last executing test programs: 17m11.339355872s ago: executing program 0 (id=354): mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000080)='./file0\x00') open$dir(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) open$dir(&(0x7f0000000140)='./file0\x00', 0x1, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) fsconfig$FSCONFIG_SET_PATH(0xffffffffffffffff, 0x3, &(0x7f0000000100)='(:\x00', &(0x7f0000000140)='./file0\x00', 0xffffffffffffffff) syz_genetlink_get_family_id$devlink(&(0x7f0000000300), 0xffffffffffffffff) r0 = syz_genetlink_get_family_id$tipc(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$IPCTNL_MSG_CT_GET_STATS_CPU(0xffffffffffffffff, &(0x7f0000000600)={&(0x7f0000000540)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x14, 0x4, 0x1, 0x101, 0x0, 0x0, {0x2, 0x0, 0x3}, ["", "", "", "", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x8000805) sendmsg$TIPC_CMD_SET_LINK_PRI(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000440)={&(0x7f0000000640)=ANY=[@ANYBLOB="68000000792e21e81ee948eaacd81eb5a391ef5aaf7bc91c73cf0d89191cb3bbf3c22e96343fd4b1dc2b96c54008dcd9d985ae03723ecad0c055176e7acb8717b4ebe6f6d0b40906316756f4774a2142bfd997190c805198b51b1a4bbf1ab1e5b062fde02982e6753cf7138b9736a6e7f3842425950b27a4199812d79abbf6963028a67a0b7c93", @ANYRES16=r0, @ANYBLOB="00012dbd7000fcdbdf25010000000000000008410000004c00180000691273797a3100"/98], 0x68}, 0x1, 0x0, 0x0, 0x20000001}, 0x1010) 17m11.206973287s ago: executing program 0 (id=360): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_SIOCETHTOOL(r1, 0x89f1, &(0x7f0000000340)={'ip6_vti0\x00', &(0x7f0000000040)=@ethtool_eee={0x45, 0x9, 0x1, 0xd, 0x6, 0x1000, 0x100, 0x8, [0x4cc, 0xffff]}}) r2 = syz_open_dev$loop(&(0x7f0000000140), 0x54, 0x600a00) ioctl$LOOP_CHANGE_FD(r2, 0x4c06, r1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r3 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r3, 0x89f2, &(0x7f0000000340)={'tunl0\x00', 0x0}) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x2, 0x8, 0x0, 0x3}, 0x0) add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000040)={'syz', 0x0}, &(0x7f0000000080)="ae", 0x1001, 0xffffffffffffffff) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfb, {0x0, 0x0, 0x0, r6, {0x0, 0x1}, {0xffff, 0xffff}, {0xffff, 0x9}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004}, 0x4000) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=@newtfilter={0x44, 0x2c, 0xc3f, 0x70bd2d, 0x25dfdbf9, {0x0, 0x0, 0x0, r6, {0x3, 0x2}, {}, {0x7, 0xffe0}}, [@filter_kind_options=@f_flower={{0xb}, {0x14, 0x2, [@TCA_FLOWER_KEY_ETH_TYPE={0x6, 0x8, 0x8100}, @TCA_FLOWER_KEY_VLAN_ETH_TYPE={0x6, 0x19, 0x88a8}]}}]}, 0x44}, 0x1, 0x0, 0x0, 0x20000810}, 0x20084084) 17m10.176030425s ago: executing program 0 (id=364): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/mcfilter\x00') syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc000) keyctl$dh_compute(0x17, 0x0, &(0x7f00000000c0)=""/83, 0x53, 0x0) read$FUSE(r0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc2(&(0x7f00000057c0), 0xffffffffffffffff) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) listen(r2, 0x1000) r3 = syz_open_procfs(0x0, &(0x7f0000002040)='net/tcp\x00') read$FUSE(r3, &(0x7f0000000000)={0x2020}, 0x96) close(r2) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00'}) read$FUSE(r3, &(0x7f0000005040)={0x2020}, 0x2020) 17m9.256365873s ago: executing program 0 (id=369): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./proc\x00', &(0x7f0000000080)='proc\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f00000012c0)='./proc/net/rpc/auth.unix.ip/channel\x00', 0x2, 0x0) write(r1, &(0x7f00000001c0)='nfsd 127.0.0.1 2147483647 *\n', 0x1c) r2 = openat(r1, &(0x7f0000000200)='./proc/net/rpc/nfsd.export/channel\x00', 0x402, 0x0) write(r2, &(0x7f0000000240)='* . 2147483647 8192 65534 65534 1 secinfo 1 1 0\n', 0x30) r3 = openat(0xffffffffffffff9c, &(0x7f0000001300)='./file0\x00', 0x480800, 0x0) mkdir(&(0x7f0000001c00)='./file0\x00', 0x0) mount$bind(&(0x7f0000000c40)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2901090, 0x0) mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x2a05004, 0x0) read(r3, &(0x7f00000002c0)=""/4096, 0x1000) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x4) mount$9p_virtio(&(0x7f0000000280), &(0x7f0000000100)='./proc/net/rpc/auth.unix.ip/channel\x00', &(0x7f0000000180), 0x10000, 0x0) lremovexattr(&(0x7f0000000200)='./file0\x00', &(0x7f0000000240)=@known='system.posix_acl_access\x00') mprotect(&(0x7f0000003000/0x4000)=nil, 0x4000, 0x2000009) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) listns(&(0x7f00000010c0)={0x20, 0x0, 0x7, 0x40000000}, 0x0, 0xf4240, 0x0) 17m8.786087412s ago: executing program 0 (id=373): r0 = syz_open_dev$vcsa(&(0x7f0000006180), 0x4, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000002000)='./mysys\x00', 0x1ff) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0403"], 0xe) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000a80)=@security={'security\x00', 0x44, 0x4, 0x4a4, 0xffffffff, 0x314, 0x314, 0x0, 0xffffffff, 0xffffffff, 0x3dc, 0x3dc, 0x3dc, 0xffffffff, 0x4, 0x0, {[{{@ipv6={@mcast1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x7f}}, [0xffffff00, 0xff, 0x0, 0xffffffff], [0xff000000, 0xff000000, 0xffffff00, 0x7e5debfdf7c2f28d], 'vlan0\x00', 'batadv_slave_0\x00', {0xff}, {0xff}, 0x3a, 0xf, 0x0, 0x4}, 0x203, 0x124, 0x148, 0x8502, {}, [@common=@unspec=@connbytes={{0x38}, {[{0x91}, {0x2}], 0x1}}, @common=@hbh={{0x48}, {0x8, 0x2, 0x1, [0x8007, 0xfff9, 0x8000, 0xa2, 0x8200, 0xb4f3, 0xffff, 0x6, 0x41, 0x7, 0xfffc, 0x6, 0x8, 0x1, 0x8, 0xd], 0x10}}]}, @common=@unspec=@CONNSECMARK={0x24, 'CONNSECMARK\x00', 0x0, {0x2}}}, {{@uncond, 0x0, 0xa4, 0x1cc}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x0, 0x200000, 'system_u:object_r:modem_device_t:s0\x00'}}}, {{@ipv6={@empty, @dev={0xfe, 0x80, '\x00', 0x42}, [0xff, 0xffffff, 0xff000000, 0xff], [0xffffffff, 0xff, 0xffffff00, 0xffffff00], 'macvtap0\x00', 'veth0_to_bond\x00', {}, {0xff}, 0x16, 0x14, 0x0, 0x38}, 0x0, 0xa4, 0xc8}, @common=@unspec=@CLASSIFY={0x24, 'CLASSIFY\x00', 0x0, {0x2}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x500) syz_emit_vhci(&(0x7f0000000280)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2) r2 = syz_clone(0x5802080, &(0x7f00000002c0), 0x0, &(0x7f0000000300), &(0x7f0000000340), &(0x7f0000000380)="970d48f6e53314feed09862a6567fe86ed52") socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r3, &(0x7f0000000500)={&(0x7f0000000040)=@hci, 0x80, &(0x7f0000000100)=[{&(0x7f0000000400)=""/248, 0x60ae0}], 0x318, 0x0, 0xdb0, 0xf5ffffff}, 0x0) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0x18, &(0x7f00000000c0), 0x31}, 0x0) sendmsg$sock(r3, &(0x7f0000000940)={0x0, 0x0, 0x0}, 0x8004) sched_setattr(r2, &(0x7f00000003c0)={0x38, 0x0, 0x2, 0x4, 0x1, 0x8, 0x0, 0x1, 0x5, 0x8}, 0x0) mount(0x0, &(0x7f0000002000)='./mysys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0) r5 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_BUFINFO(r5, 0xc02c640e, &(0x7f0000000000)={0x6, 0x101, 0x7fff, 0x5377, 0x17c, 0x7ffffffb, 0x1ff}) r6 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./mysys/module/ueagle_atm/parameters/sync_wait\x00', 0x1, 0x0) write(r6, &(0x7f0000000200)='0,', 0x2) poll(&(0x7f00000061c0), 0x0, 0x3) r7 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000600)={'vcan0\x00', 0x0}) bind$can_raw(r7, &(0x7f0000000240)={0x1d, r8}, 0x10) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.stat\x00', 0x275a, 0x0) write$FUSE_INIT(r9, &(0x7f0000000140)={0x50, 0x0, 0x0, {0x7, 0x29, 0x0, 0x10082c0c, 0x1, 0x80, 0x5, 0x7, 0x0, 0x0, 0x10, 0x8000002}}, 0x50) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_netdev_private(r10, 0x894c, 0x0) sendfile(r7, r9, &(0x7f0000000040), 0xfffffdef) umount2(&(0x7f0000000040)='./mysys/module/ueagle_atm/parameters/sync_wait\x00', 0x0) write$P9_RFSYNC(r0, &(0x7f0000006240)={0x7, 0x33, 0x1}, 0x7) 17m8.387292781s ago: executing program 0 (id=376): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mount(&(0x7f0000000040)=@md0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='ntfs3\x00', 0x2006010, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1200000004000000060000000280000000000000", @ANYRES32=r1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000f677dd01d23b065c28e7a5114feb6a00ea5199d065c2800cea2363f9eb9c93be4c140a11e10c0bbb9f603bb681c609c1f8c54723c48136a7"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r5, 0x0, 0x0}, 0x20) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x200000, 0x2) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) prctl$PR_PAC_RESET_KEYS(0x36, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004000000010300800c0001"], 0x314}], 0x1}, 0x800) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x20007, 0x30}, 0xc) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r7, &(0x7f00000002c0)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r7, 0x4) sendto$inet6(r6, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r6, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="11", 0xfffd}], 0x1}}], 0x1, 0x8015) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) openat$sr(0xffffff9c, &(0x7f0000000000), 0x40500, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) 17m8.332760406s ago: executing program 32 (id=376): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mount(&(0x7f0000000040)=@md0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='ntfs3\x00', 0x2006010, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1200000004000000060000000280000000000000", @ANYRES32=r1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000f677dd01d23b065c28e7a5114feb6a00ea5199d065c2800cea2363f9eb9c93be4c140a11e10c0bbb9f603bb681c609c1f8c54723c48136a7"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r5, 0x0, 0x0}, 0x20) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x200000, 0x2) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) prctl$PR_PAC_RESET_KEYS(0x36, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004000000010300800c0001"], 0x314}], 0x1}, 0x800) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x20007, 0x30}, 0xc) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r7, &(0x7f00000002c0)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r7, 0x4) sendto$inet6(r6, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r6, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="11", 0xfffd}], 0x1}}], 0x1, 0x8015) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) openat$sr(0xffffff9c, &(0x7f0000000000), 0x40500, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) 16m5.540111952s ago: executing program 1 (id=676): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) mkdir(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) write(r1, &(0x7f0000000200)="898e442382ea7bb0148093b8eafa09adbf407cebb6b5783ef09a1fc6fe745f905a5b7aba43bc424f516596e4e1c627ee68bad72c85daef4083d2e5446eaaeb67f820d70bbb41e9881cefd985dbba27204d54f805a83d58", 0x57) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={0x104c, 0x17, 0x1, 0x70bd26, 0x25dfdbfd, {0x4a}, [@nested={0x38, 0x5d, 0x0, 0x1, [@nested={0x34, 0x36, 0x0, 0x1, [@generic="490fbcfff697579b7a0db181037aba8cea82cd3cb8ac8614e0c67256e92af8a7b0736f24d98ea2815791cf33e667a079"]}]}, @generic="24239983087d2874b2266902c422a907de258fdd8ae3d20efcd08b1baaa414437da6d912fae8d315de617b1912ee72a4a371db5dcb8ec1498f3b0bd5ba552d9fdf33193ad45424f10e49f52b823693abdac9f6953a4cd0b80e5c9e31b0b8b53984026a2d4dcca7c895e4b7ca28c12bdad066de6ab959bef01c91bb878f24105f569617a527f36078e47de7810ad0e619e960db55837c7c017ccb32d28de893cde546c3f7dbb3b583f3cdf1b29657344c6d2b87fef288b6c6552b7cb15657698f8a981bed38206994c5d23c3ebcc24d5f9f6d3909839bae25f9daae1d5903e8e2ca2d507cf5a70beb0eb4266e46ea5b553186a949039e03f5f543f77683ec4149d4d38dc0b23f2c1edb303327b720e906dbbe95bea5359a196d5103c71c610ca15585d3fc0838ec09e5b2c2f1698531e6bcf49dfcd9e8c9ae3458e878a11fbf5a35f22ee0406271b5be504a6f4359b96e8b233c3219fe2c5b86c6d17af05333a7b7c20bf8b3c32fd19df8e8ac46197f309b113204630e5e8976397eff77444c762ee95ef3a797631001cc1e79e20e3f860f9b24521a100974321d71bed9526b62bfc55ab414421a2605ffd086dae389538846735656ab010a0aa5b4dd7e93cbb45fb8fe60770e6872c2200283cafc9ee2a8d4e53d4199ead9de3e231cd4bf59f71cf021b9e3c29449d03ec381d3123b88a8c1bedd23d1a134a53963e736b3e8e20c83177b3c83ab172a53a255ca148c8ba834407889c7fa7a0eee17bbecadc6353725ce51be9bccf2b5e85fb5481fdcc62e3f08a138c1e4721ec578354852b0298d6d680d21b3776b2f8be9b7ab878660d38bbe0aa5cbfbfbd29374961a95eade9224a644af4173df81efc8959d995a12cc479f95db85d12ba1281492515b5dfdd674232ced36243cebf25390eeeae8efe80946298269e1f24b0da1d8cf10ae1fba28d5f8a63f0218be2849f4f46dfd452bb65a9500e4fa2882a331803e8f1d0e56f373c022fe7397eec270dc9eaa6e9c1a3d22b8ba35fe85047ea892a7db5bf578bf7a0d31a112cf57c5bf2dedbbd84357f846a53560c411140310506967df20ce6cb89a91d955940197ecfa3f6aff550d94810a04f3490143a705f9ac33a31724c4227999f25bc04d4a2dd37d390c65a2702e52ed6cc1c5cd6405b8b83001a7f47fbbfe4843acf3274434bf1fa4a8e1b037b76cab25a96dae26026da4ecd05b33604c704ad1e9d72b06bb2bb7039bc69d27e34b794a5be13185b7e4f7a93bb098a043a7cec88fb6dd641a7d17824219f27471fd15b6e45995d36af4afae441ee217ea878cf31fa043967ce532897f3942f65beef7d39a88de8fa239472814b50737ae0d582fb698216b50789abebfb81f88f8d6cf8188ead16cc1e820eb219c857831c9501d46ff5122f88ba0e7616b909c12941e3b1644ecc8849980581d9808b2ac5ae85086c910e589eb34f3bb686642c20f4592e45f39b6756a8d0b1f5f0d0cf5f9186d650c22452ad0f64b154ceb0a02631283cc3aff70670193d7312956c429121481b5920490e5d9cbf4b9aa68b35ddfd0e978522d8a2c6a730786b564c7b3f3ef563dd3c1517ccc823078798f74d9d637454cf8c642c1a7d97d38d2eb6b79a1e7463c11c9903a0004d4706aefa1417c69b23aad7c569963cfc7abcf865a8192b08d2214e47f8b167b360e17aaa021905388eef134b82d977a1c67115ee93b0b306ab31c78a7253fd3a23be0fda6cd89932a5a58c135fda1d3f7bc962d43b5e60cf4be73dc24fdb0d209db09a6cca2b3333110910cf3fac79c4f071c946595b9d42053d46d36bc78067e9e494e6347ad3fe378096d4166c87a5202115cda03e50eb92ad321aa921415fba7399c30c5af2f16f2698bcad8d2ab52408d0b65173305255223ffbe9e54bc6c1a89219c695f72d992ca9515e04f40aa158716214deeb8257d79ea19856bd5725d944ae6d1b8e63958807bc64a280025479d3db1ed72c893069942f3163ee1e6e3db421abd660da80c0976ce49f331067b64eaaa9f89c016a562f2b016b90778a95c073ec62cb859fad03be7ed2f034c924178f6106c623d5f1af7efe3e59a15e204384134b4558c4ce4a12f8c1de90f52d380414e9b5122e138bddcb315231511ae0a9f40cb9cf14d53474719ad5e1627bd2091542fa652d2532889d82d511b884912ef548d8c6fa932640f7004a11b34a580fc71a0ddf67b9a74bdb900873a0a219a54b0d26697a4fb40e392b3ff36972db2cdf916cd7516448c835579ba0dbdd12a1dfa366e1c693feb83581eadda04233bcef651aff9a2a3b01f001543fb137cc9d93193819c84b7305f841277f4d26aa13fdfea254c457ac6a5964174167133a8401500f694cd050aaaf5a916121039a06c2cd2e8c33b10995ca814e7eab0e41847896f733868d3ed1e1b89c18e2d0e23bb31b683f52dbb21b7b36f5f7cc521b651cc48b1af35255cb996bd62d3e8ce70b1e21bfa929e1575dc2f90f159794174c2bdb74e8cd05e8f573f83ddcfe598088b31f158bf0532d3d25e95e46c2ed15e4221a7b79543060c56205349b82ce6324dfa85f8408b21da894f43a6dcfc314c4e8504cb384e3cd0725f8cf843d138654f3abdc7240a81203d9364bcda403df955812d47de072337864bf1c8c1295136c0d6ce56c2f0d775a7fc5f9d4b235286837b363428030fe416e77b67450d6f56cdbf404dab6fa661c373990d1e2e6e9a66ef0e0017b6d0449e784193b5a47d98bf731a2549b7ccc4a8ffb216309b31d609cb9fab7a8ed0257aabe8bffd72c70665354295f1b253ec728af0fc1e2278f5f57318efdb75a8826cdfb495a71a03d3a3c495dbb848781972f878a345af2be82e18f0c4069b14e4becf61966dbd63ec144c7dcef4efc20fa51147fb872bedd6cfb8e94a538f4019c00262e176aea6c86fae83e417af3bf5f03bbb692cbd64286702501144242d5166a73852f9b07d729be9d726ac710c18838782a209f1dbd7a51ad7af147852c939ebf17be49860ce4e84277f1a312fac10b39c0c500b3b418b4d633e00f555e7e5ac9e7bd1f1a34ef723592cb0c378cd9e166eb67267a7c4079f25d7f1a7af89f47673d0a54be03c947cbc83165b42549a17324e5186ce9b93f5e2368f89a2501dc7ac8c1a53d700cd5b7b994e1e3ef0268fefe4d3793ba137f9b7de19a9e2b2708501e4ce89c3b7d4e0986535553b4e18ad54ca07dac243e9a4bb29a8bd53220e1c0e8ab37f4f97150000b3ff1735708cd3b74b4751d5ab7583bfb636c7dde12a2ed2d529954fa807853cdf780fb1f7cd3062dea79864f895b760321a3c0cf58cad9e8f51fb2e160a83fde2af599a0981f69891cc3a243f30533764f60a00645806645287a1fa6709967396b4464c2527ced05ea9b6f7a3f0f53bbdc3203d86cd63fd5539373d893b1045a3c922cfdf3729527a77033ef1d4fcef917bec93ea2c2b0fb187abccf7fec5664ae273c7ed1d59334e10e24535bdc2c49b8a3993c9a08bdff378a3bd8e72624ca52766fe4a4d7c64f8af6dda5a7c0390a49c5e0254d7a2f634f143d009607847624ec00ba5260a9220123d242aa7e3e0af1b059ad9c65a41096e847282b703ca04e17581fc22c0333e26e5555963b5ac7a42d03db01b7592b4bd0e573be1b718b1688ab34f6b1a2af1f8a18a451b2074175421911ed781c509f8aa6b08bd2a93187b92567fed0451e43e7de45c2efb48047ec33e59d8e28d054f2f26388bae212b54b919a5759f01ec7d7477c920f3e1c626f55f0d2789af470c4f7e665274da526dff152dc289cc2a129d5fa58c8b218ac8f67335866f7c4b2af476d9dbac229b0288051672afcd18a362837112d6747bc3343c00d90ed418e771b193bae541deccbae6a37d3c9830feb3e449dbd5a04c9b7d4ee4f7ebf736e953bcd27ed52f4067142ba16b4658699c9807d7a8864f3809fe4aff1c99da376bf379b9a76467f70b5e5a34f1f8a993903c1f06779a3a5a8e84c69ec3ce4d4d92fde622b4df4ffa9980c0633f0b59652ef9b08f359896325a4b3c24d56dfff87bbb585f25b385aa6d8f6fa9cc2c4bcce3baee55ad78543bd6ceb5649cfb8f04638e14fa5d2eaf471bb333cb2c902dd45625db9cbc4b6458f3319a44d448742a81cd1d7f4e5cd25ad5d8ed2d3d896857df7148141eb2a7f48f79f4a2db60181e2540b46a28896ed1e463fff52c1e0148864f34a62d131119a602ec5e1cd70255b99dca8c08856c29c2105a63ceaa6d7dcede14a289f6a305ff0a41b4077b91d1673c3d1f592179696e6a5c850e49666f3a284591ce6d66ab2dfaff58cc7af8df14688f069c0fd131acd0ec675850e7eb1ab028377b6cfff2319e27fac0d1ec21364dcb9168c43f62c18ccf141b28c7fcbb6c5862254483eb589cd59805363f4ba8fe0210077cfbe5f365f0622e678d1135a0e600430663a1af086935040e35ba50563da658777d36b157cad725cf3ab5eab8e778af09a9f11858634f40bf44ebe3ae61bc54d5fccde2a681055eff3a6ccb0c12389fc374277b67f7c5ae029361014b79053fb1cb2287e6f8e1a72c45579b0a9de365708dec9522bcd8d7ba245178ad88c0554e3f65d3c0a861fd1ec380ca3166ea80ea4c931f221d81ed7ef179cc4d446616644810041538033dd3a5a46fc7e2c9ab7bab4260e2a0e2f58a959164b001213df1096933321171089a939b4297daa2dc118b9566e8d1c6752c68ce5ccc44e31dbd4bccad1742a5375801ebd51a96a7670811dbe00f71c600135fb050773ed6375584ea00843d41de5d9fdbe3b0d6ab9756b504e33d640dfc099ff804af598e64aafd6fff0a3d5b2eada1c6f7705cb44093d10bba78f68ea6721cccb3d0db9b57ff044272d9bca35a9a2473e4933d9654ea0856181ecb56735ef7b528246b38ec256de2b6ea11c3f1facf771cf0a0277e93eca1f13c4a94dc3631a8e6b004fa1214b8a99fc8ede868058f7b775349450cbaa732976d047daa7248444de7b0b5475344226b0c4f5b0b55d5d0eb14616219bd59d88af8b7146456f2cbe524310a52194c8fa560d7cd01f7d21ce098572f344f0bb06b1f912d480aef4d390c24e227493b4da5c04b9f70e2a936ad716ecdd9c1c24ad7eecc4920c92a6927123af0c9e1727f453c947f10668299d996080c449e00b1e500dd0abcd73db44473b672bb688861d5d0a4bd5de3f5baa92de7d5fa639c2f0d2704fd2c1aced714c202c57980f692988a8c12b76d6fd8390b3301e0daeb5ddf4771c2da9ae5cd71e7a444134fcffbbc0981fabe006f2d560f24af3e4fc61dea202015d127b41fcd5997f99efcca9ef8bc13706417ec1c61cd28b404bc06d00203182ea7adf17229d80f9d1a088789d91873637ce4df1451601f5079bb7abf8962d2fd5e9eb7d71b651aa014e4e0e0bf83d95f40a9ae8dd68307977be005e2b26138af8726484ac96959ac7d73b4de7014818e4c0c8aba7ea0f7a4cd74dc5a6fc342391d615c7684f1d8853122d2c65f10f2091dc66d993009dce56b7523d262e61f8909a5f8e649dab746fe4e0734e4f672e5a44f737f4b1e16928446fdef49a79619eac5b25186ee100592452f494650cc3b562e05a3f2ab6a69cd8a5bd6a10a508c25161ebf4f77e26b5665c5ece21c8950207a76c97e47923b9bc854b33821167d035df974ddaf9d88593bbec528287b4fc373edab902a0ed88d6f088516ef4bb9e280e39fed3c697fb309ff78aabea673c9cc21d606676f6488235fa0a8a46fe6c1749a0839bd98"]}, 0x104c}, 0x1, 0x0, 0x0, 0xc8c1}, 0x10) chdir(&(0x7f0000000080)='./file0\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x42, 0x1ff) r3 = openat$binfmt(0xffffff9c, 0x0, 0x41, 0x1ff) write$binfmt_elf64(r3, 0x0, 0x0) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) unlink(&(0x7f0000000000)='./file1\x00') close(r2) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r4, &(0x7f00000003c0)=ANY=[@ANYBLOB="270086dd03000a000000140000006c07010033d42cfffe800000000000000000000000000010ff02000000000000000000000000000189", @ANYRES64, @ANYRES64=r5, @ANYRESDEC=r1], 0x340a) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r6 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r0, &(0x7f0000000600)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575b43f86dd60", 0x13}, {&(0x7f00000001c0)="0100"/11, 0xb}, {&(0x7f0000000200)="37a0a6c482b23cba92ffffff3f7b42590e180c07f3c193b532f3080000008c49ce65df4d", 0x24}], 0x3) 16m4.979839834s ago: executing program 1 (id=677): setns(0xc9, 0x0) r0 = socket(0x8, 0x5, 0x5) ioctl$VFAT_IOCTL_READDIR_BOTH(r0, 0x40106183, &(0x7f0000000000)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f0000000040)=0x40, 0x4) connect$inet6(0xffffffffffffffff, &(0x7f0000000140)={0xa, 0x4e22, 0x56202329, @empty, 0x4000005}, 0x1c) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) mknodat$null(0xffffffffffffffff, &(0x7f0000000280)='./file0\x00', 0x2000, 0x103) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0605250c"], 0x9) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x4c, 0x0, &(0x7f0000000600)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000340)={@fd, @fd={0x66642a85, 0x0, r1}, @fd={0x66642a85, 0x0, r1}}, &(0x7f0000000400)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) ppoll(&(0x7f0000000040)=[{r2, 0x200}], 0x1, 0x0, 0x0, 0x0) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x81, 0xffffffff}) r3 = syz_open_dev$sg(&(0x7f0000000440), 0xfffffff9, 0x10000) ioctl$SG_IO(r3, 0x2285, &(0x7f00000005c0)={0x53, 0xfffffffffffffffd, 0x6, 0x0, @buffer={0x20, 0x0, 0x0}, &(0x7f0000000100)='*\x00\x00\x00\x00\x00', 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000480)={0x20, 0x0, &(0x7f0000000000)=[@request_death, @clear_death], 0xfc, 0x1000000, 0x0}) close(0xffffffffffffffff) close(0x3) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000180)=0x6f) 16m3.946096652s ago: executing program 1 (id=680): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendto$packet(r1, &(0x7f0000000a40)="d8b8f5a2289fedded39f79c78869a3cda57dc252f75ff3c104a126ad48adce8f0e98a950a526353fa8d1f1f8066b53786aca597ae0c003fd21a6587ac5520045360d2e5aa562a401e592bcfc58c0d2a60ae395f3fb89d355a220515630c2922f0fd8023f8aaa67287f2c7ad1bb4c90422c53df26719815a4623a13e672d9fe7ac5a8fed25dfabe68f0f78c3d141da3a996339f5a3f51b92a34272c7a7a2a23fe2d52e14bf5f074853976a718f65c70b968ac357f218b4bd26fb290a0167a578389d4140855208e0b4b570b27d92192e6e3c9cfa977e0dbf5b216a68dd1d0d20aa79e7677695959a6f12ad5d4cdfb5f6d6ba814f0e130edab39f06686c3da8c4022400f496f3240281c4eea169046be517f6c4661ce5df3df908bf000b882710afe0591a897c07bb3c4493edee322d4aa6a28c85290d44229732499e6f96e0222780a16bf0a86ff22d6fd545b8ac4c7c593d5ea06ff15ef1c6f01efc649b9143e259329edaa9d48bf3d9417fe9c3f4e3a53b8abb025e3d9a0e9938d731a6e54228476681c7e1022fb17f686c781496420a3476fb03132aac5282b92de57abb64e74f3c658fb42f5a338d2b0bc316abd41e96cc3708bf3f91da759d161f4b15195ccfdcb00e560ef7fb457d7435b16fe3da112a7411193007bc83b6685d8e1f5a9f7b3e7f73319212f0de514e2761ff0fb91de9ebe6736e54fe778bd9f669f5a8e0a007f99ee6be730bbfb9ea328b30aec08322d42e3854ed1852b56e208861dcef970ec2914aa96326e00"/579, 0xffffffffffffff09, 0x24008805, 0x0, 0x0) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000280)={0x8}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) ioctl$KVM_SET_MSRS(r6, 0xc008ae88, &(0x7f0000000040)={0x3, 0x0, [{0xaec, 0x0, 0x621e1a66}, {0x8a2, 0x0, 0x100}, {0xaff, 0x0, 0x8}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x6, 0x4, 0x1010, 0x89, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000002c0)={[0xb59, 0x9, 0xfffffffffffffff9, 0x2, 0x0, 0x0, 0x4002004c4, 0x1004, 0x76, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x90], 0xeeee8000, 0x2018d3}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 16m3.452820059s ago: executing program 1 (id=686): bind$inet(0xffffffffffffffff, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, 0x0}}], 0x1, 0x20008000) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x79}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000040)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x3}) munmap(&(0x7f0000c75000/0x4000)=nil, 0x4000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x28f41000) read(r0, &(0x7f0000000180)=""/145, 0x91) close(0x3) msync(&(0x7f00002c9000/0x2000)=nil, 0x2000, 0x0) memfd_secret(0x80000) recvmsg(0xffffffffffffffff, &(0x7f0000001480)={0x0, 0x0, &(0x7f0000001380), 0x5c}, 0x123) shutdown(0xffffffffffffffff, 0x1) 16m3.166264071s ago: executing program 1 (id=687): r0 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB="10000000040000"], 0x48) r1 = syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) tkill(r1, 0x13) tkill(r1, 0x12) waitid(0x0, 0x0, 0x0, 0x100000e, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./proc\x00', 0x1ff) socket$kcm(0x10, 0x3, 0x10) (async) r2 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000030c0)=[{&(0x7f0000000340)="1400000016001963d25a80648c56915a19aa2bfe", 0x14}], 0x1}, 0x0) mount(0x0, &(0x7f0000000180)='./proc\x00', &(0x7f00000001c0)='proc\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./proc/net/rpc/auth.rpcsec.context/channel\x00', 0x1, 0x0) write(r3, &(0x7f0000000400), 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB], 0x50) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) (async) write$rfkill(r0, &(0x7f0000000080)={0x0, 0x0, 0x3, 0x1}, 0x8) bpf$OBJ_GET_MAP(0x7, &(0x7f0000000340)=@generic={&(0x7f00000004c0)='./file1\x00', 0x0, 0x10}, 0x14) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000a29453206dccf484fc4c794388339b689091801ce5e5d08a1804d7f24744f48f09ce8db2e8be65997097fd07fff93971c516006c4c12a80385094d225469139097d728b4dddc4fa13c7b158cd61811e7b2268b220a0981f7d8600815f405ba18513290fb4388c4fcccaa48cd93b412cffc7e3c5d785fe75d7dfc16c1cfe3ee9dc59dd7607f583dbc3719290e4aed3a898013205b9551983d8ca37e6522f6e661cd1b53146d286b58148d537cc49ff8424d37c9e71920534574fed7c6cc63ee030fe011c46e33592d19bb1369c54ee45fd2a22087a9464b4d5fbeb123f3abcd2703e400832fe53a30f11ec5429a7efdc944db375e6d8fcc80c4af4249b77197756a1baddc2571ae9f42226f61d54d462f493869e9a705efc330bd768707a248ad588ca9984e2493a13918a8ccfb8c11702949e6ebb2454a29289fb9d6828b9d2be28ea79afa666bcc65920fea2da7bc84128fddeb02fcaf0360452b", @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000010000000300"/28], 0x50) (async) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000d00)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000a29453206dccf484fc4c794388339b689091801ce5e5d08a1804d7f24744f48f09ce8db2e8be65997097fd07fff93971c516006c4c12a80385094d225469139097d728b4dddc4fa13c7b158cd61811e7b2268b220a0981f7d8600815f405ba18513290fb4388c4fcccaa48cd93b412cffc7e3c5d785fe75d7dfc16c1cfe3ee9dc59dd7607f583dbc3719290e4aed3a898013205b9551983d8ca37e6522f6e661cd1b53146d286b58148d537cc49ff8424d37c9e71920534574fed7c6cc63ee030fe011c46e33592d19bb1369c54ee45fd2a22087a9464b4d5fbeb123f3abcd2703e400832fe53a30f11ec5429a7efdc944db375e6d8fcc80c4af4249b77197756a1baddc2571ae9f42226f61d54d462f493869e9a705efc330bd768707a248ad588ca9984e2493a13918a8ccfb8c11702949e6ebb2454a29289fb9d6828b9d2be28ea79afa666bcc65920fea2da7bc84128fddeb02fcaf0360452b", @ANYRES32, @ANYBLOB='\x00'/18, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="04000000010000000300"/28], 0x50) ioctl$EVIOCGEFFECTS(0xffffffffffffffff, 0x80044584, &(0x7f0000000780)=""/30) writev(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1) (async) writev(0xffffffffffffffff, &(0x7f0000000100)=[{0x0}], 0x1) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) (async) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) r7 = socket$inet(0x2, 0x3, 0x2) setsockopt$inet_mreqsrc(r7, 0x0, 0x27, &(0x7f0000000280)={@multicast2, @local, @remote}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) (async) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x0, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x7, 0xffffffffffffffff, 0x0}]) (async) io_submit(0x0, 0x1, &(0x7f0000001300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x7, 0xffffffffffffffff, 0x0}]) write$tun(r5, &(0x7f0000003480)=ANY=[], 0x1116) (async) write$tun(r5, &(0x7f0000003480)=ANY=[], 0x1116) sendmsg$nl_route_sched(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newtaction={0x4c, 0x30, 0x871a15abc695fb3d, 0x200, 0x25dfdbff, {}, [{0x38, 0x1, [@m_tunnel_key={0x34, 0x1, 0x0, 0x0, {{0xf}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x4c}, 0x1, 0x0, 0x0, 0xc000}, 0xc000) 16m2.986175516s ago: executing program 1 (id=688): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r2 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffbffff, {0x0, 0x0, 0x9eff, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xe, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x10) 15m47.984261035s ago: executing program 33 (id=688): r0 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) r2 = socket(0x400000000010, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd2c, 0xfffbffff, {0x0, 0x0, 0x9eff, r1, {0x0, 0x8}, {0xffff, 0xffff}, {0xe, 0xfff3}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x40001}, 0x10) 11m9.26364283s ago: executing program 3 (id=1829): r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x101, 0x181902) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x20000) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002300000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c810000000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) quotactl$Q_GETINFO(0x2, &(0x7f00000000c0)=@rnullb, 0x0, &(0x7f0000000100)) lseek(r2, 0x0, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000010c0)={0x0, 0x0, 0x1, 'queue0\x00', 0x1}) ioctl$VIDIOC_S_STD(r0, 0x40085618, &(0x7f0000000040)=0xff0000) 11m9.186569611s ago: executing program 3 (id=1832): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="0200000004000000080000000100000080"], 0x48) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000140)={r0}, 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x11, &(0x7f00000003c0)=ANY=[@ANYBLOB="180000000000000000000000000000008500000061000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r0, @ANYBLOB="0000000000000000b70500000800000085000000b600000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0x0, 0x8b, 0x0, &(0x7f0000000040)="3d25c826ab0815acd86628f886ddf6ede78b6ea6130100f000bcb9fb8f083f3a81657a32532b5100"/53, 0x0, 0xda, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x34) 11m9.044594517s ago: executing program 3 (id=1834): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mount(&(0x7f0000000040)=@md0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='ntfs3\x00', 0x2006010, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r5, 0x0, 0x0}, 0x20) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x200000, 0x2) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) prctl$PR_PAC_RESET_KEYS(0x36, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004000000010300800c0001"], 0x314}], 0x1}, 0x800) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x20007, 0x30}, 0xc) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r7, &(0x7f00000002c0)={0xa, 0x4e23, 0xfffffffc, @loopback}, 0x1c) listen(r7, 0x4) sendto$inet6(r6, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r6, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="11", 0xfffd}], 0x1}}], 0x1, 0x8015) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) openat$sr(0xffffff9c, &(0x7f0000000000), 0x40500, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) 11m6.29685022s ago: executing program 3 (id=1845): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_DEL(r0, &(0x7f0000001040)={0x0, 0x0, &(0x7f0000001000)={&(0x7f0000000fc0)=ANY=[@ANYBLOB="14ffff000036f60002000003490002"], 0x14}, 0x1, 0x0, 0x0, 0xc0}, 0x84) getsockname$packet(0xffffffffffffffff, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @random}, &(0x7f0000000040)=0x14) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x40, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f0000000040)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0) chroot(&(0x7f00000000c0)='./file0/../file0/../file0\x00') pivot_root(&(0x7f0000000000)='./file0/../file0/../file0\x00', &(0x7f0000000140)='./file0/../file0/../file0\x00') getsockopt$sock_cred(r2, 0x1, 0x11, 0x0, &(0x7f0000000240)) connect$pppoe(r2, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000080)=@base={0xe, 0x0, 0x9, 0x495, 0x0, 0xffffffffffffffff, 0x8000, '\x00', r1, r2, 0x3, 0x0, 0x5}, 0x50) 11m6.205850485s ago: executing program 3 (id=1846): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)={{0x14, 0x10, 0x4}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x5}]}, @NFT_MSG_NEWSET={0x38, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_POLICY={0x8}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x21}]}, @NFT_MSG_NEWSETELEM={0x50, 0xc, 0xa, 0x301, 0x0, 0x0, {0x3}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x24, 0x3, 0x0, 0x1, [{0x20, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @counter={{0xc}, @void}}]}]}]}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0xd0}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x9, 0x3, 0x3ffdcf, 0xaf0}, 0x50) connect$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x8ef, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0xe) socket$inet_udp(0x2, 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000080)={{}, 0x0, &(0x7f0000000040)}, 0x1c) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="230000006d0200000300000022bf000001"], 0x50) r2 = landlock_create_ruleset(&(0x7f00000002c0)={0x5f6f, 0x2}, 0x30, 0x0) landlock_restrict_self(r2, 0xe) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r3, 0xffffffffffffffff, 0x0) 11m4.991101822s ago: executing program 3 (id=1850): r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x101, 0x181902) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x20000) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002300000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c810000000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) quotactl$Q_GETINFO(0x2, &(0x7f00000000c0)=@rnullb, 0x0, &(0x7f0000000100)) lseek(r2, 0x0, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000010c0)={0x0, 0x0, 0x1, 'queue0\x00', 0x1}) ioctl$VIDIOC_S_STD(r0, 0x40085618, &(0x7f0000000040)=0xff0000) 11m4.760732127s ago: executing program 34 (id=1850): r0 = syz_open_dev$video4linux(&(0x7f0000000080), 0x101, 0x181902) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x20000) mkdirat(0xffffffffffffff9c, &(0x7f0000001500)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000001500)='./dev\x00', &(0x7f0000001600)='devtmpfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000001700)='./dev/kmsg\x00', 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002300000018010000646c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007200000095"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xb}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000756c810000000000002020207b1af8ff00000000bfa10000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r3}, 0xc) quotactl$Q_GETINFO(0x2, &(0x7f00000000c0)=@rnullb, 0x0, &(0x7f0000000100)) lseek(r2, 0x0, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_INFO(r1, 0xc08c5334, &(0x7f00000010c0)={0x0, 0x0, 0x1, 'queue0\x00', 0x1}) ioctl$VIDIOC_S_STD(r0, 0x40085618, &(0x7f0000000040)=0xff0000) 10m19.83554564s ago: executing program 4 (id=1976): set_mempolicy(0x2002, &(0x7f0000000080)=0x9, 0x9) r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='numa_maps\x00') pread64(r0, &(0x7f0000001c00)=""/4108, 0x100c, 0x3) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x204800, 0x0) umount2(&(0x7f00000001c0)='./cgroup\x00', 0x3) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r5, @ANYBLOB="0c0002800501030004000000"], 0x24}, 0x1, 0x0, 0x0, 0x20040000}, 0x20040014) timer_settime(r2, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000e, 0x20c44fb6edc09a38, 0xffffffffffffffff, 0x0) r6 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r6, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) ioctl$sock_SIOCGIFINDEX_802154(0xffffffffffffffff, 0x8933, 0x0) fchmod(r6, 0x50) openat$cdrom(0xffffffffffffff9c, &(0x7f0000000040), 0x101000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x10a942, 0x9f667fd378a54ed4) write$P9_RREADLINK(r9, &(0x7f0000000040)={0x10, 0x17, 0x2, {0xffffffffffffffc1, './file0'}}, 0xfffffdab) 10m16.096407366s ago: executing program 4 (id=1986): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0xfffff000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x1ff, 0x1, 0x0, 0x2000, &(0x7f0000002000/0x2000)=nil}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/memory.limit_in_bytes\x00', 0x2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) ioctl$KVM_SET_NR_MMU_PAGES(r2, 0xae44, 0x5) write$RDMA_USER_CM_CMD_CREATE_ID(r2, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x1, 0x0, 0x2, 0xa}}, 0x20) 10m14.92484619s ago: executing program 4 (id=1992): r0 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000040)='./file0\x00', 0x0, 0x61091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x89901) open_tree(0xffffffffffffff9c, &(0x7f00000003c0)='./file0\x00', 0x89101) preadv2(r1, &(0x7f0000001700)=[{&(0x7f0000000280)=""/240, 0xf0}, {&(0x7f0000000600)=""/4096, 0x1000}, {&(0x7f0000001600)=""/205, 0xcd}], 0x3, 0x9, 0x8, 0xb) mount$fuse(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x80000, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00005a4000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f000012d000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0x970, 0x1f480, 0x0, 0x39d}) close_range(r0, 0xffffffffffffffff, 0x0) 10m14.72216887s ago: executing program 4 (id=1995): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x117) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x103090, 0x0) writev(0xffffffffffffffff, &(0x7f0000000140)=[{&(0x7f0000000080)='g', 0x1}], 0x1) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x17, 0x0, 0x0, 0x8000}, 0x50) faccessat2(0xffffffffffffffff, &(0x7f0000000000)='./file0/file0\x00', 0x44, 0x1000) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x11e) read$FUSE(r0, &(0x7f0000001940)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) tkill(r1, 0x19) r2 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f0000000200), 0x2, 0x0) rmdir(&(0x7f00000000c0)='./cgroup/../file0\x00') lseek(r3, 0x1, 0x1) mount$bind(&(0x7f0000001900)='.\x00', &(0x7f0000000380)='./file0/file0\x00', 0x0, 0x2a05004, 0x0) umount2(&(0x7f0000000340)='./file0\x00', 0x1) 10m14.595643277s ago: executing program 4 (id=1998): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) mount(&(0x7f0000000040)=@md0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000000)='ntfs3\x00', 0x2006010, 0x0) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="1200000004000000060000000280000000000000", @ANYRES32=r1, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000000000000000000000000000000000000000000000f677dd01d23b065c28e7a5114feb6a00ea5199d065c2800cea2363f9eb9c93be4c140a11e10c0bbb9f603bb681c609c1f8c54723c48136a7"], 0x50) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={r5, 0x0, 0x0}, 0x20) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x200000, 0x2) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) prctl$PR_PAC_RESET_KEYS(0x36, 0x0) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f000000c280)=[{&(0x7f0000000a00)=ANY=[@ANYBLOB="14030000300001000001000004000000010300800c0001"], 0x314}], 0x1}, 0x800) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r6, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x20007, 0x30}, 0xc) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) listen(r7, 0x4) sendto$inet6(r6, &(0x7f0000000180)="1a", 0x34000, 0x0, &(0x7f0000000480)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$sock(r6, &(0x7f0000001680)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000100)="11", 0xfffd}], 0x1}}], 0x1, 0x8015) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) openat$sr(0xffffff9c, &(0x7f0000000000), 0x40500, 0x0) syz_open_dev$loop(&(0x7f0000000100), 0x3, 0x0) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) 10m14.225346368s ago: executing program 4 (id=2000): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0xfffffffffffffd00, &(0x7f0000000140)={&(0x7f0000001080)=ANY=[@ANYBLOB="df250100"/20], 0x14}, 0x1, 0x0, 0x0, 0x12}, 0xc004) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000240)=0x20003) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x2, 0x6, 0xfffffffffffffffe, 0x8000000000000000, 0xf4a, 0x100000000, 0xbdb], 0x50000, 0x4000}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000280)={0x5, 0xa, 0x0, 0x0, 0x7995}, 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, &(0x7f00000001c0)) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="8c45000043000701fefffffffcdbdf25017c000004"], 0x458c}, 0x1, 0x0, 0x0, 0xbbe21a6a6c0c72fd}, 0xc000) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r7, r9, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd69000000001406fffe800000000000000000000000000039fe8000000000000000000000000000aa4e224e24", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="51c2000390d80003"], 0x0) 10m13.834993008s ago: executing program 35 (id=2000): bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e0000000400000008"], 0x48) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0xfffffffffffffd00, &(0x7f0000000140)={&(0x7f0000001080)=ANY=[@ANYBLOB="df250100"/20], 0x14}, 0x1, 0x0, 0x0, 0x12}, 0xc004) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r5 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(0xffffffffffffffff, 0xc004500a, &(0x7f0000000240)=0x20003) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x2, 0x6, 0xfffffffffffffffe, 0x8000000000000000, 0xf4a, 0x100000000, 0xbdb], 0x50000, 0x4000}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$USBDEVFS_SUBMITURB(0xffffffffffffffff, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x0, &(0x7f0000000280)={0x5, 0xa, 0x0, 0x0, 0x7995}, 0x8, 0x0, 0x0, 0x48000000, 0x0, 0x0, 0x0}) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, &(0x7f00000001c0)) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000340)=ANY=[@ANYBLOB="8c45000043000701fefffffffcdbdf25017c000004"], 0x458c}, 0x1, 0x0, 0x0, 0xbbe21a6a6c0c72fd}, 0xc000) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000006080)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000ac03000000000000850000003300000095"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}, 0x94) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r7, r9, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x4a, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd69000000001406fffe800000000000000000000000000039fe8000000000000000000000000000aa4e224e24", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="51c2000390d80003"], 0x0) 9m50.048084696s ago: executing program 6 (id=2091): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) ptrace$ARCH_FORCE_TAGGED_SVA(0x1e, 0x0, 0x0, 0x4004) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$cec(&(0x7f00000000c0), 0x0, 0x549903) io_submit(0x0, 0x1, &(0x7f0000000340)=[&(0x7f0000000100)={0x1000000, 0x0, 0x0, 0x5, 0x8001, 0xffffffffffffffff, 0x0}]) syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000c40)={0x14, 0x3b, 0x301, 0xa70bd1d, 0x25dfdbff, {0x6}}, 0x14}, 0x1, 0x0, 0x0, 0x8010}, 0x0) syz_genetlink_get_family_id$tipc(0x0, r1) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x67) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x81) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xc, 0x4, 0x4, 0x8001, 0x18, 0xffffffffffffffff, 0x20000000, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1}, 0x50) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000440), r2) sendmsg$NLBL_UNLABEL_C_STATICLISTDEF(r2, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="14000000", @ANYRES16=r3, @ANYBLOB="00c3febe4def7f914815d18694"], 0x14}, 0x1, 0x0, 0x0, 0x1}, 0x45080) 9m49.041693263s ago: executing program 6 (id=2093): madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newtaction={0x6c, 0x30, 0x1, 0x0, 0x0, {}, [{0x58, 0x1, [@m_mpls={0x54, 0x1, 0x0, 0x0, {{0x9}, {0x28, 0x2, 0x0, 0x1, [@TCA_MPLS_PARMS={0x1c, 0x2, {{}, 0x1}}, @TCA_MPLS_PROTO={0x6}]}, {0x4, 0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0x6c}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x80200, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r1, 0xc00c6211, 0x0) syz_open_dev$radio(&(0x7f0000000340), 0x2, 0x2) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000100), 0x6ad01, 0x0) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sequencer(0xffffff9c, &(0x7f0000001bc0), 0x88302, 0x0) socket$inet_udp(0x2, 0x2, 0x0) pselect6(0x40, &(0x7f0000000240)={0x3, 0x0, 0x202, 0x7c, 0x10000, 0x8000, 0x4, 0x7}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0x8, 0x40080000006, 0xb06c}, 0x0, 0x0) modify_ldt$read(0x0, 0x0, 0x0) syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000040), 0xffffffffffffffff) r4 = syz_open_dev$vim2m(&(0x7f0000000100), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x2000002, 0x2, 0x2, 0x0, 0x3}) r5 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000cc0), 0x8a140, 0x0) ioctl$PTP_SYS_OFFSET_PRECISE(r5, 0x3d13, 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(r4, 0xc04c5609, &(0x7f0000000580)=@multiplanar_userptr={0x9, 0x2, 0x4, 0x400, 0x6, {}, {0x3, 0xc, 0x0, 0x2, 0x80, 0xeb, "106f7df7"}, 0xffe00, 0x2, {0x0}}) socket$nl_route(0x10, 0x3, 0x0) setns(0xc9, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 9m47.944019437s ago: executing program 6 (id=2094): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x15, 0x3, &(0x7f0000000000)=@framed={{0xdb, 0xa, 0xa, 0xfe00, 0x110, 0x71, 0x10, 0x1a}}, &(0x7f0000000480)='syzkaller\x00', 0x5}, 0x90) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000002100)={0x40, 0x44, 0x1, 0x70bd29, 0x4, {0x2}, [@nested={0x4, 0x48}, @nested={0x28, 0x1, 0x0, 0x1, [@nested={0x24, 0x1022, 0x0, 0x1, [@nested={0x20, 0xd9, 0x0, 0x1, [@nested={0x1c, 0x77, 0x0, 0x1, [@typed={0x4, 0x61}, @nested={0x14, 0x7, 0x0, 0x1, [@typed={0x8, 0xb7, 0x0, 0x0, @uid=0xffffffffffffffff}, @typed={0x8, 0x12a, 0x0, 0x0, @u32=0x7}]}]}]}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x200048d5}, 0x4008094) 9m47.590698643s ago: executing program 6 (id=2095): pipe2$9p(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80880) write$P9_RFSYNC(r0, &(0x7f0000000180)={0x7, 0x33, 0x2}, 0x7) socket(0xa, 0x3, 0x3a) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000240)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$IPVS_CMD_FLUSH(0xffffffffffffffff, &(0x7f0000001340)={0x0, 0x0, &(0x7f0000001300)={&(0x7f0000001280)=ANY=[@ANYBLOB='B'], 0x4c}}, 0x0) write$binfmt_misc(r1, &(0x7f0000001280), 0x6) openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x28100, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x1214040, 0x0) chroot(&(0x7f0000000100)='./file0\x00') mount$bind(&(0x7f00000000c0)='.\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x21d000, 0x0) pivot_root(&(0x7f0000000000)='./file0/../file0/../file0\x00', &(0x7f0000000140)='./file0\x00') ioctl$KVM_SET_SIGNAL_MASK(r4, 0x4004ae8b, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r5 = syz_open_dev$sndmidi(&(0x7f00000001c0), 0x40, 0x8d2e65e2e0736078) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r7 = add_key$fscrypt_v1(&(0x7f0000000000), &(0x7f0000000040)={'fscrypt:', @desc2}, &(0x7f0000000080)={0x0, "0f57e611c8da8af32ed98a22d3e0ac8492df23752344507178c06d80db05e73f89c0fcfd02d5c82d25ecd9199a85cb38bbf4295c1f16c4d6fcec69267741c40c", 0x13}, 0x48, 0x0) keyctl$KEYCTL_WATCH_KEY(0x20, 0x0, 0xffffffffffffffff, 0x55) keyctl$unlink(0x9, r7, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f00000000c0)={0xf000, 0x118000}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) 9m46.144279225s ago: executing program 6 (id=2102): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r10 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000100)={0x20004, r9, 0x2}) ioctl$DRM_IOCTL_GEM_FLINK(0xffffffffffffffff, 0xc008640a, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(0xffffffffffffffff, 0xc010640b, &(0x7f0000000140)={r12}) ioctl$PIO_UNIMAP(r8, 0x4b67, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x8000, 0xffff}]}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x52, 0xd8, 0xfffc, {0x20, 0x1}, {0x46, 0x8002}, @ramp={0x3, 0xfb27, {0x5, 0x4, 0x1ff, 0xfff}}}) r13 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r13, &(0x7f0000000040)="e2", 0x12d8) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x178f705d, 0xb}, {0x6, 0x2007f}]}}) write(r6, &(0x7f00000005c0)='64=', 0x3) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0500"/11, @ANYRES32=r5, @ANYBLOB="0800050008000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x28, r1, 0x5, 0x80000000, 0x4, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params]}, 0x28}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000400)=ANY=[@ANYBLOB="5000030008021100000108021100000008021100000000000080000000009873e0534acfc4250491fc0000000400010001018206028000"], 0x2b) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) 9m44.565285494s ago: executing program 6 (id=2104): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x40) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x58, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x30}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f0000000100)) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r4, 0x0, 0x0, 0x80000) socket$unix(0x1, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') socket$nl_route(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xffeffffffffffffa]}, 0x8, 0x800) 9m44.314103895s ago: executing program 36 (id=2104): r0 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x40) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x68c81, 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_NEW_SERVICE(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)={0x58, r2, 0x1, 0x0, 0x0, {}, [@IPVS_CMD_ATTR_SERVICE={0x44, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_FWMARK={0x8}, @IPVS_SVC_ATTR_FLAGS={0xc}, @IPVS_SVC_ATTR_NETMASK={0x8, 0x9, 0x30}, @IPVS_SVC_ATTR_SCHED_NAME={0x9, 0x6, 'none\x00'}, @IPVS_SVC_ATTR_TIMEOUT={0x8}, @IPVS_SVC_ATTR_PE_NAME={0x8}]}]}, 0x58}}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KDGKBMODE(r0, 0x4b44, &(0x7f0000000100)) r4 = socket$alg(0x26, 0x5, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) accept4(r4, 0x0, 0x0, 0x80000) socket$unix(0x1, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') socket$nl_route(0x10, 0x3, 0x0) syz_open_procfs(0x0, &(0x7f0000000240)='clear_refs\x00') socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) signalfd4(0xffffffffffffffff, &(0x7f0000000140)={[0xffeffffffffffffa]}, 0x8, 0x800) 1m10.496237268s ago: executing program 5 (id=3785): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = socket$inet6(0xa, 0x80002, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0xb, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_submit(0x0, 0x0, 0x0, &(0x7f0000000280)=@IORING_OP_READV=@use_registered_buffer={0x1, 0xc, 0x4004, @fd_index=0x3, 0x5, 0x0, 0x0, 0x10}) socketpair$unix(0x1, 0x3, 0x0, 0x0) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x180300, 0x0) ioctl$FBIOPAN_DISPLAY(r4, 0x4606, 0x0) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000000)=@ethtool_sfeatures={0x51}}) syz_open_procfs(0x0, &(0x7f0000002440)='net/ipv6_route\x00') mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x0) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000100)={@remote}, 0x14) r5 = syz_open_procfs(0x0, &(0x7f0000000080)='net/anycast6\x00') bpf$MAP_CREATE(0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="060007000000000000003b96f419c84d84afd8a497cb3f71b79d91aa20b4e6d75d58e89f2fae41c7efcec6747d116e29a14ecbb813d8f8a04a2f6056fd1fe171c125cd239a23562565a2d645e93dede0333fee02ff47a1fe0a76b046fc96ddf5cc0ab7e8ff5e9d595030c451356f17dcabaa2222872cf157291a9f2d14b5ab5cb8db460fcf195a6aa4fff83b86619120505031116b5416365c97718917c49542a72b5f8ba1f44f3a6dcd1015c07a2291db92382ceff67a6fab169257a118d9bd0b0bb5af4e80cf149f36cd9b3c785b60138952b2ff604202f212ffa8cae55fa9bdb31f64026ee12872a565c162de723cceb68e5fdd86656ad490a0e1512e", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) read$midi(r5, &(0x7f00000001c0)=""/70, 0xffffffd8) mkdirat(0xffffffffffffff9c, &(0x7f0000000b00)='./file0\x00', 0x1ff) mount$afs(0x0, &(0x7f0000000b00)='./file0\x00', &(0x7f0000000c00), 0x0, 0x0) 1m9.183514221s ago: executing program 5 (id=3788): socketpair$unix(0x1, 0x2, 0x0, 0x0) r0 = dup2(0xffffffffffffffff, 0xffffffffffffffff) ioctl$vim2m_VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, 0x0) syz_usb_connect(0x0, 0x2d, 0x0, 0x0) r1 = epoll_create(0x1) r2 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, 0x0, 0x0) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x20, 0x0, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000880)=ANY=[@ANYBLOB="180000002f00090028bd70000000000004000000040010"], 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) ioctl$KVM_SET_REGS(r0, 0x4090ae82, &(0x7f0000000200)={[0xe45, 0x9, 0xfffffffffffffffd, 0xffffffffffffffff, 0x10000, 0x3, 0x4004002004bf, 0x8, 0x9, 0x0, 0x600, 0x80, 0x89, 0x8, 0x7, 0x8d], 0xffffffff, 0x200367}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) close(0x3) 1m7.167831514s ago: executing program 5 (id=3791): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000740)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x70bd0a, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0x4}, {0xffff, 0xffff}, {0xfff2, 0xfff1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x4}}]}, 0x34}}, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) close(r6) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) r7 = socket$kcm(0x11, 0x3, 0x0) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000074c0)=@newtfilter={0xe8c, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r10, {0x1, 0x4}, {}, {0x8}}, [@filter_kind_options=@f_matchall={{0xd}, {0xe58, 0x2, [@TCA_MATCHALL_ACT={0xe54, 0x2, [@m_pedit={0xe50, 0x1, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x2, 0x9, 0x5, 0x6}, 0x1, 0xfb}, [{0x2, 0x9c, 0x81, 0x6, 0x2, 0x7}, {0x1, 0x6, 0x4, 0x3, 0xc, 0x81}, {0x1, 0x80000001, 0x8, 0x101, 0x3}, {0x3, 0x9, 0x0, 0x7, 0x5, 0x4}, {0xf, 0x4, 0x9, 0x51, 0x8}, {0x3, 0x4, 0xc, 0x101, 0x3, 0x84b5}, {0x9c, 0x4, 0x9, 0x2, 0x487, 0x8}, {0x1, 0x10000, 0x5, 0x4, 0x3, 0x8000}, {0x7, 0x8, 0x1ff, 0x8, 0x2, 0x7fff}, {0x439356e7, 0x609, 0x16, 0x0, 0x10000, 0x6}, {0x5, 0x3, 0x8, 0x3, 0x4, 0xffffffff}, {0x5, 0x0, 0x7, 0x7, 0x8, 0x5}, {0x5, 0x8, 0x9, 0x5, 0xfffff000, 0x7}, {0x768d, 0xcd, 0x8, 0x7, 0x5, 0x9}, {0x1, 0xfffffffb, 0x6, 0x5, 0x7ff, 0x6}, {0xfffffffb, 0x3, 0xfffffffe, 0x6, 0x2}, {0xfffff9fd, 0x9, 0xa5f, 0xa, 0x5, 0x2}, {0xffff997c, 0x9, 0x167, 0x2, 0x71, 0xa2}, {0x140, 0x2, 0x10, 0x8, 0x87, 0x60}, {0x5, 0xa, 0x2, 0x204, 0x3, 0x2000}, {0x32d, 0x8, 0x2, 0x4, 0x8, 0x9}, {0x8, 0x200, 0x58fe, 0x7ff, 0x4, 0x3}, {0x101, 0xd, 0x101, 0x1, 0x3, 0x8}, {0x0, 0x3, 0x1ff, 0x7437ec78, 0x2, 0x9}, {0xffffffff, 0x1, 0x9, 0x0, 0x1, 0x4}, {0xc, 0xe, 0xfffffffd, 0x3, 0x8, 0x81}, {0x3, 0x3, 0x6, 0x5, 0x0, 0x80}, {0xd, 0x0, 0x7ff, 0x0, 0x80000000, 0x2}, {0x4, 0xf, 0x6c5f1878, 0x57c4, 0x8, 0x25ff}, {0x4, 0xd, 0x1fadd976, 0x3071, 0x0, 0x1}, {0x5, 0x800, 0x3, 0x3, 0x3, 0x9}, {0x9, 0x1ff, 0x81, 0x9c, 0x1, 0x5}, {0x9, 0xd76, 0x6, 0xdc2, 0xa16a, 0x2}, {0x1ff, 0x5, 0x7, 0x2, 0x5, 0x1}, {0x1, 0x32158140, 0x0, 0x8, 0x6, 0x7}, {0xe, 0x4, 0x9000, 0x5, 0x2, 0x7f}, {0x3, 0x2ec74d53, 0x0, 0x0, 0x8, 0x2}, {0x5, 0xfff, 0xffffff13, 0x6, 0x2, 0x6}, {0x1, 0x6, 0x3, 0x4, 0xffb, 0xc}, {0xa, 0x6, 0x1ff, 0x8, 0x7ff, 0x8001}, {0x4, 0xffffffff, 0x0, 0xfffff740, 0x4, 0x4}, {0xffff, 0x5, 0x7, 0xac, 0xf}, {0x5, 0x3, 0x6, 0x1000, 0xd8fe, 0x8001}, {0xd, 0x3, 0x80000000, 0x0, 0xffffff81, 0x7ff}, {0xfffffffb, 0x2, 0x1ff, 0xf9, 0xffff8001}, {0x0, 0x6, 0x7ffc, 0x9, 0x500, 0x6}, {0x1, 0xffffffff, 0x834, 0x7, 0x0, 0x3}, {0x7fff, 0x6, 0x0, 0x2002, 0x2, 0x8}, {0xf61, 0x101, 0x9, 0x2, 0x80000000, 0x7fff}, {0xc7, 0x1, 0x8, 0x2, 0xffff, 0x20000000}, {0x0, 0x5, 0x1, 0xffff, 0x3, 0x3}, {0x8, 0x10001, 0x9f98, 0x1, 0x8, 0x66a}, {0xfff, 0x6, 0x8, 0x80000001, 0x0, 0x7f}, {0x8, 0x6, 0x7f, 0x5, 0x2, 0xb}, {0x4, 0x4b, 0x0, 0x1, 0x7f, 0x7fffffff}, {0xfff, 0x47e4, 0x1, 0x0, 0x80000001, 0x9}, {0x3, 0x9, 0x7, 0x6, 0x3e6b7592, 0xe5}, {0x9, 0x9, 0x1, 0x9, 0x0, 0x2}, {0x8, 0x80000001, 0x7fff, 0xb2d9, 0xfffffffe, 0x8}, {0x80000001, 0x9, 0x5202, 0x2, 0x53ce, 0x3}, {0x6, 0x7, 0x8, 0x1, 0x7f, 0x80000000}, {0xfffffff9, 0x9, 0x6, 0x6, 0x9, 0x3}, {0xfffffffd, 0x8, 0x6, 0x5, 0x3, 0x8f}, {0x741, 0x0, 0x9, 0x7fffffff, 0x4, 0x200}, {0x401, 0x2, 0x8, 0x6, 0x4, 0xc6e9}, {0x1, 0x2d73, 0x3ff, 0x5, 0x9f17, 0xffffff7f}, {0x2, 0x401, 0x2b00, 0xfffff57b, 0xfffffc00, 0xd}, {0x3, 0x4, 0xc52b, 0x9, 0x5, 0xff}, {0x0, 0x4, 0x401, 0x0, 0x1, 0x9}, {0x8, 0x4, 0x1, 0x2, 0x10, 0x1}, {0xfc, 0x8, 0x6, 0x5, 0xff, 0x5}, {0x2, 0xb15ce2d, 0x80000001, 0xbeab, 0x8, 0x5}, {0x3, 0x8, 0x3, 0x7, 0x8, 0x4}, {0xfff, 0x9, 0x6, 0x3, 0x100, 0x57}, {0x9, 0x5, 0x81, 0x103, 0xa, 0x2}, {0xb3, 0xe, 0x3, 0x8000, 0x7, 0x9}, {0xff, 0x7, 0x5, 0x10001, 0x6, 0x6}, {0x2, 0x8f, 0x9, 0xffffff46, 0x4, 0x80000000}, {0x9, 0x2, 0xfffffffc, 0x1, 0xd50, 0x3}, {0xd203, 0x7, 0x1, 0x10000, 0x43, 0x1ff}, {0x4, 0x3ff, 0xffffffff, 0x1, 0x5, 0x100}, {0x1ff, 0x3, 0x7ff, 0xfffffff8, 0x1ff, 0xfffffffc}, {0x7, 0x9, 0x3ff, 0x1, 0x7, 0x4}, {0x0, 0x6, 0x0, 0x9, 0xffff0001, 0xcca}, {0x7, 0x1, 0xfffffff1, 0x3ff, 0x100, 0x4}, {0x3, 0x9, 0x0, 0xed4, 0x4, 0x6}, {0x9, 0x7, 0x8001, 0x7, 0x7, 0x2}, {0x3, 0xfff, 0x5, 0x5, 0xb5, 0x3}, {0x0, 0x1, 0x1, 0x5, 0xffffff01, 0xfff}, {0x7, 0x5, 0x2, 0x2, 0x0, 0xfffff9de}, {0x5, 0xfffffbff, 0xe6b, 0x8, 0xb, 0x4}, {0x1d, 0xffffff10, 0x1, 0x2, 0xff, 0x52e2}, {0x0, 0x9, 0x0, 0x7, 0xdb, 0x5}, {0x7, 0x2, 0x9, 0x8, 0xa, 0x100}, {0x81, 0x4, 0x988, 0x8000, 0x0, 0x7}, {0xdc03, 0x7, 0x402c, 0xffff, 0xfffffff9, 0x4}, {0xa, 0xfffffffe, 0x1, 0x1ff, 0x1ff, 0xc1b7}, {0xa24b, 0x947d, 0x40, 0x4, 0x9, 0x2}, {0x9, 0x401, 0xa89, 0x5ef, 0x9, 0x8}, {0x7f, 0x7fff, 0x0, 0x4, 0x7fffffff}, {0x3, 0xb8c, 0x6, 0x21761f6a, 0x1, 0x4}, {0xfff, 0xda, 0x1f, 0x4, 0x8, 0x2}, {0x8, 0x10, 0x100, 0x7, 0xfffffff7, 0x43}, {0xfffff000, 0x8, 0xe96, 0x9, 0x9, 0x34b0}, {0x4, 0x8, 0x8, 0x3, 0x6cf4, 0x1}, {0x3, 0x3, 0x9, 0x4, 0xbe, 0x81}, {0x4, 0x800, 0x0, 0x5, 0x8, 0xfa2f}, {0x3, 0x8d, 0x81, 0x2, 0x8, 0x6}, {0x9, 0x2, 0x6, 0x4, 0xf, 0x5}, {0x100, 0x1, 0x2, 0xffffffff, 0x9, 0x74}, {0x4, 0x4, 0x8, 0x1, 0x0, 0x3}, {0xfffffff8, 0xfffffffb, 0xffffffff, 0x62f, 0x401, 0x30564e0}, {0x9a2f, 0x800, 0x8, 0x7, 0x7}, {0x20000006, 0x2, 0x800, 0x200, 0x9, 0x3}, {0x7, 0x6, 0x8936, 0xdcb, 0x0, 0x2}, {0x6, 0x80000000, 0x8, 0xe, 0xfffffffa, 0x8de3}, {0x0, 0x9, 0x8, 0xfff, 0x6, 0x1ff}, {0x8195, 0x2, 0x1000, 0x0, 0x0, 0x9}, {0x1, 0x5, 0xff, 0x9e0f, 0x5, 0x6}, {0x7fff, 0x6, 0x1, 0x5, 0x8000, 0x3}, {0x7ff, 0x9, 0xa, 0x6, 0x7, 0xe77}, {0x1, 0x5e12, 0x3, 0xfffffffa, 0x2, 0x80000001}, {0xffffff8c, 0x2, 0x1, 0x1, 0x10, 0x5}, {0x4, 0x7, 0x104, 0x78d, 0xffffcff9, 0x9}, {0x1, 0xe, 0x7, 0x2, 0x2, 0x207f}, {0x10, 0x5, 0xfffffffa, 0xff, 0x80000, 0xfff}, {0x1, 0x7ff, 0x696e, 0xa, 0x49d, 0xb}, {0x9bf4, 0x0, 0x5, 0x3, 0x3, 0x1000}], [{0x1, 0x1}, {0x2}, {0x5}, {0x2}, {0x2, 0x745e81639ff0f356}, {0x4}, {0x5}, {0x3, 0x1}, {0x1}, {0x2}, {0x3}, {0x4, 0x1}, {0x0, 0x1}, {0x2}, {0x2}, {}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x3, 0x1}, {0x1}, {0x2, 0x1}, {0x2}, {0x3, 0x1}, {0x2}, {0x5}, {0x2}, {0x1, 0x1}, {0x1}, {0x1, 0x1}, {0x5}, {0x4}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x4, 0x1}, {0x3, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x5}, {0xa}, {0x3}, {0x3}, {0x4, 0x1}, {0x3}, {0x4, 0x1}, {0x2, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x4}, {}, {0x4, 0x1}, {0x4}, {0x4}, {0x2, 0x1}, {0x2, 0x1}, {0x5, 0x3}, {0x4, 0x1}, {0x1}, {0x4}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x5}, {0x3, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x0, 0x1}, {0x3}, {0x6}, {0xa}, {0x3, 0x1}, {}, {0x2, 0x1}, {0x1}, {0x4}, {0x5}, {0x3}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x5, 0x9cd97d8320141b74}, {0x6}, {0x2}, {0xb82e57098c7a44ef}, {0x4, 0x1}, {0x1}, {0x0, 0x1}, {0x5}, {0x1, 0x1}, {0x5}, {0x0, 0x1}, {0x4}, {0x4}, {0x0, 0x1}, {0x2}, {0x4, 0x1}, {0x1, 0x1}, {0x1, 0x1}, {0x2}, {0x3}, {0x1, 0x1}, {}, {0x4}, {0x3}, {0x3}, {0x1}, {0x5}, {0x3, 0x1}, {0x4}, {0x3, 0x1}, {0x0, 0x1}, {0x1}, {0x2, 0x1}, {0x1}, {0x5, 0x1}, {0x4}, {0x3, 0x1}, {0x3}, {0x1}, {0x0, 0x1}, {0x4}], 0x1}}]}, {0x4}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}]}]}}]}, 0xe8c}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$kcm(r7, &(0x7f0000002900)={&(0x7f0000000500)=@xdp={0x2c, 0x8, r5, 0x17}, 0x80, &(0x7f00000000c0)=[{&(0x7f0000000380)="da", 0x1}], 0x1, 0x0, 0xffed}, 0x4000880) 1m6.924488744s ago: executing program 5 (id=3792): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = add_key(0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe) mkdir(&(0x7f00000001c0)='./file0\x00', 0x8) mkdir(&(0x7f0000000300)='./bus\x00', 0x68) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000b80), 0x8, &(0x7f0000000180)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000240)='./file0\x00') r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.usage_percpu\x00', 0x275a, 0x0) readahead(r1, 0xe, 0xffffffffffffffff) ioctl$F2FS_IOC_GET_PIN_FILE(0xffffffffffffffff, 0x4606, 0x0) keyctl$read(0xb, r0, 0x0, 0x0) mkdir(&(0x7f0000000100)='mnt\x00', 0x1ff) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000060a010400000000000000000a0000010900010073797a3100000004100004800c00018008000100636d70000900020073797a3200000000140000001100010000000000000000000100000a8c261081be0a274359fd2a8aa38ac8ccc5981a440435ed5bf2fa0c6c260a6e6ba70e28bd215de8531b93e07db8c000d2626089b688c5687d3ab7c25776df37eef887508b8476c3d7107bc676a9fdeddc088455bf8c408f2bc073caa45a7ce12852f660eecc05dcb3c54cb4f110aefdce91b890da6e44b4b22a0cfb6a45c0ed98a0d339b59ff5e50fecf9d77f274763aca563062d58e0fbdc27f6dd58a322bc182b7f1bb96c0f90b64e04a881babc971b21f86dae8af4300bbda45646dde9ca8947e47fb3d529"], 0x64}, 0x1, 0x0, 0x0, 0x4008840}, 0x20040040) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(0xffffffffffffffff, 0x84, 0x76, &(0x7f0000000200)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, &(0x7f0000000400)={0x0, 0xd0}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(0xffffffffffffffff, &(0x7f00000003c0)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x3, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x280020}, 0x1c, &(0x7f00000000c0)=[{&(0x7f0000000040)='\x00', 0x1}], 0x1}}], 0x1, 0x20008050) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, &(0x7f0000000140)=ANY=[@ANYRES32=0x0, @ANYBLOB='+'], 0x12) mount(0x0, &(0x7f0000000300)='mnt\x00', &(0x7f0000000400)='devtmpfs\x00', 0x0, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r2, 0xc0cc5605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x56555941, 0x0, 0x2000000}}) statx(0xffffffffffffffff, &(0x7f0000000240)='mnt/ttyUSB0\x00', 0x800, 0x4, &(0x7f0000000580)) r3 = syz_usb_connect(0x2, 0x39, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002ff000040a00e58684000010203010902270001010080320904000003ff000000070581024000000705020240000007058303"], &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0}) r4 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00') bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup=r4, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@cgroup=r5, 0x24, 0x0, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB="040e0a062e04"], 0xd) syz_usb_control_io$lan78xx(r3, 0x0, &(0x7f0000000d40)={0x34, &(0x7f0000000140)=ANY=[@ANYBLOB="001308000000f00d3e89bf565ec7a3b4773553c11fa870d01d6ca86c00caebf132973823409c9a17b89d0bd97812d32fdff73012cf661f08dcabde6b848e99138a753f5d02297b965d08773d0190dffb38ec36582f5af2b8d67286605857a520bd863f043d40d3f020cd6688442ce1e87b14f7190d177c00"/134], 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000400)='mnt/ttyUSB0\x00', 0x2, 0x0) r6 = socket(0x2c, 0x8000e, 0x1000000) sendmsg$nl_generic(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000006140)=ANY=[@ANYBLOB="640000001900010000000000000000001d01090050001180"], 0x64}}, 0x0) 1m4.746178195s ago: executing program 5 (id=3798): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000700)={'wlan1\x00', 0x0}) mkdir(&(0x7f0000000040)='./config\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./config\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(&(0x7f0000000140)='./config/cluster/mycluster\x00', 0x1ff) mkdir(&(0x7f0000000440)='./config/cluster/mycluster/heartbeat/myregion\x00', 0x1ff) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/blocks\x00', 0x1, 0x0) r7 = socket$can_raw(0x1d, 0x3, 0x1) r8 = syz_open_dev$tty20(0xc, 0x4, 0x1) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0xfe, 0x7fff0006}]}) r10 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000240), 0xa2003, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r10, 0xc0184800, &(0x7f0000000100)={0x20004, r9, 0x2}) r12 = syz_open_dev$dri(&(0x7f0000000280), 0x1ff, 0x140) ioctl$DRM_IOCTL_GEM_FLINK(r12, 0xc008640a, &(0x7f0000000300)={0x0, 0x0}) ioctl$DRM_IOCTL_GEM_OPEN(r12, 0xc010640b, &(0x7f0000000140)={r13}) ioctl$PIO_UNIMAP(r8, 0x4b67, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x8000, 0xffff}]}) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000180)={0x52, 0xd8, 0xfffc, {0x20, 0x1}, {0x46, 0x8002}, @ramp={0x3, 0xfb27, {0x5, 0x4, 0x1ff, 0xfff}}}) r14 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r14, &(0x7f0000000040)="e2", 0x12d8) ioctl$sock_SIOCETHTOOL(r7, 0x8946, &(0x7f0000000000)={'bridge0\x00', &(0x7f0000000040)=@ethtool_sfeatures={0x3b, 0x2, [{0x178f705d, 0xb}, {0x6, 0x2007f}]}}) write(r6, &(0x7f00000005c0)='64=', 0x3) sendmsg$NL80211_CMD_SET_INTERFACE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0500"/11, @ANYRES32=r5, @ANYBLOB="08000500"], 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r11, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x28, r1, 0x5, 0x80000000, 0x4, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params]}, 0x28}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000400)=ANY=[@ANYBLOB="5000030008021100000108021100000008021100000000000080000000009873e0534acfc4250491fc0000000400010001018206028000"], 0x2b) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, 0x0) 1m4.059400681s ago: executing program 5 (id=3799): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x90, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6fff6d6f64653d30303030303030303030303030020030301f34303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) getdents64(r1, &(0x7f0000000100)=""/134, 0x86) mount(0x0, &(0x7f0000000200)='myproc\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='myproc/iomem\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) 1m3.046088921s ago: executing program 37 (id=3799): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1df) mount(0x0, &(0x7f0000000080)='./proc\x00', 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1c1) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x90, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB="2c726f6fff6d6f64653d30303030303030303030303030020030301f34303030302c757365725f69643d", @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0, @ANYBLOB=',\x00']) read$FUSE(r0, &(0x7f00000021c0)={0x2020}, 0x2020) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000004280)='./file0\x00', 0x0, 0x2c) getdents64(r1, &(0x7f0000000100)=""/134, 0x86) mount(0x0, &(0x7f0000000200)='myproc\x00', 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000400)='myproc/iomem\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/midi.usb0/in_ports\x00', 0x1, 0x0) write(r2, &(0x7f0000000240)='2\n', 0x2) 8.411407276s ago: executing program 9 (id=3952): r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f0000000080)="1400000052004f030e789e7ee2ce2fa4ff612d27", 0x14) recvmmsg(r0, &(0x7f0000005c80)=[{{0x0, 0x0, 0x0}}], 0x344, 0x10122, 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x80001009, 0x0, 0x0, 'queue0\x00', 0xfffffffc}) write$sndseq(r1, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick=0x1f4, {}, {}, @raw32={[0x2600]}}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_DELETE_QUEUE(r1, 0x408c5333, &(0x7f0000000100)={0x0, 0x6394ff42, 0x1, 'queue0\x00'}) ioctl$SNDRV_SEQ_IOCTL_GET_QUEUE_STATUS(r1, 0xc05c5340, &(0x7f0000000280)={0x2, 0x0, 0x4, {0xb, 0x9}, 0x4, 0xfffffffd}) 8.239400893s ago: executing program 9 (id=3955): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000c80)={'lo\x00'}) r1 = socket$kcm(0x2, 0x1000000000000002, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) fadvise64(r1, 0x7, 0x6, 0x3) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r2, 0xfffffffc) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) sendto$inet(r3, 0x0, 0x44, 0x4000000, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000005e80)=[{{0x0, 0x0, &(0x7f0000005e00), 0x0, 0x0, 0x0, 0x800}}], 0x1, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r5, 0x0, 0xd231c4f959ad4808) syz_open_dev$dri(0x0, 0x1, 0x2200) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) r6 = socket$inet_sctp(0x2, 0x5, 0x84) getsockopt$inet_sctp_SCTP_MAXSEG(r6, 0x84, 0xd, &(0x7f0000000080)=@assoc_value={0x0, 0xecd}, &(0x7f00000000c0)=0x8) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xd) r7 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000001700), 0x80640, 0x0) read$FUSE(r7, &(0x7f0000001b00)={0x2020}, 0x2020) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000280)={0x60, 0x2, 0x6, 0x3, 0x0, 0x0, {0x7}, [@IPSET_ATTR_DATA={0x14, 0x7, 0x0, 0x1, [@IPSET_ATTR_BUCKETSIZE={0x5, 0x15, 0x2}, @IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x4}]}, @IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x60}, 0x1, 0x0, 0x0, 0x80890}, 0x20004000) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) ioctl$VIDIOC_G_EXT_CTRLS(0xffffffffffffffff, 0xc0185647, &(0x7f0000000180)={0x4, 0x80, 0xd, r8, 0x0, &(0x7f0000000140)={0x9b0940, 0x4, '\x00', @p_u32=&(0x7f00000000c0)=0x6}}) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000100)={0x0, 0x24, &(0x7f0000000200)={&(0x7f0000000380)=ANY=[@ANYBLOB="5c0000000906030000000000000000000a000000340007800c000180080001407f0000010c001480080001400ac5f5ae540004405000000006000540506400000000130073797a300000000005000100060000000900020073797a3100000000"], 0x5c}, 0x1, 0x0, 0x0, 0x810}, 0x20004000) 7.3125948s ago: executing program 7 (id=3959): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket(0x2, 0x80805, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r2, 0x0) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x7a, &(0x7f0000000340)={r3, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x6cbf5165, @dev={0xfe, 0x80, '\x00', 0x38}}, 0x1c) r4 = syz_open_dev$tty1(0xc, 0x4, 0x3) r5 = dup(r4) write$UHID_INPUT(r5, &(0x7f0000001040)={0x1a, {"a2e3ad21ed6b52f99cfbf4c087f71e9b230963ff7fc6e5539b9b3b09719b711b5d52101b080d29428f0e1ac6e7049b3468959b189a242a9b45f3988f7ef319520100ffe8d178708c523c921b1b23380a169b63d336cd3b78130daa61d8e81aea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f309f4cff7738596ecae8707ce065cd5b91cd0ae11a973735b36d5b1b63e91c00305d9be7bd1d020000000000000075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecd03aded6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801000000005b6bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c580263093ca9a34af674f3f39fe23491e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6fa94fc488ec130fb3850a27afc953854a642c57519544ae15a7e454dea05918b412435111c8f11baa500a3621c56cea8d20ff911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269caf12c31357c8219793e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a687974e7b4ab01b7f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a60560a22f1fca567e65d5e880572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5120000008213b704c7fb082ff27590678ef9f190bae979babc7041d860420c5664ba7921b14dc1db8892fe32d0ad7bc946813591ad8deff4b05f60cea0da3710ac000000001a527777a5371f87d0d4aa202fd28f28381aab144a5d429a04a689b83c7068ae949ef06e288e810bac9c766000a5e19c907f8ea2e2f05dd3318271a1f5f8528f227e79c1386abdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eefc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f103000000416d59fdee5325928974d12dad99dac44c3f0008047096a44060fb30e900caab415db6578b4779415d97b9a6d601005c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3c901cd34e5c92f76cc4c24eeb8bc4e9ac292d9e53803ed000000009737d214060005ea6f1783e287b3bee96e3a7288afe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f48fe4eae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf02b98a269b891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efedfd71af9444e197f47e866101496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ffffff7f000000007f889b09114edb8e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615f7084a607a7eceb6243378e0610060f02cca405d8c5f64fdb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c4e15a7b6eb65ca8104e1b4da1fbb67ab2fc043aead87c32ab875ee7c2e7b7019c902cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe529003d1802d5676d95f160ec97b1ad948741b2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd73643de50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c1023bf70cc77737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73c497579773767075428067e7f16f4dde374f8211fef42cb468e623daf60b3569d462f4f19eacdb3ed70eeebb40800000077d443e8b40426db6fe29068c0ca3d3414442e863a154704b0e5e2c664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae44369ddb4581c55925d0f6f1ba471eba281f259152f85e654fb39ddff3b484439d9921b379a3aca07f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b405177548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd84e935e00785ec27e923911fab964c271556527697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9ddbfb96d6144345f48843dd014e5c5ad8fe995754bd9cf32fce1e7027132f2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5336651b1b9bd522d60399473296b831dbd933d93994ba30b4279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee29165895ac4b008e595f437491d87abed02cefcd9db53dc10772d2b13f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76d57227edff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f84fa6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b30f0b932a4d02da711b757fe43c06d21e759595e4e98b27faea8aa12bc8040000000000000033eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d0000010000000000fcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cb0b3e35cb80dd349e891aef595dc4d080e8a96d5308e15fc37d06aeac289c0523f483e1ff7408c60edddab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec014508e5247d33ae6c962d35603ff8454c16f8342856935125102bb784ed704887071f3d998efdd9923c954ab6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6ff7ffb1d62458d0741a12830052fcc460db043afe525629b40d7cee65802cb5e930ed624806c43a006dc9336d07c2b8081c188d26558f48261f7897084c2a1a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da3932ba5c04c24a560ad80a3ce654578376e599aff3565b1d531f30912b99e6619ebe93cc0b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c0ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf475bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e6491953264c7b34252600c9654e502dcea39cb0800ebdf7f2e234b4ca7db2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc640df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c02b5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadbb25c72e9758f03a755d0be53f8d2a1dfb1c6000064b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2fc4c40e9cf96f06817fb903729a7db6ff957697c9ede7885d94ff1aa7082ead01a9b03c37b0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058093fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d060000008926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) ioctl$VHOST_VDPA_GET_VQS_COUNT(r5, 0x8004af80, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'hsr0\x00', 0x0}) r7 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi4\x00', 0x8000, 0x0) ioctl$COMEDI_DEVCONFIG(r7, 0x40946400, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000200)=ANY=[@ANYBLOB="38800100430007012abd7000fcdbdf25027c0000d791df6d55dd6055fcb8e0e6198f18004580140004000000000000000000080000000000"], 0x38}}, 0x2004c000) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000180)={r6, 0x1, 0x6, @multicast}, 0x10) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f00000000c0)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x20, 0x20, 0x5, [@enum={0x3, 0x1, 0x0, 0xf, 0x4, [{0x6}]}, @func_proto]}, {0x0, [0x0, 0x5f, 0x2e]}}, 0x0, 0x3d, 0x0, 0x0, 0x1}, 0x28) setsockopt$packet_add_memb(r0, 0x107, 0x1, &(0x7f0000000100)={r6, 0x3, 0x49, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}, 0x10) 7.128785184s ago: executing program 7 (id=3960): r0 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r0, 0x107, 0x14, &(0x7f0000000000)=0x4, 0x4) socket(0x10, 0x803, 0x0) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x24c01, 0x0) r1 = syz_open_dev$vbi(&(0x7f0000000140), 0x1, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r1, 0xc0185647, &(0x7f0000000100)={0x0, 0x9, 0x6, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0xe56a657eb850e849, 0x1, '\x00', @value=0x7fff}}) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, 0x0) getpeername(0xffffffffffffffff, 0x0, &(0x7f0000000400)) syz_usb_connect(0x4, 0x24, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) syz_emit_ethernet(0x0, 0x0, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r2 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x1) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)=',8Zz', 0x4) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0", 0x25}, {&(0x7f00000003c0)="e8700e", 0x3}], 0x2, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000000340)=""/7, 0x7}, {&(0x7f0000000280)=""/81, 0x51}], 0x2}, 0x0) ioctl$VIDIOC_S_SELECTION(r2, 0xc040565f, &(0x7f0000000940)={0xa, 0x100, 0x3, {0x8000, 0x1000, 0x4, 0x2}}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@newlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x40024, 0x2081}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @xfrm={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x54}, 0x24000850) r6 = syz_open_dev$sndctrl(&(0x7f0000002b80), 0xffffffff, 0x20c040) ioctl$SNDRV_CTL_IOCTL_ELEM_WRITE(r6, 0xc2c45513, &(0x7f0000002e00)={{0x8, 0x7, 0xa512, 0xfffdfffe, '\x00', 0x7b}, 0x0, [0x8, 0x1, 0x1000, 0x9, 0xb, 0x7fffffff, 0x6, 0x8, 0xbc0, 0x2007, 0x15b, 0x7, 0x5944, 0x5, 0x7, 0x8004a9, 0xd, 0x5, 0xb, 0x3, 0x2a, 0x400, 0x2000040, 0x10200000, 0x7, 0x0, 0x6, 0x804, 0x0, 0x3, 0x4, 0x6, 0x6, 0x7ff, 0x3ff, 0x1, 0x5, 0x3, 0xfffffeff, 0x6, 0x3, 0x0, 0xffff8007, 0x2000000e, 0xe, 0x0, 0x200002, 0x5, 0xe, 0x0, 0x9, 0x80010001, 0x400, 0x9, 0x40000009, 0xfffff647, 0xb3d, 0x4, 0x10, 0x9, 0x8, 0x9000, 0x5, 0x8, 0x98, 0xbe, 0x801, 0x1, 0x8, 0x3d, 0x1, 0xa, 0xfffffffe, 0x80000000, 0x69e, 0xb, 0x7004000, 0x0, 0x8, 0x8, 0x7, 0x9, 0x1, 0x3, 0xfffffffd, 0xffff, 0x6, 0x4, 0x100007ff, 0x4, 0xef, 0xff, 0x4, 0x3, 0x0, 0x58a0, 0xb, 0x19, 0x48895, 0x6, 0x7, 0x89, 0xfffffffe, 0xa1a9, 0xe0ae, 0x9, 0xfffff561, 0x12, 0x3, 0x3, 0xfffffffa, 0x8, 0x2, 0x1, 0xc3c, 0x1, 0x11, 0x5, 0x8, 0x2, 0xf2, 0x4, 0x621c6328, 0x7, 0xfffffffe, 0x7, 0x6, 0xff]}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r7, &(0x7f00000000c0)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r7, 0x1, 0x8, &(0x7f0000000240), 0x4) socket$netlink(0x10, 0x3, 0x0) 6.875374878s ago: executing program 2 (id=3962): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x6}]}) r2 = socket(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) connect$bt_sco(r2, &(0x7f0000000100)={0x1f, @none}, 0x8) getsockname(r2, &(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x10, 0x5, 0x801, 0x0, &(0x7f0000000280), 0x2) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) mincore(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000", @ANYRES32, @ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x41, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2b) unshare(0xa000200) r4 = semget$private(0x0, 0x4000, 0x0) semctl$GETALL(r4, 0x0, 0xd, 0x0) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) 6.474949544s ago: executing program 9 (id=3965): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000e40)={0x38, r1, 0x5, 0x70bd2c, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_USE_MFP={0x8, 0x42, 0x1}]}, 0x38}}, 0x0) syz_80211_inject_frame(&(0x7f0000000000)=@device_b, &(0x7f0000000240)=ANY=[@ANYRES8=r0, @ANYRES32=r0, @ANYRESDEC, @ANYRES8=r0, @ANYRESOCT=r2, @ANYRESHEX=r1], 0x2f) clock_gettime(0x0, &(0x7f0000000400)={0x0, 0x0}) nanosleep(&(0x7f0000000340)={r3, r4+60000000}, 0x0) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000200)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @val={0x10, 0x1, 0x21}}, 0x21) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=ANY=[@ANYBLOB="1000000008021100000108"], 0x20) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) 6.425911106s ago: executing program 7 (id=3966): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) flock(r0, 0xa) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = openat$full(0xffffff9c, &(0x7f0000000000), 0x40000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x9, &(0x7f0000000240)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000002f000000b709000000000000850000000700000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, &(0x7f00000008c0)=[{{&(0x7f0000000000)={0xa, 0x4e1f, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000040)="a4", 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x0, @remote, 0x1}, 0x1c, 0x0}}], 0x2, 0x0) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x7, 0x30, 0x5, 0x5}, &(0x7f00000000c0)=0x18) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$system_posix_acl(r4, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)=ANY=[], 0xfe44, 0x0) r5 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x4c, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r5, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r8 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r7, 0x0, 0x0}) ioctl$VIDIOC_G_INPUT(r8, 0x80045626, &(0x7f0000000180)) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r9, 0xffffffffffffffff, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) io_setup(0xffff, &(0x7f0000000140)) ioctl$TIOCPKT(r10, 0x5420, &(0x7f00000000c0)=0x6) ioctl$TCSETS(r10, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "fe94b89fc43c3328eae0cae1f5eba329e6f216"}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) 6.351229718s ago: executing program 8 (id=3967): r0 = socket$l2tp6(0xa, 0x2, 0x73) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x1000000) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x8fff, 0x0) execve(&(0x7f0000001040)='./file0\x00', 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r1) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000002c0)={0x4c, r3, 0x1, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0x8, 0x3, r2}, @val={0xc, 0x99, {0x1, 0x5b}}}}, [@NL80211_ATTR_4ADDR={0x5, 0x53, 0x1}, @NL80211_ATTR_IFNAME={0x14, 0x4, 'dvmrp0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x4}]}, 0x4c}, 0x1, 0x0, 0x0, 0x62b4e7cbb8b4f193}, 0x8040) r4 = creat(&(0x7f00000002c0)='./file0\x00', 0x10) r5 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r5, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$char_usb(r4, &(0x7f0000000700)="027ef4e4486467", 0x7) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000003c0)={r6, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000280)='./file0\x00', &(0x7f0000000300)=[0x5], 0x0, 0x0, 0x1}}, 0x40) bind$l2tp6(r0, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x3}, 0x20) 6.095913697s ago: executing program 8 (id=3968): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl802154(&(0x7f0000000a40), 0xffffffffffffffff) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = getpid() r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x2002) ioctl$EVIOCSCLOCKID(r1, 0x400445a0, &(0x7f00000001c0)=0x1) r2 = syz_pidfd_open(r0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x0, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x6, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket(0x1e, 0x1, 0x0) connect$tipc(r6, &(0x7f0000000000)=@name={0x1e, 0x2, 0x2, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(r6, &(0x7f0000000340), 0x2000011a) splice(r6, 0x0, 0xffffffffffffffff, 0x0, 0x4ff9c, 0x0) setns(r2, 0x24020000) syz_clone(0x1fa02000, 0x0, 0xfffffffffffffeab, 0x0, 0x0, 0x0) setreuid(0x0, 0x0) setrlimit(0x3, &(0x7f0000000000)={0x4, 0xc0}) 5.77672228s ago: executing program 7 (id=3969): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r0, 0x65, 0x7, &(0x7f0000000100)=0x6, 0x4) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000780)=ANY=[@ANYBLOB="19000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x6, 0xd, &(0x7f0000000200)=ANY=[@ANYRES32=r1], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x3, &(0x7f0000000380)=ANY=[], &(0x7f0000000340)='GPL\x00', 0x6, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000e80)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x50) r6 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$inet6_udp_int(r6, 0x11, 0x66, 0x0, &(0x7f00000000c0)) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x16, 0x5, &(0x7f0000000380)=ANY=[@ANYBLOB="1800000002000000000000000000000085000000a00000008500003d822408ab224500050000009500000000000000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0xf, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r7, 0x0, 0x10, 0x38, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x11, 0x14, &(0x7f0000000580)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c2500000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb700000000000000b7030000000000fd850000007300000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, @fallback=0x16, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000bc0)={r8, 0x0, 0x0}, 0x10) recvmmsg(r3, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) connect$inet6(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sysinfo(&(0x7f0000000500)=""/206) socket$kcm(0x11, 0x5, 0x300) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00'], 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000100)={0x6, 0x3, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r2, 0x5, 0x0, 0x0, 0x0, 0x0, 0x149c, 0x503, 0x0, 0x0, 0x0, 0x0, 0x5, 0xffff80fe, 0x40}, 0x4c) 4.830981586s ago: executing program 9 (id=3970): pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) write(r1, &(0x7f0000000280)="96fa2c0bff2099297e1c1ea6d53ff4c2f69b32d385f14857ae25047e39555bbacdb216aa20b99d21a3aa5e5775e86006778ec677400377670a3422aa5184ed400cf452f14ef81d20a792091e037ed82c9ee401f0f428bd4951eab88952d04fd3c2201db3378816", 0xfffffdce) r3 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_NEXT_DEVICE(r3, 0xc1205531, &(0x7f0000002680)=""/4104) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./my_debugfs\x00', 0x0) mount(0x0, &(0x7f0000000440)='./my_debugfs\x00', &(0x7f0000000480)='debugfs\x00', 0x0, 0x0) chdir(&(0x7f00000004c0)='./my_debugfs\x00') chdir(&(0x7f0000000500)='./usb\x00') chdir(&(0x7f0000000540)='./uhci\x00') r4 = open(&(0x7f0000000580)='0000:00:1d.0\x00', 0x700, 0x0) read$nci(r4, 0x0, 0x0) tee(r0, r2, 0xfffffffffffffffd, 0x0) 4.4937084s ago: executing program 7 (id=3971): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x6}]}) r2 = socket(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) getsockname(r2, &(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x10, 0x5, 0x801, 0x0, &(0x7f0000000280), 0x2) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) mincore(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000", @ANYRES32, @ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) r4 = socket$alg(0x26, 0x5, 0x0) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x41, 0x0) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2b) sendto$packet(r5, 0x0, 0x0, 0x24008805, 0x0, 0x0) unshare(0xa000200) r6 = semget$private(0x0, 0x4000, 0x0) semctl$GETALL(r6, 0x0, 0xd, 0x0) r7 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x2) 3.687962236s ago: executing program 9 (id=3972): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) r0 = getpgrp(0x0) prlimit64(r0, 0x8, &(0x7f0000000140)={0x8, 0x87}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) madvise(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0xa) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) write$cgroup_subtree(0xffffffffffffffff, 0x0, 0x5) setreuid(0xee00, 0x0) write$sequencer(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000240)='./file0\x00', &(0x7f00000004c0), 0x1200004, 0x0) r2 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0xf000, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0f000000040000000800000008"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x15, 0xc, &(0x7f0000000440)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffdffd, 0x0, 0x0, 0x0, 0x800}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r3}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x1e00, 0x4a, '\x00', 0x0, @sk_reuseport=0x27, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0xffffffff}, 0x94) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r4, 0x2000000, 0xe, 0x0, &(0x7f00000004c0)="630b008646dc3f0adf33c9f7b986", 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2}, 0x50) ioctl$TIOCSTI(r2, 0x5412, &(0x7f0000000080)=0x13) r5 = open(0x0, 0x80242, 0x1df2a23c5997fa5f) syz_io_uring_setup(0xe0b2, 0x0, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) connect$pppoe(r5, &(0x7f0000000180)={0x18, 0x0, {0x4, @remote, 'hsr0\x00'}}, 0x1e) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/trace\x00', 0x0, 0x0) read(r6, &(0x7f0000000180), 0x1000) 3.531342541s ago: executing program 8 (id=3973): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000680), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_RINGS_SET(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000008c0)={&(0x7f0000000300)={0x34, r2, 0x1, 0x4, 0x0, {}, [@ETHTOOL_A_RINGS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'wlan0\x00'}]}, @ETHTOOL_A_RINGS_RX={0x8, 0x6, 0x10000}]}, 0x34}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) ioctl$KDFONTOP_SET(r0, 0x4b3c, 0x0) 3.33085542s ago: executing program 2 (id=3974): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000240)='blkio.bfq.group_wait_time\x00', 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x1ff) mount(&(0x7f0000000200)=@filename='mtd0\x00', &(0x7f0000000100)='./file0\x00', &(0x7f0000000300)='jffs2\x00', 0x800000, 0x0) chdir(&(0x7f0000000240)='./file0\x00') mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1d4e, 0x103) preadv(r1, &(0x7f00000000c0)=[{&(0x7f0000000180)=""/140, 0x8c}], 0x1, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001180)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x3fe3aa0262d8c583, 0x70bd2b, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x6, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0xc, 0x8002, [@TCA_FQ_PIE_FLOWS={0x8, 0x2, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x24000000}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000100)=@base={0x1a, 0x4, 0x0, 0x1, 0x8000, 0x1, 0xffffffff, '\x00', 0x0, 0xffffffffffffffff, 0x4, 0x0, 0x4}, 0x50) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=@newqdisc={0x40, 0x24, 0xf0b, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0xe, 0xfff1}}, [@qdisc_kind_options=@q_etf={{0x8}, {0x14, 0x2, @TCA_ETF_PARMS={0x10, 0x1, {0x0, 0xb, 0x5}}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20000000}, 0x4000010) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[@ANYBLOB, @ANYRES32=0x0, @ANYBLOB="00000000141000001c00128009000100626f6e64000000000c00028005001f"], 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x4000000) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0x4, &(0x7f00000001c0)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x3}, [@call={0x85, 0x0, 0x0, 0x50}]}, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x4}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x0, 0xe, 0x0, &(0x7f0000000680)="548852ac5b4eba7aeaccd2c62b2b", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x9, 0x8}, 0x50) 3.012979547s ago: executing program 8 (id=3975): bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x800}, 0x50) r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000140)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x7ff, '\x00', 0x0, 0x0}, 0x50) bpf$PROG_LOAD(0x72, &(0x7f0000000840)={0x10, 0xf, &(0x7f0000000040)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x4, 0x1, 0xb, 0x9, 0xa}}, {{0x5, 0x0, 0x3, 0x9, 0x0, 0x1, 0x3801}, {0x2c}}, [], {{0x7, 0x1, 0xb, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000980)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_msg=0x7, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe}, 0x94) 2.67194363s ago: executing program 8 (id=3976): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-cast6-avx\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x800) sendto$packet(r1, &(0x7f0000000a40)="d8b8f5a2289fedded39f79c78869a3cda57dc252f75ff3c104a126ad48adce8f0e98a950a526353fa8d1f1f8066b53786aca597ae0c003fd21a6587ac5520045360d2e5aa562a401e592bcfc58c0d2a60ae395f3fb89d355a220515630c2922f0fd8023f8aaa67287f2c7ad1bb4c90422c53df26719815a4623a13e672d9fe7ac5a8fed25dfabe68f0f78c3d141da3a996339f5a3f51b92a34272c7a7a2a23fe2d52e14bf5f074853976a718f65c70b968ac357f218b4bd26fb290a0167a578389d4140855208e0b4b570b27d92192e6e3c9cfa977e0dbf5b216a68dd1d0d20aa79e7677695959a6f12ad5d4cdfb5f6d6ba814f0e130edab39f06686c3da8c4022400f496f3240281c4eea169046be517f6c4661ce5df3df908bf000b882710afe0591a897c07bb3c4493edee322d4aa6a28c85290d44229732499e6f96e0222780a16bf0a86ff22d6fd545b8ac4c7c593d5ea06ff15ef1c6f01efc649b9143e259329edaa9d48bf3d9417fe9c3f4e3a53b8abb025e3d9a0e9938d731a6e54228476681c7e1022fb17f686c781496420a3476fb03132aac5282b92de57abb64e74f3c658fb42f5a338d2b0bc316abd41e96cc3708bf3f91da759d161f4b15195ccfdcb00e560ef7fb457d7435b16fe3da112a7411193007bc83b6685d8e1f5a9f7b3e7f73319212f0de514e2761ff0fb91de9ebe6736e54fe778bd9f669f5a8e0a007f99ee6be730bbfb9ea328b30aec08322d42e3854ed1852b56e208861dcef970ec2914aa96326e00"/579, 0xffffffffffffff09, 0x24008805, 0x0, 0x0) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r4, 0xae60) ioctl$KVM_CREATE_PIT2(r4, 0x4040ae77, &(0x7f0000000280)={0x8}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x1) (fail_nth: 1) ioctl$KVM_SET_MSRS(r6, 0xc008ae88, &(0x7f0000000040)={0x3, 0x0, [{0xaec, 0x0, 0x621e1a66}, {0x8a2, 0x0, 0x100}, {0xaff, 0x0, 0x8}]}) bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0x6, 0x4, 0x1010, 0x89, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x3}, 0x50) r7 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f00000002c0)={[0xb59, 0x9, 0xfffffffffffffff9, 0x2, 0x0, 0x0, 0x4002004c4, 0x1004, 0x76, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x90], 0xeeee8000, 0x2018d3}) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) 2.657011239s ago: executing program 2 (id=3977): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) flock(r0, 0xa) r1 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0300000004000000040000000a"], 0x48) r2 = openat$full(0xffffff9c, &(0x7f0000000000), 0x40000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0x9, &(0x7f0000000240)=ANY=[@ANYBLOB="1808000000000000000000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000002f000000b709000000000000850000000700000095"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1d, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) fanotify_init(0x200, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) sendmmsg$inet6(r3, &(0x7f00000008c0)=[{{&(0x7f0000000000)={0xa, 0x4e1f, 0x1, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x1}, 0x1c, &(0x7f0000001780)=[{&(0x7f0000000040)="a4", 0x1}], 0x1}}, {{&(0x7f00000004c0)={0xa, 0x4e21, 0x0, @remote, 0x1}, 0x1c, 0x0}}], 0x2, 0x0) shutdown(r3, 0x1) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(r3, 0x84, 0x73, &(0x7f0000000080)={0x0, 0x7, 0x30, 0x5, 0x5}, &(0x7f00000000c0)=0x18) set_mempolicy(0x8006, &(0x7f0000000040)=0xfff, 0x5) r4 = creat(&(0x7f0000000080)='./bus\x00', 0x0) fsetxattr$system_posix_acl(r4, &(0x7f0000000000)='system.posix_acl_default\x00', &(0x7f00000002c0)=ANY=[@ANYBLOB], 0xfe44, 0x0) r5 = syz_open_dev$media(&(0x7f0000000040), 0x7fdffffe, 0x0) r6 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x4c, 0x0, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r5, 0x80047c05, &(0x7f0000000080)=0xffffffffffffffff) r8 = syz_open_dev$radio(&(0x7f0000000000), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_G_EXT_CTRLS(r8, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r7, 0x0, 0x0}) ioctl$VIDIOC_G_INPUT(r8, 0x80045626, &(0x7f0000000180)) r9 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x3, 0x0, 0x7fff2000}]}) close_range(r9, 0xffffffffffffffff, 0x0) r10 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000e40), 0x40080, 0x0) io_setup(0xffff, &(0x7f0000000140)) ioctl$TIOCPKT(r10, 0x5420, &(0x7f00000000c0)=0x6) ioctl$TCSETS(r10, 0x5402, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "fe94b89fc43c3328eae0cae1f5eba329e6f216"}) r11 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r11, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) 1.121220909s ago: executing program 8 (id=3978): r0 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0x10, &(0x7f0000000800)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8001}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@call={0x85, 0x0, 0x0, 0xa0}], {{}, {}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000200)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10001}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={r1, 0xfca804a0, 0x10, 0x38, &(0x7f00000002c0)="b80a000500000000", &(0x7f0000000300)=""/8, 0x2f00, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000900)={0x1, &(0x7f00000008c0)=[{0x6, 0x0, 0x0, 0x6}]}) r2 = socket(0x10, 0x3, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101001, 0x0) connect$bt_sco(r2, &(0x7f0000000100)={0x1f, @none}, 0x8) getsockname(r2, &(0x7f0000000000)=@l2tp={0x2, 0x0, @local}, &(0x7f00000000c0)=0x80) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x2) futex(&(0x7f000000cffc)=0x10, 0x5, 0x801, 0x0, &(0x7f0000000280), 0x2) mlock2(&(0x7f0000ff5000/0x9000)=nil, 0x9000, 0x0) mremap(&(0x7f0000ff5000/0x2000)=nil, 0x2000, 0x5000000, 0x3, &(0x7f0000ffd000/0x1000)=nil) mlock2(&(0x7f0000495000/0x2000)=nil, 0x2000, 0x0) mincore(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0x0) openat$autofs(0xffffff9c, &(0x7f0000000040), 0x8000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0x16, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="85000000070000006a0a00ff000000", @ANYRES32, @ANYBLOB], &(0x7f0000000140)='GPL\x00', 0x2, 0x95, &(0x7f0000000180)=""/149, 0x0, 0x0, '\x00', 0x0, @flow_dissector}, 0x94) openat$dlm_control(0xffffffffffffff9c, 0x0, 0x41, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x2b) unshare(0xa000200) r4 = semget$private(0x0, 0x4000, 0x0) semctl$GETALL(r4, 0x0, 0xd, 0x0) r5 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x2) 847.846603ms ago: executing program 2 (id=3979): bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=ANY=[@ANYBLOB="14000000100001"], 0x118}}, 0x0) r0 = socket$phonet_pipe(0x23, 0x5, 0x2) io_setup(0x3ff, &(0x7f0000000200)=0x0) io_submit(r1, 0x1, &(0x7f0000000240)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x8, 0x0, r0, &(0x7f00000002c0)='\vG', 0x2}]) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./config\x00', 0x1ff) set_mempolicy(0x3, &(0x7f0000000040)=0xe3, 0x8) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='memory.stat\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000200)={'#! ', './file0'}, 0xb) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000440)=""/173) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000000c0)='pstore\x00', 0x5020, 0x0) r3 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$vim2m_VIDIOC_QBUF(r3, 0xc058560f, &(0x7f00000001c0)=@userptr={0x0, 0x1, 0x4, 0x352c34c113f2f238, 0x0, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "0ed290c8"}, 0x0, 0x2, {0x0}}) mount$overlay(0x0, &(0x7f0000000000)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00', &(0x7f0000000040), 0x10040, &(0x7f0000000080)={[{@xino_on}, {@metacopy_on}, {@nfs_export_on}], [{@smackfsroot={'smackfsroot', 0x3d, 'configfs\x00'}}]}) symlinkat(&(0x7f0000000480)='./config/usb_gadget/g1/configs/c.1\x00', 0xffffffffffffff9c, &(0x7f0000000140)='./config/usb_gadget/g1/functions/uvc.0/streaming/class/hs/h\x00') 629.41444ms ago: executing program 7 (id=3980): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/test/cgroup.procs\x00', 0x2, 0x0) write(r0, &(0x7f0000000280)='0', 0x1) mkdir(0x0, 0x1ff) openat(0xffffffffffffff9c, &(0x7f0000000400)='my_tracefs/events/task/task_rename/filter\x00', 0x1, 0x0) close(0xffffffffffffffff) r1 = syz_open_dev$sndmidi(0x0, 0x2, 0x161d02) writev(r1, &(0x7f0000000840)=[{0x0}, {0x0}], 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000500)=@newtaction={0x110, 0x30, 0x100, 0x0, 0x0, {}, [{0xfc, 0x1, [@m_ct={0xb0, 0x12, 0x0, 0x0, {{0x7}, {0x24, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}, @TCA_CT_ZONE={0x6, 0x4, 0x8001}]}, {0x65, 0x6, "f50f486bbddd31a61d8570d94064ff6310bbc2d98d305efdd8362cf58fbdba40dde010032a1d9d1cc1bbc382615d92e6b12d77f987240067fc2c7961d393f5887e1bc43b358ce0fdca0b2527d80fae926a430ea48f3921257a36f2eb506b5d1d27"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x4}}}}]}]}, 0x110}}, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000240)={0x1, &(0x7f0000000200)=[{0x6, 0xfd, 0x17, 0x4}]}) getpid() ioctl$SECCOMP_IOCTL_NOTIF_RECV(r0, 0xc0502100, &(0x7f00000003c0)) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f07ebbeef, 0x8031, 0xffffffffffffffff, 0x2000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x400000000002) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_usbip_server_init(0x6) setgroups(0x0, 0x0) r5 = syz_open_dev$tty20(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r5, 0x560a, &(0x7f0000000040)={0x0, 0x8, 0x0, 0x4}) bpf$PROG_LOAD(0x5, 0x0, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, &(0x7f0000000340)=[0x0], 0x1}, 0x58) 524.116861ms ago: executing program 2 (id=3981): mmap$IORING_OFF_SQ_RING(0x0, 0xc00000, 0x4000002, 0x14032, 0xffffffffffffffff, 0x0) r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x15, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r0, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1, 0x10, 0x0, 0x0, 0x0, 0x0, 0xb00}, 0x90) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='loginuid\x00') preadv(r1, &(0x7f00000003c0)=[{&(0x7f0000000380)=""/44, 0x2c}], 0x1, 0x0, 0x0) writev(r1, &(0x7f00000003c0), 0x100000000000022d) mount(0x0, &(0x7f0000000000)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./mnt\x00', 0x1ff) mount(&(0x7f0000000300)=@filename='./dev/mtdblock0\x00', &(0x7f0000000200)='./mnt\x00', &(0x7f0000000040)='cramfs\x00', 0x0, 0x0) 197.232003ms ago: executing program 2 (id=3982): r0 = mq_open(&(0x7f0000000380)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf\"\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`\x1e\x91<~\xd8\xabs\xbd*e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2\x04\x00\x00\x00\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\x1e\xfc/fm\xa9`)\xfc7\x84\f+\xf7\x95\xab[J\xe7\x9d\xd8\xe3\x86\xdb\xfe|\xe91\n\xa0\xdf\v\\\xe4\x00'/941, 0x40, 0x170, 0x0) pselect6(0x40, &(0x7f0000000000)={0x8, 0x4, 0xf84, 0x6, 0xfffffffffffffbff, 0x1, 0x4, 0x3}, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x989680}, 0x0) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r1, &(0x7f00000012c0)={@val={0x8, 0x800}, @val={0x6, 0x0, 0x6, 0x8, 0x15}, @ipv4=@generic={{0x7, 0x4, 0x2, 0x2, 0xfc0, 0x66, 0x0, 0xb, 0x4, 0x0, @rand_addr=0x64010101, @broadcast, {[@rr={0x7, 0x3, 0xd2}, @generic={0x0, 0x2}]}}, "3297e3ba0fa8a2e71bd9fe1a399b5110420b70460c0dad392d66248a43540df968e7fcaab34569c0e36170578c0d3c546a98b26295e2592f360905866eb4720fed03a977a3df4224895629fd6ccec64f13a999f18f518e3ee28798381975e862f1db9dccdb2f1c1fb60f5ffc7a339d40a8bd1f24cede8a32f186f142e194d4fb48224759faf813ea80e6a853e79b4fe27fe3e1aec5897b314a7f0d515b07b1835986b4885e9826d902c40f16cd77c58b6433ab039955ce9db11f36f459e7114ace6c9989eecea80a81fd39f339356c7c3391af83da2486503a7973f6db4806cf3e5ca94cf7e1f79fd00decd76100c18251a59d1474caabf4d3ca6a9a9885df710e68c5b0dc11832dbb5eecb5c88c2f8f02bdbd88569ad4a740359cbca8c378118220d73bdd1e661c3a74f77aa931b11cd38119b0f084bb96e84803fca6566c33ee1e4e34ab0253fbf24f9f5974af5e1fc2a43a4ec9dd9928a8f38a128ea27c429300ae5a6bd7740471f973d8224b2b07879f4fbe7dcbed776a72ebdc713bcf1d7aa45b01c32a1003e6670d58510bd79ba2fde5cb2b82cef2cc315648f4e9d96d848ba327949b8926253cbdef6888a8982108b6ac7a1108533dd3fe125002e2e286362d1055082a9d73ec5ac3080f2a501ff27250b62c8965f371cf92b32d6422d79f66261eb08a2f8fe50049e102c69ce703d116d0834208cc957d0f1376457a90245816d7642412897fdd2f982fdfbc3af65aa0446b00c767b79aec40e460887ea02188e3a0960eea39b144859467b881978378c9fd593259e0f63148179fe2c2f6d40987b63a6e384e63027f03d8039d707522942d5dc88fd842524d006290b6a65e9cc86cc5b401a60ec4aedfb3bf4d0447bb681810a16b9684b72c2f4593ef834a0203e78cd1d9dbc978e9ae8f3ab62c07f1e41d59470decee7b0cc41ac49e4b7589ab6da65849f62ec217bb39ed161e7d337822d96badbd74d66451ea9a74bed591dc9631bf639dcf7846ee428a9fa55bfceedf3b1c23642f3b58dd0a7273664c6c49c9160a4b9cc5b72d0210e305b94e2cb09ae1d4af9d365b5093851f229c8c30aef75d45ccdbab4b86d801a9ad3b27f26ba601d531c0743717aa7aae29d37f496fec7682c5a1abd321ad61941a2d23fcac6af1d1875e308c8d8c64a5152be47b59c09d293f46b857310a99f1885f0a49d432aa0d39a3e8fc885e75e66b63215133175a19267c8d0adf7d8f644e742ed5369d1405e99e63b78727f135e0243f24d9ce354a1562102ee8de4c191508343b86bf7e7519ddd770ce55e17e590561b2f437194c97ad46622a6ae3dd68d9993e6744954f4cd308bd6594fdccedc578e80aed274a65219697229059723ac37d535cca0e9c314e7941b4160bbd2ffba71f26ffe3228431bc81463078ad70583277ef18bce23ca2e5b9a00670956ea8e0e2c739c006106c8c9ee3f92ba728d8490742b74a9a18cbedfc4e69bb87e0da4c7dfb964374c28c837d4641fb99a19b233675f8526af395335e0185cf3934805442ac379980b687a7128e53284ba9e741b5fe9bc969bfbd55cbce76842915e076e2adf844338d16d3802c681bafdcc60465bd34dfc2d1c069ceee40060e0570fc1275ccabfe3f9be3e84ceedf72cd649c082232008e2b0c94594588c00e0fe911bbf1c12eb6c37ce05674a7597feecf27f5e051ffa824d9ff93638dfa9a84c77562aa2cf897f55a97b79c18544ad03480e1011b8f93e0ead9c2c6672448f585c5803ae99be777fbc662ef4450c1e936ed8b3c8047f00e72adc84561f417f8e5e1dde4967005d96a64fc75d9f486b3ebdb5904a0a56ec48542f0efce939f66fd69259e7376ad37e84434ea90f35b2d3bd63b5c36b267d8f2c7dc5a50b46e00ed086dff8b039e07b84c60611269d4f282ad04dc8e0b481eece2f8a614734be73617f0ad5be195446b09dca4cf1f32653dd3e188aece76f3014deb2ba61744835c0f735234b6a4637c948a7b4fd4203b286ca87d669e325d70277075b094f59eb1dff6c9c05c40d5e464c563df79486e1a32e6ed9bcf675aac7968b4e98dc4e210215b0d3b6a2525b2e3df11f3f1490eb39cabffbe32e23659121fde8e4e346e0f595aaf3666a5f6f118c1a1128039502ac04c40b85eb4c54e6c95b8d1c2aac74ae9e1c355ccde9d54d5d833293f5df09224482179e5bcd8e227c99172a6e14c2cd4e6462ceb0a905a1d64804840ce62e350c6efac10a7fcb029f84af64e2256d45afd3b3f59379895740e0cd2fd24c63264f785bb6e3f40ec72ed67d1a7d87dd264743d9c951cb5aa8bc6f1d1bc9b23303d5aa7f8f6f961326757456057000cb2bacf78cc229002777e932c2640b8dfa793846ca49fa93996db95104a8808a1906b19df17e754b90582b6c49efb3ddce067dd9292291cfd2bb0323ce8098f29e4fce0de31cf5c7e2e2da5d0d0996a8be776de8fecfd3ce68e80d21f1701f6b90ac51278abbd727d19415e0ebe001b990b177b8db0c592b18a4b5e4a6221902362e5b20e6e6f2131a5a5e03c1150b179ef40c933c2fef1b79de738652ec4c32565f5cf751a11db177099c4e2e5bd7616cd0dd501d5bfccf5691de3cca590365328648baf8a9487a3c212193c9bb837594460967e823067a9465eba7001eaf609a810488ef5c147aaa5e9e8c75b585ac3582b6915e20b5aa2f79b7a94857122988c56dbce1ea52de1a56652e839bb853be3ee16052b33fb83ca54d8e4e19440a5e81492107043a66286f63ca87a1f7b8a4e9547a7eb6005419cfd28cb37e9e374f4d0143973286e87070754025c1a6fccfdc6858eaca8c35ecb19584ce7141cc79a5bc813469161b87a19fc21f3373d1f25b3427916dd1be2a589b70ea3b39fcc7801e13beaf19b76164faf3dc4ab8faa5648d24eddd6caceaa0d5ac9cad633c19a4a4d059ee823a49b7cf82c5777d376c111f58ea8fd473429907852301a2c856f27bd0c687ab5be0e2bbef64ddee1601375a4440e3f59d60f57caebfe457f82432523ec4a61cdbb7f1e91e4b05fda892df131c274b19929d26f7a5a6d3ca487983f729601ed9bb4bf5c1cc3d453d406e9534688dec6a2dd0b9db149365c125a95e129565e62cc91f7d960abe1055b730ae0994e7eb08392d5745d0e4f529c4defc3d3e43d0815b0cc63effa88d20c13b14e780c2f6c89a1ee5e4db45a5c272186cc3e51b13dab3add5f467e8ca0f4c45a1fc76db2f0cbf794102946aafcd8cd8a3e935a606b9721645c4d550ae0907f345593736506efc626498c974753d474a73626041d3a54f8fb50de2a6335611a3779da3a02daceb2256d9b102d4d30dd3cd389a04b1a7a6076879f36534bb3379debb46ed1fa2c40096c752017dd024345c58313b43070ff7bef94dc3cafbe6ec20d59e5ea3c196ba3b783bfa87384407efc664cd350c80ac397516018e35371956e414755cde304d2a228c1540ba6fd6a7402d11c666964f024da4c016eb556ba2c5fab86c60c12efb1496295d80f0383526e8e0fc55a287bbd3cb966a916f57958d8b6ef97aa0c4b47f7746bab6b99698c1c96b25c4e2e084147866fe0970b109dd26984adc0758eb6442712cc46dcd8ed3038b0595252eed1b8a46525862662d1e67eba66ac341f8d27853eed54854f488f079bd48df6ce7a4be8b1b61fd23a2dc4d3ade0992011539cc63f80fcfc75008c20cb639348cb218f8f476a6d56917f4ca07e67fc20ea2e9642eaf2182b397e279f5f6c70438fb8aa39cba788588c181461ea7efe1a0dd5b95eb26f7158b91012f7ce0ee1b4e79ce4da377bea4551738a0f491a84f19b3be9827b4469c299527aa9c20b8bf12f919976a0356bba720fb91010763c79bcbb10d89280f0f97cdd19aa0d54828b308195fac170613cf4b515e340a9ef2c97f618a9f50b30ae34ebeed9a38b4c6969680accc740b154ecb014fb5d543a59ccb98a7de2823a2dec39f331cb503eb74fef61262c6d4050bc723caee834eb28c64ce007f6027375e936b62387cf1778970e88b0574a0106d4c855be7425767c551b2fa644d9d8a59f787e7610581b768057d229673344571c3d6e3f10975b2859f568398b1f38f89524d9ad0c1588617c3883a1227b714c81cdf28da54f33968c1c50f28da01c308eb31d319b3e77f96bec001c9300000000000000009cc0062283ac112868592619db14d629c47bfb793a723dcd2f7b07ae4ec14ca3ef4b955ea5b2b153a279b080f6236d418075b86850974c8850efb306d5c304e726bf2643b4403e6d46b0e0395b02e93308b4b2c3e957308d497dc51c753344a7878f1f0c91295fd76e3d1cc9ef813161c6b92b7ea6068ceb97d8f45a4ce57af7d7632d699951f7fe3c71c3a32b014c74425c67e5030546b10cf7edcec2eca5ba31dc62c08f83f35bc2e36b93f15f071bc2537ebe9ca19f86dce4e84272e10323d0ceaa2cc47fe4f6ad101d454c761f9863e94af91199ce5f12469bca7ba39314b84aa7efa4bdc18f7700c19511d48d6132450111d70401a8ac73565d5386ca12345e884d08b23f9c901000a95eb4167865e58c28b112f47c96beeaa6657c923e25e56529107c5c30e65bb485d5ed21b91332db4e09df7e59dcfa05c994570deb3f9b838e22ae4abbf9a9a8c319cc9112c8dba7c2278f78b9578b0254c46a4c04b8fa4fedad6bd275f70b1618971ef6503379bfb0a508c9944328af2c820091a89e3f75e68e7f980ddc9154d273f7f2ce7a6294aefe93136860786679b80e41f6636ff45efeacfb52e2ba2bd9bd9c9030079a46caca5c4b340c17d01ba8ecbc5c561b2038481a8321c009d12136a3ad5461881d998eeaac5236fdcd8f81fb5e53848bb096d9198fd0d38830d1809f2a632b31e2b67754140c907ed58aead048b2d8af9a1c407e48db815212cfdcca97222dabdfe01f311a73e1e82c3e189ec5add48d3f8190eb9e14b58e540f7f1388a7c687629eadb19fd8a133dc8177629270ecaabff79efb6c1f750d89b9e6c5f34c6238066f8e3e425e46a27b3c0d2e9e2ed3cffe2a6f39b8e0137ea5de689b94107fb4748a5feb3902f0feba64dae4c2e69bc8d86463575c6b0ef4a8a64fef41121e57a8c67eda07e9fc8f98299677de198ea0a649ef3c00591940b2c27ba1414aaa1633deb52e3a44cfa8d7a00d014317c026a7d7f42a34b97128e1bf9cda4d8315819ac73ed5061bf9b5631d07b09b85b78ff1b6eb86e9e8c4faa0f991cd6fa0b0eb71b39c20ca9bc7c156f3bd255a5b408df172396bafd7f0fb11c6eaf1eb0a06576d37bee00424bf699584b1dfed68f0d8d8a35f0427c783fe2d79b4373628971e87501a5e4bb05b5058d0b2132741f26e76065b6f4017d963c8ee5605c4c5b6eebb96fca0a41893cb6add3fb0d728abeb860f22cedbd36e464bdaf124a7041460f7af3d64b54e9ffd240b5afad9baf6e5dd8406bc1b205da5848f51fc9dd5197716e144e1b0386614bd3cfd5ddb80ada1e5ca74c8960093a553b1f6288aa7f53663cdd867f658e51b95772dc7a6fa45fa03e14988a33250e6c16fbf0351769080d64ddfbdbf77e1215563bf2e82ecc38a682846d7e2e2ac4e87d715f97f15e84c3df04affee49612a735907d3c4d310a54a6f609873ad56f29a138f4d"}}, 0xfce) r3 = openat$cdrom(0xffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = syz_open_dev$video4linux(&(0x7f0000001140), 0x92e2, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r4, 0xc040564a, &(0x7f0000000080)={0x0, 0x0, 0x1815, 0x0, 0xfffffffe, 0x7, 0x1ff, 0x1}) ioctl$CDROM_SET_OPTIONS(r3, 0x5320, 0x18) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r5 = eventfd(0xafb) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) ioctl$BTRFS_IOC_INO_LOOKUP_USER(r5, 0xd000943e, &(0x7f00000022c0)={0x0, 0x0, "bc0628022bfe92ef3361462576e967abb05a27cc619a037d299840588330d3f3e3eff299686fb308bb75af58d092f6020225689c0b86d81ddc840fa64a5af256bd8f9e0a7b5680647fa30df4a435d9f88966e972d273185d8630f64cec8db6f25cc8070238772beeb8538c010265b60d36ffb8ababfc7c4a1a842f0a3eb30a74872bd565e707ce224cadda47dfbf6e589a05cc6a5feb81615a315214087f8afd30c69fdd8dbb474a5d1b896be1749a93df3565820261225d228530b8331718fa24856a75cda105ca8d630e5e49ca1ba2d571387e21a3da2af57b42f01da28b11332a5c2ec22eb67e221c8b4e5e6419d32b39aa8b50c89a5e0df36cc2ae24f836", "0ab6bb48317c7dce2fcbe2bd1208cfbe96b6869484c9d6a022ff316b593ea37591daa3be215ddbd8337335988114656630e532e2f50ed9a0ec0299984462ee997e74be0d320c9d36bf6e059f4fec3bde9f24a30eff1d012fd8a2a8f621acd86e1188d4db07915af2def3400f7e6ba026d02f8dbcfe53b798123e8a327c477be4c236eb42a5513ea9a2544f33ed06a787ad1bdc89c564861763e597e39ac58e5130ecb4b004cc37ce82a44b7d16dbb45d2b99af672a0621df4204b30881b55d0cfedf7249a235887cd1af0f973cbc9e008731c2f07705f9ac62714f41fad1ba190605918fc1a3334a83428b39c9ff3ab8daeb6c63d8fd933515bb4bc175aa57fbfa527d428c6a9e044ed0ec8f38d2741bd32c568bfe682547ec1e58d6df0ff6ba8677b1dfe01b8b4e4df11e2ffa0898e07ae0c0d4456c9ca3c0139e890076800882db2d08974404a6b21f0d571f5f18aace506647a52568d18e85c7e75c55153d0a9eb69241606427a6c20a54a77cd4a4d0ab8b5205a0d1b3760ec633f26e5d3a8e40e2967873031068a5358d35a2b018ef480f081e2961e5f4fc46a5f17ca5b103049c400869727abc99be8f6d00ae0123a304113734c383bb105b3ddadee3b795a2c59d1f7d9322e2a7bac03f806e09b7fb5bbd63276492ba84ba831e679204e88fffe43d24e0408c21e0a7dc009e2479f187f3e9f2f6485303cc896a8f9e17469533b6c1f486fe168955dea1aa10dafd5c75da64129b563866e8e6b3be3deae87432201862768390b63afbac514774dc2952dcd45c5d7c6bef7c2f632465c6a2a9963ef762f7eb01252c72b43a210c594b768b168bb0c654d61843ad7e4323608a9998c422f3979c7143daf02b13abf491333b5c18018627d72e63924bf1657f7369adb0e0790527aba6484858d48e1fc122d7a45114f012023d7aef243c2e8dae564215bc602153fa9c96922d5b44d5a6129b5d0a994b1d6490e03c466fc089f87f0ba29226a177fc1fdaa97b04b4e6235fc4f1d716a6616cd93708bb643040a23d010fa2d106e609b8a889c5ef4020c418c549c33c442624057a6c6b51ce102da28bc020c179ed9e81e2641fedcab1f5fc5dbde2d3c803c992d793feb60eb970a51810ed8e6c0647fd24a352bfc41bab64a926120ed9f4dff835cc666b4d796eb8138008a7e0bef629452f9ddd3fb20f0c6f3c8a970ca74ce6a11c0c351c5ed68e03f5b58fff974165511622991650b6159700e969e0b6f54722e9e6e69923a6701456e8664e774507296c2a2b6b463f47af194d833918c535a7bec960566a4cc9ba1ca8f8c60f20595dd908ce0b7ef4f5fb677e8deea61be1f8eba76a65e38c3854fcc2323f0e27b8385c11ea3f6b144b84ac74459db03e30124806b592f4c9b9d737f5e77f4b96fa0fdab8d4547950ab5c2a7187c5032dafa9252e77f244bc04212fbb3df8dde5b4737b1b6c7572153edac083a47c8948dc5bc048d6826c77931bdb5004b570bd8ad15702086e09142d093f758048f0c1ca1b8c3657a7541b8fa2ce07529bfbd487d5356b8be43f0061a2067750fae38a8093d5cdb523d5e5c6ce63c389ae96fc2b884c2ce63278d4b1f315910bc7667f281910530c828b82d72ef9766cfa97f1f0f374305ac3c375834470b364d23ef4756a4ed2f1ce14dc7d3f121139855f4538eae1e0d5b9a1e0d8e045cd6f4d9d286406dc1d2b2e95188cba1e5b162a5feaf5d123ff535ff617c7946dfe4959163c8b4b834d7769b2d5c1fb6425796c485786786a1c95d55317a15d284ce5f9818911e93317e76102cf92c1188b92dbbf9fc342d781734d995658622cc8075b5d6ec5f1b9eadbf66df121e06ce7251b79a92285d6c5fcbda6cc3b85f3f2f666224af5938dbc33481147153cab117c6752a96a54e17b76776c6de0d9650a4b79bf014ff34087399c11e18c21c2c7f03d98646de4b3c2986619d24383b0378b8c7728d3be86023b9fa21eecc1e0a3fd120e63a4cb6bcf18282ef02bfe40084f61da8f26bd5adf7ed3317b88044c189322c9673aa4082b11a3dd214bbac9aa1ee0d246e654f616fc34902fe3ce95d4cc068e037a7a2875347be5aaaf8ca4883bcc1fa70ddeb70a987605672b1d7cd34cc19e1e65f775afb9bda8fa85db48e85f91327eff4542cb73ff221dd1bd062113f51adbe6ebf201226655f8cbf93fa67939f6a198afe941e757d9d1aa55245e07158216a62102a429470ab876cd54b184d65aa9bb6b8c8c58f0875fa3737ada7242fc1c59d04c6110ac98bda340ae33d67f9402539083596eba34708f0f95a303295e7474ca0fadfcabb150bb4ca567447a8674bf2e2c894504deacee1fd4b5edfc4a02fa2bc18f7145b3d0272c3660eceed4d97e3001c3766d43bd92f90593a34a3661655c28e6c3bdd4931e8f7b9d1277ac49fb0f72bd4ee788a4efaf7d5358b4ddfdce3280dd4975094123f95fa09c3386b61c8ace35f8c0fdbdd8a9031182d2be109b810f12cd5bec88ab9cd0e1a68bb51488b3ca677dce99263998ec816dbfd76a68e025178514e0fafd178a766eb01d7ee2c3091d30b77ee1b2e95456d0d923ec73bbae3da1de6ea06617536eb71e510d612a6f790ddc1dccb4dbf3ce1ecd2de02226872161ac0728bccbc05fd4f3cb0e068ce733c2137c2b7ebccb400e961f58442a11f7a607108cd3bbd89cfe619723652eb4eba36a9dd2302834cb83bd23a9f996f32847ebd01a31e112cb1b1046409587e8f4d7838cc90dd23db2c73f973e2e60ab783ae3da2397f704510c634c8555a6e36282d59f61b5e1566bdbabdc1a2eaed20a2467b9cc27a0e709dfd0ddb1bb5535bc7cec93f502039d5cb3aa962a828859e75d26b029bb18b252725c62e4cdf5608de6fed7748cf8b464036ff2efb891dfdb0a5befe5e003420b623f05bdbe5ff7224c1544c4c992eb577dfcb398f90a383d9916612e6d57719022f08031cb2bc647b4a64599bde3eba02f563cb705d7d92836b6d6a3a8fcc35260504b2c2664f1fa2183c9d8e6c3ecd354eecfb2f9f98e0a99170b4824be62457a0537b7082e6cf84e7fd8bbe2f819dfb180773e4568d3de32ae2214a085d9b8a1dd66de1486224b19ce4b748dacbb840d182d9f10e1e8f9a17040300abb0614315c42eacfb2b919326f5469332c9b087a6bd8c0506453df0e34255bad5a489be561209c485b38180f0314a7ebfb55d4052ad2d8dd7de4a70130bcbb223964894b8884145b844bd054a0e44323c1ac569da9bdc740f5db244bba92f6040896c7dcb0b9eeff2a4e2ec393ffdf945d569bbf3f3cd4f03f3c4197555667bd2833878a03b3d022c74031fe97d33ad87068f463e1001bb2da3d93a3a02ef1368ec4922be46ac56bcf3e57f6d0dd103b957e301137bbb40d4b7c760f027ec7ef70395b84726cb1750216bec117f9be317914331e9ef1aa73b66b0dd7bd203fd23566d1fe038ed968b4e1e0ba507ad7ef9353f786cfbe89049ca783f720f607404e0b8f78d926342cf815ab0c1e9bbfecd6fc14aa51b58615e0a95f2042fc27250bc89969128e3def044ff749ab075683e225cb58090b19323b847f04e01d4688fdc771e54b6a685fc571bc2a8efac98d5feb2cc9e3c7b27507fc86b32fc47b3b2812b8bae92f136e24575efaeb1c47d75b737172b8cae89cd23573967c5f27807b67366b9df0f82925fcb92d2b4b596b5a85e732202e35587cae9d58aec08f538ac3db50c5c5cd11136823927a15bbeaeaf3c8021ed423564aab48b2e6b5be147ea0e06f17f47a13056ec88c54c64759dbc8b658380a66bcae40b0d423466715a30a37239fcfbcd639fe1fb31c56de23bed695283bba93b142dd189791f323d3b2e6b448d1fbe4edf697c907c1f9ddcb2d22607e478c202dba02aec31866c07d4f1b761ae208bdb581d9f8dff9fdde203feb7a1ae150d4a6c2e382a56cc0a7dc5d9ac7a8bfe71f9f55879d4d4f54abf24482d48a12eb7a4a48bf122d6bbf048494741d890bcd96642e202ef50799f8a8d6308c2392aa7f77c10465932047c9a21ff659d392541243d4ea4476aa234b22d5506c603e75cd750ecdfde9e9e66d92cfe4d06fb73589baa44c033e3cf1e450ffe061840e8d06c3ed38b4de247019c380b2cf78bb0cd44ea5786edcb1c6491c6a195f1facebe5b94f46051ee3bc84708d6353ba0b092d2dfce03e47a85d1ed77d976d1823bb829713cda1bfe20e8c6ce850017a92012663ef99d4e975a22fb852e3f8eb038509306a6da6cb8688e84e0488a6d3eaf801234478c4c6bcd7983a92823a150c8d7c74208eb0b50039d0148610ea7da8bbb98988a39dd22044af3a305520966648ecbb47d97fbd445794f9fed3faadb04617735ff4cc30c92aacda80a81e6e3e92e3770e8e4171f22fbe04716f9a9fb2d09a84c6b84e119a76cbacc8eb4f63deac874ec754ef2493f1ac49e94735b7caa6d593e6cbf78ce3b274cd7efcadb33669ab90b72a003202b82c0c62b79a4bb321fb2b1b4c32a0fa6c487437f2248742a3a9a683180eea3cd846c583a084fd10a4150bb6087331693c27def5749673e84161a9dc9938ed0837b0a89b58e832def0cc96ff375f1bd49ef9775fb052204fb657700e384bbb9e33b6ad5832520fe07d980e9e33f9fb91cde2c416bbe0dfdd51b5b064f44de80c23ec3b44c9a5dae5c963b5724041cd0cde5d8eea1c3825383b6cfc67a03b2fc643176221e49ef2924b36e35210e041b62122c11b5f51423ad173d1760db7e49789a8fbf6f7c30177fc476450066e3b6fd04ffdefeb897cf087765d67485ebad1415329478f940e4afe4cdcd665a13e783ee3f0cbbed147a245f01e52f9f8624be83708419b85b981ccced9b1e52007cbfb61023defdb2cf63298bd2f80df52e7c40e676a91c5b7dc55e77e91c78fb90e87fb1c15ef00c372dd1924d8b3f25c17d7cff7c3c6e44da972fb05f6e0d775dfec87b089fdddf6c0e5b4baceb315838cee6179292e290d2c2304fce97c14fd81e84f20c6b752fffbc537e854a451dcb7153d70286975ebe80b7eb191a23bf5462bfb6ad3b2e2c89568607682140024dc994a45deec96cb275e9e5c953b8ab0d1f5fb6a4519d0a1779b7ba150f9db66c99f6f2749c2323c3a3bf5b84a3bd474bb2fc43a7d300dcf8ef37167f201bc6e753fe5d50dda693137a910fe01051b7efe817c837e6826fb5737b994b55522e6950c38e2c3c66c828ebab850121f2ac18df7c2b8b1600ac34b6543dd68f35712378affd272d78e8efd90b75f767d9279c9b370d753b9f4a36464a4aed280eb23aabad1e5634aa7ca69487100efd040d60f8ca44df3717a1ab75403b230f612da2d0cf9ea6724489018bb10cf06015310efd462996b4eb66bb1d6ca8715f86750d6"}) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r0, 0xc0709411, &(0x7f00000032c0)={{r6, 0x7, 0x2b7, 0x4cf3, 0x763c, 0x9, 0x4, 0x0, 0xe, 0x3, 0x2, 0x4, 0x5, 0x80, 0x9}, 0x10, [0x0, 0x0]}) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="010000f58bbbad299ec9aa00080000004100000095400f967c39a8d6d1b51fadacef16383f1dcbe012c52a97d6c954fa87763ef3e6dbd3978af8ba2612b76eb45b96f2daa33fdbd9ba81f292f21a690e41231ee0b13ff31bb167ad2182763e4bca7341051e2b3deac8064d60ec7316d7b38759efc1b2afc8bb455c967d4f001927b87fb9828ccbad04c147b44e0727150268ef34d3c2e7a65381c878445dc92c5445d265ff45863d88cdc63a45e4098b3f4629072425734a1180e291205cd8b5f481f7423969899eb7242b6cf34b638154c5836adc9d2f9042fe8bdd83968cbc21abe2bcc3c3b998d293e7227dd6985c70e77fd866f6a0f7db7f24c27a7b1cbbf44e713b", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) openat$drirender128(0xffffffffffffff9c, 0x0, 0x400000, 0x0) clock_adjtime(0x0, &(0x7f0000000340)={0x37db, 0x82000000002f4246, 0xfffffffffffffffc, 0x6, 0x8, 0x5, 0x80, 0x4, 0x4, 0x80000, 0x2, 0x1, 0x100, 0x0, 0x8001, 0x2000000000000, 0x9, 0x5, 0x800000009, 0x4000000000200, 0x0, 0x2, 0x0, 0x10000000000f48, 0x8, 0x25}) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000040), &(0x7f00000004c0), 0xce, r7}, 0x38) 0s ago: executing program 9 (id=3983): r0 = socket$inet(0x2, 0x1, 0x0) r1 = socket$inet(0x2, 0x1, 0x6) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./proc\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./proc\x00', &(0x7f00000000c0)='proc\x00', 0x0, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./proc/mtrr\x00', 0x2, 0x0) sendmsg$NLBL_CALIPSO_C_REMOVE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x45805554f149619d}, 0xc, &(0x7f00000004c0)={&(0x7f0000000540)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010327bd70920c735874c8e358ea4ee3732a6375ab00fddbdf250200000008000200020000000800020002000000080002000200000008000100020000000800010000000000"], 0x3c}}, 0x48055) shutdown(r0, 0x0) ioctl(r2, 0x40104d00, &(0x7f0000000a00)="0000020006000000000002") mknod(&(0x7f0000000040)='./file0\x00', 0x40, 0x74f1) setns(r2, 0x8000000) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r3, &(0x7f0000000340)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300)={0xffffffffffffffff}, 0x2}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r3, &(0x7f0000000cc0)={0x18, 0x110, 0xfa00, {r4, 0x7fffffff, 0x12, 0x0, 0x0, @in={0x2, 0x4e21, @broadcast}, @in={0x2, 0x4e20, @loopback}}}, 0x118) write$RDMA_USER_CM_CMD_MIGRATE_ID(r3, &(0x7f0000000040)={0x12, 0x10, 0xfa00, {0x0, r4, r3}}, 0x18) socket$inet6_icmp(0xa, 0x2, 0x3a) r5 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r5, 0xc25c4110, &(0x7f00000005c0)={0x0, [[0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000], [0x3, 0x1ff, 0x0, 0x0, 0x0, 0x5], [0x403, 0x0, 0x0, 0x0, 0x0, 0x2]], '\x00', [{0x7, 0x0, 0x0, 0x1}, {}, {}, {}, {0x4}, {}, {0x3ff}, {0x1}, {0x0, 0x6}, {0x0, 0x7}, {0xffffffff, 0xffffffff}, {0xffffffff}], '\x00', 0x100}) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) r7 = fanotify_init(0x200, 0x0) read$FUSE(r2, &(0x7f0000000e00)={0x2020}, 0x2020) r8 = socket$inet6(0xa, 0x1, 0xaf64) bind$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) r9 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r9, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r9, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) fanotify_mark(r7, 0x21a, 0x40000032, r6, 0x0) r10 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl(r10, 0x89e0, &(0x7f00000000c0)='lapb0') setxattr$trusted_overlay_origin(&(0x7f0000000300)='./proc/mtrr\x00', &(0x7f0000000340), &(0x7f0000000380), 0x2, 0x0) connect(r1, &(0x7f0000000200)=@in={0x2, 0x15, @loopback}, 0x10) kernel console output (not intermixed with test programs): op7, logical block 0, async page read [ 942.427873][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 942.431119][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 942.531437][T20259] syzkaller0: entered promiscuous mode [ 942.533238][T20259] syzkaller0: entered allmulticast mode [ 942.608652][T20261] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 943.077354][ T8881] usb 13-1: new high-speed USB device number 11 using dummy_hcd [ 943.227318][ T8881] usb 13-1: Using ep0 maxpacket: 32 [ 943.231205][ T8881] usb 13-1: config index 0 descriptor too short (expected 29220, got 36) [ 943.233904][ T8881] usb 13-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 943.236780][ T8881] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 943.239693][ T8881] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 943.242516][ T8881] usb 13-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 943.245306][ T8881] usb 13-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 943.249918][ T8881] usb 13-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 943.253118][ T8881] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 943.258433][ T8881] usb 13-1: config 0 descriptor?? [ 943.611877][T20274] pim6reg: entered allmulticast mode [ 943.728655][T20271] pim6reg: left allmulticast mode [ 943.836658][T20271] loop7: detected capacity change from 0 to 7 [ 943.843280][ C2] blk_print_req_error: 2 callbacks suppressed [ 943.843317][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 943.848467][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.851396][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 943.854376][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.857341][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 943.862503][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.865769][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 943.870691][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.873728][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 943.876704][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 943.879778][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 943.978055][T20280] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3460'. [ 943.981467][T20280] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3460'. [ 944.007815][ T8881] usblp 13-1:0.0: usblp0: USB Bidirectional printer dev 11 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 944.238261][T20285] binder: 20284:20285 ioctl c00c6211 0 returned -14 [ 944.284844][ T24] usb 13-1: USB disconnect, device number 11 [ 944.310055][ T24] usblp0: removed [ 944.808964][T20292] netlink: 'syz.8.3463': attribute type 1 has an invalid length. [ 944.812348][T20292] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3463'. [ 945.201543][T20295] binder: 20294:20295 ioctl c00c6211 0 returned -14 [ 945.753913][T20298] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 945.943226][T20303] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 946.117421][ T1033] usb 12-1: new high-speed USB device number 12 using dummy_hcd [ 946.236789][ T42] kauditd_printk_skb: 6650 callbacks suppressed [ 946.236808][ T42] audit: type=1326 audit(2000000620.594:9402): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20310 comm="syz.5.3469" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 946.278740][ T1033] usb 12-1: Using ep0 maxpacket: 8 [ 946.286446][ T1033] usb 12-1: config index 0 descriptor too short (expected 301, got 45) [ 946.289915][ T1033] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 946.294258][ T1033] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 946.298100][ T1033] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 946.301782][ T1033] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 946.306586][ T1033] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 946.310035][ T1033] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 946.538038][ T1033] usb 12-1: usb_control_msg returned -32 [ 946.540016][ T1033] usbtmc 12-1:16.0: can't read capabilities [ 947.359384][T20319] usbtmc 12-1:16.0: usb_control_msg returned -32 [ 947.577047][ T1350] usb 12-1: USB disconnect, device number 12 [ 947.684935][T20324] jffs2: notice: (20324) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 947.740242][T20324] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3471'. [ 948.229325][T20334] binder: 20333:20334 ioctl c00c6211 0 returned -14 [ 948.234360][T20336] No source specified [ 948.451188][T20336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3475'. [ 948.454497][T20336] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3475'. [ 948.722473][T20341] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3476'. [ 948.930300][T20345] syzkaller0: entered promiscuous mode [ 948.932240][T20345] syzkaller0: entered allmulticast mode [ 948.943288][T20347] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 949.053370][T20351] jffs2: notice: (20351) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 949.086219][T20351] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3479'. [ 949.092341][T20351] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3479'. [ 949.284028][T20362] netlink: 'syz.2.3480': attribute type 1 has an invalid length. [ 949.289337][T20362] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3480'. [ 949.707960][ T42] audit: type=1326 audit(2000000624.074:9403): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20367 comm="syz.8.3484" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 949.929729][ T1350] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 950.181492][ T1350] usb 10-1: Using ep0 maxpacket: 8 [ 950.308864][ T1350] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 950.324105][ T1350] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 950.341766][ T1350] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 950.346286][ T1350] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 950.354507][ T1350] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 950.363065][ T1350] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 950.368893][ T1350] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 950.515448][T20379] netlink: 'syz.2.3485': attribute type 1 has an invalid length. [ 950.525271][T20379] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3485'. [ 950.716316][ T1350] usb 10-1: usb_control_msg returned -32 [ 950.720114][ T1350] usbtmc 10-1:16.0: can't read capabilities [ 951.503325][T20383] usbtmc 10-1:16.0: usb_control_msg returned -32 [ 951.705697][ T24] usb 10-1: USB disconnect, device number 21 [ 951.872450][T20393] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3496'. [ 951.879117][T20393] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3496'. [ 952.839978][T20402] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(7) [ 952.842405][T20402] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 952.875758][T20402] vhci_hcd vhci_hcd.0: Device attached [ 952.913320][T20412] syzkaller0: entered promiscuous mode [ 952.917293][T20412] syzkaller0: entered allmulticast mode [ 952.978562][T20409] vhci_hcd: connection closed [ 952.978838][ T13] vhci_hcd vhci_hcd.8: stop threads [ 952.982646][ T13] vhci_hcd vhci_hcd.8: release socket [ 952.984448][ T13] vhci_hcd vhci_hcd.8: disconnect device [ 953.063042][T20414] binder: 20413:20414 ioctl c00c6211 0 returned -14 [ 953.489466][T20418] pim6reg: entered allmulticast mode [ 953.622409][T20397] pim6reg: left allmulticast mode [ 953.710409][T20397] loop7: detected capacity change from 0 to 7 [ 953.743224][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 953.749651][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 953.752732][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 953.773784][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 953.777121][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 953.782698][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 953.785794][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 953.794415][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 953.797562][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 953.805997][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 953.809163][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 954.085608][T20420] binder: 20419:20420 ioctl c00c6211 0 returned -14 [ 955.728614][ T42] audit: type=1326 audit(2000000630.094:9404): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20430 comm="syz.5.3497" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 956.359573][T20442] binder: 20441:20442 ioctl c00c6211 0 returned -14 [ 958.917163][T20433] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3498'. [ 958.922401][T20433] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3498'. [ 959.337352][ T1033] usb 13-1: new high-speed USB device number 12 using dummy_hcd [ 959.487399][ T1033] usb 13-1: Using ep0 maxpacket: 8 [ 959.491225][ T1033] usb 13-1: config index 0 descriptor too short (expected 301, got 45) [ 959.493994][ T1033] usb 13-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 959.500946][ T1033] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 959.512957][ T1033] usb 13-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 959.513811][T20458] jffs2: notice: (20458) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 959.521867][ T1033] usb 13-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 959.521900][ T1033] usb 13-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 959.521913][ T1033] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 959.562254][T20458] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3505'. [ 959.565367][T20458] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3505'. [ 959.721527][T20461] gretap1: entered promiscuous mode [ 959.749416][ T1033] usb 13-1: usb_control_msg returned -32 [ 959.751325][ T1033] usbtmc 13-1:16.0: can't read capabilities [ 959.956694][ T42] audit: type=1326 audit(2000000634.314:9405): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 959.981253][ T42] audit: type=1326 audit(2000000634.314:9406): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 959.998901][ T42] audit: type=1326 audit(2000000634.334:9407): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=329 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.012562][ T42] audit: type=1326 audit(2000000634.334:9408): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.026354][ T42] audit: type=1326 audit(2000000634.334:9409): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.033767][ T42] audit: type=1326 audit(2000000634.334:9410): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.046968][T20467] netlink: 236 bytes leftover after parsing attributes in process `syz.7.3507'. [ 960.051361][ T42] audit: type=1326 audit(2000000634.334:9411): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.061368][ T42] audit: type=1326 audit(2000000634.334:9412): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.068438][ T42] audit: type=1326 audit(2000000634.334:9413): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=255 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.497300][T19760] usb 12-1: new high-speed USB device number 13 using dummy_hcd [ 960.518890][T20471] usbtmc 13-1:16.0: usb_control_msg returned -32 [ 960.649910][T19760] usb 12-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 960.657341][T19760] usb 12-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 960.666188][T19760] usb 12-1: New USB device found, idVendor=1164, idProduct=0622, bcdDevice= 0.00 [ 960.675181][T19760] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 960.698943][T19760] pvrusb2: Hardware description: Gotview USB 2.0 DVD 2 [ 960.725536][ T1033] usb 13-1: USB disconnect, device number 12 [ 960.738341][ T42] kauditd_printk_skb: 2828 callbacks suppressed [ 960.738355][ T42] audit: type=1326 audit(2000000635.104:12242): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.759782][ T42] audit: type=1326 audit(2000000635.104:12243): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf70bf017 code=0x7ffc0000 [ 960.772753][ T42] audit: type=1326 audit(2000000635.104:12244): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.781199][ T42] audit: type=1326 audit(2000000635.104:12245): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf70bf017 code=0x7ffc0000 [ 960.789942][ T42] audit: type=1326 audit(2000000635.104:12246): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.797150][ T42] audit: type=1326 audit(2000000635.104:12247): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf70bf017 code=0x7ffc0000 [ 960.804270][ T42] audit: type=1326 audit(2000000635.104:12248): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.812635][ T42] audit: type=1326 audit(2000000635.104:12249): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf70bf017 code=0x7ffc0000 [ 960.821976][ T42] audit: type=1326 audit(2000000635.104:12250): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=20 compat=1 ip=0xf70befec code=0x7ffc0000 [ 960.829057][ T42] audit: type=1326 audit(2000000635.104:12251): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20463 comm="syz.7.3507" exe="/syz-executor" sig=0 arch=40000003 syscall=173 compat=1 ip=0xf70bf017 code=0x7ffc0000 [ 961.454112][T20481] binder: 20480:20481 ioctl c00c6211 0 returned -14 [ 961.487160][T20483] pim6reg: entered allmulticast mode [ 961.505165][T20482] pim6reg: left allmulticast mode [ 961.577069][T20483] loop7: detected capacity change from 0 to 7 [ 961.672780][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 961.676669][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 961.679710][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 961.691590][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 961.694665][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 961.714242][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 961.717845][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 961.749795][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 961.753352][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 961.787743][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 961.791216][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 962.426337][T20490] binder: 20489:20490 ioctl c00c6211 0 returned -14 [ 963.027524][ T2512] pvrusb2: Failed to submit write-control URB status=-2 [ 963.042071][ T2512] pvrusb2: Device being rendered inoperable [ 963.048279][ T2512] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 963.057391][ T2512] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 963.550970][T20505] fuse: Unknown parameter 'rooÿmode' [ 963.722670][T19760] usb 12-1: USB disconnect, device number 13 [ 966.190149][T20525] binder: 20524:20525 ioctl c00c6211 0 returned -14 [ 967.798753][T20520] pim6reg: entered allmulticast mode [ 967.821841][T20520] pim6reg: left allmulticast mode [ 967.973992][T20536] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 967.992359][T20520] loop7: detected capacity change from 0 to 7 [ 968.011272][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 968.016928][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 968.021163][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 968.026811][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 968.031057][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 968.035094][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 968.039087][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 968.043112][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 968.047063][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 968.057242][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 968.061230][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 968.495328][T20546] pim6reg: entered allmulticast mode [ 968.534344][T20544] pim6reg: left allmulticast mode [ 968.573608][ T42] kauditd_printk_skb: 5389 callbacks suppressed [ 968.573621][ T42] audit: type=1804 audit(2000000642.934:17641): pid=20550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.3528" name="/newroot/351/file0/file0" dev="9p" ino=78395415 res=1 errno=0 [ 968.599125][ T42] audit: type=1804 audit(2000000642.964:17642): pid=20550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.3528" name="/newroot/351/file0/file0" dev="9p" ino=78395415 res=1 errno=0 [ 968.615125][ T42] audit: type=1804 audit(2000000642.974:17643): pid=20550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.3528" name="/newroot/351/file0/bus" dev="9p" ino=78395401 res=1 errno=0 [ 968.635708][ T42] audit: type=1804 audit(2000000642.994:17644): pid=20550 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.3528" name="/newroot/351/file0/file0" dev="9p" ino=78395415 res=1 errno=0 [ 968.662542][T20552] netlink: 'syz.5.3527': attribute type 1 has an invalid length. [ 968.669376][T20552] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3527'. [ 969.127007][T20560] netlink: 'syz.8.3529': attribute type 1 has an invalid length. [ 969.135657][T20560] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3529'. [ 970.353306][T20574] netlink: 32 bytes leftover after parsing attributes in process `syz.7.3540'. [ 970.394287][ T42] audit: type=1326 audit(2000000644.754:17645): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20575 comm="syz.5.3533" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 970.813882][T20581] fuse: Unknown parameter 'rooÿmode' [ 971.215066][T20588] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3537'. [ 971.218424][T20588] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3537'. [ 971.276814][T20592] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 971.490959][T20598] netlink: 'syz.2.3539': attribute type 1 has an invalid length. [ 971.494222][T20598] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3539'. [ 972.432381][T20610] netlink: 'syz.5.3543': attribute type 1 has an invalid length. [ 972.438906][T20610] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3543'. [ 972.638917][T20612] netlink: 'syz.7.3542': attribute type 1 has an invalid length. [ 972.641563][T20612] netlink: 756 bytes leftover after parsing attributes in process `syz.7.3542'. [ 973.198820][T20615] netlink: 'syz.2.3544': attribute type 1 has an invalid length. [ 973.207315][T20615] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3544'. [ 973.543918][T20621] binder: 20620:20621 ioctl c00c6211 0 returned -14 [ 973.632025][T20623] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3545'. [ 973.735260][T20625] binder: 20624:20625 ioctl c00c6211 0 returned -14 [ 974.930977][T20633] __nla_validate_parse: 1 callbacks suppressed [ 974.930991][T20633] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3548'. [ 974.936340][T20633] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3548'. [ 974.966167][T20634] netlink: 'syz.5.3549': attribute type 1 has an invalid length. [ 974.980687][T20634] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3549'. [ 975.640608][T20638] binder: 20637:20638 ioctl c00c6211 0 returned -14 [ 975.770723][T20645] fuse: Unknown parameter 'rooÿmode' [ 978.120311][T20656] pim6reg: entered allmulticast mode [ 978.317591][T20642] pim6reg: left allmulticast mode [ 978.413468][T20647] loop7: detected capacity change from 0 to 7 [ 978.420684][T20663] netlink: 'syz.5.3563': attribute type 1 has an invalid length. [ 978.427973][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 978.431179][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 978.434107][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 978.434408][T20663] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3563'. [ 978.449638][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 978.453055][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 978.460006][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 978.463395][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 978.466840][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 978.469981][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 978.477263][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 978.480368][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 978.761055][T20664] netlink: 'syz.2.3554': attribute type 1 has an invalid length. [ 978.767473][T20664] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3554'. [ 979.373278][T20670] netlink: 'syz.8.3555': attribute type 1 has an invalid length. [ 979.379980][T20670] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3555'. [ 980.047889][T20679] pim6reg: entered allmulticast mode [ 980.145253][T20676] pim6reg: left allmulticast mode [ 980.259577][T20676] loop7: detected capacity change from 0 to 7 [ 980.307944][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 980.308740][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 980.308803][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 980.316136][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 980.316190][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 980.327030][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 980.335443][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 980.352355][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 980.365146][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 980.956341][T20681] binder: 20680:20681 ioctl c00c6211 0 returned -14 [ 981.883091][T20692] binder: 20691:20692 ioctl c00c6211 0 returned -14 [ 983.752151][T20687] pim6reg: entered allmulticast mode [ 983.788434][T20687] pim6reg: left allmulticast mode [ 983.999521][T20705] netlink: 32 bytes leftover after parsing attributes in process `syz.5.3565'. [ 984.183865][T20708] netlink: 'syz.8.3566': attribute type 1 has an invalid length. [ 984.225341][T20687] loop7: detected capacity change from 0 to 7 [ 984.235156][T20708] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3566'. [ 984.236234][ C0] blk_print_req_error: 2 callbacks suppressed [ 984.236251][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 984.247231][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 984.250260][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 984.253139][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 984.256159][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 984.261488][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 984.264676][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 984.274707][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 984.278812][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 984.285983][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 984.291083][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 985.217990][T20716] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 985.705775][T20726] MTD: Couldn't look up './dev/mtdblock0': -2 [ 985.718629][T20727] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3571'. [ 985.721979][T20727] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3571'. [ 986.118154][ T42] audit: type=1326 audit(2000000660.484:17646): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20729 comm="syz.7.3573" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 986.301303][T20735] netlink: 'syz.8.3574': attribute type 1 has an invalid length. [ 986.303883][T20735] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3574'. [ 986.570753][T20742] binder: 20741:20742 ioctl c00c6211 0 returned -14 [ 986.632796][T20744] jffs2: notice: (20744) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 986.696347][T20744] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3576'. [ 986.714842][T20744] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3576'. [ 986.989348][T20749] binder: 20748:20749 ioctl c00c6211 0 returned -14 [ 987.877240][ T42] audit: type=1326 audit(2000000662.234:17647): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20753 comm="syz.8.3578" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 989.388318][T20764] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 990.306082][T20770] pim6reg: entered allmulticast mode [ 990.355387][T20769] pim6reg: left allmulticast mode [ 990.383595][T20772] binder: 20771:20772 ioctl c00c6211 0 returned -14 [ 990.414461][T20774] binder: 20773:20774 ioctl c00c6211 0 returned -14 [ 990.458305][T20770] loop7: detected capacity change from 0 to 7 [ 990.922020][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 991.117408][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 991.120498][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 991.226188][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 991.229367][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 991.867613][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 991.870757][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 991.883188][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 991.886951][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 991.941413][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 991.945250][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 992.561484][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 992.564081][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 993.061643][T20787] pim6reg: entered allmulticast mode [ 993.164669][T20786] pim6reg: left allmulticast mode [ 993.245619][T20786] loop7: detected capacity change from 0 to 7 [ 993.276274][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 993.280612][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 993.283678][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 993.294572][T20793] MTD: Couldn't look up './dev/mtdblock0': -2 [ 993.296034][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 993.299747][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 993.304803][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 993.307954][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 993.314245][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 993.319290][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 993.606635][T20795] pim6reg: entered allmulticast mode [ 993.690733][T20794] pim6reg: left allmulticast mode [ 993.749395][T20795] 9pnet_virtio: no channels available for device syz [ 993.767373][T20795] loop7: detected capacity change from 0 to 7 [ 994.362911][T20805] binder: 20804:20805 ioctl c00c6211 0 returned -14 [ 994.423489][T20803] netlink: 768 bytes leftover after parsing attributes in process `syz.2.3589'. [ 994.477406][T20807] binder: 20806:20807 ioctl c00c6211 0 returned -14 [ 996.075298][T20817] binder: 20816:20817 ioctl c00c6211 0 returned -14 [ 996.373083][T20822] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3594'. [ 996.378308][T20822] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3594'. [ 997.096735][T20824] fuse: Unknown parameter 'rooÿmode' [ 997.331795][T20833] binder: 20829:20833 ioctl c00c6211 0 returned -14 [ 997.365011][T20832] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3597'. [ 997.367975][T20832] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3597'. [ 997.784395][T20840] pim6reg: entered allmulticast mode [ 997.800300][T20840] pim6reg: left allmulticast mode [ 997.946192][T20838] loop7: detected capacity change from 0 to 7 [ 998.216499][ C0] blk_print_req_error: 8 callbacks suppressed [ 998.216514][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 998.255125][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 998.258251][ C0] buffer_io_error: 5 callbacks suppressed [ 998.258263][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 998.278815][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 998.281871][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 998.300307][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 998.303365][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 998.314890][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 998.318039][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 998.336642][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 998.339858][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 999.159880][T20855] netlink: 'syz.2.3601': attribute type 1 has an invalid length. [ 999.237820][T20855] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3601'. [ 999.432926][T20848] netlink: 756 bytes leftover after parsing attributes in process `syz.7.3599'. [ 1000.691403][T20858] pim6reg: entered allmulticast mode [ 1000.753631][T20856] pim6reg: left allmulticast mode [ 1000.887161][T20858] loop7: detected capacity change from 0 to 7 [ 1000.898267][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1000.902659][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1000.906001][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 1000.970975][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1000.975863][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 1001.009961][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1001.013152][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1001.054504][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1001.064922][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1001.605169][ T42] audit: type=1326 audit(2000000675.964:17648): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20864 comm="syz.5.3602" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 1001.702378][T20868] pim6reg: entered allmulticast mode [ 1001.843028][T20863] pim6reg: left allmulticast mode [ 1001.931795][T20868] loop7: detected capacity change from 0 to 7 [ 1002.664499][T20877] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3605'. [ 1002.667775][T20877] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3605'. [ 1003.127391][T14730] usb 7-1: new high-speed USB device number 22 using dummy_hcd [ 1003.280679][T14730] usb 7-1: config index 0 descriptor too short (expected 39, got 27) [ 1003.284261][T14730] usb 7-1: config 0 interface 0 altsetting 251 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1003.288616][T14730] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1003.294235][T14730] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 1003.302841][T14730] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 1003.313461][T14730] usb 7-1: Product: syz [ 1003.316316][T14730] usb 7-1: Manufacturer: syz [ 1003.327603][T14730] usb 7-1: SerialNumber: syz [ 1003.340174][T14730] usb 7-1: config 0 descriptor?? [ 1003.348426][T14730] hub 7-1:0.0: bad descriptor, ignoring hub [ 1003.350512][T14730] hub 7-1:0.0: probe with driver hub failed with error -5 [ 1003.354436][T14730] usb 7-1: selecting invalid altsetting 0 [ 1003.524347][T20891] jffs2: notice: (20891) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1003.540744][T20891] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3611'. [ 1003.544157][T20891] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3611'. [ 1003.678188][ T1033] usb 7-1: USB disconnect, device number 22 [ 1003.756375][T20896] netlink: 'syz.5.3612': attribute type 1 has an invalid length. [ 1003.766063][T20896] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3612'. [ 1004.168384][T20899] binder: 20898:20899 ioctl c00c6211 0 returned -14 [ 1004.489467][T20903] pim6reg: entered allmulticast mode [ 1004.636429][T20884] pim6reg: left allmulticast mode [ 1004.740511][T20886] loop7: detected capacity change from 0 to 7 [ 1004.800437][ C0] blk_print_req_error: 2 callbacks suppressed [ 1004.800461][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1004.806994][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1004.810127][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1004.819574][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1004.823257][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1004.828591][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1004.832362][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1004.837413][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1004.841054][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1004.846926][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1004.850745][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1005.543448][T20908] netlink: 'syz.5.3614': attribute type 1 has an invalid length. [ 1005.546284][T20908] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3614'. [ 1005.560783][T20910] binder: 20909:20910 ioctl c00c6211 0 returned -14 [ 1005.755002][T20915] jffs2: notice: (20915) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1005.796526][T20915] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3616'. [ 1005.809494][T20915] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3616'. [ 1006.517857][ T42] audit: type=1326 audit(2000000680.884:17649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20918 comm="syz.8.3617" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 1006.767888][T20925] pim6reg: entered allmulticast mode [ 1006.911786][T20923] pim6reg: left allmulticast mode [ 1006.981741][T20925] loop7: detected capacity change from 0 to 7 [ 1007.049608][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1007.056899][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1007.060045][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1007.067468][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1007.070544][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1007.080457][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1007.083519][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1007.098843][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1007.111536][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1007.950682][T20930] pim6reg: entered allmulticast mode [ 1007.993582][T20930] pim6reg: left allmulticast mode [ 1008.339051][T20929] loop7: detected capacity change from 0 to 7 [ 1008.569983][T20934] fuse: Unknown parameter 'rooÿmode' [ 1009.274122][ T42] audit: type=1326 audit(2000000683.634:17650): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20936 comm="syz.2.3620" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd6fec code=0x0 [ 1009.927721][ C0] blk_print_req_error: 8 callbacks suppressed [ 1009.927745][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1009.935385][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1009.939770][ C0] buffer_io_error: 5 callbacks suppressed [ 1009.939786][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1009.946347][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1009.949509][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1009.952705][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1009.955760][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1009.960291][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1009.963265][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1009.966781][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1009.969902][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1010.522292][ T42] audit: type=1326 audit(2000000684.874:17651): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20945 comm="syz.8.3623" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 1011.143842][T20958] netlink: 'syz.5.3625': attribute type 1 has an invalid length. [ 1011.157390][T20958] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3625'. [ 1012.215209][ T42] audit: type=1326 audit(2000000686.574:17652): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20962 comm="syz.2.3626" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd6fec code=0x0 [ 1013.953182][T20976] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1014.083348][T20978] netlink: 'syz.8.3631': attribute type 1 has an invalid length. [ 1014.086587][T20978] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3631'. [ 1014.159546][T20980] jffs2: notice: (20980) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1014.170867][T20980] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3632'. [ 1014.174655][T20980] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3632'. [ 1014.604408][T20987] netlink: zone id is out of range [ 1014.618500][T20987] netlink: zone id is out of range [ 1014.620274][T20987] netlink: zone id is out of range [ 1014.814180][T20992] binder: 20991:20992 ioctl c00c6211 0 returned -14 [ 1016.574126][T21003] pim6reg: entered allmulticast mode [ 1016.587632][T21003] pim6reg: left allmulticast mode [ 1016.720019][T21004] loop7: detected capacity change from 0 to 7 [ 1016.839046][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1016.854535][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1016.858793][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1016.875093][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1016.879620][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1016.898301][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1016.902565][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1016.906811][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1016.911179][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1017.052332][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1017.056476][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1017.153624][T20998] pim6reg: entered allmulticast mode [ 1017.159956][T21000] pim6reg: left allmulticast mode [ 1017.199511][T20998] 9pnet_virtio: no channels available for device syz [ 1017.274099][T20998] loop7: detected capacity change from 0 to 7 [ 1017.288269][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1017.293142][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1017.296374][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1017.299835][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1017.303212][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1017.307303][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1017.310702][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1017.315072][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1017.318451][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1017.698751][T21013] pim6reg: entered allmulticast mode [ 1017.785181][ T42] audit: type=1326 audit(2000000692.144:17653): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21009 comm="syz.2.3640" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd6fec code=0x0 [ 1017.919390][T21016] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1017.977601][T21011] pim6reg: left allmulticast mode [ 1018.126670][T21025] fuse: Unknown parameter 'rooÿmode' [ 1018.379461][T21012] loop7: detected capacity change from 0 to 7 [ 1019.010978][T21035] binder: 21034:21035 ioctl c00c6211 0 returned -14 [ 1019.525046][T21033] netlink: 'syz.7.3646': attribute type 1 has an invalid length. [ 1019.531254][T21033] netlink: 756 bytes leftover after parsing attributes in process `syz.7.3646'. [ 1020.380559][T21042] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1020.786988][T21046] jffs2: notice: (21046) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1020.796767][T21046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3650'. [ 1020.837423][T21046] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3650'. [ 1021.120912][T21056] xt_hashlimit: overflow, rate too high: 0 [ 1021.256694][T21059] IPv6: A: Disabled Multicast RS [ 1021.486608][T21064] fuse: Unknown parameter 'rooÿmode' [ 1022.077465][ T8881] hid-generic FFFF:0008:0003.000E: item fetching failed at offset 0/1 [ 1022.086722][ T8881] hid-generic FFFF:0008:0003.000E: probe with driver hid-generic failed with error -22 [ 1022.146990][T21072] wg2 speed is unknown, defaulting to 1000 [ 1022.248484][ T42] audit: type=1326 audit(2000000696.564:17654): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21074 comm="syz.5.3658" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 1023.993202][T21097] pim6reg: entered allmulticast mode [ 1023.996244][T21098] pim6reg: left allmulticast mode [ 1024.610007][T21099] pim6reg: entered allmulticast mode [ 1024.618345][T21069] pim6reg: left allmulticast mode [ 1024.823278][T21069] 9pnet_virtio: no channels available for device syz [ 1024.848791][T21069] loop7: detected capacity change from 0 to 7 [ 1024.861872][ C3] blk_print_req_error: 13 callbacks suppressed [ 1024.861942][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1024.868497][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.873313][ C3] buffer_io_error: 10 callbacks suppressed [ 1024.873378][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.891871][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.895325][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.898839][ C3] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.902147][ C3] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.905556][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.909377][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.912773][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.916567][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.929775][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.933350][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.937363][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.940650][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.945762][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.949267][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.952915][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1024.956404][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1024.959770][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1025.498646][ T42] audit: type=1326 audit(2000000699.864:17655): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.517880][ T42] audit: type=1326 audit(2000000699.864:17656): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.543127][T21116] binder: 21115:21116 ioctl c00c6211 0 returned -14 [ 1025.559920][ T42] audit: type=1326 audit(2000000699.864:17657): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.564783][T21118] netlink: 236 bytes leftover after parsing attributes in process `syz.5.3670'. [ 1025.613356][ T42] audit: type=1326 audit(2000000699.864:17658): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.644190][ T42] audit: type=1326 audit(2000000699.864:17659): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.662410][ T42] audit: type=1326 audit(2000000699.864:17660): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.678629][ T42] audit: type=1326 audit(2000000699.864:17661): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.696230][ T42] audit: type=1326 audit(2000000699.864:17662): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=186 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.711459][ T42] audit: type=1326 audit(2000000699.864:17663): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1025.733590][ T42] audit: type=1326 audit(2000000699.864:17664): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21113 comm="syz.5.3670" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x7ffc0000 [ 1026.072324][T21117] netlink: 'syz.7.3666': attribute type 1 has an invalid length. [ 1026.081154][T21117] netlink: 756 bytes leftover after parsing attributes in process `syz.7.3666'. [ 1027.086447][T21132] vhci_hcd vhci_hcd.0: pdev(7) rhport(0) sockfd(7) [ 1027.088554][T21132] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1027.092462][T21132] vhci_hcd vhci_hcd.0: Device attached [ 1027.468523][T21136] netlink: 'syz.5.3673': attribute type 1 has an invalid length. [ 1027.471179][T21136] netlink: 756 bytes leftover after parsing attributes in process `syz.5.3673'. [ 1027.482298][ T5880] usb 52-1: SetAddress Request (2) to port 0 [ 1027.486126][ T5880] usb 52-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1027.637277][ T61] usb 7-1: new high-speed USB device number 23 using dummy_hcd [ 1027.717544][T21133] vhci_hcd: connection reset by peer [ 1027.719565][ T8370] vhci_hcd vhci_hcd.7: stop threads [ 1027.721265][ T8370] vhci_hcd vhci_hcd.7: release socket [ 1027.723032][ T8370] vhci_hcd vhci_hcd.7: disconnect device [ 1027.787331][ T61] usb 7-1: device descriptor read/64, error -71 [ 1028.037452][ T61] usb 7-1: new high-speed USB device number 24 using dummy_hcd [ 1028.177308][ T61] usb 7-1: device descriptor read/64, error -71 [ 1028.287669][ T61] usb usb7-port1: attempt power cycle [ 1028.627962][ T61] usb 7-1: new high-speed USB device number 25 using dummy_hcd [ 1028.648133][ T61] usb 7-1: device descriptor read/8, error -71 [ 1028.888041][ T61] usb 7-1: new high-speed USB device number 26 using dummy_hcd [ 1028.908496][ T61] usb 7-1: device descriptor read/8, error -71 [ 1029.029532][ T61] usb usb7-port1: unable to enumerate USB device [ 1029.201048][ T29] usb 10-1: new high-speed USB device number 22 using dummy_hcd [ 1029.404511][ T29] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1029.420883][ T29] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1029.432778][ T29] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1029.440440][ T29] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1029.447960][ T29] usb 10-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1029.457397][ T29] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1029.469868][ T29] usb 10-1: config 0 descriptor?? [ 1029.762248][T21152] pim6reg: entered allmulticast mode [ 1029.818968][T21152] pim6reg: left allmulticast mode [ 1029.961521][T21156] loop7: detected capacity change from 0 to 7 [ 1030.284782][ C1] blk_print_req_error: 1 callbacks suppressed [ 1030.284871][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1030.293749][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1030.296890][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1030.312110][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1030.315163][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1030.389925][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1030.394064][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1030.412536][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1030.415706][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1030.424580][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1030.427851][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1030.776464][ T29] plantronics 0003:047F:FFFF.000F: hiddev0,hidraw1: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.5-1/input0 [ 1031.275156][T21169] netlink: 'syz.2.3682': attribute type 1 has an invalid length. [ 1031.282270][T21169] netlink: 756 bytes leftover after parsing attributes in process `syz.2.3682'. [ 1031.635489][ T8881] usb 10-1: USB disconnect, device number 22 [ 1031.801153][T21174] pim6reg: entered allmulticast mode [ 1032.046571][T21155] pim6reg: left allmulticast mode [ 1032.098320][T21175] pim6reg: entered allmulticast mode [ 1032.378288][T21155] loop7: detected capacity change from 0 to 7 [ 1032.415130][T21173] pim6reg: left allmulticast mode [ 1032.420417][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1032.446969][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1032.450271][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1032.453553][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1032.457334][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1032.463260][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1032.466751][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1032.471210][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1032.492004][T21175] 9pnet_virtio: no channels available for device syz [ 1032.572920][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1032.636844][ T5880] usb 52-1: device descriptor read/8, error -110 [ 1033.097300][ T42] kauditd_printk_skb: 533 callbacks suppressed [ 1033.097317][ T42] audit: type=1326 audit(2000000707.454:18198): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21182 comm="syz.2.3688" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd6fec code=0x0 [ 1033.136407][ T5880] usb usb52-port1: attempt power cycle [ 1033.266575][T21193] binder: 21192:21193 ioctl c00c6211 0 returned -14 [ 1033.774144][T21201] syz.7.3692: page allocation failure: order:0, mode:0x340cca(GFP_HIGHUSER_MOVABLE|__GFP_COMP|__GFP_THISNODE), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1033.797470][T21201] CPU: 0 UID: 0 PID: 21201 Comm: syz.7.3692 Tainted: G L syzkaller #0 PREEMPT(full) [ 1033.797490][T21201] Tainted: [L]=SOFTLOCKUP [ 1033.797495][T21201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1033.797502][T21201] Call Trace: [ 1033.797508][T21201] [ 1033.797513][T21201] dump_stack_lvl+0x100/0x190 [ 1033.797534][T21201] warn_alloc.cold+0x94/0xa8 [ 1033.797561][T21201] ? __pfx_warn_alloc+0x10/0x10 [ 1033.797579][T21201] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1033.797600][T21201] ? __pfx_get_page_from_freelist+0x10/0x10 [ 1033.797617][T21201] __alloc_frozen_pages_noprof+0x159f/0x2dc0 [ 1033.797639][T21201] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1033.797653][T21201] ? do_raw_spin_lock+0x128/0x260 [ 1033.797668][T21201] ? find_held_lock+0x2b/0x80 [ 1033.797682][T21201] ? debug_object_activate+0x343/0x4b0 [ 1033.797703][T21201] ? __lock_acquire+0x49f/0x1a40 [ 1033.797723][T21201] ? __lock_acquire+0x49f/0x1a40 [ 1033.797747][T21201] __folio_alloc_noprof+0x13/0x260 [ 1033.797761][T21201] alloc_migration_target+0x1d7/0x6d0 [ 1033.797782][T21201] migrate_pages_batch+0x5dc/0x45c0 [ 1033.797802][T21201] ? __pfx_alloc_migration_target+0x10/0x10 [ 1033.797825][T21201] ? __pfx_migrate_pages_batch+0x10/0x10 [ 1033.797847][T21201] ? __pfx___schedule+0x10/0x10 [ 1033.797863][T21201] ? __lock_acquire+0x49f/0x1a40 [ 1033.797883][T21201] migrate_pages_sync+0x12c/0x880 [ 1033.797902][T21201] ? __pfx_alloc_migration_target+0x10/0x10 [ 1033.797923][T21201] ? __pfx_migrate_pages_sync+0x10/0x10 [ 1033.797948][T21201] migrate_pages+0x1a83/0x2850 [ 1033.797968][T21201] ? __pfx_alloc_migration_target+0x10/0x10 [ 1033.797987][T21201] ? do_raw_spin_lock+0x128/0x260 [ 1033.798001][T21201] ? __pfx_migrate_pages+0x10/0x10 [ 1033.798022][T21201] ? __lock_acquire+0x49f/0x1a40 [ 1033.798040][T21201] ? __pfx_vm_normal_page+0x10/0x10 [ 1033.798060][T21201] move_pages_and_store_status+0xf1/0x230 [ 1033.798080][T21201] ? __pfx_move_pages_and_store_status+0x10/0x10 [ 1033.798104][T21201] kernel_move_pages+0xc89/0x14a0 [ 1033.798127][T21201] ? __pfx_kernel_move_pages+0x10/0x10 [ 1033.798147][T21201] ? kcov_ioctl+0x17a/0x750 [ 1033.798178][T21201] ? xfd_validate_state+0x129/0x190 [ 1033.798197][T21201] __ia32_sys_move_pages+0xdd/0x1b0 [ 1033.798208][T21201] ? __do_fast_syscall_32+0x98/0x970 [ 1033.798225][T21201] ? lockdep_hardirqs_on+0x78/0x100 [ 1033.798241][T21201] __do_fast_syscall_32+0xe7/0x970 [ 1033.798260][T21201] do_fast_syscall_32+0x32/0x70 [ 1033.798277][T21201] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1033.798292][T21201] RIP: 0023:0xf70befec [ 1033.798305][T21201] Code: Unable to access opcode bytes at 0xf70befc2. [ 1033.798311][T21201] RSP: 002b:00000000f546b50c EFLAGS: 00000292 ORIG_RAX: 000000000000013d [ 1033.798324][T21201] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000000020a0 [ 1033.798330][T21201] RDX: 0000000080000040 RSI: 0000000080001180 RDI: 0000000080000000 [ 1033.798337][T21201] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1033.798344][T21201] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1033.798351][T21201] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1033.798364][T21201] [ 1033.798378][T21201] Mem-Info: [ 1033.882230][ T5880] usb usb52-port1: unable to enumerate USB device [ 1033.889917][T21201] active_anon:4555 inactive_anon:784 isolated_anon:0 [ 1033.889917][T21201] active_file:4474 inactive_file:13399 isolated_file:0 [ 1033.889917][T21201] unevictable:9483 dirty:314 writeback:0 [ 1033.889917][T21201] slab_reclaimable:7291 slab_unreclaimable:82854 [ 1033.889917][T21201] mapped:27546 shmem:4548 pagetables:1453 [ 1033.889917][T21201] sec_pagetables:379 bounce:0 [ 1033.889917][T21201] kernel_misc_reclaimable:0 [ 1033.889917][T21201] free:24129 free_pcp:5785 free_cma:0 [ 1033.923701][T21201] Node 0 active_anon:4kB inactive_anon:4kB active_file:4kB inactive_file:0kB unevictable:0kB isolated(anon):0kB isolated(file):0kB mapped:1564kB dirty:4kB writeback:0kB shmem:0kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:7808kB pagetables:1120kB sec_pagetables:1208kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1033.942007][ T8881] usb 12-1: new high-speed USB device number 14 using dummy_hcd [ 1033.958268][T21201] Node 1 active_anon:18460kB inactive_anon:4564kB active_file:18696kB inactive_file:52056kB unevictable:38732kB isolated(anon):0kB isolated(file):0kB mapped:110220kB dirty:1252kB writeback:0kB shmem:19692kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8744kB pagetables:4692kB sec_pagetables:308kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 1033.979883][T21201] Node 0 DMA free:2796kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:12kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1034.000422][T21201] lowmem_reserve[]: 0 280 280 280 280 [ 1034.008112][T21201] Node 0 DMA32 free:25484kB boost:28740kB min:41516kB low:44708kB high:47900kB reserved_highatomic:0KB free_highatomic:0KB active_anon:4kB inactive_anon:4kB active_file:4kB inactive_file:0kB unevictable:0kB writepending:4kB zspages:1844kB present:1032196kB managed:287072kB mlocked:0kB bounce:0kB free_pcp:1308kB local_pcp:732kB free_cma:0kB [ 1034.017544][ T6130] usb 13-1: new high-speed USB device number 13 using dummy_hcd [ 1034.025259][T21201] lowmem_reserve[]: 0 0 0 0 0 [ 1034.026827][T21201] Node 1 DMA32 free:65784kB boost:0kB min:47140kB low:58924kB high:70708kB reserved_highatomic:2048KB free_highatomic:360KB active_anon:21060kB inactive_anon:4564kB active_file:18424kB inactive_file:51044kB unevictable:41532kB writepending:1252kB zspages:6088kB present:1048432kB managed:948212kB mlocked:37512kB bounce:0kB free_pcp:19056kB local_pcp:752kB free_cma:0kB [ 1034.078249][T21201] lowmem_reserve[]: 0 0 0 0 0 [ 1034.086575][T21201] Node 0 DMA: 197*4kB (UM) 5*8kB (UM) 3*16kB (UM) 8*32kB (UM) 4*64kB (UM) 1*128kB (U) 1*256kB (M) 2*512kB (M) 0*1024kB 0*2048kB 0*4096kB = 2796kB [ 1034.128556][T21201] Node 0 DMA32: 635*4kB (UME) 162*8kB (UME) 119*16kB (UME) 173*32kB (UME) 94*64kB (UME) 36*128kB (UME) 10*256kB (UM) 0*512kB 1*1024kB (U) 0*2048kB 0*4096kB = 25484kB [ 1034.152323][T21201] Node 1 DMA32: [ 1034.152508][ T8881] usb 12-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 1034.156267][ T8881] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.161503][T21201] 119*4kB [ 1034.161636][ T8881] usb 12-1: Product: syz [ 1034.163860][ T8881] usb 12-1: Manufacturer: syz [ 1034.165322][ T8881] usb 12-1: SerialNumber: syz [ 1034.167353][ T6130] usb 13-1: Using ep0 maxpacket: 32 [ 1034.169590][T21201] (UMEH) 399*8kB (UEH) 120*16kB (UE) 124*32kB (UMEH) 56*64kB (UME) 54*128kB (UE) [ 1034.170407][ T6130] usb 13-1: config 155 has an invalid descriptor of length 0, skipping remainder of the config [ 1034.176393][ T6130] usb 13-1: config 155 interface 0 altsetting 0 has an endpoint descriptor with address 0xE2, changing to 0x82 [ 1034.180042][T21201] 48*256kB (UME) 27*512kB (UME) 8*1024kB (UME) 3*2048kB (M) 0*4096kB = 60500kB [ 1034.182863][ T6130] usb 13-1: config 155 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1034.190842][ T8881] usb 12-1: config 0 descriptor?? [ 1034.194711][T21201] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1034.197725][ T6130] usb 13-1: config 155 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 11 [ 1034.202203][T21201] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1034.210624][ T6130] usb 13-1: New USB device found, idVendor=15c2, idProduct=ffdc, bcdDevice=bd.30 [ 1034.214106][ T6130] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1034.217049][ T6130] usb 13-1: Product: syz [ 1034.218802][T21201] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1034.221679][ T6130] usb 13-1: Manufacturer: syz [ 1034.224408][ T8881] i2c-tiny-usb 12-1:0.0: version 6d.cc found at bus 012 address 014 [ 1034.227683][ T6130] usb 13-1: SerialNumber: syz [ 1034.231463][T21201] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1034.238689][ C0] imon 13-1:155.0: imon usb_rx_callback_intf0: status(-71) [ 1034.243476][T21201] 23979 total pagecache pages [ 1034.256717][ T6130] input: iMON Panel, Knob and Mouse(15c2:ffdc) as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:155.0/input/input402 [ 1034.268617][T21201] 1025 pages in swap cache [ 1034.271799][T21201] Free swap = 50064kB [ 1034.284510][T21201] Total swap = 124996kB [ 1034.285839][T21201] 524155 pages RAM [ 1034.298645][T21201] 0 pages HighMem/MovableOnly [ 1034.300147][T21201] 211494 pages reserved [ 1034.310345][T21201] 0 pages cma reserved [ 1034.457474][ T6130] imon 13-1:155.0: Unknown 0xffdc device, defaulting to VFD and iMON IR [ 1034.460501][ T6130] (id 0x00) [ 1034.977948][ T6130] rc_core: IR keymap rc-imon-pad not found [ 1034.979786][ T6130] Registered IR keymap rc-empty [ 1034.983573][ T6130] imon 13-1:155.0: Looks like you're trying to use an IR protocol this device does not support [ 1034.993280][ T6130] imon 13-1:155.0: Unsupported IR protocol specified, overriding to iMON IR protocol [ 1035.039187][ T6130] rc rc0: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:155.0/rc/rc0 [ 1035.060043][ T6130] input: iMON Remote (15c2:ffdc) as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:155.0/rc/rc0/input403 [ 1035.107026][ T6130] imon 13-1:155.0: iMON device (15c2:ffdc, intf0) on usb<13:13> initialized [ 1036.057424][T21220] FAULT_INJECTION: forcing a failure. [ 1036.057424][T21220] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1036.069373][T21220] CPU: 1 UID: 0 PID: 21220 Comm: syz.5.3700 Tainted: G L syzkaller #0 PREEMPT(full) [ 1036.069395][T21220] Tainted: [L]=SOFTLOCKUP [ 1036.069399][T21220] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1036.069406][T21220] Call Trace: [ 1036.069412][T21220] [ 1036.069417][T21220] dump_stack_lvl+0x100/0x190 [ 1036.069437][T21220] should_fail_ex.cold+0x5/0xa [ 1036.069451][T21220] _copy_from_user+0x2e/0xd0 [ 1036.069473][T21220] __sys_bpf+0x2f5/0x4e80 [ 1036.069500][T21220] ? __pfx___sys_bpf+0x10/0x10 [ 1036.069522][T21220] ? find_held_lock+0x2b/0x80 [ 1036.069544][T21220] ? get_pid_task+0xfc/0x250 [ 1036.069567][T21220] ? get_pid_task+0xfc/0x250 [ 1036.069589][T21220] ? proc_fail_nth_write+0x9f/0x220 [ 1036.069612][T21220] ? find_held_lock+0x2b/0x80 [ 1036.069639][T21220] ? rcu_read_lock_any_held+0x6a/0xa0 [ 1036.069664][T21220] ? find_held_lock+0x2b/0x80 [ 1036.069683][T21220] ? ksys_write+0x190/0x250 [ 1036.069700][T21220] ? ksys_write+0x190/0x250 [ 1036.069733][T21220] ? fput+0x79/0x100 [ 1036.069756][T21220] ? __ia32_sys_bpf+0xcc/0x170 [ 1036.069774][T21220] __ia32_sys_bpf+0xcc/0x170 [ 1036.069793][T21220] ? __do_fast_syscall_32+0x98/0x970 [ 1036.069818][T21220] __do_fast_syscall_32+0xe7/0x970 [ 1036.069845][T21220] ? lockdep_hardirqs_on+0x78/0x100 [ 1036.069870][T21220] do_fast_syscall_32+0x32/0x70 [ 1036.069895][T21220] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1036.069918][T21220] RIP: 0023:0xf703efec [ 1036.069956][T21220] Code: Unable to access opcode bytes at 0xf703efc2. [ 1036.069966][T21220] RSP: 002b:00000000f542d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 1036.069985][T21220] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000600 [ 1036.069997][T21220] RDX: 0000000000000048 RSI: 0000000000000000 RDI: 0000000000000000 [ 1036.070008][T21220] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1036.070018][T21220] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1036.070028][T21220] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1036.070052][T21220] [ 1036.490206][ T42] audit: type=1800 audit(2000000710.844:18199): pid=21231 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.3704" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1036.727805][ T8881] (null): failure reading functionality [ 1036.756432][ T8881] i2c i2c-2: failure reading functionality [ 1037.260010][ T8881] i2c i2c-2: connected i2c-tiny-usb device [ 1037.283375][T21234] imon:send_packet: task interrupted [ 1037.309705][T21234] imon:send_packet: packet tx failed (-512) [ 1037.345478][T21234] imon:vfd_write: send packet #5 failed [ 1037.550184][ T5819] usb 13-1: USB disconnect, device number 13 [ 1038.291035][ T29] usb 12-1: USB disconnect, device number 14 [ 1039.023263][ T42] audit: type=1326 audit(2000000713.384:18200): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21254 comm="syz.5.3710" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf703efec code=0x0 [ 1039.341869][ T42] audit: type=1326 audit(2000000713.704:18201): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21259 comm="syz.7.3711" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 1040.062990][T21272] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(8) [ 1040.064919][T21272] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1040.082458][T21272] vhci_hcd vhci_hcd.0: Device attached [ 1040.347401][ T29] usb 54-1: SetAddress Request (6) to port 0 [ 1040.350100][ T29] usb 54-1: new SuperSpeed USB device number 6 using vhci_hcd [ 1041.409980][T21280] pim6reg: entered allmulticast mode [ 1041.521312][T21278] pim6reg: left allmulticast mode [ 1041.587342][T21278] loop7: detected capacity change from 0 to 7 [ 1041.593506][ C0] blk_print_req_error: 2 callbacks suppressed [ 1041.593523][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1041.602212][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1041.605558][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1041.609153][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1041.613249][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1041.617176][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1041.620935][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1041.626418][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1041.629949][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1041.637581][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1041.641245][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1041.693311][T21285] ip6tnl0: Caught tx_queue_len zero misconfig [ 1041.698675][T21285] sch_fq: defrate 2 ignored. [ 1041.712407][T21285] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3717'. [ 1041.715910][T21285] netlink: 5 bytes leftover after parsing attributes in process `syz.5.3717'. [ 1041.717890][T21273] vhci_hcd: connection reset by peer [ 1041.737780][T21007] vhci_hcd vhci_hcd.8: stop threads [ 1041.739832][T21007] vhci_hcd vhci_hcd.8: release socket [ 1041.742071][T21007] vhci_hcd vhci_hcd.8: disconnect device [ 1042.604303][T21302] smpboot: CPU 1 is now offline [ 1042.790086][T21308] overlayfs: missing 'lowerdir' [ 1042.970140][ T42] audit: type=1326 audit(2000000717.334:18202): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21310 comm="syz.7.3725" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 1043.316784][T21302] smpboot: CPU 3 is now offline [ 1044.488471][T21322] netlink: 'syz.8.3727': attribute type 1 has an invalid length. [ 1044.511156][T21322] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3727'. [ 1044.616956][T21317] 9p: Bad value for 'rfdno' [ 1045.439197][ T29] usb 54-1: device descriptor read/8, error -110 [ 1045.834459][ T29] usb usb54-port1: attempt power cycle [ 1046.458740][ T29] usb usb54-port1: unable to enumerate USB device [ 1046.462309][ T42] audit: type=1326 audit(2000000720.824:18203): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21336 comm="syz.8.3730" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 1046.678103][T21325] device-mapper: ioctl: only supply one of name or uuid, cmd(9) [ 1047.395473][T21348] syzkaller0: entered promiscuous mode [ 1047.401689][T21348] syzkaller0: entered allmulticast mode [ 1048.048991][T21352] binder: 21351:21352 ioctl c00c6211 0 returned -14 [ 1049.442457][T21359] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3736'. [ 1049.538293][T21361] jffs2: notice: (21361) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1049.632745][T21367] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3738'. [ 1049.651105][T21367] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3738'. [ 1052.521091][T21380] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1052.584277][T21383] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 1052.786568][T21384] XFS (nullb0): Invalid superblock magic number [ 1053.088241][T21395] fuse: Unknown parameter 'rooÿmode' [ 1053.913331][T21398] pim6reg: entered allmulticast mode [ 1053.998736][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 1054.002336][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 1054.140948][T21401] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3747'. [ 1054.199731][T21391] pim6reg: left allmulticast mode [ 1054.244836][T21402] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3746'. [ 1054.275885][T21391] loop7: detected capacity change from 0 to 7 [ 1054.281110][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1054.285664][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1054.288480][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1054.296035][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1054.299316][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1054.309376][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1054.312358][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1054.316291][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1054.319305][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1054.323498][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1054.326480][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1056.063498][T21422] pim6reg: entered allmulticast mode [ 1056.266542][T21417] pim6reg: left allmulticast mode [ 1056.330251][T21417] loop7: detected capacity change from 0 to 7 [ 1056.338862][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1056.343556][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1056.346367][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1056.354946][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1056.357863][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1056.361120][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1056.363884][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1056.367414][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1056.370993][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1056.920126][T21438] jffs2: notice: (21438) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1056.929039][T21438] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3759'. [ 1056.932243][T21438] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3759'. [ 1057.321472][T21444] netlink: 'syz.7.3760': attribute type 1 has an invalid length. [ 1057.333293][T21444] netlink: 756 bytes leftover after parsing attributes in process `syz.7.3760'. [ 1057.572045][T21451] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3762'. [ 1057.599508][T21451] netlink: 'syz.8.3762': attribute type 5 has an invalid length. [ 1057.613230][T21451] netlink: 20 bytes leftover after parsing attributes in process `syz.8.3762'. [ 1057.713582][T21451] geneve3: entered promiscuous mode [ 1057.717800][T21451] geneve3: entered allmulticast mode [ 1057.727681][ T8370] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 256 - 0 [ 1057.733164][ T8370] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 256 - 0 [ 1057.743189][ T8370] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 256 - 0 [ 1057.784406][T14677] ffs_data_put(): freeing [ 1059.144330][T21474] jffs2: notice: (21474) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1059.167483][T21474] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3768'. [ 1059.177239][T21474] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3768'. [ 1059.189808][T21469] netlink: 88 bytes leftover after parsing attributes in process `syz.8.3766'. [ 1059.635821][T21486] jffs2: notice: (21486) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1059.672531][T21486] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3772'. [ 1059.683500][T21486] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3772'. [ 1059.696724][T21490] netlink: 'syz.7.3771': attribute type 1 has an invalid length. [ 1059.885708][T21495] binder: 21494:21495 ioctl c0186405 800028c0 returned -22 [ 1060.188036][ T1033] usb 7-1: new high-speed USB device number 27 using dummy_hcd [ 1060.342145][T21498] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1060.348637][ T1033] usb 7-1: Using ep0 maxpacket: 8 [ 1060.360502][T21503] netlink: 'syz.8.3777': attribute type 10 has an invalid length. [ 1060.381632][ T1033] usb 7-1: config 0 has an invalid interface number: 55 but max is 0 [ 1060.393575][ T1033] usb 7-1: config 0 has no interface number 0 [ 1060.404144][ T1033] usb 7-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1060.419779][ T1033] usb 7-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1060.433736][ T1033] usb 7-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1060.454149][ T1033] usb 7-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1060.484464][ T1033] usb 7-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1060.496355][ T1033] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1060.498752][T21503] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1060.547149][ T1033] usb 7-1: config 0 descriptor?? [ 1060.671496][T21503] team0: Port device netdevsim1 added [ 1060.679337][ T1033] ldusb 7-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1060.796505][ T5819] usb 7-1: USB disconnect, device number 27 [ 1060.808955][ T5819] ldusb 7-1:0.55: LD USB Device #0 now disconnected [ 1060.934282][ T42] audit: type=1400 audit(2000000735.294:18204): apparmor="DENIED" operation="change_profile" class="file" info="label not found" error=-2 profile="unconfined" name=2626205F7374617465735F7065725F696E736E203020746F74616C5F7374617465732030207065616B5F7374617465732030206D61726B5F726561642030 pid=21507 comm="syz.7.3778" [ 1063.135866][T21517] __nla_validate_parse: 1 callbacks suppressed [ 1063.135880][T21517] netlink: 88 bytes leftover after parsing attributes in process `syz.5.3781'. [ 1063.655568][T21524] 9p: Bad value for 'wfdno' [ 1063.778919][T21530] kAFS: No cell specified [ 1063.934341][T21531] program syz.7.3783 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1067.172340][T21553] netlink: 88 bytes leftover after parsing attributes in process `syz.2.3790'. [ 1067.402488][ T42] audit: type=1326 audit(2000000741.764:18205): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21562 comm="syz.2.3794" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd6fec code=0x0 [ 1067.477400][T21532] usb 10-1: new full-speed USB device number 23 using dummy_hcd [ 1067.593416][T21567] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1067.631293][T21532] usb 10-1: not running at top speed; connect to a high speed hub [ 1067.641397][T21532] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 1067.644966][T21532] usb 10-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1067.668501][T21532] usb 10-1: New USB device found, idVendor=0ea0, idProduct=6858, bcdDevice= 0.40 [ 1067.674007][T21532] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1067.681505][T21532] usb 10-1: Product: syz [ 1067.682883][T21532] usb 10-1: Manufacturer: syz [ 1067.684452][T21532] usb 10-1: SerialNumber: syz [ 1067.697652][T21532] oti6858 10-1:1.0: oti6858 converter detected [ 1067.711607][T21532] usb 10-1: oti6858 converter now attached to ttyUSB0 [ 1067.925952][T21572] netlink: 'syz.8.3795': attribute type 1 has an invalid length. [ 1067.936615][T21572] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3795'. [ 1068.263112][T21574] oti6858 ttyUSB0: oti6858_open(): usb_submit_urb() failed with error -90 [ 1068.464621][T21532] usb 10-1: USB disconnect, device number 23 [ 1068.573603][T21532] oti6858 ttyUSB0: oti6858 converter now disconnected from ttyUSB0 [ 1068.590148][T21532] oti6858 10-1:1.0: device disconnected [ 1069.079236][ T42] audit: type=1326 audit(2000000743.444:18206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21579 comm="syz.8.3797" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 1069.278069][T18846] overlayfs: failed lookup in lower (newroot/166, name='file0', err=-40): overlapping layers [ 1069.298777][T18846] overlayfs: failed lookup in lower (newroot/166, name='file0', err=-40): overlapping layers [ 1070.489319][ T8370] bridge_slave_1: left promiscuous mode [ 1070.495981][ T8370] bridge0: port 2(bridge_slave_1) entered disabled state [ 1070.513277][ T8370] bridge_slave_0: left allmulticast mode [ 1070.517553][ T8370] bridge_slave_0: left promiscuous mode [ 1070.523857][ T8370] bridge0: port 1(bridge_slave_0) entered disabled state [ 1070.897726][ T8370] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1070.924973][ T8370] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1070.943752][ T8370] bond0 (unregistering): Released all slaves [ 1070.969475][ T8370] bond1 (unregistering): Released all slaves [ 1071.331887][T21591] fuse: Unknown parameter 'rmotmode' [ 1071.374766][T21593] netlink: 'syz.8.3802': attribute type 1 has an invalid length. [ 1071.408249][T21593] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3802'. [ 1071.543526][T21598] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3803'. [ 1071.701412][ T65] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1071.736977][ T65] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1071.742098][ T65] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1071.759359][ T65] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1071.781104][ T65] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1072.007429][T15311] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1072.014655][T15311] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1072.017122][T15311] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1072.021820][T15311] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1072.026600][T15311] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1072.202913][T21610] program syz.2.3804 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1072.333510][T21610] infiniband syz0: set active [ 1072.335020][T21610] infiniband syz0: added bond_slave_1 [ 1072.416328][T21610] smbdirect: ib_dev[syz0]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1072.421102][T21610] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1072.426361][T21610] smbdirect: ib_dev[syz0]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1072.535562][T21610] RDS/IB: syz0: added [ 1072.537945][T21610] smc: adding ib device syz0 with port count 1 [ 1072.540333][T21610] smc: ib device syz0 port 1 has pnetid SYZ2 (user defined) [ 1073.783470][ T8370] hsr_slave_0: left promiscuous mode [ 1073.797403][ T8370] hsr_slave_1: left promiscuous mode [ 1073.803824][ T8370] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1073.820246][ T8370] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1073.996357][ T8370] team0 (unregistering): Port device team_slave_1 removed [ 1074.007085][ T8370] team0 (unregistering): Port device team_slave_0 removed [ 1074.087837][T15311] Bluetooth: hci1: command tx timeout [ 1074.139788][ T5446] 8021q: adding VLAN 0 to HW filter on device eth10 [ 1075.759763][T21638] netlink: 40 bytes leftover after parsing attributes in process `syz.7.3811'. [ 1075.861025][ T5446] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1076.073953][ T5446] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1076.157307][T15311] Bluetooth: hci1: command tx timeout [ 1076.383466][T21656] netlink: 'syz.8.3812': attribute type 1 has an invalid length. [ 1076.425256][T21656] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3812'. [ 1076.538272][ T5446] 8021q: adding VLAN 0 to HW filter on device eth13 [ 1076.724633][T21662] jffs2: notice: (21662) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1076.758662][T21662] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3813'. [ 1076.767098][T21662] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3813'. [ 1076.990314][T21667] socket: no more sockets [ 1077.387074][T21597] wg2 speed is unknown, defaulting to 1000 [ 1078.179256][T21597] bridge0: port 1(bridge_slave_0) entered blocking state [ 1078.184597][T21597] bridge0: port 1(bridge_slave_0) entered disabled state [ 1078.197101][T21597] bridge_slave_0: entered allmulticast mode [ 1078.206905][T21597] bridge_slave_0: entered promiscuous mode [ 1078.217878][T21597] bridge0: port 2(bridge_slave_1) entered blocking state [ 1078.225115][T21597] bridge0: port 2(bridge_slave_1) entered disabled state [ 1078.234186][T21597] bridge_slave_1: entered allmulticast mode [ 1078.238058][T15311] Bluetooth: hci1: command tx timeout [ 1078.245988][T21597] bridge_slave_1: entered promiscuous mode [ 1078.324196][T21597] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1078.348319][T21597] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1078.409717][T21597] team0: Port device team_slave_0 added [ 1078.424294][T21597] team0: Port device team_slave_1 added [ 1078.479093][T21597] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1078.486278][T21597] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1078.511986][T21597] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1078.521603][T21597] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1078.525159][T21597] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1078.550337][T21597] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1078.612173][T21597] hsr_slave_0: entered promiscuous mode [ 1078.617923][T21597] hsr_slave_1: entered promiscuous mode [ 1078.622621][T21597] debugfs: 'hsr0' already exists in 'hsr' [ 1078.627560][T21597] Cannot create hsr debugfs directory [ 1079.079351][T21597] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1079.569566][T21597] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1079.578898][T21597] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1079.583837][T21597] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1079.654027][T21597] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1079.664105][T21597] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1079.667144][T21597] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1079.675652][T21597] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1079.808486][T21597] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1079.828086][T21597] 8021q: adding VLAN 0 to HW filter on device team0 [ 1079.839502][ T120] bridge0: port 1(bridge_slave_0) entered blocking state [ 1079.842454][ T120] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1079.854525][ T120] bridge0: port 2(bridge_slave_1) entered blocking state [ 1079.857661][ T120] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1079.937270][T14323] usb 13-1: new high-speed USB device number 14 using dummy_hcd [ 1080.097837][T14323] usb 13-1: Using ep0 maxpacket: 16 [ 1080.102555][T14323] usb 13-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1080.111019][T14323] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1080.117581][T14323] usb 13-1: Product: syz [ 1080.118959][T14323] usb 13-1: Manufacturer: syz [ 1080.128699][T14323] usb 13-1: SerialNumber: syz [ 1080.322802][T15311] Bluetooth: hci1: command tx timeout [ 1080.430893][T14323] usb 13-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1080.504697][T14323] usb 13-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1080.518566][T14323] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1080.528184][T14323] usb 13-1: media controller created [ 1080.551881][T14323] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1080.747932][T14323] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1080.795481][T14323] dvb_usb_gl861 13-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 1080.809711][T14323] usb 13-1: USB disconnect, device number 14 [ 1081.034481][T21597] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1081.049592][T21101] netdevsim netdevsim10 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.239246][ T42] audit: type=1326 audit(2000000755.604:18207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21717 comm="syz.8.3820" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 1081.312445][T21597] veth0_vlan: entered promiscuous mode [ 1081.322178][T21597] veth1_vlan: entered promiscuous mode [ 1081.343367][T21597] veth0_macvtap: entered promiscuous mode [ 1081.348766][T21597] veth1_macvtap: entered promiscuous mode [ 1081.364999][T21597] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1081.374907][T21597] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1081.432590][ T5838] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.448386][ T5838] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.483392][ T5838] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.507042][ T5838] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1081.588429][T14628] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1081.606405][T14628] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1081.670577][T14628] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1081.675672][T14628] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1082.244714][T21735] netlink: 'syz.9.3822': attribute type 1 has an invalid length. [ 1082.263621][T21735] netlink: 756 bytes leftover after parsing attributes in process `syz.9.3822'. [ 1082.327365][T14323] usb 12-1: new high-speed USB device number 15 using dummy_hcd [ 1082.499134][T14323] usb 12-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 1082.512729][T14323] usb 12-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1082.529530][T14323] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1082.580760][T21733] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1082.606983][T14323] opticon 12-1:1.0: opticon converter detected [ 1082.692932][T14323] usb 12-1: opticon converter now attached to ttyUSB0 [ 1083.324723][T21729] overlay: Unknown parameter 'measure' [ 1084.657958][T21532] usb 14-1: new full-speed USB device number 2 using dummy_hcd [ 1084.809762][T21532] usb 14-1: config 36 has an invalid descriptor of length 0, skipping remainder of the config [ 1084.814593][T21532] usb 14-1: config 36 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1084.829507][T21532] usb 14-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 1084.834069][T21532] usb 14-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 1084.839826][T21532] usb 14-1: Manufacturer: syz [ 1084.847433][T21532] usb 14-1: SerialNumber: syz [ 1084.871672][T21748] netlink: 164 bytes leftover after parsing attributes in process `syz.2.3825'. [ 1084.956069][T21701] usb 12-1: USB disconnect, device number 15 [ 1084.981089][T21748] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3825'. [ 1085.019223][T21701] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1085.032135][T21701] opticon 12-1:1.0: device disconnected [ 1085.073921][T21746] netlink: 44 bytes leftover after parsing attributes in process `syz.9.3824'. [ 1085.355263][T21757] syz.7.3827 (21757): drop_caches: 2 [ 1085.636543][T21532] usbhid 14-1:36.0: couldn't find an input interrupt endpoint [ 1085.653645][T21762] syzkaller0: entered promiscuous mode [ 1085.655459][T21762] syzkaller0: entered allmulticast mode [ 1085.664382][T21532] usb 14-1: USB disconnect, device number 2 [ 1085.742468][T21762] bochs-drm 0000:00:01.0: [drm] Unknown color mode 7; guessing buffer size. [ 1085.776231][T21766] 9pnet_virtio: no channels available for device syz [ 1085.802634][T21766] openvswitch: netlink: IP tunnel TTL not specified. [ 1086.153925][T21778] binder: 21771:21778 ioctl 40085874 80000100 returned -22 [ 1086.193347][T21772] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3835'. [ 1088.274212][T21801] netlink: 'syz.9.3841': attribute type 1 has an invalid length. [ 1088.335204][T21801] netlink: 756 bytes leftover after parsing attributes in process `syz.9.3841'. [ 1089.025213][T21805] kAFS: unable to lookup cell '/,c¾ûL' [ 1089.629902][T21804] binder: 21802:21804 ioctl c0506107 80000180 returned -22 [ 1090.111371][T21818] jffs2: notice: (21818) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1090.236758][T21818] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3844'. [ 1090.266654][T21818] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3844'. [ 1091.019364][T21841] netlink: 'syz.8.3847': attribute type 1 has an invalid length. [ 1091.021879][T21841] netlink: 224 bytes leftover after parsing attributes in process `syz.8.3847'. [ 1092.544603][T21862] netlink: 'syz.9.3851': attribute type 1 has an invalid length. [ 1092.598653][T21862] netlink: 756 bytes leftover after parsing attributes in process `syz.9.3851'. [ 1093.851174][T21880] x_tables: ip6_tables: icmp6 match: only valid for protocol 58 [ 1094.193942][T21883] wg2 speed is unknown, defaulting to 1000 [ 1095.486722][T21892] netlink: 'syz.9.3857': attribute type 1 has an invalid length. [ 1095.503066][T21892] netlink: 756 bytes leftover after parsing attributes in process `syz.9.3857'. [ 1095.598640][T21896] netlink: 'syz.7.3859': attribute type 23 has an invalid length. [ 1095.836058][T21902] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1096.413940][ T42] audit: type=1326 audit(2000000770.774:18208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21906 comm="syz.7.3862" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 1096.853595][ T42] audit: type=1326 audit(2000000771.214:18209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21923 comm="syz.8.3868" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 1097.162029][T21929] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1097.812968][T21934] netlink: 'syz.9.3871': attribute type 2 has an invalid length. [ 1097.822127][T21934] netlink: 164 bytes leftover after parsing attributes in process `syz.9.3871'. [ 1098.505616][T21932] wg2 speed is unknown, defaulting to 1000 [ 1099.512226][T21943] netlink: 'syz.9.3872': attribute type 1 has an invalid length. [ 1099.544043][T21943] netlink: 756 bytes leftover after parsing attributes in process `syz.9.3872'. [ 1101.889475][T21958] pim6reg: entered allmulticast mode [ 1101.894755][T21958] pim6reg: left allmulticast mode [ 1101.996863][T21958] loop7: detected capacity change from 0 to 7 [ 1102.020090][ C2] blk_print_req_error: 2 callbacks suppressed [ 1102.020104][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1102.044535][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1102.048043][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1102.055249][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1102.058735][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1102.070258][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1102.076696][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1102.085854][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1102.089071][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1102.105746][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1102.108880][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1103.058224][T21980] jffs2: notice: (21980) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1103.074311][T21980] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3885'. [ 1103.081580][T21980] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3885'. [ 1103.287366][ T42] audit: type=1326 audit(2000000777.644:18210): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21982 comm="syz.7.3886" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 1103.656004][T21988] jffs2: notice: (21988) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1103.709842][T21988] input: syz0 as /devices/virtual/input/input407 [ 1104.547339][ T1471] usb 7-1: new high-speed USB device number 28 using dummy_hcd [ 1104.703983][ T1471] usb 7-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 1104.711819][ T1471] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1104.721696][ T1471] usb 7-1: Product: syz [ 1104.723963][ T1471] usb 7-1: Manufacturer: syz [ 1104.733221][ T1471] usb 7-1: SerialNumber: syz [ 1104.741797][ T1471] usb 7-1: config 0 descriptor?? [ 1104.801891][ T1471] i2c-tiny-usb 7-1:0.0: version 6d.cc found at bus 007 address 028 [ 1105.293382][T21996] netlink: 'syz.8.3889': attribute type 1 has an invalid length. [ 1105.328671][T21996] netlink: 756 bytes leftover after parsing attributes in process `syz.8.3889'. [ 1105.370935][T22000] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1105.450358][T22000] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1106.150121][ T1471] (null): failure reading functionality [ 1106.187051][ T1471] i2c i2c-2: failure reading functionality [ 1106.199633][ T1471] i2c i2c-2: connected i2c-tiny-usb device [ 1106.209076][ T1471] usb 7-1: USB disconnect, device number 28 [ 1106.274487][T22006] jffs2: notice: (22006) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1106.402129][T22006] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3890'. [ 1106.412896][T22006] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3890'. [ 1107.013888][T22012] netlink: 12 bytes leftover after parsing attributes in process `syz.2.3892'. [ 1107.482662][T22020] jffs2: notice: (22020) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1107.547069][T22020] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3894'. [ 1107.550738][T22020] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3894'. [ 1107.554014][T22020] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3894'. [ 1107.561171][T22015] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 1108.024939][T22026] lpc_ich 0000:00:00.0: I/O space for ACPI uninitialized [ 1108.027525][T22026] lpc_ich 0000:00:00.0: No MFD cells added [ 1108.141111][T22030] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(8) [ 1108.143263][T22030] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1108.171136][T22030] vhci_hcd vhci_hcd.0: Device attached [ 1108.461536][ T120] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1108.669164][T21532] usb 54-1: SetAddress Request (10) to port 0 [ 1108.674424][ T120] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1108.700940][T21532] usb 54-1: new SuperSpeed USB device number 10 using vhci_hcd [ 1108.890643][T22030] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 1109.307327][ T42] audit: type=1800 audit(2000000783.664:18211): pid=22039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.3899" name="attr_allow_any_host" dev="configfs" ino=101543 res=0 errno=0 [ 1109.349300][ T42] audit: type=1800 audit(2000000783.694:18212): pid=22039 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.9.3899" name="addr_trsvcid" dev="configfs" ino=101544 res=0 errno=0 [ 1109.498759][T22031] vhci_hcd: connection reset by peer [ 1109.503338][ T8378] vhci_hcd vhci_hcd.8: stop threads [ 1109.505079][ T8378] vhci_hcd vhci_hcd.8: release socket [ 1109.513003][ T8378] vhci_hcd vhci_hcd.8: disconnect device [ 1110.088761][T22053] jffs2: notice: (22053) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1110.099038][T22051] binder_alloc: 22050: binder_alloc_buf, no vma [ 1110.112480][T22051] netlink: 108 bytes leftover after parsing attributes in process `syz.7.3902'. [ 1110.115247][T22053] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3903'. [ 1110.127417][T22053] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3903'. [ 1110.130315][T22053] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3903'. [ 1110.479029][T22059] netlink: 12 bytes leftover after parsing attributes in process `syz.8.3905'. [ 1110.549263][T22061] bond1 (unregistering): Released all slaves [ 1110.691857][T22064] pim6reg: entered allmulticast mode [ 1110.733832][T22064] loop7: detected capacity change from 0 to 7 [ 1110.739204][T22067] pim6reg: left allmulticast mode [ 1110.745923][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1110.754310][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1110.757550][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1110.761513][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1110.764641][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1110.768657][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1110.771737][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1110.774620][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1110.777713][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1110.784760][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1110.787794][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1111.184037][T22072] jffs2: notice: (22072) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1111.295940][ T42] audit: type=1800 audit(2000000785.644:18213): pid=22076 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3910" name="attr_allow_any_host" dev="configfs" ino=101647 res=0 errno=0 [ 1111.297320][T22076] nvmet: Disable port '1' before changing attribute in nvmet_addr_trsvcid_store [ 1111.336215][ T42] audit: type=1800 audit(2000000785.654:18214): pid=22076 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3910" name="addr_trsvcid" dev="configfs" ino=101648 res=0 errno=0 [ 1111.371671][ T42] audit: type=1326 audit(2000000785.684:18215): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22073 comm="syz.2.3908" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd6fec code=0x0 [ 1111.718250][ T24] usb 12-1: new high-speed USB device number 16 using dummy_hcd [ 1111.805914][T22087] jffs2: notice: (22087) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1111.827507][T22087] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3913'. [ 1111.834906][T22087] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3913'. [ 1111.844478][T22087] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3913'. [ 1111.879334][ T24] usb 12-1: New USB device found, idVendor=8087, idProduct=0025, bcdDevice= 0.00 [ 1111.888866][ T24] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1113.797518][T21532] usb 54-1: device descriptor read/8, error -110 [ 1113.998482][ T65] Bluetooth: hci2: command 0xfc05 tx timeout [ 1114.002770][T15311] Bluetooth: hci2: Reading Intel version command failed (-110) [ 1114.020248][ T65] Bluetooth: hci2: Resetting usb device. [ 1114.047129][ C2] Bluetooth: hci2: urb ffff88805b7add00 failed to resubmit (2) [ 1114.292569][T22089] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 1114.431642][T22091] Bluetooth: MGMT ver 1.23 [ 1114.666302][ T8881] usb 12-1: USB disconnect, device number 16 [ 1114.720166][T21532] usb usb54-port1: attempt power cycle [ 1115.425680][T22102] vhci_hcd vhci_hcd.0: pdev(9) rhport(0) sockfd(8) [ 1115.427883][T22102] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1115.444939][ T1435] ieee802154 phy0 wpan0: encryption failed: -22 [ 1115.448207][ T1435] ieee802154 phy1 wpan1: encryption failed: -22 [ 1115.489324][T22102] vhci_hcd vhci_hcd.0: Device attached [ 1115.668134][T21532] usb usb54-port1: unable to enumerate USB device [ 1115.933178][T13640] usb 56-1: SetAddress Request (2) to port 0 [ 1115.989411][T13640] usb 56-1: new SuperSpeed USB device number 2 using vhci_hcd [ 1116.009026][T22102] EXT4-fs (sr0): VFS: Can't find ext4 filesystem [ 1116.455358][T22103] vhci_hcd: connection reset by peer [ 1116.463687][ T8375] vhci_hcd vhci_hcd.9: stop threads [ 1116.469675][ T8375] vhci_hcd vhci_hcd.9: release socket [ 1116.476855][ T8375] vhci_hcd vhci_hcd.9: disconnect device [ 1116.861408][T22118] jffs2: notice: (22118) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1116.918637][T22118] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3920'. [ 1116.934541][T22118] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3920'. [ 1117.098161][T22123] tc action pedit offset must be on 32 bit boundaries [ 1117.296626][T22125] jffs2: notice: (22125) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1118.242513][ T42] audit: type=1800 audit(2000000792.604:18216): pid=22125 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.3921" name="blkio.bfq.io_merged_recursive" dev="jffs2" ino=3 res=0 errno=0 [ 1118.411405][T22142] netlink: 24 bytes leftover after parsing attributes in process `syz.9.3926'. [ 1118.608546][T22148] pim6reg: entered allmulticast mode [ 1118.613427][T22148] pim6reg: left allmulticast mode [ 1118.659861][T22148] loop7: detected capacity change from 0 to 7 [ 1118.672292][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1118.676257][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1118.679786][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1118.683306][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1118.686787][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1118.693087][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1118.696628][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1118.703452][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1118.706978][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1118.714031][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1118.717633][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1118.891830][ T1033] usb 13-1: new high-speed USB device number 15 using dummy_hcd [ 1119.048855][ T1033] usb 13-1: Using ep0 maxpacket: 32 [ 1119.061931][ T1033] usb 13-1: config 0 has an invalid interface number: 119 but max is 0 [ 1119.067825][ T1033] usb 13-1: config 0 has no interface number 0 [ 1119.070318][ T1033] usb 13-1: config 0 interface 119 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1119.079559][ T1033] usb 13-1: config 0 interface 119 altsetting 0 has an endpoint descriptor with address 0xE3, changing to 0x83 [ 1119.085850][ T1033] usb 13-1: config 0 interface 119 altsetting 0 bulk endpoint 0x83 has invalid maxpacket 27 [ 1119.092664][ T1033] usb 13-1: config 0 interface 119 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1119.113343][ T1033] usb 13-1: New USB device found, idVendor=05ac, idProduct=0292, bcdDevice=88.73 [ 1119.122554][ T1033] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1119.125304][ T1033] usb 13-1: Product: syz [ 1119.126944][ T1033] usb 13-1: Manufacturer: syz [ 1119.131858][ T1033] usb 13-1: SerialNumber: syz [ 1119.164004][ T1033] usb 13-1: config 0 descriptor?? [ 1119.167896][T22153] pim6reg: entered allmulticast mode [ 1119.175366][T22149] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1119.176493][T22153] pim6reg: left allmulticast mode [ 1119.222463][ T1033] input: bcm5974 as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.119/input/input410 [ 1119.234883][ T5129] usb 13-1: BOGUS urb xfer, pipe 1 != type 3 [ 1119.261734][T22153] loop7: detected capacity change from 0 to 7 [ 1119.369063][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x880700 phys_seg 1 prio class 2 [ 1119.372980][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1119.376501][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1119.381677][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1119.385191][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1119.389888][ C2] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 1119.393403][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1119.404706][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1119.411045][ C2] Buffer I/O error on dev loop7, logical block 0, async page read [ 1119.433302][ C0] bcm5974 13-1:0.119: trackpad urb failed: -1 [ 1119.544835][ C0] bcm5974 13-1:0.119: trackpad urb failed: -1 [ 1119.566378][ T1033] usb 13-1: USB disconnect, device number 15 [ 1121.126443][T22169] jffs2: notice: (22169) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1121.142088][T13640] usb 56-1: device descriptor read/8, error -110 [ 1121.143649][T22169] netlink: 8 bytes leftover after parsing attributes in process `syz.8.3935'. [ 1121.143664][T22169] netlink: 16 bytes leftover after parsing attributes in process `syz.8.3935'. [ 1121.262903][ T42] audit: type=1326 audit(2000000795.624:18217): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22173 comm="syz.9.3938" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70cefec code=0x0 [ 1121.324033][T22176] pim6reg: entered allmulticast mode [ 1121.327843][T22176] pim6reg: left allmulticast mode [ 1121.393098][T22178] loop7: detected capacity change from 0 to 7 [ 1122.315529][T13640] usb usb56-port1: attempt power cycle [ 1122.512446][T22190] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1122.936923][T22195] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1123.218620][T13640] usb usb56-port1: unable to enumerate USB device [ 1123.356783][T22201] FAULT_INJECTION: forcing a failure. [ 1123.356783][T22201] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1123.375522][T22201] CPU: 2 UID: 0 PID: 22201 Comm: syz.9.3945 Tainted: G L syzkaller #0 PREEMPT(full) [ 1123.375546][T22201] Tainted: [L]=SOFTLOCKUP [ 1123.375550][T22201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1123.375557][T22201] Call Trace: [ 1123.375563][T22201] [ 1123.375568][T22201] dump_stack_lvl+0x100/0x190 [ 1123.375590][T22201] should_fail_ex.cold+0x5/0xa [ 1123.375604][T22201] _copy_to_user+0x32/0xd0 [ 1123.375623][T22201] simple_read_from_buffer+0xcb/0x170 [ 1123.375646][T22201] proc_fail_nth_read+0x1af/0x230 [ 1123.375669][T22201] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1123.375687][T22201] ? rw_verify_area+0xce/0x6d0 [ 1123.375705][T22201] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1123.375722][T22201] vfs_read+0x1e4/0xb40 [ 1123.375736][T22201] ? __pfx_vfs_read+0x10/0x10 [ 1123.375746][T22201] ? find_held_lock+0x2b/0x80 [ 1123.375762][T22201] ? __fget_files+0x215/0x3d0 [ 1123.375777][T22201] ? __fget_files+0x21f/0x3d0 [ 1123.375792][T22201] ksys_read+0x12a/0x250 [ 1123.375803][T22201] ? __pfx_ksys_read+0x10/0x10 [ 1123.375819][T22201] do_int80_emulation+0x14b/0x720 [ 1123.375855][T22201] asm_int80_emulation+0x1a/0x20 [ 1123.375868][T22201] RIP: 0023:0xf72074eb [ 1123.375878][T22201] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1123.375891][T22201] RSP: 002b:00000000f54bd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1123.375905][T22201] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54bd5d0 [ 1123.375913][T22201] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1123.375920][T22201] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1123.375927][T22201] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1123.375934][T22201] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1123.375949][T22201] [ 1123.461697][T22204] jffs2: notice: (22204) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1123.511498][T22204] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3946'. [ 1123.521720][T22204] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3946'. [ 1126.057156][T22236] jffs2: notice: (22236) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1126.162924][T22236] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3957'. [ 1126.178420][T22236] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3957'. [ 1126.939491][T22244] netlink: 20 bytes leftover after parsing attributes in process `syz.9.3955'. [ 1127.241939][T22261] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3963'. [ 1127.341750][ T42] audit: type=1326 audit(2000000801.704:18218): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22258 comm="syz.2.3962" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fd6fec code=0x0 [ 1127.475422][T22267] netlink: zone id is out of range [ 1127.482860][T22267] netlink: zone id is out of range [ 1127.489114][T22267] netlink: zone id is out of range [ 1127.744044][T22275] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1127.857880][T22277] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1127.894351][T22278] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1129.885571][ T42] audit: type=1326 audit(2000000804.244:18219): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22292 comm="syz.7.3971" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf70befec code=0x0 [ 1130.994176][T22303] jffs2: notice: (22303) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 1131.084380][T22303] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3974'. [ 1131.089731][T22303] netlink: 24 bytes leftover after parsing attributes in process `syz.2.3974'. [ 1132.161756][T22308] FAULT_INJECTION: forcing a failure. [ 1132.161756][T22308] name failslab, interval 1, probability 0, space 9, times 0 [ 1132.215869][T22308] CPU: 2 UID: 0 PID: 22308 Comm: syz.8.3976 Tainted: G L syzkaller #0 PREEMPT(full) [ 1132.215905][T22308] Tainted: [L]=SOFTLOCKUP [ 1132.215909][T22308] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1132.215917][T22308] Call Trace: [ 1132.215922][T22308] [ 1132.215927][T22308] dump_stack_lvl+0x100/0x190 [ 1132.215946][T22308] should_fail_ex.cold+0x5/0xa [ 1132.215960][T22308] should_failslab+0xc2/0x120 [ 1132.215979][T22308] __kmalloc_noprof+0xfc/0x820 [ 1132.215994][T22308] ? rcu_is_watching+0x12/0xc0 [ 1132.216010][T22308] ? tomoyo_realpath_from_path+0xb6/0x690 [ 1132.216031][T22308] tomoyo_realpath_from_path+0xb6/0x690 [ 1132.216053][T22308] tomoyo_path_number_perm+0x23c/0x580 [ 1132.216067][T22308] ? tomoyo_path_number_perm+0x22e/0x580 [ 1132.216083][T22308] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1132.216098][T22308] ? get_pid_task+0x106/0x250 [ 1132.216128][T22308] ? find_held_lock+0x2b/0x80 [ 1132.216143][T22308] ? __fget_files+0x215/0x3d0 [ 1132.216155][T22308] ? hook_file_ioctl_common+0x140/0x440 [ 1132.216169][T22308] ? __fget_files+0x215/0x3d0 [ 1132.216187][T22308] ? __fget_files+0x21f/0x3d0 [ 1132.216200][T22308] security_file_ioctl_compat+0xd3/0x230 [ 1132.216217][T22308] __ia32_compat_sys_ioctl+0xc2/0x360 [ 1132.216238][T22308] __do_fast_syscall_32+0xe7/0x970 [ 1132.216256][T22308] ? lockdep_hardirqs_on+0x78/0x100 [ 1132.216273][T22308] do_fast_syscall_32+0x32/0x70 [ 1132.216291][T22308] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1132.216306][T22308] RIP: 0023:0xf709efec [ 1132.216321][T22308] Code: Unable to access opcode bytes at 0xf709efc2. [ 1132.216326][T22308] RSP: 002b:00000000f548d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1132.216366][T22308] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 000000000000ae41 [ 1132.216378][T22308] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1132.216384][T22308] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1132.216392][T22308] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1132.216398][T22308] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1132.216413][T22308] [ 1132.216653][T22308] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1133.212391][ T42] audit: type=1326 audit(2000000807.574:18220): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22315 comm="syz.8.3978" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf709efec code=0x0 [ 1133.620153][T22324] cramfs: checking physical address 0x00000000294c0000 for linear cramfs image [ 1133.626311][T22324] cramfs: wrong magic [ 1133.653509][T22324] cramfs: wrong magic [ 1133.895368][T22326] syzkaller1: entered promiscuous mode [ 1133.900432][T22326] syzkaller1: entered allmulticast mode [ 1240.025775][ C2] ------------[ cut here ]------------ [ 1240.029871][ C2] 1 [ 1240.029881][ C2] WARNING: kernel/rcu/tree_stall.h:1048 at rcu_check_gp_start_stall.part.0+0x1c4/0x4b0, CPU#2: syz.2.3982/22326 [ 1240.034808][ C2] Modules linked in: [ 1240.038113][ C2] CPU: 2 UID: 0 PID: 22326 Comm: syz.2.3982 Tainted: G L syzkaller #0 PREEMPT(full) [ 1240.042315][ C2] Tainted: [L]=SOFTLOCKUP [ 1240.044006][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1240.047657][ C2] RIP: 0010:rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 1240.049863][ C2] Code: 88 61 01 00 00 be 04 00 00 00 48 c7 c7 80 65 72 9b e8 10 1d 8b 00 b8 01 00 00 00 87 05 a5 27 84 19 85 c0 0f 85 3d 01 00 00 90 <0f> 0b 90 48 c7 c3 84 eb 21 91 48 81 fd 40 33 bf 8e 74 5a 48 b8 00 [ 1240.056710][ C2] RSP: 0018:ffffc90000538df0 EFLAGS: 00010046 [ 1240.059041][ C2] RAX: 0000000000000000 RBX: 0000000000002904 RCX: ffffffff81ee3dd0 [ 1240.062084][ C2] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff9b726580 [ 1240.064788][ C2] RBP: ffffffff8ebf3340 R08: 0000000000000001 R09: fffffbfff36e4cb0 [ 1240.067260][ C2] R10: 0000000000000003 R11: 0000000000000000 R12: 1ffffffff1d01e50 [ 1240.069751][ C2] R13: 0000000000000246 R14: 0000000000000020 R15: 0000000000000002 [ 1240.072262][ C2] FS: 0000000000000000(0000) GS:ffff888096df3000(0063) knlGS:00000000f5496b40 [ 1240.075060][ C2] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 1240.077375][ C2] CR2: 00000000f735d31c CR3: 0000000055c01000 CR4: 0000000000352ef0 [ 1240.080454][ C2] Call Trace: [ 1240.081768][ C2] [ 1240.082896][ C2] rcu_core+0x2cb/0x10d0 [ 1240.084563][ C2] ? sched_clock+0x38/0x60 [ 1240.086334][ C2] ? sched_clock_cpu+0x6c/0x570 [ 1240.088247][ C2] ? __pfx_rcu_core+0x10/0x10 [ 1240.090076][ C2] ? mark_held_locks+0x40/0x70 [ 1240.091955][ C2] handle_softirqs+0x1ea/0x9b0 [ 1240.093839][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 1240.095897][ C2] ? _raw_spin_unlock+0x28/0x50 [ 1240.097801][ C2] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 1240.099984][ C2] __irq_exit_rcu+0x162/0x210 [ 1240.101826][ C2] irq_exit_rcu+0x9/0x30 [ 1240.103482][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1240.105664][ C2] [ 1240.106821][ C2] [ 1240.107990][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1240.110314][ C2] RIP: 0010:smp_call_function_many_cond+0x5ab/0x1870 [ 1240.112665][ C2] Code: 01 c5 41 83 c4 03 e8 44 92 0c 00 f3 90 41 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 a8 10 00 00 8b 45 08 31 ff 83 e0 01 41 89 c6 <89> c6 e8 8e 8c 0c 00 45 85 f6 75 d0 e8 14 92 0c 00 e8 0f 92 0c 00 [ 1240.120009][ C2] RSP: 0018:ffffc900056079c8 EFLAGS: 00000202 [ 1240.122358][ C2] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffc90031f45000 [ 1240.125469][ C2] RDX: 0000000000080000 RSI: ffffffff81fd2ebc RDI: 0000000000000000 [ 1240.128643][ C2] RBP: ffff88802b243360 R08: 0000000000000005 R09: 0000000000000000 [ 1240.131765][ C2] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003 [ 1240.134897][ C2] R13: ffffed100564866d R14: 0000000000000001 R15: ffff88802b43c9c0 [ 1240.138035][ C2] ? smp_call_function_many_cond+0x58c/0x1870 [ 1240.140469][ C2] ? smp_call_function_many_cond+0x58c/0x1870 [ 1240.142887][ C2] ? __pfx_retrigger_next_event+0x10/0x10 [ 1240.145164][ C2] ? clock_was_set+0x1c3/0x850 [ 1240.147090][ C2] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 1240.149601][ C2] ? find_held_lock+0x2b/0x80 [ 1240.151493][ C2] ? mark_held_locks+0x40/0x70 [ 1240.153377][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1240.155253][ C2] clock_was_set+0x61c/0x850 [ 1240.156757][ C2] ? __pfx_clock_was_set+0x10/0x10 [ 1240.158375][ C2] do_adjtimex+0x302/0x370 [ 1240.159785][ C2] ? __pfx_do_adjtimex+0x10/0x10 [ 1240.161358][ C2] ? __pfx_posix_clock_realtime_adj+0x10/0x10 [ 1240.163282][ C2] __do_sys_clock_adjtime32+0x1c4/0x280 [ 1240.165021][ C2] ? __pfx___do_sys_clock_adjtime32+0x10/0x10 [ 1240.166939][ C2] ? __pfx_do_futex+0x10/0x10 [ 1240.168431][ C2] ? __pfx_do_sys_openat2+0x10/0x10 [ 1240.170089][ C2] __do_fast_syscall_32+0xe7/0x970 [ 1240.171708][ C2] ? lockdep_hardirqs_on+0x78/0x100 [ 1240.173356][ C2] do_fast_syscall_32+0x32/0x70 [ 1240.174920][ C2] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1240.176939][ C2] RIP: 0023:0xf7fd6fec [ 1240.178246][ C2] Code: Unable to access opcode bytes at 0xf7fd6fc2. [ 1240.180751][ C2] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000157 [ 1240.183772][ C2] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000340 [ 1240.186259][ C2] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1240.188734][ C2] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1240.191173][ C2] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1240.193608][ C2] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1240.196085][ C2] [ 1240.197073][ C2] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1240.199320][ C2] CPU: 2 UID: 0 PID: 22326 Comm: syz.2.3982 Tainted: G L syzkaller #0 PREEMPT(full) [ 1240.202670][ C2] Tainted: [L]=SOFTLOCKUP [ 1240.204331][ C2] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1240.208064][ C2] Call Trace: [ 1240.209406][ C2] [ 1240.210562][ C2] dump_stack_lvl+0x100/0x190 [ 1240.212436][ C2] vpanic+0x552/0x970 [ 1240.213793][ C2] ? __pfx_vpanic+0x10/0x10 [ 1240.215245][ C2] panic+0xd1/0xe0 [ 1240.216504][ C2] ? __pfx_panic+0x10/0x10 [ 1240.218021][ C2] ? check_panic_on_warn+0x1f/0x90 [ 1240.219635][ C2] check_panic_on_warn.cold+0x19/0x34 [ 1240.221329][ C2] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 1240.223306][ C2] __warn.cold+0x191/0x318 [ 1240.224711][ C2] __report_bug+0x30f/0x440 [ 1240.226150][ C2] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 1240.228151][ C2] ? __pfx___report_bug+0x10/0x10 [ 1240.229725][ C2] ? mark_held_locks+0x40/0x70 [ 1240.231259][ C2] ? __lock_acquire+0x49f/0x1a40 [ 1240.232841][ C2] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 1240.234766][ C2] report_bug+0xb2/0x220 [ 1240.236122][ C2] ? rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 1240.238104][ C2] handle_bug+0x16a/0x2a0 [ 1240.239469][ C2] exc_invalid_op+0x17/0x50 [ 1240.240926][ C2] asm_exc_invalid_op+0x1a/0x20 [ 1240.242459][ C2] RIP: 0010:rcu_check_gp_start_stall.part.0+0x1c4/0x4b0 [ 1240.244642][ C2] Code: 88 61 01 00 00 be 04 00 00 00 48 c7 c7 80 65 72 9b e8 10 1d 8b 00 b8 01 00 00 00 87 05 a5 27 84 19 85 c0 0f 85 3d 01 00 00 90 <0f> 0b 90 48 c7 c3 84 eb 21 91 48 81 fd 40 33 bf 8e 74 5a 48 b8 00 [ 1240.250577][ C2] RSP: 0018:ffffc90000538df0 EFLAGS: 00010046 [ 1240.252480][ C2] RAX: 0000000000000000 RBX: 0000000000002904 RCX: ffffffff81ee3dd0 [ 1240.254936][ C2] RDX: 0000000000000001 RSI: 0000000000000004 RDI: ffffffff9b726580 [ 1240.257423][ C2] RBP: ffffffff8ebf3340 R08: 0000000000000001 R09: fffffbfff36e4cb0 [ 1240.259886][ C2] R10: 0000000000000003 R11: 0000000000000000 R12: 1ffffffff1d01e50 [ 1240.262338][ C2] R13: 0000000000000246 R14: 0000000000000020 R15: 0000000000000002 [ 1240.264800][ C2] ? rcu_check_gp_start_stall.part.0+0x1b0/0x4b0 [ 1240.266804][ C2] rcu_core+0x2cb/0x10d0 [ 1240.268149][ C2] ? sched_clock+0x38/0x60 [ 1240.269545][ C2] ? sched_clock_cpu+0x6c/0x570 [ 1240.271064][ C2] ? __pfx_rcu_core+0x10/0x10 [ 1240.272552][ C2] ? mark_held_locks+0x40/0x70 [ 1240.274066][ C2] handle_softirqs+0x1ea/0x9b0 [ 1240.275566][ C2] ? __pfx_handle_softirqs+0x10/0x10 [ 1240.277254][ C2] ? _raw_spin_unlock+0x28/0x50 [ 1240.278775][ C2] ? __hrtimer_rearm_deferred+0x9b/0x720 [ 1240.280520][ C2] __irq_exit_rcu+0x162/0x210 [ 1240.281999][ C2] irq_exit_rcu+0x9/0x30 [ 1240.283454][ C2] sysvec_apic_timer_interrupt+0xa3/0xc0 [ 1240.285220][ C2] [ 1240.286161][ C2] [ 1240.287146][ C2] asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1240.289021][ C2] RIP: 0010:smp_call_function_many_cond+0x5ab/0x1870 [ 1240.291085][ C2] Code: 01 c5 41 83 c4 03 e8 44 92 0c 00 f3 90 41 0f b6 45 00 41 38 c4 7c 08 84 c0 0f 85 a8 10 00 00 8b 45 08 31 ff 83 e0 01 41 89 c6 <89> c6 e8 8e 8c 0c 00 45 85 f6 75 d0 e8 14 92 0c 00 e8 0f 92 0c 00 [ 1240.297046][ C2] RSP: 0018:ffffc900056079c8 EFLAGS: 00000202 [ 1240.298940][ C2] RAX: 0000000000000001 RBX: 0000000000000000 RCX: ffffc90031f45000 [ 1240.301315][ C2] RDX: 0000000000080000 RSI: ffffffff81fd2ebc RDI: 0000000000000000 [ 1240.303754][ C2] RBP: ffff88802b243360 R08: 0000000000000005 R09: 0000000000000000 [ 1240.306199][ C2] R10: 0000000000000001 R11: 0000000000000000 R12: 0000000000000003 [ 1240.308611][ C2] R13: ffffed100564866d R14: 0000000000000001 R15: ffff88802b43c9c0 [ 1240.310904][ C2] ? smp_call_function_many_cond+0x58c/0x1870 [ 1240.312810][ C2] ? smp_call_function_many_cond+0x58c/0x1870 [ 1240.314713][ C2] ? __pfx_retrigger_next_event+0x10/0x10 [ 1240.316531][ C2] ? clock_was_set+0x1c3/0x850 [ 1240.318037][ C2] ? __pfx_smp_call_function_many_cond+0x10/0x10 [ 1240.320024][ C2] ? find_held_lock+0x2b/0x80 [ 1240.321506][ C2] ? mark_held_locks+0x40/0x70 [ 1240.323016][ C2] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1240.324848][ C2] clock_was_set+0x61c/0x850 [ 1240.326309][ C2] ? __pfx_clock_was_set+0x10/0x10 [ 1240.327916][ C2] do_adjtimex+0x302/0x370 [ 1240.329320][ C2] ? __pfx_do_adjtimex+0x10/0x10 [ 1240.330871][ C2] ? __pfx_posix_clock_realtime_adj+0x10/0x10 [ 1240.332775][ C2] __do_sys_clock_adjtime32+0x1c4/0x280 [ 1240.334523][ C2] ? __pfx___do_sys_clock_adjtime32+0x10/0x10 [ 1240.336444][ C2] ? __pfx_do_futex+0x10/0x10 [ 1240.337923][ C2] ? __pfx_do_sys_openat2+0x10/0x10 [ 1240.339554][ C2] __do_fast_syscall_32+0xe7/0x970 [ 1240.341022][ C2] ? lockdep_hardirqs_on+0x78/0x100 [ 1240.342660][ C2] do_fast_syscall_32+0x32/0x70 [ 1240.344216][ C2] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1240.346188][ C2] RIP: 0023:0xf7fd6fec [ 1240.347488][ C2] Code: Unable to access opcode bytes at 0xf7fd6fc2. [ 1240.349557][ C2] RSP: 002b:00000000f549650c EFLAGS: 00000292 ORIG_RAX: 0000000000000157 [ 1240.352149][ C2] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080000340 [ 1240.354613][ C2] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1240.357103][ C2] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1240.359546][ C2] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1240.362003][ C2] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1240.364464][ C2] [ 1241.445675][ C2] Shutting down cpus with NMI [ 1241.447864][ C2] Kernel Offset: disabled [ 1241.449246][ C2] Rebooting in 86400 seconds..