max is 0 [ 1528.913191][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1528.950756][T15714] usb 9-1: config 0 has no interface number 0 [ 1528.960471][T15714] usb 9-1: config 0 interface 41 has no altsetting 0 [ 1528.972156][T15714] usb 9-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1528.985373][T15714] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1528.999123][T15714] usb 9-1: Product: syz [ 1529.009339][T15714] usb 9-1: Manufacturer: syz [ 1529.015186][T15714] usb 9-1: SerialNumber: syz [ 1529.029305][T15714] usb 9-1: config 0 descriptor?? [ 1529.735175][T15714] CoreChips 9-1:0.41: probe with driver CoreChips failed with error -71 [ 1529.820095][T15714] usb 9-1: USB disconnect, device number 11 [ 1529.939669][T18054] netlink: 'syz.9.2384': attribute type 1 has an invalid length. [ 1530.692224][ T3632] usb 5-1: new full-speed USB device number 9 using dummy_hcd [ 1530.794521][T18075] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2391'. [ 1530.864757][T18075] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2391'. [ 1530.898604][ T3632] usb 5-1: config 0 has an invalid interface number: 231 but max is 0 [ 1530.930176][ T3632] usb 5-1: config 0 has no interface number 0 [ 1530.950544][ T3632] usb 5-1: config 0 interface 231 altsetting 0 endpoint 0x6 has invalid maxpacket 1023, setting to 64 [ 1530.962149][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1531.003835][ T3632] usb 5-1: New USB device found, idVendor=067b, idProduct=27a1, bcdDevice=b0.9b [ 1531.039852][ T3632] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1531.064680][ T3632] usb 5-1: Product: syz [ 1531.080374][ T3632] usb 5-1: Manufacturer: syz [ 1531.109350][ T3632] usb 5-1: SerialNumber: syz [ 1531.152391][ T3632] usb 5-1: config 0 descriptor?? [ 1531.217498][T18066] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 1533.030782][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1534.400791][T17083] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 1534.453789][ T3632] plusb 5-1:0.231 usb0: register 'plusb' at usb-dummy_hcd.4-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1, 72:87:72:ef:6b:13 [ 1534.796781][T17083] usb 10-1: config index 0 descriptor too short (expected 23569, got 27) [ 1535.274040][T17083] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1535.328831][T17083] usb 10-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1535.338422][T17083] usb 10-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1535.347968][ T3632] usb 5-1: USB disconnect, device number 9 [ 1535.357811][ T3632] plusb 5-1:0.231 usb0: unregister 'plusb' usb-dummy_hcd.4-1, Prolific PL-2301/PL-2302/PL-25A1/PL-27A1 [ 1535.369257][T17083] usb 10-1: Manufacturer: syz [ 1535.416079][T17083] usb 10-1: config 0 descriptor?? [ 1536.672232][T17083] rc_core: IR keymap rc-hauppauge not found [ 1536.698039][T17083] Registered IR keymap rc-empty [ 1536.709247][T17083] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0 [ 1536.740536][T17083] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0/input17 [ 1536.789352][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.796497][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.803406][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.810511][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.817030][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.824118][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.830703][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.837793][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.844682][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.851781][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.858591][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.865675][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.872371][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.879455][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.886010][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.893082][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.899594][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.906680][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.913241][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.920337][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.926846][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.933936][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.940451][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.947536][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.954365][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.961444][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.968283][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.975363][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.981956][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1536.989038][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1536.995596][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.002755][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.009332][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.016429][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.022910][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.029995][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.036564][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.043647][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.050800][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.057881][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.064411][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.071493][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.078066][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.085144][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.091696][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.098770][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.105267][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.112356][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.118903][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.125993][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.132617][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.139707][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.146177][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.153255][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.160051][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.167140][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.173888][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.180967][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.187510][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.194596][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.201097][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.208193][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.214677][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.221763][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.228333][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.235424][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.241936][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.249109][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.256146][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.263221][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.269672][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.276747][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.283306][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.290393][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.296839][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1537.296935][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.297017][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.303147][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.303211][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.310319][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.310386][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.316845][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.316911][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.324111][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.324179][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.330525][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.330587][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.337777][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.337844][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.344251][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.344313][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.351687][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.351743][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.352556][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.352608][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.358936][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.358997][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.366211][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.366275][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.372645][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.372704][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.379810][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.379873][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.386284][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.386347][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.393554][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.393619][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.399955][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.400021][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.407212][ C1] raw-gadget.1 gadget.9: ignoring, device is not running [ 1537.407283][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1537.563869][T18116] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1537.620307][T17083] usb 10-1: USB disconnect, device number 4 [ 1537.641335][T18116] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1539.462867][T18147] loop6: detected capacity change from 0 to 128 [ 1539.486103][T18147] EXT4-fs: Ignoring removed orlov option [ 1539.648182][T18147] EXT4-fs (loop6): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1540.099677][T18153] netlink: 'syz.8.2410': attribute type 1 has an invalid length. [ 1540.112321][T18147] ext4 filesystem being mounted at /411/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1540.765288][ T7519] EXT4-fs (loop6): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1541.361230][T15714] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1541.563691][T15714] usb 2-1: config index 0 descriptor too short (expected 23569, got 27) [ 1541.623762][T15714] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1541.661980][T15714] usb 2-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1541.676763][T15714] usb 2-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1541.716028][T15714] usb 2-1: Manufacturer: syz [ 1541.744353][T15714] usb 2-1: config 0 descriptor?? [ 1541.879708][T18170] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1542.430914][T11935] usb 7-1: new high-speed USB device number 18 using dummy_hcd [ 1542.681136][T11935] usb 7-1: Using ep0 maxpacket: 16 [ 1542.781403][T11935] usb 7-1: New USB device found, idVendor=054c, idProduct=0038, bcdDevice=16.f5 [ 1542.838659][T11935] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1542.939614][T11935] usb 7-1: Product: syz [ 1542.973932][T11935] usb 7-1: Manufacturer: syz [ 1543.019516][T11935] usb 7-1: SerialNumber: syz [ 1543.041620][T11935] usb 7-1: config 0 descriptor?? [ 1543.060784][T15714] rc_core: IR keymap rc-hauppauge not found [ 1543.076812][T15714] Registered IR keymap rc-empty [ 1543.077623][T11935] visor 7-1:0.0: Sony Clie 3.5 converter detected [ 1543.096247][T15714] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 1543.131861][T15714] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input18 [ 1543.225231][ C0] igorplugusb 2-1:0.0: receive overflow invalid: 163 [ 1543.428528][T15714] usb 2-1: USB disconnect, device number 10 [ 1543.566688][T11935] usb 7-1: Sony Clie 3.5 converter now attached to ttyUSB0 [ 1543.730445][T11935] usb 7-1: USB disconnect, device number 18 [ 1543.751070][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1543.888065][T18203] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1544.004346][T18220] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1544.031276][T11935] clie_3.5 ttyUSB0: Sony Clie 3.5 converter now disconnected from ttyUSB0 [ 1544.068768][T18220] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1544.091413][T11935] visor 7-1:0.0: device disconnected [ 1544.777360][T14553] usb 5-1: new high-speed USB device number 10 using dummy_hcd [ 1545.044134][T14553] usb 5-1: Using ep0 maxpacket: 32 [ 1545.098491][T14553] usb 5-1: config 0 has an invalid interface number: 35 but max is 0 [ 1545.147542][T14553] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1545.278414][T14553] usb 5-1: config 0 has no interface number 0 [ 1545.295752][T14553] usb 5-1: config 0 interface 35 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1545.333170][T18247] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1545.347537][T14553] usb 5-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 1545.391012][T18247] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1545.418207][T14553] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1545.449829][T14553] usb 5-1: Product: syz [ 1545.462576][T14553] usb 5-1: Manufacturer: syz [ 1545.472542][T14553] usb 5-1: SerialNumber: syz [ 1545.504328][T14553] usb 5-1: config 0 descriptor?? [ 1545.541757][T14553] radio-si470x 5-1:0.35: could not find interrupt in endpoint [ 1545.560464][T14553] radio-si470x 5-1:0.35: probe with driver radio-si470x failed with error -5 [ 1545.774963][T14553] radio-raremono 5-1:0.35: Thanko's Raremono connected: (10C4:818A) [ 1545.892938][T18260] netlink: 'syz.9.2434': attribute type 1 has an invalid length. [ 1545.912510][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1546.041995][T14553] radio-raremono 5-1:0.35: V4L2 device registered as radio48 [ 1546.365397][T14553] usb 5-1: USB disconnect, device number 10 [ 1546.421409][T14553] radio-raremono 5-1:0.35: Thanko's Raremono disconnected [ 1546.474094][ T1312] ieee802154 phy0 wpan0: encryption failed: -22 [ 1546.489402][ T1312] ieee802154 phy1 wpan1: encryption failed: -22 [ 1547.475646][T18273] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1547.931146][T14553] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1548.300153][T14553] usb 2-1: Using ep0 maxpacket: 8 [ 1548.427266][T14553] usb 2-1: config index 0 descriptor too short (expected 5924, got 36) [ 1548.493875][T14553] usb 2-1: config 250 has an invalid interface number: 228 but max is -1 [ 1548.577360][T14553] usb 2-1: config 250 has 1 interface, different from the descriptor's value: 0 [ 1548.660452][T14553] usb 2-1: config 250 has no interface number 0 [ 1548.702801][T14553] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x1 has invalid maxpacket 65280, setting to 1024 [ 1548.751999][T14553] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 1024 [ 1548.793453][T14553] usb 2-1: config 250 interface 228 altsetting 255 endpoint 0x82 has invalid maxpacket 20648, setting to 1024 [ 1548.819696][T18297] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1548.833384][T14553] usb 2-1: config 250 interface 228 altsetting 255 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1548.857952][T18297] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1548.870119][T14553] usb 2-1: config 250 interface 228 altsetting 255 has 2 endpoint descriptors, different from the interface descriptor's value: 17 [ 1548.897693][T14553] usb 2-1: config 250 interface 228 has no altsetting 0 [ 1548.912367][T14553] usb 2-1: New USB device found, idVendor=0525, idProduct=d292, bcdDevice= 0.07 [ 1548.922102][T14553] usb 2-1: New USB device strings: Mfr=0, Product=106, SerialNumber=59 [ 1548.932378][T14553] usb 2-1: Product: syz [ 1548.936669][T14553] usb 2-1: SerialNumber: syz [ 1549.046114][T14553] hub 2-1:250.228: bad descriptor, ignoring hub [ 1549.073627][T14553] hub 2-1:250.228: probe with driver hub failed with error -5 [ 1549.511047][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1549.753068][T18306] loop4: detected capacity change from 0 to 4096 [ 1550.082160][T14553] usblp 2-1:250.228: usblp0: USB Bidirectional printer dev 11 if 228 alt 255 proto 3 vid 0x0525 pid 0xD292 [ 1550.137519][T14553] usb 2-1: USB disconnect, device number 11 [ 1550.192760][T14553] usblp0: removed [ 1550.222879][T18306] ntfs3(loop4): Mark volume as dirty due to NTFS errors [ 1550.408976][T18306] ntfs3(loop4): Failed to load $Extend (-22). [ 1550.456345][T18306] ntfs3(loop4): Failed to initialize $Extend. [ 1550.571117][ T5866] usb 7-1: new full-speed USB device number 19 using dummy_hcd [ 1550.776983][ T5866] usb 7-1: too many endpoints for config 0 interface 0 altsetting 0: 254, using maximum allowed: 30 [ 1550.802745][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1024, setting to 64 [ 1550.973874][T14553] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1551.406401][T14553] usb 10-1: New USB device found, idVendor=0547, idProduct=0201, bcdDevice=11.64 [ 1551.499521][T18325] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1551.548874][T14553] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1551.617398][ T5866] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid maxpacket 1024, setting to 64 [ 1551.628882][ T5866] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 254 [ 1551.642141][ T5866] usb 7-1: New USB device found, idVendor=054c, idProduct=1000, bcdDevice= 0.00 [ 1551.651550][ T5866] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1551.660326][T14553] usb 10-1: Product: syz [ 1551.684526][ T5866] usb 7-1: config 0 descriptor?? [ 1551.691799][T18313] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1551.700053][T18313] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1552.090480][T14553] usb 10-1: Manufacturer: syz [ 1552.590733][T14553] usb 10-1: SerialNumber: syz [ 1552.701247][T14553] usb 10-1: config 0 descriptor?? [ 1552.800141][ T5866] sony 0003:054C:1000.0034: unknown main item tag 0x4 [ 1552.811228][ T5866] sony 0003:054C:1000.0034: reserved main item tag 0xd [ 1552.826116][ T5866] sony 0003:054C:1000.0034: hidraw0: USB HID v9.42 Device [HID 054c:1000] on usb-dummy_hcd.6-1/input0 [ 1552.837426][ T5866] sony 0003:054C:1000.0034: failed to claim input [ 1552.918554][T14553] dvb-usb: found a 'Nebula Electronics uDigiTV DVB-T USB2.0)' in warm state. [ 1552.925324][ T5866] usb 7-1: USB disconnect, device number 19 [ 1553.076386][T14553] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1553.123440][T14553] dvbdev: DVB: registering new adapter (Nebula Electronics uDigiTV DVB-T USB2.0)) [ 1553.195071][T14553] usb 10-1: media controller created [ 1553.453661][T14553] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1553.503916][T18342] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1553.674222][T18345] fido_id[18345]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 1554.533273][T18361] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1555.030947][T14553] DVB: Unable to find symbol mt352_attach() [ 1555.172190][T18368] tipc: Started in network mode [ 1555.233078][T18368] tipc: Node identity aaaaaaaaaa3, cluster identity 4711 [ 1555.294647][T18368] tipc: Enabled bearer , priority 10 [ 1555.562246][T14553] DVB: Unable to find symbol nxt6000_attach() [ 1555.615089][T14553] dvb-usb: no frontend was attached by 'Nebula Electronics uDigiTV DVB-T USB2.0)' [ 1555.680245][T14553] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.9/usb10/10-1/input/input19 [ 1556.551176][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1556.685375][ T3632] tipc: Node number set to 10136234 [ 1556.719052][T14553] dvb-usb: schedule remote query interval to 1000 msecs. [ 1556.728136][T14553] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0) successfully initialized and connected. [ 1556.738688][T14553] dvb-usb: bulk message failed: -22 (7/0) [ 1556.746087][T14553] dvb-usb: bulk message failed: -22 (7/0) [ 1556.765845][T14553] usb 10-1: USB disconnect, device number 5 [ 1557.503912][T18389] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1558.574352][T14553] dvb-usb: Nebula Electronics uDigiTV DVB-T USB2.0 successfully deinitialized and disconnected. [ 1559.050362][T18410] netlink: 71 bytes leftover after parsing attributes in process `syz.0.2480'. [ 1559.414561][ T3632] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1559.431189][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1559.651550][ T3632] usb 2-1: Using ep0 maxpacket: 32 [ 1559.725488][ T3632] usb 2-1: config index 0 descriptor too short (expected 35577, got 27) [ 1559.785957][ T3632] usb 2-1: config 1 has too many interfaces: 92, using maximum allowed: 32 [ 1559.803320][ T5866] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 1559.846136][ T3632] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 92 [ 1559.915310][ T3632] usb 2-1: config 1 has no interface number 0 [ 1559.945519][ T3632] usb 2-1: config 1 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1559.980735][ T3632] usb 2-1: config 1 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 1560.021578][ T3632] usb 2-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1560.031426][ T5866] usb 10-1: Using ep0 maxpacket: 8 [ 1560.041129][ T3632] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.098864][ T5866] usb 10-1: New USB device found, idVendor=047d, idProduct=5003, bcdDevice=2f.8c [ 1560.145851][ T5866] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1560.223276][T18427] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1560.258620][ T5866] usb 10-1: Product: syz [ 1560.272138][ T3632] snd_usb_pod 2-1:1.1: Line 6 Pocket POD found [ 1560.317915][ T5866] usb 10-1: Manufacturer: syz [ 1560.348531][ T5866] usb 10-1: SerialNumber: syz [ 1560.382200][ T5866] usb 10-1: config 0 descriptor?? [ 1560.437682][ T5866] gspca_main: se401-2.14.0 probing 047d:5003 [ 1560.520804][T17083] usb 5-1: new high-speed USB device number 11 using dummy_hcd [ 1560.529568][ T3632] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now attached [ 1560.697839][T17083] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 1560.728208][T17083] usb 5-1: config 0 has no interface number 0 [ 1560.754085][T17083] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1560.787246][T17083] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1560.828779][T17083] usb 5-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 1560.848616][ T5866] gspca_se401: Wrong descriptor type [ 1560.854082][T17083] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1560.908488][T17083] usb 5-1: config 0 descriptor?? [ 1561.017874][ T3632] usb 2-1: USB disconnect, device number 12 [ 1561.057886][ T3632] snd_usb_pod 2-1:1.1: Line 6 Pocket POD now disconnected [ 1561.116869][T14553] usb 10-1: USB disconnect, device number 6 [ 1562.080789][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1562.385443][T17083] prodikeys 0003:041E:2801.0035: hidraw0: USB HID v0.00 Device [HID 041e:2801] on usb-dummy_hcd.4-1/input1 [ 1562.476914][T18436] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1562.582157][T17083] hid_prodikeys: hid-prodikeys: failed to find output report [ 1562.582157][T17083] [ 1563.674529][T17083] usb 5-1: USB disconnect, device number 11 [ 1564.315793][T18462] fido_id[18462]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.4/usb5/report_descriptor': No such file or directory [ 1564.502092][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1565.130716][ T3632] usb 5-1: new high-speed USB device number 12 using dummy_hcd [ 1565.340772][ T3632] usb 5-1: Using ep0 maxpacket: 16 [ 1565.373959][ T3632] usb 5-1: config 0 interface 0 altsetting 11 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1565.446365][ T3632] usb 5-1: config 0 interface 0 has no altsetting 0 [ 1565.495907][ T3632] usb 5-1: New USB device found, idVendor=1038, idProduct=12c2, bcdDevice= 0.00 [ 1565.551925][ T3632] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1565.704467][ T3632] usb 5-1: config 0 descriptor?? [ 1566.550761][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1566.679129][ T3632] steelseries 0003:1038:12C2.0036: ignoring exceeding usage max [ 1566.788989][T18498] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1566.802722][ T3632] steelseries 0003:1038:12C2.0036: unknown main item tag 0x1 [ 1566.931783][ T3632] usb 5-1: USB disconnect, device number 12 [ 1567.553863][T18509] loop0: detected capacity change from 0 to 128 [ 1567.605972][T18509] EXT4-fs: Ignoring removed orlov option [ 1567.654636][T18509] EXT4-fs (loop0): mounted filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09 r/w without journal. Quota mode: none. [ 1567.736484][T18509] ext4 filesystem being mounted at /524/mnt supports timestamps until 2038-01-19 (0x7fffffff) [ 1567.890876][ T5866] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1568.755660][ T5866] usb 2-1: New USB device found, idVendor=2c42, idProduct=1602, bcdDevice=da.64 [ 1568.789368][ T5866] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1568.799195][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1568.807266][ T5866] usb 2-1: Product: syz [ 1568.812506][ T5866] usb 2-1: Manufacturer: syz [ 1568.817569][ T5866] usb 2-1: SerialNumber: syz [ 1568.852595][ T5866] usb 2-1: config 0 descriptor?? [ 1568.886593][ T5627] EXT4-fs (loop0): unmounting filesystem 76b65be2-f6da-4727-8c75-0525a5b65a09. [ 1568.886953][ T5866] hub 2-1:0.0: bad descriptor, ignoring hub [ 1568.978016][ T5866] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1568.999097][ T5866] f81232 2-1:0.0: f81534a converter detected [ 1569.198608][ T5866] f81534a ttyUSB0: f81232_set_register failed status: -71 [ 1569.246895][ T5866] f81534a ttyUSB0: probe with driver f81534a failed with error -5 [ 1569.936070][ T5866] usb 2-1: reset high-speed USB device number 13 using dummy_hcd [ 1570.892851][T18538] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1570.934876][ T5866] usb 2-1: device descriptor read/all, error -71 [ 1571.090049][T18549] dummy0: entered allmulticast mode [ 1571.224395][T18549] dummy0: left allmulticast mode [ 1571.682386][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1572.676092][ T5866] usb 2-1: USB disconnect, device number 13 [ 1572.686591][ T5866] f81232 2-1:0.0: device disconnected [ 1573.585946][T18576] netlink: 4 bytes leftover after parsing attributes in process `syz.8.2518'. [ 1573.655867][T18579] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2518'. [ 1573.750857][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1573.785265][T18581] loop0: detected capacity change from 0 to 8 [ 1574.113864][T18581] SQUASHFS error: Unable to read inode 0x9 [ 1574.437710][ T3632] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1574.636737][ T3632] usb 2-1: Using ep0 maxpacket: 16 [ 1574.772735][ T3632] usb 2-1: config 0 interface 0 altsetting 11 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1575.009089][ T3632] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1575.172879][ T3632] usb 2-1: New USB device found, idVendor=1038, idProduct=12c2, bcdDevice= 0.00 [ 1575.381465][ T3632] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1575.482439][ T3632] usb 2-1: config 0 descriptor?? [ 1575.601297][T18587] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1576.000562][ T3632] steelseries 0003:1038:12C2.0037: ignoring exceeding usage max [ 1576.058561][ T3632] steelseries 0003:1038:12C2.0037: unknown main item tag 0x1 [ 1576.405351][ T9146] usb 2-1: USB disconnect, device number 14 [ 1576.766848][T18626] loop8: detected capacity change from 0 to 4096 [ 1576.788501][T18630] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1576.834599][T18630] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1576.913489][T18626] ntfs3(loop8): Mark volume as dirty due to NTFS errors [ 1577.016915][T18626] ntfs3(loop8): Failed to load $Extend (-22). [ 1577.057878][T18626] ntfs3(loop8): Failed to initialize $Extend. [ 1577.430833][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1577.620869][ T3632] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1578.597699][ T3632] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1578.630980][ T3632] usb 2-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1578.685568][ T3632] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1578.742640][ T3632] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 1578.815885][ T3632] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 1578.878047][ T3632] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1579.038538][ T3632] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1579.054087][ T3632] usb 2-1: Product: syz [ 1579.129253][ T3632] usb 2-1: Manufacturer: syz [ 1579.474710][T18668] loop8: detected capacity change from 0 to 128 [ 1579.520995][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1579.670276][T18668] UDF-fs: error (device loop8): udf_read_tagged: read failed, block=256, location=256 [ 1579.825656][ T3632] cdc_wdm 2-1:1.0: skipping garbage [ 1579.887331][ T3632] cdc_wdm 2-1:1.0: skipping garbage [ 1580.019819][ T3632] cdc_wdm 2-1:1.0: cdc-wdm0: USB WDM device [ 1580.095407][ T3632] cdc_wdm 2-1:1.0: Unknown control protocol [ 1580.238186][ T3632] usb 2-1: USB disconnect, device number 15 [ 1581.915228][T18665] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1582.548770][T18696] file system registered [ 1582.619591][T18697] unloading [ 1583.995064][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1586.143694][T18730] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2555'. [ 1586.971648][T18742] loop1: detected capacity change from 0 to 128 [ 1587.009266][ T5866] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 1587.533042][T18747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1587.590111][ T5866] usb 9-1: config index 0 descriptor too short (expected 23569, got 27) [ 1587.666730][T18747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1587.683293][ T5866] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1587.703674][T18742] hpfs: filesystem error: invalid number of hotfixes: 2066844986, used: 2066844985; already mounted read-only [ 1587.717838][T18742] hpfs: filesystem error: improperly stopped [ 1587.730445][T18742] hpfs: filesystem error: warning: spare dnodes used, try chkdsk [ 1587.739396][T18742] hpfs: You really don't want any checks? You are crazy... [ 1587.746797][T18742] hpfs: Code page index out of array [ 1587.752396][T18742] hpfs: code page support is disabled [ 1587.758170][T18742] hpfs: hpfs_map_4sectors(): unaligned read [ 1587.764950][T18742] hpfs: hpfs_map_4sectors(): unaligned read [ 1587.771349][T18742] hpfs: filesystem error: unable to find root dir [ 1587.799761][ T5866] usb 9-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1587.857142][ T5866] usb 9-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1587.900147][ T5866] usb 9-1: Manufacturer: syz [ 1587.950810][ T5866] usb 9-1: config 0 descriptor?? [ 1588.275572][T18759] loop4: detected capacity change from 0 to 512 [ 1588.298603][T18759] EXT4-fs: group quota file already specified [ 1588.311304][ T5866] rc_core: IR keymap rc-hauppauge not found [ 1588.345128][ T5866] Registered IR keymap rc-empty [ 1589.189637][ T5866] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0 [ 1589.224196][ T5866] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input20 [ 1589.420750][ C0] igorplugusb 9-1:0.0: receive overflow invalid: 163 [ 1589.696749][ T5866] usb 9-1: USB disconnect, device number 12 [ 1589.836808][T18778] loop1: detected capacity change from 0 to 512 [ 1590.711036][T18778] EXT4-fs (loop1): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1590.997424][T18778] ext4 filesystem being mounted at /297/file1 supports timestamps until 2038-01-19 (0x7fffffff) [ 1591.476315][T18786] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1591.967578][T11696] EXT4-fs (loop1): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1593.243196][T18807] netlink: 'syz.1.2573': attribute type 14 has an invalid length. [ 1593.350957][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1595.020749][T14553] usb 7-1: new high-speed USB device number 20 using dummy_hcd [ 1595.921019][T14553] usb 7-1: Using ep0 maxpacket: 16 [ 1596.036192][T14553] usb 7-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1596.096018][T14553] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1596.142215][T14553] usb 7-1: Product: syz [ 1596.163685][T14553] usb 7-1: Manufacturer: syz [ 1596.205779][T14553] usb 7-1: SerialNumber: syz [ 1596.408490][T14553] usb 7-1: config 0 descriptor?? [ 1597.441082][T14553] dvb_usb_dtv5100 7-1:0.0: probe with driver dvb_usb_dtv5100 failed with error -110 [ 1598.254380][T18847] loop0: detected capacity change from 0 to 512 [ 1598.336039][T18848] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1598.626147][T15715] usb 7-1: USB disconnect, device number 20 [ 1598.649997][T18847] EXT4-fs (loop0): mounted filesystem 00000000-0000-0000-0000-000000000000 r/w without journal. Quota mode: writeback. [ 1598.790988][T18847] ext4 filesystem being mounted at /537/file0 supports timestamps until 2038-01-19 (0x7fffffff) [ 1599.183124][T18866] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1599.376936][ T30] kauditd_printk_skb: 11 callbacks suppressed [ 1599.376967][ T30] audit: type=1800 audit(1785632072.834:64): pid=18862 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.0.2589" name="file1" dev="loop0" ino=15 res=0 errno=0 [ 1599.567799][ T5627] EXT4-fs (loop0): unmounting filesystem 00000000-0000-0000-0000-000000000000. [ 1599.830334][T18889] loop4: detected capacity change from 0 to 16 [ 1599.895031][T18889] erofs (device loop4): mounted with root inode @ nid 36. [ 1599.964156][T18894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1599.997970][T18889] syz.4.2598: attempt to access beyond end of device [ 1599.997970][T18889] loop4: rw=8388608, sector=1936876908, nr_sectors = 1 limit=16 [ 1600.017460][T18889] syz.4.2598: attempt to access beyond end of device [ 1600.017460][T18889] loop4: rw=8388608, sector=3955228672, nr_sectors = 1 limit=16 [ 1600.102930][T18894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1600.177431][T18894] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1600.217163][T18894] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1600.391036][T10970] Bluetooth: hci3: command 0x0405 tx timeout [ 1602.068191][T18909] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1602.400897][T14553] usb 9-1: new low-speed USB device number 13 using dummy_hcd [ 1602.607232][T14553] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1602.647803][T14553] usb 9-1: config 0 has no interface number 0 [ 1602.690012][T14553] usb 9-1: config 0 interface 1 altsetting 19 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1602.760445][T14553] usb 9-1: config 0 interface 1 altsetting 19 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1602.771055][T18943] PM: suspend entry (deep) [ 1602.816179][T14553] usb 9-1: config 0 interface 1 has no altsetting 0 [ 1602.868312][T14553] usb 9-1: New USB device found, idVendor=2179, idProduct=0053, bcdDevice= 0.00 [ 1602.922315][T14553] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1602.996535][T14553] usb 9-1: config 0 descriptor?? [ 1603.300437][T18952] netlink: 4 bytes leftover after parsing attributes in process `syz.4.2616'. [ 1603.318393][ T778] Filesystems sync: 0.495 seconds [ 1603.393099][T18955] netlink: 28 bytes leftover after parsing attributes in process `syz.4.2616'. [ 1603.902623][T14553] uclogic 0003:2179:0053.0038: pen parameters not found [ 1603.919170][T14553] uclogic 0003:2179:0053.0038: interface is invalid, ignoring [ 1603.925489][T18943] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1603.935789][T14553] usb 9-1: USB disconnect, device number 13 [ 1604.210122][T18943] Freezing user space processes [ 1604.271360][T18943] Freezing user space processes completed (elapsed 0.034 seconds) [ 1604.279833][T18943] OOM killer disabled. [ 1604.286533][T18943] Freezing remaining freezable tasks [ 1604.301386][T18943] Freezing remaining freezable tasks completed (elapsed 0.008 seconds) [ 1604.311562][T18943] printk: Suspending console(s) (use no_console_suspend to debug) [ 1604.606794][T18943] vhci_hcd vhci_hcd.14: suspend vhci_hcd [ 1604.606944][T18943] vhci_hcd vhci_hcd.13: suspend vhci_hcd [ 1604.607069][T18943] vhci_hcd vhci_hcd.12: suspend vhci_hcd [ 1604.607173][T18943] vhci_hcd vhci_hcd.11: suspend vhci_hcd [ 1604.607286][T18943] vhci_hcd vhci_hcd.10: suspend vhci_hcd [ 1604.607388][T18943] vhci_hcd vhci_hcd.9: suspend vhci_hcd [ 1604.607495][T18943] vhci_hcd vhci_hcd.8: suspend vhci_hcd [ 1604.607619][T18943] vhci_hcd vhci_hcd.7: suspend vhci_hcd [ 1604.607714][T18943] vhci_hcd vhci_hcd.6: suspend vhci_hcd [ 1604.607827][T18943] vhci_hcd vhci_hcd.5: suspend vhci_hcd [ 1604.607952][T18943] vhci_hcd vhci_hcd.4: suspend vhci_hcd [ 1604.608051][T18943] vhci_hcd vhci_hcd.3: suspend vhci_hcd [ 1604.608184][T18943] vhci_hcd vhci_hcd.2: suspend vhci_hcd [ 1604.608316][T18943] vhci_hcd vhci_hcd.1: suspend vhci_hcd [ 1604.608417][T18943] vhci_hcd vhci_hcd.0: suspend vhci_hcd [ 1605.028178][ T75] sd 0:0:1:0: [sda] Synchronizing SCSI cache [ 1605.912887][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1606.148233][ C0] dummy_hcd dummy_hcd.0: timer fired with no URBs pending? [ 1607.045297][T18943] ACPI: PM: Preparing to enter system sleep state S3 [ 1607.046705][T18943] ACPI: PM: Saving platform NVS memory [ 1607.050234][T18943] Disabling non-boot CPUs ... [ 1607.099780][T18943] smpboot: CPU 1 is now offline [ 1607.187316][T18943] ACPI: PM: Low-level resume complete [ 1607.187370][T18943] ACPI: PM: Restoring platform NVS memory [ 1607.218610][T18943] Enabling non-boot CPUs ... [ 1607.238243][T18943] smpboot: Booting Node 0 Processor 1 APIC 0x1 [ 1607.257253][T18943] CPU1 is up [ 1607.258577][T18943] ACPI: PM: Waking up from system sleep state S3 [ 1607.424329][T18980] virtio_scsi virtio0: 1/0/0 default/read/poll queues [ 1607.660013][ C0] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.661053][ C1] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.962326][T18990] usb 1-1: reset high-speed USB device number 3 using dummy_hcd [ 1608.031437][ T9074] Bluetooth: hci3: command 0x0405 tx timeout [ 1608.114001][T18990] usb 1-1: device firmware changed [ 1608.170574][T18943] OOM killer enabled. [ 1608.171195][T18943] Restarting tasks: Starting [ 1608.248561][T11935] usb 1-1: USB disconnect, device number 3 [ 1608.287448][T18943] Restarting tasks: Done [ 1608.318801][T18943] random: crng reseeded on system resumption [ 1608.363264][T18943] PM: suspend exit [ 1609.574252][T11935] ================================================================== [ 1609.575447][T11935] BUG: KASAN: slab-use-after-free in snd_usb_midi_v2_free+0x52d/0x670 [ 1609.576840][T11935] Write of size 8 at addr ffff88807735a350 by task kworker/1:0/11935 [ 1609.578032][T11935] [ 1609.578498][T11935] CPU: 1 UID: 0 PID: 11935 Comm: kworker/1:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1609.578557][T11935] Tainted: [L]=SOFTLOCKUP [ 1609.578572][T11935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1609.578607][T11935] Workqueue: usb_hub_wq hub_event [ 1609.578800][T11935] Call Trace: [ 1609.578865][T11935] [ 1609.578880][T11935] dump_stack_lvl+0x100/0x190 [ 1609.579057][T11935] print_report+0x13d/0x4b0 [ 1609.579173][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.579224][T11935] ? __virt_addr_valid+0x239/0x430 [ 1609.579366][T11935] ? snd_usb_midi_v2_free+0x52d/0x670 [ 1609.579413][T11935] kasan_report+0xdf/0x1c0 [ 1609.579530][T11935] ? snd_usb_midi_v2_free+0x52d/0x670 [ 1609.579587][T11935] snd_usb_midi_v2_free+0x52d/0x670 [ 1609.579636][T11935] ? __pfx_snd_ctl_dev_free+0x10/0x10 [ 1609.579747][T11935] snd_usb_midi_v2_free_all+0x85/0xe0 [ 1609.579800][T11935] snd_usb_audio_free+0x4e/0x120 [ 1609.579884][T11935] ? __pfx_snd_usb_audio_free+0x10/0x10 [ 1609.579942][T11935] release_card_device+0xb2/0x1a0 [ 1609.579985][T11935] ? __pfx_release_card_device+0x10/0x10 [ 1609.580027][T11935] device_release+0xd2/0x270 [ 1609.580136][T11935] kobject_put+0x1f7/0x640 [ 1609.580238][T11935] ? snd_card_disconnect.part.0+0x443/0x5b0 [ 1609.580291][T11935] put_device+0x1f/0x30 [ 1609.580329][T11935] snd_card_free_when_closed+0x2b/0x40 [ 1609.580372][T11935] usb_audio_disconnect+0x210/0x680 [ 1609.580435][T11935] usb_unbind_interface+0x1dd/0x9e0 [ 1609.580522][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.580570][T11935] ? __pfx_usb_unbind_interface+0x10/0x10 [ 1609.580631][T11935] device_remove+0x12a/0x180 [ 1609.580731][T11935] device_release_driver_internal+0x44e/0x620 [ 1609.580813][T11935] ? __entry_text_end+0x1020b5/0x1020b9 [ 1609.580866][T11935] bus_remove_device+0x2bc/0x560 [ 1609.580915][T11935] ? __pfx_bus_remove_device+0x10/0x10 [ 1609.580963][T11935] ? __pfx_device_remove_attrs+0x10/0x10 [ 1609.581019][T11935] device_del+0x376/0x9b0 [ 1609.581072][T11935] ? __pfx_device_del+0x10/0x10 [ 1609.581124][T11935] ? __pfx___pm_runtime_barrier+0x10/0x10 [ 1609.581221][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.581303][T11935] usb_disable_device+0x367/0x810 [ 1609.581356][T11935] ? mark_held_locks+0x40/0x70 [ 1609.581470][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.581525][T11935] usb_disconnect+0x2e2/0x9a0 [ 1609.581585][T11935] hub_event+0x1c4f/0x4a60 [ 1609.581657][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.581706][T11935] ? __lock_acquire+0x49f/0x1a40 [ 1609.581750][T11935] ? do_raw_spin_unlock+0x145/0x1e0 [ 1609.581805][T11935] ? __pfx_hub_event+0x10/0x10 [ 1609.581859][T11935] ? debug_object_deactivate+0x2e4/0x3b0 [ 1609.582004][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.582054][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.582104][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.582154][T11935] ? rcu_is_watching+0x12/0xc0 [ 1609.582252][T11935] process_one_work+0xa23/0x1940 [ 1609.582339][T11935] ? __pfx_process_one_work+0x10/0x10 [ 1609.582376][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.582431][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.582484][T11935] worker_thread+0x5ef/0xe50 [ 1609.582529][T11935] ? __pfx_worker_thread+0x10/0x10 [ 1609.582568][T11935] ? kthread+0x13a/0x450 [ 1609.582676][T11935] ? __pfx_worker_thread+0x10/0x10 [ 1609.582714][T11935] kthread+0x370/0x450 [ 1609.582772][T11935] ? __pfx_kthread+0x10/0x10 [ 1609.582857][T11935] ret_from_fork+0x72b/0xd50 [ 1609.582951][T11935] ? __pfx_ret_from_fork+0x10/0x10 [ 1609.583003][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1609.583051][T11935] ? __switch_to+0x800/0x10f0 [ 1609.583154][T11935] ? __switch_to_asm+0x39/0x70 [ 1609.583209][T11935] ? __pfx_kthread+0x10/0x10 [ 1609.583275][T11935] ret_from_fork_asm+0x1a/0x30 [ 1609.583345][T11935] [ 1609.583359][T11935] [ 1609.633919][T11935] Allocated by task 5866: [ 1609.634617][T11935] kasan_save_stack+0x30/0x50 [ 1609.635349][T11935] kasan_save_track+0x14/0x30 [ 1609.636038][T11935] __kasan_kmalloc+0xaa/0xb0 [ 1609.636713][T11935] __kmalloc_cache_noprof+0x2e5/0x6c0 [ 1609.637537][T11935] snd_ump_endpoint_new+0x93/0x470 [ 1609.638290][T11935] create_midi2_ump+0x2dd/0x920 [ 1609.638989][T11935] snd_usb_midi_v2_create+0x11fa/0x4070 [ 1609.639789][T11935] snd_usb_create_stream.isra.0+0x386/0x4d0 [ 1609.640661][T11935] usb_audio_probe+0xf05/0x3b10 [ 1609.641367][T11935] usb_probe_interface+0x303/0x8f0 [ 1609.642103][T11935] really_probe+0x241/0xa60 [ 1609.642766][T11935] __driver_probe_device+0x20e/0x450 [ 1609.643525][T11935] driver_probe_device+0x4a/0x140 [ 1609.644271][T11935] __device_attach_driver+0x1df/0x320 [ 1609.645041][T11935] bus_for_each_drv+0x159/0x1e0 [ 1609.645723][T11935] __device_attach+0x1e4/0x4d0 [ 1609.646415][T11935] device_initial_probe+0xaf/0xd0 [ 1609.647143][T11935] bus_probe_device+0x64/0x160 [ 1609.647828][T11935] device_add+0x121d/0x1970 [ 1609.648493][T11935] usb_set_configuration+0xd97/0x1c60 [ 1609.649252][T11935] usb_generic_driver_probe+0xa1/0xe0 [ 1609.650091][T11935] usb_probe_device+0xef/0x400 [ 1609.650771][T11935] really_probe+0x241/0xa60 [ 1609.651585][T11935] __driver_probe_device+0x20e/0x450 [ 1609.652344][T11935] driver_probe_device+0x4a/0x140 [ 1609.653060][T11935] __device_attach_driver+0x1df/0x320 [ 1609.653821][T11935] bus_for_each_drv+0x159/0x1e0 [ 1609.654503][T11935] __device_attach+0x1e4/0x4d0 [ 1609.655180][T11935] device_initial_probe+0xaf/0xd0 [ 1609.655898][T11935] bus_probe_device+0x64/0x160 [ 1609.656582][T11935] device_add+0x121d/0x1970 [ 1609.657235][T11935] usb_new_device.cold+0x685/0x115c [ 1609.658313][T11935] hub_event+0x30a3/0x4a60 [ 1609.658979][T11935] process_one_work+0xa23/0x1940 [ 1609.659714][T11935] worker_thread+0x5ef/0xe50 [ 1609.660407][T11935] kthread+0x370/0x450 [ 1609.661016][T11935] ret_from_fork+0x72b/0xd50 [ 1609.661685][T11935] ret_from_fork_asm+0x1a/0x30 [ 1609.662414][T11935] [ 1609.662754][T11935] Freed by task 11935: [ 1609.663323][T11935] kasan_save_stack+0x30/0x50 [ 1609.664001][T11935] kasan_save_track+0x14/0x30 [ 1609.664691][T11935] kasan_save_free_info+0x3b/0x70 [ 1609.665415][T11935] __kasan_slab_free+0x5f/0x80 [ 1609.666139][T11935] kfree+0x22b/0x6c0 [ 1609.666728][T11935] snd_rawmidi_dev_free+0x3e/0x60 [ 1609.667447][T11935] __snd_device_free+0x1a3/0x300 [ 1609.668169][T11935] snd_device_free_all+0xf3/0x220 [ 1609.668895][T11935] release_card_device+0x77/0x1a0 [ 1609.669619][T11935] device_release+0xd2/0x270 [ 1609.670287][T11935] kobject_put+0x1f7/0x640 [ 1609.670993][T11935] put_device+0x1f/0x30 [ 1609.671602][T11935] snd_card_free_when_closed+0x2b/0x40 [ 1609.672404][T11935] usb_audio_disconnect+0x210/0x680 [ 1609.673164][T11935] usb_unbind_interface+0x1dd/0x9e0 [ 1609.673922][T11935] device_remove+0x12a/0x180 [ 1609.674668][T11935] device_release_driver_internal+0x44e/0x620 [ 1609.675546][T11935] bus_remove_device+0x2bc/0x560 [ 1609.676253][T11935] device_del+0x376/0x9b0 [ 1609.676886][T11935] usb_disable_device+0x367/0x810 [ 1609.677610][T11935] usb_disconnect+0x2e2/0x9a0 [ 1609.678278][T11935] hub_event+0x1c4f/0x4a60 [ 1609.678915][T11935] process_one_work+0xa23/0x1940 [ 1609.679617][T11935] worker_thread+0x5ef/0xe50 [ 1609.680264][T11935] kthread+0x370/0x450 [ 1609.680861][T11935] ret_from_fork+0x72b/0xd50 [ 1609.681529][T11935] ret_from_fork_asm+0x1a/0x30 [ 1609.682217][T11935] [ 1609.682573][T11935] The buggy address belongs to the object at ffff88807735a000 [ 1609.682573][T11935] which belongs to the cache kmalloc-4k of size 4096 [ 1609.684538][T11935] The buggy address is located 848 bytes inside of [ 1609.684538][T11935] freed 4096-byte region [ffff88807735a000, ffff88807735b000) [ 1609.686844][T11935] [ 1609.687297][T11935] The buggy address belongs to the physical page: [ 1609.688356][T11935] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x77358 [ 1609.689626][T11935] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 1609.690786][T11935] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 1609.691868][T11935] page_type: f5(slab) [ 1609.692498][T11935] raw: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122 [ 1609.693680][T11935] raw: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 1609.694893][T11935] head: 00fff00000000040 ffff88813fe22140 dead000000000100 dead000000000122 [ 1609.696074][T11935] head: 0000000000000000 0000000800040004 00000000f5000000 0000000000000000 [ 1609.697258][T11935] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 1609.698440][T11935] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 1609.699803][T11935] page dumped because: kasan: bad access detected [ 1609.700795][T11935] page_owner tracks the page as allocated [ 1609.701591][T11935] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5608, tgid 5608 (syz-executor), ts 115473479035, free_ts 115434332755 [ 1609.704528][T11935] post_alloc_hook+0xfd/0x120 [ 1609.705269][T11935] get_page_from_freelist+0xf48/0x3530 [ 1609.706069][T11935] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 1609.706914][T11935] new_slab+0xa2/0x640 [ 1609.707530][T11935] refill_objects+0xe3/0x410 [ 1609.708206][T11935] __pcs_replace_empty_main+0x376/0x680 [ 1609.709031][T11935] __kmalloc_cache_noprof+0x479/0x6c0 [ 1609.709814][T11935] __pollwait+0x2c3/0x490 [ 1609.710533][T11935] pipe_poll+0x263/0x6e0 [ 1609.711185][T11935] do_select+0xd54/0x1850 [ 1609.711815][T11935] core_sys_select+0x55b/0xbb0 [ 1609.712517][T11935] do_pselect.constprop.0+0x238/0x270 [ 1609.713310][T11935] __x64_sys_pselect6+0x149/0x1c0 [ 1609.714056][T11935] do_syscall_64+0x115/0x870 [ 1609.714734][T11935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1609.715597][T11935] page last free pid 5627 tgid 5627 stack trace: [ 1609.716472][T11935] __free_frozen_pages+0x79f/0x1090 [ 1609.717211][T11935] qlist_free_all+0x47/0xf0 [ 1609.717889][T11935] kasan_quarantine_reduce+0x1a0/0x1f0 [ 1609.718748][T11935] __kasan_slab_alloc+0x69/0x90 [ 1609.719439][T11935] kmem_cache_alloc_node_noprof+0x27d/0x6b0 [ 1609.720302][T11935] __alloc_skb+0x140/0x710 [ 1609.721010][T11935] netlink_ack+0x117/0xb80 [ 1609.721699][T11935] netlink_rcv_skb+0x333/0x420 [ 1609.722429][T11935] genl_rcv+0x28/0x40 [ 1609.723045][T11935] netlink_unicast+0x585/0x850 [ 1609.723804][T11935] netlink_sendmsg+0x8b0/0xda0 [ 1609.724505][T11935] __sys_sendto+0x48b/0x4e0 [ 1609.725251][T11935] __x64_sys_sendto+0xe0/0x1c0 [ 1609.725936][T11935] do_syscall_64+0x115/0x870 [ 1609.726612][T11935] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1609.727433][T11935] [ 1609.727774][T11935] Memory state around the buggy address: [ 1609.728557][T11935] ffff88807735a200: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1609.729659][T11935] ffff88807735a280: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1609.730771][T11935] >ffff88807735a300: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1609.731864][T11935] ^ [ 1609.732776][T11935] ffff88807735a380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1609.733865][T11935] ffff88807735a400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 1609.735023][T11935] ================================================================== [ 1610.030132][T11935] Kernel panic - not syncing: kasan.fault=panic_on_write set ... [ 1610.031288][T11935] CPU: 1 UID: 0 PID: 11935 Comm: kworker/1:0 Tainted: G L syzkaller #0 PREEMPT(full) [ 1610.032809][T11935] Tainted: [L]=SOFTLOCKUP [ 1610.033478][T11935] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026 [ 1610.034838][T11935] Workqueue: usb_hub_wq hub_event [ 1610.035578][T11935] Call Trace: [ 1610.036105][T11935] [ 1610.036581][T11935] dump_stack_lvl+0x100/0x190 [ 1610.037352][T11935] vpanic+0x552/0x970 [ 1610.037944][T11935] ? __pfx_vpanic+0x10/0x10 [ 1610.038611][T11935] ? __pfx___schedule+0x10/0x10 [ 1610.039378][T11935] ? snd_usb_midi_v2_free+0x52d/0x670 [ 1610.040160][T11935] panic+0xd1/0xe0 [ 1610.040722][T11935] ? __pfx_panic+0x10/0x10 [ 1610.041408][T11935] ? preempt_schedule_common+0x42/0xc0 [ 1610.042203][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.043003][T11935] ? preempt_schedule_thunk+0x16/0x40 [ 1610.043835][T11935] end_report.part.0+0x68/0x90 [ 1610.044545][T11935] kasan_report.cold+0xe/0x18 [ 1610.045224][T11935] ? snd_usb_midi_v2_free+0x52d/0x670 [ 1610.046022][T11935] snd_usb_midi_v2_free+0x52d/0x670 [ 1610.046760][T11935] ? __pfx_snd_ctl_dev_free+0x10/0x10 [ 1610.047530][T11935] snd_usb_midi_v2_free_all+0x85/0xe0 [ 1610.048293][T11935] snd_usb_audio_free+0x4e/0x120 [ 1610.049010][T11935] ? __pfx_snd_usb_audio_free+0x10/0x10 [ 1610.049823][T11935] release_card_device+0xb2/0x1a0 [ 1610.050541][T11935] ? __pfx_release_card_device+0x10/0x10 [ 1610.051346][T11935] device_release+0xd2/0x270 [ 1610.052007][T11935] kobject_put+0x1f7/0x640 [ 1610.052661][T11935] ? snd_card_disconnect.part.0+0x443/0x5b0 [ 1610.053512][T11935] put_device+0x1f/0x30 [ 1610.054127][T11935] snd_card_free_when_closed+0x2b/0x40 [ 1610.054913][T11935] usb_audio_disconnect+0x210/0x680 [ 1610.055673][T11935] usb_unbind_interface+0x1dd/0x9e0 [ 1610.056426][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.057221][T11935] ? __pfx_usb_unbind_interface+0x10/0x10 [ 1610.058046][T11935] device_remove+0x12a/0x180 [ 1610.058737][T11935] device_release_driver_internal+0x44e/0x620 [ 1610.059633][T11935] ? __entry_text_end+0x1020b5/0x1020b9 [ 1610.060430][T11935] bus_remove_device+0x2bc/0x560 [ 1610.061147][T11935] ? __pfx_bus_remove_device+0x10/0x10 [ 1610.061917][T11935] ? __pfx_device_remove_attrs+0x10/0x10 [ 1610.062718][T11935] device_del+0x376/0x9b0 [ 1610.063349][T11935] ? __pfx_device_del+0x10/0x10 [ 1610.064053][T11935] ? __pfx___pm_runtime_barrier+0x10/0x10 [ 1610.064863][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.065664][T11935] usb_disable_device+0x367/0x810 [ 1610.066420][T11935] ? mark_held_locks+0x40/0x70 [ 1610.067112][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.067934][T11935] usb_disconnect+0x2e2/0x9a0 [ 1610.068623][T11935] hub_event+0x1c4f/0x4a60 [ 1610.069280][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.070082][T11935] ? __lock_acquire+0x49f/0x1a40 [ 1610.070783][T11935] ? do_raw_spin_unlock+0x145/0x1e0 [ 1610.071525][T11935] ? __pfx_hub_event+0x10/0x10 [ 1610.072256][T11935] ? debug_object_deactivate+0x2e4/0x3b0 [ 1610.073074][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.073869][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.074663][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.075454][T11935] ? rcu_is_watching+0x12/0xc0 [ 1610.076150][T11935] process_one_work+0xa23/0x1940 [ 1610.076858][T11935] ? __pfx_process_one_work+0x10/0x10 [ 1610.077618][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.078419][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.079222][T11935] worker_thread+0x5ef/0xe50 [ 1610.079930][T11935] ? __pfx_worker_thread+0x10/0x10 [ 1610.080756][T11935] ? kthread+0x13a/0x450 [ 1610.081394][T11935] ? __pfx_worker_thread+0x10/0x10 [ 1610.082146][T11935] kthread+0x370/0x450 [ 1610.082760][T11935] ? __pfx_kthread+0x10/0x10 [ 1610.083440][T11935] ret_from_fork+0x72b/0xd50 [ 1610.084138][T11935] ? __pfx_ret_from_fork+0x10/0x10 [ 1610.084920][T11935] ? srso_alias_return_thunk+0x5/0xfbef5 [ 1610.085728][T11935] ? __switch_to+0x800/0x10f0 [ 1610.086429][T11935] ? __switch_to_asm+0x39/0x70 [ 1610.087129][T11935] ? __pfx_kthread+0x10/0x10 [ 1610.087809][T11935] ret_from_fork_asm+0x1a/0x30 [ 1610.088524][T11935] [ 1610.089372][T11935] Kernel Offset: disabled [ 1610.090020][T11935] Rebooting in 86400 seconds..