last executing test programs: 2m5.088614363s ago: executing program 2 (id=2933): bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@tracing={0x0, 0x7}}, 0x20) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r1) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000}) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) capset(&(0x7f0000000080)={0x20080522}, &(0x7f00000000c0)={0x200000, 0x200000, 0x7}) sendmmsg$unix(r2, &(0x7f00000254c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000a0}}, {{&(0x7f0000001580)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x40042}}], 0x2, 0x0) stat(&(0x7f0000000180)='./file0\x00', &(0x7f00000002c0)) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000000)=0x1) 2m4.952415507s ago: executing program 2 (id=2934): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') getdents64(r0, &(0x7f0000001e80)=""/4118, 0x1016) (fail_nth: 10) 2m4.951978134s ago: executing program 2 (id=2935): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x620, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x5ec, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0xf8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_DATA={0xd4, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x62, 0x1, "5fdeaf0b506a222c6fa182bc2f7a836b103478b44a83b60d94852401578daff349ad6c3148a691075fbfd4066fd5205547f9f9151d2ad5f9c6806ad1fac3523f6b2fb426e6a45da1921f99881c09699d2940fb9f4c2b24a8dc88409c9cc9"}]}]}, {0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0x13c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x138, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0xbb, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff5201be66172808e4c09adcbc90ba24a050e9cc3dd901"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x380, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xe5, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b8647c48fecb31ccd3d6175aaf84978c553c69065430c3f9f46da1c07432400"}, @NFTA_SET_ELEM_DATA={0x230, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9c, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e043"}, @NFTA_DATA_VALUE={0x5b, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8e33d210b4b61a73d50f3150dc40aef8f1796e9aab4"}, @NFTA_DATA_VALUE={0x55, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x53, 0x1, "ffff1cd393f78383fb2852a5cb3e61fcc84727de0cc0ba7d7e6eb4d1bd7667bdfc27962424197d9115bbc90780793c26f90fd7e85d20085821164378300042280d6fdb339c991fea7704d724168ae2"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_DELCHAIN={0x60, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x7b0}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0xbd}]}, &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) r5 = socket(0x2d, 0x2, 0x0) bind$xdp(r5, &(0x7f0000000080)={0x2d, 0x0, r4, 0xc}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x20050800) socket(0x2d, 0x2, 0x0) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 2m4.02207665s ago: executing program 2 (id=2938): socket$nl_route(0x10, 0x3, 0x0) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x151) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./dev\x00', 0x151) mount(0x0, &(0x7f00000001c0)='./dev\x00', &(0x7f0000000200)='devtmpfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./dev/sda\x00', 0x2, 0x0) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000340)={0xa, 0x4, 0x14}) (async) ioctl$IOC_PR_RELEASE(r1, 0x401070ca, &(0x7f0000000340)={0xa, 0x4, 0x14}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) fsopen(&(0x7f0000000080)='autofs\x00', 0x0) (async) r4 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) write$tun(r3, &(0x7f0000000380)=ANY=[], 0xfdef) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff) mount(&(0x7f0000000100)=@filename='none\x00', &(0x7f0000000000)='./debug\x00', &(0x7f0000000200)='debugfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./debug/o2net/connected_nodes\x00', 0x0, 0x0) read(r5, &(0x7f0000000400)=""/4096, 0x1000) (async) read(r5, &(0x7f0000000400)=""/4096, 0x1000) close(r5) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r6, 0x8933, &(0x7f0000000180)={'wpan4\x00'}) fsmount(r4, 0x0, 0x2) (async) r7 = fsmount(r4, 0x0, 0x2) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r8, r8) setpgid(0x0, r8) (async) setpgid(0x0, r8) clock_gettime(0x0, &(0x7f0000000380)={0x0, 0x0}) utimensat(r3, &(0x7f0000000280)='none\x00', &(0x7f00000003c0)={{0x77359400}, {r9, r10/1000+10000}}, 0x0) fchdir(r7) lstat(&(0x7f00000001c0)='./file0\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x2}) (async) fcntl$lock(0xffffffffffffffff, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x2}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r11, 0x1, &(0x7f0000000040)={{0x0, 0x3938700}, {0x0, 0x989680}}, 0x0) sendmsg$nl_route(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000001400)=@newlink={0x17c, 0x10, 0x401, 0x2040000, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x6024b, 0x18a1}, [@IFLA_LINK={0x8, 0x5, r2}, @IFLA_VF_PORTS={0x13c, 0x18, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, [@IFLA_PORT_REQUEST={0x5, 0x6, 0x8}, @IFLA_PORT_PROFILE={0x9, 0x2, '@)\'@\x00'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xc9}]}, {0x4c, 0x1, 0x0, 0x1, [@IFLA_PORT_PROFILE={0x6, 0x2, ',\x00'}, @IFLA_PORT_VF={0x8, 0x1, 0xdb8}, @IFLA_PORT_PROFILE={0xc, 0x2, 'debugfs\x00'}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x1}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "04514bee7413a6f2eb0698d13c5680a0"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0xe7}, @IFLA_PORT_PROFILE={0x6, 0x2, '-\x00'}]}, {0x4}, {0x5c, 0x1, 0x0, 0x1, [@IFLA_PORT_VF={0x8, 0x1, 0x7}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "6c5585b23a09399c217730482bdfa1d0"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "f428e0134e4d57e361e982b3910320a9"}, @IFLA_PORT_REQUEST={0x5, 0x6, 0x1}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "5bdd5799bd346ef1a2b4fee896a2248c"}, @IFLA_PORT_PROFILE={0xc, 0x2, 'bridge0\x00'}]}, {0x6c, 0x1, 0x0, 0x1, [@IFLA_PORT_HOST_UUID={0x14, 0x5, "ed57d42ab906362d9cc7f6864df7c6b1"}, @IFLA_PORT_VF={0x8, 0x1, 0x1d}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "102f5851a33387c3cb00"}, @IFLA_PORT_HOST_UUID={0x14, 0x5, "7e8dd4e1e8439d39a44809abdf8d4a58"}, @IFLA_PORT_VF={0x8, 0x1, 0x95f}, @IFLA_PORT_VF={0x8, 0x1, 0x8001}, @IFLA_PORT_INSTANCE_UUID={0x14, 0x4, "3f93d15229014dbabf4481fe61088aff"}]}]}, @IFLA_MASTER={0x8, 0xa, r2}, @IFLA_TXQLEN={0x8, 0xd, 0x80}, @IFLA_LINK_NETNSID={0x8, 0x25, 0x3ff}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000004}, 0x0) 2m3.849534456s ago: executing program 2 (id=2940): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100001040000000000dde4", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r3, 0xab00, r4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r5, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x7) socket$packet(0x11, 0x2, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB="400000000008004280040008000c00018006060000800a00001800028014000c0020010000000000000000080000000000f3097f7394fac547ba7e96c73a5b80a436170bacfb0d766fd0ac5ab33d58b59384b0c346acc6cd7362abe16960d0220dc6772045bf6ac53762bf3c8a02f253cda1f4fdbdacc9e0e9760661c6a0ba73a36fea0bfeae53d0fd6abbbffa572260dc6c28aa1649e32513373746df73729b532316dd4b29a3a9228a16bad391c0b961a68e8a87bd14f4876d298e35bf5a8c2da2e18f644033f6d3f4637b9aa0418d3e985b799a058105bda6dffcd2305039489d2d4712ecf9180fe3867339bd707d03a02a5aa92a07817877fa70b0832115"], 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x5, 0xb, 0x6, 0x86}) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000280)={0x9}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_PIT(r8, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0x8}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xb, 0x0, 0x3, 0x6, 0x7f, 0x6}, {0x0, 0x0, 0x38, 0xef, 0x84, 0x7, 0x92, 0x54, 0x0, 0x5, 0x4, 0x7, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, r10) sendmsg$NLBL_MGMT_C_ADD(r10, &(0x7f0000002c40)={0x0, 0xffffffffffffffd2, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYRES16=0x0, @ANYRES16=r11, @ANYRESDEC=r9], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000037000501f3fffffffedbd725017c000008000800", @ANYRES32=r12, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 2m3.590586898s ago: executing program 2 (id=2942): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc044) write(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x104008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r1 = syz_create_resource$binfmt(&(0x7f0000000100)='./file1\x00') execveat$binfmt(0xffffffffffffff9c, r1, 0x0, &(0x7f0000004780)={[], 0xf000}, 0x1000) r2 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r2, &(0x7f00000001c0)={0x18, 0x2, {0x0, @empty}}, 0x1e) 2m3.452378537s ago: executing program 32 (id=2942): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0xc044) write(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x104008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x0) getrandom(&(0x7f0000000240)=""/286, 0xffffff9a, 0x0) r1 = syz_create_resource$binfmt(&(0x7f0000000100)='./file1\x00') execveat$binfmt(0xffffffffffffff9c, r1, 0x0, &(0x7f0000004780)={[], 0xf000}, 0x1000) r2 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r2, &(0x7f00000001c0)={0x18, 0x2, {0x0, @empty}}, 0x1e) 8.142371123s ago: executing program 4 (id=3401): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x628, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x5f4, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x100, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_DATA={0xdc, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x54, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x62, 0x1, "5fdeaf0b506a222c6fa182bc2f7a836b103478b44a83b60d94852401578daff349ad6c3148a691075fbfd4066fd5205547f9f9151d2ad5f9c6806ad1fac3523f6b2fb426e6a45da1921f99881c09699d2940fb9f4c2b24a8dc88409c9cc9"}]}]}, {0x18, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0x13c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x138, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0xbb, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff5201be66172808e4c09adcbc90ba24a050e9cc3dd901"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x380, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xe5, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b8647c48fecb31ccd3d6175aaf84978c553c69065430c3f9f46da1c07432400"}, @NFTA_SET_ELEM_DATA={0x230, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9c, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e043"}, @NFTA_DATA_VALUE={0x5b, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8e33d210b4b61a73d50f3150dc40aef8f1796e9aab4"}, @NFTA_DATA_VALUE={0x55, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x53, 0x1, "ffff1cd393f78383fb2852a5cb3e61fcc84727de0cc0ba7d7e6eb4d1bd7667bdfc27962424197d9115bbc90780793c26f90fd7e85d20085821164378300042280d6fdb339c991fea7704d724168ae2"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_DELCHAIN={0x60, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x7b8}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0xbd}]}, &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) r5 = socket(0x2d, 0x2, 0x0) bind$xdp(r5, &(0x7f0000000080)={0x2d, 0x0, r4, 0xc}, 0x10) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x20050800) socket(0x2d, 0x2, 0x0) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 7.208034091s ago: executing program 4 (id=3403): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x11, 0x5, &(0x7f0000000300)=ANY=[@ANYRESOCT=0x0], &(0x7f0000000240)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffffe}, 0x94) ioctl$DMA_HEAP_IOCTL_ALLOC(0xffffffffffffffff, 0xc0184800, &(0x7f0000000000)={0xf, r0, 0x4b36baea9e1c7e99}) syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_MESH(r1, &(0x7f0000000340)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYRES32=r0, @ANYBLOB="000126bd700001b133d62ec562bab7670a5b99ea33d7"], 0x1c}, 0x1, 0x0, 0x0, 0x4}, 0x20048004) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000100)=@req={0x3fd, 0x0, 0x3, 0x3}, 0x10) recvmmsg(r2, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000040)=""/36, 0x24}], 0x1}, 0x4}], 0x1, 0x400101a0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./tracing/per_cpu/cpu0/trace_pipe_raw\x00', 0x0, 0x0) r4 = syz_io_uring_setup(0x690e, &(0x7f0000000640)={0x0, 0x12d8, 0x400, 0x3, 0x375}, &(0x7f00000001c0)=0x0, &(0x7f00000002c0)=0x0, &(0x7f0000000400)=0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x34000, 0x0) ioctl$FE_GET_PROPERTY(0xffffffffffffffff, 0x80106f53, &(0x7f0000000040)={0x30, 0x0}) syz_io_uring_submit(r5, r6, r7, &(0x7f0000000040)=@IORING_OP_CLOSE={0x13, 0x48, 0x0, r4}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x400400, 0x4) ioctl$LOOP_GET_STATUS(r3, 0x4c03, &(0x7f0000000440)) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r8 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r8, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0) write$binfmt_register(r9, &(0x7f0000000040)={0x3a, 'syz2', 0x3a, 'E', 0x3a, 0x0, 0x3a, 'tracefs\x00', 0x3a, '*:@{\':', 0x3a, './trace'}, 0x35) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0xc, 0x11, r3, 0xffffe000) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) 7.207641963s ago: executing program 1 (id=3404): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x20000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@newqdisc={0x90, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2a, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x60, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [0xe, 0x0, 0xc], 0x0, [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffa], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}]}, 0x90}}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000002000000000000000600000000000070a11173857249d8881937ecfbd3cde5a9810000009500ff01"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$sndseq(0xffffff9c, &(0x7f00000005c0), 0x668080) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a45320, &(0x7f00000000c0)={{0x80}, 'port1\x00', 0x0, 0x150014, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7}) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @name="a13c4dacaace7477f3f8f1d68f8a0c4a4b407126d4a332ea110a356827492a5c"}) r6 = add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="3800000010000108fdffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008001b"], 0x38}}, 0x0) sendmmsg$alg(r7, &(0x7f0000000140), 0x4924b68, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x1, 0x41) connect$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r9 = fcntl$dupfd(r8, 0x406, r8) write$binfmt_elf64(r9, &(0x7f0000000340)=ANY=[@ANYRESOCT=r5, @ANYRES64=r8, @ANYRES32=r8, @ANYRESDEC, @ANYRES64, @ANYRES64=r6, @ANYRES8=r1], 0xfffffdcf) 6.277232217s ago: executing program 1 (id=3406): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x4a0, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x46c, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x4}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x26d}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0xec, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0xe8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa6, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff52"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x338, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xc6, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b"}, @NFTA_SET_ELEM_DATA={0x208, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9d, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e04369"}, @NFTA_DATA_VALUE={0x46, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8"}, @NFTA_DATA_VALUE={0xa0, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7daee2b24a3a1e046d50f9da29ebd7751c269a7f3d1ae12330e0144099c658e7f06c4f649470bbea3418964d4150d095e856424488f3e6ecbf9df26f68c29fd03bb5b7c99094f4150af52e6"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x4}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x5d0}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0xbd}]}, &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) r4 = socket(0x2d, 0x2, 0x0) bind$xdp(r4, &(0x7f0000000080)={0x2d, 0x0, r3, 0xc}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x94}}, 0x20050800) r6 = socket(0x2d, 0x2, 0x0) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 6.20274544s ago: executing program 4 (id=3407): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) ioctl$AUTOFS_DEV_IOCTL_READY(0xffffffffffffffff, 0xc0189376, &(0x7f0000000140)={{0x1, 0x1, 0x18, r0, {0x6}}, './file0\x00'}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getsockname$unix(r3, &(0x7f0000000400)=@abs, &(0x7f00000004c0)=0x6e) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x20, 0x0, &(0x7f0000000280)) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x80400, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000440)=ANY=[], 0x24}}, 0x0) r6 = socket(0x10, 0x3, 0x0) write(r6, &(0x7f0000000580)="240000001e005f031400ff01000000f80700b3586ff606c2e553797c080008e467dc0000", 0x24) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="0b0000001f0000000200000022bf000001000000", @ANYRES32, @ANYBLOB="08000000dd0000000000", @ANYRES32=0x0, @ANYRES32], 0x50) r8 = socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(r8, &(0x7f0000000080)={&(0x7f0000000100)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @local}}, 0x80, 0x0, 0x0, &(0x7f0000001240)}, 0x40) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000300), &(0x7f0000000400), 0x401, r7, 0x0, 0xa002a0}, 0x38) r9 = socket$l2tp6(0xa, 0x2, 0x73) connect$l2tp6(r9, 0x0, 0x0) 6.193211737s ago: executing program 0 (id=3408): r0 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) r1 = add_key(&(0x7f0000000040)='pkcs7_test\x00', 0x0, &(0x7f0000000140)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0cecfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b6090782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312f178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad195768dec9edd0b159764ade5f26202fc9e5f56423905b300"/1364, 0x554, r0) prctl$PR_SET_PTRACER(0x59616d61, 0x0) mmap$IORING_OFF_SQ_RING(0x0, 0x10, 0x2, 0x10, 0xffffffffffffffff, 0x0) keyctl$KEYCTL_PKEY_ENCRYPT(0x19, &(0x7f0000000080)={r1, 0x4, 0x37}, 0x0, &(0x7f0000005840)="00000002", 0x0) 6.123795887s ago: executing program 0 (id=3409): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100001040000000000dde40000000000", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r3, 0xab00, r4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r5, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x7) socket$packet(0x11, 0x2, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x5, 0xb, 0x6, 0x86}) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000280)={0x9}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_PIT(r8, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0x8}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xb, 0x0, 0x3, 0x6, 0x7f, 0x6}, {0x0, 0x0, 0x38, 0xef, 0x84, 0x7, 0x92, 0x54, 0x0, 0x5, 0x4, 0x7, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, r10) sendmsg$NLBL_MGMT_C_ADD(r10, &(0x7f0000002c40)={0x0, 0xffffffffffffffd2, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYRES16=0x0, @ANYRES16=r11, @ANYRESDEC=r9], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000037000501f3fffffffedbd725017c000008000800", @ANYRES32=r12, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 5.874220718s ago: executing program 0 (id=3410): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x6d4, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x6a0, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0xf8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_DATA={0xd4, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x62, 0x1, "5fdeaf0b506a222c6fa182bc2f7a836b103478b44a83b60d94852401578daff349ad6c3148a691075fbfd4066fd5205547f9f9151d2ad5f9c6806ad1fac3523f6b2fb426e6a45da1921f99881c09699d2940fb9f4c2b24a8dc88409c9cc9"}]}]}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x26d}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0x140, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x13c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0xbd, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff5201be66172808e4c09adcbc90ba24a050e9cc3dd9010f28"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x424, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xe5, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b8647c48fecb31ccd3d6175aaf84978c553c69065430c3f9f46da1c07432400"}, @NFTA_SET_ELEM_DATA={0x2d4, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9d, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e04369"}, @NFTA_DATA_VALUE={0x5b, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8e33d210b4b61a73d50f3150dc40aef8f1796e9aab4"}, @NFTA_DATA_VALUE={0xa5, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7daee2b24a3a1e046d50f9da29ebd7751c269a7f3d1ae12330e0144099c658e7f06c4f649470bbea3418964d4150d095e856424488f3e6ecbf9df26f68c29fd03bb5b7c99094f4150af52e6f4d67b75a6"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0xa2, 0x1, "ffff1cd393f78383fb2852a5cb3e61fcc84727de0cc0ba7d7e6eb4d1bd7667bdfc27962424197d9115bbc90780793c26f90fd7e85d20085821164378300042280d6fdb339c991fea7704d724168ae2e838716ac67dea6bf27dceb06dbb5864ac4cdd7b5b3992ef89d77f26b0113d52ea436874029f42f50319873bbcd768e334c7a5cdfb554337971d63d1f8ad7de07a72ca1a00742fe12b6019772b0615"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_DELCHAIN={0x60, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x864}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) bind$xdp(0xffffffffffffffff, &(0x7f0000000080)={0x2d, 0x0, r4, 0xc}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x20050800) r6 = socket(0x2d, 0x2, 0x0) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 4.777976581s ago: executing program 0 (id=3412): syz_usb_connect(0x5, 0x4e, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000200000040cd06350100010000000109023c0001010080"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000003c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000640)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x28, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, 0x0) socket$phonet_pipe(0x23, 0x5, 0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./trace/events/sched/sched_switch/trigger\x00', 0x2, 0x0) write(r3, &(0x7f0000000180)='enable_event:sched:', 0x13) 4.776627443s ago: executing program 1 (id=3413): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000002100)=0x0) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5, r0}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) process_madvise(0xffffffffffffffff, &(0x7f0000000080)=[{&(0x7f0000000000)='\x00', 0x1}], 0x10000000000002cc, 0x14, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r1 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000344000/0x4000)=nil, 0x4000, 0x1) fcntl$lock(r1, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x0, 0xfffe}) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r2 = fanotify_init(0x200, 0x0) writev(r2, &(0x7f0000000380)=[{&(0x7f0000000240)="e0335d1583aaa5d4", 0x8}], 0x1) r3 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x105c40, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(r6, 0xc040aed5, &(0x7f0000000040)={0x10000, 0x1f000}) r7 = openat$userfaultfd(0xffffff9c, &(0x7f0000000140), 0x80801, 0x0) ioctl$FAT_IOCTL_SET_ATTRIBUTES(r7, 0x40047211, &(0x7f0000000180)) r8 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r8, 0x7a7, &(0x7f0000000100)=0x80000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r8, 0x7a0, &(0x7f0000000140)={@my=0x0}) r9 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x20846, 0x12) truncate(&(0x7f0000000180)='./file0\x00', 0x8fff5) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1, 0x10012, r9, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r8, 0x7a8, &(0x7f0000000040)={{@my=0x1, 0xffffffff}, @any, 0x9, 0x0, 0x7, 0x0, 0x0, 0x0, 0xfffffffc}) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_default\x00', 0x0, 0x0, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x8, &(0x7f00000004c0)=ANY=[@ANYBLOB="1809000000000000000000000001000018120000", @ANYRES32, @ANYBLOB="0000000000000000b703000000000000850000000c000000b700000000000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x7a44, 0x1700) 4.36826745s ago: executing program 1 (id=3415): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x4a0, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x46c, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x4}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x26d}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0xec, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0xe8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa6, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff52"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x338, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xc6, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b"}, @NFTA_SET_ELEM_DATA={0x208, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9d, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e04369"}, @NFTA_DATA_VALUE={0x46, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8"}, @NFTA_DATA_VALUE={0xa0, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7daee2b24a3a1e046d50f9da29ebd7751c269a7f3d1ae12330e0144099c658e7f06c4f649470bbea3418964d4150d095e856424488f3e6ecbf9df26f68c29fd03bb5b7c99094f4150af52e6"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x4}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x5d0}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0xbd}]}, &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) r4 = socket(0x2d, 0x2, 0x0) bind$xdp(r4, &(0x7f0000000080)={0x2d, 0x0, r3, 0xc}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x94}}, 0x20050800) r6 = socket(0x2d, 0x2, 0x0) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 4.367686388s ago: executing program 4 (id=3416): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x6d0, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x69c, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0xf4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_DATA={0xd0, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x62, 0x1, "5fdeaf0b506a222c6fa182bc2f7a836b103478b44a83b60d94852401578daff349ad6c3148a691075fbfd4066fd5205547f9f9151d2ad5f9c6806ad1fac3523f6b2fb426e6a45da1921f99881c09699d2940fb9f4c2b24a8dc88409c9cc9"}]}]}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x26d}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0x140, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x13c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0xbd, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff5201be66172808e4c09adcbc90ba24a050e9cc3dd9010f28"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x424, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xe5, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b8647c48fecb31ccd3d6175aaf84978c553c69065430c3f9f46da1c07432400"}, @NFTA_SET_ELEM_DATA={0x2d4, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9d, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e04369"}, @NFTA_DATA_VALUE={0x5b, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8e33d210b4b61a73d50f3150dc40aef8f1796e9aab4"}, @NFTA_DATA_VALUE={0xa5, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7daee2b24a3a1e046d50f9da29ebd7751c269a7f3d1ae12330e0144099c658e7f06c4f649470bbea3418964d4150d095e856424488f3e6ecbf9df26f68c29fd03bb5b7c99094f4150af52e6f4d67b75a6"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0xa2, 0x1, "ffff1cd393f78383fb2852a5cb3e61fcc84727de0cc0ba7d7e6eb4d1bd7667bdfc27962424197d9115bbc90780793c26f90fd7e85d20085821164378300042280d6fdb339c991fea7704d724168ae2e838716ac67dea6bf27dceb06dbb5864ac4cdd7b5b3992ef89d77f26b0113d52ea436874029f42f50319873bbcd768e334c7a5cdfb554337971d63d1f8ad7de07a72ca1a00742fe12b6019772b0615"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_DELCHAIN={0x60, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x860}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) bind$xdp(0xffffffffffffffff, &(0x7f0000000080)={0x2d, 0x0, r4, 0xc}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x20050800) r6 = socket(0x2d, 0x2, 0x0) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 3.869485264s ago: executing program 3 (id=3417): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x20000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@newqdisc={0x90, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2a, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x60, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [0xe, 0x0, 0xc], 0x0, [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffa], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}]}, 0x90}}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000002000000000000000600000000000070a11173857249d8881937ecfbd3cde5a9810000009500ff01"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$sndseq(0xffffff9c, &(0x7f00000005c0), 0x668080) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a45320, &(0x7f00000000c0)={{0x80}, 'port1\x00', 0x0, 0x150014, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7}) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @name="a13c4dacaace7477f3f8f1d68f8a0c4a4b407126d4a332ea110a356827492a5c"}) r6 = add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="3800000010000108fdffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008001b"], 0x38}}, 0x0) sendmmsg$alg(r7, &(0x7f0000000140), 0x4924b68, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r8, 0x0, 0x0) connect$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r9 = fcntl$dupfd(r8, 0x406, r8) write$binfmt_elf64(r9, &(0x7f0000000340)=ANY=[@ANYRESOCT=r5, @ANYRES64=r8, @ANYRES32=r8, @ANYRESDEC, @ANYRES64, @ANYRES64=r6, @ANYRES8=r1], 0xfffffdcf) 2.907230111s ago: executing program 3 (id=3418): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000680)={'bridge0\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="48000000100001040000000000dde40000000000", @ANYRES32=r2, @ANYBLOB="3f00000006020400280012800b0001006272696467650000180002800c002e0003000000030000000500070008"], 0x48}, 0x1, 0x0, 0x0, 0x44000}, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r3 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) ioctl$NBD_SET_SOCK(r3, 0xab00, r4) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r5, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r5, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r5, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm, @window, @sack_perm, @timestamp, @timestamp, @timestamp, @timestamp], 0x7) socket$packet(0x11, 0x2, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=ANY=[@ANYBLOB], 0x40}, 0x1, 0x0, 0x0, 0x4048011}, 0xc0d4) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$DVB_DVR_DMX_DQBUF(0xffffffffffffffff, 0xc0186f40, &(0x7f0000000040)={0x1, 0x20000000, 0x5, 0xb, 0x6, 0x86}) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000280)={0x9}) r9 = ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) ioctl$KVM_SET_PIT(r8, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0x8}, {0x804, 0x1, 0x1, 0x45, 0xff, 0x6, 0x2, 0xb, 0x0, 0x3, 0x6, 0x7f, 0x6}, {0x0, 0x0, 0x38, 0xef, 0x84, 0x7, 0x92, 0x54, 0x0, 0x5, 0x4, 0x7, 0x3a}], 0xffffffff}) openat$vimc2(0xffffffffffffff9c, &(0x7f0000003240), 0x2, 0x0) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$netlbl_mgmt(0x0, r10) sendmsg$NLBL_MGMT_C_ADD(r10, &(0x7f0000002c40)={0x0, 0xffffffffffffffd2, &(0x7f0000000100)={&(0x7f0000000380)=ANY=[@ANYRES16=0x0, @ANYRES16=r11, @ANYRESDEC=r9], 0x1b0}, 0x1, 0x0, 0x0, 0x20000000}, 0x40) r12 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r12, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c00000037000501f3fffffffedbd725017c000008000800", @ANYRES32=r12, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8050) ioctl$KVM_SET_USER_MEMORY_REGION(r8, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 2.859886062s ago: executing program 4 (id=3419): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x8001}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000002c0), 0x4) socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_dev$video4linux(0x0, 0x80000005, 0x20040) ioctl$VIDIOC_SUBDEV_S_FMT(r1, 0xc0585605, &(0x7f0000000280)={0x1, 0x0, {0xa, 0x2000, 0x300e, 0x0, 0xa, 0x4, 0x1, 0x1993012db91ab52e}}) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) splice(r2, 0x0, 0xffffffffffffffff, 0x0, 0xd9d7, 0x5) write$FUSE_INIT(r3, &(0x7f0000000340)={0x50, 0x0, 0x0, {0x7, 0x28, 0x1, 0xc002e38, 0x7ff, 0x80, 0x10000, 0xa79, 0x0, 0x0, 0x100}}, 0xffffffed) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000080)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x1, 0x0, 0x0, 0x0, {0xa, 0x0, 0x6, @private0}}}, 0x3a) write$tun(r4, &(0x7f0000000640)=ANY=[@ANYBLOB="08000800000300140100000000004500002800000000008990780000000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x36) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001580)=ANY=[@ANYBLOB="600000000206030000000000b8791fa80000000014000780080012400000000005001500010000000500010006000000050005000200000005000400000000000900020073797a310000000012000300686173683a6e65742c706f7274"], 0x60}}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_SET_LAPIC(r2, 0x4400ae8f, &(0x7f00000008c0)={"0b695bce4008832d5ab9b66b019877de47f820bb6d1830729994156f3e7fa7d69a91fcb01d1fa09ba06306c717d92764f6805beaec7a656b77c28f6044a7d70c57454df5253295a055546cba9631f3c0c99529249f6bb91dc96af244dd19f76b76ac2b0da2b08e7f7f7e7b4ac0aa58cda73b1f20916e47e512a7550cea59b0ab777d60dc99d88058057870f959ffb0df384c92437af93bba6e8b42eef81c31097077cae996ad5691cc820c752196d4514bf98fe842cc9e3196845899edd865220257c6719408eedb1f2115f63a0e480d50eecd37939515f60912798ac4550365a91e5a2078f772eff2111741482139ba5e3752c8bb55dfed2159c82cc46323b2f2dda91120a00b34a77258a5667edcba48e641e447df1a8b0b669058b281f15c8c3cd308cfee1f981da8abfa39cbe2251b40e9b9021e9521aca0dcb502d39240c6fa845baec6dc98f3eda3d5d9f842ab503c8e712c0f143d2abbe12b1167bb83c559c643ab8f61ba8ca33d2332f3ac6e600057ada12e8e0de0a66c310097e1961775266ceb21f3bb93357a8ba0f368a974cfbfdade03e6385d122de95188c5929441e6dd7698390023dd34ea8c9768a8da8e7072ed8df7b1c90cba450c4215f04321f921d229357afaf16b06aad25fb4f6e87f464c465713a4f272317ace22ccdf2a70328f3fe1f3c123147ffd537d1688c1859e086c57aff3d555db52ac2d8be5fc82f9136cbb0506f6330220c6d6593c952da74b9add8332e8126749b31eddacd8a4bac1319c8efc9c824983d7645ff1fae2e1d8a0e82fe0ca49ff5dfe6a25338dfb2c87093fed47075a650d940f9658eef2c85ad75dd41b64a8be30cf9f4d15ab0bce7ab03c6ff6e126e2c38946037be515335bdc02fa4fa1127ba2d9c946ff5db175cd41ca2f70e76e840a27fbd717726013e7518c6b7e2396bf3278ffbfeec2c4e50c74a33b8dcaccc41a45498f27bd6686492fb5026b152112038402df55059b13227c0c763044567bf06510bc2b63418a8f190e47224ffe565f5b7ed63156c4191ecc9e5d8c15ebcb302bad5a19726deb2bcbf9507f04120d9b2e5ded8d52aa1b4c5efe2332004a777126fe788474e5c4c6b29d528a5e8f20da85e9d9b00207c2af3976fca448df4d7691c06fcc7a103750d627a5a07526479f863c0d7d4b1a5bd84b90da40f70c912096b9c85c8656b68167f661460f341fc83046017401001369660b0446740a0e3c0d8ae834569053ae953b48d58739d964b5e5d33f4feee4227b741fa3fb9c4b4784fee587e816b493636376cf4d9d71589d67c2d19cce0ed9c4ea805821f96fb8742450fc7c34f0f420b1cef76ef5de2cd6c80fe8ed011115abea41a5a9385406b0f263e0adb33d42b189ed1d9d755712d2fb273252cf2dac83d5a27d9ddb9f49c704f3a5f130a31c0505fc6fbaff3d54f6bd41"}) sendmsg$IPSET_CMD_ADD(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)={0x54, 0x9, 0x6, 0x201, 0x0, 0x0, {0x2}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x2c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @local}}, @IPSET_ATTR_PROTO={0x5, 0x7, 0x84}, @IPSET_ATTR_PORT={0x6, 0x4, 0x1, 0x0, 0x4620}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x34040017}, 0x80) r8 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r8, 0x29, 0x23, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, &(0x7f00000001c0), 0x4) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000005c0)=ANY=[@ANYBLOB="020b000102"], 0x10}}, 0x0) 2.795513504s ago: executing program 1 (id=3420): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x6d4, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x6a0, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0xf8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPRESSIONS={0x14, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @exthdr={{0xb}, @void}}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_DATA={0xd4, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x62, 0x1, "5fdeaf0b506a222c6fa182bc2f7a836b103478b44a83b60d94852401578daff349ad6c3148a691075fbfd4066fd5205547f9f9151d2ad5f9c6806ad1fac3523f6b2fb426e6a45da1921f99881c09699d2940fb9f4c2b24a8dc88409c9cc9"}]}]}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x26d}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0x140, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x13c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}, @NFTA_DATA_VALUE={0xbd, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff5201be66172808e4c09adcbc90ba24a050e9cc3dd9010f28"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x424, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xe5, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b8647c48fecb31ccd3d6175aaf84978c553c69065430c3f9f46da1c07432400"}, @NFTA_SET_ELEM_DATA={0x2d4, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9d, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e04369"}, @NFTA_DATA_VALUE={0x5b, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8e33d210b4b61a73d50f3150dc40aef8f1796e9aab4"}, @NFTA_DATA_VALUE={0xa5, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7daee2b24a3a1e046d50f9da29ebd7751c269a7f3d1ae12330e0144099c658e7f06c4f649470bbea3418964d4150d095e856424488f3e6ecbf9df26f68c29fd03bb5b7c99094f4150af52e6f4d67b75a6"}, @NFTA_DATA_VERDICT={0x44, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0xa2, 0x1, "ffff1cd393f78383fb2852a5cb3e61fcc84727de0cc0ba7d7e6eb4d1bd7667bdfc27962424197d9115bbc90780793c26f90fd7e85d20085821164378300042280d6fdb339c991fea7704d724168ae2e838716ac67dea6bf27dceb06dbb5864ac4cdd7b5b3992ef89d77f26b0113d52ea436874029f42f50319873bbcd768e334c7a5cdfb554337971d63d1f8ad7de07a72ca1a00742fe12b6019772b0615"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_DELCHAIN={0x60, 0x5, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x3}, [@NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x1}, @NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x864}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) bind$xdp(0xffffffffffffffff, &(0x7f0000000080)={0x2d, 0x0, r4, 0xc}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x60, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x9c}}, 0x20050800) r6 = socket(0x2d, 0x2, 0x0) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r2, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 2.68424109s ago: executing program 3 (id=3421): sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000d40)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000d00)={&(0x7f0000000140)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x4a0, 0xc, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x4}, [@NFTA_SET_ELEM_LIST_ELEMENTS={0x46c, 0x3, 0x0, 0x1, [{0x1c, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}]}, {0x4}, {0x24, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x26d}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0xb7f1}]}, {0xec, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0xe8, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0xa6, 0x1, "552c6301687be697ed64c1e9df59c60c85226bdc3a36fe4b37dcd6eea3b5cb197f6e2e00666b33d27cc83b333395aaf470bec42735a4713f18b72f03b6b508b0c0d8f952e93c5a98bc55e321351a3fac830db8c7dda3149774f8557e670916e3e60f8485f95fe973a83efb06ab273c821aacfb74ff89b8d04d61609fb12901b39bd373450d83cb91d591415fb81fecfefbac8edb704077b9f60ee9cf52069086ff52"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6e6db71aaf07917f}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}]}, {0x338, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz1\x00'}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY_END={0x4}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_KEY_END={0x24, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @inner={{0xa}, @void}}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_USERDATA={0xc6, 0x6, 0x1, 0x0, "1816afa4850e1d04356825b15c0dcd4887d4eac4d08b8c2be0a24b6612cbb9d37ce76c6c08640a06ec8e6a171da16e2a3a8d7cdbe30ac25d7967e5572a52a109f0932d1ef05201cc582f43521fe3d0004cbf65e30a249aff8a9b1c7dd6b82d9893dadf84ed1c27bf6e4b86f4476ed0f99a9745b79d28865f1b3778ee14e29774a090b7ee088c80d235604203c9d8ec338d12d00a432ce9a2d36913d024592a4519fc6b41f866cd4686c7a41922ef828f9ee9a8981ace7f9da0a9369393d4f5a3934b"}, @NFTA_SET_ELEM_DATA={0x208, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x9d, 0x1, "13731d5161384166ac39c545764f540a92ad4f66e80b2fc3f768744415e34b143b7de5991fa17635a1a141d1d5e62f1559a9da1b46fbf4d026a046fcf7e469c7293afaeeabbdfb98ad294a32d216a627787ecee1ee1d730950a5299bfc9f5c4abd70a1266ad1373c82332ada9748fd8820f2e7d7b17156fcf191b84c1e33f539ee17c9629a704e7f35eabdb873014ef157a589efc214e04369"}, @NFTA_DATA_VALUE={0x46, 0x1, "9885649f9cbc45d533cffe173360cc346bc4a1facf197fc6387f477ec61644f3b27051122e20790f8b1f138e662540ff743726e183f67461e2f75f4d386eb69087b8"}, @NFTA_DATA_VALUE={0xa0, 0x1, "66cf9394d042f1ba9a5edf72c2f27f6b009a189ab1f7341fff14e4ecbcc55074eafc5e720fc81675174418fd0b7e3d5e08e56fd73f1c203100326d2f091e89ad3edd4b3a1b45374532649d63fa602ec3d7daee2b24a3a1e046d50f9da29ebd7751c269a7f3d1ae12330e0144099c658e7f06c4f649470bbea3418964d4150d095e856424488f3e6ecbf9df26f68c29fd03bb5b7c99094f4150af52e6"}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x542892f26a091959}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x4}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}}, @NFT_MSG_NEWFLOWTABLE={0x14, 0x16, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x2}}, @NFT_MSG_NEWCHAIN={0xb4, 0x3, 0xa, 0x3, 0x0, 0x0, {0x7, 0x0, 0x8}, [@NFTA_CHAIN_FLAGS={0x8}, @NFTA_CHAIN_TYPE={0xa, 0x7, 'route\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x38, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x54129f90}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x51073541}, @NFTA_HOOK_DEV={0x14, 0x3, 'wg0\x00'}]}, @NFTA_CHAIN_COUNTERS={0x4}, @NFTA_CHAIN_USERDATA={0x24, 0xc, "9fcc96cc0a4b13738c38024ce92f5031a317bab5b5945e6ef765b15a42f9a2b3"}, @NFTA_CHAIN_POLICY={0x8, 0x5, 0x1, 0x0, 0xfffffffffffffffb}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x2c, 0x16, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x9}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x5d0}, 0x1, 0x0, 0x0, 0x20048084}, 0x81) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x181) close(0xffffffffffffffff) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = socket(0x10, 0x803, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0xd, 0x4, &(0x7f0000000700)=@framed={{0x18, 0x0, 0x0, 0x0, 0xffffff41, 0x0, 0x0, 0x0, 0x8}, [@generic={0x91, 0x1, 0x1, 0xbd}]}, &(0x7f00000001c0)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff9}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000400)={'veth0_to_hsr\x00', 0x0}) r4 = socket(0x2d, 0x2, 0x0) bind$xdp(r4, &(0x7f0000000080)={0x2d, 0x0, r3, 0xc}, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)={{0x14}, [@NFT_MSG_NEWTABLE={0x14, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}}, @NFT_MSG_NEWSET={0x58, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x2c, 0x12, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @last={{0x9}, @val={0x4}}}, {0x14, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x4}}}]}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x106}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x94}}, 0x20050800) r6 = socket(0x2d, 0x2, 0x0) bind$xdp(r6, &(0x7f0000000080)={0x2d, 0x0, 0x0, 0xc}, 0x10) r7 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) r8 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r8, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) ioctl$sock_bt_hidp_HIDPCONNADD(r7, 0x400448c8, &(0x7f00000000c0)={r8, r8, 0x7, 0x2, &(0x7f0000000040)='9f', 0xe, 0x4, 0x8, 0x9, 0x3, 0x3, 0x2, 'syz1\x00'}) ioctl$sock_bt_hidp_HIDPCONNDEL(r7, 0x400448c9, &(0x7f0000000000)={@fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}) sendmsg$NFT_MSG_GETFLOWTABLE(r1, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000800)={&(0x7f0000000740)=ANY=[@ANYBLOB="6c000000170a01040000000000000000010000040c00054000000000000000010c0005400000006c256b94040900020073797a32000000000900020073797a31000000000c000540010000000000000108000740000000000900010073797a30"], 0x6c}, 0x1, 0x0, 0x0, 0x80}, 0x20008020) r9 = openat$ppp(0xffffffffffffff9c, 0x0, 0x1, 0x0) ioctl$TUNSETOFFLOAD(r9, 0x4004743d, 0x110e22fff6) 1.697932643s ago: executing program 4 (id=3422): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0xc, &(0x7f0000000180)=0x100000001, 0x4) timer_create(0x6, &(0x7f00000000c0)={0x0, 0x2, 0x1, @thr={&(0x7f0000000880)="fcf17ae9f11fab863d5fc7ee3bb7643bfd977f6b5cc86a3debbcfe3c156d5bd4d989ace6c349fa19c2ae6fca3949013a03866f96cf58d597899f44c96b86d2f68403f14a6a758efc20ea4fa89283a8df7ec380cbfd930536ecf6ade2e066b44155aa510ea48621444dec2c94f9f3210fff1b86d3a390e9df898a094b1e1f2e41d8911e0699f2ba62e0ef1f30d3d221d84a3abe5be9f6359d5794538afec25325aff8e19dc042631208159e117d197e3b11a5057a46268478bd5d7d3c516a2898653f5412a287fd5480314bc0df22ad51d470b981025a2928977519fc1ac43fef58db6febb093a3b662eed7748b53399c487ebc59cd9fbe57ca5156ae4d82830d9834103e4309e246150fa46c6c126107cf5548467017f2336ec0cbcf8c7612a5e3dc0e5fce4f422468bd374c9de74a920d3156c73f080b1428cf81448c3558a1eb03282230be59200ffd051ec22ff2a4787b09f5f02dd64d6b3c54690dd8ddaa25f0e9009f40ecdc2e243f4c6452e40ff68677115f6e53a786112b46ac90fece1f0dc55237173baae82d9d929fc32d7eb71db97f1d3c1707843411f03e6ca99e4252f08425ebd2e022697a141b59efc50b7eb76f47ee84afb106e2258c8425d1bf91fb6a898cb411cd1bb62634ffa2e1c24bdde6896046de3604ed0900a0883292fe13a0823fb0618b181edffb0e20ea27e55fca6c8119f77bd49951e79052d7eba295b1a1e0fcd4eabc4aef661b98057c9c979557e242b60d956bfb5e59733964255c076ee35f870767f2cbd74b4c7304cb89adab5c1186266fdee477853761c827e86538a5cf17f167da5a3ecad7b3b68e3d419c66ddc5d69ecc223ae760ef96f364fb159cb413ad322b8f217213db41a45c46c80a7ed8992c6054b9c027be98a26d3a5b5a881556f5dc658fadcb02548ea395aa0caec4492df7091871bab281a96823f4ab3937f1d3dda474e74b2761c21ded182a21bed6cf4b5b7bd09b446f5c8d5cf66833d29cdd9adc18ae9424ed45649efb726b3e9bd766d44562407a72e05177d843c227cd5535c1db2179d36c5059fd97b8dd08f5dea21ca24e33cfe308831f0dcf94210c1ae5166b65cc637cf01ddcd82559b93268f89c598fb4fd45d0ae391c5536c2e859554a1d0baa47a91da65e62980bf7fd20630c8f163aa44f74b73a404f127474fee46a38b1227fe08580b505f6fd9a69471528ddc2d770e8c6cc804b7fadf3d57a0a38349bee2f44de39d51308cf22d47802b7063317f7b850032a950a2ee696d179fd3b045234efee6aac43676eb0e5d73a699be84fb7067db1d353042cbec14f4bba380a16322d8b9f5951caf9a474453dea7d529171174bc2bd2d050750e2161cafae60df92cae66eeccb4910b9e4c823466d177db432b2979cb5361c536c3969069873e1f8982c5f6fb4ef4b465bdf46742d84bfbb265cd57ee96998ff7170f3be7691133e4e9a78ca0e917f4528ef3f729b90368cf5785aa6688c3627d5e98e2d9bfc70764922b6389963346dc7d66255eba63e3c46bcbe299e13fa970f1b005e1bb0016189af3e23bb59468e480d4fcbfb8a880d227536229501cbe756b3377c4375c8530c7f5c24628e36bb8940756992a8d45355a0e6a8b87390d689c643d90352a71cc241fdaf86a790555675b5f08373661b5cd754a252127f5f17c0327934739b054543bf4e3a31ca025c8d7186a199f9ac259286b5f505dea7d79fd55e5c912dd31573918ac7abdda17c436ad570d51e77343721c946535e66aec02db3f43819d142d54742a864fa658164428278532662a1014f541bed273c1a3984ba5b79ab207d4449eda90b286fcfbdcc6f8e12d5829bdbf76e3241641b23c2cb572130b523d159165518d3cbd2fe3cbdd48fdc77e3569b9a8f7b5c8b01c2fd973e776479aa8d9fba56e17b1bf075b238a3ac4e7fe46a0cce4bf24f7b53a92e24bb30c7ee05fe3f520f47eebafd4f4f4f900bf7730e24bbb9797998501e14de8b93743def7e71fcff4841c46a8df7edd3d3f03ef7f790797b3efe991b04533adfeda2a5f246a0dd8c59984face8a72de80f3b0ce384cc11c30bcde7249f7d67c6a6218fc83e8b5f679abdc428b21fd956db927488e524189e2795f6927372f641a6dac20a0e669ee46431b504443ee82ac99c43ef204ff4a99b47d522bcb4cd1e7b8d8e8554ed405aa01f15919b825823010dedeac36c400177f3b05b0b85eb6d7acf6da4a0690ac8c2b843fa48e34709386f9ee4e7d669f6cc8c3427370b6842564870d4100fb50a4e7fc6a3e7e10971c5c336209f06621ea3c0797b8d616970ae34bf8dce7fe3d7dcdd7195a343e8a1bf4b6753e37d59e5ba9b7e1690e6dd7ceb8d7b6dbc30daf353ddad0518f477347739b27a363b2f259d5b3c5b7aa9f84bee83f1a081a6cf9c379745286412a306da782ab314bcd7ff225a6337039bdea92c85045fef032836269903a2ade0f3d0584ef6e31edf7108200d4d9bb27963b25a2d39914a2721c725ce254be9e828e7c41940de66e5ba413777b0151b0470615e3c384934630e42e3cc11d87f492653bf14873babe674f54fa6febc693a57b780933bc0ff37fecbc923d052d84ef0c1dd4feee5d9d88ad40e1517a9a90911fbfd70887027bc1eac9e30869aa89b4eeabaaa6ed376115f09263ba603be2066c4cd3f6f579de35050c8aee8e94a4a2dd8fec10a4229a976520a1e418cb8660e40c2f0018b253d93affd8d675114cda4b10bc7045fc357ca6a6eaf68afc8168cb6abdcb35d07d5f5850619772cd12ce19bf83d03d60a8e741b8f871399d192365e37a1662fb1530ee6471115608652eb6fb423f81284aabda2afbeea22b68c6b8744963e74541adeb94ae578da939f4c36a398243022c4a360c5beea2a9e23c716896a0b877e447213d9872398bc48ec809d6a1fbc1546271910caf1b155e610cc754fddc6c60b4e0fb314ceb1db43913249f51b21e518d52660bfb644c4ce90969b9f5afc4b78bcee05c4195be79233da974060a8bf1b66b9f37453424f76b9c9784930c2c1b76b00293bcd4186164468d1ba2a33c3dee5c8437909f36f36b7a7a86c65aaab3371380a4d198a70ff6f47af60d4e8618f33603b32b49e5c7c10fafa7c9b146e796219e935534f91d2875279e2fc526469f498458094058d3b9d90d0b7cbd156ed6551f9001db6dcb933f6aa9ff549ac0b39c882c627a54664ced6fc3091b4435f9d107f5dc402172ec1e3c0f71074b0833f7c158641f2838ceb3aba9538a6d6f260dbf70be64e3c412aa28eb41e20435643946d3dbe27349bf21905a2ca0ec03e7c4db2136d9f9149b6691a6b32fba538136f1c00af802a3ef6eb608286654906dffaf4860a9f2dedb554b0dc7dc1e105b9f465b5d9355f58f39116cf8a940ccd5d4986054cd28c75c979deff85dba935acbba627f8367cdecdc5fb0c7b2a6ac2a9aeeb14cbe1425ff795f796513f823507804e21f6c29381fa6db838d1fba57f3bd290c1cc5d3aaa67cba568501225cd8388548f391170f7965492e9399a36b4b9bd462e6adf50bb149b51daf9f47acd406f703b8dd51debfaf6e6ab2a1b8740ba3756e9173b72ea16da9e018f540c0ec90cc0e70d8d19a4e46dbf7454174aa50946958cb2121f6527e377bd6c43344b0ef0630ba4b7e173a06144f4e3cf74513d8ba5829d4479200aa73cfdb44eb97de02c0c9c36232cfdd0fbff58e0861584f15d5495db43207675998485b2a929ec66a5b9dfb0a9c3f5033fbfbc63fc055419927b894d967e4cd891fc358b9fda34e76d1477b7a1b89d413ec8bbc54ce7f7445fcf75d8d37a0d1116ba162d604240e8096ea15990afd2f6933451929db73f230d45687dde54c65c92ae18e190170b392f46e3041bd3f474df14d52b11c991ceacc422d1bf28b45f670fbc1cfd781b7dfd364f21d9150862bc08b784a428ec064abd89c5fdd58c32aa57bb948caabaa0f5690b8873b883e510563915fece6e27b24213369e5fa0f65e4fbbc6b9813f3d4fc72a92404ebcf5f79a438ec230999d07f080c28171146a4a00393e90daad1abf51cc28e4a847f707d8cdb2f8ad568d5f89d09f4d52ede090f310cd900a550107e495885fcf0bb12f2ebc2b899b8ac85eb09f2dedeaed9791f3dddca65348e886d039b082317065de33c6444bde56819981811648ea6e065caafab76b84fb6761607ff6021270f97199417c7667213bdd907841867d6527a66fb21274a3703488c21e9ddd364857726138acee5e7455bf3592b691909d6d52df9ab0d446764c75d3bc594d9ef57a5a748ae686bf21ca6911013164390d9d5a535af607da306d546cb34c587fd0f9eae228b7390ce58c31b73569c31e204e8b78a74c3bcc52f77c427b24a796f5f588478955fd6e3bfc837d3109e2fb625846d19438099071090d437e56df6c6b0b51f52b55c5d194e571a968089bcfbe2195086822be0677634d47975eb8f1365b9f0448271735149c969497a8a7c4f7ee29ed9aff5fd5a97a2c6a55570e618b4edb86d7ad51f890d48d096e7d29a23c18a2dbe815fdc8bf828d36b7a54346bb6a06b58a81cdf07559bbf63bc2167888097df74ceaa663cec7f4bc4122047b80a5e663d2af17c8bc03af1210b51b2a0fda53a8edd7872245e26937ec346e2fd2dc360ea4e698cb8bd61beaab90d35aaf0c3471a2ea29c6a82b380b6a91e0362fa0d2ace5f7ad47fd3db2bde992a01edb62a702c4b8ce454515d315bc503db892ff6360a3b815cc9affbc9e133a4c5bf55d04456387ce19eb3832d39f0a1fea5e1e61fd563960f596bbc697087b2b6c9f15620c8ab7ff80718a4e7c32dcc11eb5ce78cf1e66f12d2e29a5617e35be59e894aa5bcb01a956736463c126d7f764b9ee896c7b5d30f972b16bac2cd7c923ccd54f15c56788ff1350255a315226709944f0708ee1c254561f0c5ed505f730264b5d16821b8c23f17c3d517e9a922229b8373a22d585302c2c7894e92e0df1131298c440790360b042d3e8c292e68c90ed0e1aec38b6dea3de64eb4e341fdd362f8630c5106a9333ed369be1aea3435421a675ed18514b0285bbb14cf10e465ed61085be5a9a1e7b8600d05ac6c9e9764ec4dfafb216439b054a65cb4de1da25e5defd1077ff8b190fd379f760d842d550d18e2cea46efe3544a330404432c87b971bbf45e139162eb277ae361fbfb6589f88ac4c3c3e50da34183e5f5fbe16c40471f1b5a334425aa6b208525cbb34e71dc34b1c96fe452f7e194ca08d359bd00c01da485eda10380f4e9020b44342e1dcb7a6a8b381de484fa8e62cc22e5922e4d58934ce739b8a466a3bd8df62e8bc650a53e9951a0bf8810d4fa265e891052a5d13982aa2fab5897ceecf8909840ef986f71917193353e4c4166ec3523a432c9f72fea01756031141c90917bda473ce411b29300dfeceee3725ef8262b4cd118f25f937c1f12f641fcd3506d8feb4539e334d62256222a98108576f0d8c4caf6b1b736d45b26043c3699397db3b65cf483e3a9438a6235fa7f09cabb884e0ac1737955b1ef1a1b5fb5c5e53a73cc5a6557b3a1a511cf14a8110d8480d75e0d8cbc42920909fae0b8fdd322ad8ee0cfa0ebd73027ce43e1487f5bd281c11153b63fbb7fe25a1c84ca819fe9f332781efe1757057b835dc917fd652e77e34a902a5531690baaa732002c6b24ead8b40afd6cbf847a15635d05e5d97be6dfc336221ca6e7efc404234937acf18a18789abf212f6a7b1de01704c3a5b51c5c6d8f045dd7fa9085", &(0x7f0000001880)="7d948d5dce6795a357d8f23f58946d90ea2188c1a126a553662c3eb6f15c2940620cf01a50e3840b3ac8e5c4a84c8a8a2b2be04180a18409795c3837d399f6135ba36c0381c6d2e5e3ea6e14783a8aef8a6bb817b3e23d8dba944d3c767798d0db2dad0d0fa9f57fae8ccaa1b374d6ccaca6d32c9849dddf24b14dc02197d0e503d8d66ef62522ed3b6f59d5a40e4545834bb5fdd373bfccb1"}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r1, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) syz_ublk_setup_io_uring(0x1d, &(0x7f0000000040)={0x0, 0x30b5, 0x3400, 0xa, 0x15d}, &(0x7f0000000300)=0x0, &(0x7f0000000280)=0x0, &(0x7f0000000140)=0x0) syz_ublk_add_dev(0xffffffffffffffff, r4, r5, r6, &(0x7f0000000200)={0x2e, 0x14, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000004c0)=@any_dev={0x3, 0xe26, 0x0, 0x0, 0x1000, 0x10000, 0xffffffffffffffff, 0x0, 0xd}}}, &(0x7f0000000480)) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) dup(r7) bpf$TOKEN_CREATE(0x24, &(0x7f00000001c0)={0x0, r3}, 0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x0, 0x0, &(0x7f0000000480)='syzkaller\x00'}, 0x94) splice(r2, 0x0, r3, 0x0, 0x8000f28, 0x5) setsockopt$inet_sctp6_SCTP_EVENTS(0xffffffffffffffff, 0x84, 0xb, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x11, 0x0, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c) mkdirat$cgroup_root(0xffffffffffffff9c, 0x0, 0x1ff) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./tracefs\x00', &(0x7f0000000040)='tracefs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./tracefs/instances/foo\x00', 0x1ff) r8 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r8, &(0x7f00000005c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000300), 0x111}}, 0x20) 1.367731807s ago: executing program 1 (id=3423): openat$ttyS3(0xffffffffffffff9c, 0x0, 0x28000, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) inotify_init() r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0xf4240, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) dup(r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) splice(r5, 0x0, r7, 0x0, 0x88000cc, 0x0) fcntl$setpipe(r6, 0x407, 0x100004) write$eventfd(r6, &(0x7f0000000240), 0xffffff14) 1.366909205s ago: executing program 3 (id=3424): r0 = syz_open_dev$dri(&(0x7f0000000440), 0x2, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r0, 0xc04064a0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000100)=[0x0], 0x0, 0x0, 0x0, 0x1}) (async) syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) (async) socket$nl_generic(0x10, 0x3, 0x10) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) timer_create(0x0, 0x0, &(0x7f0000000300)) (async) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10003, 0x5}) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{0x77359400}, {0x0, 0x989680}}, 0x0) (async) mount(0x0, &(0x7f0000000040)='./sys\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/pci/devices/0000:00:01.0/driver\x00', 0x0, 0x0) r2 = openat(r1, &(0x7f0000000140)='unbind\x00', 0x1, 0x0) write(r2, &(0x7f0000000180)='0000:00:01.0\n', 0xd) (async) r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:01.0\x00', 0x0, 0x0) r4 = openat(r3, &(0x7f0000000240)='driver_override\x00', 0x1, 0x0) write(r4, &(0x7f0000000280)='intel_ish_ipc\n', 0xe) (async) r5 = openat$dir(0xffffffffffffff9c, &(0x7f0000000300)='./sys/bus/pci/drivers/intel_ish_ipc\x00', 0x0, 0x0) r6 = openat(r5, &(0x7f0000000340)='bind\x00', 0x1, 0x0) write(r6, &(0x7f0000000380)='0000:00:01.0\n', 0xd) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) (async) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x0, 0x347000) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./dev\x00', 0x1ff) (async) r8 = socket$inet_sctp(0x2, 0x5, 0x84) close(r8) 1.36664959s ago: executing program 0 (id=3425): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) close(r0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r1, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) sendto$inet6(r1, &(0x7f00000004c0)="b0", 0x1, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @loopback={0x700}, 0x4}, 0x1c) 1.288331438s ago: executing program 3 (id=3426): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x20000, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1e0000000000000004000000ff"], 0x48) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000000)=@newqdisc={0x90, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2a, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x60, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x1, [0xe, 0x0, 0xc], 0x0, [0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffa], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x4}]}}]}, 0x90}}, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x3, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000002000000000000000600000000000070a11173857249d8881937ecfbd3cde5a9810000009500ff01"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r3 = openat$sndseq(0xffffff9c, &(0x7f00000005c0), 0x668080) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r3, 0xc0a45320, &(0x7f00000000c0)={{0x80}, 'port1\x00', 0x0, 0x150014, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x7}) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000540)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @name="a13c4dacaace7477f3f8f1d68f8a0c4a4b407126d4a332ea110a356827492a5c"}) r6 = add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r7 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000640)=ANY=[@ANYBLOB="3800000010000108fdffffff0000000000000000", @ANYRES32=0x0, @ANYBLOB="000000000000000008001b"], 0x38}}, 0x0) sendmmsg$alg(r7, &(0x7f0000000140), 0x4924b68, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x1, 0x41) connect$inet6(r8, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) r9 = fcntl$dupfd(r8, 0x406, r8) write$binfmt_elf64(r9, &(0x7f0000000340)=ANY=[@ANYRESOCT=r5, @ANYRES64=r8, @ANYRES32=r8, @ANYRESDEC, @ANYRES64, @ANYRES64=r6, @ANYRES8=r1], 0xfffffdcf) 335.052365ms ago: executing program 0 (id=3427): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) r1 = socket(0x40000000015, 0x5, 0x0) getsockopt$sock_buf(r1, 0x1, 0x1c, 0x0, &(0x7f00000001c0)) close(r0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) write(r4, &(0x7f0000000340), 0x11000) vmsplice(r3, &(0x7f0000000000)=[{&(0x7f0000000500), 0x3528a9c0}], 0x1, 0x0) setsockopt(r2, 0x84, 0x80, &(0x7f0000000000)="1400000009000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x401, @ipv4={'\x00', '\xff\xff', @empty}}], 0x1c) getsockopt$inet_sctp6_SCTP_STATUS(r1, 0x84, 0xe, &(0x7f0000000040)={0x0, 0xfffffffa, 0x1, 0x0, 0x7ff, 0x2, 0x101, 0x4, {0x0, @in6={{0xa, 0x401, 0x5, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xf}}, 0x2}}, 0x2, 0x3, 0x9, 0x8, 0x3}}, &(0x7f0000000100)=0xb0) ioctl$BTRFS_IOC_SCRUB_CANCEL(r1, 0x941c, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(r0, 0x84, 0x10, &(0x7f0000000140)=@assoc_value={r5, 0xfff}, 0x8) sendto$inet6(r2, &(0x7f00000004c0)="b0", 0x1, 0x40811, &(0x7f0000000240)={0xa, 0x4e23, 0x1ff, @loopback, 0x4}, 0x1c) 0s ago: executing program 3 (id=3428): openat$ttyS3(0xffffffffffffff9c, 0x0, 0x28000, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) inotify_init() r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'bridge0\x00'}) r1 = syz_open_dev$tty1(0xc, 0x4, 0x2) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) dup(r1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='memory.events\x00', 0x26e1, 0x0) pipe(&(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x7a05, 0x1700) splice(r5, 0x0, r7, 0x0, 0x88000cc, 0x0) fcntl$setpipe(r6, 0x407, 0x100004) write$eventfd(r6, &(0x7f0000000240)=0x9000000, 0xffffff14) kernel console output (not intermixed with test programs): ip=0xf6fdefec code=0x0 [ 642.855474][T16319] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2866'. [ 643.076239][ T854] usb 7-1: USB disconnect, device number 50 [ 643.204250][ T42] audit: type=1326 audit(1790823182.143:3915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16325 comm="syz.3.2870" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff4fec code=0x0 [ 643.608477][T16334] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2872'. [ 644.270530][T16343] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2876'. [ 645.031591][T16352] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2877'. [ 645.042254][T16353] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2885'. [ 645.606984][ T64] Bluetooth: hci0: command 0x040f tx timeout [ 645.939368][T16365] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(7) [ 645.939396][T16365] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 645.940862][T16365] vhci_hcd vhci_hcd.0: Device attached [ 645.941889][T16365] binder: 16364:16365 ioctl 84009422 80000500 returned -22 [ 645.942322][T16365] binder: 16364:16365 ioctl 50009403 80000900 returned -22 [ 645.942634][T16366] vhci_hcd: connection closed [ 645.943095][ T5819] vhci_hcd vhci_hcd.3: stop threads [ 645.943118][ T5819] vhci_hcd vhci_hcd.3: release socket [ 645.943136][ T5819] vhci_hcd vhci_hcd.3: disconnect device [ 646.001643][T16370] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2881'. [ 646.106959][ T1478] usb 6-1: new high-speed USB device number 66 using dummy_hcd [ 646.260374][ T1478] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 646.261422][ T1478] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 646.261444][ T1478] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 646.261474][ T1478] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 646.750961][ T42] audit: type=1326 audit(1790823185.693:3916): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16375 comm="syz.3.2883" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff4fec code=0x0 [ 646.772828][ T42] audit: type=1326 audit(1790823185.713:3917): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16377 comm="syz.2.2882" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf701efec code=0x0 [ 647.766046][T16395] FAULT_INJECTION: forcing a failure. [ 647.766046][T16395] name failslab, interval 1, probability 0, space 0, times 0 [ 647.766078][T16395] CPU: 3 UID: 0 PID: 16395 Comm: syz.3.2889 Tainted: G L syzkaller #0 PREEMPT(full) [ 647.766105][T16395] Tainted: [L]=SOFTLOCKUP [ 647.766113][T16395] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 647.766124][T16395] Call Trace: [ 647.766131][T16395] [ 647.766139][T16395] dump_stack_lvl+0x100/0x190 [ 647.766168][T16395] should_fail_ex.cold+0x5/0xa [ 647.766194][T16395] should_failslab+0xc2/0x120 [ 647.766222][T16395] kmem_cache_alloc_noprof+0x92/0x6a0 [ 647.766246][T16395] ? sk_prot_alloc+0x60/0x2a0 [ 647.766275][T16395] sk_prot_alloc+0x60/0x2a0 [ 647.766299][T16395] sk_alloc+0x36/0xe80 [ 647.766327][T16395] unix_create1+0xa6/0x700 [ 647.766357][T16395] unix_create+0x10f/0x1b0 [ 647.766384][T16395] __sock_create+0x339/0x860 [ 647.766411][T16395] __sys_socketpair+0x1e4/0x5b0 [ 647.766438][T16395] ? __pfx___sys_socketpair+0x10/0x10 [ 647.766473][T16395] __ia32_compat_sys_socketcall+0x3c1/0x770 [ 647.766500][T16395] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 647.766524][T16395] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 647.766547][T16395] ? __fget_files+0x21f/0x3d0 [ 647.766585][T16395] ? __pfx_ksys_write+0x10/0x10 [ 647.766614][T16395] __do_fast_syscall_32+0x13a/0x8b0 [ 647.766637][T16395] ? lockdep_hardirqs_on+0x7d/0x110 [ 647.766661][T16395] do_fast_syscall_32+0x32/0x70 [ 647.766685][T16395] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 647.766724][T16395] RIP: 0023:0xf7ff4fec [ 647.766743][T16395] Code: Unable to access opcode bytes at 0xf7ff4fc2. [ 647.766753][T16395] RSP: 002b:00000000f54b6440 EFLAGS: 00000286 ORIG_RAX: 0000000000000066 [ 647.766772][T16395] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000f54b645c [ 647.766785][T16395] RDX: 00000000f7488ff4 RSI: 00000000f74b4f00 RDI: 0000000000000000 [ 647.766798][T16395] RBP: 0000000000000003 R08: 0000000000000000 R09: 0000000000000000 [ 647.766810][T16395] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 647.766822][T16395] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 647.766847][T16395] [ 648.896161][ T854] usb 6-1: USB disconnect, device number 66 [ 649.001701][T16404] netlink: 8752 bytes leftover after parsing attributes in process `syz.2.2893'. [ 649.153216][T16414] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2892'. [ 649.183331][T16415] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2894'. [ 649.186470][T16418] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2894'. [ 649.196413][T16417] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2894'. [ 649.272044][T16421] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2895'. [ 650.131053][ T42] audit: type=1326 audit(1790823189.074:3918): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16422 comm="syz.1.2896" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 650.373095][T16431] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2897'. [ 651.108742][T16435] busy [ 651.263585][T16447] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2904'. [ 651.294227][ T42] audit: type=1326 audit(1790823190.234:3919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16436 comm="syz.1.2898" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 651.315930][T16447] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 651.318127][T16447] netlink: 'syz.3.2904': attribute type 8 has an invalid length. [ 651.439347][T16445] block nbd3: shutting down sockets [ 651.498947][T16454] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2914'. [ 651.565727][T16461] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 651.578004][T16461] netlink: 'syz.2.2914': attribute type 8 has an invalid length. [ 651.651248][T16463] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2906'. [ 651.749160][T16453] block nbd2: shutting down sockets [ 652.351047][ T42] audit: type=1326 audit(1790823191.294:3920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16468 comm="syz.0.2908" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 652.523950][T16475] kvm: user requested TSC rate below hardware speed [ 652.722457][T16482] /dev/sr0: Can't open blockdev [ 653.035520][T16495] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2923'. [ 653.326084][T16496] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2915'. [ 653.784115][T16498] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2916'. [ 653.925997][T16498] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 653.941963][T16498] netlink: 'syz.0.2916': attribute type 8 has an invalid length. [ 654.010340][T16505] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2917'. [ 654.038337][T16497] block nbd0: shutting down sockets [ 654.308674][T16527] netlink: 'syz.3.2924': attribute type 1 has an invalid length. [ 654.327008][T16520] FAULT_INJECTION: forcing a failure. [ 654.327008][T16520] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 654.327036][T16520] CPU: 1 UID: 0 PID: 16520 Comm: syz.0.2922 Tainted: G L syzkaller #0 PREEMPT(full) [ 654.327056][T16520] Tainted: [L]=SOFTLOCKUP [ 654.327062][T16520] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 654.327071][T16520] Call Trace: [ 654.327077][T16520] [ 654.327083][T16520] dump_stack_lvl+0x100/0x190 [ 654.327108][T16520] should_fail_ex.cold+0x5/0xa [ 654.327129][T16520] _copy_to_user+0x32/0xd0 [ 654.327152][T16520] snd_pcm_oss_read2+0x294/0x400 [ 654.327172][T16520] ? __pfx_snd_pcm_oss_read2+0x10/0x10 [ 654.327188][T16520] ? snd_pcm_kernel_ioctl+0x12e/0x280 [ 654.327210][T16520] ? snd_pcm_oss_prepare+0x11e/0x240 [ 654.327228][T16520] snd_pcm_oss_read+0x5aa/0x730 [ 654.327248][T16520] ? __pfx_snd_pcm_oss_read+0x10/0x10 [ 654.327266][T16520] vfs_read+0x1e4/0xb40 [ 654.327284][T16520] ? lock_acquire+0x1d1/0x380 [ 654.327305][T16520] ? __fget_files+0x34/0x3d0 [ 654.327323][T16520] ? __pfx_vfs_read+0x10/0x10 [ 654.327338][T16520] ? find_held_lock+0x2b/0x80 [ 654.327355][T16520] ? __fget_files+0x215/0x3d0 [ 654.327372][T16520] ? __fget_files+0x215/0x3d0 [ 654.327393][T16520] ? __fget_files+0x21f/0x3d0 [ 654.327416][T16520] ksys_read+0x12a/0x250 [ 654.327433][T16520] ? __pfx_ksys_read+0x10/0x10 [ 654.327464][T16520] ? ksys_write+0x1ac/0x250 [ 654.327483][T16520] ? __pfx_ksys_write+0x10/0x10 [ 654.327505][T16520] __do_fast_syscall_32+0x13a/0x8b0 [ 654.327524][T16520] ? lockdep_hardirqs_on+0x7d/0x110 [ 654.327542][T16520] do_fast_syscall_32+0x32/0x70 [ 654.327560][T16520] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 654.327585][T16520] RIP: 0023:0xf6fdefec [ 654.327603][T16520] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 654.327610][T16520] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 654.327626][T16520] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000800063c0 [ 654.327635][T16520] RDX: 00000000fffffe46 RSI: 0000000000000000 RDI: 0000000000000000 [ 654.327645][T16520] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 654.327653][T16520] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 654.327662][T16520] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 654.327682][T16520] [ 654.361566][ T9] usb 7-1: new high-speed USB device number 51 using dummy_hcd [ 654.469889][ T42] audit: type=1326 audit(1790823193.414:3921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16531 comm="syz.3.2925" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff4fec code=0x0 [ 654.506423][ T9] usb 7-1: device descriptor read/64, error -71 [ 654.767483][ T9] usb 7-1: new high-speed USB device number 52 using dummy_hcd [ 654.767572][T11843] usb 5-1: new high-speed USB device number 74 using dummy_hcd [ 654.906538][ T9] usb 7-1: device descriptor read/64, error -71 [ 654.927071][T11843] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 654.927964][T11843] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 654.927980][T11843] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 654.928006][T11843] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 655.026609][ T9] usb usb7-port1: attempt power cycle [ 655.376383][ T9] usb 7-1: new high-speed USB device number 53 using dummy_hcd [ 655.396854][ T9] usb 7-1: device descriptor read/8, error -71 [ 655.636425][ T9] usb 7-1: new high-speed USB device number 54 using dummy_hcd [ 655.656799][ T9] usb 7-1: device descriptor read/8, error -71 [ 655.766811][ T9] usb usb7-port1: unable to enumerate USB device [ 657.189238][T16543] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2936'. [ 657.220599][T16543] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 657.223520][T16543] netlink: 'syz.1.2936': attribute type 8 has an invalid length. [ 657.279653][T16542] block nbd1: shutting down sockets [ 657.319145][T16550] busy [ 657.319935][T16552] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2930'. [ 657.339212][T16552] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 657.341769][T16552] netlink: 'syz.1.2930': attribute type 8 has an invalid length. [ 657.409103][T16551] block nbd1: shutting down sockets [ 657.532105][T15098] usb 5-1: USB disconnect, device number 74 [ 657.676304][ T7075] usb 6-1: new high-speed USB device number 67 using dummy_hcd [ 657.827285][ T7075] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 657.828225][ T7075] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 657.828246][ T7075] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 657.828274][ T7075] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 658.252175][T16567] FAULT_INJECTION: forcing a failure. [ 658.252175][T16567] name failslab, interval 1, probability 0, space 0, times 0 [ 658.252208][T16567] CPU: 0 UID: 0 PID: 16567 Comm: syz.2.2934 Tainted: G L syzkaller #0 PREEMPT(full) [ 658.252234][T16567] Tainted: [L]=SOFTLOCKUP [ 658.252242][T16567] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 658.252254][T16567] Call Trace: [ 658.252262][T16567] [ 658.252270][T16567] dump_stack_lvl+0x100/0x190 [ 658.252301][T16567] should_fail_ex.cold+0x5/0xa [ 658.252327][T16567] should_failslab+0xc2/0x120 [ 658.252361][T16567] kmem_cache_alloc_noprof+0x92/0x6a0 [ 658.252385][T16567] ? __pfx_map_id_range_down+0x10/0x10 [ 658.252414][T16567] ? security_inode_alloc+0x3b/0x2c0 [ 658.252449][T16567] security_inode_alloc+0x3b/0x2c0 [ 658.252480][T16567] inode_init_always_gfp+0xc6f/0xfb0 [ 658.252510][T16567] alloc_inode+0x8e/0x250 [ 658.252530][T16567] new_inode+0x22/0x1c0 [ 658.252553][T16567] proc_pid_make_inode+0x22/0x160 [ 658.252578][T16567] ? d_lookup+0xe7/0x190 [ 658.252599][T16567] proc_fd_instantiate+0x57/0x230 [ 658.252623][T16567] proc_fill_cache+0x2a3/0x3a0 [ 658.252651][T16567] ? __pfx_proc_fd_instantiate+0x10/0x10 [ 658.252676][T16567] ? __pfx_proc_fill_cache+0x10/0x10 [ 658.252701][T16567] ? _raw_spin_unlock+0x28/0x50 [ 658.252729][T16567] proc_readfd_common+0x1ef/0x5f0 [ 658.252753][T16567] ? __pfx_proc_fd_instantiate+0x10/0x10 [ 658.252779][T16567] ? __pfx_proc_readfd_common+0x10/0x10 [ 658.252801][T16567] ? down_read_killable+0x35d/0x520 [ 658.252830][T16567] ? __pfx_down_read_killable+0x10/0x10 [ 658.252863][T16567] iterate_dir+0x296/0xae0 [ 658.252889][T16567] __ia32_sys_getdents64+0x13a/0x2c0 [ 658.252914][T16567] ? __pfx___ia32_sys_getdents64+0x10/0x10 [ 658.252937][T16567] ? __pfx_filldir64+0x10/0x10 [ 658.252960][T16567] ? arch_syscall_is_vdso_sigreturn+0x19b/0x200 [ 658.253005][T16567] ? syscall_user_dispatch+0x76/0x130 [ 658.253030][T16567] __do_fast_syscall_32+0x13a/0x8b0 [ 658.253054][T16567] ? lockdep_hardirqs_on+0x7d/0x110 [ 658.253083][T16567] do_fast_syscall_32+0x32/0x70 [ 658.253107][T16567] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 658.253130][T16567] RIP: 0023:0xf701efec [ 658.253152][T16567] Code: Unable to access opcode bytes at 0xf701efc2. [ 658.253162][T16567] RSP: 002b:00000000f540d50c EFLAGS: 00000292 ORIG_RAX: 00000000000000dc [ 658.253181][T16567] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001e80 [ 658.253191][T16567] RDX: 0000000000001016 RSI: 0000000000000000 RDI: 0000000000000000 [ 658.253204][T16567] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 658.253217][T16567] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 658.253228][T16567] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 658.253253][T16567] [ 658.448684][T16572] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2935'. [ 659.734277][T11729] netdevsim netdevsim2 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.776182][ T854] usb 5-1: new high-speed USB device number 75 using dummy_hcd [ 659.811599][T11729] netdevsim netdevsim2 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.860740][T11729] netdevsim netdevsim2 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.896641][ T64] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 659.908389][ T64] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 659.910315][ T64] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 659.915325][T11729] netdevsim netdevsim2 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 659.920353][ T64] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 659.920854][ T64] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 659.928690][ T854] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 659.933213][ T854] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 659.933228][ T854] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 659.933245][ T854] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 660.091665][T11729] bridge_slave_1: left allmulticast mode [ 660.091694][T11729] bridge_slave_1: left promiscuous mode [ 660.093652][T11729] bridge0: port 2(bridge_slave_1) entered disabled state [ 660.096698][T11729] bridge_slave_0: left allmulticast mode [ 660.096714][T11729] bridge_slave_0: left promiscuous mode [ 660.096808][T11729] bridge0: port 1(bridge_slave_0) entered disabled state [ 660.101169][T11729] lo: left allmulticast mode [ 660.300637][T11729] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 660.302575][T11729] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 660.303554][T11729] bond0 (unregistering): Released all slaves [ 660.336960][ T5792] netdevsim netdevsim2 eth2: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.337434][ T5792] netdevsim netdevsim2 eth3: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.337765][ T5792] netdevsim netdevsim2 eth4: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.337809][ T5792] netdevsim netdevsim2 eth5: set [0, 0] type 1 family 0 port 8472 - 0 [ 660.407686][T16593] lo speed is unknown, defaulting to 1000 [ 660.408480][T16593] lo speed is unknown, defaulting to 1000 [ 660.612083][T16616] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2946'. [ 661.078750][ T5454] 8021q: adding VLAN 0 to HW filter on device eth2 [ 661.181395][T15098] usb 6-1: USB disconnect, device number 67 [ 661.417862][ T5454] 8021q: adding VLAN 0 to HW filter on device eth3 [ 661.430721][T11729] hsr_slave_0: left promiscuous mode [ 661.433601][T11729] hsr_slave_1: left promiscuous mode [ 661.434031][T11729] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 661.434053][T11729] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 661.436532][T11729] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 661.436661][T11729] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 661.457977][T11729] veth1_macvtap: left promiscuous mode [ 661.459697][T11729] veth0_macvtap: left promiscuous mode [ 661.459871][T11729] veth1_vlan: left promiscuous mode [ 661.460036][T11729] veth0_vlan: left promiscuous mode [ 661.799271][T11729] team0 (unregistering): Port device team_slave_1 removed [ 661.811756][T11729] team0 (unregistering): Port device team_slave_0 removed [ 661.968989][T16593] bridge0: port 1(bridge_slave_0) entered blocking state [ 661.969101][T16593] bridge0: port 1(bridge_slave_0) entered disabled state [ 661.969187][T16593] bridge_slave_0: entered allmulticast mode [ 661.970391][T16593] bridge_slave_0: entered promiscuous mode [ 661.975360][T16593] bridge0: port 2(bridge_slave_1) entered blocking state [ 661.975484][T16593] bridge0: port 2(bridge_slave_1) entered disabled state [ 661.975583][T16593] bridge_slave_1: entered allmulticast mode [ 661.979378][T16593] bridge_slave_1: entered promiscuous mode [ 662.026016][ T64] Bluetooth: hci1: command tx timeout [ 662.044813][T16593] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 662.050376][T16593] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 662.099238][T16593] team0: Port device team_slave_0 added [ 662.100884][T16593] team0: Port device team_slave_1 added [ 662.114164][T16593] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 662.114174][T16593] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 662.114188][T16593] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 662.115491][T16593] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 662.115500][T16593] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 662.115513][T16593] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 662.137457][T16593] hsr_slave_0: entered promiscuous mode [ 662.138224][T16593] hsr_slave_1: entered promiscuous mode [ 662.138653][T16593] debugfs: 'hsr0' already exists in 'hsr' [ 662.138665][T16593] Cannot create hsr debugfs directory [ 662.272673][ T5454] 8021q: adding VLAN 0 to HW filter on device eth4 [ 662.407943][T16593] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 662.412935][T16593] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 662.414716][T16593] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 662.417119][T16593] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 662.417542][T16593] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 662.438112][T16593] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 662.438558][T16593] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 662.440923][T16593] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 662.480757][T16593] 8021q: adding VLAN 0 to HW filter on device bond0 [ 662.489851][T16593] 8021q: adding VLAN 0 to HW filter on device team0 [ 662.509963][ T55] bridge0: port 1(bridge_slave_0) entered blocking state [ 662.510030][ T55] bridge0: port 1(bridge_slave_0) entered forwarding state [ 662.515513][ T55] bridge0: port 2(bridge_slave_1) entered blocking state [ 662.515576][ T55] bridge0: port 2(bridge_slave_1) entered forwarding state [ 662.540945][ T5454] 8021q: adding VLAN 0 to HW filter on device eth5 [ 662.549255][T16673] FAULT_INJECTION: forcing a failure. [ 662.549255][T16673] name failslab, interval 1, probability 0, space 0, times 0 [ 662.549276][T16673] CPU: 2 UID: 0 PID: 16673 Comm: syz.3.2952 Tainted: G L syzkaller #0 PREEMPT(full) [ 662.549292][T16673] Tainted: [L]=SOFTLOCKUP [ 662.549296][T16673] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 662.549303][T16673] Call Trace: [ 662.549307][T16673] [ 662.549311][T16673] dump_stack_lvl+0x100/0x190 [ 662.549331][T16673] should_fail_ex.cold+0x5/0xa [ 662.549346][T16673] ? __pfx_fuse_inode_set+0x10/0x10 [ 662.549359][T16673] should_failslab+0xc2/0x120 [ 662.549376][T16673] __kmalloc_cache_noprof+0x91/0x6d0 [ 662.549389][T16673] ? fuse_alloc_inode+0xc7/0x1a0 [ 662.549403][T16673] ? __pfx_fuse_inode_eq+0x10/0x10 [ 662.549415][T16673] ? __pfx_fuse_inode_set+0x10/0x10 [ 662.549427][T16673] fuse_alloc_inode+0xc7/0x1a0 [ 662.549440][T16673] ? __pfx_fuse_alloc_inode+0x10/0x10 [ 662.549453][T16673] alloc_inode+0x68/0x250 [ 662.549464][T16673] iget5_locked+0x5f/0xa0 [ 662.549476][T16673] fuse_iget+0x165/0x910 [ 662.549493][T16673] ? __pfx_fuse_iget+0x10/0x10 [ 662.549507][T16673] ? fuse_chan_send+0x6d3/0x9c0 [ 662.549524][T16673] fuse_lookup_name+0x47a/0x780 [ 662.549541][T16673] ? __pfx_fuse_lookup_name+0x10/0x10 [ 662.549564][T16673] ? find_held_lock+0x2b/0x80 [ 662.549582][T16673] fuse_lookup+0x209/0x590 [ 662.549597][T16673] ? __pfx_fuse_lookup+0x10/0x10 [ 662.549612][T16673] ? lock_acquire+0x1d1/0x380 [ 662.549629][T16673] ? lookup_slow+0x42/0x70 [ 662.549644][T16673] ? down_read+0x13b/0x4c0 [ 662.549673][T16673] ? __pfx_down_read+0x10/0x10 [ 662.549690][T16673] __lookup_slow+0x155/0x320 [ 662.549703][T16673] lookup_slow+0x50/0x70 [ 662.549714][T16673] path_lookupat+0x5e8/0xc40 [ 662.549729][T16673] filename_lookup+0x202/0x590 [ 662.549743][T16673] ? __kasan_slab_alloc+0x89/0x90 [ 662.549760][T16673] ? __pfx_filename_lookup+0x10/0x10 [ 662.549787][T16673] ? lock_acquire+0x1d1/0x380 [ 662.549803][T16673] ? __might_fault+0xc5/0x140 [ 662.549816][T16673] filename_linkat+0x145/0x640 [ 662.549835][T16673] ? __pfx_filename_linkat+0x10/0x10 [ 662.549856][T16673] ? do_getname+0x191/0x390 [ 662.549868][T16673] __ia32_sys_link+0x80/0xb0 [ 662.549886][T16673] __do_fast_syscall_32+0x13a/0x8b0 [ 662.549900][T16673] ? lockdep_hardirqs_on+0x7d/0x110 [ 662.549914][T16673] do_fast_syscall_32+0x32/0x70 [ 662.549929][T16673] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 662.549943][T16673] RIP: 0023:0xf7ff4fec [ 662.549957][T16673] Code: Unable to access opcode bytes at 0xf7ff4fc2. [ 662.549962][T16673] RSP: 002b:00000000f549550c EFLAGS: 00000292 ORIG_RAX: 0000000000000009 [ 662.549974][T16673] RAX: ffffffffffffffda RBX: 0000000080000280 RCX: 0000000080000400 [ 662.549981][T16673] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 662.549987][T16673] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 662.549994][T16673] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 662.550000][T16673] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 662.550018][T16673] [ 662.602915][ T970] usb 5-1: USB disconnect, device number 75 [ 662.660159][T16681] jffs2: notice: (16681) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 662.686033][ T5848] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 662.821433][ T1478] hid-generic 0005:0008:0009.004F: hidraw1: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 662.835165][T16687] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2954'. [ 662.896736][ T5848] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 662.919885][ T5848] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 662.919911][ T5848] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 662.919941][ T5848] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 663.067305][T16689] fido_id[16689]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory [ 663.650647][T16699] netlink: 40 bytes leftover after parsing attributes in process `syz.0.2956'. [ 663.680587][T16699] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 663.683353][T16699] netlink: 'syz.0.2956': attribute type 8 has an invalid length. [ 663.719370][T16593] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 663.754427][T16698] block nbd0: shutting down sockets [ 663.900908][T16593] veth0_vlan: entered promiscuous mode [ 663.916843][T16593] veth1_vlan: entered promiscuous mode [ 663.964878][T16593] veth0_macvtap: entered promiscuous mode [ 663.974649][T16593] veth1_macvtap: entered promiscuous mode [ 664.012979][T16593] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 664.026807][T16593] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 664.048276][ T5819] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.076790][ T5819] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.077359][ T5819] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.078127][ T5819] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 664.102104][ T64] Bluetooth: hci1: command tx timeout [ 664.155631][ T69] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.156675][ T69] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.233977][ T222] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 664.233998][ T222] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 664.362018][ T42] audit: type=1326 audit(1790823203.304:3922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16723 comm="syz.4.2959" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6feefec code=0x0 [ 664.920339][T16738] netlink: 40 bytes leftover after parsing attributes in process `syz.3.2964'. [ 664.946091][ T970] usb 5-1: new high-speed USB device number 76 using dummy_hcd [ 664.955048][T16738] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 664.960122][T16738] netlink: 'syz.3.2964': attribute type 8 has an invalid length. [ 665.041687][T16737] block nbd3: shutting down sockets [ 665.106408][ T970] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 665.107213][ T970] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 665.107227][ T970] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 665.107245][ T970] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 665.162549][T16743] i2c-slave-eeprom 0-1022: i2c_slave_register: not supported by adapter [ 665.167306][T16743] i2c-slave-eeprom 0-1022: probe with driver i2c-slave-eeprom failed with error -95 [ 665.168045][T16743] i2c i2c-0: new_device: Instantiated device slave-24c02 at 0x22 [ 665.212397][T16743] i2c i2c-0: new_device: Instantiated device tcpci at 0x02 [ 665.751934][T15098] usb 6-1: USB disconnect, device number 68 [ 666.165852][ T64] Bluetooth: hci1: command tx timeout [ 666.590575][T16755] bridge0: port 3(syz_tun) entered blocking state [ 666.590699][T16755] bridge0: port 3(syz_tun) entered disabled state [ 666.590824][T16755] syz_tun: entered allmulticast mode [ 666.592283][T16755] syz_tun: entered promiscuous mode [ 666.593105][T16755] bridge0: port 3(syz_tun) entered blocking state [ 666.593194][T16755] bridge0: port 3(syz_tun) entered listening state [ 666.706980][ T42] audit: type=1400 audit(1790823205.645:3923): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" name="unknown" pid=16760 comm="syz.1.2970" name="unknown" offset=28 [ 666.761715][T16763] netlink: 56 bytes leftover after parsing attributes in process `syz.1.2971'. [ 666.817012][T16767] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2973'. [ 666.859603][T16767] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 666.862733][T16767] netlink: 'syz.1.2973': attribute type 8 has an invalid length. [ 666.884848][ T5848] hid-generic 0005:0008:0009.0050: hidraw1: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 666.914780][T16768] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2972'. [ 666.942736][T16766] block nbd1: shutting down sockets [ 666.952731][T16771] fido_id[16771]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory [ 667.079996][ T42] audit: type=1326 audit(1790823206.025:3924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16772 comm="syz.1.2974" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 667.491797][T16777] FAULT_INJECTION: forcing a failure. [ 667.491797][T16777] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 667.491821][T16777] CPU: 0 UID: 0 PID: 16777 Comm: syz.3.2975 Tainted: G L syzkaller #0 PREEMPT(full) [ 667.491837][T16777] Tainted: [L]=SOFTLOCKUP [ 667.491841][T16777] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 667.491848][T16777] Call Trace: [ 667.491853][T16777] [ 667.491858][T16777] dump_stack_lvl+0x100/0x190 [ 667.491877][T16777] should_fail_ex.cold+0x5/0xa [ 667.491890][T16777] ? prepare_alloc_pages+0x16d/0x5b0 [ 667.491909][T16777] should_fail_alloc_page+0xeb/0x140 [ 667.491927][T16777] prepare_alloc_pages+0x1f0/0x5b0 [ 667.491943][T16777] ? do_raw_spin_lock+0x128/0x260 [ 667.491957][T16777] __alloc_frozen_pages_noprof+0x1e9/0x3300 [ 667.491973][T16777] ? do_raw_spin_unlock+0x145/0x1e0 [ 667.491985][T16777] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 667.491998][T16777] ? debug_object_activate+0x343/0x4b0 [ 667.492018][T16777] ? __pfx_debug_object_activate+0x10/0x10 [ 667.492037][T16777] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 667.492051][T16777] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 667.492067][T16777] ? update_cfs_rq_load_avg+0x51/0x550 [ 667.492079][T16777] ? __dequeue_entity+0xf2b/0x2170 [ 667.492097][T16777] ? __lock_acquire+0x5c0/0x1f40 [ 667.492114][T16777] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 667.492131][T16777] ? policy_nodemask+0xed/0x4f0 [ 667.492150][T16777] alloc_pages_mpol+0x201/0x550 [ 667.492167][T16777] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 667.492185][T16777] ? __pfx___page_table_check_ptes_set+0x10/0x10 [ 667.492206][T16777] alloc_pages_noprof+0x1a/0x160 [ 667.492219][T16777] pte_alloc_one+0x1c/0x3d0 [ 667.492234][T16777] __pte_alloc+0x6d/0x380 [ 667.492248][T16777] ? __pfx___pte_alloc+0x10/0x10 [ 667.492262][T16777] ? rcu_read_unlock+0x2d/0xb0 [ 667.492276][T16777] do_anonymous_page+0x1307/0x2050 [ 667.492292][T16777] ? __pfx_do_anonymous_page+0x10/0x10 [ 667.492303][T16777] ? pgd_none+0x9f/0xe0 [ 667.492313][T16777] ? __pfx_pgd_none+0x10/0x10 [ 667.492323][T16777] ? find_held_lock+0x2b/0x80 [ 667.492338][T16777] __handle_mm_fault+0x1ff3/0x2f60 [ 667.492353][T16777] ? __pfx___handle_mm_fault+0x10/0x10 [ 667.492363][T16777] ? __pfx_mt_find+0x10/0x10 [ 667.492399][T16777] ? find_vma+0xbf/0x140 [ 667.492415][T16777] ? __pfx_find_vma+0x10/0x10 [ 667.492430][T16777] handle_mm_fault+0x363/0xa20 [ 667.492445][T16777] do_user_addr_fault+0x745/0x12f0 [ 667.492462][T16777] exc_page_fault+0x6f/0xd0 [ 667.492476][T16777] asm_exc_page_fault+0x26/0x30 [ 667.492487][T16777] RIP: 0010:_copy_from_user+0x93/0xd0 [ 667.492508][T16777] Code: e1 e1 fc 89 ee 4c 89 ef 48 b8 00 f0 ff ff ff 7f 00 00 48 39 c3 48 0f 47 d8 e8 39 57 54 fd 0f 01 cb 4c 89 ef 48 89 de 48 89 e9 a4 0f 1f 00 49 89 cc 48 89 cb 0f 01 ca 31 ff 48 89 ce e8 e5 db [ 667.492519][T16777] RSP: 0018:ffffc90003dffa48 EFLAGS: 00050297 [ 667.492530][T16777] RAX: 0000000000000001 RBX: 00000000800010c0 RCX: 00000000000010c4 [ 667.492537][T16777] RDX: 0000000000000001 RSI: 0000000080200000 RDI: ffff8880505fef40 [ 667.492544][T16777] RBP: 0000000000200004 R08: 0000000000000001 R09: ffffed100a0c0000 [ 667.492551][T16777] R10: 0000000000000003 R11: 0000000000000000 R12: 0000000000000000 [ 667.492558][T16777] R13: ffff888050400000 R14: ffff888050400000 R15: ffff888027dd3c00 [ 667.492572][T16777] ? _copy_from_user+0x87/0xd0 [ 667.492588][T16777] map_delete_elem+0x9c2/0xe80 [ 667.492605][T16777] ? find_held_lock+0x2b/0x80 [ 667.492632][T16777] ? __pfx_map_delete_elem+0x10/0x10 [ 667.492655][T16777] __sys_bpf+0x1f68/0x4a30 [ 667.492671][T16777] ? __pfx___sys_bpf+0x10/0x10 [ 667.492683][T16777] ? lock_acquire+0x1d1/0x380 [ 667.492699][T16777] ? get_pid_task+0x2a/0x250 [ 667.492711][T16777] ? find_held_lock+0x2b/0x80 [ 667.492724][T16777] ? get_pid_task+0xfc/0x250 [ 667.492735][T16777] ? get_pid_task+0xfc/0x250 [ 667.492750][T16777] ? proc_fail_nth_write+0x9f/0x220 [ 667.492765][T16777] ? find_held_lock+0x2b/0x80 [ 667.492781][T16777] ? rcu_read_lock_any_held+0x6a/0x90 [ 667.492795][T16777] ? find_held_lock+0x2b/0x80 [ 667.492808][T16777] ? ksys_write+0x190/0x250 [ 667.492820][T16777] ? ksys_write+0x190/0x250 [ 667.492833][T16777] ? lock_acquire+0x1d1/0x380 [ 667.492859][T16777] ? fput+0x7c/0x100 [ 667.492875][T16777] ? __ia32_sys_bpf+0xcc/0x170 [ 667.492888][T16777] __ia32_sys_bpf+0xcc/0x170 [ 667.492902][T16777] ? __do_fast_syscall_32+0xb3/0x8b0 [ 667.492917][T16777] __do_fast_syscall_32+0x13a/0x8b0 [ 667.492931][T16777] ? lockdep_hardirqs_on+0x7d/0x110 [ 667.492964][T16777] do_fast_syscall_32+0x32/0x70 [ 667.492979][T16777] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 667.492993][T16777] RIP: 0023:0xf7ff4fec [ 667.493005][T16777] Code: Unable to access opcode bytes at 0xf7ff4fc2. [ 667.493011][T16777] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 667.493022][T16777] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001080 [ 667.493029][T16777] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 667.493036][T16777] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 667.493042][T16777] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 667.493049][T16777] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 667.493063][T16777] [ 667.865324][ T7075] usb 5-1: USB disconnect, device number 76 [ 667.902538][T16782] FAT-fs (nbd4): unable to read boot sector [ 667.908302][T16782] FAT-fs (nbd4): unable to read boot sector [ 668.040101][T16792] jffs2: notice: (16792) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 668.167048][ T42] audit: type=1400 audit(1790823207.105:3925): apparmor="STATUS" info="failed to unpack profile" error=-71 profile="unconfined" name="unknown" pid=16786 comm="syz.0.2978" name="unknown" offset=28 [ 668.245765][ T64] Bluetooth: hci1: command tx timeout [ 668.267607][T16794] netlink: 8 bytes leftover after parsing attributes in process `syz.4.2979'. [ 668.853484][T16804] netlink: 56 bytes leftover after parsing attributes in process `syz.0.2981'. [ 668.950877][T16808] netlink: 40 bytes leftover after parsing attributes in process `syz.4.2983'. [ 668.981166][T16808] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 668.984337][T16808] netlink: 'syz.4.2983': attribute type 8 has an invalid length. [ 669.087938][T16807] block nbd4: shutting down sockets [ 669.125679][ T5848] usb 5-1: new high-speed USB device number 77 using dummy_hcd [ 669.323217][ T1478] hid-generic 0005:0008:0009.0051: hidraw1: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 669.349139][T16822] netlink: 8 bytes leftover after parsing attributes in process `syz.1.2987'. [ 669.359618][ T5848] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 669.396708][ T5848] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 669.396735][ T5848] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 669.396766][ T5848] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 669.411794][T16823] fido_id[16823]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory [ 669.415617][ T7075] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 669.592252][ T7075] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 669.595846][ T7075] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 669.595953][ T7075] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 669.596061][ T7075] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 670.273622][ T42] audit: type=1326 audit(1790823209.215:3926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16827 comm="syz.1.2988" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 671.203303][T16836] netlink: 40 bytes leftover after parsing attributes in process `syz.1.2989'. [ 671.241250][T16836] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 671.245813][T16836] netlink: 'syz.1.2989': attribute type 8 has an invalid length. [ 671.322504][T16835] block nbd1: shutting down sockets [ 671.336051][T14257] hid-generic 0005:0008:0009.0052: hidraw1: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 671.363090][T16840] netlink: 8 bytes leftover after parsing attributes in process `syz.3.2991'. [ 671.627873][T16842] fido_id[16842]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory [ 671.824446][T16847] openvswitch: netlink: Unknown VXLAN extension attribute 0 [ 672.051417][T14257] usb 5-1: USB disconnect, device number 77 [ 672.196961][T15098] usb 9-1: USB disconnect, device number 2 [ 672.399368][ T42] audit: type=1326 audit(1790823211.345:3927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16862 comm="syz.0.2998" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 672.645675][T15098] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 672.796245][T15098] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 672.797888][T15098] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 672.797908][T15098] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 672.797938][T15098] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 672.877921][ T5848] hid-generic 0005:0008:0009.0053: hidraw1: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 672.913332][T16874] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3001'. [ 672.960879][T16875] fido_id[16875]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory [ 673.449805][T16886] i2c i2c-0: Failed to register i2c client slave-24c02 at 0x22 (-16) [ 673.466039][T16886] i2c i2c-0: Failed to register i2c client tcpci at 0x02 (-16) [ 674.026213][T16896] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3003'. [ 675.343824][ T3377] usb 9-1: USB disconnect, device number 3 [ 675.660255][T16927] gadgetfs: bound to dummy_udc driver [ 675.685315][ T970] usb 5-1: new high-speed USB device number 78 using dummy_hcd [ 675.755252][ T3377] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 675.835851][ T970] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 675.836801][ T970] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 675.836814][ T970] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 675.836833][ T970] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.905875][ T3377] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 675.906866][ T3377] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 675.906879][ T3377] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 675.906896][ T3377] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 675.915425][T14257] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 675.915633][ C0] gadgetfs: connected [ 675.915733][T14257] gadgetfs: disconnected [ 676.065490][ C0] gadgetfs: connected [ 676.097065][T14257] usb 6-1: New USB device found, idVendor=1234, idProduct=5678, bcdDevice= 1.00 [ 676.111712][T14257] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 676.147461][ C0] gadgetfs: configuration #1 [ 676.156606][T14257] input: USB Touchscreen 1234:5678 as /devices/platform/dummy_hcd.1/usb6/6-1/6-1:1.0/input/input78 [ 676.391476][T16925] gadgetfs: suspended from state 3 [ 676.391674][T16925] gadgetfs: disconnected [ 676.394209][ T7075] usb 6-1: USB disconnect, device number 69 [ 678.488398][T15098] usb 9-1: USB disconnect, device number 4 [ 678.504005][ T3377] usb 5-1: USB disconnect, device number 78 [ 678.634779][ T42] audit: type=1326 audit(1790823217.575:3928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16932 comm="syz.3.3010" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff4fec code=0x0 [ 678.915156][ T970] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 679.075722][ T970] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 679.076529][ T970] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 679.076542][ T970] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 679.076558][ T970] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 680.032769][T16958] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3012'. [ 680.698703][T16968] FAULT_INJECTION: forcing a failure. [ 680.698703][T16968] name failslab, interval 1, probability 0, space 0, times 0 [ 680.698738][T16968] CPU: 2 UID: 0 PID: 16968 Comm: syz.4.3021 Tainted: G L syzkaller #0 PREEMPT(full) [ 680.698766][T16968] Tainted: [L]=SOFTLOCKUP [ 680.698774][T16968] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 680.698786][T16968] Call Trace: [ 680.698793][T16968] [ 680.698803][T16968] dump_stack_lvl+0x100/0x190 [ 680.698835][T16968] should_fail_ex.cold+0x5/0xa [ 680.698864][T16968] should_failslab+0xc2/0x120 [ 680.698895][T16968] __kmalloc_noprof+0xfc/0x840 [ 680.698924][T16968] ? lsm_blob_alloc+0x68/0x90 [ 680.698955][T16968] lsm_blob_alloc+0x68/0x90 [ 680.698981][T16968] security_task_alloc+0x2a/0x260 [ 680.699005][T16968] copy_process+0x2c11/0x8380 [ 680.699040][T16968] ? __pfx_copy_process+0x10/0x10 [ 680.699062][T16968] ? futex_wake+0x4ea/0x5e0 [ 680.699096][T16968] kernel_clone+0x176/0x9d0 [ 680.699118][T16968] ? __pfx_kernel_clone+0x10/0x10 [ 680.699153][T16968] __do_compat_sys_ia32_clone+0xd4/0x120 [ 680.699184][T16968] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 680.699236][T16968] __do_fast_syscall_32+0x13a/0x8b0 [ 680.699267][T16968] do_fast_syscall_32+0x32/0x70 [ 680.699292][T16968] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 680.699318][T16968] RIP: 0023:0xf6feefec [ 680.699340][T16968] Code: Unable to access opcode bytes at 0xf6feefc2. [ 680.699351][T16968] RSP: 002b:00000000f53dd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 680.699371][T16968] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 0000000000000000 [ 680.699385][T16968] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 680.699396][T16968] RBP: 00000000f53dd5ec R08: 0000000000000000 R09: 0000000000000000 [ 680.699408][T16968] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 680.699421][T16968] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 680.699447][T16968] [ 680.989556][T16974] FAULT_INJECTION: forcing a failure. [ 680.989556][T16974] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 680.989579][T16974] CPU: 3 UID: 0 PID: 16974 Comm: syz.4.3024 Tainted: G L syzkaller #0 PREEMPT(full) [ 680.989595][T16974] Tainted: [L]=SOFTLOCKUP [ 680.989600][T16974] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 680.989610][T16974] Call Trace: [ 680.989614][T16974] [ 680.989620][T16974] dump_stack_lvl+0x100/0x190 [ 680.989640][T16974] should_fail_ex.cold+0x5/0xa [ 680.989657][T16974] _copy_from_user+0x2e/0xd0 [ 680.989676][T16974] io_uring_setup+0xc0/0x160 [ 680.989694][T16974] ? find_held_lock+0x2b/0x80 [ 680.989709][T16974] ? ksys_write+0x190/0x250 [ 680.989724][T16974] ? ksys_write+0x190/0x250 [ 680.989739][T16974] ? __pfx_io_uring_setup+0x10/0x10 [ 680.989758][T16974] ? do_futex+0x190/0x440 [ 680.989772][T16974] ? __pfx_do_futex+0x10/0x10 [ 680.989789][T16974] ? xfd_validate_state+0x129/0x190 [ 680.989812][T16974] __ia32_sys_io_uring_setup+0xc2/0x170 [ 680.989831][T16974] __do_fast_syscall_32+0x13a/0x8b0 [ 680.989847][T16974] ? lockdep_hardirqs_on+0x7d/0x110 [ 680.989861][T16974] do_fast_syscall_32+0x32/0x70 [ 680.989875][T16974] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 680.989890][T16974] RIP: 0023:0xf6feefec [ 680.989904][T16974] Code: Unable to access opcode bytes at 0xf6feefc2. [ 680.989910][T16974] RSP: 002b:00000000f53dd4bc EFLAGS: 00000282 ORIG_RAX: 00000000000001a9 [ 680.989923][T16974] RAX: ffffffffffffffda RBX: 0000000000000ec6 RCX: 00000000800008c0 [ 680.989932][T16974] RDX: 00000000f7150fd7 RSI: 0000000000000001 RDI: 00000000f53dd53c [ 680.989940][T16974] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 680.989947][T16974] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 680.989955][T16974] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 680.989968][T16974] [ 680.993544][ T42] audit: type=1326 audit(1790823219.935:3929): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16975 comm="syz.3.3023" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff4fec code=0x0 [ 681.067102][ T5792] nci: nci_rx_work: unknown MT 0x1 [ 681.115026][ T3377] usb 5-1: new high-speed USB device number 79 using dummy_hcd [ 681.265695][ T3377] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 681.266693][ T3377] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 681.266714][ T3377] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 681.266747][ T3377] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 681.938016][T15098] usb 6-1: USB disconnect, device number 70 [ 682.167882][ C1] bridge0: port 3(syz_tun) entered learning state [ 683.901444][ T3377] usb 5-1: USB disconnect, device number 79 [ 683.990630][T16974] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 684.102065][T15098] hid-generic 0005:0008:0009.0054: hidraw1: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 684.110746][T17000] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3027'. [ 684.822535][T17007] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 684.854284][T17007] netlink: 'syz.1.3028': attribute type 8 has an invalid length. [ 684.951920][T16999] fido_id[16999]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory [ 685.184774][ T42] audit: type=1326 audit(1790823224.126:3930): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.184825][ T42] audit: type=1326 audit(1790823224.126:3931): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.196522][ T42] audit: type=1326 audit(1790823224.146:3932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=386 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.196576][ T42] audit: type=1326 audit(1790823224.146:3933): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.196703][ T42] audit: type=1326 audit(1790823224.146:3934): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.197162][ T42] audit: type=1326 audit(1790823224.146:3935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=432 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.197264][ T42] audit: type=1326 audit(1790823224.146:3936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.197353][ T42] audit: type=1326 audit(1790823224.146:3937): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.197632][ T42] audit: type=1326 audit(1790823224.146:3938): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.197847][ T42] audit: type=1326 audit(1790823224.146:3939): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17006 comm="syz.4.3030" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf6feefec code=0x7ffc0000 [ 685.368753][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 685.418408][T17004] block nbd1: shutting down sockets [ 685.521572][T17023] bridge0: received packet on syz_tun with own address as source address (addr:aa:aa:aa:aa:aa:aa, vlan:1) [ 687.665142][ T1478] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 687.847890][ T1478] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 687.905518][ T1478] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 687.905536][ T1478] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 687.905556][ T1478] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 687.907993][T17052] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 687.910893][T17052] netlink: 'syz.1.3041': attribute type 8 has an invalid length. [ 688.727167][T17049] block nbd1: shutting down sockets [ 688.751903][T17057] FAULT_INJECTION: forcing a failure. [ 688.751903][T17057] name failslab, interval 1, probability 0, space 0, times 0 [ 688.751939][T17057] CPU: 2 UID: 0 PID: 17057 Comm: syz.0.3042 Tainted: G L syzkaller #0 PREEMPT(full) [ 688.751968][T17057] Tainted: [L]=SOFTLOCKUP [ 688.751975][T17057] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 688.751988][T17057] Call Trace: [ 688.751995][T17057] [ 688.752003][T17057] dump_stack_lvl+0x100/0x190 [ 688.752037][T17057] should_fail_ex.cold+0x5/0xa [ 688.752065][T17057] should_failslab+0xc2/0x120 [ 688.752094][T17057] kmem_cache_alloc_noprof+0x92/0x6a0 [ 688.752119][T17057] ? lockdep_init_map_type+0x5c/0x250 [ 688.752151][T17057] ? copy_process+0x47d7/0x8380 [ 688.752178][T17057] copy_process+0x47d7/0x8380 [ 688.752212][T17057] ? __pfx_copy_process+0x10/0x10 [ 688.752232][T17057] ? futex_wake+0x4ea/0x5e0 [ 688.752268][T17057] kernel_clone+0x176/0x9d0 [ 688.752290][T17057] ? __pfx_kernel_clone+0x10/0x10 [ 688.752323][T17057] __do_compat_sys_ia32_clone+0xd4/0x120 [ 688.752355][T17057] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 688.752407][T17057] __do_fast_syscall_32+0x13a/0x8b0 [ 688.752437][T17057] do_fast_syscall_32+0x32/0x70 [ 688.752462][T17057] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 688.752495][T17057] RIP: 0023:0xf6fdefec [ 688.752520][T17057] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 688.752529][T17057] RSP: 002b:00000000f53cd4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 688.752549][T17057] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 0000000000000000 [ 688.752562][T17057] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 688.752574][T17057] RBP: 00000000f53cd5ec R08: 0000000000000000 R09: 0000000000000000 [ 688.752590][T17057] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 688.752603][T17057] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 688.752629][T17057] [ 688.931524][T17066] ubi0: attaching mtd0 [ 688.946295][T17066] ubi0: scanning is finished [ 688.946327][T17066] ubi0 error: ubi_read_volume_table: the layout volume was not found [ 689.142192][T17066] ubi0 error: ubi_attach_mtd_dev: failed to attach mtd0, error -22 [ 690.439499][ T5892] usb 9-1: USB disconnect, device number 5 [ 690.480733][T17087] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 690.484647][T17087] netlink: 'syz.3.3049': attribute type 8 has an invalid length. [ 690.555415][T17086] block nbd3: shutting down sockets [ 690.626878][T17092] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 690.629456][T17092] netlink: 'syz.3.3051': attribute type 8 has an invalid length. [ 690.686708][T17091] block nbd3: shutting down sockets [ 690.779852][T17095] FAULT_INJECTION: forcing a failure. [ 690.779852][T17095] name failslab, interval 1, probability 0, space 0, times 0 [ 690.779888][T17095] CPU: 3 UID: 0 PID: 17095 Comm: syz.3.3053 Tainted: G L syzkaller #0 PREEMPT(full) [ 690.779917][T17095] Tainted: [L]=SOFTLOCKUP [ 690.779925][T17095] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 690.779939][T17095] Call Trace: [ 690.779947][T17095] [ 690.779956][T17095] dump_stack_lvl+0x100/0x190 [ 690.779990][T17095] should_fail_ex.cold+0x5/0xa [ 690.780021][T17095] should_failslab+0xc2/0x120 [ 690.780052][T17095] kmem_cache_alloc_noprof+0x92/0x6a0 [ 690.780079][T17095] ? lockdep_init_map_type+0x5c/0x250 [ 690.780111][T17095] ? copy_process+0x47d7/0x8380 [ 690.780137][T17095] copy_process+0x47d7/0x8380 [ 690.780172][T17095] ? __pfx_copy_process+0x10/0x10 [ 690.780192][T17095] ? futex_wake+0x4ea/0x5e0 [ 690.780229][T17095] kernel_clone+0x176/0x9d0 [ 690.780251][T17095] ? __pfx_kernel_clone+0x10/0x10 [ 690.780285][T17095] __do_compat_sys_ia32_clone+0xd4/0x120 [ 690.780316][T17095] ? __pfx___do_compat_sys_ia32_clone+0x10/0x10 [ 690.780379][T17095] __do_fast_syscall_32+0x13a/0x8b0 [ 690.780409][T17095] do_fast_syscall_32+0x32/0x70 [ 690.780437][T17095] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 690.780463][T17095] RIP: 0023:0xf7ff4fec [ 690.780485][T17095] Code: Unable to access opcode bytes at 0xf7ff4fc2. [ 690.780495][T17095] RSP: 002b:00000000f54b64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000078 [ 690.780518][T17095] RAX: ffffffffffffffda RBX: 0000000000000011 RCX: 0000000000000000 [ 690.780531][T17095] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 690.780543][T17095] RBP: 00000000f54b65ec R08: 0000000000000000 R09: 0000000000000000 [ 690.780556][T17095] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 690.780569][T17095] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 690.780596][T17095] [ 690.881691][ T5892] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 691.368902][T17112] netlink: 'syz.0.3061': attribute type 8 has an invalid length. [ 691.481250][T17111] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 691.664788][ T5892] usb 9-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 691.665642][ T5892] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 691.695233][T17106] block nbd0: shutting down sockets [ 691.792251][ T42] kauditd_printk_skb: 40 callbacks suppressed [ 691.792264][ T42] audit: type=1326 audit(1790823230.736:3980): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17120 comm="syz.0.3062" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 691.902414][ T5892] net1080 9-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.4-1, NetChip TurboCONNECT, 66:aa:0c:8b:7e:8d [ 692.144547][ T854] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 692.295458][ T854] usb 6-1: Using ep0 maxpacket: 8 [ 692.296647][ T854] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 692.299015][ T854] usb 6-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 692.299040][ T854] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 692.299060][ T854] usb 6-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 692.299143][ T854] usb 6-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 692.299177][ T854] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 692.337254][ T7075] usb 9-1: USB disconnect, device number 6 [ 692.338245][ T7075] net1080 9-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.4-1, NetChip TurboCONNECT [ 692.509490][ T854] usb 6-1: GET_CAPABILITIES returned 0 [ 692.509514][ T854] usbtmc 6-1:16.0: can't read capabilities [ 692.718995][ C0] usbtmc 6-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 693.980081][T17154] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 693.983874][T17154] netlink: 'syz.0.3064': attribute type 8 has an invalid length. [ 694.797588][T17152] block nbd0: shutting down sockets [ 694.818304][ T854] usb 6-1: USB disconnect, device number 71 [ 694.877425][T17167] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 694.879338][T17167] netlink: 'syz.0.3070': attribute type 8 has an invalid length. [ 694.930478][T17166] block nbd0: shutting down sockets [ 695.174825][T15098] hid-generic 0005:0008:0009.0055: hidraw1: BLUETOOTH HID v0.03 Device [syz1] on aa:aa:aa:aa:aa:aa [ 695.187350][T17182] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3073'. [ 695.397837][T17185] fido_id[17185]: Failed to open report descriptor at '/sys/devices/virtual/bluetooth/hci1/hci1:200/report_descriptor': No such file or directory [ 696.074970][T17189] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3075'. [ 696.798569][T17202] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 696.798703][T17202] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 696.798774][T17202] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 696.798899][T17202] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 696.798928][T17202] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 696.819708][T17202] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 697.114356][ T5892] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 697.238975][T17221] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3084'. [ 697.284745][ T5892] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 697.285694][ T5892] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 697.285713][ T5892] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 697.285740][ T5892] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.316973][T11843] usb 5-1: new high-speed USB device number 80 using dummy_hcd [ 697.484004][T11843] usb 5-1: Using ep0 maxpacket: 8 [ 697.484716][T11843] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 697.485725][T11843] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid maxpacket 56832, setting to 1024 [ 697.485753][T11843] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 1024 [ 697.485776][T11843] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 697.485797][T11843] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 697.485839][T11843] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 697.524053][ C1] bridge0: port 3(syz_tun) entered forwarding state [ 697.524074][ C1] bridge0: topology change detected, propagating [ 697.694196][T11843] usb 5-1: GET_CAPABILITIES returned 0 [ 697.694221][T11843] usbtmc 5-1:16.0: can't read capabilities [ 697.898130][ C0] usbtmc 5-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 697.898179][ C0] usbtmc 5-1:16.0: usbtmc_write_bulk_cb - nonzero write bulk status received: -71 [ 697.971397][T17214] FAULT_INJECTION: forcing a failure. [ 697.971397][T17214] name failslab, interval 1, probability 0, space 0, times 0 [ 697.971421][T17214] CPU: 0 UID: 0 PID: 17214 Comm: syz.0.3082 Tainted: G L syzkaller #0 PREEMPT(full) [ 697.971438][T17214] Tainted: [L]=SOFTLOCKUP [ 697.971443][T17214] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 697.971450][T17214] Call Trace: [ 697.971471][T17214] [ 697.971476][T17214] dump_stack_lvl+0x100/0x190 [ 697.971497][T17214] should_fail_ex.cold+0x5/0xa [ 697.971514][T17214] should_failslab+0xc2/0x120 [ 697.971532][T17214] __kmalloc_cache_noprof+0x91/0x6d0 [ 697.971547][T17214] ? call_usermodehelper_setup+0xaf/0x360 [ 697.971564][T17214] ? __pfx_free_modprobe_argv+0x10/0x10 [ 697.971577][T17214] call_usermodehelper_setup+0xaf/0x360 [ 697.971596][T17214] __request_module+0x3c7/0x6a0 [ 697.971610][T17214] ? __pfx___request_module+0x10/0x10 [ 697.971627][T17214] ? rcu_is_watching+0x13/0xc0 [ 697.971640][T17214] ? apparmor_capable+0x1d7/0x4d0 [ 697.971662][T17214] ? __pfx_compat_standard_call+0x10/0x10 [ 697.971675][T17214] dev_load+0x204/0x240 [ 697.971686][T17214] wext_ioctl_dispatch.constprop.0+0x9e/0x3d0 [ 697.971701][T17214] compat_wext_handle_ioctl+0x15d/0x220 [ 697.971715][T17214] ? __pfx_compat_wext_handle_ioctl+0x10/0x10 [ 697.971731][T17214] ? do_vfs_ioctl+0x226/0x13e0 [ 697.971744][T17214] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 697.971759][T17214] compat_sock_ioctl+0x381/0x760 [ 697.971777][T17214] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 697.971791][T17214] ? hook_file_ioctl_common+0x140/0x440 [ 697.971808][T17214] ? __fget_files+0x21f/0x3d0 [ 697.971825][T17214] ? __pfx_compat_sock_ioctl+0x10/0x10 [ 697.971841][T17214] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 697.971856][T17214] __do_fast_syscall_32+0x13a/0x8b0 [ 697.971870][T17214] ? lockdep_hardirqs_on+0x7d/0x110 [ 697.971891][T17214] do_fast_syscall_32+0x32/0x70 [ 697.971906][T17214] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 697.971922][T17214] RIP: 0023:0xf6fdefec [ 697.971936][T17214] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 697.971942][T17214] RSP: 002b:00000000f53ab50c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 697.971955][T17214] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000008b1a [ 697.971962][T17214] RDX: 0000000080000040 RSI: 0000000000000000 RDI: 0000000000000000 [ 697.971969][T17214] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 697.971976][T17214] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 697.971983][T17214] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 697.971997][T17214] [ 698.804209][ T64] Bluetooth: hci4: command 0x0c1a tx timeout [ 698.804248][ T64] Bluetooth: hci2: command 0x0c1a tx timeout [ 698.804266][ T5743] Bluetooth: hci0: command 0x040f tx timeout [ 699.215027][T17245] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3090'. [ 699.885047][T15098] usb 6-1: USB disconnect, device number 72 [ 700.078319][ T5848] usb 5-1: USB disconnect, device number 80 [ 700.192318][T17256] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3094'. [ 700.235766][T17247] infiniband syz1: set active [ 700.236453][T17247] infiniband syz1: added syz_tun [ 700.407091][T17247] smbdirect: ib_dev[syz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 700.407123][T17247] smbdirect: ib_dev[syz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 700.407154][T17247] smbdirect: ib_dev[syz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 700.441183][T17247] RDS/IB: syz1: added [ 700.441218][T17247] smc: adding ib device syz1 with port count 1 [ 700.441233][T17247] smc: ib device syz1 port 1 has no pnetid [ 700.893906][ T64] Bluetooth: hci0: command 0x040f tx timeout [ 701.993874][T11843] usb 5-1: new high-speed USB device number 81 using dummy_hcd [ 702.154479][T11843] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 702.155467][T11843] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 702.155489][T11843] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 702.155519][T11843] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 702.328847][T17285] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3102'. [ 702.963725][ T5743] Bluetooth: hci0: command 0x040f tx timeout [ 703.370509][T17293] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3104'. [ 703.397232][T17303] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3103'. [ 703.900941][ T42] audit: type=1326 audit(1790823242.847:3981): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17304 comm="syz.1.3109" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 704.936204][T15098] usb 5-1: USB disconnect, device number 81 [ 705.089234][ T5743] Bluetooth: hci0: command 0x040f tx timeout [ 705.260228][T17331] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3115'. [ 705.597696][T17335] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3117'. [ 706.305649][ T42] audit: type=1326 audit(1790823245.257:3982): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17342 comm="syz.4.3121" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6feefec code=0x0 [ 706.365145][T17350] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3127'. [ 706.434566][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434630][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434654][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434678][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434696][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434724][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434747][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434770][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434792][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.434815][T17352] netlink: 'syz.1.3120': attribute type 3 has an invalid length. [ 706.438303][T17354] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3119'. [ 706.859986][T17356] netlink: 212348 bytes leftover after parsing attributes in process `syz.1.3120'. [ 706.860019][T17356] openvswitch: netlink: Message has 512 unknown bytes. [ 707.133475][ T64] Bluetooth: hci0: command 0x040f tx timeout [ 707.377059][T17361] rdma_rxe: rxe_newlink: failed to add syz_tun [ 707.448914][T17367] FAULT_INJECTION: forcing a failure. [ 707.448914][T17367] name failslab, interval 1, probability 0, space 0, times 0 [ 707.448935][T17367] CPU: 0 UID: 0 PID: 17367 Comm: syz.3.3126 Tainted: G L syzkaller #0 PREEMPT(full) [ 707.448957][T17367] Tainted: [L]=SOFTLOCKUP [ 707.448962][T17367] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 707.448968][T17367] Call Trace: [ 707.448973][T17367] [ 707.448977][T17367] dump_stack_lvl+0x100/0x190 [ 707.448996][T17367] should_fail_ex.cold+0x5/0xa [ 707.449011][T17367] should_failslab+0xc2/0x120 [ 707.449028][T17367] kmem_cache_alloc_noprof+0x92/0x6a0 [ 707.449042][T17367] ? __pfx_map_id_range_down+0x10/0x10 [ 707.449060][T17367] ? security_inode_alloc+0x3b/0x2c0 [ 707.449080][T17367] security_inode_alloc+0x3b/0x2c0 [ 707.449098][T17367] inode_init_always_gfp+0xc6f/0xfb0 [ 707.449122][T17367] alloc_inode+0x8e/0x250 [ 707.449139][T17367] new_inode+0x22/0x1c0 [ 707.449157][T17367] debugfs_create_dir+0xbe/0x440 [ 707.449186][T17367] drm_debugfs_clients_add+0x6f/0x210 [ 707.449208][T17367] drm_file_alloc+0x5c6/0xb40 [ 707.449228][T17367] drm_open_helper+0x1fc/0x540 [ 707.449250][T17367] drm_open+0x1a0/0x3e0 [ 707.449268][T17367] ? __pfx_drm_open+0x10/0x10 [ 707.449287][T17367] drm_stub_open+0x20f/0x380 [ 707.449307][T17367] ? __pfx_drm_stub_open+0x10/0x10 [ 707.449319][T17367] chrdev_open+0x234/0x6a0 [ 707.449334][T17367] ? __pfx_apparmor_file_open+0x10/0x10 [ 707.449347][T17367] ? __pfx_chrdev_open+0x10/0x10 [ 707.449363][T17367] ? fsnotify_open_perm_and_set_mode+0x17a/0xa80 [ 707.449383][T17367] do_dentry_open+0x6ab/0x14d0 [ 707.449398][T17367] ? __pfx_chrdev_open+0x10/0x10 [ 707.449425][T17367] vfs_open+0x82/0x3f0 [ 707.449456][T17367] path_openat+0x19fa/0x2440 [ 707.449484][T17367] ? __pfx_path_openat+0x10/0x10 [ 707.449516][T17367] do_file_open+0x20e/0x430 [ 707.449541][T17367] ? __pfx_do_file_open+0x10/0x10 [ 707.449582][T17367] ? _raw_spin_unlock+0x28/0x50 [ 707.449599][T17367] ? alloc_fd+0x471/0x7a0 [ 707.449628][T17367] do_sys_openat2+0x10f/0x1e0 [ 707.449654][T17367] ? __pfx_do_sys_openat2+0x10/0x10 [ 707.449683][T17367] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 707.449706][T17367] ? __fget_files+0x21f/0x3d0 [ 707.449734][T17367] __ia32_compat_sys_openat+0x12d/0x210 [ 707.449753][T17367] ? __pfx___ia32_compat_sys_openat+0x10/0x10 [ 707.449771][T17367] ? ksys_write+0x1ac/0x250 [ 707.449800][T17367] do_int80_emulation+0x166/0x650 [ 707.449824][T17367] asm_int80_emulation+0x1a/0x20 [ 707.449842][T17367] RIP: 0023:0xf71f75ab [ 707.449856][T17367] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 707.449872][T17367] RSP: 002b:00000000f54b603c EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 707.449890][T17367] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f54b6100 [ 707.449902][T17367] RDX: 0000000000080800 RSI: 0000000000000000 RDI: 0000000000000000 [ 707.449910][T17367] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 707.449917][T17367] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 707.449924][T17367] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 707.449939][T17367] [ 707.449958][T17367] debugfs: out of free dentries, can not create directory 'client-129' [ 707.613507][T11843] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 707.690582][ T5892] usb 5-1: new high-speed USB device number 82 using dummy_hcd [ 707.800645][T17378] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3128'. [ 708.023455][T11843] usb 9-1: Using ep0 maxpacket: 8 [ 708.024010][T11843] usb 9-1: New USB device found, idVendor=04e7, idProduct=0009, bcdDevice= 0.00 [ 708.024822][T11843] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 708.024846][T11843] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 708.033733][T11843] usb 9-1: config 0 descriptor?? [ 708.103993][ T5892] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 708.104827][ T5892] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 708.104887][ T5892] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 708.104907][ T5892] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 708.254739][T17361] lo speed is unknown, defaulting to 1000 [ 708.255508][T17361] lo speed is unknown, defaulting to 1000 [ 708.607140][T11843] usb 9-1: string descriptor 0 read error: -71 [ 708.609907][T11843] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 708.615997][T11843] usb 9-1: USB disconnect, device number 7 [ 708.787275][ T42] audit: type=1326 audit(1790823247.737:3983): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17389 comm="syz.1.3132" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 709.164065][ T65] block nbd4: Receive control failed (result -107) [ 709.167177][T17393] nbd4: detected capacity change from 0 to 18 [ 709.170416][T13483] block nbd4: Dead connection, failed to find a fallback [ 709.170438][T13483] block nbd4: shutting down sockets [ 709.170512][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.170537][T13483] buffer_io_error: 11 callbacks suppressed [ 709.170548][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.203409][ T5743] Bluetooth: hci0: command 0x040f tx timeout [ 709.239072][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.239104][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.239896][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.239920][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.240011][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.240033][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.240118][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.240140][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.246534][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.246561][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.257220][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.257248][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.257862][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.257887][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.257921][T16524] ldm_validate_partition_table(): Disk read failed. [ 709.258014][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.258036][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.258122][T13483] I/O error, dev nbd4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 709.258143][T13483] Buffer I/O error on dev nbd4, logical block 0, async page read [ 709.258324][T16524] Dev nbd4: unable to read RDB block 0 [ 709.258563][T16524] nbd4: unable to read partition table [ 709.258734][T16524] nbd4: partition table beyond EOD, truncated [ 709.262575][T17394] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 709.262635][T17394] pi3usb30532 0-0005: Error reading config register -16 [ 709.262778][T17394] pi3usb30532 0-0005: probe with driver pi3usb30532 failed with error -16 [ 709.263001][T17394] i2c i2c-0: new_device: Instantiated device pi3usb30532 at 0x05 [ 709.265497][T17393] nbd4: detected capacity change from 18 to 0 [ 709.268734][T16524] ldm_validate_partition_table(): Disk read failed. [ 709.268778][T16524] Dev nbd4: unable to read RDB block 0 [ 709.268800][T16524] nbd4: unable to read partition table [ 709.268949][T16524] nbd4: partition table beyond EOD, truncated [ 710.443663][T16605] usb 5-1: USB disconnect, device number 82 [ 710.526369][T17414] syz.1.3143 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 710.825902][T17428] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3142'. [ 711.022354][T17434] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3148'. [ 711.036239][T17434] hsr_slave_1 (unregistering): left promiscuous mode [ 711.082110][T17436] netlink: 4 bytes leftover after parsing attributes in process `syz.4.3148'. [ 711.513401][ T5848] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 711.593599][T16605] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 711.663860][ T5848] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 711.665010][ T5848] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 711.665029][ T5848] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 711.665058][ T5848] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.744026][T16605] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 711.744961][T16605] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 711.744981][T16605] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 711.745008][T16605] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.768624][ T42] audit: type=1326 audit(1790823250.717:3984): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17461 comm="syz.3.3159" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff4fec code=0x0 [ 711.843328][ T1478] usb 5-1: new high-speed USB device number 83 using dummy_hcd [ 712.008685][ T1478] usb 5-1: New USB device found, idVendor=056a, idProduct=033b, bcdDevice= 0.00 [ 712.010110][ T1478] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 712.010134][ T1478] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 712.010166][ T1478] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 712.662376][T17470] lo speed is unknown, defaulting to 1000 [ 712.663403][T17470] lo speed is unknown, defaulting to 1000 [ 713.955079][T17482] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 713.955099][T17482] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 713.955159][T17482] vhci_hcd vhci_hcd.0: Device attached [ 713.959464][T17482] binder: 17481:17482 ioctl 50009403 80000900 returned -22 [ 714.143108][ T5848] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 714.213232][ T5848] usb 43-1: new high-speed USB device number 2 using vhci_hcd [ 714.286081][ T5892] usb 9-1: USB disconnect, device number 8 [ 714.359564][ T854] usb 6-1: USB disconnect, device number 73 [ 714.415781][T17488] Bluetooth: MGMT ver 1.23 [ 714.592527][ T970] usb 5-1: USB disconnect, device number 83 [ 714.793047][ T5892] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 714.828118][T17498] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3166'. [ 714.931621][T17483] vhci_hcd: connection reset by peer [ 714.932320][T11670] vhci_hcd vhci_hcd.3: stop threads [ 714.944304][T11670] vhci_hcd vhci_hcd.3: release socket [ 714.950997][T11670] vhci_hcd vhci_hcd.3: disconnect device [ 714.964049][ T5892] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 714.964841][ T5892] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 714.964854][ T5892] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 714.964870][ T5892] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 715.387590][ T42] audit: type=1326 audit(1790823254.327:3985): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17504 comm="syz.1.3169" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7fb6fec code=0x0 [ 715.572159][T17510] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3168'. [ 717.221366][ T65] block nbd1: Receive control failed (result -107) [ 717.225045][T17522] nbd1: detected capacity change from 0 to 18 [ 717.228138][ T5113] block nbd1: Dead connection, failed to find a fallback [ 717.228156][ T5113] block nbd1: shutting down sockets [ 717.228168][ T5113] blk_print_req_error: 6 callbacks suppressed [ 717.228180][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.228202][ T5113] buffer_io_error: 6 callbacks suppressed [ 717.228212][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.229660][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.229685][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.229907][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.229929][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230021][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.230042][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230128][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.230148][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230249][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.230270][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230368][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.230389][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230475][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.230496][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230527][T16524] ldm_validate_partition_table(): Disk read failed. [ 717.230596][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.230617][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230702][ T5113] I/O error, dev nbd1, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 717.230723][ T5113] Buffer I/O error on dev nbd1, logical block 0, async page read [ 717.230913][T16524] Dev nbd1: unable to read RDB block 0 [ 717.231316][T16524] nbd1: unable to read partition table [ 717.231471][T16524] nbd1: partition table beyond EOD, truncated [ 717.285613][T17523] i2c i2c-0: Failed to register i2c client pi3usb30532 at 0x05 (-16) [ 717.305265][T17522] nbd1: detected capacity change from 18 to 0 [ 717.305483][T16524] ldm_validate_partition_table(): Disk read failed. [ 717.305507][T16524] Dev nbd1: unable to read RDB block 0 [ 717.305526][T16524] nbd1: unable to read partition table [ 717.305693][T16524] nbd1: partition table beyond EOD, truncated [ 717.549973][T16605] usb 9-1: USB disconnect, device number 9 [ 717.716466][T17529] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 717.720851][T17529] validate_nla: 39 callbacks suppressed [ 717.720870][T17529] netlink: 'syz.4.3177': attribute type 8 has an invalid length. [ 717.787959][T17528] block nbd4: shutting down sockets [ 717.859582][T17535] lo speed is unknown, defaulting to 1000 [ 717.860373][T17535] lo speed is unknown, defaulting to 1000 [ 718.976796][T17553] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3183'. [ 718.987096][T17553] hsr_slave_1 (unregistering): left promiscuous mode [ 719.028053][T17555] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3183'. [ 719.246595][T17559] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3185'. [ 719.600838][T17563] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 719.610254][T17563] netlink: 'syz.3.3187': attribute type 8 has an invalid length. [ 719.625932][ T5848] vhci_hcd vhci_hcd.3: vhci_device speed not set [ 719.665455][T17566] program syz.1.3188 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 719.666043][T17566] vivid-000: ================= START STATUS ================= [ 719.666103][T17566] vivid-000: Test Pattern: 75% Colorbar [ 719.666118][T17566] vivid-000: Fill Percentage of Frame: 100 [ 719.667446][T17566] vivid-000: Horizontal Movement: No Movement [ 719.667460][T17566] vivid-000: Vertical Movement: No Movement [ 719.667472][T17566] vivid-000: OSD Text Mode: All [ 719.667482][T17566] vivid-000: Show Border: false [ 719.667492][T17566] vivid-000: Show Square: true [ 719.667502][T17566] vivid-000: Sensor Flipped Horizontally: false [ 719.667558][T17566] vivid-000: Sensor Flipped Vertically: false [ 719.667572][T17566] vivid-000: Insert SAV Code in Image: false [ 719.667583][T17566] vivid-000: Insert EAV Code in Image: false [ 719.667699][T17566] vivid-000: Insert Video Guard Band: false [ 719.667712][T17566] vivid-000: Reduced Framerate: false [ 719.667723][T17566] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 719.667736][T17566] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 719.667801][T17566] vivid-000: Enable Capture Cropping: true [ 719.667812][T17566] vivid-000: Enable Capture Composing: true [ 719.667869][T17566] vivid-000: Enable Capture Scaler: true [ 719.667881][T17566] vivid-000: Timestamp Source: End of Frame [ 719.667892][T17566] vivid-000: Colorspace: Rec. 709 [ 719.667903][T17566] vivid-000: Transfer Function: Default [ 719.667913][T17566] vivid-000: Y'CbCr Encoding: Default [ 719.667924][T17566] vivid-000: HSV Encoding: Hue 0-179 [ 719.667986][T17566] vivid-000: Quantization: Default [ 719.667997][T17566] vivid-000: Apply Alpha To Red Only: false [ 719.668007][T17566] vivid-000: Standard Aspect Ratio: 4x3 [ 719.668018][T17566] vivid-000: DV Timings Signal Mode: Current DV Timings [ 719.668082][T17566] vivid-000: DV Timings: 640x480p59 inactive [ 719.668097][T17566] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 719.668109][T17566] vivid-000: Maximum EDID Blocks: 2 [ 719.668171][T17566] vivid-000: Limited RGB Range (16-235): true [ 719.668182][T17566] vivid-000: Rx RGB Quantization Range: Automatic [ 719.668242][T17566] vivid-000: Power Present: 0x00000001 [ 719.668256][T17566] tpg source WxH: 1280x720 (Y'CbCr) [ 719.668263][T17566] tpg field: 1 [ 719.668329][T17566] tpg crop: (0,0)/64x64 [ 719.668339][T17566] tpg compose: (0,0)/16x16 [ 719.668346][T17566] tpg colorspace: 3 [ 719.668351][T17566] tpg transfer function: 0/1 [ 719.668357][T17566] tpg Y'CbCr encoding: 0/2 [ 719.668363][T17566] tpg quantization: 0/2 [ 719.668368][T17566] tpg RGB range: 0/1 [ 719.668374][T17566] vivid-000: ================== END STATUS ================== [ 719.683364][T17562] block nbd3: shutting down sockets [ 719.968511][T17575] lo speed is unknown, defaulting to 1000 [ 719.969328][T17575] lo speed is unknown, defaulting to 1000 [ 720.453199][T17586] program syz.0.3201 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 720.453947][T17586] vivid-000: ================= START STATUS ================= [ 720.453957][T17586] vivid-000: Test Pattern: 75% Colorbar [ 720.453970][T17586] vivid-000: Fill Percentage of Frame: 100 [ 720.453983][T17586] vivid-000: Horizontal Movement: No Movement [ 720.453995][T17586] vivid-000: Vertical Movement: No Movement [ 720.454006][T17586] vivid-000: OSD Text Mode: All [ 720.454017][T17586] vivid-000: Show Border: false [ 720.454028][T17586] vivid-000: Show Square: true [ 720.454039][T17586] vivid-000: Sensor Flipped Horizontally: false [ 720.454050][T17586] vivid-000: Sensor Flipped Vertically: false [ 720.454062][T17586] vivid-000: Insert SAV Code in Image: false [ 720.454073][T17586] vivid-000: Insert EAV Code in Image: false [ 720.454084][T17586] vivid-000: Insert Video Guard Band: false [ 720.454096][T17586] vivid-000: Reduced Framerate: false [ 720.454108][T17586] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 720.454121][T17586] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 720.454133][T17586] vivid-000: Enable Capture Cropping: true [ 720.454144][T17586] vivid-000: Enable Capture Composing: true [ 720.454155][T17586] vivid-000: Enable Capture Scaler: true [ 720.454165][T17586] vivid-000: Timestamp Source: End of Frame [ 720.454176][T17586] vivid-000: Colorspace: Rec. 709 [ 720.454187][T17586] vivid-000: Transfer Function: Default [ 720.454197][T17586] vivid-000: Y'CbCr Encoding: Default [ 720.454208][T17586] vivid-000: HSV Encoding: Hue 0-179 [ 720.454218][T17586] vivid-000: Quantization: Default [ 720.454228][T17586] vivid-000: Apply Alpha To Red Only: false [ 720.454239][T17586] vivid-000: Standard Aspect Ratio: 4x3 [ 720.454250][T17586] vivid-000: DV Timings Signal Mode: Current DV Timings [ 720.454261][T17586] vivid-000: DV Timings: 640x480p59 inactive [ 720.454274][T17586] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 720.454291][T17586] vivid-000: Maximum EDID Blocks: 2 [ 720.454305][T17586] vivid-000: Limited RGB Range (16-235): true [ 720.454330][T17586] vivid-000: Rx RGB Quantization Range: Automatic [ 720.454347][T17586] vivid-000: Power Present: 0x00000001 [ 720.454360][T17586] tpg source WxH: 1280x720 (Y'CbCr) [ 720.454368][T17586] tpg field: 1 [ 720.454372][T17586] tpg crop: (0,0)/64x64 [ 720.454380][T17586] tpg compose: (0,0)/16x16 [ 720.454388][T17586] tpg colorspace: 3 [ 720.454392][T17586] tpg transfer function: 0/1 [ 720.454398][T17586] tpg Y'CbCr encoding: 0/2 [ 720.454404][T17586] tpg quantization: 0/2 [ 720.454410][T17586] tpg RGB range: 0/1 [ 720.454415][T17586] vivid-000: ================== END STATUS ================== [ 720.762692][T17595] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3194'. [ 720.912869][ T5848] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 721.073348][ T5848] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 721.074113][ T5848] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 721.074127][ T5848] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 721.074144][ T5848] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 721.511760][T17599] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3197'. [ 721.524487][T17599] hsr_slave_1 (unregistering): left promiscuous mode [ 721.556870][T17599] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3197'. [ 722.410577][T17609] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 722.413733][T17609] netlink: 'syz.1.3199': attribute type 8 has an invalid length. [ 722.688116][T17608] block nbd1: shutting down sockets [ 722.741614][T17614] netlink: 'syz.1.3202': attribute type 8 has an invalid length. [ 722.753342][T17617] netlink: 'syz.1.3202': attribute type 8 has an invalid length. [ 722.760058][ T42] audit: type=1326 audit(1790823261.698:3986): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17615 comm="syz.0.3203" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 722.855797][T17626] program syz.3.3204 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 722.856430][T17626] vivid-000: ================= START STATUS ================= [ 722.856440][T17626] vivid-000: Test Pattern: 75% Colorbar [ 722.856454][T17626] vivid-000: Fill Percentage of Frame: 100 [ 722.856467][T17626] vivid-000: Horizontal Movement: No Movement [ 722.856478][T17626] vivid-000: Vertical Movement: No Movement [ 722.856490][T17626] vivid-000: OSD Text Mode: All [ 722.856501][T17626] vivid-000: Show Border: false [ 722.856512][T17626] vivid-000: Show Square: true [ 722.856523][T17626] vivid-000: Sensor Flipped Horizontally: false [ 722.856534][T17626] vivid-000: Sensor Flipped Vertically: false [ 722.856545][T17626] vivid-000: Insert SAV Code in Image: false [ 722.856556][T17626] vivid-000: Insert EAV Code in Image: false [ 722.856569][T17626] vivid-000: Insert Video Guard Band: false [ 722.856580][T17626] vivid-000: Reduced Framerate: false [ 722.856592][T17626] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 722.856605][T17626] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 722.856618][T17626] vivid-000: Enable Capture Cropping: true [ 722.856629][T17626] vivid-000: Enable Capture Composing: true [ 722.856640][T17626] vivid-000: Enable Capture Scaler: true [ 722.856652][T17626] vivid-000: Timestamp Source: End of Frame [ 722.856663][T17626] vivid-000: Colorspace: Rec. 709 [ 722.856673][T17626] vivid-000: Transfer Function: Default [ 722.856710][T17626] vivid-000: Y'CbCr Encoding: Default [ 722.856722][T17626] vivid-000: HSV Encoding: Hue 0-179 [ 722.856734][T17626] vivid-000: Quantization: Default [ 722.856745][T17626] vivid-000: Apply Alpha To Red Only: false [ 722.856757][T17626] vivid-000: Standard Aspect Ratio: 4x3 [ 722.856769][T17626] vivid-000: DV Timings Signal Mode: Current DV Timings [ 722.856781][T17626] vivid-000: DV Timings: 640x480p59 inactive [ 722.856796][T17626] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 722.856809][T17626] vivid-000: Maximum EDID Blocks: 2 [ 722.856821][T17626] vivid-000: Limited RGB Range (16-235): true [ 722.856832][T17626] vivid-000: Rx RGB Quantization Range: Automatic [ 722.856845][T17626] vivid-000: Power Present: 0x00000001 [ 722.856857][T17626] tpg source WxH: 1280x720 (Y'CbCr) [ 722.856864][T17626] tpg field: 1 [ 722.856868][T17626] tpg crop: (0,0)/64x64 [ 722.856875][T17626] tpg compose: (0,0)/16x16 [ 722.856881][T17626] tpg colorspace: 3 [ 722.856885][T17626] tpg transfer function: 0/1 [ 722.856891][T17626] tpg Y'CbCr encoding: 0/2 [ 722.856896][T17626] tpg quantization: 0/2 [ 722.856901][T17626] tpg RGB range: 0/1 [ 722.856906][T17626] vivid-000: ================== END STATUS ================== [ 722.979832][T17632] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3212'. [ 723.069196][T17634] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3205'. [ 723.838537][T16605] usb 9-1: USB disconnect, device number 10 [ 723.994750][T17646] netlink: 52 bytes leftover after parsing attributes in process `syz.1.3215'. [ 724.192969][ T854] usb 5-1: new high-speed USB device number 84 using dummy_hcd [ 724.358844][ T854] usb 5-1: New USB device found, idVendor=0525, idProduct=1080, bcdDevice= 1.00 [ 724.365758][ T854] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 724.611333][ T854] net1080 5-1:1.0 usb0: register 'net1080' at usb-dummy_hcd.0-1, NetChip TurboCONNECT, 8e:57:bf:22:da:32 [ 724.804839][T17643] overlayfs: upper fs does not support file handles, falling back to index=off. [ 724.804909][T17643] overlayfs: conflicting lowerdir path [ 725.094716][T16824] usb 5-1: USB disconnect, device number 84 [ 725.095721][T16824] net1080 5-1:1.0 usb0: unregister 'net1080' usb-dummy_hcd.0-1, NetChip TurboCONNECT [ 725.110202][T17666] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3219'. [ 725.396747][T17678] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 725.573402][T17677] block nbd4: shutting down sockets [ 725.728086][T17688] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3216'. [ 726.102452][ T854] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 726.286680][ T854] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 726.287610][ T854] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 726.287623][ T854] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 726.287640][ T854] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 726.337531][ T61] kworker/2:1 (61) used greatest stack depth: 16536 bytes left [ 726.873054][T17710] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3222'. [ 726.910295][T17711] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3225'. [ 727.111434][T17713] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 727.121592][T17713] netlink: 'syz.1.3226': attribute type 8 has an invalid length. [ 727.203616][T17712] block nbd1: shutting down sockets [ 727.856371][T17720] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 727.890697][T17723] netlink: 28 bytes leftover after parsing attributes in process `syz.1.3228'. [ 727.935947][T17719] block nbd0: shutting down sockets [ 728.208886][T17727] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3230'. [ 728.753858][T17731] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3231'. [ 729.059422][ T5848] usb 9-1: USB disconnect, device number 11 [ 729.305384][ T1167] IPVS: starting estimator thread 0... [ 729.310712][T17739] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3240'. [ 729.402266][T17738] IPVS: using max 43 ests per chain, 103200 per kthread [ 729.852171][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 730.077995][T17750] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 730.085383][T17750] netlink: 'syz.4.3236': attribute type 8 has an invalid length. [ 730.275904][T17757] netlink: 52 bytes leftover after parsing attributes in process `syz.0.3238'. [ 730.303177][T17749] block nbd4: shutting down sockets [ 730.533856][T17762] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3239'. [ 731.278404][T17770] loop5: detected capacity change from 0 to 2640 [ 731.278655][T17770] buffer_io_error: 6 callbacks suppressed [ 731.278663][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278682][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278697][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278713][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278729][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278751][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278771][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278787][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278795][T17770] ldm_validate_partition_table(): Disk read failed. [ 731.278809][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278824][T17770] Buffer I/O error on dev loop5, logical block 0, async page read [ 731.278848][T17770] Dev loop5: unable to read RDB block 0 [ 731.279022][T17770] loop5: unable to read partition table [ 731.279108][T17770] loop_reread_partitions: partition scan of loop5 (3„ ¾‚³˜) failed (rc=-5) [ 731.302472][T17774] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3242'. [ 731.383668][T17777] bond1 (unregistering): Released all slaves [ 731.562454][ T5892] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 731.881156][ T5892] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 731.922124][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 731.922813][T17784] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3246'. [ 731.954413][ T5892] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 731.954429][ T5892] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 731.954447][ T5892] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 732.308862][ T74] IPVS: starting estimator thread 0... [ 732.402164][T17788] IPVS: using max 42 ests per chain, 100800 per kthread [ 732.580377][T17790] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 732.584078][T17790] netlink: 'syz.0.3248': attribute type 8 has an invalid length. [ 732.635583][T17789] block nbd0: shutting down sockets [ 733.133832][T17796] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 733.233330][T17795] block nbd1: shutting down sockets [ 734.002136][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 734.013699][T17806] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3252'. [ 734.337572][T15098] usb 9-1: USB disconnect, device number 12 [ 734.678130][T17815] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3254'. [ 734.909277][T17820] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3256'. [ 735.357226][T17825] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3255'. [ 735.979038][ T42] audit: type=1326 audit(1790823274.918:3987): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17835 comm="syz.4.3262" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6feefec code=0x0 [ 736.081963][ T64] Bluetooth: hci1: command 0x0c1a tx timeout [ 736.291870][ T5892] usb 5-1: new high-speed USB device number 85 using dummy_hcd [ 736.462395][ T5892] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 736.463242][ T5892] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 736.463256][ T5892] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 736.463275][ T5892] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 736.715640][T17846] netlink: 20 bytes leftover after parsing attributes in process `syz.3.3265'. [ 737.262578][T11843] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 737.412541][T11843] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 737.413512][T11843] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 737.413532][T11843] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 737.413561][T11843] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 738.143360][T17864] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3268'. [ 738.203735][T17869] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3270'. [ 739.078751][T17877] netlink: 28 bytes leftover after parsing attributes in process `syz.4.3273'. [ 739.213979][T16605] usb 5-1: USB disconnect, device number 85 [ 739.416051][T17879] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 739.419588][T17879] netlink: 'syz.0.3274': attribute type 8 has an invalid length. [ 739.536086][T17878] block nbd0: shutting down sockets [ 739.579604][ T42] audit: type=1326 audit(1790823278.519:3988): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17881 comm="syz.0.3275" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 739.990155][T17887] netlink: 20 bytes leftover after parsing attributes in process `syz.4.3276'. [ 740.045809][ T970] usb 6-1: USB disconnect, device number 74 [ 740.872788][T17900] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3280'. [ 740.912142][T17901] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3279'. [ 741.802664][T17907] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3283'. [ 741.872465][T11843] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 741.983592][T17917] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3286'. [ 742.261956][T11843] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 742.262826][T11843] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 742.262839][T11843] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 742.262856][T11843] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 742.996562][T17923] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3287'. [ 743.743803][ T42] audit: type=1326 audit(1790823282.689:3989): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17924 comm="syz.0.3288" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6fdefec code=0x0 [ 744.599285][T11843] usb 6-1: USB disconnect, device number 75 [ 744.867691][T17939] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3289'. [ 745.787638][T17953] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3295'. [ 745.798668][T17954] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3294'. [ 746.523842][T17959] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3296'. [ 746.556722][ T42] audit: type=1326 audit(1790823285.499:3990): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=17962 comm="syz.4.3297" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6feefec code=0x0 [ 746.576995][T17961] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 746.578931][T17961] netlink: 'syz.0.3305': attribute type 8 has an invalid length. [ 746.643623][T17960] block nbd0: shutting down sockets [ 746.802357][ T1438] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.421206][ T970] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 747.581754][ T970] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 747.582658][ T970] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 747.582670][ T970] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 747.582687][ T970] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 747.741258][T16824] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 747.902054][T16824] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 747.903119][T16824] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 747.903138][T16824] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 747.903169][T16824] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 750.208005][ T854] usb 6-1: USB disconnect, device number 76 [ 750.505907][T17994] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3302'. [ 750.921585][T16824] usb 9-1: USB disconnect, device number 13 [ 751.021060][ T5169] usb 5-1: new high-speed USB device number 86 using dummy_hcd [ 751.171522][ T5169] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 751.172341][ T5169] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 751.172355][ T5169] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 751.172374][ T5169] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 751.459345][T18000] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3304'. [ 751.651416][T16605] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 751.652543][T18005] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3306'. [ 751.842203][T16605] usb 9-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 751.910820][T16605] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 751.912758][T16605] usb 9-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 751.913245][T16605] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 752.721951][T18013] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3308'. [ 752.862656][T18016] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3309'. [ 753.568042][ T5848] usb 5-1: USB disconnect, device number 86 [ 753.588351][ T42] audit: type=1326 audit(1790823292.529:3991): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18017 comm="syz.3.3310" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7ff4fec code=0x0 [ 753.950320][T18027] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3313'. [ 754.382432][T18029] netlink: 20 bytes leftover after parsing attributes in process `syz.1.3312'. [ 754.750506][T16605] usb 9-1: USB disconnect, device number 14 [ 754.927293][T18033] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3314'. [ 755.085238][T18041] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3316'. [ 755.894554][T18044] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3318'. [ 755.931611][T18053] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3319'. [ 756.043491][T18055] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3320'. [ 756.349281][T18060] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3321'. [ 756.880848][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 757.037705][T18064] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3322'. [ 757.357337][T18068] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3323'. [ 757.694625][T18071] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 757.696571][T18071] netlink: 'syz.0.3332': attribute type 8 has an invalid length. [ 757.753140][T18070] block nbd0: shutting down sockets [ 757.821341][ T42] audit: type=1326 audit(1790823296.720:3992): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18075 comm="syz.4.3325" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6feefec code=0x0 [ 758.230704][ T5169] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 758.237744][T18080] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3324'. [ 758.381036][ T5169] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 758.381818][ T5169] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 758.381832][ T5169] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 758.381850][ T5169] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 758.491150][T18086] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3327'. [ 758.962895][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 759.404403][T18097] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3329'. [ 759.425213][T18098] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3330'. [ 760.848571][T15098] usb 5-1: USB disconnect, device number 87 [ 760.938922][T18111] __nla_validate_parse: 1 callbacks suppressed [ 760.938935][T18111] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3334'. [ 760.994360][T18113] netlink: 'syz.3.3335': attribute type 1 has an invalid length. [ 761.040622][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 761.048786][T18113] bond2: (slave veth3): Enslaving as an active interface with a down link [ 761.057873][T18113] netlink: 28 bytes leftover after parsing attributes in process `syz.3.3335'. [ 761.058841][T18113] 8021q: adding VLAN 0 to HW filter on device bond2 [ 761.657124][T18122] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 761.661491][T18122] netlink: 'syz.0.3336': attribute type 8 has an invalid length. [ 761.792245][T18121] block nbd0: shutting down sockets [ 761.877058][T18127] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3338'. [ 762.147710][T18135] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3339'. [ 762.436674][T18138] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3341'. [ 762.847791][T18144] FAULT_INJECTION: forcing a failure. [ 762.847791][T18144] name fail_futex, interval 1, probability 0, space 0, times 0 [ 762.847813][T18144] CPU: 3 UID: 0 PID: 18144 Comm: syz.0.3344 Tainted: G L syzkaller #0 PREEMPT(full) [ 762.847829][T18144] Tainted: [L]=SOFTLOCKUP [ 762.847833][T18144] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 762.847839][T18144] Call Trace: [ 762.847844][T18144] [ 762.847862][T18144] dump_stack_lvl+0x100/0x190 [ 762.847882][T18144] should_fail_ex.cold+0x5/0xa [ 762.847895][T18144] ? __lock_acquire+0x5c0/0x1f40 [ 762.847913][T18144] get_futex_key+0x1d0/0x14f0 [ 762.847926][T18144] ? __pfx_get_futex_key+0x10/0x10 [ 762.847936][T18144] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 762.847956][T18144] futex_wake+0xf4/0x5e0 [ 762.847972][T18144] ? __pfx_futex_wake+0x10/0x10 [ 762.847992][T18144] do_futex+0x2b2/0x440 [ 762.848005][T18144] ? __pfx_do_futex+0x10/0x10 [ 762.848017][T18144] ? __do_sys_add_key+0x37d/0x460 [ 762.848032][T18144] ? rcu_is_watching+0x13/0xc0 [ 762.848044][T18144] ? __do_sys_add_key+0x37d/0x460 [ 762.848059][T18144] ? kfree+0x1e5/0x6d0 [ 762.848071][T18144] __ia32_sys_futex_time32+0x2f4/0x470 [ 762.848087][T18144] ? __pfx___ia32_sys_futex_time32+0x10/0x10 [ 762.848107][T18144] __do_fast_syscall_32+0x13a/0x8b0 [ 762.848123][T18144] do_fast_syscall_32+0x32/0x70 [ 762.848138][T18144] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 762.848157][T18144] RIP: 0023:0xf6fdefec [ 762.848170][T18144] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 762.848175][T18144] RSP: 002b:00000000f53cd5cc EFLAGS: 00000246 ORIG_RAX: 00000000000000f0 [ 762.848187][T18144] RAX: ffffffffffffffda RBX: 00000000f73d4f8c RCX: 0000000000000081 [ 762.848194][T18144] RDX: 00000000000f4240 RSI: 0000000020646165 RDI: 0000000063617473 [ 762.848201][T18144] RBP: 0000000000203a6b R08: 0000000000000000 R09: 0000000000000000 [ 762.848207][T18144] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 762.848214][T18144] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 762.848228][T18144] [ 762.849837][T18145] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 762.849886][T18144] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 763.111494][T18153] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3342'. [ 763.120942][ T5743] Bluetooth: hci1: command 0x0c1a tx timeout [ 763.197104][T18154] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3343'. [ 764.087686][T18161] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 764.097042][T18161] netlink: 'syz.4.3348': attribute type 8 has an invalid length. [ 764.261062][T18159] block nbd4: shutting down sockets [ 764.515665][T18165] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3347'. [ 764.566927][T18171] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3346'. [ 764.618363][T18174] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3351'. [ 764.984976][T18182] jffs2: notice: (18182) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 765.392190][ T5892] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 765.560595][ T5892] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 765.561407][ T5892] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 765.561421][ T5892] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 765.561438][ T5892] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 765.815682][T18194] jffs2: notice: (18194) jffs2_build_xattr_subsystem: complete building xattr subsystem, 0 of xdatum (0 unchecked, 0 orphan) and 0 of xref (0 dead, 0 orphan) found. [ 765.843495][T18192] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 765.846870][T18192] netlink: 'syz.3.3358': attribute type 8 has an invalid length. [ 765.926272][T18191] block nbd3: shutting down sockets [ 766.067754][T18211] __nla_validate_parse: 2 callbacks suppressed [ 766.067818][T18211] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3360'. [ 766.247034][T18215] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3363'. [ 767.080600][T18219] netlink: 16 bytes leftover after parsing attributes in process `syz.0.3364'. [ 767.782084][T18232] jffs2: notice: (18232) jffs2_build_xattr_subsystem: complete building xattr subsystem, 1 of xdatum (0 unchecked, 0 orphan) and 1 of xref (0 dead, 0 orphan) found. [ 767.788092][T18232] FAULT_INJECTION: forcing a failure. [ 767.788092][T18232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 767.788120][T18232] CPU: 0 UID: 0 PID: 18232 Comm: syz.0.3368 Tainted: G L syzkaller #0 PREEMPT(full) [ 767.788141][T18232] Tainted: [L]=SOFTLOCKUP [ 767.788146][T18232] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 767.788156][T18232] Call Trace: [ 767.788161][T18232] [ 767.788168][T18232] dump_stack_lvl+0x100/0x190 [ 767.788193][T18232] should_fail_ex.cold+0x5/0xa [ 767.788213][T18232] strncpy_from_user+0x3b/0x2d0 [ 767.788251][T18232] do_getname+0x78/0x390 [ 767.788268][T18232] path_setxattrat+0x360/0x3b0 [ 767.788290][T18232] ? __pfx_path_setxattrat+0x10/0x10 [ 767.788313][T18232] ? rcu_read_lock_any_held+0x6a/0x90 [ 767.788331][T18232] ? find_held_lock+0x2b/0x80 [ 767.788364][T18232] ? fput+0x7c/0x100 [ 767.788384][T18232] ? ksys_write+0x1ac/0x250 [ 767.788402][T18232] __ia32_sys_lsetxattr+0xc7/0x140 [ 767.788423][T18232] ? __do_fast_syscall_32+0xb3/0x8b0 [ 767.788442][T18232] ? lockdep_hardirqs_on+0x7d/0x110 [ 767.788459][T18232] __do_fast_syscall_32+0x13a/0x8b0 [ 767.788519][T18232] ? lockdep_hardirqs_on+0x7d/0x110 [ 767.788538][T18232] do_fast_syscall_32+0x32/0x70 [ 767.788557][T18232] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 767.788576][T18232] RIP: 0023:0xf6fdefec [ 767.788593][T18232] Code: Unable to access opcode bytes at 0xf6fdefc2. [ 767.788600][T18232] RSP: 002b:00000000f53cd50c EFLAGS: 00000292 ORIG_RAX: 00000000000000e3 [ 767.788615][T18232] RAX: ffffffffffffffda RBX: 0000000080000180 RCX: 0000000080003380 [ 767.788625][T18232] RDX: 0000000080002400 RSI: 0000000000000024 RDI: 0000000000000000 [ 767.788633][T18232] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 767.788643][T18232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 767.788651][T18232] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 767.788670][T18232] [ 767.953234][T18235] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 767.956000][T18238] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 767.959275][T18238] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 768.125881][T15098] usb 6-1: USB disconnect, device number 77 [ 768.383028][T18251] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3372'. [ 769.289180][T18263] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3373'. [ 769.375807][T18261] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3374'. [ 770.087261][T18272] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 770.168396][T18268] netlink: 'syz.3.3376': attribute type 8 has an invalid length. [ 770.362864][T18267] block nbd3: shutting down sockets [ 770.380105][T15098] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 770.562358][T15098] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 770.564095][T15098] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 770.564149][T15098] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 770.564242][T15098] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 770.595938][T18296] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3379'. [ 771.124012][T15098] usb 6-1: USB disconnect, device number 78 [ 771.170660][T18303] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3382'. [ 771.857743][T18314] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3385'. [ 772.502906][T18321] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3395'. [ 772.980252][T18331] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3388'. [ 773.071134][T18333] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 773.211704][T18326] netlink: 'syz.4.3389': attribute type 8 has an invalid length. [ 773.348772][T18324] block nbd4: shutting down sockets [ 773.968864][T18345] netlink: 16 bytes leftover after parsing attributes in process `syz.4.3391'. [ 774.259045][T18346] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3392'. [ 774.366287][T11843] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 774.419054][T18348] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3394'. [ 774.713381][T11843] usb 6-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 774.716405][T11843] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 774.716428][T11843] usb 6-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 774.716480][T11843] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 774.750787][T18354] tipc: Started in network mode [ 774.750805][T18354] tipc: Node identity ac14140f, cluster identity 4711 [ 774.751641][T18354] tipc: New replicast peer: 255.255.255.255 [ 774.752240][T18354] tipc: Enabled bearer , priority 10 [ 774.754153][T18354] tipc: New replicast peer: fc02:0000:0000:0000:0000:0000:0000:0001 [ 774.914433][T18360] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3398'. [ 774.962964][T18362] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 774.966941][T18362] netlink: 'syz.4.3400': attribute type 8 has an invalid length. [ 775.065422][T18359] block nbd4: shutting down sockets [ 775.232808][ T5826] usb 6-1: USB disconnect, device number 79 [ 775.769849][ T5848] tipc: Node number set to 2886997007 [ 775.914396][T18375] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3402'. [ 776.285844][T18382] netlink: 16 bytes leftover after parsing attributes in process `syz.1.3404'. [ 777.145595][T18393] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3406'. [ 777.311946][T18396] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 777.314009][T18396] netlink: 'syz.0.3409': attribute type 8 has an invalid length. [ 777.370533][T18392] block nbd0: shutting down sockets [ 777.535393][T18402] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3410'. [ 778.779628][T16605] usb 5-1: new high-speed USB device number 88 using dummy_hcd [ 778.940335][T16605] usb 5-1: New USB device found, idVendor=06cd, idProduct=0135, bcdDevice= 1.00 [ 778.947333][T16605] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 778.947360][T16605] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 778.947393][T16605] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 779.023975][T18422] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3415'. [ 779.254464][T18423] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3416'. [ 779.647705][T18427] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3417'. [ 780.360902][T16605] usb 5-1: USB disconnect, device number 88 [ 780.405583][ T42] audit: type=1326 audit(1790823319.351:3993): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=18429 comm="syz.4.3419" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf6feefec code=0x0 [ 780.454832][T18432] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 780.463618][T18432] netlink: 'syz.3.3418': attribute type 8 has an invalid length. [ 780.560782][T18431] block nbd3: shutting down sockets [ 780.621297][T18441] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3420'. [ 780.730430][T18443] netlink: 8 bytes leftover after parsing attributes in process `syz.3.3421'. [ 782.349536][T18458] netlink: 16 bytes leftover after parsing attributes in process `syz.3.3426'. [ 783.501110][T18462] sctp: [Deprecated]: syz.0.3427 (pid 18462) Use of struct sctp_assoc_value in delayed_ack socket option. [ 783.501110][T18462] Use struct sctp_sack_info instead [ 784.530585][T18448] ------------[ cut here ]------------ [ 784.530596][T18448] current->flags & PF_MEMALLOC [ 784.530602][T18448] WARNING: mm/page_alloc.c:4816 at __alloc_frozen_pages_noprof+0x1eac/0x3300, CPU#0: syz.1.3423/18448 [ 784.537180][T18448] Modules linked in: [ 784.538535][T18448] CPU: 0 UID: 0 PID: 18448 Comm: syz.1.3423 Tainted: G L syzkaller #0 PREEMPT(full) [ 784.542081][T18448] Tainted: [L]=SOFTLOCKUP [ 784.543460][T18448] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 784.548164][T18448] RIP: 0010:__alloc_frozen_pages_noprof+0x1eac/0x3300 [ 784.550412][T18448] Code: 38 d0 7c 08 84 d2 0f 85 de 12 00 00 65 48 8b 05 e2 a7 1c 12 c7 84 24 94 00 00 00 00 80 00 00 f6 40 2d 08 0f 84 ba e7 ff ff 90 <0f> 0b 90 e9 b1 e7 ff ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 [ 784.556930][T18448] RSP: 0000:ffffc90007505f18 EFLAGS: 00010202 [ 784.558865][T18448] RAX: ffff88805ef68000 RBX: 0000000000000000 RCX: 1ffff1100fffad29 [ 784.561568][T18448] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88803fffd938 [ 784.564070][T18448] RBP: ffff88805ef6802c R08: 0000000000008000 R09: 0000000000000001 [ 784.566546][T18448] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000148c48 [ 784.569180][T18448] R13: ffff88803fffb900 R14: 0000000000000000 R15: 1ffff92000ea0bfd [ 784.571713][T18448] FS: 0000000000000000(0000) GS:ffff888096955000(0063) knlGS:00000000f5476b40 [ 784.574491][T18448] CS: 0010 DS: 002b ES: 002b CR0: 0000000080050033 [ 784.576559][T18448] CR2: 00000000f748ba54 CR3: 0000000069409000 CR4: 0000000000352ef0 [ 784.579094][T18448] Call Trace: [ 784.580167][T18448] [ 784.581133][T18448] ? check_prev_add+0xfe/0xe60 [ 784.582658][T18448] ? __lock_acquire+0xe8b/0x1f40 [ 784.584235][T18448] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 784.586239][T18448] ? lock_acquire+0x1d1/0x380 [ 784.587749][T18448] ? clockevents_program_event+0x1bf/0x820 [ 784.589649][T18448] ? __bfs+0x150/0x2a0 [ 784.590980][T18448] ? find_held_lock+0x2b/0x80 [ 784.592687][T18448] ? __lock_acquire+0x5c0/0x1f40 [ 784.594256][T18448] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 784.596241][T18448] ? policy_nodemask+0xed/0x4f0 [ 784.597845][T18448] alloc_pages_mpol+0x201/0x550 [ 784.599492][T18448] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 784.601229][T18448] ? filemap_get_entry+0x22d/0x450 [ 784.602847][T18448] ? filemap_get_entry+0x22d/0x450 [ 784.604473][T18448] folio_alloc_noprof+0x22/0x250 [ 784.606039][T18448] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 784.608029][T18448] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 784.610405][T18448] ? __filemap_get_folio_mpol+0x369/0x1280 [ 784.612232][T18448] __filemap_get_folio_mpol+0x653/0x1280 [ 784.613986][T18448] bdev_getblk+0x246/0x6a0 [ 784.615421][T18448] ? ext4_get_group_desc+0x2b9/0x570 [ 784.617100][T18448] __ext4_get_inode_loc+0x571/0x1510 [ 784.618770][T18448] ? __pfx___ext4_get_inode_loc+0x10/0x10 [ 784.620684][T18448] ? start_this_handle+0xfa7/0x1390 [ 784.622323][T18448] ? ext4_get_inode_loc+0xbd/0x160 [ 784.623941][T18448] ext4_get_inode_loc+0xbd/0x160 [ 784.625512][T18448] ? __pfx_ext4_get_inode_loc+0x10/0x10 [ 784.627502][T18448] ? __pfx_ext4_dirty_inode+0x10/0x10 [ 784.629488][T18448] ext4_reserve_inode_write+0x145/0x330 [ 784.631235][T18448] __ext4_mark_inode_dirty+0x18f/0x910 [ 784.633026][T18448] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 784.634793][T18448] ? __pfx___ext4_mark_inode_dirty+0x10/0x10 [ 784.636688][T18448] ? trace_jbd2_handle_start+0x83/0x240 [ 784.638436][T18448] ? jbd2__journal_start+0xf7/0x6b0 [ 784.640359][T18448] ? __ext4_journal_start_sb+0x314/0x610 [ 784.642147][T18448] ? __ext4_journal_start_sb+0x17b/0x610 [ 784.644160][T18448] ? ext4_dirty_inode+0xa1/0x130 [ 784.645750][T18448] ? __pfx_ext4_dirty_inode+0x10/0x10 [ 784.647445][T18448] ext4_dirty_inode+0xd9/0x130 [ 784.648982][T18448] ? rcu_is_watching+0x13/0xc0 [ 784.650923][T18448] __mark_inode_dirty+0x1f3/0x16e0 [ 784.652640][T18448] sync_lazytime+0x39b/0x5d0 [ 784.654231][T18448] iput.part.0+0x207/0x1050 [ 784.655663][T18448] ? dentry_unlink_inode+0xc7/0x470 [ 784.657306][T18448] ? __pfx_do_raw_spin_trylock+0x10/0x10 [ 784.659193][T18448] iput+0x35/0x40 [ 784.660500][T18448] dentry_unlink_inode+0x284/0x470 [ 784.662113][T18448] dentry_kill+0x25d/0xc20 [ 784.663536][T18448] shrink_dentry_list+0x1e8/0x310 [ 784.665140][T18448] prune_dcache_sb+0xea/0x150 [ 784.666619][T18448] ? list_lru_count_one+0x147/0x320 [ 784.668382][T18448] ? __pfx_prune_dcache_sb+0x10/0x10 [ 784.670138][T18448] super_cache_scan+0x32b/0x550 [ 784.671757][T18448] do_shrink_slab+0x416/0x1200 [ 784.673360][T18448] shrink_slab+0x171/0x12e0 [ 784.674817][T18448] ? try_to_shrink_lruvec+0x68d/0x830 [ 784.676499][T18448] ? __pfx_shrink_slab+0x10/0x10 [ 784.678052][T18448] ? lock_acquire+0x1d1/0x380 [ 784.679587][T18448] shrink_one+0x398/0x850 [ 784.681138][T18448] ? shrink_node+0x2a81/0x4320 [ 784.682654][T18448] ? shrink_node+0x2b00/0x4320 [ 784.684155][T18448] shrink_node+0x2b20/0x4320 [ 784.685724][T18448] ? shrink_node+0x286e/0x4320 [ 784.687231][T18448] ? __pfx_shrink_node+0x10/0x10 [ 784.688807][T18448] ? queue_work_on+0x141/0x1e0 [ 784.690399][T18448] ? do_try_to_free_pages+0x33e/0x16d0 [ 784.691913][T18448] do_try_to_free_pages+0x33e/0x16d0 [ 784.693620][T18448] ? __pfx_do_try_to_free_pages+0x10/0x10 [ 784.695405][T18448] ? __lock_acquire+0x5c0/0x1f40 [ 784.696981][T18448] try_to_free_pages+0x2a0/0x740 [ 784.698640][T18448] ? __pfx_try_to_free_pages+0x10/0x10 [ 784.700498][T18448] ? find_held_lock+0x2b/0x80 [ 784.701927][T18448] ? fs_reclaim_acquire+0x70/0x100 [ 784.703632][T18448] ? fs_reclaim_acquire+0x70/0x100 [ 784.705260][T18448] __alloc_frozen_pages_noprof+0xf8a/0x3300 [ 784.707108][T18448] ? __pfx_vmap_small_pages_range_noflush+0x10/0x10 [ 784.709247][T18448] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 784.711254][T18448] ? __vmap_pages_range_noflush+0x3db/0x660 [ 784.713101][T18448] ? is_vmalloc_addr+0x86/0xa0 [ 784.714615][T18448] ? is_vmalloc_or_module_addr+0x47/0x60 [ 784.716308][T18448] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 784.718388][T18448] ? __css_rstat_updated+0x1ce/0x590 [ 784.720281][T18448] ? __pfx___css_rstat_updated+0x10/0x10 [ 784.722231][T18448] ? policy_nodemask+0xed/0x4f0 [ 784.723788][T18448] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 784.725682][T18448] ? policy_nodemask+0xed/0x4f0 [ 784.727264][T18448] alloc_pages_mpol+0x201/0x550 [ 784.728837][T18448] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 784.730624][T18448] ? find_held_lock+0x2b/0x80 [ 784.732123][T18448] ? rcu_read_unlock+0x17/0x60 [ 784.733652][T18448] ? rcu_read_unlock+0x17/0x60 [ 784.735167][T18448] alloc_pages_noprof+0x1a/0x160 [ 784.736737][T18448] __vmalloc_node_range_noprof+0xc1b/0x1420 [ 784.738908][T18448] ? bpf_check+0x1c48/0xa550 [ 784.740514][T18448] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 784.742276][T18448] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 784.744270][T18448] ? rcu_is_watching+0x13/0xc0 [ 784.745869][T18448] __kvmalloc_node_noprof+0x3da/0x9b0 [ 784.747685][T18448] ? bpf_check+0x1c48/0xa550 [ 784.749486][T18448] ? bpf_check+0x1c48/0xa550 [ 784.751351][T18448] bpf_check+0x1c48/0xa550 [ 784.753145][T18448] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 784.755629][T18448] ? rcu_is_watching+0x13/0xc0 [ 784.757430][T18448] ? __up_read+0x333/0x980 [ 784.759243][T18448] ? __pfx_bpf_check+0x10/0x10 [ 784.761314][T18448] ? lock_acquire+0x1d1/0x380 [ 784.763312][T18448] ? bpf_prog_load+0x1a09/0x2a80 [ 784.764891][T18448] ? find_held_lock+0x2b/0x80 [ 784.766374][T18448] ? bpf_prog_load+0x1a09/0x2a80 [ 784.767943][T18448] ? __asan_memset+0x23/0x50 [ 784.769496][T18448] ? bpf_prog_load+0x1ac3/0x2a80 [ 784.771061][T18448] bpf_prog_load+0x1ac3/0x2a80 [ 784.772604][T18448] ? __pfx_bpf_prog_load+0x10/0x10 [ 784.774221][T18448] ? lock_acquire+0x1d1/0x380 [ 784.775719][T18448] __sys_bpf+0x1f46/0x4a30 [ 784.777142][T18448] ? __pfx___sys_bpf+0x10/0x10 [ 784.778658][T18448] ? __pfx_futex_hash+0x10/0x10 [ 784.780572][T18448] ? putname+0xb1/0x110 [ 784.781900][T18448] ? kmem_cache_free+0x127/0x6c0 [ 784.783482][T18448] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 784.785269][T18448] ? xfd_validate_state+0x129/0x190 [ 784.786983][T18448] ? __ia32_sys_bpf+0xcc/0x170 [ 784.788591][T18448] __ia32_sys_bpf+0xcc/0x170 [ 784.790185][T18448] ? __do_fast_syscall_32+0xb3/0x8b0 [ 784.791895][T18448] __do_fast_syscall_32+0x13a/0x8b0 [ 784.793562][T18448] ? lockdep_hardirqs_on+0x7d/0x110 [ 784.795208][T18448] do_fast_syscall_32+0x32/0x70 [ 784.796752][T18448] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 784.798747][T18448] RIP: 0023:0xf7fb6fec [ 784.800149][T18448] Code: Unable to access opcode bytes at 0xf7fb6fc2. [ 784.802219][T18448] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 784.804830][T18448] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000840 [ 784.807287][T18448] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 784.809808][T18448] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 784.812304][T18448] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 784.814774][T18448] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 784.817280][T18448] [ 784.818282][T18448] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 784.820593][T18448] CPU: 0 UID: 0 PID: 18448 Comm: syz.1.3423 Tainted: G L syzkaller #0 PREEMPT(full) [ 784.823945][T18448] Tainted: [L]=SOFTLOCKUP [ 784.825313][T18448] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 784.828436][T18448] Call Trace: [ 784.829498][T18448] [ 784.830451][T18448] dump_stack_lvl+0x100/0x190 [ 784.831940][T18448] vpanic+0x553/0x970 [ 784.833227][T18448] ? __pfx_vpanic+0x10/0x10 [ 784.834673][T18448] panic+0xd1/0xe0 [ 784.835880][T18448] ? __pfx_panic+0x10/0x10 [ 784.837304][T18448] check_panic_on_warn.cold+0x19/0x34 [ 784.838989][T18448] ? __alloc_frozen_pages_noprof+0x1eac/0x3300 [ 784.840945][T18448] __warn.cold+0x191/0x318 [ 784.842366][T18448] __report_bug+0x30f/0x440 [ 784.843804][T18448] ? __alloc_frozen_pages_noprof+0x1eac/0x3300 [ 784.845736][T18448] ? __pfx___report_bug+0x10/0x10 [ 784.847317][T18448] ? kernel_text_address+0x8d/0x100 [ 784.848961][T18448] ? __kernel_text_address+0xd/0x30 [ 784.850628][T18448] ? get_page_from_freelist+0x344/0x35d0 [ 784.852435][T18448] ? get_page_from_freelist+0xafd/0x35d0 [ 784.854200][T18448] ? __alloc_frozen_pages_noprof+0x1eac/0x3300 [ 784.856135][T18448] report_bug+0xb3/0x220 [ 784.857484][T18448] ? __alloc_frozen_pages_noprof+0x1eac/0x3300 [ 784.859404][T18448] handle_bug+0x16a/0x2a0 [ 784.860819][T18448] exc_invalid_op+0x17/0x50 [ 784.862256][T18448] asm_exc_invalid_op+0x1a/0x20 [ 784.863785][T18448] RIP: 0010:__alloc_frozen_pages_noprof+0x1eac/0x3300 [ 784.865886][T18448] Code: 38 d0 7c 08 84 d2 0f 85 de 12 00 00 65 48 8b 05 e2 a7 1c 12 c7 84 24 94 00 00 00 00 80 00 00 f6 40 2d 08 0f 84 ba e7 ff ff 90 <0f> 0b 90 e9 b1 e7 ff ff 48 b8 00 00 00 00 00 fc ff df 48 c1 ea 03 [ 784.871827][T18448] RSP: 0000:ffffc90007505f18 EFLAGS: 00010202 [ 784.873739][T18448] RAX: ffff88805ef68000 RBX: 0000000000000000 RCX: 1ffff1100fffad29 [ 784.876413][T18448] RDX: 0000000000000000 RSI: 0000000000000002 RDI: ffff88803fffd938 [ 784.878775][T18448] RBP: ffff88805ef6802c R08: 0000000000008000 R09: 0000000000000001 [ 784.881267][T18448] R10: 0000000000000002 R11: 0000000000000000 R12: 0000000000148c48 [ 784.883829][T18448] R13: ffff88803fffb900 R14: 0000000000000000 R15: 1ffff92000ea0bfd [ 784.886307][T18448] ? __alloc_frozen_pages_noprof+0x2eb/0x3300 [ 784.888307][T18448] ? check_prev_add+0xfe/0xe60 [ 784.889831][T18448] ? __lock_acquire+0xe8b/0x1f40 [ 784.891408][T18448] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 784.893392][T18448] ? lock_acquire+0x1d1/0x380 [ 784.894931][T18448] ? clockevents_program_event+0x1bf/0x820 [ 784.896681][T18448] ? __bfs+0x150/0x2a0 [ 784.897945][T18448] ? find_held_lock+0x2b/0x80 [ 784.899504][T18448] ? __lock_acquire+0x5c0/0x1f40 [ 784.901101][T18448] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 784.902953][T18448] ? policy_nodemask+0xed/0x4f0 [ 784.904505][T18448] alloc_pages_mpol+0x201/0x550 [ 784.906047][T18448] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 784.907738][T18448] ? filemap_get_entry+0x22d/0x450 [ 784.909447][T18448] ? filemap_get_entry+0x22d/0x450 [ 784.911091][T18448] folio_alloc_noprof+0x22/0x250 [ 784.912675][T18448] filemap_alloc_folio_noprof.part.0+0x3db/0x440 [ 784.914669][T18448] ? __pfx_filemap_alloc_folio_noprof.part.0+0x10/0x10 [ 784.916823][T18448] ? __filemap_get_folio_mpol+0x369/0x1280 [ 784.918673][T18448] __filemap_get_folio_mpol+0x653/0x1280 [ 784.920494][T18448] bdev_getblk+0x246/0x6a0 [ 784.921922][T18448] ? ext4_get_group_desc+0x2b9/0x570 [ 784.923594][T18448] __ext4_get_inode_loc+0x571/0x1510 [ 784.925266][T18448] ? __pfx___ext4_get_inode_loc+0x10/0x10 [ 784.927049][T18448] ? start_this_handle+0xfa7/0x1390 [ 784.928696][T18448] ? ext4_get_inode_loc+0xbd/0x160 [ 784.930326][T18448] ext4_get_inode_loc+0xbd/0x160 [ 784.931903][T18448] ? __pfx_ext4_get_inode_loc+0x10/0x10 [ 784.933646][T18448] ? __pfx_ext4_dirty_inode+0x10/0x10 [ 784.935307][T18448] ext4_reserve_inode_write+0x145/0x330 [ 784.937003][T18448] __ext4_mark_inode_dirty+0x18f/0x910 [ 784.938695][T18448] ? kmem_cache_alloc_noprof+0x2d5/0x6a0 [ 784.940456][T18448] ? __pfx___ext4_mark_inode_dirty+0x10/0x10 [ 784.942262][T18448] ? trace_jbd2_handle_start+0x83/0x240 [ 784.943961][T18448] ? jbd2__journal_start+0xf7/0x6b0 [ 784.945540][T18448] ? __ext4_journal_start_sb+0x314/0x610 [ 784.947274][T18448] ? __ext4_journal_start_sb+0x17b/0x610 [ 784.949075][T18448] ? ext4_dirty_inode+0xa1/0x130 [ 784.950661][T18448] ? __pfx_ext4_dirty_inode+0x10/0x10 [ 784.952348][T18448] ext4_dirty_inode+0xd9/0x130 [ 784.953868][T18448] ? rcu_is_watching+0x13/0xc0 [ 784.955372][T18448] __mark_inode_dirty+0x1f3/0x16e0 [ 784.956986][T18448] sync_lazytime+0x39b/0x5d0 [ 784.958450][T18448] iput.part.0+0x207/0x1050 [ 784.959885][T18448] ? dentry_unlink_inode+0xc7/0x470 [ 784.961524][T18448] ? __pfx_do_raw_spin_trylock+0x10/0x10 [ 784.963285][T18448] iput+0x35/0x40 [ 784.964458][T18448] dentry_unlink_inode+0x284/0x470 [ 784.966057][T18448] dentry_kill+0x25d/0xc20 [ 784.967473][T18448] shrink_dentry_list+0x1e8/0x310 [ 784.969062][T18448] prune_dcache_sb+0xea/0x150 [ 784.970554][T18448] ? list_lru_count_one+0x147/0x320 [ 784.972183][T18448] ? __pfx_prune_dcache_sb+0x10/0x10 [ 784.973858][T18448] super_cache_scan+0x32b/0x550 [ 784.975403][T18448] do_shrink_slab+0x416/0x1200 [ 784.976923][T18448] shrink_slab+0x171/0x12e0 [ 784.978366][T18448] ? try_to_shrink_lruvec+0x68d/0x830 [ 784.980058][T18448] ? __pfx_shrink_slab+0x10/0x10 [ 784.981628][T18448] ? lock_acquire+0x1d1/0x380 [ 784.983110][T18448] shrink_one+0x398/0x850 [ 784.984483][T18448] ? shrink_node+0x2a81/0x4320 [ 784.985986][T18448] ? shrink_node+0x2b00/0x4320 [ 784.987495][T18448] shrink_node+0x2b20/0x4320 [ 784.988962][T18448] ? shrink_node+0x286e/0x4320 [ 784.990465][T18448] ? __pfx_shrink_node+0x10/0x10 [ 784.992026][T18448] ? queue_work_on+0x141/0x1e0 [ 784.993550][T18448] ? do_try_to_free_pages+0x33e/0x16d0 [ 784.995218][T18448] do_try_to_free_pages+0x33e/0x16d0 [ 784.996832][T18448] ? __pfx_do_try_to_free_pages+0x10/0x10 [ 784.998604][T18448] ? __lock_acquire+0x5c0/0x1f40 [ 785.000178][T18448] try_to_free_pages+0x2a0/0x740 [ 785.001752][T18448] ? __pfx_try_to_free_pages+0x10/0x10 [ 785.003461][T18448] ? find_held_lock+0x2b/0x80 [ 785.004972][T18448] ? fs_reclaim_acquire+0x70/0x100 [ 785.006579][T18448] ? fs_reclaim_acquire+0x70/0x100 [ 785.008180][T18448] __alloc_frozen_pages_noprof+0xf8a/0x3300 [ 785.010050][T18448] ? __pfx_vmap_small_pages_range_noflush+0x10/0x10 [ 785.012095][T18448] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 785.014086][T18448] ? __vmap_pages_range_noflush+0x3db/0x660 [ 785.015931][T18448] ? is_vmalloc_addr+0x86/0xa0 [ 785.017457][T18448] ? is_vmalloc_or_module_addr+0x47/0x60 [ 785.019210][T18448] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 785.021113][T18448] ? __css_rstat_updated+0x1ce/0x590 [ 785.022776][T18448] ? __pfx___css_rstat_updated+0x10/0x10 [ 785.024528][T18448] ? policy_nodemask+0xed/0x4f0 [ 785.026045][T18448] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 785.027895][T18448] ? policy_nodemask+0xed/0x4f0 [ 785.029458][T18448] alloc_pages_mpol+0x201/0x550 [ 785.031010][T18448] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 785.032731][T18448] ? find_held_lock+0x2b/0x80 [ 785.034221][T18448] ? rcu_read_unlock+0x17/0x60 [ 785.035734][T18448] ? rcu_read_unlock+0x17/0x60 [ 785.037267][T18448] alloc_pages_noprof+0x1a/0x160 [ 785.038819][T18448] __vmalloc_node_range_noprof+0xc1b/0x1420 [ 785.040732][T18448] ? bpf_check+0x1c48/0xa550 [ 785.042203][T18448] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 785.043888][T18448] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 785.045882][T18448] ? rcu_is_watching+0x13/0xc0 [ 785.047393][T18448] __kvmalloc_node_noprof+0x3da/0x9b0 [ 785.049080][T18448] ? bpf_check+0x1c48/0xa550 [ 785.050565][T18448] ? bpf_check+0x1c48/0xa550 [ 785.052027][T18448] bpf_check+0x1c48/0xa550 [ 785.053451][T18448] ? count_memcg_events_mm.constprop.0+0xfa/0x2a0 [ 785.055456][T18448] ? rcu_is_watching+0x13/0xc0 [ 785.056972][T18448] ? __up_read+0x333/0x980 [ 785.058394][T18448] ? __pfx_bpf_check+0x10/0x10 [ 785.059938][T18448] ? lock_acquire+0x1d1/0x380 [ 785.061448][T18448] ? bpf_prog_load+0x1a09/0x2a80 [ 785.063013][T18448] ? find_held_lock+0x2b/0x80 [ 785.064506][T18448] ? bpf_prog_load+0x1a09/0x2a80 [ 785.066070][T18448] ? __asan_memset+0x23/0x50 [ 785.067537][T18448] ? bpf_prog_load+0x1ac3/0x2a80 [ 785.069110][T18448] bpf_prog_load+0x1ac3/0x2a80 [ 785.070658][T18448] ? __pfx_bpf_prog_load+0x10/0x10 [ 785.072268][T18448] ? lock_acquire+0x1d1/0x380 [ 785.073776][T18448] __sys_bpf+0x1f46/0x4a30 [ 785.075192][T18448] ? __pfx___sys_bpf+0x10/0x10 [ 785.076716][T18448] ? __pfx_futex_hash+0x10/0x10 [ 785.078263][T18448] ? putname+0xb1/0x110 [ 785.079577][T18448] ? kmem_cache_free+0x127/0x6c0 [ 785.081189][T18448] ? __ia32_sys_futex_time32+0x2f4/0x470 [ 785.082951][T18448] ? xfd_validate_state+0x129/0x190 [ 785.084618][T18448] ? __ia32_sys_bpf+0xcc/0x170 [ 785.086138][T18448] __ia32_sys_bpf+0xcc/0x170 [ 785.087614][T18448] ? __do_fast_syscall_32+0xb3/0x8b0 [ 785.089296][T18448] __do_fast_syscall_32+0x13a/0x8b0 [ 785.090944][T18448] ? lockdep_hardirqs_on+0x7d/0x110 [ 785.092597][T18448] do_fast_syscall_32+0x32/0x70 [ 785.094141][T18448] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 785.096120][T18448] RIP: 0023:0xf7fb6fec [ 785.097435][T18448] Code: Unable to access opcode bytes at 0xf7fb6fc2. [ 785.099503][T18448] RSP: 002b:00000000f547650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 785.102130][T18448] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000840 [ 785.104602][T18448] RDX: 0000000000000094 RSI: 0000000000000000 RDI: 0000000000000000 [ 785.107064][T18448] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 785.109594][T18448] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 785.112067][T18448] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 785.114553][T18448] [ 785.116290][T18448] Kernel Offset: disabled [ 785.117662][T18448] Rebooting in 86400 seconds..