last executing test programs: 1m26.815560414s ago: executing program 1 (id=33): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$IPVS_CMD_SET_INFO(r0, &(0x7f00000001c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000180)={&(0x7f0000000080)={0xc4, r1, 0x4, 0x70bd28, 0x25dfdbfc, {}, [@IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x5}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x8}, @IPVS_CMD_ATTR_DEST={0x50, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PERSIST_CONNS={0x8, 0x9, 0x3}, @IPVS_DEST_ATTR_TUN_PORT={0x6, 0xe, 0x4e24}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x3}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x9}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x200}, @IPVS_DEST_ATTR_ADDR={0x14, 0x1, @ipv4=@rand_addr=0x64010102}, @IPVS_DEST_ATTR_ACTIVE_CONNS={0x8, 0x7, 0x1}, @IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP={0x8, 0x4, 0x7fffffff}, @IPVS_CMD_ATTR_DAEMON={0x1c, 0x3, 0x0, 0x1, [@IPVS_DAEMON_ATTR_MCAST_PORT={0x6, 0x7, 0x4e22}, @IPVS_DAEMON_ATTR_SYNC_ID={0x8, 0x3, 0x3}, @IPVS_DAEMON_ATTR_MCAST_GROUP={0x8, 0x5, @private=0xa010101}]}, @IPVS_CMD_ATTR_DEST={0x24, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e20}, @IPVS_DEST_ATTR_PORT={0x6, 0x2, 0x4e22}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x7b56}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0xf54}]}, @IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x4}]}, 0xc4}, 0x1, 0x0, 0x0, 0x1}, 0xc0) sendmsg$NL80211_CMD_GET_MPATH(r0, &(0x7f0000000300)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000002c0)={&(0x7f0000000240)={0x44, 0x0, 0x100, 0x70bd2b, 0x25dfdbff, {{}, {@void, @val={0xc, 0x99, {0x4, 0x3a}}}}, [@NL80211_ATTR_MPATH_NEXT_HOP={0xa, 0x1a, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x44}, 0x1, 0x0, 0x0, 0x20045}, 0x30008091) r2 = openat$nmem0(0xffffffffffffff9c, &(0x7f0000000340), 0x121540, 0x0) ioctl$KVM_CAP_HYPERV_TLBFLUSH(r2, 0x4068aea3, &(0x7f0000000380)) sendmsg$NLBL_UNLABEL_C_STATICREMOVE(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f0000000400)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000004c0)={&(0x7f0000000440)={0x58, 0x0, 0x20, 0x70bd28, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'macvtap0\x00'}, @NLBL_UNLABEL_A_IPV4ADDR={0x8, 0x4, @rand_addr=0x64010102}, @NLBL_UNLABEL_A_SECCTX={0x26, 0x7, 'system_u:object_r:xen_device_t:s0\x00'}]}, 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x80) io_uring_register$IORING_REGISTER_PROBE(r2, 0x8, &(0x7f0000000540)={0x0, 0x0, 0x0, '\x00', [{}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {}]}, 0x2d) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000700), r2) sendmsg$TIPC_NL_LINK_GET(r2, &(0x7f0000000a40)={&(0x7f00000006c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000a00)={&(0x7f0000000740)={0x2a4, r3, 0x8, 0x70bd29, 0x25dfdbfe, {}, [@TIPC_NLA_SOCK={0x68, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x980}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x14, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x2}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0xc637}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7fa}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x2}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1ff}, @TIPC_NLA_SOCK_CON={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x3}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x401}, @TIPC_NLA_CON_FLAG={0x8, 0x1, 0x2}]}]}, @TIPC_NLA_PUBL={0x34, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x2}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x7}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xd20e}, @TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0xffffffff}]}, @TIPC_NLA_BEARER={0x154, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0xffffffff, @loopback, 0x1}}, {0x20, 0x2, @in6={0xa, 0x4e23, 0x80, @private2, 0x1ff}}}}, @TIPC_NLA_BEARER_PROP={0x3c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x16}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffff03b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x800}]}, @TIPC_NLA_BEARER_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x11}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}]}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e22, @local}}, {0x14, 0x2, @in={0x2, 0x4e22, @multicast2}}}}, @TIPC_NLA_BEARER_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xe275}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80}]}, @TIPC_NLA_BEARER_NAME={0xd, 0x1, @udp='udp:syz0\x00'}, @TIPC_NLA_BEARER_UDP_OPTS={0x2c, 0x4, {{0x14, 0x1, @in={0x2, 0x4e24, @initdev={0xac, 0x1e, 0x1, 0x0}}}, {0x14, 0x2, @in={0x2, 0x4e23, @rand_addr=0x64010102}}}}, @TIPC_NLA_BEARER_UDP_OPTS={0x38, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e20, 0x7, @empty, 0x3}}, {0x14, 0x2, @in={0x2, 0x4e24, @broadcast}}}}]}, @TIPC_NLA_LINK={0x7c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x712}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x3}]}]}, 0x2a4}}, 0x20040845) sendmsg$nl_route_sched(r2, &(0x7f0000000b40)={&(0x7f0000000a80)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000ac0)=@getchain={0x34, 0x66, 0x100, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x3, 0xfff2}, {0xfffc, 0xfff2}, {0x0, 0x10}}, [{0x8, 0xb, 0x4}, {0x8, 0xb, 0xc}]}, 0x34}, 0x1, 0x0, 0x0, 0x94}, 0x4000014) write$selinux_validatetrans(r2, &(0x7f0000000b80)={'system_u:object_r:hostname_exec_t:s0', 0x20, 'system_u:object_r:fixed_disk_device_t:s0', 0x20, 0x7ff, 0x20, 'unconfined\x00'}, 0x6e) openat$selinux_user(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NLBL_MGMT_C_LISTDEF(r4, &(0x7f0000000d40)={&(0x7f0000000c40)={0x10, 0x0, 0x0, 0xc9c09d85870d4e86}, 0xc, &(0x7f0000000d00)={&(0x7f0000000c80)={0x64, 0x0, 0x200, 0x70bd29, 0x25dfdbfd, {}, [@NLBL_MGMT_A_IPV6ADDR={0x14, 0x5, @loopback}, @NLBL_MGMT_A_DOMAIN={0x7, 0x1, ']&\x00'}, @NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @initdev={0xac, 0x1e, 0x1, 0x0}}, @NLBL_MGMT_A_CV4DOI={0x8, 0x4, 0x1}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @dev={0xac, 0x14, 0x14, 0x1}}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @rand_addr=0x64010101}, @NLBL_MGMT_A_IPV6MASK={0x14, 0x6, @empty}]}, 0x64}}, 0x4004005) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r2, 0x89f1, &(0x7f0000000e00)={'syztnl2\x00', &(0x7f0000000dc0)={'syztnl1\x00', 0x0, 0x7800, 0x8000, 0x6, 0x4, {{0x6, 0x4, 0x3, 0x4, 0x18, 0x67, 0x0, 0x87, 0x4, 0x0, @empty, @empty, {[@noop, @noop]}}}}}) getsockopt$inet_IP_IPSEC_POLICY(r2, 0x0, 0x10, &(0x7f0000000e40)={{{@in6=@private2, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{}, 0x0, @in=@private}}, &(0x7f0000000f40)=0xe8) sendmsg$nl_xfrm(r2, &(0x7f00000010c0)={&(0x7f0000000d80)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000001080)={&(0x7f0000000f80)=@polexpire={0xd8, 0x1b, 0x100, 0x70bd2d, 0x25dfdbfb, {{{@in=@rand_addr=0x64010101, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x4e23, 0xc, 0x4e23, 0x800, 0xa, 0x80, 0x0, 0x6c, r5, r6}, {0x3, 0x0, 0x7, 0x2, 0x4, 0x8001, 0x3, 0x7}, {0x81, 0x0, 0x8000, 0x1}, 0xf11a, 0x6e6bb4, 0x1, 0x1, 0x1, 0x2}, 0x7}, [@XFRMA_IF_ID={0x8, 0x1f, 0x3}, @replay_thresh={0x8, 0xb, 0x7}, @extra_flags={0x8, 0x18, 0x6}]}, 0xd8}, 0x1, 0x0, 0x0, 0xc000085}, 0x24000010) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000001140), r2) sendmsg$NL80211_CMD_STOP_AP(r2, &(0x7f0000001200)={&(0x7f0000001100)={0x10, 0x0, 0x0, 0x800}, 0xc, &(0x7f00000011c0)={&(0x7f0000001180)={0x20, r7, 0x400, 0x70bd2d, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x2, 0x79}}}}, ["", "", "", "", "", "", ""]}, 0x20}, 0x1, 0x0, 0x0, 0x4}, 0x4008000) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000001280), r2) sendmsg$BATADV_CMD_GET_TRANSTABLE_GLOBAL(r0, &(0x7f0000001340)={&(0x7f0000001240)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000001300)={&(0x7f00000012c0)={0x24, r8, 0x100, 0x70bd2c, 0x25dfdbfd, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5}, @BATADV_ATTR_GW_SEL_CLASS={0x8, 0x34, 0x4}]}, 0x24}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) r9 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000001380), 0x111402, 0x0) getsockopt$inet_dccp_int(r9, 0x21, 0x0, &(0x7f00000013c0), &(0x7f0000001400)=0x4) ioctl$PPPIOCSMRU1(r2, 0x40047452, &(0x7f0000001440)=0x6) openat$vmci(0xffffffffffffff9c, &(0x7f0000001480), 0x2, 0x0) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f00000014c0), 0x42200, 0x0) ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000001540), r9) sendmsg$TIPC_CMD_SET_NODE_ADDR(r2, &(0x7f0000001600)={&(0x7f0000001500)={0x10, 0x0, 0x0, 0xa000008}, 0xc, &(0x7f00000015c0)={&(0x7f0000001580)={0x24, r11, 0x300, 0x70bd2c, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0xfe6a}}, [""]}, 0x24}, 0x1, 0x0, 0x0, 0x4004005}, 0x40080) 1m26.642581664s ago: executing program 1 (id=37): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) r3 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x56) connect$inet(r3, &(0x7f0000000380)={0x2, 0x4e24, @local}, 0x10) close(r3) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000280)={0x2, 0x0, 0x1}) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000a00), 0xffffffffffffffff) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)={0x1c, r4, 0x1, 0x70bd2a, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc0, &(0x7f00000003c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x2b, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x14, r4, 0x400, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) (async) socket$inet_smc(0x2b, 0x1, 0x0) (async) setsockopt$inet_tcp_TCP_REPAIR(r3, 0x6, 0x13, &(0x7f0000000040)=0x1, 0x4) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000080)=0x1, 0x56) (async) connect$inet(r3, &(0x7f0000000380)={0x2, 0x4e24, @local}, 0x10) (async) close(r3) (async) ioctl$vim2m_VIDIOC_REQBUFS(r2, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) (async) ioctl$vim2m_VIDIOC_EXPBUF(r2, 0xc0405610, &(0x7f0000000280)={0x2, 0x0, 0x1}) (async) syz_genetlink_get_family_id$fou(&(0x7f0000000a00), 0xffffffffffffffff) (async) sendmsg$FOU_CMD_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)={0x1c, r4, 0x1, 0x70bd2a, 0x0, {}, [@FOU_ATTR_TYPE={0x5, 0x4, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000340)={0xffffffffffffffff, 0xe0, &(0x7f00000004c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x7, 0x7, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xc0, &(0x7f00000003c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000140), &(0x7f0000000180), 0x8, 0x2b, 0x8, 0x8, &(0x7f00000001c0)}}, 0x10) (async) sendmsg$FOU_CMD_DEL(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000380)={0x14, r4, 0x400, 0x70bd2c, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x20044000}, 0x0) (async) 1m26.641913934s ago: executing program 1 (id=39): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) r2 = socket(0x2a, 0x2, 0x0) getsockname$packet(r2, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000001480)=0x14) r4 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_STATUS32(r4, 0xc0f85403, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=@newqdisc={0x38, 0x24, 0xf0b, 0x0, 0x25dfdbfc, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x0) move_pages(0x0, 0x42, 0x0, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x29a83a768e447add) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000014c0)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd2d, 0x20000000, {0x0, 0x0, 0x0, r3, {0x5, 0x2}, {0xfff1}, {0x5, 0xffe0}}, [@filter_kind_options=@f_basic={{0xa}, {0xc, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0xfff1, 0x7}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r5, &(0x7f00000002c0), 0x40000000000009f, 0x0) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), r0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="01002cbd7000ffdbdf253900000008000300", @ANYRES32=r1, @ANYBLOB="0c005a80080103800400010015d6ea6762884d45dcab71bf8269936fc0dc39df551890cd592b44e0d2"], 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r5, &(0x7f0000000b40)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000b00)={&(0x7f0000000380)={0x74c, r6, 0x400, 0x70bd2c, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0xc3, 0x46}}}}, [@NL80211_ATTR_TX_RATES={0x48, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x44, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x1, 0x3, 0x10, 0x5, 0x7, 0x1, 0x4]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0x23, 0x1, [0x9, 0x16, 0x9, 0x36, 0x3, 0x60, 0x30, 0x6c, 0xb, 0xc, 0x24, 0x18, 0x3, 0x18, 0x4, 0x6c, 0x1, 0x1, 0xc, 0x16, 0x60, 0x5, 0x9, 0x30, 0x36, 0x36, 0x5, 0x3, 0x9, 0x1, 0x1b]}]}]}, @NL80211_ATTR_TX_RATES={0x108, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x28, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfffc, 0x28fe, 0x25, 0x4, 0x3ff, 0x1, 0x1]}}]}, @NL80211_BAND_6GHZ={0x80, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HT={0x2b, 0x2, [{0x6, 0x7}, {0x2, 0x2}, {0x5, 0x6}, {0x3, 0x5}, {0x1, 0xa}, {0x1}, {0x1, 0x6}, {0x2, 0x2}, {0x1, 0x5}, {0x1, 0x6}, {0x2, 0x6}, {0x6, 0x8}, {0x1, 0x7}, {0x2, 0xa}, {0x0, 0x8}, {0x0, 0x7}, {0x0, 0x8}, {0x3, 0x6}, {0x1, 0xa}, {0x1}, {0x1, 0x6}, {0x5, 0xa}, {0x6, 0x2}, {0x5, 0xa}, {0x2, 0x3}, {0x0, 0x2}, {0x0, 0x4}, {0x5, 0x5}, {0x4, 0xa}, {0x6, 0x7}, {0x0, 0xa}, {0x3}, {0x2, 0x7}, {0x1, 0x1}, {0x5, 0x4}, {0x0, 0x2}, {0x7, 0x4}, {0x2, 0x8}, {0x7, 0x6}]}, @NL80211_TXRATE_LEGACY={0xf, 0x1, [0x1, 0x36, 0x6c, 0x12, 0x9, 0x18, 0x12, 0x48, 0x9, 0x60, 0x48]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x1000, 0x40, 0x8, 0x0, 0x7, 0x7, 0x6]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0xa01, 0x4, 0x4, 0x1, 0xa7, 0x0, 0xc]}}]}, @NL80211_BAND_2GHZ={0x5c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x1, 0x2, 0xfff9, 0x1, 0x4, 0x6, 0x6]}}, @NL80211_TXRATE_HT={0x44, 0x2, [{0x7, 0x9}, {0x0, 0x4}, {0x5, 0x6}, {0x5, 0x5}, {0x4, 0x9}, {0x6}, {0x0, 0x3}, {0x0, 0x5}, {0x3, 0x4}, {0x6, 0x9}, {0x0, 0x8}, {0x3, 0x8}, {0x5, 0x6}, {0x3, 0x9}, {0x3, 0x7}, {0x3, 0x7}, {0x0, 0x9}, {0x3}, {0x0, 0x7}, {0x3, 0xa}, {0x0, 0x4}, {0x4, 0x2}, {0x5, 0x1}, {0x4, 0x5}, {0x0, 0x1}, {0x4, 0x8}, {0x4, 0x1}, {0x2, 0x7}, {0x3, 0x6}, {0x7, 0x3}, {0x1, 0x1}, {0x7, 0x6}, {0x1, 0x3}, {0x0, 0x5}, {0x4, 0x4}, {0x0, 0x6}, {0x2, 0x9}, {0x1, 0x2}, {}, {0x5, 0x6}, {0x7, 0xa}, {0x6, 0x1}, {0x7, 0x6}, {0x7, 0x7}, {0x3, 0x2}, {0x2, 0x7}, {0x1, 0x2}, {0x7}, {0x7, 0xa}, {0x2, 0x4}, {0x7}, {0x7}, {0x0, 0x3}, {0x0, 0x7}, {0x1, 0x3}, {0x6, 0x6}, {0x5, 0x1}, {0x1, 0x4}, {0x7, 0x6}, {0x1, 0x5}, {0x4, 0x4}, {0x0, 0x9}, {0x0, 0x8}, {0x2, 0x2}]}]}]}, @NL80211_ATTR_TX_RATES={0x98, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x94, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4f, 0x2, [{0x7, 0x5}, {0x3, 0x5}, {0x1, 0x1}, {0x0, 0x8}, {0x5, 0x5}, {0x4, 0x9}, {0x0, 0x3}, {0x1, 0x2}, {0x0, 0x7}, {0x1, 0x7}, {0x2, 0x4}, {0x0, 0xa}, {0x4}, {0x1, 0x3}, {}, {0x4, 0x7}, {0x7, 0x4}, {0x7, 0xa}, {0x4, 0x1}, {0x7, 0x2}, {0x4, 0x9}, {0x5, 0x8}, {0x3, 0x4}, {0x7, 0x1}, {0x1, 0x2}, {0x5, 0xa}, {0x6, 0x9}, {0x2, 0x3}, {0x4, 0x9}, {0x3, 0xa}, {0x2, 0xa}, {0x7, 0x9}, {0x1, 0x9}, {0x4, 0x9}, {0x0, 0x8}, {0x3, 0x2}, {0x3, 0x5}, {0x6}, {0x2, 0x1}, {0x3, 0x2}, {0x4, 0xa}, {0x4, 0x6}, {0x2, 0x4}, {0x0, 0x5}, {0x1, 0x7}, {0x7, 0x8}, {0x1, 0x2}, {0x5}, {0x4, 0x6}, {0x2}, {0x5}, {0x6, 0xa}, {0x6, 0x5}, {0x7, 0x7}, {0x3}, {0x1, 0x4}, {0x5, 0x3}, {0x7, 0x9}, {0x5, 0x5}, {0x3, 0x1}, {0x4, 0x1}, {0x2, 0x6}, {0x1, 0x4}, {0x7, 0x1}, {0x0, 0x5}, {0x2, 0x5}, {0x0, 0x8}, {0x1}, {0x7, 0x1}, {0x1}, {0x3, 0x9}, {0x1, 0x9}, {0x7, 0x4}, {0x0, 0x5}, {0x2, 0x9}]}, @NL80211_TXRATE_HT={0x36, 0x2, [{0x0, 0x7}, {0x5, 0xa}, {0x6, 0x2}, {0x1, 0x4}, {0x7, 0xa}, {0x6, 0x8}, {0x0, 0x6}, {0x1}, {0x6, 0x6}, {0x2, 0x2}, {0x0, 0x8}, {0x0, 0x9}, {0x6, 0x9}, {0x7, 0x5}, {0x0, 0x4}, {0x6, 0x7}, {0x0, 0x3}, {0x4, 0x8}, {0x6}, {0x0, 0x9}, {0x4, 0x6}, {0x4, 0xa}, {0x4, 0x3}, {0x2, 0xa}, {0x2}, {0x7, 0x4}, {0x6, 0xa}, {0x2, 0x7}, {0x1, 0x4}, {}, {0x6, 0x4}, {0x2, 0x7}, {0x5, 0x8}, {0x5, 0x9}, {0x0, 0x7}, {0x6, 0x1}, {0x0, 0x6}, {0x3, 0x8}, {0x1, 0x2}, {0x3, 0x6}, {0x1}, {0x0, 0x9}, {0x7, 0x1}, {0x0, 0x6}, {0x4, 0x3}, {0x5}, {0x0, 0x3}, {0x5, 0xa}, {0x5, 0x2}, {0x1, 0x2}]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_ATTR_TX_RATES={0xfc, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x60, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x7f3, 0x5, 0x0, 0x8, 0x4f, 0x5, 0x9, 0x9]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0x7, 0x1, 0xb7, 0x40, 0x3, 0x0, 0x5c]}}, @NL80211_TXRATE_HT={0x33, 0x2, [{0x5, 0x6}, {0x5, 0x2}, {0x7, 0xa}, {0x6}, {0x2, 0x8}, {0x2, 0x5}, {0x3, 0x1}, {0x6}, {0x5, 0x9}, {0x7}, {0x7, 0xa}, {0x5, 0x8}, {0x6, 0x1}, {0x7, 0x2}, {0x1, 0x1}, {0x3, 0x3}, {0x7, 0xa}, {0x5}, {0x4, 0x3}, {0x3, 0x2}, {0x7}, {0x1, 0x6}, {0x0, 0x5}, {0x0, 0x8}, {0x6, 0x8}, {0x0, 0x1}, {0x7}, {}, {0x3, 0x3}, {0x2, 0x3}, {0x2}, {0x0, 0x3}, {0x4, 0x8}, {0x1, 0x5}, {0x1, 0x4}, {0x3, 0x6}, {0x0, 0xa}, {0x1, 0x1}, {0x3}, {0x5, 0x9}, {0x1, 0x4}, {0x0, 0x6}, {0x4, 0xa}, {0x0, 0xa}, {0x4, 0x4}, {0x1, 0x3}, {0x7, 0x4}]}]}, @NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2555, 0xcc, 0x6, 0x8, 0xbc00, 0x9, 0x4, 0x81]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x4, 0x6, 0xffff, 0x7, 0x4, 0x81, 0x8, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_LEGACY={0xf, 0x1, [0xc, 0x3, 0x48, 0xb, 0x24, 0xc, 0x16, 0x60, 0x3, 0xe, 0x6c]}]}, @NL80211_BAND_2GHZ={0x4c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x1f, 0x2, [{0x3, 0x4}, {0x6, 0x5}, {0x5}, {0x1, 0x9}, {0x1, 0x7}, {0x1, 0x7}, {0x6, 0x3}, {0x7, 0x1}, {0x4, 0x7}, {0x1, 0x4}, {0x3, 0x3}, {0x0, 0x1}, {0x2}, {0x0, 0x5}, {0x1, 0x9}, {0x2, 0x5}, {0x5, 0x1}, {0x4, 0x6}, {0x7, 0x4}, {0x1, 0x9}, {0x2, 0x6}, {0x5, 0x3}, {0x0, 0x7}, {0x1, 0x6}, {0x7, 0x7}, {0x3, 0x1}, {0x5, 0x1}]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3, 0x7, 0x7, 0x5, 0x7743, 0x8, 0x6, 0x1a7]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8e86, 0x7, 0x7, 0x2, 0x800, 0x101, 0x7a2, 0x2]}}]}]}, @NL80211_ATTR_TX_RATES={0x160, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x78, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0xfff2, 0x6, 0x1, 0x7, 0x1, 0x23f, 0xac97]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x1, 0x1, 0x401, 0x3, 0x0, 0x2, 0x6]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7ff, 0x4, 0x1, 0x6, 0x10, 0x1ff, 0x2, 0x4]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0xfff1, 0xfffa, 0xffb7, 0x6, 0x9, 0x9, 0xde7a]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7f, 0x200, 0x1, 0x8000, 0x8, 0x200, 0xffff, 0x1]}}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_5GHZ={0x30, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x13, 0x2, [{0x6, 0x4}, {0x5, 0x3}, {0x7, 0x7}, {}, {0x0, 0x9}, {0x6}, {0x3, 0x7}, {0x2, 0x8}, {0x0, 0x1}, {0x5, 0x2}, {0x0, 0x7}, {0x4, 0x5}, {0x3, 0x9}, {0x7, 0x7}, {0x0, 0x7}]}]}, @NL80211_BAND_6GHZ={0x18, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x18, 0x0, 0x9, 0x9, 0x5, 0xfff3, 0x5, 0x8]}}]}, @NL80211_BAND_6GHZ={0x44, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x40, 0x2, [{0x1, 0x2}, {0x0, 0x4}, {0x2, 0x2}, {0x1, 0x5}, {0x3, 0xa}, {0x3, 0x7}, {0x4, 0x9}, {0x1, 0x6}, {0x0, 0x6}, {0x3, 0x4}, {0x5, 0x7}, {0x0, 0x5}, {0x6, 0x7}, {0x5, 0x4}, {0x1, 0xa}, {0x3, 0x3}, {0x5, 0x3}, {0x2, 0x1}, {0x6, 0x6}, {0x4, 0x4}, {0x7, 0x5}, {0x3, 0x2}, {0x0, 0x7}, {0x6}, {0x0, 0x7}, {0x5, 0x3}, {0x3, 0xa}, {0x2, 0x4}, {0x7, 0x1}, {0x7}, {0x0, 0x5}, {0x3, 0x3}, {0x7, 0x2}, {0x7, 0x5}, {0x1, 0x7}, {0x2, 0x5}, {0x7, 0x9}, {0x3, 0xa}, {0x0, 0x6}, {0x4, 0x3}, {0x5, 0x9}, {0x3, 0x9}, {0x0, 0x7}, {0x0, 0x5}, {0x3, 0xa}, {0x0, 0x1}, {0x2, 0x2}, {0x7, 0x9}, {0x6, 0x9}, {0x7, 0x5}, {0x6, 0x1}, {0x3, 0xa}, {0x4, 0x4}, {0x4, 0x9}, {0x5, 0x3}, {0x1, 0x5}, {0x2, 0x9}, {0x6, 0x4}, {0x1, 0x2}, {0x1, 0x1}]}]}, @NL80211_BAND_5GHZ={0x28, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x24, 0x1, [0x1, 0xc, 0x23, 0x3, 0x36, 0x18, 0x1, 0x30, 0x6, 0xb, 0x26, 0x5, 0x6c, 0x4, 0x6, 0x60, 0xc, 0x12, 0x9, 0x2f, 0x18, 0x6, 0xc, 0x12, 0x48, 0xb, 0xc, 0x7d, 0x60, 0x1b, 0x12, 0xb]}]}, @NL80211_BAND_60GHZ={0x30, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x2a, 0x7, 0x3, 0xa, 0x3, 0x8001, 0x9]}}]}]}, @NL80211_ATTR_TX_RATES={0x9c, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x2c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0xb, 0x1, [0x9f46f5b8af1b7721, 0x16, 0x12, 0x1, 0x4, 0xc, 0xb]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xfff, 0x7, 0x6, 0x4, 0x3, 0xe, 0x8, 0x4]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_6GHZ={0x5c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x3ff, 0xc957, 0x4000, 0x7, 0x1ff, 0x18b5, 0x8c, 0x90f]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xda2f, 0x6, 0x2, 0x9, 0x4, 0x119, 0x6, 0x5]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x1, 0x5, 0x3, 0x7, 0x8, 0x3, 0x6, 0x5]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x60, 0x0, 0x8, 0x4, 0x6d, 0x8, 0xae5f, 0x52]}}]}, @NL80211_BAND_2GHZ={0x4}, @NL80211_BAND_2GHZ={0xc, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x174, 0x5a, 0x0, 0x1, [@NL80211_BAND_6GHZ={0x2c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x8, 0x5db, 0xfffa, 0x8, 0xb, 0x2]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x1bf, 0x4, 0x3, 0xff81, 0x8a, 0x0, 0x3]}}]}, @NL80211_BAND_60GHZ={0x38, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HT={0x2c, 0x2, [{0x5, 0x7}, {0x7, 0x4}, {0x5, 0x8}, {0x1, 0x9}, {0x2, 0x1}, {0x0, 0x9}, {0x0, 0x9}, {0x1, 0x3}, {0x4}, {0x1, 0x6}, {0x5, 0x9}, {0x5, 0x1}, {0x3, 0x7}, {0x0, 0x3}, {0x2}, {0x7, 0x3}, {0x3, 0x8}, {0x6, 0x1}, {0x5, 0x8}, {0x1, 0x9}, {0x3, 0x8}, {0x6, 0x8}, {0x7, 0xa}, {}, {0x5, 0x6}, {0x2, 0x3}, {0x4}, {0x5, 0x6}, {0x6, 0x9}, {0x4, 0x9}, {0x4, 0x4}, {0x5, 0x4}, {0x1, 0x6}, {0x5, 0x4}, {0x4, 0x9}, {0x3, 0x9}, {0x0, 0x8}, {0x7, 0x9}, {}, {0x0, 0x8}]}]}, @NL80211_BAND_6GHZ={0xc, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x1}]}, @NL80211_BAND_2GHZ={0x2c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x28, 0x2, [{0x5, 0x3}, {0x1, 0x8}, {0x1, 0x1}, {0x0, 0x7}, {0x1, 0x7}, {0x0, 0x8}, {0x7, 0x2}, {0x4, 0x8}, {0x6, 0xa}, {0x1, 0x8}, {0x0, 0x8}, {0x3, 0x6}, {0x0, 0x2}, {0x6, 0x8}, {0x0, 0x6}, {0x5, 0x4}, {0x0, 0x2}, {0x1, 0x6}, {0x0, 0x3}, {0x2, 0x6}, {0x7, 0x9}, {0x5, 0x3}, {0x5, 0x8}, {0x7, 0x1}, {0x3, 0x2}, {0x0, 0x4}, {0x6, 0x2}, {0x5, 0x5}, {0x0, 0x5}, {0x1, 0x9}, {0x6, 0x7}, {0x6, 0x2}, {0x1, 0x7}, {0x3, 0x6}, {0x1, 0x6}, {0x1, 0x5}]}]}, @NL80211_BAND_60GHZ={0x58, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x6, 0x5, 0x3, 0x3, 0xb, 0x4, 0x1]}}, @NL80211_TXRATE_LEGACY={0xe, 0x1, [0x4, 0x30, 0x4, 0x9, 0x2b, 0x24, 0xc, 0x24, 0x2, 0x2]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xff, 0xff10, 0x2, 0x7, 0x200, 0x8, 0xfffe, 0x7ee9]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x913a, 0x10, 0x1ef, 0x1, 0x5, 0xfff, 0x5, 0x1]}}]}, @NL80211_BAND_6GHZ={0x20, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x995d, 0x8, 0x80, 0x9, 0xfffb, 0x2, 0x7ff, 0x7]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_5GHZ={0x3c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x37e9, 0x4, 0x8, 0xfffa, 0x7, 0xffa0, 0x200, 0x1ff]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x200, 0xfff8, 0x4, 0x8, 0x8c6, 0x4, 0x1]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_2GHZ={0x20, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1c, 0x1, [0x6c, 0x3, 0x12, 0xb304c92877041990, 0x3, 0xb, 0x36, 0x5, 0x6c, 0x16, 0x4, 0x4, 0x1, 0x18, 0x30, 0x9, 0x6, 0x6c, 0x48, 0x16, 0x5, 0x2, 0x1b, 0x60]}]}]}, @NL80211_ATTR_TX_RATES={0x24, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x20, 0x2, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x9f9, 0x3, 0xa, 0x800, 0x1ff, 0xfff7, 0x1]}}]}]}, @NL80211_ATTR_TX_RATES={0xb4, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x28, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x6, 0x10, 0xfff7, 0x9, 0x6, 0x807f, 0x80, 0x401]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_60GHZ={0x64, 0x2, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x9, 0x1, [0x6c, 0xc, 0x3, 0x18, 0x24]}, @NL80211_TXRATE_LEGACY={0x1a, 0x1, [0x1b, 0xc, 0x5, 0x30, 0x36, 0x30, 0x12, 0x18, 0x36, 0x36, 0x6, 0x12, 0x9, 0x16, 0x3, 0x16, 0x12, 0x2, 0x24, 0x1e4749cde54e4026, 0x48, 0x3]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x4, 0x6, 0xbd81, 0x3, 0x5, 0x4, 0xbf1]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x3000, 0x0, 0xe31, 0x6, 0x5, 0x5, 0x77b9]}}]}, @NL80211_BAND_60GHZ={0x4}, @NL80211_BAND_5GHZ={0x20, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x6, 0x40, 0x6, 0x81, 0xf, 0x872, 0x81]}}]}]}]}, 0x74c}, 0x1, 0x0, 0x0, 0x84e673cb5584b403}, 0x80) 1m26.581086822s ago: executing program 1 (id=42): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000700)={0x18, 0x5, &(0x7f0000000480)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000850000005000000095"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) mkdir(&(0x7f0000000080)='./file0\x00', 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r2 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$IPVS_CMD_FLUSH(r3, &(0x7f00000001c0)={&(0x7f00000000c0), 0xc, &(0x7f0000000100)={&(0x7f00000003c0)={0xdc, r2, 0x1, 0x70bd2d, 0x25dfdbfd, {}, [@IPVS_CMD_ATTR_TIMEOUT_UDP={0x8, 0x6, 0x577ca121}, @IPVS_CMD_ATTR_SERVICE={0x2c, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv6=@remote}, @IPVS_SVC_ATTR_ADDR={0x14, 0x3, @ipv4=@empty}]}, @IPVS_CMD_ATTR_TIMEOUT_TCP_FIN={0x8, 0x5, 0x415}, @IPVS_CMD_ATTR_SERVICE={0x20, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_FLAGS={0xc, 0x7, {0x15}}, @IPVS_SVC_ATTR_AF={0x6, 0x1, 0xa}, @IPVS_SVC_ATTR_PROTOCOL={0x6, 0x2, 0x3c}]}, @IPVS_CMD_ATTR_DEST={0x54, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x7fffffff}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5, 0xd, 0x1}, @IPVS_DEST_ATTR_TUN_FLAGS={0x6, 0xf, 0x1}, @IPVS_DEST_ATTR_TUN_TYPE={0x5}, @IPVS_DEST_ATTR_FWD_METHOD={0x8, 0x3, 0x1}, @IPVS_DEST_ATTR_FWD_METHOD={0x8}, @IPVS_DEST_ATTR_L_THRESH={0x8, 0x6, 0x3}, @IPVS_DEST_ATTR_U_THRESH={0x8, 0x5, 0x1}]}, @IPVS_CMD_ATTR_SERVICE={0xc, 0x1, 0x0, 0x1, [@IPVS_SVC_ATTR_SCHED_NAME={0x7, 0x6, 'rr\x00'}]}, @IPVS_CMD_ATTR_DEST={0xc, 0x2, 0x0, 0x1, [@IPVS_DEST_ATTR_INACT_CONNS={0x8, 0x8, 0x2d4}]}]}, 0xdc}, 0x1, 0x0, 0x0, 0x20000001}, 0x20004004) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) ptrace(0x10, r4) rt_tgsigqueueinfo(r4, r4, 0x13, &(0x7f0000000140)={0x3d, 0x4, 0xfffffff9}) r5 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r5, 0x1, &(0x7f0000000040)='user\x00N\xac]\x86\x8a\xa3\x7f\x00', &(0x7f0000000080)='\x00', 0x0) read$FUSE(r1, &(0x7f00000007c0)={0x2020}, 0x2020) ptrace$peeksig(0x4209, r4, &(0x7f0000000040)={0x1}, &(0x7f00000001c0)) sched_setaffinity(r4, 0x8, &(0x7f0000000140)=0x1) mount$fuse(0x20000000, &(0x7f0000000180)='./file0\x00', 0x0, 0x36fe8a, 0x0) mount$fuse(0x0, &(0x7f0000000040)='./file0\x00', 0x0, 0x24000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) r6 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={&(0x7f00000002c0)='mmap_lock_acquire_returned\x00', r0, 0x0, 0x8}, 0x18) mlock(&(0x7f0000bff000/0x400000)=nil, 0x400000) mremap(&(0x7f0000e95000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffc000/0x1000)=nil) munlock(&(0x7f0000ffc000/0x4000)=nil, 0x4000) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x15) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1f00000000000000000000000010000000000000", @ANYRES32=0x1, @ANYBLOB="00000052f6c8770b86c7e60eadf5e2bd", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x100000f, 0x51010, r6, 0x1000) 1m26.423125539s ago: executing program 1 (id=46): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x0, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100001c0000000000000000000000850000006d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='rxrpc_recvmsg\x00', r0}, 0x10) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000000)='rxrpc_recvmsg\x00', r1}, 0x10) r2 = socket$kcm(0x21, 0x2, 0x2) recvmsg$kcm(r2, &(0x7f0000001a80)={0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_emit_ethernet(0x32, &(0x7f0000000000)={@random="e90c630faca2", @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @gue={{0x2, 0x1, 0x3, 0x2, 0x0, @val=0x80}}}}}}}, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, 0x0, 0x0) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f0000000540), 0x3c) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='cpuacct.usage_sys\x00', 0x275a, 0x0) write$binfmt_script(r4, &(0x7f000000e0c0), 0x10010) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x1, &(0x7f0000000200)=@gcm_256={{0x304}, "00e0f07600", "832b4d2434b35bca8c0b78d2afff6d70d2025c7f53123828322d5af0d5c6c3a5", '`\a-N', "298f0e6df9ae9b3d"}, 0x38) ioctl$int_in(r3, 0x5421, 0x0) sendfile(r3, r4, &(0x7f0000000100)=0x6, 0x100000000010001) syz_emit_ethernet(0x31, &(0x7f00000000c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x23, 0x0, 0x2, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0xffff, 0xf, 0x0, @opaque="66b71b4468e24e"}}}}}, 0x0) 1m25.053377667s ago: executing program 1 (id=58): syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r1, &(0x7f0000000740)={&(0x7f0000000280)={0xa, 0x4e22, 0x3, @loopback, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@tclass={{0x14}}], 0x18}, 0x40881) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0xd}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) 1m25.052343022s ago: executing program 32 (id=58): syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) sendmsg$inet6(r1, &(0x7f0000000740)={&(0x7f0000000280)={0xa, 0x4e22, 0x3, @loopback, 0x9}, 0x1c, 0x0, 0x0, &(0x7f0000000380)=[@tclass={{0x14}}], 0x18}, 0x40881) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0xd}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r0, 0x100000000) 1m16.752662771s ago: executing program 0 (id=231): waitid$P_PIDFD(0x3, 0xffffffffffffffff, 0x0, 0x4, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0x4008ae89, &(0x7f0000000240)=ANY=[@ANYBLOB="0100000005080000029cebf6afa54f1d20da0b7a0c642f6faea76689e24a00c7c81df9c166872f3ad474f72507b54e8b8ee95d2af0e5615c663d965f21e47f0a0ee5d881d247b01c5f32db50c6e0da832f05029321adb8df6b020155c630c591d096b9c0c902ce16f00396b352e14d1de8b9fac4db7c7c6a68e240f73bc0a4655d39a792bf2d0a0459554b45d9570317a7e2ac3ba6ec03"]) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000140)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r0, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r0, &(0x7f0000000080)={0x18, 0x0, r1, {0x7}}, 0x18) lstat(&(0x7f00000001c0)='./file0\x00', 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x82000, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/mem_sleep', 0x102, 0x0) sendfile(r4, r4, &(0x7f0000000000)=0x8, 0x4) ioctl$IOC_WATCH_QUEUE_SET_FILTER(0xffffffffffffffff, 0x5761, 0x0) r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x6000, 0x0) getsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x24, &(0x7f00000000c0)={@multicast2, @multicast1, 0x0}, &(0x7f0000000140)=0xc) sendmsg$nl_route_sched(r5, &(0x7f0000000200)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)=@gettclass={0x24, 0x2a, 0x400, 0x70bd2a, 0x25dfdbff, {0x0, 0x0, 0x0, r6, {0xffe0, 0x8}, {0x1, 0xf}, {0x5, 0x1}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x80}, 0x45) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x200) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r7, 0x4068aea3, 0x0) ioctl$KVM_GET_MSRS(r7, 0xc008ae88, &(0x7f0000000040)) 1m15.792461292s ago: executing program 0 (id=237): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0xf, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @remote, {[@timestamp={0x44, 0x4, 0x0, 0x0, 0x9}, @timestamp_prespec={0x44, 0x1c, 0xc0, 0x3, 0x1, [{@multicast1, 0x5}, {@remote}, {@empty, 0x3}]}, @timestamp_prespec={0x44, 0x4, 0x0, 0x3, 0x8}, @noop]}}}}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r2, 0x0) dup(r1) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r6) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000000c0)=ANY=[@ANYBLOB="98030000", @ANYRES16=r7, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r8, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c0900005603330080b0c000ffffffffffff"], 0x398}}, 0x0) r9 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x60040, 0x120) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001380)=ANY=[@ANYBLOB="0000000000000000340012800e00010069", @ANYRES64=r8, @ANYRESOCT, @ANYRESHEX=r9, @ANYRES8=r9, @ANYRES16, @ANYRESHEX], 0x5c}}, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r10, 0x6, 0xd, &(0x7f0000000140)='yeah\x00', 0x60) connect$inet6(r10, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) write$binfmt_script(r10, &(0x7f0000000200), 0xfffffd9d) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r3, 0x84, 0x19, &(0x7f0000000180)={r11}, 0x8) getsockopt$inet_sctp_SCTP_GET_PEER_ADDRS(0xffffffffffffffff, 0x84, 0x6c, &(0x7f0000000340)={r11, 0x1000, "fa0968e156f84f15202684ff941c5dcb396ce8b1149c059433e0083a875cc64fea7907086ec8077c864d5807b991d59929bdd28a3e801ba89feda920baa05ada2416fabc7ccbc5450adbf7262e89d290456b9178ae26f3138b18c012bc45e77760f5fe63eec00a35229a98ff4b260ae63a5cb4b10c7917b9f480b873ef70cc4fc3cfc19d42ac50c1db853ca6b13de53bfeb9c42e9921935c87cbd28b7c020106b85d09c0d09f488211aa477382762e381671315e04e4ffd06c0af945f0aee3159b6d352b8057407920d6cf9bff90ab5e3d9559edb28d184471cb90864905dfbd6ac5aa523a8f656ad3cbe0a3fcdaa0c2bb734b0670685276722d02f5d13a86896328c5ef550a5084a4461c462babf325e22d7fb9807fa5431cfa9f6c12062c129a16a8c66485660c1d0f23bda189bad7c4f27f2e22899697e93afe551271edd10f497beaabce5d33bad80fd0f8a12869380526c1e5991dc393ef467dd139639e8df4990c2d9bae85dba93b77b00a596678f1fad1535dacfe7dcd08d0b77fab5b117fce724277f972af7aabb3c401dc82de840dacda112fbc0ea27d20075d36afef3c5090ae3613d97562f0c856057031b615236a90701bd6f47babfd53e4c84039d999df36551b75797d9dc5fbd73acc71c29a86f2d7719ac30ee4ec161c94ef563a66e430856e316d311b833da873e1a3d1299fa479dd7fe1a14bfb2faf20a519daade961d2b98c6b16dc2565b572352c7e9adfd49fc2bd6fc7920b6324b0c810bc0b95baea12e48d0c2f73f2eea27e29bf0108b3bfad6b9c5dea42cd1d7755147a9749063a8fa7bc71feca78f0b16e3548df8cc6695052c3798e13c675072373a1e67cba34af3dea17efda992f059d0a76a5aea83330e165e4e3c2d4775a43e07ffa689a5bd9334bd5d5c2628c18d419e3090cf35d20995f589b65531fdc0098d84189779f57399705c9abaadaed7b1b81b5feb7a1499ff23675ad0d3e7cd026b578122a9ba63d718c7af6235dca029cee8aa5594e0e10f631f08c35c827fe9b3360dd3343984c1f00b49629fb5793a81b690005c4e2f5fc40bd97863fae2b3fad91fa3eedfbef292814ce715ee836164a38b2cd61a32596655bccd448cb0ea262a91b361518e2933f62919c0e82ee5d69a9bd23d32f84af1e927978d1ab0d44d4113c97192980367d01e71c6edf32c85f8108b159b102d5be66d005ff791497fa38349617edf599e0c0b9bfba9bea50f25a67fc5f77cb38898302e1c6419fb4b33c0a340e3f4ef089a2844c8e4e1e365fad1cf231f3c26d4a2be7344f5e281d94ceb5da5190da716f2994067c881505bf9a26239563ea28dd829be50d787b6fb48de29a652725482ead26b766a4f5c22087cb6fd799230b795d3276ceb9dc826a60cd1d53c1be8aa1e5b58e114a0582a8df3aee62ffa7ef9d20bcf35fab47cff9ab1736199e5758ed08139df67065416218216a5ac3f06ad52568b23a9e2110b02a6f07e9d71da3332b57a40f143dd13de89cf2a7afdcf1772b79ae31fdd928c34eda4391049db6cba1d021ebb34fde6d73b6b575990a21827831973c13f90c7649e2db6ae51d18b1e4cb857834a69332d90dd458d45dbc2cec24de6f82aba65b8815520f4305d868fc76f084446b5eb5bbf0c9e17adcacdbcc70a1c3e46399cda8b45782d8af336c14a4d7e5be9371fc20941f2ba354530082ef090e9ffbb7ec3c545bd2d34d0118b81ccaeaab82f115623615ca478d092bf0829d12aa8574bd892127480ae5f9e03cbfbe8fa3d3c08c77542a3dec2017250739d46a12e3dec43157d9469b97acb949ca96e1dbc6c885f862b97fb8908ece9a15511ac7971ab97442bc1098347de4cc49c57d3d3b0f9b5583bd16f9cd4f94c0601fcc0db070311a1bdf8bf4cfdca50d547405c4a6f491c3539e258701dd7463270fd017f2fd6f67b1a3b164c2333651ea8f7f732a44452817447e907b82747eb9145186d7083c4d1022ed3b689c1fbe8933615ddf154f18abe98194f3236ae175489c91893f70f2530af361b159adc3e9de81f6adc21ad55a0d0884ad6e9a3c1aa351fa558ea931b7ac0d213d3414ba41a9a5f8f0ee125339b3d39d0bd6851a99e20c895f362e1f974555183717abb03d11ec30e0e422d97b521a0b783024c7700f1cb7c0678e4251a5bb175e9040b90eb65d7f18a278eb54ec3c30c4742f542ed80e5c4b7b566792c8e0a401be3bf4527cf60f8ab7a185e41a5634a3aeda1742187f5abfa6706872d67ed5846e34494e7269d290584f6c097ddf32e46dfd6201b4204c94a09fa9f96d3c7ddfeee588001e7f3558551591d20b67a2ce98599e04252ea084da6eb430001b9b33afadcb23c8298e5714f0d940b8d1c92cdfc7996cba313a86a363295b3dee1e4abec53b0360fbeb6ff6b226a7c8a3fd8334d2de5a26f27a03230bfdb0c5f2259d5f5265c292d8f78d8768b60510816add69213898b12b519e4b7628a548f7d97674d3fb0b1d2777e814f11ee878bf31c413e31c5101f54fcaae8dd631fd2bc93ee445c89f55ceb028bd8822617d490f6b5e1230c31c56593705dfcd4627c08a32dc2d4b1e1983914d60dd8d7d5c0f6eae2cafbe9164277c834741c3ac2c243c2d83ea9ad6d2bb531a4c1dc592b0c39fecaa756e1db8854db0548aa6454f1976df9db6c7f8e28fe615199802627925cd0bad89fbd91be5164f12ca584de3a39c1fb365a264826269b01f30f27247fae8eac76f0eeaefd6d9fe892f0bb8cbada1a6d2ed1c0e717fd72e1867b7c881c4effcbf21ed4ad378eee8de5e64ca592d6631b985bc6ed99a1cbe484c23412f556da812dd0b7a1318afffcad579d8f24ce907fd27aa6bfa0f0b67ee64221127dceafde0564943a7aeb0b759074529dcda718b72d6cdfad3f7a312e483e8e33982d938d8215f6cf050233fd2ef40cf6f9e86447f1854d969154647495918801ac4cb61b8f7c72d2ba2e2c77c8075d2d37547855addedcf7d950760a621bc16c7379d6c524b5baaf3897bbaa88e6f6a4dc7212f2d6483247b389df0293fdf938280ddeb0ef2e5a0063fda616b812aca431d278b47a1db78d02a70cef198ae72a417474afacaa8bae4dc22102188a3c9f11c7f561f10bd8154c167314df5398998fe910ea334efd02ebe1477cec1602505ffa3dee247220bca08d144fe6f307031fbfbfe8a5889e19d7a1ef72dfd7c235ccb881d56dd01d4a3a170c4efa31531aabc78c9ce9794659d3495aecb18c05f004627a8c21c59aa3f931ea66a80ae0eccda5da55d5131f3ed4dfac71ee134add55f20388a3ee3f144e8ddaba789f45050d97cf065b8b00505bab392be71ff6178f33b4034b403e454a28bf7b99b68ed92053a5a69762eeec4cd5fb5ee7c52ba41917682b11bebb178a3b23943cbefecb45d327f425d28a07bd46fa2cff68606530db3ba185910fe23988d3b3ff8ff87dab2cb533b0533409f4caeb70fb544db97e145ca3595a07a7537f76e2de61b538d910829cc8e2e7606a172bbbbf43b89a20ede2fc56b2dd26014d32d10d024da4bd20b5167dd213df1e158e30e56bd1314ce1aae642cbc0b44072b3e272070c31e44b64f8c65c7f0aa7ca0f9f3fb5ce1df4c634bb7eba506e57463ae1582e04124f042e6c9af662c222d7bfc05ce4a083b330b172a1abf0a8e090c4313412264024308321696b8f70af4e7a8802062e79d39e17a181023ab151021a1f6e183263d62f01b967df8aa93045ae4fefec445c70390ac31377002e668df4439d6608b3c1bc94fa31187dc019ce38528849a5e8b3ba1b197963791b5c21cb9fbe877a0cb1f6e6bb2df863ba0065f09bbb4cbd2fc2137253028d4b1d6a7ad54d8cccb0c13344e9716913f9404f1f29ffc9c51691aaec1368d50b3a9afa4919cfb9a88bd0980faec21aa0b34113b763faf3a9b68f7725e53f24356f16761af4a7bbdc8622a5b1915790ce6a0e867174cc7cbe962e09d9bd6604ae61cb211aeedef2d85f4df705b0680a6bbd3c4f9ec317076a8e540c7ce242decbb3035f3727a6c353e7c033631956fb3fc5d85ad013a4190657f2f8a605e0f186a5c997ab8d74b95520ca41502b011ac76c0e0abbfecb9b640836c650ab338ef27373db1abc464ad0c911f25a8eefd622b5e50e12ffd266e8335eb5d53538e8702ccc4df478b0e1dd5ea38072b0769489c3c4b6954db2afa49ef940660a31fb5c4dbde2cfe18a424a25dd7377ba19c5f16997e365c9bd12a860c9d8ab6ffb20242b838b72a356bec8906c64d2d0393b5f12e7e1f46619282a1dccbbc3a134532a82fcc9e76b538aec2751ac3c699592584f53e1618bfffc099604370264eaa1a865cd7dfd64433e21e76f3e8c768648fc0edbd24cd6ae22ab62703bda02072ad781be89826fc029450f3b84c1836024e29ac128ed780d02a48524a1ee596c12cbf4164b0eb295ab25483c3e6daedc3d70815d83974acd3a87631590761b99bb6b25b354359d56f9af86473af4cd4629e1c4a65b9aeb092afb647c42a3dd309bd6db9675c25433f48d28679f38f6aea467e0dc0ab87c8ac70057224198144188df3b14c6d0b4bbcad2187518422f620175f58df3811fd166969696168e3add90d62fd025e7a967231b6c32766da5a113ade44541b3c53b9064b144168fec59acb47a7f09bd842490a236cfc3928ecf3cc6e49362ba7326a0480bf9752e9f7c12ed65b9dec6bf18bcaccad9491083cdfeaae8b4dc97ed2e1854b3925b41f55b917386f914fc1c9056be8c0a7feaac1ca7ee18a575ed8d5379efc4865169f0b7a5940910ec2d8533e998c73ad64335ea2a8cda7a87bfdb2f4441434215fbc3a37aaf3bb27872763d9589d56a2b40ee160568977542275c94c1780392c42d47ac01ecf523ed7331ae5d12cb97df6bfac87051af266699666d3a4c80210da529f8254a317887883d35dfe7da98826ca93f18e4ed35c0c5ac502fd318dec5c375ae6484f9d098bfd76aa23fa888e0a57e00f046bb2de315ba004f667a1207bba68e11406a2239ca64b708ef1831b6d70680d360793104576033d93f9b7725cdc47a1b7a74c7535444c560c6158f613f38556d8c75591f9873c1b12d76a384b91bb3f22a2e64278ffeabf6a8b128652b8b30baa46b78ed8b0534ca647b37de211f0f372adae28cd141183f914160c2baff831fe4f7fa72781d813d8f9d0e3d4b2de782905a5867ec0309513bb071de9c721caf798b1e0f5f10a8e8f80a11442d4808fd97271107b1f785e9d0a38854578d6c8eacae1e0165803452d2477d8638c81d946467fa25292f01828278be8ebc715768b6a7c51fc24567cd430d6b1e9e06549a4ea8417b5e1ca5ffb62a43d39319af80293b456b83c8f25606abeb3cbdd609d7cbdd30e03759ae9d67ce095afe6a4af5f21c64eab6452bb7501159d9db188f600e854001c9032b05e1a4b3c9452fd5f0110878586325ab5c076c3c0d9c0cc92b9d5c9b30c90fa6dd2d5ffd012a5a3f51d66f7017fcbb9f00a7ecd7a8518537e52513652671bfa5d6f1243eca5ce04bd61bce4d9d0007e1504b8ab69f52270260859ec6b12180da2e0868e62eb1192c827b4526f0551a1b6e14de0bc3c3e813803672901a1bff775764f279fbe039ffe7163c9d0e85057175ae5704e2451f22f097cd9a3b969979dd1a1d1db0cc12e2aa6edeffaa00587352d5c49eba526fec06a4791037860feae192ad28bbfcb41bcd31b3ea78c7f2ee1e0348fe711b3f2b8c854d18c89d32161511ae8b473786466b86e243ca56a49"}, &(0x7f00000000c0)=0x1008) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000027000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, &(0x7f0000001400)="0f78cf360f32baf80c66b85c403c8266efbafc0cb060ee66b8000000800f23d00f21f86635000000070f23f8baf80c66b8779b1a8c66efbafc0cec0f080f01c20f06baf80c66b8506c0f8066efbafc0c66b80b00000066efba42003e26c0b21da777ef", 0x63}], 0x1, 0x20, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 1m15.638786153s ago: executing program 0 (id=241): r0 = creat(&(0x7f00000000c0)='./bus\x00', 0x24) r1 = socket$netlink(0x10, 0x3, 0x0) getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) lchown(&(0x7f0000000340)='./bus\x00', r2, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000080)='system.posix_acl_access\x00', &(0x7f00000003c0)=ANY=[], 0x34, 0x0) creat(&(0x7f0000000040)='./bus\x00', 0x0) write$RDMA_USER_CM_CMD_SET_OPTION(0xffffffffffffffff, 0x0, 0x0) syz_usbip_server_init(0x4) r3 = openat$selinux_attr(0xffffffffffffff9c, &(0x7f00000002c0)='/proc/thread-self/attr/sockcreate\x00', 0x2, 0x0) write$selinux_attr(r3, &(0x7f0000000100)='system_u:object_r:hugetlbfs_t:s0\x00', 0x1d) socket(0x10, 0x3, 0x0) syz_usb_connect(0x1, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="120100001ddf8208c00712152230000000010902"], 0x0) r4 = syz_io_uring_setup(0x82e, &(0x7f00000005c0)={0x0, 0x20000020, 0x10100, 0x1, 0xfffffffd}, &(0x7f0000000100)=0x0, &(0x7f0000000380)=0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000002c0)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000980)={&(0x7f0000000940)='rxrpc_recvmsg\x00', r7}, 0x10) r8 = socket(0x21, 0x2, 0x10000000000002) connect$rxrpc(r8, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @multicast2}}, 0x3a) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) r9 = syz_io_uring_setup(0x4b5, &(0x7f0000010400)={0x0, 0x1086e1, 0x1, 0x8}, &(0x7f0000010080), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_BUFFERS(r9, 0x0, &(0x7f0000010300)=[{&(0x7f0000010380)=""/47, 0x2f}], 0x1) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x4000, 0x0, 0x200000, 0x0) sendmmsg(r8, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0) recvmmsg(r8, &(0x7f0000006340)=[{{0x0, 0x0, 0x0}, 0xb5d}], 0x1, 0x2, 0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r4, 0x16, &(0x7f0000000000)={&(0x7f0000001000)={[{0x0}, {0x0}, {0x0}, {0x0}]}, 0x4}, 0x1) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x9, 0xe, &(0x7f0000000a40)=ANY=[@ANYBLOB="b70200000d000000bfa300000000000005000000000000007a0af0fff8ffffff79a4f0ff00000000b7060000ffffffff2d6405000000000065060400010000050404000001007d60b7030000000000006a0a00fe00000000850000000d000000b7000000000000009500000000000000496cf27fb6d2c643db7e2d5fb4b0936cdf827fb43a431ca711fcd0cdfa146ed3d09a6175037958e27106e225b7937f02008b5e5a076d83923dd29c034055b67d5b310efcfa89147a7fb0a93d035f2f206d2ef831ab7ea0c34f17e3ad6eecbb622003b538dfd8e012e79578e51bc53099e90f4580d7be3e8c254a5cba117cbdb9cd38bdb2ca8e050000003a14817ac61e4dd11183a13477bf7e060e3670ef0e6a9f65f1328d6704902cbe7bc04b82d2789cb132b8667c214733a18c8b6619f28d996d60a17e3c184b751c51160100000000000080148b9a31ee8dc8b544f3c4a532e60a0ac346dfebd31a08060000000200000000000000334d83239dd20100008000000000d858e8327ef01fb6c86acac12233f9a1fb9c2aec61ce63a38d2fd50117b89a9ab359b4eea0c6e957bc73ddc4eabba08a406f99f7b1e1ad828267d4eadd3964663e085354133f7130856f756436303767d2e24f29e5dad9796edb697a6ea0183babc190ae2ebf8aad34732181feb28cb0bae7c34dc5e7c805210600000000000000c3dec04b25df45d4f71ab158c36657b7218baa07a99bd50499ccc421ace5e845885efb5b9964e4beba3da8223fe5308e4e65ee93e107000000f8ddebf70132a4d01776839b8eccf707882042e716df9b57b290c661d4e85031086197bcc5cb0e221a0c34323c129102b6ff0100002e88a1940b3c02ed9c92d6f64b1282dc51bb0015982730711c599e1c72ffa11ed8be1a6830d7507005154c46bd3ca96318c570f0721fc7aa2a5836ba99fe1f86468694f22cdf550ef091a78098534f0d973059594119d06d5ea9a8d0857382ec6e2a071474cfc12346e47ad97f4ead7cf70a9d1cdac944779dc08a705414888700a30e2366c6a06b3367a389ca39059787790017b0689a173db9c24db65c1e00015c1d093dab18fd0699fe3304000000323e9c707fe81436b024c2574980397bc49d70c060d57bc88fbe3bbaa058b040362ab926150763fb099408885afc2bf9a46a076b7babfcddeff8c35030669ea69f5e4be1b8e0d6697e97186f9ae97d5670dba6623279f73db9dec75070cd9ab0fda6b069ef6d2857ca3e4e6068f1bf710d133d541da86e0477e4a6cc999dc21c3ef408e6b178e7c9f274d7fafc8d757d33dfa35aa2b2ff7f9a7d365e63845f3e1092f8dde8af3904ea0f4b82649b83ed4fa0f873339c4cadecc13219ba7518aa4f7db34ead13484742067ab743c1d82a5687f2ed690000010000000000000000000000000000000000000099d4fa0000000000003f0ecdc7c82e72919c91d2039afe17e95edef8ba72205beff7771bcb293747b88486cacee403000000a2919a4b09e168e4e4d5ff2ed893f2e314679fa69fc7e0cf761f91b18725704a01c56009a9f748e5aaf30a10bd8c409b1870c1f75e26b45264e3d3f8e0048e55ae289c2f884d0766cddc76eb7f601110ff39053c262279f4ef00fbdb8c328615a9ec84f27a9f3938ae736138b8c1ec220c1540bf3d162dc1c27fa30f0dc60b9f257db5d1c7ed2efce676a93110904d5e055af44664b53c764d61443f73552195c7ccfbf9f03c44432eaa3b7501d4239354da8de21eada75d3a3afb2c76ff0700007976694b6a0f0e946766f57544ff52cef0dd811bec4e3c0a30f2d7d19d26d201721b8eded3bc475958dd498ee2b2d6146e33fc0de1dc2e0516ac565ddb1d4ae89e671282a2d3066ac968c7d7d7db195f255b1b4a85eb9ee0a3b68c9e209756623adf685dd715d68ed1274b4d5502f512493af8f98c615cac3666c58f785c3f758be352a71871d5c081197d37980e4f4e26b5476fb20407ff7098b7174bef66fa03a99b5c0c20b378065fac4ef9ac2d0d804b9400000060e5d3f1749f6aecf69ba83a71caa9bdddc679f1b826f74b6563a4be1fd82b73c8c2bc65f63982"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x59, '\x00', 0x0, @fallback=0x27, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r10 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000040), 0xf0a2d533e54dfb59, 0x0) ioctl$SNDCTL_DSP_STEREO(r10, 0xc0045003, &(0x7f0000000080)=0x1) r11 = syz_init_net_socket$nfc_raw(0x27, 0x5, 0x0) syz_io_uring_submit(r5, r6, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x0, r11, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}}) io_uring_enter(r4, 0x5b43, 0x763, 0x0, 0x0, 0x0) 1m14.540736529s ago: executing program 2 (id=255): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000340)=[@text16={0x10, &(0x7f0000000140)="66b93709000066b81000000066ba000000000f30f30f093ec08613a81366b9800000c00f326635001000000f300f01c10f320f01c20f005700660f50cb650f01d1ff9b1400", 0x45}], 0x1, 0x10, 0x0, 0x0) write$P9_RLERRORu(r3, &(0x7f0000000040)={0x10, 0x7, 0x1, {{0x3, '!*\xd6'}, 0xffff}}, 0x10) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0x1, 0x57, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(0xffffffffffffffff, 0xc0189375, &(0x7f0000000080)={{0x1, 0x1, 0x18, r0}, './file0\x00'}) (async) syz_kvm_setup_cpu$x86(r3, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000340)=[@text16={0x10, &(0x7f0000000140)="66b93709000066b81000000066ba000000000f30f30f093ec08613a81366b9800000c00f326635001000000f300f01c10f320f01c20f005700660f50cb650f01d1ff9b1400", 0x45}], 0x1, 0x10, 0x0, 0x0) (async) write$P9_RLERRORu(r3, &(0x7f0000000040)={0x10, 0x7, 0x1, {{0x3, '!*\xd6'}, 0xffff}}, 0x10) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000004000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, 0x0}], 0x1, 0x57, 0x0, 0x0) (async) ioctl$KVM_RUN(r2, 0xae80, 0x0) (async) 1m14.42278184s ago: executing program 0 (id=256): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000004280)=ANY=[@ANYBLOB="440000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="03000000800402002400128008000100677265001800028006000e0000570000060003"], 0x44}}, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) fchown(r1, 0x0, 0xee01) fchmodat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0xfffffffb) openat(0xffffffffffffff9c, &(0x7f0000001740)='.\x00', 0x515001, 0x408) r2 = openat$tun(0xffffffffffffff9c, 0x0, 0x20800, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)={0x28, 0x3d, 0x107, 0x0, 0x0, {0x4, 0x7c}, [@typed={0x4}, @nested={0x10, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0x4, 0x1c}]}]}, 0x28}}, 0x0) openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(r5, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r6, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r8 = openat$procfs(0xffffffffffffff9c, &(0x7f0000002200)='/proc/asound/timers\x00', 0x0, 0x0) read$FUSE(r8, &(0x7f0000004d00)={0x2020}, 0x2020) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) r10 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000180)={'bond0\x00', 0x0}) write(r3, &(0x7f0000000280)="82d7da9736a483c8ed057538d8636af6d6b20764e628b10c8231cbce42aa60fda08ff93c49d4b9c3f5f4796b6474af45b120215d9d937e01b7622f0dde73e2fb0d2a4673c58f6366590b0a17b3f59c5cd5762207f19dd4b6047573d96103e36918d8078e7face1bd4c64b94be97d47c6afa6d8fd4c0fdacf8ab62cd29c6439ab728899a78ae11e2ae8df2f3b89b96560e8982226bf24", 0x96) sendmsg$nl_route(r10, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=@dellink={0x20, 0x11, 0x101, 0x0, 0x0, {0x0, 0x0, 0x0, r11}}, 0x20}}, 0x0) sendmsg$nl_route_sched(r3, 0x0, 0x0) 1m14.339929916s ago: executing program 2 (id=257): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400001200200000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="140000001000010007000000000000000000000a20000000000a03000000000000000000010000000900010073797a300000000048000000090a010400001200200000000100000008000a40000000000900020073797a32000000000900010073797a3000000000080005400000001f0c00098008000140000000075c0000000e0a01020000000000000000010000000900020073797a32000000000900010073797a30"], 0xec}}, 0x0) (async) 1m14.339612506s ago: executing program 2 (id=258): ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000000)={'sit0\x00', &(0x7f00000002c0)={'syztnl1\x00', 0x0, 0x0, 0x1, 0x0, 0x0, {{0xf, 0x4, 0x0, 0x0, 0x3c, 0x0, 0x0, 0x0, 0x0, 0x0, @broadcast, @remote, {[@timestamp={0x44, 0x4, 0x0, 0x0, 0x9}, @timestamp_prespec={0x44, 0x1c, 0xc0, 0x3, 0x1, [{@multicast1, 0x5}, {@remote}, {@empty, 0x3}]}, @timestamp_prespec={0x44, 0x4, 0x0, 0x3, 0x8}, @noop]}}}}}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='hugetlb.2MB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f0000000240), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x280000b, 0x28011, r2, 0x0) r3 = dup(r1) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = socket$inet_sctp(0x2, 0x1, 0x84) r5 = socket$packet(0x11, 0x3, 0x300) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000640), r6) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f00000000c0)=ANY=[@ANYBLOB="98030000", @ANYRES16=r7, @ANYBLOB="010028057000fcdbdf253b00000008000300", @ANYRES32=r8, @ANYBLOB="04008e00080057001b0a000004006c000500190107000000080026006c0900005603330080b0c000ffffffffffff"], 0x398}}, 0x0) r9 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x60040, 0x120) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000001380)=ANY=[@ANYBLOB="0000000000000000340012800e00010069", @ANYRES64=r8, @ANYRESOCT, @ANYRESHEX=r9, @ANYRES8=r9, @ANYRES16, @ANYRESHEX], 0x5c}}, 0x0) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r10, 0x6, 0xd, &(0x7f0000000140)='yeah\x00', 0x60) connect$inet6(r10, &(0x7f0000000180)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) write$binfmt_script(r10, &(0x7f0000000200), 0xfffffd9d) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0xd, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) r11 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r11, &(0x7f0000027000/0x18000)=nil, &(0x7f0000000300)=[@textreal={0x8, &(0x7f0000001400)="0f78cf360f32baf80c66b85c403c8266efbafc0cb060ee66b8000000800f23d00f21f86635000000070f23f8baf80c66b8779b1a8c66efbafc0cec0f080f01c20f06baf80c66b8506c0f8066efbafc0c66b80b00000066efba42003e26c0b21da777ef", 0x63}], 0x1, 0x20, 0x0, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r1, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) ioctl$KVM_RUN(r11, 0xae80, 0x0) 1m14.268316981s ago: executing program 0 (id=262): capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000180)={0x7, 0x7, 0x7, 0x10001, 0xf}) fchmodat(0xffffffffffffff9c, &(0x7f0000000300)='.\x00', 0xffffffd3) socket$nl_generic(0x10, 0x3, 0x10) (async) r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) (async) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000000), 0xffffffffffffffff) socket$nl_xfrm(0x10, 0x3, 0x6) (async) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000800)=@migrate={0xcc, 0x21, 0x1, 0x0, 0x0, {{@in, @in6=@remote}}, [@migrate={0x50, 0x11, [{@in=@multicast1, @in=@local, @in=@local, @in=@broadcast}]}, @user_kmaddress={0x2c, 0x13, {@in=@remote, @in6=@dev={0xfe, 0x80, '\x00', 0x28}, 0x0, 0xa}}]}, 0xcc}}, 0x0) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)={0x2c, r1, 0x1, 0x0, 0x0, {0x2a}, [@ETHTOOL_A_LINKMODES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'syz_tun\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40040}, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000440)={0x6, 0x1b, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x6}, {{0x18, 0x1, 0x1, 0x0, 0x1}}, {}, [@btf_id={0x18, 0x9, 0x3, 0x0, 0x2}, @ldst={0x0, 0x0, 0x2, 0x0, 0x5, 0x4, 0x4}, @ringbuf_query, @jmp={0x5, 0x0, 0xb, 0x4, 0x2, 0x7b7183c8faf25f21, 0x1}, @initr0={0x18, 0x0, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x80}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffffb}, @func={0x85, 0x0, 0x1, 0x0, 0xfffffffffffffff9}]}, &(0x7f0000000080)='GPL\x00', 0x1, 0xb4, &(0x7f0000000340)=""/180, 0x41000, 0x68, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f00000000c0)={0x5, 0x2}, 0x8, 0x10, &(0x7f0000000140)={0x3, 0xf, 0x1, 0x5}, 0x10, 0x0, 0x0, 0x3, &(0x7f00000002c0)=[0x1, 0xffffffffffffffff, 0xffffffffffffffff], &(0x7f0000000400)=[{0x0, 0x5, 0x7, 0x3}, {0x0, 0x2, 0xf, 0xc}, {0x5, 0x5, 0x1, 0xc}], 0x10, 0x2, @void, @value}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r3, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, &(0x7f0000000540)=[0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa6, &(0x7f00000005c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0xb3, 0x8, 0x8, &(0x7f0000000680)}}, 0x10) (async) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000007c0)={r3, 0xe0, &(0x7f00000006c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000500)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x6, &(0x7f0000000540)=[0x0, 0x0, 0x0], &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xa6, &(0x7f00000005c0)=[{}, {}, {}, {}, {}], 0x28, 0x10, &(0x7f0000000600), &(0x7f0000000640), 0x8, 0xb3, 0x8, 0x8, &(0x7f0000000680)}}, 0x10) openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) (async) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) fchown(r4, 0x0, 0xee01) syz_open_dev$loop(&(0x7f0000000800), 0x8, 0x0) openat(r4, &(0x7f0000000000)='./file0\x00', 0x1a74c1, 0x408) r5 = getpgid(0x0) ptrace$ARCH_MAP_VDSO_X32(0x1e, r5, 0x1, 0x2001) 1m14.062694576s ago: executing program 0 (id=263): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000700), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, r2, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x20040000) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000011c0)={0x48, 0x2c, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x800}, @nested={0x34, 0x18, 0x0, 0x1, [@nested={0x2d, 0x1c, 0x0, 0x1, [@typed={0x8, 0xcf, 0x0, 0x0, @pid}, @generic="f3cc50fe634d094ec09b27ebad7974a937072c2cb851ba4a0630dbb1fa35788811"]}]}]}, 0x48}], 0x1}, 0x0) 1m14.058769497s ago: executing program 33 (id=263): syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000700), r1) sendmsg$NLBL_UNLABEL_C_ACCEPT(r1, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000740)={0x1c, r2, 0x1, 0x70bd29, 0x25dfdbfe, {}, [@NLBL_UNLABEL_A_ACPTFLG={0x5, 0x1, 0x1}]}, 0x1c}, 0x1, 0x0, 0x0, 0x400c000}, 0x20040000) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000011c0)={0x48, 0x2c, 0x1, 0x0, 0x0, "", [@nested={0x4, 0x800}, @nested={0x34, 0x18, 0x0, 0x1, [@nested={0x2d, 0x1c, 0x0, 0x1, [@typed={0x8, 0xcf, 0x0, 0x0, @pid}, @generic="f3cc50fe634d094ec09b27ebad7974a937072c2cb851ba4a0630dbb1fa35788811"]}]}]}, 0x48}], 0x1}, 0x0) 1m14.011494712s ago: executing program 2 (id=265): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000080)='./file0\x00', &(0x7f0000000000)='./file0\x00', 0x0, 0x21714a, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) umount2(&(0x7f00000000c0)='./file0\x00', 0x9) 1m14.011107648s ago: executing program 2 (id=266): r0 = syz_open_dev$vim2m(&(0x7f0000000340), 0x2, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000140)={0x16, 0x1, 0x3, "18e889d15b38429faa8ff62438eaed752e68f3a6d09382b392b049e33958b16c"}) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r0, 0x8010661b, &(0x7f0000000000)) r1 = syz_open_dev$sg(&(0x7f00000000c0), 0x1, 0x40200) setresuid(0x0, 0xee00, 0x0) r2 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000680)=@bpf_lsm={0x1d, 0x10, &(0x7f0000000580)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1}, {}, {}, [@kfunc={0x85, 0x0, 0x2, 0x0, 0x5}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000200)='syzkaller\x00', 0xa6165118, 0x0, 0x0, 0x41100, 0x20, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f00000002c0)=[r2, r2], &(0x7f0000000600)=[{0x2, 0x4, 0xf}, {0x5, 0x5, 0x2, 0xb}, {0x2, 0x5, 0x1, 0x3}, {0x1, 0x4, 0xe, 0x7}, {0x1, 0x1, 0x5, 0xd}, {0x4, 0x1, 0x5}, {0x0, 0x5, 0xc, 0x4}], 0x10, 0x1, @void, @value}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000500)={r3, 0xe0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, &(0x7f0000000180)=[0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x20000000000000a4, 0x0, &(0x7f00000001c0), &(0x7f0000000200), 0x0, 0x96, &(0x7f00000001c0)=[{}, {}, {}, {}, {}, {}, {}], 0x38, 0x10, &(0x7f0000000300), &(0x7f0000000380), 0x8, 0x35, 0x8, 0x8, &(0x7f00000003c0)}}, 0x10) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r7, 0xc008ae88, &(0x7f0000000040)={0x1, 0x0, [{0x297, 0x0, 0x296}]}) dup2(r2, r1) r8 = bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1e, 0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="180800000000feff000000000000000f180300004e07", @ANYRES32, @ANYRESHEX, @ANYRES32=r2, @ANYBLOB="0000000000000000b70500000800000015000000760000e4be980000000000001e080000000000008500000007000000b70000000000000095"], &(0x7f0000000980)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x22, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$SG_GET_VERSION_NUM(r1, 0x2282, &(0x7f0000000100)) mmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000002, 0x11, r8, 0x2fea0000) 1m13.192223539s ago: executing program 2 (id=271): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x111, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x80000000}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x7fff}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x14) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000140)=0x9, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)={0x144, r3, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_MEDIA={0x6c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd8b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x62a}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xf}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xa1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x66138e35}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xf6e}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x80}, 0x4040080) r4 = dup(r2) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r4, 0x80605414, &(0x7f0000000400)) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r5, 0x20, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) preadv2(r4, &(0x7f0000001940)=[{&(0x7f00000005c0)=""/101, 0x65}, {&(0x7f0000000640)=""/62, 0x3e}, {&(0x7f0000000680)=""/145, 0x91}, {&(0x7f0000000740)=""/4096, 0x1000}, {&(0x7f0000001740)=""/191, 0xbf}, {&(0x7f0000001800)=""/140, 0x8c}, {&(0x7f00000018c0)=""/114, 0x72}], 0x7, 0x461, 0xffffff7f, 0xa) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f00000019c0)={0x2, 'macsec0\x00', {0x8}}) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000001a00)={r0, 0x7, 0xcd, 0x5}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r6, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001b00)={&(0x7f0000001a80)={0x54, r5, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xe}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x80) socket$netlink(0x10, 0x3, 0x7) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r4, 0x800442d3, &(0x7f0000001b80)={0x3d63, 0x0, 0x44, @broadcast, 'ipvlan1\x00'}) syz_genetlink_get_family_id$tipc(&(0x7f0000001bc0), r4) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000001cc0)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x1c, r1, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) bind$inet(r6, &(0x7f0000001d00)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001e00)={r4, 0x58, &(0x7f0000001d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000002080)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x10000044}, 0xc, &(0x7f0000002040)={&(0x7f0000001e40)=@newtfilter={0x1e8, 0x2c, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x6, 0x5}, {0xc, 0xc}, {0x2, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x7}}, @TCA_CHAIN={0x8, 0xb, 0x4}, @filter_kind_options=@f_basic={{0xa}, {0x1a8, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x831c1d96fe497e79, 0xfff1}}, @TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0x5}}, @TCA_BASIC_EMATCHES={0x194, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8}}, @TCA_EMATCH_TREE_LIST={0xdc, 0x2, 0x0, 0x1, [@TCF_EM_META={0x48, 0x2, 0x0, 0x0, {{0x9, 0x4, 0x7}, [@TCA_EM_META_RVALUE={0x29, 0x3, [@TCF_META_TYPE_VAR='\tY', @TCF_META_TYPE_VAR="09d0e77c40728300", @TCF_META_TYPE_INT=0x2, @TCF_META_TYPE_VAR="e8f709d3", @TCF_META_TYPE_INT=0x6, @TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_VAR="17a231b3", @TCF_META_TYPE_VAR="0d989c7a27aea1"]}, @TCA_EM_META_RVALUE={0x10, 0x3, [@TCF_META_TYPE_INT, @TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_VAR, @TCF_META_TYPE_INT=0x8]}]}}, @TCF_EM_NBYTE={0x14, 0x2, 0x0, 0x0, {{0x76, 0x2, 0x7}, {0x9, 0x2, 0x1, "1ed1"}}}, @TCF_EM_NBYTE={0x18, 0x3, 0x0, 0x0, {{0xff39, 0x2, 0x2}, {0xb2a3, 0x6, 0x0, "1f3bcd88f91e"}}}, @TCF_EM_CONTAINER={0x64, 0x1, 0x0, 0x0, {{0x6, 0x0, 0x2ccd}, "0bf08dc9a4ba7e1788d7e99081bf03c74a1d3e2992c6df8a18d2deddb7b17d0f21f02d239c63a15174aac6d96513499ad579f69d1bd14f4d2416e4c77dd1710824c46515d970a080de679254e916a38fc06a080105685db5"}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x200}}, @TCA_EMATCH_TREE_LIST={0x94, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x9, 0x3, 0x8000}, {0x4, 0x9, 0xff3, 0x3ff}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{}, {{0x3, 0x1, 0x1}, {0x3}}}}, @TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x6, 0x3, 0xfffa}, {0x9a6b, 0x8, 0x8, 0x2}}}, @TCF_EM_IPT={0x44, 0x1, 0x0, 0x0, {{0x247d, 0x9, 0x3}, [@TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x7}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x1}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x3}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x10044010}, 0x41) syz_emit_ethernet(0x56, &(0x7f00000020c0)={@random="351f2d449eb3", @remote, @void, {@canfd={0xd, {{0x1, 0x0, 0x1}, 0x1, 0x3, 0x0, 0x0, "cae2386eda3b001bf1ac3c0b193ed9970ac8c8de1e58fb9a9e76c9c8467b71697e572a1f010e608ed067eb73ae396659958bf57c10593433190c615f782c406a"}}}}, &(0x7f0000002140)={0x0, 0x2, [0xac, 0x7ec, 0xb83, 0x3fc]}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r8, &(0x7f0000002240)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x219480}, 0xc, &(0x7f0000002200)={&(0x7f00000021c0)={0x1c, r1, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24044001) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000002380)={0xa9db, 0x0}, 0x8) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000002400)={0x2, 0x2, &(0x7f0000002280)=@raw=[@map_idx={0x18, 0x5, 0x5, 0x0, 0xe}], &(0x7f00000022c0)='syzkaller\x00', 0x401, 0xb, &(0x7f0000002300)=""/11, 0x41000, 0x32, '\x00', 0x0, @fallback=0x15, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002340)={0x2, 0x5, 0xf, 0x100}, 0x10, r9, r6, 0x0, &(0x7f00000023c0)=[r4, r4, r6, r4], 0x0, 0x10, 0x5, @void, @value}, 0x94) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f0000002580)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000002540)={&(0x7f0000002500)={0x34, r1, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x7}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x8}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x401}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x20004000) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r4, 0xc018937d, &(0x7f00000025c0)={{0x1, 0x1, 0x18, r10}, './file0\x00'}) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000002600)=0x3, 0x4) 1m13.156722063s ago: executing program 34 (id=271): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x111, 0x70bd2d, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x80000000}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x7fff}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x100}]}, 0x2c}, 0x1, 0x0, 0x0, 0x40}, 0x14) setsockopt$sock_int(r0, 0x1, 0x12, &(0x7f0000000140)=0x9, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), r0) sendmsg$TIPC_NL_MEDIA_GET(r2, &(0x7f00000003c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000380)={&(0x7f0000000200)={0x144, r3, 0x300, 0x70bd2b, 0x25dfdbfc, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x80000001}]}, @TIPC_NLA_MEDIA={0x6c, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd8b}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffa}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7fff}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_LINK={0x54, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x200}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}, @TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x62a}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xd}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}]}]}, @TIPC_NLA_MON={0x14, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x5}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xf}]}, @TIPC_NLA_MON={0x34, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0xa1}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x66138e35}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0xf6e}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x4}]}, @TIPC_NLA_PUBL={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_LOWER={0x8}, @TIPC_NLA_PUBL_TYPE={0x8, 0x1, 0x8001}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}]}]}, 0x144}, 0x1, 0x0, 0x0, 0x80}, 0x4040080) r4 = dup(r2) ioctl$SNDRV_TIMER_IOCTL_STATUS64(r4, 0x80605414, &(0x7f0000000400)) r5 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r0) sendmsg$BATADV_CMD_GET_HARDIF(r2, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x1c, r5, 0x20, 0x70bd29, 0x25dfdbfd, {}, [@BATADV_ATTR_TPMETER_TEST_TIME={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x4000000) preadv2(r4, &(0x7f0000001940)=[{&(0x7f00000005c0)=""/101, 0x65}, {&(0x7f0000000640)=""/62, 0x3e}, {&(0x7f0000000680)=""/145, 0x91}, {&(0x7f0000000740)=""/4096, 0x1000}, {&(0x7f0000001740)=""/191, 0xbf}, {&(0x7f0000001800)=""/140, 0x8c}, {&(0x7f00000018c0)=""/114, 0x72}], 0x7, 0x461, 0xffffff7f, 0xa) ioctl$sock_SIOCSIFVLAN_SET_VLAN_INGRESS_PRIORITY_CMD(r2, 0x8983, &(0x7f00000019c0)={0x2, 'macsec0\x00', {0x8}}) ioctl$F2FS_IOC_MOVE_RANGE(r2, 0xc020f509, &(0x7f0000001a00)={r0, 0x7, 0xcd, 0x5}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r6, &(0x7f0000001b40)={&(0x7f0000001a40)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f0000001b00)={&(0x7f0000001a80)={0x54, r5, 0x8, 0x70bd27, 0x25dfdbfc, {}, [@BATADV_ATTR_FRAGMENTATION_ENABLED={0x5, 0x30, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}, @BATADV_ATTR_AP_ISOLATION_ENABLED={0x5, 0x2a, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8}, @BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xe}, @BATADV_ATTR_VLANID={0x6}, @BATADV_ATTR_BONDING_ENABLED={0x5, 0x2d, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5, 0x2f, 0x1}]}, 0x54}, 0x1, 0x0, 0x0, 0x4}, 0x80) socket$netlink(0x10, 0x3, 0x7) ioctl$sock_bt_bnep_BNEPGETCONNINFO(r4, 0x800442d3, &(0x7f0000001b80)={0x3d63, 0x0, 0x44, @broadcast, 'ipvlan1\x00'}) syz_genetlink_get_family_id$tipc(&(0x7f0000001bc0), r4) sendmsg$ETHTOOL_MSG_LINKINFO_SET(r2, &(0x7f0000001cc0)={&(0x7f0000001c00)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000001c80)={&(0x7f0000001c40)={0x1c, r1, 0x400, 0x70bd2a, 0x25dfdbff, {}, [@ETHTOOL_A_LINKINFO_TP_MDIX_CTRL={0x5, 0x5, 0x7}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40) bind$inet(r6, &(0x7f0000001d00)={0x2, 0x4e20, @rand_addr=0x64010102}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000001e00)={r4, 0x58, &(0x7f0000001d80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) sendmsg$nl_route_sched(r6, &(0x7f0000002080)={&(0x7f0000001d40)={0x10, 0x0, 0x0, 0x10000044}, 0xc, &(0x7f0000002040)={&(0x7f0000001e40)=@newtfilter={0x1e8, 0x2c, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x6, 0x5}, {0xc, 0xc}, {0x2, 0xc}}, [@TCA_RATE={0x6, 0x5, {0x6, 0x7}}, @TCA_CHAIN={0x8, 0xb, 0x4}, @filter_kind_options=@f_basic={{0xa}, {0x1a8, 0x2, [@TCA_BASIC_CLASSID={0x8, 0x1, {0x831c1d96fe497e79, 0xfff1}}, @TCA_BASIC_CLASSID={0x8, 0x1, {0x2, 0x5}}, @TCA_BASIC_EMATCHES={0x194, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x8}}, @TCA_EMATCH_TREE_LIST={0xdc, 0x2, 0x0, 0x1, [@TCF_EM_META={0x48, 0x2, 0x0, 0x0, {{0x9, 0x4, 0x7}, [@TCA_EM_META_RVALUE={0x29, 0x3, [@TCF_META_TYPE_VAR='\tY', @TCF_META_TYPE_VAR="09d0e77c40728300", @TCF_META_TYPE_INT=0x2, @TCF_META_TYPE_VAR="e8f709d3", @TCF_META_TYPE_INT=0x6, @TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_VAR="17a231b3", @TCF_META_TYPE_VAR="0d989c7a27aea1"]}, @TCA_EM_META_RVALUE={0x10, 0x3, [@TCF_META_TYPE_INT, @TCF_META_TYPE_INT=0x5, @TCF_META_TYPE_VAR, @TCF_META_TYPE_INT=0x8]}]}}, @TCF_EM_NBYTE={0x14, 0x2, 0x0, 0x0, {{0x76, 0x2, 0x7}, {0x9, 0x2, 0x1, "1ed1"}}}, @TCF_EM_NBYTE={0x18, 0x3, 0x0, 0x0, {{0xff39, 0x2, 0x2}, {0xb2a3, 0x6, 0x0, "1f3bcd88f91e"}}}, @TCF_EM_CONTAINER={0x64, 0x1, 0x0, 0x0, {{0x6, 0x0, 0x2ccd}, "0bf08dc9a4ba7e1788d7e99081bf03c74a1d3e2992c6df8a18d2deddb7b17d0f21f02d239c63a15174aac6d96513499ad579f69d1bd14f4d2416e4c77dd1710824c46515d970a080de679254e916a38fc06a080105685db5"}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x3}}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x200}}, @TCA_EMATCH_TREE_LIST={0x94, 0x2, 0x0, 0x1, [@TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x9, 0x3, 0x8000}, {0x4, 0x9, 0xff3, 0x3ff}}}, @TCF_EM_CANID={0x14, 0x2, 0x0, 0x0, {{}, {{0x3, 0x1, 0x1}, {0x3}}}}, @TCF_EM_U32={0x1c, 0x3, 0x0, 0x0, {{0x6, 0x3, 0xfffa}, {0x9a6b, 0x8, 0x8, 0x2}}}, @TCF_EM_IPT={0x44, 0x1, 0x0, 0x0, {{0x247d, 0x9, 0x3}, [@TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x7}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x1}, @TCA_EM_IPT_MATCH_NAME={0xb}, @TCA_EM_IPT_NFPROTO={0x5, 0x4, 0x3}, @TCA_EM_IPT_HOOK={0x8, 0x1, 0x3}]}}]}, @TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x6}}]}]}}]}, 0x1e8}, 0x1, 0x0, 0x0, 0x10044010}, 0x41) syz_emit_ethernet(0x56, &(0x7f00000020c0)={@random="351f2d449eb3", @remote, @void, {@canfd={0xd, {{0x1, 0x0, 0x1}, 0x1, 0x3, 0x0, 0x0, "cae2386eda3b001bf1ac3c0b193ed9970ac8c8de1e58fb9a9e76c9c8467b71697e572a1f010e608ed067eb73ae396659958bf57c10593433190c615f782c406a"}}}}, &(0x7f0000002140)={0x0, 0x2, [0xac, 0x7ec, 0xb83, 0x3fc]}) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r8, &(0x7f0000002240)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x219480}, 0xc, &(0x7f0000002200)={&(0x7f00000021c0)={0x1c, r1, 0x200, 0x70bd29, 0x25dfdbfb, {}, [@ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8}]}, 0x1c}, 0x1, 0x0, 0x0, 0x10}, 0x24044001) bpf$BPF_BTF_GET_NEXT_ID(0x17, &(0x7f0000002380)={0xa9db, 0x0}, 0x8) r10 = bpf$PROG_LOAD(0x5, &(0x7f0000002400)={0x2, 0x2, &(0x7f0000002280)=@raw=[@map_idx={0x18, 0x5, 0x5, 0x0, 0xe}], &(0x7f00000022c0)='syzkaller\x00', 0x401, 0xb, &(0x7f0000002300)=""/11, 0x41000, 0x32, '\x00', 0x0, @fallback=0x15, r6, 0x8, 0x0, 0x0, 0x10, &(0x7f0000002340)={0x2, 0x5, 0xf, 0x100}, 0x10, r9, r6, 0x0, &(0x7f00000023c0)=[r4, r4, r6, r4], 0x0, 0x10, 0x5, @void, @value}, 0x94) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r4, &(0x7f0000002580)={&(0x7f00000024c0)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000002540)={&(0x7f0000002500)={0x34, r1, 0x2, 0x70bd25, 0x25dfdbfc, {}, [@ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x7}, @ETHTOOL_A_CHANNELS_RX_COUNT={0x8, 0x6, 0x8}, @ETHTOOL_A_CHANNELS_OTHER_COUNT={0x8, 0x8, 0x401}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x9}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x20004000) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r4, 0xc018937d, &(0x7f00000025c0)={{0x1, 0x1, 0x18, r10}, './file0\x00'}) setsockopt$netlink_NETLINK_NO_ENOBUFS(r2, 0x10e, 0x5, &(0x7f0000002600)=0x3, 0x4) 52.802301679s ago: executing program 4 (id=551): r0 = socket$inet_sctp(0x2, 0x5, 0x84) ioctl$sock_inet_sctp_SIOCINQ(r0, 0x541b, &(0x7f0000000000)) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(0xffffffffffffffff, 0x84, 0x71, &(0x7f0000000040)={0x0, 0x7f}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp_SCTP_PRIMARY_ADDR(r0, 0x84, 0x6, &(0x7f00000000c0)={r1, @in6={{0xa, 0x4e24, 0x2, @private1={0xfc, 0x1, '\x00', 0x1}, 0x5}}}, 0x84) ioctl$sock_SIOCGIFBR(r0, 0x8940, &(0x7f0000000180)=@generic={0x3, 0x7, 0x2}) ioctl$AUTOFS_IOC_EXPIRE(r0, 0x810c9365, &(0x7f00000001c0)={{}, 0x100, './file0\x00'}) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000300)=@assoc_value={r1, 0x81}, 0x8) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x6, 0x4010, r0, 0x6cf9e000) ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000340)={{0x1, 0x1, 0x18, r0, {0x5}}, './file0\x00'}) ioctl$RFKILL_IOCTL_NOINPUT(r2, 0x5201) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000380)=@x86={0x1, 0x8, 0x7, 0x0, 0x8000, 0xc, 0x3e, 0x4, 0x5f, 0x8, 0x6, 0x19, 0x0, 0x1, 0x2, 0x8, 0x80, 0x8, 0x5, '\x00', 0xf, 0x8}) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet6(0xa, 0xa, 0x38) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000003c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_ALLOW_IOVAS(r2, 0x3b82, &(0x7f0000000440)={0x18, r3, 0x1, 0x0, &(0x7f0000000400)=[{0x2, 0x3}]}) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(r2, 0xc018937a, &(0x7f0000000480)={{0x1, 0x1, 0x18, r0, {0x2}}, './file0\x00'}) accept4$x25(r4, &(0x7f00000004c0)={0x9, @remote}, &(0x7f0000000500)=0x12, 0x0) ioctl$KVM_CAP_HYPERV_SYNIC(r2, 0x4068aea3, &(0x7f0000000540)) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r4, 0x3ba0, &(0x7f00000005c0)={0x48, 0x2, r3, 0x0, 0x0, 0x0, 0x0, 0x1}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r2, 0x3ba0, &(0x7f0000000640)={0x48, 0xa, r5, 0x0, r3}) stat(&(0x7f00000006c0)='./file0\x00', &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0}) quotactl_fd$Q_QUOTAON(r2, 0xffffffff80000201, r6, &(0x7f0000000780)='./file0\x00') setxattr$security_evm(&(0x7f00000007c0)='./file0\x00', &(0x7f0000000800), &(0x7f0000000840)=@md5={0x1, "e67afd49c0f7751761deec29a9df22e2"}, 0x11, 0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000880)={0x2, 0x4, 0x8, 0x1, 0x80, r4, 0x3, '\x00', 0x0, 0xffffffffffffffff, 0x5, 0x2, 0x5, 0x0, @void, @value, @void, @value}, 0x50) syz_open_dev$video4linux(&(0x7f0000000900), 0x26, 0x20001) io_uring_register$IORING_REGISTER_BUFFERS(r2, 0x0, &(0x7f0000001c80)=[{&(0x7f0000000940)=""/14, 0xe}, {&(0x7f0000000980)=""/4096, 0x1000}, {&(0x7f0000001980)=""/94, 0x5e}, {&(0x7f0000001a00)=""/218, 0xda}, {&(0x7f0000001b00)=""/185, 0xb9}, {&(0x7f0000001bc0)=""/8, 0x8}, {&(0x7f0000001c00)=""/128, 0x80}], 0x7) msgget(0x2, 0x211) prctl$PR_SET_DUMPABLE(0x4, 0x1) ioctl$SG_SET_COMMAND_Q(r4, 0x2271, &(0x7f0000001d00)) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r2, 0x3ba0, &(0x7f0000001d40)={0x48, 0xa, r5, 0x0, r3}) 52.722993003s ago: executing program 4 (id=552): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) ioctl$sock_SIOCGIFVLAN_DEL_VLAN_CMD(r0, 0x8982, &(0x7f0000002800)={0x1, 'vlan0\x00'}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000000c0), r1) sendmsg$IEEE802154_ADD_IFACE(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x34, r2, 0x1b, 0x70bd26, 0x25dfdbfd, {}, [@IEEE802154_ATTR_HW_ADDR={0xc, 0x5, {0xffffffffffff0103}}, @IEEE802154_ATTR_DEV_TYPE={0x5}, @IEEE802154_ATTR_PHY_NAME={0x9, 0x1f, 'phy1\x00'}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x8000) 52.582687039s ago: executing program 4 (id=554): openat$kvm(0xffffffffffffff9c, &(0x7f00000037c0), 0x20242, 0x0) prlimit64(0x0, 0x7, &(0x7f0000000000), 0x0) ioctl$KVM_CREATE_DEVICE(0xffffffffffffffff, 0xc00caee0, &(0x7f0000003800)={0x4}) 52.578423065s ago: executing program 4 (id=556): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) mkdirat(r0, &(0x7f0000000040)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000240)='devtmpfs\x00', 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) syz_usb_connect(0x5, 0x24, &(0x7f0000002040)=ANY=[@ANYBLOB="12010000fe76181004160780a6af011703010902120001000000000904"], 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x535, 0x200) ioctl$SNDRV_CTL_IOCTL_HWDEP_INFO(r2, 0x80dc5521, &(0x7f0000000300)=""/161) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x262) 51.372638987s ago: executing program 4 (id=567): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f00000000c0)={0x10, 0x1, 0x1, "872290ee01e89bee266d8c7a6aa6995c1937025a4754aa9610c55ae1146141bb", 0x50b6be9b}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x80042, 0x0) r2 = dup(r1) read$FUSE(r2, 0x0, 0x0) ioctl$FUSE_DEV_IOC_BACKING_OPEN(r2, 0x4010e501, &(0x7f0000000040)={r0}) 51.184132055s ago: executing program 4 (id=568): r0 = request_key(&(0x7f0000000040)='asymmetric\x00', 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, r0) 51.098325992s ago: executing program 35 (id=568): r0 = request_key(&(0x7f0000000040)='asymmetric\x00', 0x0, 0x0, 0x0) add_key$keyring(&(0x7f0000000000), &(0x7f0000000080)={'syz', 0x2}, 0x0, 0x0, r0) 1.730701557s ago: executing program 7 (id=1390): r0 = socket$inet6(0xa, 0x6, 0x2000) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0xd}}, 0x14) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket(0x11, 0x800000003, 0x0) r3 = socket(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newqdisc={0x88, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xa, [0x0, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x5, 0x0, 0x2], 0x0, [0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x7fff, 0x8000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x200]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x5}, 0x0) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000100)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x54, r4}) r5 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="10000000000900c60b4f355510048600"], 0x10}, 0x0) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010001fff0100"/20, @ANYRES32=0x0, @ANYBLOB="00f9785ee90000001874000c0002ef90d1213c280b61a6a3528008000200ffffffff08000400000500f7df4508192396e364d02ce64f779bdfe8a8dcaadfe1733f1f05f623911714f0228f04e6234b17d712aff2c4c4588018349cdd1b194217f3d89208eaf1eaa7018747fb8ae3a8c577a22aecf8c5e65b7c3dd134d582e49d9fdf0d91d6a98c2fbd0c06a03b7eacae98bb5fe8d77e"], 0x40}}, 0x0) socket$inet6(0xa, 0x6, 0x2000) (async) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000040)={@dev={0xfe, 0x80, '\x00', 0xd}}, 0x14) (async) setsockopt$inet6_mreq(r0, 0x29, 0x1c, &(0x7f00000001c0)={@remote}, 0x14) (async) socket$netlink(0x10, 0x3, 0x0) (async) socket(0x11, 0x800000003, 0x0) (async) socket(0x10, 0x3, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000600)) (async) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newqdisc={0x88, 0x24, 0xf0b, 0x0, 0x0, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0x3}}, [@qdisc_kind_options=@q_mqprio={{0xb}, {0x58, 0x2, {{0xa, [0x0, 0x0, 0x0, 0x2, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x5, 0x0, 0x2], 0x0, [0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4], [0x0, 0x7fff, 0x8000, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x200]}}}}]}, 0x88}, 0x1, 0x0, 0x0, 0x5}, 0x0) (async) ioctl$sock_inet6_SIOCDIFADDR(r0, 0x8936, &(0x7f0000000100)={@private2={0xfc, 0x2, '\x00', 0x1}, 0x54, r4}) (async) socket$kcm(0x21, 0x2, 0x2) (async) sendmsg$kcm(r5, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000680)=ANY=[@ANYBLOB="10000000000900c60b4f355510048600"], 0x10}, 0x0) (async) sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="4000000010001fff0100"/20, @ANYRES32=0x0, @ANYBLOB="00f9785ee90000001874000c0002ef90d1213c280b61a6a3528008000200ffffffff08000400000500f7df4508192396e364d02ce64f779bdfe8a8dcaadfe1733f1f05f623911714f0228f04e6234b17d712aff2c4c4588018349cdd1b194217f3d89208eaf1eaa7018747fb8ae3a8c577a22aecf8c5e65b7c3dd134d582e49d9fdf0d91d6a98c2fbd0c06a03b7eacae98bb5fe8d77e"], 0x40}}, 0x0) (async) 1.730300538s ago: executing program 7 (id=1392): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x1, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_DSTOPTS(r2, 0x29, 0x3b, &(0x7f00000002c0)=ANY=[], 0x8) bind$inet6(r2, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0x0, @empty}, 0x1c) recvmmsg(r2, &(0x7f0000006940)=[{{0x0, 0x0, 0x0}, 0x1}], 0x1, 0x2b, 0x0) setsockopt$inet6_int(r2, 0x29, 0x4, &(0x7f0000000000)=0x1, 0x4) (async) sendto$inet6(r2, 0x0, 0x0, 0x0, &(0x7f0000000300)={0xa, 0x4e20, 0x0, @mcast1}, 0x1c) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x42280, 0x0) close(r1) (async) ioctl$KVM_CHECK_EXTENSION(r3, 0xae01, 0x1) (async) r4 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) r5 = syz_open_dev$evdev(&(0x7f0000000180), 0x0, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000021c0)='./file0\x00', 0x3a) mount$tmpfs(0x0, &(0x7f0000002040)='./file0\x00', &(0x7f0000002200), 0x3810819, 0x0) (async) mount$tmpfs(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0xa820a9, &(0x7f0000000580)=ANY=[@ANYBLOB="6e725f626c6f636b733d382c00ab9dcfeaa38f0255f7ae0b88264ee77c0e4f321f56ed143b1acd2fb929405359e64d445c0301800ae1ed33f125f15810d5193316e9767cfe6feff984fbf7324e9a1bb836e31250499667c7fef9"]) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x0, 0x3, 0x0, 0x3d70000000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CLEAR_DIRTY_LOG(r7, 0xc018aec0, &(0x7f0000000140)={0x0, 0xc0, 0x380, &(0x7f0000000180)=[0x8000000000000000, 0xec66, 0xff, 0x8, 0x98bd, 0x800000000000009, 0x0, 0x4, 0x10000, 0x100, 0x1004, 0x0, 0x8, 0x5, 0xf, 0x9, 0x9, 0x5, 0x2, 0x9, 0x8, 0x7, 0xc1, 0x3, 0x2, 0x2, 0x6, 0x9, 0x96, 0xffffffff, 0xffffffff00000000, 0x4, 0x4, 0x7, 0x23b, 0x3, 0x2, 0x888f, 0x4, 0x8, 0x6, 0x6, 0x3, 0x4, 0x20000000006, 0x8, 0x9, 0x400, 0x3, 0xfffffffffffffff7, 0xfffffffffffffffa, 0x2, 0xe, 0x6, 0x4, 0xe6, 0x200000000000101, 0x5, 0x9, 0x66, 0x6, 0x7, 0x5, 0x1, 0x9, 0xd, 0x6, 0xbbdc, 0x80000000, 0xfffffffffffffc00, 0x2, 0x7, 0x2, 0xcdc, 0x7, 0x2, 0x3, 0x2, 0x5, 0x2, 0x6, 0x0, 0x3403, 0xab6, 0x0, 0x4, 0x0, 0xffffffffffffff81, 0x9, 0xff, 0x6, 0x28000000, 0x5, 0x61d, 0x3, 0x7, 0xf6, 0x4, 0x6, 0x200, 0x7, 0xe53e, 0x2b, 0x8, 0x2293332f, 0x4, 0x5, 0x0, 0xd, 0x2, 0x80000001, 0x981, 0x2, 0x7, 0xdfd4, 0xfffd, 0x10, 0x5, 0x8, 0x1, 0x53e0f0fe, 0xeb4, 0x3, 0xfffffffffffffffe, 0xb692, 0xcc, 0x8, 0x3]}) (async) ioctl$EVIOCSMASK(r5, 0x40104593, &(0x7f0000000080)={0x0, 0x0, 0x0}) ioctl$EVIOCSKEYCODE_V2(r5, 0x80104592, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, "00207d2000000000201b14700c1e0ac74f000000001200000000000900"}) 1.729949128s ago: executing program 5 (id=1393): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x40046207, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f00000003c0)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x10, 0x0, &(0x7f0000000480)=[@clear_death], 0x0, 0x0, 0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a010400000000000000000200000048000480440001800c0001007061796c6f616400340002800800044000000000080005400000000008000340000000000800024000000002080006400000000308000840000000010900010073797a30000000000900020073797a3200000000140000001110010000000000000000000000000a"], 0x9c}}, 0x0) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) sync() setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) r5 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) r6 = openat$hwrng(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000040)) r7 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r7, 0x8924, &(0x7f00000000c0)={'wlan0\x00', 0x1}) preadv(r6, &(0x7f0000000a40)=[{&(0x7f00000007c0)=""/129, 0x81}, {0x0, 0x2}], 0x2, 0x0, 0x0) creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r8, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r9 = dup(r8) write$FUSE_BMAP(r9, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r9, &(0x7f00000000c0)={0x14c}, 0x137) r10 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r10, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x10}, 0xc) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r10, 0x84, 0x7b, 0x0, 0x0) bind$inet6(r10, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 1.582033501s ago: executing program 7 (id=1394): r0 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_script(r2, 0x0, 0xb) openat$incfs(r2, &(0x7f0000000080)='.pending_reads\x00', 0x24000, 0x5) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r6 = socket$inet(0x2, 0x40000000003, 0x800000800000001) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)=0x100, 0x4) (async) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x0, &(0x7f0000000000)=0x100, 0x4) getsockopt$inet_mreqsrc(r6, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000040)=0x8) r7 = syz_usb_connect(0x1, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="1a0100005c6b4408070a64006e40010203030902240001a82300000904000002ca744d00090503034d00ff99090805", @ANYRES32], &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x1, [{0x0, 0x0}]}) syz_open_dev$char_usb(0xc, 0xb4, 0x0) (async) r8 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r8, &(0x7f0000000280)=""/239, 0xef) syz_usb_disconnect(r7) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000010900010073797a3100000000c4000000030a010200000000001a0000010000000900030073797a320000000098000c00ce46fb7a46804846e02ab8501f20c9a3146f470e5cca0585693727a9364bb1c1d9cf9b8317a090949d085dceab414697bc620b7bf420019d1e7c1e360d63d1675c0db77db99bb9cacb92e60d3ea5fa440b74df9f811a309510911632344e325bae255d2e9866098d459a944ee06f74b4536a180f7a4da80b1148e08a893113b870ae90559e523a976e18f85e1603fe35dcb053850900010073797a31000000002c000000050a01020000000000000000010000000c00024000000000000000010900010073797a310000000028000000000a05000000000000000000010000080900010073797a31000000000800024000000001"], 0x160}}, 0x0) (async) sendmsg$NFT_BATCH(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000400)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01030000000000000000010000010900010073797a3100000000c4000000030a010200000000001a0000010000000900030073797a320000000098000c00ce46fb7a46804846e02ab8501f20c9a3146f470e5cca0585693727a9364bb1c1d9cf9b8317a090949d085dceab414697bc620b7bf420019d1e7c1e360d63d1675c0db77db99bb9cacb92e60d3ea5fa440b74df9f811a309510911632344e325bae255d2e9866098d459a944ee06f74b4536a180f7a4da80b1148e08a893113b870ae90559e523a976e18f85e1603fe35dcb053850900010073797a31000000002c000000050a01020000000000000000010000000c00024000000000000000010900010073797a310000000028000000000a05000000000000000000010000080900010073797a31000000000800024000000001"], 0x160}}, 0x0) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000400)=ANY=[@ANYBLOB="2c010000", @ANYRES16=r3, @ANYBLOB="010000000000000000006600000008000300", @ANYRES32=r5, @ANYBLOB="080026006c0900000800b7001e000000"], 0x2c}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) (async) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f00000000c0)=[@in6={0xa, 0x4e20, 0x0, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, &(0x7f0000000180)=0x10) socket$inet_sctp(0x2, 0x1, 0x84) (async) r10 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r10, 0x84, 0xd, &(0x7f0000000000)=@assoc_value={0x0}, &(0x7f0000000040)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(0xffffffffffffffff, 0x84, 0x85, &(0x7f0000000000)={r11, @in={{0x2, 0x0, @empty}}, 0x27c0}, 0x90) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r1, 0x84, 0x19, &(0x7f0000000580)={r11}, 0x8) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) r14 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_ABORT_SCAN(r14, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, r13, 0x2, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r15}, @val={0xc, 0x99, {0x0, 0x6d}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000010) (async) sendmsg$NL80211_CMD_ABORT_SCAN(r14, &(0x7f0000000380)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x28, r13, 0x2, 0x70bd26, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r15}, @val={0xc, 0x99, {0x0, 0x6d}}}}, ["", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x4000000}, 0x24000010) sendmsg$NL80211_CMD_FRAME(r12, &(0x7f0000000c00)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000440)={0x50, r13, 0x1, 0x0, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_FRAME={0x2a, 0x33, @action={{{}, {}, @broadcast, @device_a, @from_mac, {0x0, 0xff}}, @ext_ch_sw={0x4, 0x4, {{0x3, 0x0, 0xb6}, @val={0x76, 0x6, {0x4, 0x5, 0x19, 0x3}}}}}}, @NL80211_ATTR_CSA_C_OFFSETS_TX={0x6, 0xcd, [0x0]}]}, 0x50}, 0x1, 0x0, 0x0, 0xc0}, 0x0) bind$netrom(r0, &(0x7f0000000000)={{0x6, @rose}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @null, @netrom, @bcast, @default, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @null]}, 0x48) 1.139851624s ago: executing program 6 (id=1404): capset(&(0x7f0000000000)={0x20071026}, &(0x7f0000000280)={0x0, 0x1, 0x0, 0x0, 0x800000}) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='blkio.bfq.io_queued\x00', 0x275a, 0x0) fchmod(r0, 0x20049549e2a2d659) r1 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x0) preadv(r1, &(0x7f0000000740)=[{0x0, 0x61}, {&(0x7f0000000500)=""/97, 0x61}], 0x2, 0x0, 0x0) ioctl$DRM_IOCTL_WAIT_VBLANK(r1, 0xc018643a, &(0x7f0000000080)={0x4000000, 0x0, 0x3}) ftruncate(r0, 0x0) r2 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r2, &(0x7f0000000000), 0xc) io_uring_enter(r0, 0x35d0, 0xbce8, 0x21, &(0x7f0000000100), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x19, 0x4, &(0x7f0000000300)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000ba00000095"], &(0x7f0000000400)='syzkaller\x00', 0x8, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x10, @void, @value}, 0x94) r3 = socket$inet(0x2, 0x2, 0x0) setsockopt$inet_mreqn(r3, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) setsockopt$inet_msfilter(r3, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a0101"], 0x57) r4 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r4, &(0x7f0000000040)={0x2a, 0x1, 0x4000}, 0xc) writev(r4, &(0x7f0000000180), 0x0) ioctl$sock_qrtr_TIOCINQ(r2, 0x541b, &(0x7f0000000140)) 1.092037346s ago: executing program 5 (id=1405): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$int_in(r0, 0x5421, &(0x7f0000000240)=0x2) connect$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) shutdown(r0, 0x1) writev(r0, &(0x7f00000019c0)=[{&(0x7f0000000400)="a754b449ca", 0x5}], 0x1) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) write(r1, &(0x7f0000000340)="07000000010003", 0x7) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='nfsd\x00', 0xd, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@xino_auto}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) (async) socket$vsock_stream(0x28, 0x1, 0x0) (async) ioctl$int_in(r0, 0x5421, &(0x7f0000000240)=0x2) (async) connect$vsock_stream(r0, &(0x7f0000000000)={0x28, 0x0, 0x0, @local}, 0x10) (async) shutdown(r0, 0x1) (async) writev(r0, &(0x7f00000019c0)=[{&(0x7f0000000400)="a754b449ca", 0x5}], 0x1) (async) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) bind$bt_hci(r1, &(0x7f0000000080)={0x1f, 0xffff, 0x3}, 0x6) (async) write(r1, &(0x7f0000000340)="07000000010003", 0x7) (async) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) (async) mount(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='nfsd\x00', 0xd, 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000180)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}, {@xino_auto}]}) (async) 1.091459041s ago: executing program 6 (id=1406): r0 = syz_open_dev$vim2m(&(0x7f00000001c0), 0x0, 0x2) openat$nullb(0xffffffffffffff9c, &(0x7f0000001000), 0x169802, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mprotect(&(0x7f00000be000/0xd000)=nil, 0xd000, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = socket$inet(0x2, 0x5, 0x0) setsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000080)="441f0803000000e8c94ef56491ee54be0e1c2074ed27c1c6fe76cef3e2", 0x1d) getsockopt$inet_opts(r1, 0x0, 0x4, 0x0, &(0x7f0000000140)) dup3(r1, 0xffffffffffffffff, 0x80000) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000280)=@mmap={0x0, 0x1, 0x4, 0x100004, 0x0, {0x77359400}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "37bb54f0"}}) r2 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r3 = syz_open_procfs(0x0, &(0x7f0000000340)='net/wireless\x00') bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000180)={0xd, 0x4, &(0x7f0000001300)=ANY=[@ANYBLOB="180000000000000000e6f0000000000061199808000000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x8, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) preadv(r3, &(0x7f0000000080)=[{&(0x7f0000000140)=""/115, 0x73}], 0x1, 0x10000, 0x4000004) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000080)={'veth0_to_bridge\x00', 0x0}) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000001800)={0x6, 0x3, &(0x7f00000006c0)=ANY=[@ANYBLOB="180000000000000000001f00000000009500000000000000"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', r5, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x80) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r3, 0x89f3, &(0x7f0000000100)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6_vti0\x00', r5, 0x4, 0x8, 0xd, 0x5, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}, @loopback, 0x1, 0x80a8, 0x8f, 0x3ff}}) socket$inet6_mptcp(0xa, 0x1, 0x106) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0x10, &(0x7f0000000380)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32, @ANYBLOB="04ce67c4e0e8f5244f1555efb953e35804fe0000000000b705000008000000852f72b8f3f81d0320a5e7a8901447967df2f6260db166afeb301f88347bbddc938562084c8991933eebb5f4d5f5669715fe3cfe33592e5cc25a9e53dbcc5f316d4466c8ad2e9d748da4a5914b0b649bc7f227d1f11c47863461fd7d6f73807569e5d78c17f13739c804ca009d9cf5f8eb8fb48506ba8c69df1e1ee2b8f86c"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) sendmmsg$inet(r6, &(0x7f00000039c0)=[{{&(0x7f0000000080)={0x2, 0x4e20, @local}, 0x10, 0x0}}], 0x1, 0x2000c044) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3000000010000100"/20, @ANYRES32=0x0, @ANYBLOB="8000000002000200080004000000000008001b"], 0x30}}, 0x0) sendto$inet(r6, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$netlink(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000340)=ANY=[@ANYBLOB="2c0000002c0001000000000000000000040000800800188008ac0f"], 0x2c}], 0x1}, 0x0) 1.031382531s ago: executing program 5 (id=1408): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000040)=ANY=[@ANYBLOB="3c0000001000010400"/20, @ANYRES32=0x0, @ANYBLOB="06010200000000001400030076657468305f746f5f626f6e6400000008003a00", @ANYRES32=0x0, @ANYBLOB="121fe789017c016c43ecf8a6b544d6334b067c3b83aea37104c48c02364c17d1da2e021949fbf4416607ace74f979790ddf125f488bf15cd0af0e4569efce990e5a2e7276534553bd581457f46faf0b33a82f8bde4f87f00ead40bfcaa81306e07c9a42f553665f2d3abce308a65e2417e106ed886de9d7c23fce6fd89e59c4d500b970d0a56"], 0x3c}, 0x1, 0x0, 0x0, 0x20000810}, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) 1.029848703s ago: executing program 6 (id=1409): r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCGSERIAL(r0, 0x541e, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000040)=""/201}) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX(r1, 0x84, 0x6e, &(0x7f00000001c0)=[@in={0x2, 0x4e23, @remote}, @in6={0xa, 0x4e23, 0x8001, @mcast1, 0x1}, @in={0x2, 0x4e21, @multicast1}, @in6={0xa, 0x4e22, 0x10, @local, 0x9}, @in={0x2, 0x4e23, @remote}], 0x68) ioctl$TIOCGSOFTCAR(0xffffffffffffffff, 0x5419, &(0x7f0000000240)) writev(r1, &(0x7f0000000280), 0x0) r2 = syz_open_dev$audion(&(0x7f00000002c0), 0x7, 0x204380) ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f0000000300)={0xa, 0x0, [{0x2, 0x9, 0x3, [0x2, 0x8, 0x6, 0x5a, 0x5, 0x80000, 0x6, 0xa6]}, {0x6, 0x8, 0xfffffff8, [0x3, 0x6, 0xffff0000, 0x3ff, 0x1, 0x5, 0x8, 0x1000]}, {0x5, 0x8, 0x1, [0x67, 0x43, 0x5, 0x8, 0x3, 0x7ff, 0x101, 0xd26]}, {0x100, 0x1, 0x6, [0x9, 0x7, 0xd61e, 0x7, 0x6, 0x5b, 0x9, 0x80000000]}, {0xd, 0x0, 0x3, [0xb3, 0x0, 0x18c5, 0x3, 0x10000, 0x7, 0xff, 0xb]}, {0xf3a54e5, 0x9, 0x3, [0xb1, 0x70, 0x200, 0x9, 0x2, 0x8001, 0x3, 0x10]}, {0x100, 0xaf0, 0x80, [0x80000000, 0x9, 0x4, 0x1, 0x1, 0x9, 0x6, 0xa5]}, {0x5, 0xfffffff9, 0x1, [0x48640aff, 0x9, 0x91, 0xe, 0x0, 0xbabd, 0x2, 0x3]}, {0x1, 0xb, 0xf, [0x3, 0xac03, 0x80, 0xb78, 0x80000001, 0xffffff7d, 0xfffffff5, 0xfffffff5]}, {0x9690, 0x9, 0x9, [0x2, 0x0, 0x8000, 0x1a, 0x9, 0x2, 0x9, 0x4]}]}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r2, 0xc01064c1, &(0x7f00000004c0)={0x0, 0x1, 0xffffffffffffffff}) writev(r3, &(0x7f0000002840)=[{&(0x7f0000000500)="151f9fb24bfa3892494ccb29944b56aef3e2828d4d7200b3b03b6e5b88dd7b42d0ed077b3d2817b81c442f7ef59ec099b024a0a1e08fad495046d837f1659bd2176fdf732195706683c43af23d359ec382d779bc75879c2d3c09710845a6e739c1c71ee5aa45a1bd2ae3127df05844177c3f9bc9489d8678887831342a302080257fc7d00c55ec765d0a89f286e93a4d24f7dfc4c4", 0x95}, {&(0x7f00000005c0)="e1a2543c241f1abcff0dcbb01fded092bb7886", 0x13}, {&(0x7f0000000600)="ce459b254f98e7856f4551900ae9f736679547b2f8b636ba3a50071bd9619e530ff4c621467c3f925be8448678f898da6a84c2c6f4658ed73a9b60cd17b76a2e75cb3c118e1958f2c2f1bd7ed77f057f9876dd344e17f665c0372ea7b600ba676bdabd89bfb02cd33c6c4727e3de73368b09b42001eea244fae75486c5e35efb853d0602020ea641b8db320978a9a25905a34a", 0x93}, {&(0x7f00000006c0)="3b161bb115e2285ec2c2cd4b8f9ad769d562e583b5df17baa15235a85185e499", 0x20}, {&(0x7f0000000700)="3685cac60aa372c8db5b34f35c9c5e1914d1ae0f14eec66adc60b84405f3bf7d1d3f2086d7402c5d3f17e1135e0beb649d74a6d1e96c2aa63f36020b1ac6de08fb17d3368a2513d7c4610724099e626cfe3ae3a3da2a04e320b9cfae4d7fdf09764b0e0438dd59b3042a2f4d663fa23a3d7423e7cd24013a5f90e25b196eaa9e6b55ed529b510b1f25d9b35e1906027707743f1890f3debef8f25b07585ea2923a548857253426f3009a45496fb66e1a8016e0ef9528b3042b1b65e096a3b15f408d1050152ac14c175ba270023468f3e99f29cf73594016196fef7cfd09014011a8851dea20ebbd42fa8c31b0bc2dcc5849edecf3347958e36a2e4c23640df42ecf8009ab06f801298bd413320b0e26d171f4264ee81fb598c863b03185b4173658002c05b2ae601b0100592494a109ce641858783cdcff75aff75534f37b51e762af990e1e0bed2916b0be81a1620b450589db7b300d4c998b80eccf4f3f1f97e14d6193336f1b60605599f6eb065891ee7d432e68fedad983f1ff5abb2c199747fe156db65e4f5f566fa71f2f75be800da92a76bb6cc81f32a5647ef7d7953380fa6bad23c124591d41f3efdecee7e3ca5e724e5c9cbc3bb293fb7f29f0bf229bef428ee938a7cb4d61e22028fe99a4c70608e9ef95460edd4f07ffd96e0454b6b7e139a2ce0b532bfd09d5efccf2fe8f7f042369b8629b7748a427167d64fb00ffeea75a9f54156c2ade79f7a1793c56b25f7ce29101b5498cc2b57706f57b5736d7854a6e5cbb9acb7156723e8f4a3fd1a9ce5eb852aa4af821953bb0521fb08c761b3b0a278e0f86612a96d9ff06c7796a3b6154b33faffb49cdf4c299910fcb947fedf8e9a8ce7fdd892d6853f045f0614f5a9d4b7c18a45a8cb6682498b27454835bc63ef1ba96500a451fc98e3e19e882985d9e8561628a6dfe3770d653433450899231292657af02e164d5d01623d496b206e2de29cc8f73cfe74432f2cf9650a80fa0e66a00f93b22642e334582bc6690249737aea87b50cbc76aef9119a25af50eba1fc23c690e0251767893cf47d51760c7feaf3355677781074686e7a5384a5db8fde0c0b75a9630fd7bdbef95175a5ecb6f7b4dc0812a56e2074ca7c7893e2ea85c57ba8ef61e6aef95a426aa31c56187cbaa16c87b57b34f38cf5cbbcaba1cfb4c377ba8ddc207099c0d9c7fab9594ed92bc5ca9c5388b07ce87d0247033637e3e13c22e55dc1b940a85361a7c9ea291b20c7eb0623d459eacf072f614febab94c7d72c9ef2ec03788b00aed915f5a3cede910ca448697072b3dd827078d8587b53620e42cd00a7c755f2fbf645dd62cbca91326ff4200fbb61d78b70805ce664233c2c27a7a277832b035feff4e82e823d86a5ab4673bfc76325bf073c5df83eea755c8aac68a477799bc905dc7bd2eedc527bb60e69884f773ff7c6b963cbae53fa22234365e65d1a4f93501d407996a90dc3fe14b5553996b1e7e7f4f022a18d15d6ee980c4faaa0d5590b61f843d86ac5fb9686523bfa64d86604c00d1b5b3c9b4ebb8474ab1dfb8d38025821db77294dba3be5a2702099bfc44d94ae9aa5abd9bd5a067b2c85e80e64d06013418c7cbd677a65bd196eb415dbb64eafa5e2b7d7dd422a0cc8fdd7d9a4154cd516504459e07049f80dfe7152725289b87e84b744a3a611d859ecfa5a713895b41c436b180eed9ee699b8c41f3aead5d467ffa3b879c546795f141a77fc811a5514a7fe68d4f79e29ebf2ba704b959c68c74a3b92974a0d430c93a8f1add88d16465e55131c2c6e136609bbbcd0c19f0f8e75545742a9cc5bb689b1a48962f72781ae3b1cf16f11c7a9057a03b49de1175ed036a8a1762457a89981b28850ea3e739d8c14cae39b0eab48cc4b0b085c5daa400c3156ebbbadc9b5275945b78acc8cf64e61f1b623a4e9137c65e0cca823b1a98324c3639ef58a3def931139e38165825a87e1c00f749b9150548708b35aa9170815acc96114b673a12eb8f81c572c6094146f92cd5f0055f3a3864fb70c89d9c80ed7cca0ca81cec8494d2bbbd881aa5a81e1073ec2454259fc91747ecda80d8f9dfd5caf4827321c25b704c50eef98b78ece9d99a0641e2b39d93c6cc5f9dc7f1af7d7d391a267036949519b3027a5db3846dfb37db5c0613b7216b0e58199b06355d93d15eacbfca7a316af01cb591686c736c9dc1728513d1509bfdd8bb4ea67449901995ad418d9e3a9761fa98c66ec53e7e9d41f0bbf30c9c4bed27d6e12d89f674c3f7624d48540d7743f3c869277e7654533fd30f52f2fff1b467ad0f07085352c09f203531fc60e1d11ba6ab74722d828f43f10ffd77b063a0632f298316679dc5f2f3c76a96ff8f0f73313dd03bc232b9d0f1b4c0723790527a258fbd2dfe407786d0bd32ba5de718283a327824acd7f20fb2b8e9c86e1da467e3d7407ebf7725b583d40bedd0197b05a14bae7085309c8a6eb47e7ebf5a47ae1976094d0e8aa629e4be7df4f261183163e266f8b41cfe18013b975cbd31a19c4eeea8eee68a80d5aa01ae26417dacd28fca1bf40f4cfc6cebedb378278eb16f16f11804c1db028e021905dbe3f6ec4858a2dbf5ed2c2fd8c0554547f80124d59d52efe26513af677c80d6d1956daf530d2713f050d8ab24931d1a546dfe702a480ede521b3c10bbdaee57e821716acf4a5fde1df96fcd51f7c1717adb7156bf1f11358cd473fc18dc0d378285534bda3cf07531501787797eb8771b1cc46ab474f4533ef67c0e542267491ceae45822df0baed98f388f08be971c3f85e02333c06d7fae5d9c2f95edabe9fc66a733fc8c8b555d7fb6c1deca881d7b7806c40c7623a67b06977b04c580a00eff85cd0db75bbd027ae47bab881ef7e2f06329b5cee3d0e2c3c0c51a0585d069177bb9bb42f60cb861d2afd4fa4acbc66e2e572daa88aaf0bf03cf708dad4823c4777caafb8fdd01de5be14471b6b798a2af558a0f4952597326465549f6eadb61ac039e3351d75cdd9cef0c6e8f37f73ca3c6c9ee135d7183223757e45d984cbe5e1b25bcb17a51beb8fd8241eebfa7841f4a261df0d327ae12047b928560ab123c6bef868dd6740b72b4edd4d01ad3ce737b21bc697a6ca6140feac6c60c85925fb8321d9b73c9924abbe2647559490e9e4b0632e613022b50d8af3eef937c2057fcc9de35dfad30eddf20a4eb229960070a632610a1bdfa44a8b4a6351e1c0b887af54a465e68adc0676cb886f3d79e5200f39d7488bc43f16b4b69bbd954ca098b64e846077db9b5cf78d2ee4d3e86bbe29d938375cc30878832a906389ce0e933f97959f930215b8d3e250c2c077e0c26962005dcec8c8484c503eeabaafabae1b96d75420676713f4791e052a80c0248528cdb40bde75e729a0d1cb67875e97556940a086cbe808e224497d5c0da6fcd3216d4b53b2cc047009c46caa29d7167a2c8f9e6c153ddebc4d0d8cc58ad3612094276703c87bbd9316daaa1af417dc68848cf5acb445138a307e11b7a83038a0140fbed8e05a20596d0bb5d7bbb796e966511040d71f8a2cf70af6a6fed77161cda13c2b3202d06bc2edc6ea7edabe146549b41f2d582bd276d1d503ae1753ceee99d8454e5bc158ad402a2ddbcf675dffe4c4d18f4d2fa2ae285fb5f35ed3c4cd167f5651ae84abd23bcebb4e6bab76f28e9e0f482f16652bbc781b0a3a4f6a91c1fd400c79c5f53bec51a2c8c4c1addf2de0856d007300de4fad19b0d2370af9d3e5705c73c8b44cd61496923c6be8b499994a29097336ce5d9e324a7cd1620de3efac76f8df01cd08cbb9a37571ac9c1f3d693960e04b9b654df6c52f3fc77ec1a5259e79a3334bbbab42e04b0d5465b19d34ed877c748c0a5a2de520747b49ca641deed7ba81d00a02ddad89e2846b2bb4dac47032547859062e29a059f8b873938b32076733555d05b7dab59679da9b188ce26d51ada8c48af3c1b69cc9eb0cf07e706e56c84ed79a2e29a9aa75a8a5d67179ea19e79ff2d4bb07c08fca7c5124e7869cd82381a76021cb631b61b82b0142653fa09efa845554bbcf01ede7fcaa6db392ba50c87dae38c391d9940ef7a8881c02e0918d9b29db87e8c3fb7527a9a4b483c539ac9be4f9ba5988859f6a5bc11bb96b45e331aa0d0250563510ebe65c42918c9dd731d75c30edac69079d86f1c23fdcb1629fc943aa65eee3ace9de062181bd408a762fed92733ac69ec2f21c8ca27e1c5140d62c1304d0361229cd6baad4b11d565771e18c7c75ddbbfa412ff5e7c9eedb5d660084aa6d03e1b68f67a6d8f03c18e4f33005301a867846dfa8c910c3b440e222808b4bd63a9131aed0f89000688852df7f1bae1f1156d0b9b4c393f88746509f326e6259be85578eb6dbaa4386f345da80629ea9e62b8c920c0710c9df3e884e5f094cd4d912f4464355359b638cb16ed43f79d377279c1bc7c5df7521229d715c502750b83de74cf6d3ed5b9dd1a7c9059aff46c3d049f938f1e43663520c41d8488e1e559c0eb0bd7fa0554d71a1fcf868bdd748c3aeeb3e8b58f6a84a4f4ce18670484e2af4dd936b883508adb44282186c13be019d6f4b16a4829b90279fe0bfd98e24aa84435e804566cae275e778588efd84cfbb63e6751e1b7f6af489bc5e5dee83c1ab96c828d4f996e7a7070985f646f9232f1fc8d887248ba156dbc85f44f789582d7c6e226c440f6fec2502db98903bfc3e669c6875148c72d280b49f901968ebcafe988c8e15d881492e3ccc50e6c4ea3a2243370dfecbdff973f420cc876259cf17d4037e541f2c34301904afb6af743b7128b0b6e3442807b5309acc43ce84181a8c361ca7b408cccbaaf5fa9d095e0468b6e0fdd4eb80b662c0c61ac9c31505318fd5ca17b80ac22e1d3b53ffd670ad5125ed103f5fd1d706a8b77a9bbf456e1c9ec145b9cf25e888107360145745d37cf9965c29b2a3d78fca7aec5798d5bb3213dedbde2f3775214a3a486f1d9ef6556f07fb8b49fc9c82f9c8bec40e70a617b687f1bbe2a14250ba9a0ab6e621589d58f805965c26b0eaa17f64e9f3d30125414a95d7af01c1447e3b8a1b965c4a39f910a088a55046183817abceb255b9aa016119826ad3e4b41d31157dd5533cfae480566cf125e749b2d72964c87b79a1c91c274a17a0c32989244b530fa92977e0e4c72294f14ec4bb54eada47d1131c79c8b11f6ba70786c0dea9edaaaf3dccee103e93ee14980f2a0d5fb92250dccb34613474c8316b36d56f7ff0e54fb70138a09fa946305911275a002d02cab6f0b66b8883cc0140ab46229af1c35b5125d27e3666ec6c9744d847d418523e92da50d6f1ea0b6a6cdd1ac9b1a037d2def43408054f202b894d69c8589e0b2c5fa3c50f6d390cfbe994fbb7aff787bd6be4930f7eaa0621fe23e73ae258e1dafeec08e12d1e44107932f30d8312eb81325c3be5dd2167d691a1f457c9beb62aaf98ca4e776b7b1b47be60b705308e6dc9a01f2f7c98fd5f6da1126b2fa93f70f9f513c989fd44982cf0cfb91e2287f79b327a5040b2eb7e8c8b88ce2bd4ab3d1597aa5d28d6827126519053f526d67647bf74eedd3d923e37cc2650e812c9659dd6596c3607253742d4cb7ae414935c832002425ff044b1a56f6791f6e25aa4678b14a6f4bec57a707225c700bf914e3befa16d4eccbbc3b6713602765975db65dd6bef15fa7fa928423ac2d4dd76669759bb4ebbed7ab1cd3da3358384c53d045eca0e1fcd49f2499688cdb82f1ea88d7590e53ebd1ad40", 0x1000}, {&(0x7f0000001700)="6535f3ce5ca0aa5e8c94ddffeaa1ea7475f399ec557f882651aefb21b9033bdef652bf8a6c3562b07c3fc68ecf7dbec4cb6e74dbc700e90b5c9c158079e41871f8b03b13475702810db6f4a3fa0184b1d2205ca980e52fd295fe613f582de70249301f5891cdc7d1037efb4bcb30ac712d9b220f5671eb84ad5de26c8895e694c12a78c902059209e61381186f2450d3bcebd75f6508266bfc9372d1c70f5abf4dfbc800cfe5c4c299c77a117eb2e93b2e5068b742c586febd989a0144f3bd710a15880b45ab", 0xc6}, {&(0x7f0000001800)="caa73c35a874feff010f8b3a853fd9a83041f17b8525f9a7c073e5331dbbaffc3741ed5f8929d133678d47c4e4cff69a7560da30370e088eacaf9d5a943d11978fabe5b7f48c4e76816aa9e1b9c78ec4fa5aa773372568b6fa178319fa8df744f164a2ee8bb0d7f8f9cfec79af75e3046f427e22a51a434dab2139d60450e0dfed6cd41ac89f9271702b11d19188fa6bad181486397533d6613e0c97417442a37a3f68d3875dc03478e9327d548c25a319fb6566eb75280d19fdcc08e315d3fa650e97e86fa157e8c910546303f789d376e978f2804b02ce50e3e7ffb744bf0ad1dcf4a1d40aeca1767a42b3f78ac8cec77e63d9373fcbf879033a11bc6a598b25c0ad675ef8fcc3787ded863cf9475a01ee8ab8f70d83802b986969a01b03391b83b51ec73dd43af0f53b173342e1ae00835b435503493f5812d3c0752e3f4187cd07e153937f1388c0935b55aa11fe624ce74ccb55b3b40ddf2107b777b9ee6cf5ec2b96e453b58d6181f8b5af78b51c9c8175c8be080f444d9f32654f57dfd90e67188a32f5c63f96aa112f13a4cbb09aacfe3f8f05c7653f87b17cef148e48ad03b670adea27704d938b2067c5f09f9bf96c0f665412f4025568e00508646aa7cae324af419782f4c5cdf2ee726f10e5887c01e1990723dd58ac6584053fc819e47977311d232af964cd2e89dabd6c11342289d7541dc1ce0c0f7bc88e46ca134a9485a86c671a885aacfc4018b66e9249424df3b9263c417ff21846e05bdb195dae08cbca6f578bfd718f0b1896aced4bc579878bcf03f1c520dcf6dba82911020e2d903299a81054984774ebd7dc8811fa9ec49e949c94053eb6dbd3dca59f818fc1c954b4c49919a6479120e92f5d707250908b132973949fb464abaff70afc0b9f9af16f9c8c1184025beacc3fb33e9e2693c1a275dcf03e4e41ab34769551a08a8e0586320e2041790bb40ee8ef203bdbd863e53ef3678e1817acb6554189841de65e4de1e17b05ddc30a77a7e8ca70fd68fdecb8bbcaca1dd2cd5fdbe400511c93530a3334afe9345ff0b358dd9f1defaa087f613691a541702d54fdd5e5bc7f490ccc06f34c609ca06ca7422f793509aeb58664e7913dc2cf3a7dc5057bb9e4a4db833791a482e9a21a5645530cddf90b991a523f8ab5b64e15ea73a18e20cf6629014a45a5bdaba4c4a3278deb394df889ab9ce3211003a1ff119889ef6ff29b881612891b4238fe35d4ca3057799d454a804c2d02bac24acb3b6de47c38af24ca7c09648ac7e19513ab33524e510fe8da4981704c87b2419c719947959132a6a64962093846e960400e805ee21df53d4213665315d8b832f92004d51bb71f2f8ef146c0ec1c3d91cdc853d7b6524325f6a29a8113e05534a2e4850e0055a3f32f3c8262cdfaddc19d7df988e33fe1215bb849bbe62bd949ee38605c9310cbdad178cdf5c2b10c0661ccf0f741f422d45c00ce5c5b2c66a405d64f0d139ee54b45377b2ab5832b343f4a634e827c9a7eacff608f3e0a07efe2e27029cd840f172ec414b60cb93f910c81fba7c317f72483ead05655218639eb8eb6722171e2ba5fa434f7901e501b586da4e1cc3d63acc1c457917b3489185911ee28df604468b4a10c4a9f91c5dbe17729b9a9f5bf3af4cd6ecf8567bdbd3e3cbd35617be242818359d50994fb9e1878faab413456d13a43de6847ee21bc3ce6ad02eea3e74af207ac80fa5c69d91c287e74476c47ab43b764da5fa080e841c4d34fe356ed3595932eac05153c3f01e298c4ac27e86496a51873a01c3c88f514134b286dcde6a88ec769fc5f378e58d62880986fe82ebf106c3483dbc9b9bdb70e7a7c5edb80213ee1496139f0711bacbf1a7e1006e237fef346f4d256f9941b2f63a09e10ed89e0331079726af7a23bc00f47bd2e17968ffba55c4d296ce50a56e163436103f08ade1cb7f1c2f2e12ebe30a72b1f9840c48cc53452ee8b981e731f9ab0e23e2ff956fc1465d6a36f9e65fb05d96bde8207e096ff55e0dac55418b7d9795be93b3e13138d310b826066caa96fae736ced1e677be60c35fbb0b002e91b34cfdee74dcdf9aa80ed57910716047b8be831cb3e35ae3abca73515890dfaacf69011284d1cefa241369394741721a1f23ec77f16037b34b857d9b09b292d56dfcd8fadf8ae51ba897c7c967673f5681eab10fa0ee2dd42b59130ae5cac4437b89e762006d05950c06c9682118ec4ccc084d223bcbff42ab66e9255a1babf6f2104361eba60c140d194f4778ea313a281bf6ca6d29c193c53bc58300298531f129700906484bd5769548b39d50298d68617bd03bfe63a491e95c8c9313bd2ce8c7665d0bbee414960872ed6fc6cf59c352f8f3d908994061b54b986dfc8327f15f09aa297bdec503fe6ed5cc1fcdccfd09ddfd30c956835136bf71017d8eb1a5168d3102215f79a36278d685592ce277ee091a33fde482d34984668802ff565c0f39dd2d789d440ff9789ac3e43b6ef6c3185df961ca1565fff74d052aa789c8434c04bd9ec0d0f2f576f51aa466b61acb008d28c61f63fdc46b962437961994f699d18a68edc3aac8fad592dd0f3b07e63e22e84e130f9d1a8ad5b5561721bb9f519665268c50a66f56f75ee6567e757859adb372e01dd7c5a8a098adacc80706767fa6e3c987973e1142f598230c208415710fc98089820221242474f7ef7b20738fbe5094873398fb174884bb9e2d56fad63c302e3139f5a1c49065f0c93ac23b86f71a102077013f6f546ef0ff0ae2d872a9d3d1a3a7aabccf8b3a2601f31d48e69b1294c5af7054c25cf48801639e9a9979ce74a4988c2c0abdc742d7f0abd108afa3cf3ae04d808e5cd7b35ced19e76a4b36e882a21da5dddc5f61c304b566dc3f2aaa9d262e15fdb9bfb192710f022dfb254d219442a0820539461a0318b97559f850c762d33d7c17848f5ec828134dc4d55c999e1e1a43766277dea40908c2f4a74837230653d22737603645981743069cd9c7e613fa60a9f1bbb46b4e633938988e88b59f9f1017c8043eb2b806276dc4b7e4e0aa49070db9dbae8617f615ee156e9c805b7a424d10c1c3e7b842af5bbda33ffe2cce5532f47badbe70b8d68c48442b5a794d1aaed19028d5319c98b0b8bdd56c3c943f98d9a0f2287aebdebae5a94838f05e5a2fa4b79e636efd84d50eb726aefc0ce7d60a1160c8c9fb96586dd30aad1b798bd18d21062ae99fba1138e420e02bd5ee7ae00fb4bbf6b410e62a0bec7110f361edaa2c5edce2a2979595bdfbc3d59f277b386156a90e30045f4a9ef0941d2935db322bce081c22fd734e8b3400f739c57f06eadb6e01f540c652296c8316b8ee27b1d17ea1bc66f234ceccae371a5368fccec1388991acc4d1c76ddccd6d19150510a7d68f6bdb9bff47fc8c4d1135b347ade199254c9980904b9862bddb8fdbd41cf4d394c43ade63f124fba71b313f9864327d63495ea7c5e81e49af55242d3b8972f116081e7c596c562bf0f329d5c84b99a72f5ba1338c7a4045037d7f89d7cbd5c1763dfbfba84b7f3b5a5a1472df179422bed6febbd56995facfaa13557c91a84ec7c3a037d6769f0d004ed009f1c2466bd8567086d421695b322f9b3a5d6bdf1a9784795de4b7cdb3873de07e9c13ac1f7c15c93daa2a5b5d7c28a7ec2bf339d4f54397b9d2c3ef378cc027d70d2e0a1c69d914c29132796b71817596ad3263d7f5457c3077aee4cb7a38e4954d8974d6340888962cdf6bf2dc5d180d18ae5142479bcf97fa2ef9022f7def2e5e5b3aaaef48e13594500f6f5f8a8d4d47d70cb9b1489a5e65ecd52680c82f063e5bfb98ec9d873f85bc3857f20aed5877089a88157a8c5544afb0046da9b5ce1ef74dee3f89415704e7f50bbb800331adcc7a4c5f35730f08346f30ff5c747d43a36a6be96c53da1106d7ff96d4ac518390eb8beb01865a6978a984178dff4659e83f66cf80aa2c702aa1e9864d697edb81fb2b9d74ff314f9206c597d66f34040e5e0785836324439e0ff6a3d598002353a21f8e69aa9e4c61510a5979108df64d64029ee0d9f017a5de9c42f65bf9642e342505f983360b85636997577ff076bcf72fcea966525a839b65ec6daad23f69e841b8d6a02e3beadb2fd87b84933589f50a4077901ee2891f9d1f48a3ca507a1932c7023654742f84105699500c5422a26abbb68950a08f59683d39a646b80fdaad55439fbbfe426a7f725563da2738412429c24f6e2cb27c7d6176cecaeeb6cddd4a1b15409f0164421cf1435aef8f65af88e8c6035a90971d0c7f28589a38870f20244ac7db36028f0ac80444b5b61e4ec549b95c3287c248d93bab2adfcce9557eddfcf398d646a2dcb02321ca75291a874ea87bab8fd71a33076036ffd9cfd445818f0b7fb2d95a50b8586727c78650f68d157007d25c10b47cde8d1fae8c3bc63f18a066a6b2eeeb12f04dcbaa9a0c8b8670576764d095893281dd6c55c79ea438074b0a28371293ccec46e5db79646782144a58973857587057a0967f5eea4de83172e2c1c09c5d372fb0e86a96731bebd4c796fd8b05a1dc3ffd3ec7faa7b027e6f10f855ac39121cef3d02ce60eb5ede9bc9b5a3536cc8a528c78787a88bfe95a398d15b49bfb50a52d161961bd163b40b990ae70c3dcaa3e8b21ec3926e823472bf03fc717e53b8556a485d1639cb753c084038e0489f8207b4d504e33c9519efdfbe29c3ff29f09ca122dab18eeb03501db9dd20232efe1d0ee44b188400a5db0b01ab0d666b784a3ea6a35b940a95b901247b2602efd19ec08035371627cd78ef8a15673aea3c328755f054bbc606b98db0890493c4491dbcfb6d627817ab7bfe96e2a687bf86685dbba5d5d12076c4ae91a2eeaf83bdd1f9a87eb07ce022050bba9a191d068fe5dedfa71eddb17d85918c16e1382a93083df1c8f9c6c9f11d04cfa57225d11cca6aa25e7c941167a41849aeb37314bf3fe5dc87eaed5560c1597768a0da2412d98067d72cb0050083cc2acb2d3e4af2b05a72f4c38cf4c8fc4d924cec76d2ca692add456f4dd6173e7ab49a7f4518b723d667f2326a72c734212ee82f059fdc247b38e8467f618bfbbb0786ffdb6b159e880effaf533f3f0d4134fdffef3763ac15053f44a71161db8415737cd558f001eec616965dd9b6136c614c6cd383331dfa2165218bb1bc90a16caea3faf59dea2e55ea47429b963f46f11bb7cf95f666c50f8c15d7629f6634fc0786d7fdc2f566fab9e92de9112dc0db2647f9350a2f4e720e8e184e382282307ca560eaef61e0c7a26482ce3c84f0fcba0492682e6fc3e69290b12dcf679452d9fe054eeef28fc71b48bf158518469cbbd8f042d82d9d9d72cd620e9a054acdfcdd28e09f1b4075557b0a331c2fb0e9339101b045013603d925814941416b2642a60939d19e55aa87c071cb462736d061d4916107f526a5c7de91490e90e9c48154f8aac7a3ab03e07344150424cd175145b5e5bde6001f29d112074bd91828403aca931f16cbd997aec6db8320de8187f1cf8dae5a4a4cdc5061d216bf54a541950b558be8f3fe05a1b7a4a19c4fca2faecceb913f0c0907783345ecb3f824123ee5cdb2054a102711167c3eaa67df0a6df24f48009c0a554df3c3a212523b022937cbd3cab083a924b5e5c627ac9897b68f9c1c76b6d01c5e2b8987c93579014dc8dc86eb6a30490aa85ca9cefe77f960bd8bb64cae359ced6936da34a9e88a6a5bad14d1d61c4deead8414a5c0e4e61ae4b8c67dfae8", 0x1000}, {&(0x7f0000002800)="87b8adbbc7ca6cbb94b983f3fefd9fef726746111098677826033c41b3261cd1d9705f70e583d5e851a1edd1ad", 0x2d}], 0x8) sendmsg$NFT_MSG_GETRULE(r2, &(0x7f0000002b00)={&(0x7f00000028c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000002ac0)={&(0x7f0000002900)={0x19c, 0x7, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x1}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0xa4, 0x4, 0x0, 0x1, [{0x30, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0x2}]}}}, {0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5, 0x3, 0x2}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x4}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, {0xc, 0x1, 0x0, 0x1, @fwd={{0x8}, @void}}, {0x30, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x1000}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x80000001}]}}}]}, @NFTA_RULE_USERDATA={0x47, 0x7, 0x1, 0x0, "653ce5a797d63c894704d319a6459d4c1701690ba8aa76cb5dd4ea047c6a868faecdbfdafc98ea0f9eb5671893035dfce63157f2b7fb2cbd7418c07e3e8a437bf1c3cd"}, @NFTA_RULE_COMPAT={0x1c, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_RULE_COMPAT_PROTO_IPV6={0x8, 0x1, 0x1, 0x0, 0x2b}, @NFTA_RULE_COMPAT_PROTO_BRIDGE={0x8, 0x1, 0x1, 0x0, 0x6002}]}, @NFTA_RULE_EXPRESSIONS={0x74, 0x4, 0x0, 0x1, [{0x60, 0x1, 0x0, 0x1, @connlimit={{0xe}, @val={0x4c, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_FLAGS={0x8}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_CONNLIMIT_COUNT={0x8}, @NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0x6}]}}}, {0x10, 0x1, 0x0, 0x1, @tproxy={{0xb}, @void}}]}]}, 0x19c}, 0x1, 0x0, 0x0, 0x4040}, 0x4) ioctl$F2FS_IOC_DEFRAGMENT(r2, 0xc010f508, &(0x7f0000002b40)={0x5, 0xc}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000002b80)={'batadv0\x00'}) ioctl$VIDIOC_PREPARE_BUF(r2, 0xc058565d, &(0x7f0000002bc0)=@fd={0x101, 0xa, 0x4, 0x0, 0x6, {}, {0x1, 0x8, 0x3, 0xf, 0x7, 0x4, "5bd66ead"}, 0x9, 0x4, {}, 0xfffffe01, 0x0, r2}) r4 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000002c40)='./binderfs/custom0\x00', 0x0, 0x0) ioctl$FICLONERANGE(r4, 0x4020940d, &(0x7f0000002c80)={{r0}, 0xcc9, 0x7}) r5 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_int(r5, 0x0, 0x3, &(0x7f0000002cc0)=0x8, 0x4) ioctl$VIDIOC_S_AUDOUT(r5, 0x40345632, &(0x7f0000002d00)={0x6, "3e4e029b3ac14261cc0ad8764396a93892c7ce33d9b507b986ac2885ef227e1b", 0x1}) ioctl$BLKSECDISCARD(r2, 0x127d, &(0x7f0000002d40)=0x7ff) setsockopt$bt_BT_SNDMTU(r2, 0x112, 0xc, &(0x7f0000002d80)=0x8, 0x2) recvmsg(r5, &(0x7f0000002f40)={0x0, 0x0, &(0x7f0000002ec0)=[{&(0x7f0000002dc0)=""/212, 0xd4}], 0x1, &(0x7f0000002f00)=""/5, 0x5}, 0x10021) setsockopt$XDP_UMEM_FILL_RING(r2, 0x11b, 0x5, &(0x7f0000002f80), 0x4) ioctl$SNDRV_RAWMIDI_IOCTL_PARAMS(r2, 0xc0305710, &(0x7f0000002fc0)={0x0, 0x6, 0x101, 0x1, 0x40a}) r6 = socket$isdn(0x22, 0x3, 0x11) ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000003040)={'netpci0\x00', &(0x7f0000003000)=@ethtool_ringparam={0x11, 0x4, 0x3f1, 0xff, 0x7, 0x9, 0x2, 0x3, 0x48}}) r7 = openat$zero(0xffffffffffffff9c, &(0x7f0000003080), 0x440, 0x0) r8 = openat$cuse(0xffffffffffffff9c, &(0x7f00000030c0), 0x2, 0x0) ioctl$LOOP_SET_FD(r7, 0x4c00, r8) bpf$MAP_CREATE(0x0, &(0x7f0000003100)=@base={0xe, 0x9, 0x9, 0x4, 0x10, 0xffffffffffffffff, 0x6, '\x00', 0x0, r7, 0x2, 0x1, 0x5, 0x0, @void, @value, @void, @value}, 0x50) 971.677066ms ago: executing program 5 (id=1411): r0 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000080)={&(0x7f0000000000)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x5c, 0x5c, 0x3, [@enum={0xc, 0x5, 0x0, 0x6, 0x4, [{0x6, 0xfffffffe}, {0x4, 0x9}, {0x3, 0x8}, {0xa, 0x6}, {0x1, 0x4}]}, @var={0x4, 0x0, 0x0, 0xe, 0x2}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x1, 0x5, 0x2}}]}, {0x0, [0x2e]}}, &(0x7f0000000280)=""/127, 0x77, 0x7f, 0x0, 0xbae, 0x10000, @value}, 0x28) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xdc, @void, @value}, 0x94) r1 = socket$packet(0x11, 0x3, 0x300) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r2, 0x107, 0xf, &(0x7f0000000100)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000000c0)={'geneve1\x00', 0x0}) sendto$packet(r2, &(0x7f0000000180)="0b031200e0ff64000200475400f6a13bb1000000086086dd4803", 0x100a6, 0x0, &(0x7f0000000140)={0x11, 0x8100, r3}, 0x14) 970.950817ms ago: executing program 5 (id=1412): r0 = socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_GET_MPP(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000040}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x2c, r1, 0x300, 0x70bd29, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_MAC={0xa, 0x6, @broadcast}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4080}, 0x840) (async) r2 = openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000140), 0x200000) (async) r3 = add_key$user(&(0x7f0000000180), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000200)="725adc1eb84aa49b3abe2394c91111f54a9912f10c952b55b6dca73bae", 0x1d, 0xfffffffffffffffa) keyctl$dh_compute(0x17, &(0x7f0000000240)={0x0, r3}, &(0x7f0000000280)=""/47, 0x2f, &(0x7f00000003c0)={&(0x7f00000002c0)={'xcbc-aes-ce\x00'}, &(0x7f0000000300)="725d851b702d0feb1c04dd0535da0c855cb9d45fcb848176e6d5d635610255a3108d14d8aca7b4f6aab5c0a972a0b8aed3b02f29245a0e677b184f5b87949e0393d32583cab6067e0cd490bd23ebb033979d3048fe9cf2a44f7a32b4bef2a84c33852a9a36ba781c39f9466aa01c59a841c9693d7e7a0c674ec780aed6dce2d0f9dc928b8c8d4eb979da52d37f65159cf0d1bd16e8e3e324219abc79a62deb28f29fdbbd6e3b927dd4de20f9e9c67e86bce7b6dae591d9e6e2a31449b8d135ad", 0xc0}) (async, rerun: 64) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000400)={0x8, 0x100, 0xbf}) (async, rerun: 64) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f0000000440)={0x0, 0x0, 0xffffffffffffffff}) ioctl$DRM_IOCTL_MODE_GETFB2(r4, 0xc06864ce, &(0x7f0000000480)={0x0, 0x98b0, 0x8000, 0x9, 0x2, [0x0, 0x0, 0x0, 0x0], [0x3, 0x7, 0xfa, 0x9], [0x60, 0x69e, 0x7f, 0x2b], [0x8, 0x8, 0x7, 0x8]}) (async) socket$inet6_tcp(0xa, 0x1, 0x0) (async) r6 = socket$nl_generic(0x10, 0x3, 0x10) (async) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000540)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_FLUSH_PMKSA(r6, &(0x7f0000000600)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r1, 0x2, 0x70bd2d, 0x25dfdbfc, {{}, {@val={0x8, 0x3, r7}, @void}}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x4008040}, 0x20040011) (async) getsockopt$inet_mtu(0xffffffffffffffff, 0x0, 0xa, &(0x7f0000000640), &(0x7f0000000680)=0x4) (async) r8 = syz_genetlink_get_family_id$devlink(&(0x7f00000006c0), r6) (async, rerun: 64) r9 = openat$pfkey(0xffffffffffffff9c, &(0x7f0000000700), 0x8180, 0x0) (rerun: 64) ioctl$I2C_RETRIES(r9, 0x701, 0x2) (async) ioctl$VIDIOC_SUBDEV_S_FRAME_INTERVAL(r9, 0xc0305616, &(0x7f0000000740)={0x0, {0x7fffffff, 0xffffffff}}) (async) r10 = syz_genetlink_get_family_id$smc(&(0x7f00000007c0), r6) sendmsg$SMC_PNETID_DEL(r6, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x54, r10, 0x400, 0x70bd27, 0x25dfdbff, {}, [@SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x4}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'nicvf0\x00'}, @SMC_PNETID_IBNAME={0x9, 0x3, 'syz2\x00'}]}, 0x54}, 0x1, 0x0, 0x0, 0x440d4}, 0xc000010) (async) write$UHID_INPUT(r9, &(0x7f0000000900)={0x8, {"f488145827fafdaf59c0f09e7f00592d26c5400e8803d82791cb26b7333c5511b53047941ac1fff73fb7261aced2affb0283f33907ac5358e2a734c08d1a169c315dcc1fb91359a976e7cb151572553f77962b7b30a145068c881b34414768d7c92544a4455b665bfad6595d6d0c7d74f05eddfee4075b0e0c683a88354b9def201825a41731603f40858f2a0bf919cbc1a6fca5263f56d227218741c2360109d7c87e830a0c96076e34ca3470945c85125df23ac687d393bb05f1405e784541a35632fd544f88c1fc5e595afbedc2f4f4d04368dc59d940e9186e29ed95dcc6225869930a9ff2abc68fa17d9ba85455f19c0263c717c79e725dd6134411bc9b92077df23b41ff44f33072ee859f8eab81181002cb3d610aa6fb3e01d0bf3fa55a5e413885a6f2979ef63338b31c3bfa2ba15f119ab1e97a2255199a52e1b6de0a779db1685e47c0b11b78a210f45188c9a6a2a2fcceafa0f2e77ba27ca2bd5c11498bb17f7a1217437d3dd1cd6b46be39cc651fc19986d5c8436e7fba66d7ab097d72c47eebe952a24337ce76b36550a58b2c815a0be0649d15edf7ad149e82115939e104413527b39070f4dcf47681d509b39fa5ba90537171952de501096544d143a93fc305e176d54610a8e804fbb8173f877a7cd81843807f665524b210c95d7156ffde0ef6f4a399714056926ffe2beea0b9cc009050e88ad19188401f96562b3094a40cac450ca520272ab25888fd5047c881ef179dd95f533605f6425fc9d88b948dcef9cc5b8f645e3685a88cbf50374d35be27c1b678f4f2efcea3ddc4089a43ee1193a524465cdf83d22b99a5790527119034018bb95fac522c4510ddfec99df97e0860e285fba3d6d0e422515814b458a2a3e36a35710e237cfbef80607fe0c090c68cef5e3d516a62da2ffdb67971d143ccf9d703c5e88c5096ad71abe594b4b5574c692b0269035315183cd56a834a47c1b0cec4b23b44cb3fa619adf9fb0c158a29cacf02396275fac422d027b19bd21249b05e7b5b45d72514debc56b8dabc189ed2ab8a5f6fef74b7c502979556b036177be55ba7425f6a387daef8ad50d46ec51b1cfb65ee0e527d8890f1b86837c8b1364d04986c6b56afbafba4965043eb76f6335a40f8faea12a231b5e56ecdb7123b857cf93bfca801f5535ad640e085b76233149d4644c040df27cfb10b8d83f17b388b6e9c1f64331797b5472655846574793ffe3bfdae5e21e0ca07fe0324049ee456bae27b2a43638addbba7f0419a17a2e88d4a1da89d4e92fa31ca3bb31ba589b01f07496c51ccae1ed8b891f5e7727a14b93915193c4f14a7b44455a73ec80ca8a5275f655fa4ee55e595628b3feda0921e8203050c0c396e9282e1dece98498968110d7e7736e74e139aee7555817ed52fc1957cb040601662993f5a2e8bc9599ffef100cef0a707d8ca7e64c68870c14f1dc43473ec1c54b23da346e05a4802fc6f545224c132d0b5bd4aad9df746f5ec9d67246def4175216f69866bf65c897ef309c34884f93193f464c15aabacc5d38cabfbd3ef960c27d7d1316d4233c59ddd66db166b0fbc74beb7d390979b5fb520f4a762835f5f37363ef35dc4c7af44f57d5c7737ac7457d5f8d0809302438d408b08ea939bd81379ceb1f7120c94d85bedfb6ca6e8d6e9435ee0d862026934f133e212cad2d62f69ed9380a1d12766e67f25f73b19b1a0334cb58ac4c3af7e750c81b6b7b8a3ad873846f5755eafb59b7df2866c8c192e22486ecd2cd69bf4cbeb3d7c2eaf591f5767e74c584667627f5742ee5c26f4ca17f18bc3598e335cf2140a3da35b2a51208c2e338b3bac061b5d6b4e21e51860c8c8cd10af5c8264716a1875f4e8e36c87cf935efc73a23ac4c27c022945fa50de8708581781bcf86e68c0894a1b8e87442b7c3d4007530832f6e37882e8435cfc46964c8a3d99b4ab30e464a75cc724ab866909de9b34cb2177a4625d28f6b07a22b5e9911f08a83ee090ffa9ec92e2258c0a0b0510fc7e8ae98cfe3dee7218f4ff85142a27a9db1c1b2dda93769ae277c74f5b10ed7005535567f9a9801afc85ed5308f9e1d0626494dd46d70620b0a45850546f1b7e91faa04fe54195734a9dc8d25d985debf9d3431b411867bee469d6641457dcf5a33d373c092a4c8811b14d4f5ac66d00a0779894920203da3920bf2f54d001335bbc5873af2cf840c0b4abcc1bd41d592e09216a77878f789a42a796665a39c59372f0e14e5d43fc7e5afd2415ddd1a263cf4073bc6240a8948f38b594227020baea6f36b13152f45905a9f204ad025771cc676ad095d69b81004226f0948c390908fe55a5977712846e59246150d388d13345e593a4d24a651a008eab461a9efbb1022814f8db808647e7e7b6b7cbe3882985bc7b944a1649e9256dc747f0c48742f83199e94fea58994a57e6f66fa291fafbb7eb5809b7503b784b18cfa926c6dfc10c15f34c5df6a875d8e457b2a8be1c028ae38119a9ed194fc0e5692d3647e7ceafc12aef5001434aaec716c111e6d7204a07dc007cf1ff45cdf02bedd3e6209c90d0abb4a40d86d54af4177f80a8673e0f2b67cfa6c7f9faa1417a83d3f5acfca7d604a1be9ae3b075c23cf62d907faf6d0ffeb66253e542497d5b443321bb122fcfe2570bbf851bfc0f2256cd13cef5add90c5ca414e534dc7d405a0873cf38b68bb5ae376349ce53d54c17f1ab732073498e7ae4995302b820d4f20e4c94af480fd99f2228ec2259a52c02130c64728c73308762c4b1c32428be0bd4167f0dfe3e64d8a7138f7f72f705e1a470b7265cd8f5b17495de035335822b3bc4089f5d14144eba3172f062dc37d75265a670c1b501852f8383b380def5533032a8a801c8d2f3319eed9e64ea0c1309536214a84337c4d1c7c892a5beb487c7653c3f19f387f6fd02df534dc7d2fc50387bfee367d6cc644966d72ab90f95117a49b72450c1db1a4490cb573a9f667da638c83dc03ec386287048c5cd9f319a6bc8bbb9975c86c814a0349c10ea5ce5aaba50a431d3bd902b7fb56fcc1155b18a6b42a4d9d24d1c58c0b14fb09b998812943ab03d1b2d48790bdf35ae0f11aa639b556fd18d8af93e96781896f17756de8d076cab4f8134b161a2b67b164cbdfd7c9a23bdc524e0686da3c8d22a167da17eeadd9415ff59a756b56f07843eeaac6e0ccbf3500735e3ee0364a4090afc6e09ed3302e75eb3d431009ba9f7d5d30467ce84ba90810c766a6a6a37aad8dc59b864249612e93c1ac35a66abdbd19a4c4b94ad9293221c6b1220799c2e5718c260f32a72fd3f47387a2a6b1d71f8c22ff98713d7b334c20dbe3ebb816bb7542e7dd39aa5696bc9339350b1c168d5ad6474e88967af8ec4c9721f0fdb8eb118728b12c39598d978c7596e25c8febe4205474a2050e577cb1701c9a9874c91fe18c87a6e0ca97815165262f3ca346e8e340e3c10b4dfd9c82c2a80a272a53ca12a1309656d87efdede80e0f574db249911f1bcd74e035b41b9cd5eb2d8d2e35f8cf22974301a6939c59c4a21082c33894dd9347692424c63a376aa8bbb1e75ea5ecde2565a6e34a189e5a72339971857911e52fc0da10987a0f78ba6c7ac0be23876f442b541f346be398e9228437eef5c66b6a3886eb9fdcb9a36516c8d7f415272a86ca34307b7fb6e6656fcc7691b2062be083ec0b770ba29dd07a3f5c35d68a0ba3d145de3b746c03e1db1d59beafcd77f9b6d989b09b6d2f73bbed471280f791d2cc12b81568d5b17ddc363561654b1a4064a8b96db571ba736f7c44ef6bd032ab2f71d4ac131ee2c82b81c5e0c47d0edca30e8c3bca6e2aa9c9230b115c7fc4cfc4f7765023974ef4e42a33fa76ae6cca0c2f44f047f131df1e0d0c0ce536296eeaa0c9486c16f3d2bc32e836dcacf9703467e37c1fa77ecfabda2b4451e87897191c08ac66e83ab589acdc9d886b33cb3e3e467723801fe3d14b0edf7e5998afd4c8fd5bbe942ad07bc146a095fd299b207da215bb4620261bd3ec01f6d47434ab988c8615380093dd5ab782cb05f3e9cbdab79eaa6ffd30a6007c4d8250e95c0f09d748ba2bac487ff79c9c7c5372574ce96695922b02a76c78ab2f5a261fc15ae56d4b6cd1039a316906fbe73a327afbfe348ec68add5b40b1b7b187648db160389d2cf568287c4a7f0877ef0441702662be0577f70aaaeee70708d8a1b6b92349bb1f750f6936c0567de158ab086b3acdd3c2e745883cbdcf3bcb1337ca962399b6d175dee39e5ef9e12c6169e82e7d422d7ab888a18c478552d9c36443ea3acbf934d145c6ab72f2c31e9545a983d516b89b6f0ef251efdd76ff3ec8f19aa3ad3c346f319f772183949ffe8a271d900a7d08f8947f586d9a074f6fc8947cacc7013e7f8fe830a8df0c80df8a1bdd68d05eb6cd8fd0cc55b4b95d6f992b5980af14d02d04d220ca2785e56f7780ba261f92414822d618c330a5c013eb979dab6c1dc2893b04353b945790f5c590484846754a0500362a53196d2c1301b10caf3c69b445bce04d17c75379c7b345119d7bafa8cf833892ab96b4df01eaa822c5f49e22617be8d5b84895b6d6409b7d82bcfa468c948325240778fee8ea7dc48df2d34c98a8c36472e33091062d782f4edd076c432042431aa3e94d0ca405079041ee30899b40dd1e0d662746c230f6e8b707b3a2fbff9fde7e041f8e6a057e7b5b66ec22bdf3d68c13d7fd9d9b830db9f8ad7425a110ad742d8089d617f901be5942e92fec672b9b55d0e3fc6938c8e4803320e5fe4f941ad4235e79581134f9718cc5aef8456a69325241b8a3646997d72648504ce8a37bd8f7044ef8175573137b50d5730341ea19d13bbd4d76b81b4d71d918a951200927a65e757a0a4be0d4cc9a7215a403850a9c282206fb8ce766cb141432ed964d9404d5cab10f541b64b469c47bdbb89a482331227431f50c2c9a304d7423455e5367ffdce601f652fff86727903ec49e2af350391b6579b2c281a9c775f414162aa4c80583eee857ec09fcc46b9c9cc2132bc8415e143b7a4e47563794362fc425163ed8fd8b6440a3d67cc30c22bff64c6f6cba96d5403c5f1e4e21baeab1a5b7eefb255831a6a760ca1353093f6fa76549f1e3be466653ebd40b61d178aea0ee2f944840436394ddc50476bc99b286dde2c89412dbf64bb20cfbc4a15a2547d021810aaa3e0816d40b9589ffc40a270078f59e6605b76fe02c63e554cb70ebe159410441ba238f1c8be158f0ea0a0f05a885d88147631c3f8b8a1a52d1f9c83e57fbc15d608c2c0c36f818f663b7bdd379644d5b6b3563adb60c9caa949ee93008371cca11ed5119ff137b51a95ee9b5f46db57d3e5a3cd83a0d675dca81de0b470661fa2804b62c76d756b7c31bdb69a46c7b5aa58c640784d9800d0e382386e22db2f970ea200870a8d22069fe6859dbec8f646b0e113afa5311463146c76f4b4857385b53331f9bb6f6f51f5d94e648e528ad877083aecd1d33a55c5a1380a25695e8c5d6a8322c5d96b2ae96ac1715766689373c2a9c9167f0765c68309aed7122a9915751b29e3fa9c887d6492fcdcf2c9da7e800b45821469a9d3837b78a4f1d8777c410b2d95c404c8056c6bcc545aa3d1a9eb3b24d61dfa894f4de226411ddf9c640e499053a825fbd4b3c1a7010af25b6f863525497350199df90b4d7c86c64a0de58df0e9b7f9fec7ea8ca7bb58493822d3ad2f317bccc81b276800469d7bfb91f2ef962bc131b614f9c6a33691d6d770f7", 0x1000}}, 0x1006) (async) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(r0, &(0x7f0000001a00)={&(0x7f0000001940)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f00000019c0)={&(0x7f0000001980)={0x38, r8, 0x400, 0x70bd2b, 0x25dfdbfe, {}, [{@pci={{0x8}, {0x11}}, {0x8, 0xb, 0x4cc}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4}, 0x40) (async) syz_emit_ethernet(0x88, &(0x7f0000001a40)={@link_local, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@generic={0x888e, "80807e9dda66ff0cffa847a3d8e281af3276e444f58cac7ab3a860a349d81a96e0d53edcbafe4be3b2dc8eb2144f6411d85fda0af7c88c6c42e796b2bc2b0faf834b9e01202f184d9dbdc75052b5dab7acadd3dcddc6ef7de96f91bc0d009ba662e621c10ce8542e3e04b00d850021b70073eb70149b6c45c08a"}}}, 0x0) (async) r11 = dup(r2) r12 = mmap$IORING_OFF_SQ_RING(&(0x7f0000fff000/0x1000)=nil, 0x1000, 0x9, 0x40010, r11, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r12, 0x110, &(0x7f0000001b00)=0x7, 0x0, 0x4) (async) openat$pfkey(0xffffffffffffff9c, &(0x7f0000001b40), 0x80000, 0x0) syz_open_dev$video4linux(&(0x7f0000001b80), 0x2, 0x220a00) (async) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r11, 0xc00c642d, &(0x7f0000001bc0)={r5, 0x80000}) fsetxattr$security_capability(0xffffffffffffffff, &(0x7f0000001c00), &(0x7f0000001c80)=@v3={0x3000000, [{0xfffffff7, 0x1}, {0x2, 0x5e}]}, 0x18, 0x3) 882.337973ms ago: executing program 5 (id=1413): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x40046207, 0x0) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000000)={0x8, 0x0, &(0x7f00000003c0)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000080)={0x10, 0x0, &(0x7f0000000480)=[@clear_death], 0x0, 0x0, 0x0}) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a74000000060a010400000000000000000200000048000480440001800c0001007061796c6f616400340002800800044000000000080005400000000008000340000000000800024000000002080006400000000308000840000000010900010073797a30000000000900020073797a3200000000140000001110010000000000000000000000000a"], 0x9c}}, 0x0) r4 = socket$inet6(0xa, 0x3, 0x8000000003c) sync() setsockopt$IP6T_SO_SET_REPLACE(r4, 0x29, 0x40, &(0x7f00000014c0)=@raw={'raw\x00', 0x8, 0x3, 0x528, 0x0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x458, 0xffffffff, 0xffffffff, 0x458, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00'}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@empty, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00', {}, {}, 0x62}, 0x0, 0x358, 0x388, 0x0, {}, [@common=@inet=@hashlimit3={{0x158}, {'veth0_to_hsr\x00', {0x4, 0x8, 0x20, 0x5e1b2d47, 0xf91, 0x5, 0x4, 0x9f7, 0x18}, {0x8}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x588) r5 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r5, &(0x7f0000000140)={0xa, 0x0, 0x0, @dev, 0x7}, 0x1c) openat$hwrng(0xffffffffffffff9c, &(0x7f0000000740), 0x0, 0x0) ioctl$EVIOCGBITSND(r2, 0x80404532, &(0x7f0000000040)) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$sock_inet_SIOCSIFFLAGS(r6, 0x8924, &(0x7f00000000c0)={'wlan0\x00', 0x1}) writev(r5, &(0x7f0000000380)=[{&(0x7f0000000100)='!', 0x1}, {&(0x7f0000000780)="91b10d1375c31dd6efac1d6adfa8ae0b48b2aa58dfb3e1f7f9cd396e7f56a479de46e6e37eba7a5d980808e7dd0628e54c469a8ad5c39b0bf434bff9429c8d38b6da7f529827a8e5c400d18c6150dea18b9e70c7f8b14dc558d59bb92dde07beadaf20d885d09c48c17fb6aff59da4fdd120a26787f750f0e9705fe3fafae1a3a0df84e8fed16476938e42cd0cbb33282a74abb91782a2621614f37ac3592fb482a079b0bd008362a60976d8fca75026454390d1407392126197eae99b8633c71acd0bdacda146296a4f87b061987eadee1e7b6376a9b010b649e2d98e66cf649ed8f8d1e6e08310a588c06da0dd40209a4017a9642ca993e8", 0xf9}, {&(0x7f0000001a80)="e83f23841c3db7853bab6b14f69ce7a1bb9d74414d5027509729016fa0a5a0da998c3e08c3e11ac6f54e579dc40d30f63e7372b39b755283814ed4ab2b8f77f39e00361a5e5e751b0d05e8b9abf0ac60ff5f5c8923702845b329eb910a0a566815385449b0805bcb6b7b13b28010f3451455499d03cf26163aa0478948c7354a6d629079451ff6a0b5479c88a79ab40c84009891409a7595cb0da172fc8bf1b3f67cccc5eb0dd18283f2814d4abd72e1717825a1b47b1196b79851d8a9dc75d05408ef1dcc15cddf66719dc14101b943dde621017a0cedfde9a5aacfa2100438579251b77cf8086e0c62e4df14373ec1fb4ee40254bc5be59720af5ad4c294aeb2b2cbccecb46d2d6d869d52583f85bb7198ccc3fcc86ea147ca8960e3ef553efc8d1c6ca7fe0a05c716b96ca45348af888ae01ae81240f49f9fb74464664ea58d724b8801e9f26fbf9931a6e9c7c0ab1b66314140546af5a99ff02afb3516d4cef3976f9dfcffcb6444a4872ecb0bd1c3f8826932a325b29452c65bd9297fad3324fa1cebd8e25a002c0d0a97bf42aae2f2eb697f2c53fe1b35d835dab18d3c0d3e91499f541039b2a2fc4d8f666b9a6202c47e6f43ed84647beb4f87b93cc885eb566c8798f9cb1115315ae090ba7bf8395435b856eb917a7266d1803a4456d1159cfc80cda514a6cf69aba02f725516f81def2843f0babbd2bbb97bce641dc9bafc93232c412c82e0e22e1084b83152b083ec6e533b647e5e700db23b39809d1439ab47e4c63f06be5e18a3b0fc107224b7901860158ca72a2dce5f1f16a1de3d0d809499d040770246c0ba3c62f6f6b3b88e18d2296601d1fbc8b4b4a6a9eb3fea4d7ff8d9a6a115b4e6c7e2d6d1724234e4bfc44c97f565b4452ccfa6a45d0100464b4c6a1a00ecf08b69091fbe20a6d795913e5b64a9d4d738990fb2e1ab190c4ac8f448600303ee832687128d9c6ac8b4bac799c3629e330658e6cf80d3b64c74feca0f5900782e6c5f7aff511ecf885a3baeaf336b589f792215da28dd89b29a55aef7a0d917fa0e6c3547c85669a7dd96f66371214741663692e369d1e2bd08fdf9c674ac3c1f0577eeafd695ee5bb00e34c3f9c5d3b88b0b85540d3942ce4f023c32a2d51b20b10f6c7f1667be16b3b734e2b0e4b08d0029a7e953a3c4dc348921ce21ef8b0a41069ee011f0c240613cf07e6861265c1a834feb15a8c280a44385ff97ed9f23530839701742b702e615ee9921702b7697d61d21d25f8eafdce2c9c914adaed25898757e2f2f3e1ce9588c4009b9b83054f1b7afac306b2ed97e84ad1bfddb7ac0005abace47dc5b4c9f33eaf200f42eeab83c5be08133d965b1b993fe08072562d263b7927856207e18247ca4acc7d30795df27327518eb74321e08af607963363964bfbd1ac8f232c7a9ad12d5b14cd5bffa725407e8b34631a73015131d95d0cca12c466b96612d4ceb7e2bf0988ca6beb4b635c1ec5ae24908ffd40ef62e981bc6014d468e7886a6eeceac143ceca0eb53c2502c03ba97815d49887f4e5b2e309bfd004cc1b304787a", 0x456}], 0x3) creat(&(0x7f0000000240)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) write$P9_RVERSION(r7, &(0x7f0000000500)=ANY=[@ANYBLOB="1500000065ffff048000000800395032303030"], 0x15) r8 = dup(r7) write$FUSE_BMAP(r8, &(0x7f0000000100)={0x18}, 0x18) write$FUSE_NOTIFY_RETRIEVE(r8, &(0x7f00000000c0)={0x14c}, 0x137) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_DEFAULT_PRINFO(r9, 0x84, 0x72, &(0x7f0000000240)={0x0, 0x0, 0x10}, 0xc) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r9, 0x84, 0x7b, 0x0, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 360.451507ms ago: executing program 3 (id=1421): syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) r0 = syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x800) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f00000004c0)={0x0, 0xc2, 0x80, 0x20203843, 0x3, [0x2], [0x80ffff, 0x1, 0x400000], [0x0, 0x2, 0xfffffffe, 0x5], [0x9]}) syz_open_dev$dri(&(0x7f0000000140), 0x1, 0x0) (async) syz_open_dev$dri(&(0x7f0000000000), 0x4, 0x800) (async) ioctl$DRM_IOCTL_MODE_ADDFB2(r0, 0xc06864b8, &(0x7f00000004c0)={0x0, 0xc2, 0x80, 0x20203843, 0x3, [0x2], [0x80ffff, 0x1, 0x400000], [0x0, 0x2, 0xfffffffe, 0x5], [0x9]}) (async) 281.201523ms ago: executing program 3 (id=1422): mknod$loop(&(0x7f0000000140)='./file0\x00', 0x0, 0x1) r0 = syz_init_net_socket$ax25(0x3, 0x2, 0x0) setsockopt$ax25_int(r0, 0x101, 0x9, &(0x7f0000000040)=0x9, 0x4) mount(&(0x7f0000000100)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000000040)='./file0\x00', &(0x7f0000000080)='omfs\x00', 0x0, &(0x7f0000000340)) syz_open_dev$video(&(0x7f0000000040), 0xa7, 0x0) r1 = syz_open_dev$video4linux(&(0x7f0000000000), 0x10000, 0x440) ioctl$VIDIOC_S_PARM(r1, 0xc0cc5616, &(0x7f0000000080)={0x1, @output={0x0, 0x0, {0x3, 0x5}, 0x81, 0x5}}) syz_emit_vhci(&(0x7f00000001c0)=ANY=[@ANYBLOB="042ff108ffffffffffff0005abc8f0fe0403fdbed37cf2172f6aec502c95d4620b492c794745e07bf88d5a7503d058c2eccbd9e647bbfcf693b7e13273e36d4f6086967019f3a52d32ea8fd5e205ca9b7ff8df84d5c7b36774578d323ecfdfeb0c829fac53569f987b9a9db03abcfb61e152b4eccdd038bee6644d051c3758cb4eae73c1dee433a806cbced63bf686d83fac1cd16b9002c8e1e745855e72ade051522aa359de4650a5254165bb797611deae570633a0de97390d7ae33c4a0a23a650dc1555e5ad0c5d4f203532c1751731886af697516b49995987fa21caca5e8b4bbb8cced0b22a6a03964f633b5e57f34337ba3707a95a326ae06dd356a5d9fb7aaaaaaaaaaa100500e037960d0004c5aafb9df2db4ce31a713e07a8c87838eaee14718dc058d57204517d972f716c5e91c4dc490881003f3cf7466e16c0a861cf81d1530092ab6944c07d2b3119bd60519ee07a9e961d7f4c99719eff525795636afa660b0d039926631023fc3b8e747c512d4ceafbd60d0bde947805b062dfa37e0ac39c5e27d1930bdda2dea35b15c9d8c3edca4a214937607114fc8722f30ed0f6a5f5fd9ffb89df9978ab3acd8f2669cb7ebe5c43cfde355b970e35d633af47c296ef89b59333682fc541e13030b0fa1bde1efc113f14113b6774099908c4dd9b09c77d082744c1e57e5462ebd249905133bfe515f49be55cebeaac48ffffffffffff0e0124f200ffcbe620b1716d4d6ed270c7741a2a01efde07d1bda5dab142c4258231a16c62adc7b4e755019f20fef2c4eb05e8f88e95e5965da8f00f1712427e50a72330edcb3eef0d0f72f829c87812b8e3e0ce5023bde0fe3664cff064ff4a57def831222b5e83a02f574a3794a24eae6caadd94c93354edc867f9a6ca7290b369910ad06c570a01bdaa362ecbd60dc46b9b209e8eac813061f05e814e3dcc6749e4f9b3f3746fe7b61627927d52f6397b41ddddfe7d1efd8c7562f43f4f3a9a5643aa1117f5807a50ccdd63923fb59445bb593f2d054257823d8fe7d59bc7191e33fa25e0c3748e7eca08bb4477fab1d098000000000000012ebd4cb0050006d2cf36eac4681e92a90752b700d5a8acc6c6b4ff2f5132ab4a1072b22a7830561cc09fed0b6e9ba88182a9084b41ca992572fd27b8e6fadc172f2fc8b1ef70f2c10a9aec4dd50262e9dbe96831cb59f28d6967d020db311ccabd65954ba1560cd6d341e2967ac94b57c2e608a78b223096872eda11656f140bad169b87557f73d03e67479ec1cc26f25c6f4dd1a997db2a82c73c750c17c331830888128d3d658985e55e60c8a2d759750521c059e38c24337012cbfce9dd21815c0941bb5bb447f5001df2183eb25873eadbe34bc4721614c303ae670f24ab3754223818c76f147354ebc2208fac4232eac299e7f1a00e09e700000000000010c08e82b8a00001db941386c0c752b1d40a879a7d83b41e7d93a1c3e5ea5e454ab7a5fcd9f51be4541c869fec28ad68c76c1b681bab6e1ecf408e9ab3057cf8189033d3396d7acd49098c5ad67f392c6354dd82fb22cb0f249c7a0b6ffde31b315904e24ef92791ff3e17e7a8c88915f4818c17d29f9b67aca193acf82f458f8be281e59846e5fd14bd9b5e5ae01b9004f3fbdaf559ece5135441e98649f10c56ee842fb53fc1d3f984d488c2f0b12dc3b8d6bec137a7c772ebb4b0f60a22555a126890d05baa4982c5caf5dca1f5fba1e1ebd0c8bf4d3c063c1391540d28b3a3865694d65d574d9fb695fe93f94912541739e7d98a4bc400000000000006b8a5773853130456dd4304e199aaa64fb49bb6af435d57155163b466018f2f9faea98ed48b51d7c0c8917b31397e1dba6a5f093fdc1cf0e8266924680b891be9dc5640490433c08c2f7e2bfff318530dd42dcd1520974ea5839f5300dbd1471051eaa1a813a94763297261ae88f1a945fdcc7cb397db6a449c6821079926cecfbb9aa8ced9fd26cc29b4d3a8fa6cc31bb62676b7a279e98d8adc55c8e097d01ba97f8a1995e08d7b13e42048b5f292e723304bb27489863b06767ef293c15a06519d829ca5f1129b9e747c1f7d681e61dcdf837ec00fc5261e9172b23888e5b75d7835b0c3a4d7565877856d46c42a04e4c3686c45e1d4aaaaaaaaaa1205047bedf4080006663dfa6019bbc2088779d0d3099a473c254e4df22f3da995505a3d790f29e87bed61e97163949a4dd497c294838060b030826830360d14ed0e1bdd18ba8153822f000a7ab2d190894c4ba9c15a3390e2e59eb780ce20066dcef6c49a48338bd6db291aa35ac4f06bea4bf325761e4a19613997cdf9073d3568f1d86558fc4b63e136fdd7efbf3d81359b531d84588a6ef88721e57a1f14d0108958adc735439dfa14ca41096587bf97f85407357e6b4b0509d515a7f24c369b965940506d7cb9058113784313bac9c596d301f94b6f109ec8a1bdb89bf61f4c2e35972d99460aa449251c83eb3c8b8adb57fa92cb31eb000000000000044079a1f30100078152b6e609c450f5f0181a55272f65d19e93904e7a6587da09c8f45ad5252387cb0887903c87f1e4e361bdda5a3c3acc6560a4175b73a70b7845f9570424776e98c45863c9aab1c9666c473890a901d6ac974448e62de6207dc994425a479c5a11c5060814a7385dc424f9abc767e40e9c876e816cc3b3b7d55e7d7f6c2598f2877a7663d44f51e5c4ed0b975632a1c308f8de6fd35969f5cc0ab67924339f10f0a8a54b82067486073203722fd4be4bd2e78d529e2fa4e4628cf5057494800c7a214f62ffeed694f93931806710bc8e8428c5d87f6071d8621a8038e10ec312407d6752593cb804a71c883dfe64dd36"], 0x7f4) 231.798681ms ago: executing program 3 (id=1423): r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, &(0x7f0000000040)='cgroup.events\x00', 0x275a, 0x0) read$FUSE(r1, &(0x7f0000002c40)={0x2020}, 0x2020) (async) ioctl$sock_inet6_tcp_SIOCOUTQ(r1, 0x5411, &(0x7f0000000000)) (async) r2 = socket$kcm(0x10, 0x2, 0x4) syz_init_net_socket$netrom(0x6, 0x5, 0x0) (async) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CREATE_DEVICE(r4, 0xc00caee0, &(0x7f0000000100)={0x4, 0xffffffffffffffff}) ioctl$KVM_SET_DEVICE_ATTR(r5, 0x4018aee1, &(0x7f00000001c0)=@attr_other={0x0, 0x1, 0x1, &(0x7f0000000180)=0x6}) sendmsg$kcm(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000000ac0)="4c000000140097f87059ae08060c040002ff0f020000000000001a350182fa73a69d35a21429b17cd02941601d60ffc0cca84708f7abca1b4e7d06a60300000072f750375ed08a5604000000", 0x4c}], 0x1}, 0x0) 142.376695ms ago: executing program 3 (id=1424): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f000000d000)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020073797a31000000000900010073797a3000000000080005400000001c08000640ffffff000800034000000028300000000c0a01010000000000000000070000000900040073797a31000000000900010073797a3000000000040003"], 0x65d0}}, 0x0) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f0000000580)={'syztnl0\x00', &(0x7f0000000500)={'ip_vti0\x00', 0x0, 0x8000, 0x40, 0xc, 0xb, {{0xc, 0x4, 0x2, 0x26, 0x30, 0x64, 0x0, 0x3, 0x2f, 0x0, @dev={0xac, 0x14, 0x14, 0x42}, @loopback, {[@ssrr={0x89, 0xb, 0x73, [@loopback, @multicast2]}, @ssrr={0x89, 0x7, 0x48, [@empty]}, @noop, @ssrr={0x89, 0x7, 0x29, [@private=0xa010100]}]}}}}}) sendmsg$inet(r0, &(0x7f0000000640)={&(0x7f0000000040)={0x2, 0x4e21, @loopback}, 0x10, &(0x7f0000000480)=[{&(0x7f0000000100)="00e0b5061ba25ffa27fc591afdfef9091247066712e3f35612083c0f45ea3bfd7167e8ae1c4409f05a76312a3beb5d12dead272f4e891dd9b8d446ff9a837063a0ebf1041262349ec7ab7b9f0cd02bba82c789658b29bc5bd7e688c49451466903d6cded8f8be1b38ae42dbce9d13c1ccb1484ecce", 0x75}, {&(0x7f0000000180)="13056269a939b02c94f12c1564aa20e8b5dd0190e3318c348d370d18e92d2f56a65ebc9da88125fa0fba49702edf56f7ec82a4c655f0f652ca618cfed049dd06a4cd4e152d98e2334dda90afd90c210ec636b104ce0a", 0x56}, {&(0x7f0000000080)="baa4c2", 0x3}, {&(0x7f0000000200)="89fc3cde40e6f65780d4109312ad7e2f87cfd010a8e0156248bc7fc39d76127594910c5a20ecb557354cffbcc5f71e5974c7a44cdeb5dd65dbd79f5154f5fee8aab46536bf065f1d31bc7c5928bee24b3a8310e0122035bbe5c5c9f0b19f1fbb1583d55f8c54dedc3b51ab6e3477841860e6872b5949e1017b0804fab51fc018fd750914778268ff7820112f5844f1d2f4adec723786fd74a2efbb0709349c5fb5e73c4eea0e3632aa5a4c9b4bd73927e55d7e11b1634ebf44ee593968aac9d645c060edba34a6b20e8db6dafcd8c7cf07d34b512ea39e53d2283a971bf045baacc685dbaf", 0xe5}, {&(0x7f0000000300)="a0e8c7d45e5a75c57efe84eb68afc0bf8f125e878f6baab9c43ac798fb215adc8473f72d262dec848b6cc287788370add159a7aa34ed34fc8b8d422726e24571de567d0445614514c21e59a6f3da6dfd53acb27ce993e295461aa85d1017f14d99c430b954ece194b2611d58b5d21295afb41ec2bf6285f2cb318fa6448cd8df691fa800520a70474468c3ee4e80ebb44da45994951a35138b6bb0c543629f56015cbe0b16587eba3fface2311767c7112bf2779413c3848e4fceafbb822c2fae609d76a234d3d8db92c19668a", 0xcd}, {&(0x7f0000000400)="1058827bead5f513e0baa37dac34d3b26030e05d4bcbdf689ef13b00fa8b5f6134d5161c65259423a7ed5b0fe57fe90757a9f52727a6d1f84490f441c4802d8499b46cb4a2bfcecbd9", 0x49}], 0x6, &(0x7f00000005c0)=[@ip_tos_int={{0x14, 0x0, 0x1, 0xfffffffd}}, @ip_pktinfo={{0x1c, 0x0, 0x8, {r1, @rand_addr=0x64010102, @broadcast}}}, @ip_ttl={{0x14, 0x0, 0x2, 0x4}}, @ip_tos_u8={{0x11, 0x0, 0x1, 0x1}}], 0x68}, 0x4008085) 141.210032ms ago: executing program 6 (id=1425): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0x5, 0x2) r1 = syz_open_dev$usbfs(&(0x7f0000000000), 0x1ff, 0x402) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000140)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000000c0), &(0x7f0000000100)='%-010d \x00'}, 0x20) r3 = dup(r1) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x14, 0x21, &(0x7f0000000280)=@framed={{0x18, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xdab}, [@generic={0x6, 0x3, 0x5, 0xc, 0x8}, @ringbuf_query, @printk={@lli, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x6}}, @map_idx_val={0x18, 0x1, 0x6, 0x0, 0xc}, @func={0x85, 0x0, 0x1, 0x0, 0x4}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, 0x1}}, @ldst={0x2, 0x1, 0x4, 0x8}]}, &(0x7f00000003c0)='GPL\x00', 0x85, 0x1, &(0x7f0000000400)=""/1, 0x41100, 0x1, '\x00', 0x0, @fallback=0x37, 0xffffffffffffffff, 0x8, &(0x7f0000000440)={0x8, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x7, &(0x7f0000000480)=[0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, 0x1], &(0x7f00000004c0)=[{0x4, 0x5, 0xc, 0x2}, {0x5, 0x5, 0x3, 0x6}, {0x5, 0x3, 0xe, 0xc}, {0x0, 0x3, 0x2, 0x1}, {0x2, 0x1, 0x5, 0x8}, {0x1, 0x4, 0x9}, {0x2, 0x1, 0x10, 0xc}], 0x10, 0x3, @void, @value}, 0x94) r5 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x6, 0x0, 0xffffffffffffffff, 0x4, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000640)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000040)='kmem_cache_free\x00', r7}, 0x10) fchdir(r5) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/mnt\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) r8 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000600)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x200, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x5, 0x5, 0x0, @void, @value, @void, @value}, 0x50) r9 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000680), 0x1, 0x0) syz_open_dev$ptys(0xc, 0x3, 0x1) r10 = syz_io_uring_complete(0x0) r11 = bpf$OBJ_GET_MAP(0x7, &(0x7f0000000700)=@o_path={&(0x7f00000006c0)='./file0\x00', 0x0, 0x10, r0}, 0x18) r12 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) readv(r12, &(0x7f0000000240)=[{0x0}, {&(0x7f0000000180)=""/172, 0xac}], 0x2) r13 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000740)={0x1b, 0x0, 0x0, 0x289, 0x0, 0xffffffffffffffff, 0x2, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x1, 0x4, 0x0, @void, @value, @void, @value}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1d, 0x9, &(0x7f0000000180)=@framed={{0x18, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3}, [@initr0={0x18, 0x0, 0x0, 0x0, 0x7fff, 0x0, 0x0, 0x0, 0xfffff801}, @generic={0x4, 0x6, 0xc, 0x6192, 0x3}, @map_fd={0x18, 0xa, 0x1, 0x0, r2}, @alu={0x4, 0x1, 0x0, 0x8, 0xe, 0x4}]}, &(0x7f0000000200)='syzkaller\x00', 0x3, 0x0, 0x0, 0x40f00, 0x19, '\x00', 0x0, @lsm=0x2b, r3, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000240)={0x5, 0xc, 0x3, 0x8f21}, 0x10, 0x0, r4, 0x3, &(0x7f00000007c0)=[r8, r9, r10, r11, r12, r13], &(0x7f0000000800)=[{0x5, 0x1, 0x10, 0x7}, {0x3, 0x3, 0x101, 0xf}, {0x4, 0x1, 0x9, 0x6}], 0x10, 0x3, @void, @value}, 0x94) r14 = dup(r1) ioctl$USBDEVFS_CONTROL(r14, 0xc0185500, &(0x7f0000000040)={0x23, 0x1, 0x13, 0x1, 0x0, 0x0, 0x0}) ioctl$vim2m_VIDIOC_REQBUFS(r0, 0xc0145608, &(0x7f0000000040)={0x8, 0x1, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r0, 0x40045612, &(0x7f0000000000)=0x1) 141.089881ms ago: executing program 7 (id=1426): r0 = bpf$MAP_CREATE(0x1900000000000000, &(0x7f0000000040)=@base={0x1b, 0x0, 0x0, 0x2000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) mmap(&(0x7f0000ffc000/0x1000)=nil, 0x1000, 0x1e, 0x13, r0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(0xffffffffffffffff, 0xc01864c6, &(0x7f0000000100)={&(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0], 0x5, 0x80000, 0x0, 0xffffffffffffffff}) setsockopt$sock_int(r1, 0x1, 0x7, &(0x7f0000000140)=0x9, 0x4) r2 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x2000003, 0x12, r2, 0x80000000) 140.915601ms ago: executing program 3 (id=1427): r0 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) (async) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(0xffffffffffffffff, 0x4020565b, &(0x7f0000000080)={0x8000006, 0x8}) (async) r1 = syz_open_procfs(0x0, &(0x7f00000001c0)='net/sockstat\x00') read$FUSE(r1, &(0x7f0000000640)={0x2020}, 0x2020) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000280)='cpuacct.stat\x00', 0x275a, 0x0) symlinkat(&(0x7f0000000180)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0xffffffffffffff9c, 0x0) (async) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) (async) splice(r2, &(0x7f0000000000)=0xfffffffffffffc00, r0, &(0x7f0000000040)=0x3243, 0x7fffffffffffffff, 0x9) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x3, 0x4, &(0x7f00000003c0)=ANY=[@ANYBLOB="b4050000000000006110b0000000000063510800000000009500090000000000827573595f16aaba19dee4850fad9dc34ae0ec78734eb5ff8c80d4457498c5a7b0c59abd315c61996d140187d64787b68c0a1b3e361a405ed57dc367c33abfd46e35"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x85, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x52) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 82.109234ms ago: executing program 6 (id=1428): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r1, &(0x7f0000009780)={0x2020}, 0x2020) ppoll(&(0x7f00000000c0)=[{r1, 0xa200}], 0x1, &(0x7f0000000100), 0x0, 0x0) bind$inet(r0, &(0x7f0000000200)={0x2, 0x4e20, @remote}, 0xfeb2) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4e20, @empty}, 0x10) r2 = openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) recvmsg$unix(r2, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000080)=""/142, 0x8e}, {&(0x7f0000001740)=""/4096, 0x1000}, {&(0x7f0000000140)=""/185, 0xb9}, {&(0x7f0000000380)=""/127, 0x7f}], 0x4, &(0x7f00000005c0)=[@rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x20, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x18, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff]}}, @cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}], 0xe0}, 0x2000) recvmsg(r0, &(0x7f0000000580)={0x0, 0x7, &(0x7f0000000500)=[{&(0x7f0000000740)=""/4096, 0xa15b0}], 0x1}, 0x700) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1e00"/19, @ANYRES32=0x1, @ANYBLOB='\x00'/12, @ANYRES32], 0x48) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r4, &(0x7f00000002c0), 0x40000000000009f, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r5, 0x0, 0x80, &(0x7f00000000c0)=@broute={'broute\x00', 0x20, 0x1, 0x220, [0x1000000, 0x0, 0x0, 0x0, 0x0, 0x20000500], 0x7, 0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="00000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000000000000000000000000000000000000000000000000000000000000000875bf98d000000000000feffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff01000000110000000000000000006e2a30456b880000145b41fe6900000079616d3000000000000000000000000079616d3000000000000000000000000076657468315f742f5f626f6e640000001180c20000000000000000000180c200000000faffffffffffffff0000006701000090010000737461746973746963000000000000000000000000000000000000000000000018000000000000000000000000000000000000000000000000000000000000008dadb8e3646e617400000000ff0300000000000000000000000000000000000010000100000000000000ff000000006e666c010000000000000000000000000000000000000000000000000000ff0050000000121b6eb244d4f0fffbf04a000000007e4b000022d4e27ebdf3b9dc569e338e2c551c2fc4a19597ba4c501c8b1f16fb7809c40aee86f4fe16383d2afb577ed2bb6dd99f024b3f54ba00000000415544495400000000000000000000000000000000000000000000000000000008000000000000200000000000000000000200"/544]}, 0x298) r6 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) setsockopt$netrom_NETROM_T1(r6, 0x103, 0x1, &(0x7f0000000840)=0x3, 0x4) close_range(r4, r5, 0x2) ioctl$SIOCSIFHWADDR(r3, 0x89f1, &(0x7f0000000900)={'macvlan1\x00', @random="0600002000"}) shmget$private(0x0, 0x3000, 0x16001b20, &(0x7f0000ffd000/0x3000)=nil) recvfrom$inet(r0, &(0x7f0000000280)=""/235, 0xeb, 0x120, 0x0, 0x0) 81.846728ms ago: executing program 7 (id=1429): mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f0000000c00)=ANY=[@ANYBLOB="56c78e3c733d76697274696f2c6e6f657874656e642c6163638173733d616e792c63616368653d667363616368652c76657273696f6e3d3970323030302e75"]) chdir(&(0x7f0000000100)='./file0\x00') r0 = pidfd_getfd(0xffffffffffffffff, 0xffffffffffffffff, 0x0) setsockopt$ax25_int(r0, 0x101, 0x5, &(0x7f00000000c0), 0x4) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x62881, 0x19d) write$uinput_user_dev(r1, &(0x7f0000000880)={'syz0\x00', {0x2, 0x4b99, 0x4, 0x1}, 0x1e, [0x5, 0x4379, 0x8, 0x4, 0x2, 0x5, 0x2, 0x9, 0x5, 0x7, 0x7, 0xba7, 0x8, 0x9, 0x5, 0x3, 0x2b9d, 0x9, 0xaf7, 0x1, 0x3c, 0x1, 0x5, 0x907, 0x4, 0x80, 0x8, 0xfffffff7, 0x0, 0x0, 0xb, 0x370, 0x5, 0x778ac212, 0x1, 0x10001, 0x1000, 0x401, 0xfffffffd, 0x19, 0x10000, 0x9, 0xe, 0x7, 0x9, 0x5, 0x4, 0x8c02, 0x3, 0x9, 0x7, 0x4, 0x10000, 0x5, 0x100, 0x48d4, 0xfffffffc, 0xfffffffa, 0x40, 0xc4a1, 0x5, 0x10000000, 0x6, 0x8], [0xa, 0x6, 0x8001, 0xfff, 0x3ff, 0xfffffffd, 0x3, 0x7fff, 0x2b, 0xc, 0x5, 0x40000000, 0xffffffff, 0x809508, 0x0, 0x5, 0xd, 0x1, 0x6, 0x1, 0x10001, 0x3ff, 0xffffffff, 0x7, 0x2df4, 0x4, 0xffffff7f, 0x2, 0x1ff, 0x6, 0xb, 0x9, 0x4, 0x1, 0xfffffffb, 0x6, 0x4, 0x7fffffff, 0x8, 0xf, 0x1, 0xc, 0x9, 0x80000000, 0x14c0eb9d, 0x1, 0x7, 0x1, 0x10, 0x7f, 0xab3, 0x6, 0x12, 0xa, 0xa, 0x4, 0x524dda75, 0x800000e, 0x5, 0x3, 0x6ece, 0x3ff, 0xe773], [0xde3, 0x5dd4, 0x6, 0x4, 0x3, 0x5, 0x0, 0x2, 0xfffffffa, 0x1, 0x7ff, 0x403, 0xfffffffc, 0x8, 0x7, 0xe74617a, 0x2, 0x4, 0x4, 0x6, 0x80000000, 0x19000000, 0x8, 0x1fc, 0x6, 0xf, 0x0, 0xfffffffc, 0x40002e6, 0x1, 0x8, 0x4000004, 0x9, 0x0, 0x4, 0x0, 0x3, 0x3, 0x0, 0x7, 0x1000, 0x4, 0x3, 0x7bb14aae, 0x1, 0x1000, 0xffffffff, 0x3, 0x3, 0xb, 0x5, 0x0, 0x0, 0x3, 0x3ff, 0x7, 0xfffff801, 0x8, 0x3, 0x1, 0x2, 0xfffffffe, 0x20000004, 0x1], [0x7f, 0x401, 0x101, 0x1b4, 0x4, 0x0, 0x200007, 0x1000, 0x4, 0x1645, 0x2, 0xffffff80, 0x7, 0x0, 0x4, 0x0, 0x7, 0x9, 0x6, 0x1000, 0x8, 0x10000, 0xfffffdd2, 0x2a8, 0x470, 0x8d1, 0x5, 0x8, 0x10, 0x0, 0x5, 0xa, 0xa, 0x6, 0x4e1bbb9d, 0x6, 0x1, 0x90a, 0x7ffffffc, 0xfffffffd, 0x10, 0x8, 0x3, 0x4, 0x5, 0x2, 0xb, 0xe, 0x4, 0x2, 0x6, 0x1, 0xfe, 0x2, 0x2, 0xc, 0x4, 0x6, 0xbf09, 0x9, 0x6, 0x1, 0x5, 0xa3]}, 0x45c) utimes(&(0x7f0000000040)='./file0\x00', 0x0) write$P9_RREADLINK(r1, &(0x7f0000000080)={0xa, 0x17, 0x1, {0x1, '.'}}, 0xa) openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) 81.642723ms ago: executing program 3 (id=1430): openat$autofs(0xffffffffffffff9c, &(0x7f0000000000), 0x107003, 0x0) (async) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000f5dfe4)={0xa, 0x4e20, 0xfffffffe}, 0x1c) (async) sendto$inet6(r0, 0x0, 0x0, 0x4098884, &(0x7f0000000240)={0xa, 0x4e20, 0x0, @mcast2}, 0x1c) (async) recvfrom(r0, 0x0, 0x0, 0x0, 0x0, 0x0) (async) sendto$inet6(r0, &(0x7f0000000040)='2', 0x1, 0x0, 0x0, 0x0) 1.805008ms ago: executing program 6 (id=1431): socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(0xffffffffffffffff, 0x8982, &(0x7f0000000000)={0x8, 'macsec0\x00', {'netpci0\x00'}}) r0 = socket$inet(0x2, 0x3, 0x30) (async) symlink(&(0x7f0000000040)='.\x00', &(0x7f0000000100)='./file0\x00') (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file0\x00', 0x50) (async) mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) r1 = openat$dir(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x0, 0x0) mknodat$loop(r1, &(0x7f0000000340)='./file1\x00', 0x0, 0x0) chdir(&(0x7f0000000140)='./bus\x00') (async) rename(&(0x7f0000000800)='./file0\x00', &(0x7f0000000840)='./file1\x00') (async) getsockopt$inet_mreqsrc(r0, 0x0, 0x53, &(0x7f0000000000)={@dev, @local, @broadcast}, &(0x7f0000000080)=0x2c) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48) (async) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.throttle.io_serviced_recursive\x00', 0x275a, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f00000102c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=@newlink={0x3c, 0x10, 0x401, 0xfffffffc, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_STP_STATE={0x8}]}}}]}, 0x3c}}, 0x0) r4 = socket$caif_seqpacket(0x25, 0x5, 0x0) setsockopt$CAIFSO_LINK_SELECT(r4, 0x116, 0x7f, &(0x7f00000000c0)=0x3, 0x4) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="083b0000050000000000000000000000f03dce0d32d0d3f7c80834f5c2c70fc36aaca68f93d18a8907839a528ee5e408d117b40c8022775c23db0675e47b2d919637"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sched_cls, r2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) (async) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) close(r6) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000029c0)) (async) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0xe}}) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r7) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r8) 0s ago: executing program 7 (id=1432): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0xfffffe98, &(0x7f00000000c0)={&(0x7f0000000000)=ANY=[@ANYBLOB="8400000000010104000000000000000002000000240001801400018008000100ac1414bb08000200ac0314bb0c0002800500010000000000240002801400018008000100ac1414aa08000200ac1414000c0002800500010000000000080007400000000010001700000000000000000000000000100016"], 0x84}}, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000001200)=[@text64={0x40, &(0x7f0000000200)="f7790066baa00066b86b4266ef66ba420066b8e20066ef0f29902cbb0000c4e2b1ba8c88d9000000666666440f38826b410f7842280f07b8010000000f01d9c4033921820f47a753fd", 0x49}], 0x1, 0x0, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f000049c000/0x18000)=nil, &(0x7f0000000400)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000280)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000280)={'wlan0\x00'}) sendmsg$NL80211_CMD_SET_PMKSA(r5, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRESHEX=r3, @ANYBLOB="e15200000000000000006f0f000008000300", @ANYRESHEX=r2], 0x44}}, 0x0) listen(r4, 0x0) io_setup(0x2007, &(0x7f0000000200)=0x0) r7 = eventfd2(0x0, 0x0) timer_settime(0x0, 0x0, &(0x7f0000000300)={{}, {0x77359400}}, 0x0) (async) timer_settime(0x0, 0x0, &(0x7f0000000300)={{}, {0x77359400}}, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r8, 0x29, 0x36, &(0x7f00000000c0)=ANY=[], 0x8) connect$inet6(r8, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) (async) connect$inet6(r8, &(0x7f0000000100)={0xa, 0x0, 0x0, @mcast2, 0x5}, 0x1c) setsockopt$SO_BINDTODEVICE(r8, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendmmsg$inet6(r8, &(0x7f0000000000)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000000040)="82", 0x1}, {&(0x7f00000000c0)="0000ffffff", 0x5}], 0x2}}], 0x1, 0x8080) sendto$inet6(r8, &(0x7f0000000300), 0x16, 0x3b00, 0x0, 0xfffffffffffffdfd) io_submit(r6, 0x2, &(0x7f0000000280)=[&(0x7f0000000000)={0x1802, 0x0, 0x0, 0x5, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x1, r7}, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0}]) io_pgetevents(r6, 0x1, 0x1, &(0x7f0000000040)=[{}], 0x0, 0x0) (async) io_pgetevents(r6, 0x1, 0x1, &(0x7f0000000040)=[{}], 0x0, 0x0) shutdown(r4, 0x0) (async) shutdown(r4, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r3, 0x4008ae93, &(0x7f00000003c0)=0x2000) ioctl$F2FS_IOC_FLUSH_DEVICE(r3, 0x4008f50a, &(0x7f00000001c0)={0x3, 0x6}) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}) (async) ioctl$KVM_SET_VCPU_EVENTS(r3, 0x4400ae8f, &(0x7f0000000140)=@x86={0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}) ioctl$KVM_RUN(r3, 0xae80, 0x0) 0s ago: executing program 7 (id=1433): r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x101882, 0x0) r1 = socket(0x10, 0x3, 0x0) sendto$inet6(r1, &(0x7f0000000080)="7800000018002507b9409b14ffff00000202be04020506056403040c5c0009003f0020010a0000000d0085a168216b46d32345653600648d040012000a00050049935ade4a460c89b6ec0cff3959547f509058ba86c902007a00004a32000402160008000a0024a40423e000e218d1ddf66ed538f2523250", 0x78, 0x0, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000000c0)='./bus\x00') r2 = openat(0xffffffffffffff9c, &(0x7f0000000240)='.\x00', 0x0, 0x0) ioctl$FS_IOC_FSSETXATTR(r2, 0x401c5820, &(0x7f00000002c0)={0x71e5b316, 0xfffffffc}) write$cgroup_int(r0, &(0x7f0000000040)=0x900, 0x12) kernel console output (not intermixed with test programs): 1737335311.355:510): avc: denied { ioctl } for pid=7524 comm="syz.4.349" path="/dev/autofs" dev="devtmpfs" ino=104 ioctlcmd=0x9376 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1 [ 70.497687][ T39] audit: type=1400 audit(1737335311.365:511): avc: denied { map } for pid=7527 comm="syz.3.350" path="socket:[19307]" dev="sockfs" ino=19307 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 70.506600][ T39] audit: type=1400 audit(1737335311.365:512): avc: denied { accept } for pid=7527 comm="syz.3.350" path="socket:[19307]" dev="sockfs" ino=19307 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 70.539935][ T6068] usb 11-1: new high-speed USB device number 9 using dummy_hcd [ 70.560476][ T6068] usb 11-1: device descriptor read/8, error -71 [ 70.567498][ T7530] syz.3.351: attempt to access beyond end of device [ 70.567498][ T7530] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 70.571891][ T7530] XFS (nbd3): SB validate failed with error -5. [ 70.645897][ T39] audit: type=1400 audit(1737335311.535:513): avc: denied { write } for pid=7536 comm="syz.3.352" name="vlan0" dev="proc" ino=4026533671 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:proc_net_t tclass=file permissive=1 [ 70.650558][ T5974] usb 10-1: too many configurations: 9, using maximum allowed: 8 [ 70.659113][ T5974] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 70.661955][ T5974] usb 10-1: can't read configurations, error -61 [ 70.663918][ T5974] usb usb10-port1: attempt power cycle [ 70.682264][ T6068] usb usb11-port1: unable to enumerate USB device [ 70.717847][ T7538] @: renamed from vlan0 (while UP) [ 70.723866][ T39] audit: type=1400 audit(1737335311.615:514): avc: denied { listen } for pid=7536 comm="syz.3.352" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 70.835604][ T39] audit: type=1400 audit(1737335311.725:515): avc: denied { read } for pid=7541 comm="syz.3.353" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 70.908241][ T7546] xt_socket: unknown flags 0xc [ 70.937467][ T7549] tipc: Started in network mode [ 70.939066][ T7549] tipc: Node identity ac14140f, cluster identity 4711 [ 70.942441][ T7549] tipc: New replicast peer: 255.255.255.255 [ 70.944552][ T7549] tipc: Enabled bearer , priority 10 [ 71.009871][ T5974] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 71.030701][ T5974] usb 10-1: too many configurations: 9, using maximum allowed: 8 [ 71.041276][ T5974] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 71.043586][ T5974] usb 10-1: can't read configurations, error -61 [ 71.125339][ T1416] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.127303][ T1416] ieee802154 phy1 wpan1: encryption failed: -22 [ 71.130594][ T5941] Bluetooth: hci0: command 0x0419 tx timeout [ 71.130620][ T65] Bluetooth: hci1: command 0x0419 tx timeout [ 71.189807][ T5974] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 71.211575][ T5974] usb 10-1: too many configurations: 9, using maximum allowed: 8 [ 71.215809][ T5974] usb 10-1: unable to read config index 0 descriptor/start: -61 [ 71.218827][ T5974] usb 10-1: can't read configurations, error -61 [ 71.221693][ T5974] usb usb10-port1: unable to enumerate USB device [ 71.244117][ T7574] netlink: 'syz.3.362': attribute type 4 has an invalid length. [ 71.248375][ T7573] netlink: 'syz.3.362': attribute type 4 has an invalid length. [ 71.586697][ T7593] syz.3.366: attempt to access beyond end of device [ 71.586697][ T7593] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 71.590913][ T7593] XFS (nbd3): SB validate failed with error -5. [ 71.681336][ T7603] fuse: Unknown parameter 'rootm000Lµ‚Bl‡´šï¯Þeá0' [ 71.683586][ T7603] fuse: Unknown parameter 'rootm000Lµ‚Bl‡´šï¯Þeá0' [ 71.773788][ T7618] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 71.780878][ T7618] netlink: 12 bytes leftover after parsing attributes in process `syz.4.373'. [ 71.982734][ T63] usb 8-1: new high-speed USB device number 6 using dummy_hcd [ 72.003729][ T7627] syz.6.376: attempt to access beyond end of device [ 72.003729][ T7627] nbd6: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 72.007442][ T7627] XFS (nbd6): SB validate failed with error -5. [ 72.061499][ T6071] tipc: Node number set to 2886997007 [ 72.129846][ T63] usb 8-1: Using ep0 maxpacket: 16 [ 72.134601][ T63] usb 8-1: config 0 interface 0 altsetting 44 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 72.139161][ T63] usb 8-1: config 0 interface 0 altsetting 44 has 1 endpoint descriptor, different from the interface descriptor's value: 17 [ 72.145607][ T63] usb 8-1: config 0 interface 0 has no altsetting 0 [ 72.152567][ T63] usb 8-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 72.156385][ T63] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 72.159698][ T63] usb 8-1: Product: syz [ 72.161600][ T63] usb 8-1: Manufacturer: syz [ 72.163605][ T63] usb 8-1: SerialNumber: syz [ 72.168373][ T63] usb 8-1: config 0 descriptor?? [ 72.177256][ T63] input: syz syz as /devices/platform/dummy_hcd.3/usb8/8-1/8-1:0.0/input/input10 [ 72.381241][ T7648] mkiss: ax0: crc mode is auto. [ 72.447283][ T63] usb 8-1: USB disconnect, device number 6 [ 72.809888][ T6067] usb 11-1: new high-speed USB device number 10 using dummy_hcd [ 72.846311][ T7659] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 72.849157][ T7659] cramfs: wrong magic [ 72.853142][ T7659] SELinux: unrecognized netlink message: protocol=4 nlmsg_type=16 sclass=netlink_tcpdiag_socket pid=7659 comm=syz.4.383 [ 72.912731][ T7661] ieee802154 phy0 wpan0: encryption failed: -22 [ 72.962082][ T6067] usb 11-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 72.964606][ T6067] usb 11-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 72.967450][ T6067] usb 11-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 72.975313][ T6067] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 84, changing to 10 [ 72.979205][ T6067] usb 11-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 50922, setting to 1024 [ 72.991532][ T6067] usb 11-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 72.995147][ T6067] usb 11-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 72.998217][ T6067] usb 11-1: Product: syz [ 73.001186][ T6067] usb 11-1: Manufacturer: syz [ 73.012790][ T7652] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 73.016833][ T6067] cdc_wdm 11-1:1.0: skipping garbage [ 73.020507][ T7664] cifs: Unknown parameter 'no9á ‘ýPƒ¹G!8°‰™…EŸ8-ö¤ ™ŠÇÅ–èEeÕ¬' [ 73.022738][ T6067] cdc_wdm 11-1:1.0: skipping garbage [ 73.028552][ T6067] cdc_wdm 11-1:1.0: cdc-wdm0: USB WDM device [ 73.031362][ T6067] cdc_wdm 11-1:1.0: Unknown control protocol [ 73.053185][ T7668] 9pnet_virtio: no channels available for device syz [ 73.075013][ T7666] syz.5.385: attempt to access beyond end of device [ 73.075013][ T7666] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 73.078742][ T7666] XFS (nbd5): SB validate failed with error -5. [ 73.167565][ T7679] binder: 7678:7679 ioctl c0306201 200001c0 returned -14 [ 73.200033][ T65] Bluetooth: hci1: command 0x0419 tx timeout [ 73.200539][ T5941] Bluetooth: hci0: command 0x0419 tx timeout [ 73.219691][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.221829][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.224285][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.226433][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.228417][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.230610][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.232624][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.234556][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.236523][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.238543][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.240532][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.242439][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.244416][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.246360][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.248310][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.250287][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.252367][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.254501][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.256712][ C1] cdc_wdm 11-1:1.0: nonzero urb status received: -71 [ 73.258843][ C1] cdc_wdm 11-1:1.0: wdm_int_callback - 0 bytes [ 73.273136][ T7688] input: syz0 as /devices/virtual/input/input11 [ 73.292535][ T7688] tmpfs: Cannot disable swap on remount [ 73.294769][ T7690] netdevsim netdevsim3: Direct firmware load for ÿ failed with error -2 [ 73.297762][ T7690] netdevsim netdevsim3: Falling back to sysfs fallback for: ÿ [ 73.481868][ T7699] XFS (nullb0): Invalid superblock magic number [ 73.498332][ T5992] usb 11-1: USB disconnect, device number 10 [ 74.170737][ T7721] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 74.174008][ T7721] overlayfs: The uuid=off requires a single fs for lower and upper, falling back to uuid=null. [ 74.195114][ T7723] netlink: 'syz.3.400': attribute type 2 has an invalid length. [ 74.252232][ T7727] : entered promiscuous mode [ 74.281554][ T7729] binder: BINDER_SET_CONTEXT_MGR already set [ 74.283584][ T7729] binder: 7726:7729 ioctl 4018620d 20000100 returned -16 [ 74.420817][ T5941] Bluetooth: hci2: unexpected event for opcode 0x041b [ 74.703985][ T6071] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 74.822563][ T7758] [U]  [ 74.852059][ T6071] usb 10-1: Using ep0 maxpacket: 32 [ 74.857407][ T6071] usb 10-1: New USB device found, idVendor=1ba6, idProduct=0001, bcdDevice=49.88 [ 74.860489][ T6071] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 74.863491][ T6071] usb 10-1: Product: syz [ 74.865147][ T6071] usb 10-1: Manufacturer: syz [ 74.867189][ T6071] usb 10-1: SerialNumber: syz [ 74.870129][ T6071] usb 10-1: config 0 descriptor?? [ 74.877063][ T6071] as10x_usb: device has been detected [ 74.879949][ T6071] dvbdev: DVB: registering new adapter (Abilis Systems DVB-Titan) [ 74.896024][ T6071] usb 10-1: DVB: registering adapter 1 frontend 0 (Abilis Systems DVB-Titan)... [ 74.912191][ T6071] as10x_usb: error during firmware upload part1 [ 74.914262][ T6071] Registered device Abilis Systems DVB-Titan [ 74.955049][ T7760] netlink: 24 bytes leftover after parsing attributes in process `syz.4.414'. [ 75.028113][ T7768] Option 'Í'M•O§±' to dns_resolver key: bad/missing value [ 75.123741][ T7779] ebt_limit: overflow, try lower: 570423552/2483027968 [ 75.164989][ T6071] usb 10-1: USB disconnect, device number 6 [ 75.193237][ T6071] Unregistered device Abilis Systems DVB-Titan [ 75.194767][ T6071] as10x_usb: device has been disconnected [ 75.271450][ T7800] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=7800 comm=syz.3.423 [ 75.279904][ T65] Bluetooth: hci1: command 0x0419 tx timeout [ 75.325649][ T7815] tmpfs: Unknown parameter 'keyring' [ 75.500140][ T7831] netdevsim netdevsim6: loading /lib/firmware/. failed with error -22 [ 75.503383][ T7831] netdevsim netdevsim6: Direct firmware load for . failed with error -22 [ 75.505807][ T7819] syz.5.428: attempt to access beyond end of device [ 75.505807][ T7819] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 75.506406][ T7831] netdevsim netdevsim6: Falling back to sysfs fallback for: . [ 75.510703][ T7819] XFS (nbd5): SB validate failed with error -5. [ 75.511409][ T39] kauditd_printk_skb: 89 callbacks suppressed [ 75.511417][ T39] audit: type=1400 audit(1737335316.405:605): avc: denied { setopt } for pid=7820 comm="syz.3.429" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 76.156570][ T7850] overlay: Bad value for 'workdir' [ 76.297546][ T39] audit: type=1400 audit(1737335317.185:606): avc: denied { setopt } for pid=7865 comm="syz.5.438" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 76.867080][ T7907] syz.5.445: attempt to access beyond end of device [ 76.867080][ T7907] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 76.872582][ T7907] XFS (nbd5): SB validate failed with error -5. [ 76.912882][ T6262] usb 11-1: new high-speed USB device number 11 using dummy_hcd [ 76.967372][ T39] audit: type=1400 audit(1737335317.855:607): avc: denied { read } for pid=7916 comm="syz.5.446" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 77.017472][ T7921] netlink: 4 bytes leftover after parsing attributes in process `syz.5.446'. [ 77.060072][ T6262] usb 11-1: Using ep0 maxpacket: 8 [ 77.065500][ T6262] usb 11-1: config 1 has an invalid interface number: 136 but max is 1 [ 77.067856][ T6262] usb 11-1: config 1 has an invalid interface number: 185 but max is 1 [ 77.078512][ T6262] usb 11-1: config 1 has no interface number 0 [ 77.080527][ T6262] usb 11-1: config 1 has no interface number 1 [ 77.082300][ T6262] usb 11-1: config 1 interface 136 altsetting 3 endpoint 0x5 has invalid maxpacket 511, setting to 64 [ 77.085666][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has an endpoint descriptor with address 0x34, changing to 0x4 [ 77.090843][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has a duplicate endpoint with address 0x4, skipping [ 77.093876][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 77.097385][ T6262] usb 11-1: config 1 interface 136 altsetting 3 endpoint 0xA has invalid maxpacket 1023, setting to 64 [ 77.101292][ T6262] usb 11-1: config 1 interface 136 altsetting 3 endpoint 0x6 has invalid maxpacket 512, setting to 64 [ 77.105185][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has an endpoint descriptor with address 0x4C, changing to 0xC [ 77.108592][ T6262] usb 11-1: config 1 interface 136 altsetting 3 endpoint 0xC has an invalid bInterval 131, changing to 11 [ 77.113953][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has a duplicate endpoint with address 0x5, skipping [ 77.117281][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has an invalid descriptor for endpoint zero, skipping [ 77.121928][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has a duplicate endpoint with address 0xA, skipping [ 77.125934][ T6262] usb 11-1: config 1 interface 136 altsetting 3 endpoint 0xE has invalid maxpacket 479, setting to 64 [ 77.129994][ T6262] usb 11-1: config 1 interface 136 altsetting 3 has 14 endpoint descriptors, different from the interface descriptor's value: 13 [ 77.134228][ T6262] usb 11-1: config 1 interface 185 altsetting 0 has a duplicate endpoint with address 0xC, skipping [ 77.137392][ T6262] usb 11-1: config 1 interface 185 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 77.140596][ T6262] usb 11-1: config 1 interface 136 has no altsetting 0 [ 77.144178][ T6262] usb 11-1: Dual-Role OTG device on HNP port [ 77.146131][ T6262] usb 11-1: New USB device found, idVendor=0ccd, idProduct=0069, bcdDevice=6c.0e [ 77.148810][ T6262] usb 11-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 77.151573][ T6262] usb 11-1: Product: syz [ 77.152885][ T6262] usb 11-1: Manufacturer: syz [ 77.154280][ T6262] usb 11-1: SerialNumber: syz [ 77.163473][ T7897] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 77.209332][ T7934] syz.4.450: attempt to access beyond end of device [ 77.209332][ T7934] loop4: rw=0, sector=64, nr_sectors = 2 limit=0 [ 77.219840][ T7934] isofs_fill_super: bread failed, dev=loop4, iso_blknum=16, block=32 [ 77.274193][ T39] audit: type=1400 audit(1737335318.165:608): avc: denied { wake_alarm } for pid=7938 comm="syz.4.453" capability=35 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 77.359908][ T65] Bluetooth: hci1: command 0x0419 tx timeout [ 77.386460][ T6262] usb 11-1: USB disconnect, device number 11 [ 77.421830][ T7945] syz.5.454: attempt to access beyond end of device [ 77.421830][ T7945] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 77.426570][ T7945] XFS (nbd5): SB validate failed with error -5. [ 77.483835][ T7981] (unnamed net_device) (uninitialized): option use_carrier: invalid value (7) [ 77.561736][ T7989] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 77.918634][ T39] audit: type=1400 audit(1737335318.805:609): avc: denied { getopt } for pid=8006 comm="syz.5.465" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 78.112305][ T8032] netlink: 84 bytes leftover after parsing attributes in process `syz.6.471'. [ 78.115643][ T8032] netlink: 12 bytes leftover after parsing attributes in process `syz.6.471'. [ 78.119354][ T8032] netlink: 20 bytes leftover after parsing attributes in process `syz.6.471'. [ 78.269177][ T8052] netlink: 6 bytes leftover after parsing attributes in process `syz.5.476'. [ 78.275364][ T8052] bridge_slave_0: default FDB implementation only supports local addresses [ 78.279142][ T8052] netlink: 6 bytes leftover after parsing attributes in process `syz.5.476'. [ 78.282600][ T8052] bridge_slave_0: default FDB implementation only supports local addresses [ 78.287964][ T8052] 9pnet_fd: Insufficient options for proto=fd [ 78.330175][ T8059] netlink: 'syz.6.478': attribute type 19 has an invalid length. [ 78.333157][ T8061] netlink: 20 bytes leftover after parsing attributes in process `syz.3.479'. [ 78.368467][ T39] audit: type=1400 audit(1737335319.255:610): avc: denied { setattr } for pid=8065 comm="syz.5.480" name="admmidi2" dev="devtmpfs" ino=1327 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 78.420629][ T8075] nd_bus ndbus0: __nd_ioctl:bus unknown input size cmd: cmd_call field: 1 [ 78.424599][ T39] audit: type=1400 audit(1737335319.305:611): avc: denied { read write } for pid=8071 comm="syz.6.483" name="ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 78.435993][ T39] audit: type=1400 audit(1737335319.305:612): avc: denied { open } for pid=8071 comm="syz.6.483" path="/dev/ndctl0" dev="devtmpfs" ino=109 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 78.448771][ T39] audit: type=1400 audit(1737335319.315:613): avc: denied { ioctl } for pid=8071 comm="syz.6.483" path="/dev/ndctl0" dev="devtmpfs" ino=109 ioctlcmd=0x640a scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 78.665751][ T8102] netlink: 4 bytes leftover after parsing attributes in process `syz.5.491'. [ 78.902973][ T8116] netlink: 68 bytes leftover after parsing attributes in process `syz.6.495'. [ 78.957906][ T8121] capability: warning: `syz.6.496' uses deprecated v2 capabilities in a way that may be insecure [ 78.970768][ T8122] /dev/sg0: Can't lookup blockdev [ 79.306396][ T39] audit: type=1400 audit(1737335320.195:614): avc: denied { setattr } for pid=8134 comm="syz.5.501" name="file0" dev="tmpfs" ino=331 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 79.368131][ T8138] xt_hashlimit: size too large, truncated to 1048576 [ 79.421200][ T8140] binder: 8137:8140 ioctl 80404532 20000040 returned -22 [ 79.440957][ T65] Bluetooth: hci1: command 0x0419 tx timeout [ 79.672818][ T8082] kexec: Could not allocate control_code_buffer [ 79.824902][ T8153] x_tables: ip_tables: icmp.0 match: invalid size 8 (kernel) != (user) 56 [ 79.827865][ T8153] xt_hashlimit: size too large, truncated to 1048576 [ 79.946456][ T65] Bluetooth: hci1: unexpected event for opcode 0x2023 [ 80.083621][ T8177] macsec0: entered promiscuous mode [ 80.147061][ T8179] macsec0: left promiscuous mode [ 80.370299][ T8194] __nla_validate_parse: 1 callbacks suppressed [ 80.370310][ T8194] netlink: 4 bytes leftover after parsing attributes in process `syz.4.518'. [ 80.575727][ T8214] netlink: 'syz.4.524': attribute type 62 has an invalid length. [ 80.671779][ T8225] xt_hashlimit: size too large, truncated to 1048576 [ 80.724913][ T8229] binder: 8224:8229 ioctl 80404532 20000040 returned -22 [ 80.869840][ T63] usb 8-1: new high-speed USB device number 7 using dummy_hcd [ 80.929849][ T5973] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 81.021667][ T63] usb 8-1: config 1 interface 0 altsetting 2 endpoint 0x1 has invalid wMaxPacketSize 0 [ 81.024521][ T63] usb 8-1: config 1 interface 0 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 0 [ 81.027218][ T63] usb 8-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 81.030836][ T63] usb 8-1: config 1 interface 0 has no altsetting 0 [ 81.034368][ T63] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 81.036942][ T63] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.039169][ T63] usb 8-1: Product: syz [ 81.040442][ T63] usb 8-1: Manufacturer: syz [ 81.041771][ T63] usb 8-1: SerialNumber: syz [ 81.081149][ T5973] usb 9-1: config 1 interface 0 altsetting 2 endpoint 0x1 has invalid wMaxPacketSize 0 [ 81.083934][ T5973] usb 9-1: config 1 interface 0 altsetting 2 bulk endpoint 0x1 has invalid maxpacket 0 [ 81.086666][ T5973] usb 9-1: config 1 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 81.090557][ T5973] usb 9-1: config 1 interface 0 has no altsetting 0 [ 81.094172][ T5973] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 81.096738][ T5973] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 81.099083][ T5973] usb 9-1: Product: syz [ 81.100598][ T5973] usb 9-1: Manufacturer: syz [ 81.101957][ T5973] usb 9-1: SerialNumber: syz [ 81.185529][ T39] kauditd_printk_skb: 4 callbacks suppressed [ 81.185538][ T39] audit: type=1400 audit(1737335322.075:619): avc: denied { getopt } for pid=8232 comm="syz.5.531" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 81.249000][ T63] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 7 if 0 alt 2 proto 1 vid 0x0525 pid 0xA4A8 [ 81.307731][ T5973] usblp 9-1:1.0: usblp1: USB Unidirectional printer dev 3 if 0 alt 2 proto 1 vid 0x0525 pid 0xA4A8 [ 81.367574][ T1340] cfg80211: failed to load regulatory.db [ 81.429923][ T5992] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 81.448963][ T39] audit: type=1400 audit(1737335322.335:620): avc: denied { read write } for pid=8215 comm="syz.3.526" name="lp0" dev="devtmpfs" ino=2897 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 81.457433][ T39] audit: type=1400 audit(1737335322.335:621): avc: denied { open } for pid=8215 comm="syz.3.526" path="/dev/usb/lp0" dev="devtmpfs" ino=2897 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:printer_device_t tclass=chr_file permissive=1 [ 81.466198][ T39] audit: type=1326 audit(1737335322.335:622): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8242 comm="syz.6.535" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb072185d29 code=0x0 [ 81.509595][ T63] usb 8-1: USB disconnect, device number 7 [ 81.513818][ T63] usblp0: removed [ 81.559623][ T8245] netlink: 'syz.4.528': attribute type 1 has an invalid length. [ 81.563373][ T8245] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 81.567691][ T8245] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 81.579422][ T30] usb 9-1: USB disconnect, device number 3 [ 81.581394][ T5992] usb 10-1: Using ep0 maxpacket: 8 [ 81.588489][ T5992] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 81.591449][ T5992] usb 10-1: config 0 has no interface number 0 [ 81.594038][ T5992] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 81.598346][ T5992] usb 10-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 81.602790][ T30] usblp1: removed [ 81.605696][ T5992] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 81.611807][ T5992] usb 10-1: config 0 descriptor?? [ 81.616512][ T5992] iowarrior 10-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 82.138433][ T8268] xt_hashlimit: size too large, truncated to 1048576 [ 82.153846][ T8270] input: syz0 as /devices/virtual/input/input12 [ 82.191180][ T8272] binder: 8267:8272 ioctl 80404532 20000040 returned -22 [ 82.211138][ T65] Bluetooth: hci3: Received unexpected HCI Event 0x00 [ 82.326848][ T39] audit: type=1400 audit(1737335323.215:623): avc: denied { ioctl } for pid=8274 comm="syz.6.542" path="socket:[22326]" dev="sockfs" ino=22326 ioctlcmd=0x940c scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 82.479895][ T1020] usb 8-1: new high-speed USB device number 8 using dummy_hcd [ 82.641930][ T1020] usb 8-1: Using ep0 maxpacket: 16 [ 82.648965][ T1020] usb 8-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 82.651696][ T1020] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.654088][ T1020] usb 8-1: Product: syz [ 82.655393][ T1020] usb 8-1: Manufacturer: syz [ 82.656757][ T1020] usb 8-1: SerialNumber: syz [ 82.660443][ T1020] r8152-cfgselector 8-1: Unknown version 0x0000 [ 82.662295][ T1020] r8152-cfgselector 8-1: config 0 descriptor?? [ 82.884667][ T39] audit: type=1400 audit(1737335323.775:624): avc: denied { ioctl } for pid=8296 comm="syz.6.548" path="socket:[23866]" dev="sockfs" ino=23866 ioctlcmd=0x8914 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 82.886086][ T6068] usb 10-1: USB disconnect, device number 7 [ 83.210600][ T39] audit: type=1400 audit(1737335324.105:625): avc: denied { map } for pid=8304 comm="syz.4.551" path="socket:[21108]" dev="sockfs" ino=21108 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 83.219529][ T39] audit: type=1400 audit(1737335324.105:626): avc: denied { read } for pid=8304 comm="syz.4.551" path="socket:[21108]" dev="sockfs" ino=21108 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=sctp_socket permissive=1 [ 83.291249][ T8309] veth0_vlan: left allmulticast mode [ 83.319526][ T8309] team0: Port device vlan0 removed [ 83.719811][ T5974] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 83.779910][ T63] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 83.843503][ T8325] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 83.879996][ T5974] usb 9-1: Using ep0 maxpacket: 16 [ 83.885525][ T5974] usb 9-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 83.889072][ T5974] usb 9-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 83.892791][ T5974] usb 9-1: Product: syz [ 83.894222][ T5974] usb 9-1: Manufacturer: syz [ 83.895515][ T5974] usb 9-1: SerialNumber: syz [ 83.897807][ T5974] usb 9-1: config 0 descriptor?? [ 83.900226][ T8327] syz.6.560[8327] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 83.900276][ T8327] syz.6.560[8327] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 83.903190][ T8327] syz.6.560[8327] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 83.907422][ T8327] netlink: 4 bytes leftover after parsing attributes in process `syz.6.560'. [ 83.913781][ T8327] netlink: 12 bytes leftover after parsing attributes in process `syz.6.560'. [ 83.939908][ T63] usb 10-1: Using ep0 maxpacket: 8 [ 83.943086][ T63] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 83.946673][ T63] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 83.950533][ T63] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 83.953965][ T63] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 83.958609][ T63] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 83.961958][ T63] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 83.980972][ T39] audit: type=1400 audit(1737335324.875:627): avc: denied { connect } for pid=8328 comm="syz.6.561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 83.996772][ T39] audit: type=1400 audit(1737335324.885:628): avc: denied { write } for pid=8328 comm="syz.6.561" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 84.052290][ T8334] netlink: 24 bytes leftover after parsing attributes in process `syz.6.562'. [ 84.102338][ T6067] usb 9-1: USB disconnect, device number 4 [ 84.123210][ T8335] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.562'. [ 84.126202][ T8334] netlink: 16402 bytes leftover after parsing attributes in process `syz.6.562'. [ 84.165841][ T8337] netlink: 8 bytes leftover after parsing attributes in process `syz.6.563'. [ 84.171105][ T8337] openvswitch: netlink: nsh attr 8192 is out of range max 3 [ 84.171825][ T63] usb 10-1: usb_control_msg returned -32 [ 84.174024][ T8337] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 84.179513][ T63] usbtmc 10-1:16.0: can't read capabilities [ 84.921856][ T1137] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.032087][ T1137] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.085480][ T5937] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.092873][ T5937] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.095635][ T5937] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.098955][ T5937] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.102238][ T5937] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3 [ 85.105344][ T5937] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.124021][ T1137] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.149089][ T1020] r8152-cfgselector 8-1: Unknown version 0x0000 [ 85.151029][ T1020] r8152-cfgselector 8-1: bad CDC descriptors [ 85.160507][ T1020] r8152-cfgselector 8-1: USB disconnect, device number 8 [ 85.227172][ T8356] ebt_among: dst integrity fail: 200 [ 85.230515][ T1137] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 85.235533][ T8356] ebt_among: dst integrity fail: 200 [ 85.237972][ T8356] ebt_among: dst integrity fail: 200 [ 85.240013][ T8356] ebt_among: dst integrity fail: 200 [ 85.243302][ T8356] ebt_among: dst integrity fail: 200 [ 85.245195][ T8356] ebt_among: dst integrity fail: 200 [ 85.247080][ T8356] ebt_among: dst integrity fail: 200 [ 85.249002][ T8356] ebt_among: dst integrity fail: 200 [ 85.251166][ T8356] ebt_among: dst integrity fail: 200 [ 85.253044][ T8356] ebt_among: dst integrity fail: 200 [ 85.283910][ T8349] chnl_net:caif_netlink_parms(): no params data found [ 85.316240][ T63] IPVS: starting estimator thread 0... [ 85.331080][ T8363] openvswitch: netlink: IP tunnel dst address not specified [ 85.370459][ T8349] bridge0: port 1(bridge_slave_0) entered blocking state [ 85.370487][ T8349] bridge0: port 1(bridge_slave_0) entered disabled state [ 85.370552][ T8349] bridge_slave_0: entered allmulticast mode [ 85.371013][ T8349] bridge_slave_0: entered promiscuous mode [ 85.372681][ T8349] bridge0: port 2(bridge_slave_1) entered blocking state [ 85.372705][ T8349] bridge0: port 2(bridge_slave_1) entered disabled state [ 85.372798][ T8349] bridge_slave_1: entered allmulticast mode [ 85.373199][ T8349] bridge_slave_1: entered promiscuous mode [ 85.429858][ T8369] IPVS: using max 38 ests per chain, 91200 per kthread [ 85.434129][ T8349] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 85.438080][ T8349] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 85.759516][ T1137] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 85.765098][ T1137] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 85.769191][ T1137] bond0 (unregistering): (slave bond2): Releasing backup interface [ 85.771823][ T1137] bond0 (unregistering): Released all slaves [ 85.777554][ T1137] bond1 (unregistering): (slave batadv1): Releasing backup interface [ 85.780826][ T8388] syz.3.577: attempt to access beyond end of device [ 85.780826][ T8388] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 85.781253][ T1137] bond1 (unregistering): Released all slaves [ 85.784314][ T8388] XFS (nbd3): SB validate failed with error -5. [ 85.893898][ T1137] bond2 (unregistering): Released all slaves [ 85.903695][ T8349] team0: Port device team_slave_0 added [ 85.932071][ T8349] team0: Port device team_slave_1 added [ 85.985162][ T8396] macsec0: entered promiscuous mode [ 85.987149][ T8349] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 85.989159][ T8349] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 85.996697][ T8349] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 86.000631][ T8349] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 86.002723][ T8349] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 86.009971][ T8349] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 86.017441][ T8396] veth1_macvtap: left promiscuous mode [ 86.034134][ T8396] macsec0 (unregistering): left promiscuous mode [ 86.123733][ T8402] pimreg: entered allmulticast mode [ 86.127136][ T8349] hsr_slave_0: entered promiscuous mode [ 86.129304][ T8349] hsr_slave_1: entered promiscuous mode [ 86.131723][ T8349] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 86.133784][ T8349] Cannot create hsr debugfs directory [ 86.135426][ T8396] bridge: RTM_NEWNEIGH with invalid ether address [ 86.232710][ T8409] netlink: 8 bytes leftover after parsing attributes in process `syz.3.581'. [ 86.280911][ T8406] /dev/sr0: Can't open blockdev [ 86.318548][ T8349] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 86.318971][ T39] kauditd_printk_skb: 13 callbacks suppressed [ 86.318981][ T39] audit: type=1400 audit(1737335327.205:642): avc: denied { setopt } for pid=8414 comm="syz.6.584" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 86.328923][ T8349] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 86.330634][ T39] audit: type=1400 audit(1737335327.205:643): avc: denied { ioctl } for pid=8414 comm="syz.6.584" path="socket:[21371]" dev="sockfs" ino=21371 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 86.359568][ T8349] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 86.364138][ T8349] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 86.372293][ T8421] netlink: 1280 bytes leftover after parsing attributes in process `syz.6.586'. [ 86.376075][ T8421] openvswitch: netlink: Flow actions attr not present in new flow. [ 86.409259][ T1137] hsr_slave_0: left promiscuous mode [ 86.414479][ T1137] hsr_slave_1: left promiscuous mode [ 86.419137][ T1137] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 86.426767][ T1137] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 86.429310][ T1137] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 86.433656][ T1137] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 86.459439][ T1137] veth1_macvtap: left promiscuous mode [ 86.462021][ T1137] veth0_macvtap: left promiscuous mode [ 86.464258][ T1137] veth1_vlan: left promiscuous mode [ 86.466302][ T1137] veth0_vlan: left promiscuous mode [ 86.546706][ T1137] pimreg11 (unregistering): left allmulticast mode [ 86.580978][ T8428] syz.3.587: attempt to access beyond end of device [ 86.580978][ T8428] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 86.585368][ T8428] XFS (nbd3): SB validate failed with error -5. [ 87.190447][ T1137] team0 (unregistering): Port device team_slave_1 removed [ 87.213326][ T65] Bluetooth: hci0: command tx timeout [ 87.315750][ T1137] team0 (unregistering): Port device team_slave_0 removed [ 87.928515][ T1340] usb 10-1: USB disconnect, device number 8 [ 87.973668][ T8349] 8021q: adding VLAN 0 to HW filter on device bond0 [ 87.997891][ T8349] 8021q: adding VLAN 0 to HW filter on device team0 [ 88.006981][ T6515] bridge0: port 1(bridge_slave_0) entered blocking state [ 88.009785][ T6515] bridge0: port 1(bridge_slave_0) entered forwarding state [ 88.012307][ T8446] xt_NFQUEUE: number of queues (65534) out of range (got 131068) [ 88.023098][ T104] bridge0: port 2(bridge_slave_1) entered blocking state [ 88.026010][ T104] bridge0: port 2(bridge_slave_1) entered forwarding state [ 88.029297][ T8448] netlink: 596 bytes leftover after parsing attributes in process `syz.3.590'. [ 88.127700][ T8462] netlink: 32 bytes leftover after parsing attributes in process `syz.6.594'. [ 88.135587][ T39] audit: type=1400 audit(1737335329.005:644): avc: denied { map } for pid=8459 comm="syz.6.594" path="socket:[21417]" dev="sockfs" ino=21417 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 88.154495][ T8462] netlink: 32 bytes leftover after parsing attributes in process `syz.6.594'. [ 88.205074][ T8349] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 88.221489][ T8468] MTD: Attempt to mount non-MTD device "/dev/nullb0" [ 88.227002][ T8468] VFS: Can't find a romfs filesystem on dev nullb0. [ 88.227002][ T8468] [ 88.440968][ T8349] veth0_vlan: entered promiscuous mode [ 88.446403][ T8349] veth1_vlan: entered promiscuous mode [ 88.461181][ T8349] veth0_macvtap: entered promiscuous mode [ 88.465085][ T8349] veth1_macvtap: entered promiscuous mode [ 88.474153][ T8349] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.477079][ T8349] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.481733][ T8349] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.484770][ T8349] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.487572][ T8349] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 88.490669][ T8349] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.493993][ T8349] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 88.498892][ T8349] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.502754][ T8349] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.505537][ T8349] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.508552][ T8349] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.511489][ T8349] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 88.514425][ T8349] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 88.517791][ T8349] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 88.521416][ T8349] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.523919][ T8349] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.526333][ T8349] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.529155][ T8349] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 88.561330][ T1137] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.563676][ T1137] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.582981][ T104] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 88.585222][ T104] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 88.630384][ T39] audit: type=1400 audit(1737335329.515:645): avc: denied { create } for pid=8530 comm="syz.3.605" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 88.636155][ T39] audit: type=1400 audit(1737335329.515:646): avc: denied { write } for pid=8530 comm="syz.3.605" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 88.650501][ T39] audit: type=1400 audit(1737335329.515:647): avc: denied { nlmsg_read } for pid=8530 comm="syz.3.605" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 88.656353][ T39] audit: type=1400 audit(1737335329.535:648): avc: denied { write } for pid=8529 comm="syz.7.569" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 88.718831][ T8542] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 88.722304][ T8542] overlayfs: "xino" feature enabled using 2 upper inode bits. [ 88.726119][ T8542] netlink: 'syz.5.607': attribute type 1 has an invalid length. [ 88.729126][ T8542] Cannot find map_set index 0 as target [ 88.749614][ T8546] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=8546 comm=syz.7.608 [ 88.755069][ T39] audit: type=1326 audit(1737335329.645:649): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8545 comm="syz.7.608" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd900785d29 code=0x0 [ 88.761460][ T39] audit: type=1400 audit(1737335329.645:650): avc: denied { create } for pid=8547 comm="syz.5.609" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 88.766928][ T39] audit: type=1400 audit(1737335329.655:651): avc: denied { read } for pid=8547 comm="syz.5.609" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 88.771643][ T63] usb 11-1: new high-speed USB device number 12 using dummy_hcd [ 88.796937][ T8551] netlink: 8 bytes leftover after parsing attributes in process `syz.5.610'. [ 88.861564][ T8558] netlink: 'syz.7.608': attribute type 5 has an invalid length. [ 88.920521][ T63] usb 11-1: Using ep0 maxpacket: 8 [ 88.925823][ T63] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 88.928733][ T63] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 88.940018][ T832] usb 8-1: new high-speed USB device number 9 using dummy_hcd [ 88.942326][ T63] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 88.945324][ T63] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 88.949112][ T63] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 88.960198][ T63] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 89.112318][ T832] usb 8-1: Using ep0 maxpacket: 8 [ 89.123393][ T832] usb 8-1: config 0 has no interfaces? [ 89.126677][ T832] usb 8-1: New USB device found, idVendor=06f8, idProduct=b000, bcdDevice=e1.2d [ 89.129399][ T832] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 89.132044][ T832] usb 8-1: Product: syz [ 89.133519][ T832] usb 8-1: Manufacturer: syz [ 89.134877][ T832] usb 8-1: SerialNumber: syz [ 89.137526][ T832] usb 8-1: config 0 descriptor?? [ 89.177383][ T63] usb 11-1: usb_control_msg returned -32 [ 89.179462][ T63] usbtmc 11-1:16.0: can't read capabilities [ 89.280014][ T65] Bluetooth: hci0: command tx timeout [ 89.347120][ T2296] usb 8-1: USB disconnect, device number 9 [ 89.959021][ T8579] netlink: 8 bytes leftover after parsing attributes in process `syz.3.614'. [ 89.962922][ T8579] netlink: 12 bytes leftover after parsing attributes in process `syz.3.614'. [ 89.966535][ T8579] netlink: 'syz.3.614': attribute type 7 has an invalid length. [ 90.116051][ T8581] ipt_rpfilter: unknown options [ 90.217502][ T8573] netem: change failed [ 90.219601][ T1020] usb 11-1: USB disconnect, device number 12 [ 90.222715][ T8578] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 90.273828][ T8583] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.415685][ T8583] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.518525][ T8583] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.620190][ T8583] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 90.715301][ T8583] netdevsim netdevsim3 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.720238][ T8620] tmpfs: Unknown parameter '0xffffffffffffffffÿÿÿ' [ 90.723132][ T8583] netdevsim netdevsim3 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.731500][ T8583] netdevsim netdevsim3 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 90.743208][ T8583] netdevsim netdevsim3 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.003801][ T8652] Cannot find add_set index 0 as target [ 91.006298][ T8652] netlink: 'syz.7.627': attribute type 21 has an invalid length. [ 91.008570][ T8652] netlink: 128 bytes leftover after parsing attributes in process `syz.7.627'. [ 91.011465][ T8652] netlink: 'syz.7.627': attribute type 5 has an invalid length. [ 91.013682][ T8652] netlink: 'syz.7.627': attribute type 6 has an invalid length. [ 91.015960][ T8652] netlink: 3 bytes leftover after parsing attributes in process `syz.7.627'. [ 91.059873][ T5972] usb 11-1: new high-speed USB device number 13 using dummy_hcd [ 91.123066][ T8588] Bluetooth: hci0: Opcode 0x0c03 failed: -4 [ 91.219977][ T5972] usb 11-1: Using ep0 maxpacket: 8 [ 91.223725][ T5972] usb 11-1: config index 0 descriptor too short (expected 301, got 45) [ 91.226868][ T5972] usb 11-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 91.231766][ T5972] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 91.235667][ T5972] usb 11-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 91.239649][ T5972] usb 11-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 91.245230][ T5972] usb 11-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 91.249015][ T5972] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 91.457073][ T5972] usb 11-1: GET_CAPABILITIES returned 0 [ 91.458862][ T5972] usbtmc 11-1:16.0: can't read capabilities [ 91.843112][ T8685] serio: Serial port ptm0 [ 92.142719][ T8712] ieee802154 phy0 wpan0: encryption failed: -22 [ 92.337263][ T39] kauditd_printk_skb: 178 callbacks suppressed [ 92.337276][ T39] audit: type=1400 audit(1737335333.225:830): avc: denied { read } for pid=8732 comm="syz.3.645" name="vga_arbiter" dev="devtmpfs" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:xserver_misc_device_t tclass=chr_file permissive=1 [ 92.469897][ T8738] __nla_validate_parse: 1 callbacks suppressed [ 92.469914][ T8738] netlink: 12 bytes leftover after parsing attributes in process `syz.3.646'. [ 92.586436][ T8742] netlink: 256 bytes leftover after parsing attributes in process `syz.3.647'. [ 92.589229][ T8742] netlink: 256 bytes leftover after parsing attributes in process `syz.3.647'. [ 92.843985][ T39] audit: type=1400 audit(1737335333.735:831): avc: denied { ioctl } for pid=8757 comm="syz.3.653" path="socket:[24488]" dev="sockfs" ino=24488 ioctlcmd=0x8943 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 93.014372][ T39] audit: type=1400 audit(1737335333.905:832): avc: denied { watch_mount } for pid=8766 comm="syz.5.655" path="/85" dev="tmpfs" ino=472 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 93.219838][ T63] usb 8-1: new high-speed USB device number 10 using dummy_hcd [ 93.379923][ T63] usb 8-1: Using ep0 maxpacket: 8 [ 93.384540][ T63] usb 8-1: config 2 interface 0 has no altsetting 0 [ 93.388826][ T63] usb 8-1: New USB device found, idVendor=04e2, idProduct=1412, bcdDevice=ca.10 [ 93.392301][ T63] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 93.395387][ T63] usb 8-1: Product: syz [ 93.397054][ T63] usb 8-1: Manufacturer: syz [ 93.398927][ T63] usb 8-1: SerialNumber: syz [ 93.615741][ T8765] input: syz1 as /devices/virtual/input/input15 [ 93.675316][ T63] usb 8-1: USB disconnect, device number 10 [ 93.711513][ T8770] sysfs: cannot create duplicate filename '/devices/virtual/tty/gsmtty1' [ 93.716114][ T8770] CPU: 0 UID: 0 PID: 8770 Comm: syz.7.656 Not tainted 6.13.0-rc7-syzkaller-00209-g9528d418de4d #0 [ 93.720000][ T8770] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 93.723147][ T8770] Call Trace: [ 93.724130][ T8770] [ 93.725011][ T8770] dump_stack_lvl+0x16c/0x1f0 [ 93.726607][ T8770] sysfs_warn_dup+0x7f/0xa0 [ 93.728472][ T8770] sysfs_create_dir_ns+0x24d/0x2b0 [ 93.730701][ T8770] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 93.733030][ T8770] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 93.735302][ T8770] ? kobject_add_internal+0x12d/0x990 [ 93.737154][ T8770] ? class_dir_child_ns_type+0xd/0x60 [ 93.738768][ T8770] kobject_add_internal+0x2c8/0x990 [ 93.740285][ T8770] kobject_add+0x16f/0x240 [ 93.741598][ T8770] ? __pfx_kobject_add+0x10/0x10 [ 93.743296][ T8770] ? lock_acquire+0x2f/0xb0 [ 93.745143][ T8770] ? get_device_parent+0x11f/0x4e0 [ 93.747261][ T8770] ? kobject_put+0xab/0x5a0 [ 93.749111][ T8770] ? device_add+0xc02/0x1a70 [ 93.750558][ T8770] device_add+0x289/0x1a70 [ 93.752099][ T8770] ? __pfx_device_add+0x10/0x10 [ 93.754065][ T8770] ? __init_waitqueue_head+0xca/0x150 [ 93.755767][ T8770] tty_register_device_attr+0x38f/0x7c0 [ 93.757381][ T8770] ? __pfx_tty_register_device_attr+0x10/0x10 [ 93.759196][ T8770] ? lockdep_init_map_type+0x16d/0x7d0 [ 93.761293][ T8770] ? tty_port_init+0x156/0x1c0 [ 93.763246][ T8770] gsm_activate_mux+0x157/0x2e0 [ 93.765374][ T8770] gsmld_ioctl+0xc9a/0x1550 [ 93.767263][ T8770] ? trace_lock_acquire+0x14e/0x1f0 [ 93.769198][ T8770] ? tty_ldisc_ref_wait+0x24/0x80 [ 93.770750][ T8770] ? __pfx_gsmld_ioctl+0x10/0x10 [ 93.772224][ T8770] ? __ldsem_down_read_nested+0xf4/0x920 [ 93.774304][ T8770] ? __pfx___ldsem_down_read_nested+0x10/0x10 [ 93.776198][ T8770] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 93.777912][ T8770] ? __pfx_pty_unix98_ioctl+0x10/0x10 [ 93.779646][ T8770] ? __pfx_gsmld_ioctl+0x10/0x10 [ 93.781321][ T8770] tty_ioctl+0x6ee/0x15d0 [ 93.783077][ T8770] ? __pfx_tty_ioctl+0x10/0x10 [ 93.784827][ T8770] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 93.786840][ T8770] ? __pfx_lock_release+0x10/0x10 [ 93.788321][ T8770] ? selinux_file_ioctl+0x180/0x270 [ 93.789870][ T8770] ? selinux_file_ioctl+0xb4/0x270 [ 93.791380][ T8770] ? __pfx_tty_ioctl+0x10/0x10 [ 93.792798][ T8770] __x64_sys_ioctl+0x190/0x200 [ 93.794747][ T8770] do_syscall_64+0xcd/0x250 [ 93.796569][ T8770] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 93.798913][ T8770] RIP: 0033:0x7fd900785d29 [ 93.800682][ T8770] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 93.808024][ T8770] RSP: 002b:00007fd9005f9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 93.810451][ T8770] RAX: ffffffffffffffda RBX: 00007fd900975fa0 RCX: 00007fd900785d29 [ 93.813140][ T8770] RDX: 0000000020000010 RSI: 0000000040204706 RDI: 0000000000000003 [ 93.815501][ T8770] RBP: 00007fd900801b08 R08: 0000000000000000 R09: 0000000000000000 [ 93.817750][ T8770] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 93.820094][ T8770] R13: 0000000000000000 R14: 00007fd900975fa0 R15: 00007ffc72be86e8 [ 93.822527][ T8770] [ 93.823397][ T8684] usb 11-1: USB disconnect, device number 13 [ 93.824930][ T8770] kobject: kobject_add_internal failed for gsmtty1 with -EEXIST, don't try to register things with the same name in the same directory. [ 93.866864][ T39] audit: type=1400 audit(1737335334.755:833): avc: denied { ioctl } for pid=8772 comm="syz.6.657" path="/99/file0/file0" dev="9p" ino=37618362 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 93.880813][ T39] audit: type=1400 audit(1737335334.775:834): avc: denied { write } for pid=8772 comm="syz.6.657" path="/99/file0/file0" dev="9p" ino=37618362 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 94.239869][ T39] audit: type=1400 audit(1737335335.125:835): avc: denied { nlmsg_read } for pid=8794 comm="syz.6.665" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 94.315742][ T39] audit: type=1326 audit(1737335335.205:836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=8803 comm="syz.7.669" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd900785d29 code=0x0 [ 94.323284][ T39] audit: type=1400 audit(1737335335.215:837): avc: denied { create } for pid=8805 comm="syz.3.670" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=user_namespace permissive=1 [ 94.329357][ T39] audit: type=1400 audit(1737335335.215:838): avc: denied { sys_admin } for pid=8805 comm="syz.3.670" capability=21 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=cap_userns permissive=1 [ 94.361779][ T39] audit: type=1400 audit(1737335335.255:839): avc: denied { accept } for pid=8809 comm="syz.3.671" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 94.395775][ T8812] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 94.397634][ T8812] vhci_hcd vhci_hcd.0: devid(0) speed(3) speed_str(high-speed) [ 94.400311][ T8812] vhci_hcd vhci_hcd.0: Device attached [ 94.403710][ T8813] vhci_hcd: connection closed [ 94.403834][ T104] vhci_hcd: stop threads [ 94.406896][ T104] vhci_hcd: release socket [ 94.408206][ T104] vhci_hcd: disconnect device [ 94.535262][ T8815] netlink: 68 bytes leftover after parsing attributes in process `syz.7.669'. [ 94.540314][ T8820] (unnamed net_device) (uninitialized): invalid ARP target 0.0.0.0 specified for addition [ 94.543143][ T8820] (unnamed net_device) (uninitialized): option arp_ip_target: invalid value (0) [ 94.599880][ T63] usb 11-1: new low-speed USB device number 14 using dummy_hcd [ 94.781570][ T63] usb 11-1: config 0 has an invalid interface number: 55 but max is 0 [ 94.785119][ T63] usb 11-1: config 0 has no interface number 0 [ 94.787730][ T63] usb 11-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 94.792234][ T63] usb 11-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 94.796481][ T63] usb 11-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 94.800541][ T63] usb 11-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 94.803746][ T63] usb 11-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 94.807034][ T63] usb 11-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 94.811035][ T63] usb 11-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 94.813788][ T63] usb 11-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 94.817133][ T63] usb 11-1: config 0 descriptor?? [ 94.819112][ T8808] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 94.821469][ T8808] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 94.827443][ T63] ldusb 11-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 94.886555][ T8837] netlink: 8 bytes leftover after parsing attributes in process `syz.5.679'. [ 94.989570][ T8852] trusted_key: syz.3.681 sent an empty control message without MSG_MORE. [ 94.994908][ T8844] netlink: 1280 bytes leftover after parsing attributes in process `syz.3.681'. [ 94.997671][ T8844] openvswitch: netlink: Flow actions attr not present in new flow. [ 95.226225][ T8879] sch_fq: defrate 0 ignored. [ 95.241829][ T8881] Bluetooth: MGMT ver 1.23 [ 95.512669][ T8904] bridge: RTM_NEWNEIGH with invalid state 0x0 [ 95.636987][ T8909] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 95.881321][ T8925] netlink: 92 bytes leftover after parsing attributes in process `syz.7.702'. [ 96.155151][ T8946] netlink: 'syz.5.708': attribute type 19 has an invalid length. [ 96.250633][ T1020] usb 12-1: new high-speed USB device number 2 using dummy_hcd [ 96.399909][ T1020] usb 12-1: Using ep0 maxpacket: 32 [ 96.404499][ T1020] usb 12-1: unable to read config index 0 descriptor/start: -61 [ 96.406889][ T1020] usb 12-1: can't read configurations, error -61 [ 96.529867][ T1020] usb 12-1: new high-speed USB device number 3 using dummy_hcd [ 96.563817][ T8963] overlayfs: missing 'lowerdir' [ 96.679804][ T1020] usb 12-1: Using ep0 maxpacket: 32 [ 96.682912][ T1020] usb 12-1: unable to read config index 0 descriptor/start: -61 [ 96.685137][ T1020] usb 12-1: can't read configurations, error -61 [ 96.687170][ T1020] usb usb12-port1: attempt power cycle [ 97.029960][ T1020] usb 12-1: new high-speed USB device number 4 using dummy_hcd [ 97.062083][ T1020] usb 12-1: Using ep0 maxpacket: 32 [ 97.066032][ T1020] usb 12-1: unable to read config index 0 descriptor/start: -61 [ 97.068527][ T1020] usb 12-1: can't read configurations, error -61 [ 97.199886][ T1020] usb 12-1: new high-speed USB device number 5 using dummy_hcd [ 97.220415][ T1020] usb 12-1: Using ep0 maxpacket: 32 [ 97.223948][ T1020] usb 12-1: unable to read config index 0 descriptor/start: -61 [ 97.226225][ T1020] usb 12-1: can't read configurations, error -61 [ 97.228280][ T1020] usb usb12-port1: unable to enumerate USB device [ 97.313250][ T8684] usb 11-1: USB disconnect, device number 14 [ 97.317819][ T8684] ldusb 11-1:0.55: LD USB Device #0 now disconnected [ 97.468311][ T8980] tipc: Can't bind to reserved service type 2 [ 97.473657][ T8980] netlink: 'syz.6.717': attribute type 4 has an invalid length. [ 97.492218][ T39] kauditd_printk_skb: 8 callbacks suppressed [ 97.492227][ T39] audit: type=1400 audit(1737335338.385:848): avc: denied { nlmsg_write } for pid=8981 comm="syz.5.718" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_audit_socket permissive=1 [ 97.548275][ T8988] syz.5.720[8988] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 97.548350][ T8988] syz.5.720[8988] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 97.552893][ T8988] syz.5.720[8988] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 97.558262][ T8988] syz.5.720[8988] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 97.563561][ T8988] syz.5.720[8988] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 97.567900][ T8988] syz.5.720[8988] is installing a program with bpf_probe_write_user helper that may corrupt user memory! [ 97.573572][ T8988] syz.5.720 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 97.608989][ T8993] A: renamed from bond_slave_0 (while UP) [ 97.621224][ T39] audit: type=1400 audit(1737335338.515:849): avc: denied { map } for pid=8992 comm="syz.5.722" path="socket:[28701]" dev="sockfs" ino=28701 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_stream_socket permissive=1 [ 97.628724][ T39] audit: type=1400 audit(1737335338.515:850): avc: denied { getopt } for pid=8992 comm="syz.5.722" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 97.690876][ T8999] netlink: 12 bytes leftover after parsing attributes in process `syz.5.725'. [ 97.694149][ T8999] netlink: 12 bytes leftover after parsing attributes in process `syz.5.725'. [ 97.791920][ T9009] overlayfs: failed to clone upperpath [ 97.794310][ T9009] overlayfs: failed to clone upperpath [ 98.258116][ T9042] set match dimension is over the limit! [ 98.265761][ T9042] set match dimension is over the limit! [ 98.405785][ T39] audit: type=1400 audit(1737335339.295:851): avc: denied { sqpoll } for pid=9046 comm="syz.6.741" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 98.443642][ T104] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 98.446068][ T104] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 98.565490][ T39] audit: type=1400 audit(1737335339.455:852): avc: denied { ioctl } for pid=9066 comm="syz.5.746" path="socket:[28066]" dev="sockfs" ino=28066 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 98.568187][ T65] Bluetooth: hci2: unexpected event for opcode 0x0406 [ 98.706038][ T9072] netlink: 132 bytes leftover after parsing attributes in process `syz.6.748'. [ 98.753826][ T9077] fuse: Unknown parameter '0xffffffffffffffff0xffffffffffffffff' [ 98.804629][ T39] audit: type=1400 audit(1737335339.695:853): avc: denied { connect } for pid=9081 comm="syz.5.752" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 98.846525][ T9089] netlink: 'syz.5.754': attribute type 1 has an invalid length. [ 98.849589][ T9089] netlink: 24 bytes leftover after parsing attributes in process `syz.5.754'. [ 98.859840][ T39] audit: type=1400 audit(1737335339.745:854): avc: denied { read } for pid=9088 comm="syz.5.754" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_crypto_socket permissive=1 [ 98.904998][ T9093] netlink: 24 bytes leftover after parsing attributes in process `syz.5.756'. [ 98.907601][ T9094] netlink: 24 bytes leftover after parsing attributes in process `syz.5.756'. [ 98.913288][ T9094] netlink: 24 bytes leftover after parsing attributes in process `syz.5.756'. [ 98.915869][ T9093] netlink: 24 bytes leftover after parsing attributes in process `syz.5.756'. [ 98.958918][ T9099] erspan1: entered promiscuous mode [ 99.085075][ T9116] overlayfs: failed to clone lowerpath [ 99.169092][ T65] Bluetooth: hci1: unexpected event for opcode 0x2042 [ 99.241521][ T9132] ptrace attach of "/syz-executor exec"[9133] was attempted by "/syz-executor exec"[9132] [ 99.287160][ T39] audit: type=1400 audit(1737335340.175:855): avc: denied { create } for pid=9120 comm="syz.5.766" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 99.294734][ T39] audit: type=1400 audit(1737335340.175:856): avc: denied { write } for pid=9120 comm="syz.5.766" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 99.326375][ T9138] syz_tun: entered allmulticast mode [ 99.328602][ T9138] syz_tun: left allmulticast mode [ 99.480268][ T9148] xt_hashlimit: size too large, truncated to 1048576 [ 99.764776][ T9176] A link change request failed with some changes committed already. Interface batadv_slave_0 may have been left with an inconsistent configuration, please check. [ 99.885332][ T9186] netlink: 4 bytes leftover after parsing attributes in process `syz.7.783'. [ 99.888421][ T9186] netlink: 44 bytes leftover after parsing attributes in process `syz.7.783'. [ 100.228131][ T9200] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 100.230542][ T9200] IPv6: NLM_F_CREATE should be set when creating new route [ 100.691130][ T9215] sctp: [Deprecated]: syz.7.790 (pid 9215) Use of int in maxseg socket option. [ 100.691130][ T9215] Use struct sctp_assoc_value instead [ 100.698040][ T9215] sctp: [Deprecated]: syz.7.790 (pid 9215) Use of struct sctp_assoc_value in delayed_ack socket option. [ 100.698040][ T9215] Use struct sctp_sack_info instead [ 100.724057][ T9218] sch_tbf: burst 824 is lower than device ipvlan0 mtu (1514) ! [ 100.776614][ T9208] syz.5.789: attempt to access beyond end of device [ 100.776614][ T9208] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 100.780458][ T9208] XFS (nbd5): SB validate failed with error -5. [ 100.847455][ T9242] openvswitch: netlink: Duplicate or invalid key (type 0). [ 100.856819][ T9242] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 100.881230][ T39] audit: type=1400 audit(1737335341.775:857): avc: denied { write } for pid=9243 comm="syz.5.798" name="usbmon7" dev="devtmpfs" ino=759 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usbmon_device_t tclass=chr_file permissive=1 [ 100.898944][ T9250] fuse: Bad value for 'fd' [ 100.954240][ T9259] vlan2: entered promiscuous mode [ 100.956451][ T9259] gretap0: entered promiscuous mode [ 100.967108][ T9259] gretap0: left promiscuous mode [ 101.269223][ T9277] syz.3.808: attempt to access beyond end of device [ 101.269223][ T9277] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 101.273814][ T9277] XFS (nbd3): SB validate failed with error -5. [ 101.549185][ T9293] netlink: 'syz.7.809': attribute type 10 has an invalid length. [ 101.552076][ T9293] vlan0: entered allmulticast mode [ 101.555757][ T9293] veth0_vlan: entered allmulticast mode [ 101.564017][ T9293] team0: Port device vlan0 added [ 101.776488][ T9301] input: syz1 as /devices/virtual/input/input17 [ 101.900715][ T9310] netlink: 'syz.7.815': attribute type 13 has an invalid length. [ 101.903009][ T9310] netlink: 'syz.7.815': attribute type 11 has an invalid length. [ 102.058986][ T9334] : Can't lookup blockdev [ 102.228574][ T9337] syz.5.822: attempt to access beyond end of device [ 102.228574][ T9337] nbd5: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 102.233299][ T9337] XFS (nbd5): SB validate failed with error -5. [ 103.202597][ T65] Bluetooth: hci1: Controller not accepting commands anymore: ncmd = 0 [ 103.205250][ T65] Bluetooth: hci1: Injecting HCI hardware error event [ 103.210029][ T65] Bluetooth: hci1: hardware error 0x00 [ 103.294165][ T9366] __nla_validate_parse: 8 callbacks suppressed [ 103.294175][ T9366] netlink: 2052 bytes leftover after parsing attributes in process `syz.6.824'. [ 103.299021][ T9366] netlink: 8 bytes leftover after parsing attributes in process `syz.6.824'. [ 103.327707][ T9384] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=9384 comm=syz.3.831 [ 103.389837][ T2296] usb 10-1: new low-speed USB device number 9 using dummy_hcd [ 103.437982][ T9404] netlink: 12 bytes leftover after parsing attributes in process `syz.3.834'. [ 103.454053][ T9394] syz.7.833: attempt to access beyond end of device [ 103.454053][ T9394] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 103.457846][ T9394] XFS (nbd7): SB validate failed with error -5. [ 103.516211][ T39] audit: type=1400 audit(1737335344.405:858): avc: denied { setopt } for pid=9416 comm="syz.3.835" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_tcpdiag_socket permissive=1 [ 103.529807][ T2296] usb 10-1: device descriptor read/64, error -71 [ 103.541912][ T39] audit: type=1400 audit(1737335344.435:859): avc: denied { unmount } for pid=5942 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 103.653305][ T9428] netlink: 4 bytes leftover after parsing attributes in process `syz.3.839'. [ 103.658678][ T9428] gretap0: entered promiscuous mode [ 103.660740][ T9428] macvtap1: entered promiscuous mode [ 103.662485][ T9428] macvtap1: entered allmulticast mode [ 103.664244][ T9428] gretap0: entered allmulticast mode [ 103.736126][ T9436] netlink: 48 bytes leftover after parsing attributes in process `syz.3.842'. [ 103.761275][ T9436] netlink: 8 bytes leftover after parsing attributes in process `syz.3.842'. [ 103.770752][ T9436] bridge0: port 2(bridge_slave_1) entered disabled state [ 103.774368][ T9436] netlink: 32 bytes leftover after parsing attributes in process `syz.3.842'. [ 103.779094][ T9436] bridge0: port 1(bridge_slave_0) entered disabled state [ 103.783266][ T9436] netlink: 'syz.3.842': attribute type 1 has an invalid length. [ 103.793732][ T2296] usb 10-1: new low-speed USB device number 10 using dummy_hcd [ 103.919856][ T2296] usb 10-1: device descriptor read/64, error -71 [ 104.043303][ T2296] usb usb10-port1: attempt power cycle [ 104.184996][ T9473] netlink: 16 bytes leftover after parsing attributes in process `syz.3.851'. [ 104.187661][ T9473] netlink: 92 bytes leftover after parsing attributes in process `syz.3.851'. [ 104.357977][ T39] audit: type=1400 audit(1737335345.245:860): avc: denied { connect } for pid=9478 comm="syz.3.853" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 104.400615][ T2296] usb 10-1: new low-speed USB device number 11 using dummy_hcd [ 104.430261][ T2296] usb 10-1: device descriptor read/8, error -71 [ 104.689908][ T2296] usb 10-1: new low-speed USB device number 12 using dummy_hcd [ 104.710289][ T2296] usb 10-1: device descriptor read/8, error -71 [ 104.816417][ T39] audit: type=1400 audit(1737335345.705:861): avc: denied { mounton } for pid=9482 comm="syz.7.854" path="/56/file0" dev="tmpfs" ino=310 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=sock_file permissive=1 [ 104.820088][ T2296] usb usb10-port1: unable to enumerate USB device [ 104.899575][ T9494] netlink: 8 bytes leftover after parsing attributes in process `syz.6.858'. [ 105.009014][ T9511] netlink: 'syz.6.863': attribute type 1 has an invalid length. [ 105.243756][ T9525] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 105.271553][ T9529] openvswitch: netlink: Actions may not be safe on all matching packets [ 105.275878][ T9531] openvswitch: netlink: Actions may not be safe on all matching packets [ 105.279992][ T65] Bluetooth: hci1: Opcode 0x0c03 failed: -110 [ 105.373779][ T9536] openvswitch: netlink: Flow actions attr not present in new flow. [ 105.398655][ T39] audit: type=1400 audit(1737335346.285:862): avc: denied { setattr } for pid=9546 comm="syz.3.873" name="/" dev="9p" ino=37618266 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 105.405463][ T39] audit: type=1400 audit(1737335346.295:863): avc: denied { map } for pid=9535 comm="syz.7.871" path="/dev/bus/usb/002/001" dev="devtmpfs" ino=745 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:usb_device_t tclass=chr_file permissive=1 [ 105.416457][ T9547] skbuff: bad partial csum: csum=65489/0 headroom=64 headlen=65491 [ 105.487481][ T9550] netlink: 'syz.7.874': attribute type 2 has an invalid length. [ 105.495920][ T9550] : entered promiscuous mode [ 105.635588][ T9563] hfsplus: unable to find HFS+ superblock [ 105.677220][ T39] audit: type=1400 audit(1737335346.565:864): avc: denied { lock } for pid=9568 comm="syz.7.880" path="/70/file0/cgroup.kill" dev="9p" ino=37618387 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 105.716671][ T9583] overlayfs: failed to clone upperpath [ 105.768115][ T9590] netlink: 'syz.7.884': attribute type 1 has an invalid length. [ 105.786672][ T39] audit: type=1804 audit(1737335346.675:865): pid=9590 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=invalid_pcr cause=open_writers comm="syz.7.884" name="/newroot/71/file0/file0" dev="9p" ino=37618362 res=1 errno=0 [ 105.794282][ T39] audit: type=1800 audit(1737335346.675:866): pid=9590 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed(directio) comm="syz.7.884" name="file0" dev="9p" ino=37618362 res=0 errno=0 [ 105.847008][ T9602] MTD: Attempt to mount non-MTD device "/dev/nbd3" [ 105.849052][ T9602] cramfs: wrong magic [ 105.869715][ T39] audit: type=1400 audit(1737335346.755:867): avc: denied { accept } for pid=9603 comm="syz.7.889" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 105.914700][ T9607] netlink: 'syz.7.892': attribute type 11 has an invalid length. [ 106.117871][ T9619] syz.7.896: attempt to access beyond end of device [ 106.117871][ T9619] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 106.123296][ T9619] XFS (nbd7): SB validate failed with error -5. [ 106.178840][ T65] Bluetooth: hci2: Malformed LE Event: 0x0b [ 106.343893][ T9657] No buffer was provided with the request [ 106.346337][ T9658] No buffer was provided with the request [ 106.629855][ T2296] usb 12-1: new high-speed USB device number 6 using dummy_hcd [ 106.789854][ T2296] usb 12-1: Using ep0 maxpacket: 16 [ 106.793918][ T2296] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 106.797987][ T2296] usb 12-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 106.802163][ T2296] usb 12-1: New USB device found, idVendor=05ac, idProduct=8241, bcdDevice= 0.00 [ 106.805842][ T2296] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 106.815356][ T2296] usb 12-1: config 0 descriptor?? [ 107.223581][ T2296] appleir 0003:05AC:8241.0002: unknown main item tag 0x0 [ 107.225994][ T2296] appleir 0003:05AC:8241.0002: unknown main item tag 0x0 [ 107.227980][ T2296] appleir 0003:05AC:8241.0002: unknown main item tag 0x0 [ 107.231099][ T2296] appleir 0003:05AC:8241.0002: unknown main item tag 0x0 [ 107.233105][ T2296] appleir 0003:05AC:8241.0002: unknown main item tag 0x0 [ 107.235482][ T2296] appleir 0003:05AC:8241.0002: No inputs registered, leaving [ 107.249637][ T2296] appleir 0003:05AC:8241.0002: hiddev0,hidraw1: USB HID v0.00 Device [HID 05ac:8241] on usb-dummy_hcd.7-1/input0 [ 107.355586][ T9705] syz.3.919: attempt to access beyond end of device [ 107.355586][ T9705] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 107.361148][ T9705] XFS (nbd3): SB validate failed with error -5. [ 107.461101][ T9717] overlayfs: upperdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 107.465377][ T9717] overlayfs: workdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 107.538279][ T2296] usb 12-1: USB disconnect, device number 6 [ 107.842299][ T9727] netlink: 'syz.5.924': attribute type 1 has an invalid length. [ 107.848506][ T9727] ip6gretap0: entered promiscuous mode [ 107.850521][ T9727] macvtap1: entered promiscuous mode [ 107.852118][ T9727] macvtap1: entered allmulticast mode [ 107.853640][ T9727] ip6gretap0: entered allmulticast mode [ 107.908340][ T9728] block nbd5: NBD_DISCONNECT [ 107.910748][ T9728] block nbd5: Disconnected due to user request. [ 107.914227][ T9728] block nbd5: shutting down sockets [ 108.087286][ T9742] nvme_fabrics: unknown parameter or missing value '(' in ctrl creation request [ 108.088565][ T9743] fuse: Unknown parameter 'bd' [ 108.220316][ T9743] cgroup: release_agent respecified [ 108.818854][ T9777] sctp: [Deprecated]: syz.3.938 (pid 9777) Use of int in max_burst socket option deprecated. [ 108.818854][ T9777] Use struct sctp_assoc_value instead [ 108.982344][ T9795] devtmpfs: Cannot enable quota on remount [ 108.984422][ T9795] devtmpfs: Cannot enable quota on remount [ 108.987173][ T9795] devtmpfs: Cannot enable quota on remount [ 108.988961][ T9795] devtmpfs: Cannot enable quota on remount [ 108.992811][ T9795] devtmpfs: Cannot enable quota on remount [ 108.995411][ T9795] devtmpfs: Cannot enable quota on remount [ 108.997208][ T9795] devtmpfs: Cannot enable quota on remount [ 108.999068][ T9795] devtmpfs: Cannot enable quota on remount [ 109.001324][ T9795] devtmpfs: Cannot enable quota on remount [ 109.003306][ T9795] devtmpfs: Cannot enable quota on remount [ 109.005125][ T9795] devtmpfs: Cannot enable quota on remount [ 109.006285][ T9779] netdevsim netdevsim6 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.006888][ T9795] devtmpfs: Cannot enable quota on remount [ 109.009199][ T9779] netdevsim netdevsim6 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.011109][ T9795] devtmpfs: Cannot enable quota on remount [ 109.013227][ T9779] netdevsim netdevsim6 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.015258][ T9795] devtmpfs: Cannot enable quota on remount [ 109.017499][ T9779] netdevsim netdevsim6 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 109.019339][ T9795] devtmpfs: Cannot enable quota on remount [ 109.019491][ T9795] devtmpfs: Cannot enable quota on remount [ 109.025556][ T9795] devtmpfs: Cannot enable quota on remount [ 109.027457][ T9795] devtmpfs: Cannot enable quota on remount [ 109.029325][ T9795] devtmpfs: Cannot enable quota on remount [ 109.031285][ T9795] devtmpfs: Cannot enable quota on remount [ 109.033122][ T9795] devtmpfs: Cannot enable quota on remount [ 109.034968][ T9795] devtmpfs: Cannot enable quota on remount [ 109.037569][ T9795] devtmpfs: Cannot enable quota on remount [ 109.038033][ T9798] __nla_validate_parse: 11 callbacks suppressed [ 109.038045][ T9798] netlink: 12 bytes leftover after parsing attributes in process `syz.3.945'. [ 109.039465][ T9795] devtmpfs: Cannot enable quota on remount [ 109.046607][ T9796] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=5125 sclass=netlink_route_socket pid=9796 comm=syz.5.944 [ 109.046640][ T9795] devtmpfs: Cannot enable quota on remount [ 109.057699][ T9801] A link change request failed with some changes committed already. Interface geneve0 may have been left with an inconsistent configuration, please check. [ 109.084616][ T9806] befs: (nullb0): No write support. Marking filesystem read-only [ 109.091551][ T9806] befs: (nullb0): invalid magic header [ 109.141780][ T9817] hfs: can't find a HFS filesystem on dev sr0 [ 109.145871][ T9798] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 109.149129][ T9799] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 109.289615][ T9824] syz.7.949: attempt to access beyond end of device [ 109.289615][ T9824] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 109.294831][ T9824] XFS (nbd7): SB validate failed with error -5. [ 109.334917][ T9836] netlink: 4 bytes leftover after parsing attributes in process `syz.5.951'. [ 109.337461][ T9836] bridge_slave_1: left allmulticast mode [ 109.339097][ T9836] bridge_slave_1: left promiscuous mode [ 109.341617][ T9836] bridge0: port 2(bridge_slave_1) entered disabled state [ 109.345776][ T9836] bridge_slave_0: left allmulticast mode [ 109.347434][ T9836] bridge_slave_0: left promiscuous mode [ 109.349122][ T9836] bridge0: port 1(bridge_slave_0) entered disabled state [ 109.587802][ T9859] syz.7.958: attempt to access beyond end of device [ 109.587802][ T9859] nbd7: rw=0, sector=0, nr_sectors = 2 limit=0 [ 109.592421][ T9859] befs: (nbd7): unable to read superblock [ 109.617607][ T39] kauditd_printk_skb: 11 callbacks suppressed [ 109.617618][ T39] audit: type=1326 audit(1737335350.505:879): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9864 comm="syz.6.960" exe="/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fb072185d29 code=0x0 [ 109.640994][ T9869] pimreg11: entered allmulticast mode [ 109.799446][ T9876] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=6928 sclass=netlink_route_socket pid=9876 comm=syz.5.963 [ 109.856574][ T9879] Cannot find set identified by id 65534 to match [ 109.859214][ T39] audit: type=1400 audit(1737335350.745:880): avc: denied { execute } for pid=9878 comm="syz.5.964" dev="hugetlbfs" ino=30654 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 109.868134][ T39] audit: type=1400 audit(1737335350.745:881): avc: denied { execute_no_trans } for pid=9878 comm="syz.5.964" path=2F6D656D66643AA39F6EB4645204693502ACCEE1889D5B4038D7269FCE707B69CDA97D09D702B31344CE1F2039497F151D933DB5E75C274CE6D28EBC294A7454447181CF81BAE531F520C8103EC95C85174CBFCF91DF4DF3025E542A202864656C6574656429 dev="hugetlbfs" ino=30654 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:hugetlbfs_t tclass=file permissive=1 [ 110.368307][ T9887] QAT: failed to copy from user cfg_data. [ 110.573563][ T9907] SET target dimension over the limit! [ 110.574009][ T9904] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.578844][ T9904] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.581918][ T9904] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.584868][ T9904] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.587695][ T9904] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.598731][ T9904] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.601830][ T9904] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 110.604864][ T9904] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 110.608246][ T9904] batadv_slave_0: entered promiscuous mode [ 110.610891][ T9904] macsec2: entered allmulticast mode [ 110.612479][ T9904] batadv_slave_0: entered allmulticast mode [ 110.616287][ T9904] batadv_slave_0: left allmulticast mode [ 110.617936][ T9904] batadv_slave_0: left promiscuous mode [ 110.620159][ T9911] program syz.7.975 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 110.690869][ T9917] netlink: 28 bytes leftover after parsing attributes in process `syz.7.976'. [ 110.693626][ T39] audit: type=1400 audit(1737335351.585:882): avc: denied { getopt } for pid=9921 comm="syz.6.978" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 110.711052][ T39] audit: type=1400 audit(1737335351.595:883): avc: denied { unmount } for pid=8349 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfs_t tclass=filesystem permissive=1 [ 110.734733][ T39] audit: type=1326 audit(1737335351.625:884): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=9881 comm="syz.5.965" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0fe9585d29 code=0x7fc00000 [ 110.832805][ T9943] netlink: ct family unspecified [ 110.834289][ T9943] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 110.886065][ T9953] 9pnet: p9_errstr2errno: server reported unknown error 184467440737095 [ 110.940788][ T9956] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1538 sclass=netlink_route_socket pid=9956 comm=syz.5.989 [ 110.969988][ T832] usb 12-1: new high-speed USB device number 7 using dummy_hcd [ 110.988485][ T9961] xt_hashlimit: size too large, truncated to 1048576 [ 111.039120][ T9966] binfmt_misc: register: failed to install interpreter file ./file0 [ 111.079010][ T39] audit: type=1400 audit(1737335351.965:885): avc: denied { setopt } for pid=9968 comm="syz.3.994" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 111.079844][ T9969] virtio-pci 0000:00:01.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=io+mem:owns=io+mem [ 111.129851][ T832] usb 12-1: Using ep0 maxpacket: 8 [ 111.132503][ T832] usb 12-1: config 0 has no interfaces? [ 111.134115][ T832] usb 12-1: New USB device found, idVendor=0225, idProduct=0000, bcdDevice= 0.00 [ 111.136840][ T832] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 111.140556][ T832] usb 12-1: config 0 descriptor?? [ 111.992111][T10005] IPv6: Can't replace route, no match found [ 112.035283][T10010] xt_CONNSECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 112.151682][ T39] audit: type=1400 audit(1737335353.045:886): avc: denied { attach_queue } for pid=10018 comm="syz.5.1008" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 112.155025][T10021] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 112.157953][ T39] audit: type=1400 audit(1737335353.045:887): avc: denied { write } for pid=10018 comm="syz.5.1008" path="socket:[33861]" dev="sockfs" ino=33861 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 112.169707][T10021] overlayfs: failed to clone upperpath [ 112.173341][T10021] overlayfs: failed to clone upperpath [ 112.252792][T10029] openvswitch: netlink: Port -1 exceeds max allowable 65535 [ 112.258121][T10027] 9pnet_fd: Insufficient options for proto=fd [ 112.299069][T10033] syz.5.1015 (10033): /proc/10032/oom_adj is deprecated, please use /proc/10032/oom_score_adj instead. [ 112.340831][T10035] xt_hashlimit: size too large, truncated to 1048576 [ 112.409359][ T39] audit: type=1400 audit(1737335353.295:888): avc: denied { getopt } for pid=10041 comm="syz.3.1019" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 112.430379][T10047] netlink: 56 bytes leftover after parsing attributes in process `syz.5.1020'. [ 112.458578][T10050] netlink: 'syz.3.1021': attribute type 10 has an invalid length. [ 112.487844][T10050] veth0_vlan: left promiscuous mode [ 112.494098][T10050] veth0_vlan: entered promiscuous mode [ 112.504385][T10050] team0: Device veth0_vlan failed to register rx_handler [ 112.602886][T10057] block device autoloading is deprecated and will be removed. [ 112.612294][T10057] syz.5.1024: attempt to access beyond end of device [ 112.612294][T10057] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 113.013451][T10089] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1034'. [ 113.099058][T10092] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=1539 sclass=netlink_route_socket pid=10092 comm=syz.6.1035 [ 113.104870][T10092] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=57 sclass=netlink_route_socket pid=10092 comm=syz.6.1035 [ 113.110600][T10092] netlink: 'syz.6.1035': attribute type 9 has an invalid length. [ 113.113032][T10092] netlink: 209852 bytes leftover after parsing attributes in process `syz.6.1035'. [ 113.143206][T10096] netlink: 'syz.6.1036': attribute type 11 has an invalid length. [ 113.235630][T10104] xt_hashlimit: size too large, truncated to 1048576 [ 113.546575][T10108] SELinux: policydb version -817610988 does not match my version range 15-33 [ 113.550862][T10108] SELinux: failed to load policy [ 113.589609][T10112] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1041'. [ 113.595100][T10112] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1041'. [ 113.598557][T10112] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1041'. [ 113.602860][T10112] netlink: 36 bytes leftover after parsing attributes in process `syz.3.1041'. [ 113.636685][T10115] trusted_key: encrypted_key: keylen for the ecryptfs format must be equal to 64 bytes [ 113.834707][T10120] batadv_slave_0: entered promiscuous mode [ 113.869115][ T63] usb 12-1: USB disconnect, device number 7 [ 114.254400][T10140] netlink: 'syz.7.1051': attribute type 27 has an invalid length. [ 114.328471][T10140] bridge0: port 2(bridge_slave_1) entered disabled state [ 114.330641][T10140] bridge0: port 1(bridge_slave_0) entered disabled state [ 114.428641][T10140] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 114.441576][T10140] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 114.488155][T10140] veth0_vlan: left allmulticast mode [ 114.494873][T10140] vlan0: left allmulticast mode [ 114.528192][T10140] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.531933][T10140] netdevsim netdevsim7 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.535178][T10140] netdevsim netdevsim7 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.538375][T10140] netdevsim netdevsim7 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 114.590040][T10145] 8021q: adding VLAN 0 to HW filter on device bond0 [ 114.592498][T10145] 8021q: adding VLAN 0 to HW filter on device team0 [ 114.597205][T10145] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 114.652857][T10119] batadv_slave_0: left promiscuous mode [ 114.793817][T10164] xt_hashlimit: size too large, truncated to 1048576 [ 114.856059][T10172] __nla_validate_parse: 45 callbacks suppressed [ 114.856069][T10172] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1062'. [ 114.861388][T10172] netlink: 16 bytes leftover after parsing attributes in process `syz.3.1062'. [ 114.883942][T10177] syz.7.1063: attempt to access beyond end of device [ 114.883942][T10177] loop7: rw=0, sector=0, nr_sectors = 1 limit=0 [ 114.887628][T10177] efs: cannot read volume header [ 114.889343][ T1340] IPVS: starting estimator thread 0... [ 114.894762][ T65] Bluetooth: hci3: unexpected event for opcode 0x1001 [ 114.916123][T10183] overlayfs: upperdir is in-use as upperdir/workdir of another mount, mount with '-o index=off' to override exclusive upperdir protection. [ 114.925799][ T39] kauditd_printk_skb: 6 callbacks suppressed [ 114.925809][ T39] audit: type=1400 audit(1737335355.815:895): avc: denied { listen } for pid=10181 comm="syz.7.1065" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 114.925890][T10183] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1065'. [ 114.936671][T10182] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1065'. [ 114.979870][T10178] IPVS: using max 38 ests per chain, 91200 per kthread [ 115.034365][ T39] audit: type=1400 audit(1737335355.925:896): avc: denied { setattr } for pid=10184 comm="syz.3.1066" path="/dev/kvm" dev="devtmpfs" ino=84 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:kvm_device_t tclass=chr_file permissive=1 [ 115.140198][T10198] syz.7.1069: attempt to access beyond end of device [ 115.140198][T10198] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 115.143962][T10198] XFS (nbd7): SB validate failed with error -5. [ 115.294613][T10218] nvme_fabrics: unknown parameter or missing value '(' in ctrl creation request [ 115.311916][ T39] audit: type=1400 audit(1737335356.205:897): avc: denied { map } for pid=10213 comm="syz.7.1074" path="/dev/nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 115.364179][T10227] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 115.385958][T10227] overlayfs: option "volatile" is meaningless in a non-upper mount, ignoring it. [ 115.558214][T10232] syz.3.1079 (10232): drop_caches: 2 [ 115.599624][ T39] audit: type=1400 audit(1737335356.485:898): avc: denied { map } for pid=10239 comm="syz.6.1083" path="socket:[33450]" dev="sockfs" ino=33450 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 115.715268][T10242] syz.7.1082: attempt to access beyond end of device [ 115.715268][T10242] nbd7: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 115.719202][T10242] XFS (nbd7): SB validate failed with error -5. [ 115.857015][T10264] SET target dimension over the limit! [ 115.857805][ T39] audit: type=1400 audit(1737335356.745:899): avc: denied { accept } for pid=10263 comm="syz.6.1088" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 116.173620][T10291] syz.5.1095: attempt to access beyond end of device [ 116.173620][T10291] nbd5: rw=4096, sector=0, nr_sectors = 2 limit=0 [ 116.178768][T10291] XFS (nbd5): SB validate failed with error -5. [ 116.265389][T10299] xt_hashlimit: size too large, truncated to 1048576 [ 116.317375][T10301] binder: 10298:10301 ioctl 80404532 20000040 returned -22 [ 116.621353][ T39] audit: type=1400 audit(1737335357.515:900): avc: denied { listen } for pid=10309 comm="syz.7.1099" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 116.703772][ T39] audit: type=1400 audit(1737335357.595:901): avc: denied { execute } for pid=10315 comm="syz.7.1101" path="/dev/nullb0" dev="devtmpfs" ino=707 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=blk_file permissive=1 [ 116.805659][T10322] netlink: 'syz.5.1103': attribute type 10 has an invalid length. [ 116.807938][T10322] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 116.812666][T10322] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 116.855991][T10336] (unnamed net_device) (uninitialized): option tlb_dynamic_lb: mode dependency failed, not supported in mode broadcast(3) [ 116.860474][T10336] netlink: 'syz.5.1108': attribute type 2 has an invalid length. [ 116.862754][T10336] netlink: 132 bytes leftover after parsing attributes in process `syz.5.1108'. [ 116.866798][T10336] netlink: 'syz.5.1108': attribute type 2 has an invalid length. [ 116.873541][ T39] audit: type=1400 audit(1737335357.765:902): avc: denied { map } for pid=10334 comm="syz.5.1108" path="socket:[33506]" dev="sockfs" ino=33506 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_route_socket permissive=1 [ 116.935674][T10352] xt_hashlimit: size too large, truncated to 1048576 [ 116.970663][ T63] usb 12-1: new high-speed USB device number 8 using dummy_hcd [ 117.048068][T10367] hub 2-0:1.0: USB hub found [ 117.049539][T10367] hub 2-0:1.0: 2 ports detected [ 117.118312][ T39] audit: type=1400 audit(1737335358.005:903): avc: denied { bind } for pid=10373 comm="syz.3.1116" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 117.128482][T10369] syz.5.1115: attempt to access beyond end of device [ 117.128482][T10369] nbd5: rw=4096, sector=0, nr_sectors = 2 limit=0 [ 117.130858][ T63] usb 12-1: Using ep0 maxpacket: 8 [ 117.134729][ T63] usb 12-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 117.137753][ T63] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 117.140115][T10369] XFS (nbd5): SB validate failed with error -5. [ 117.141695][ T63] usb 12-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 117.145022][ T63] usb 12-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 117.148630][ T63] usb 12-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 117.158191][ T63] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 117.273055][T10387] bond0: entered promiscuous mode [ 117.274574][T10387] A: entered promiscuous mode [ 117.276053][T10387] bond_slave_1: entered promiscuous mode [ 117.278281][T10387] 8021q: adding VLAN 0 to HW filter on device macvlan2 [ 117.282900][T10387] bond0: left promiscuous mode [ 117.284308][T10387] A: left promiscuous mode [ 117.285773][T10387] bond_slave_1: left promiscuous mode [ 117.373777][ T63] usb 12-1: GET_CAPABILITIES returned 0 [ 117.375452][ T63] usbtmc 12-1:16.0: can't read capabilities [ 117.580875][T10405] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1124'. [ 117.626460][T10409] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1126'. [ 117.725422][T10420] openvswitch: netlink: IP tunnel dst address not specified [ 117.770581][ T39] audit: type=1400 audit(1737335358.665:904): avc: denied { append } for pid=10425 comm="syz.5.1130" name="fb0" dev="devtmpfs" ino=637 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:framebuf_device_t tclass=chr_file permissive=1 [ 117.789550][T10416] syz.3.1127: attempt to access beyond end of device [ 117.789550][T10416] nbd3: rw=4096, sector=0, nr_sectors = 1 limit=0 [ 117.794816][T10416] XFS (nbd3): SB validate failed with error -5. [ 117.885213][T10436] netlink: 1280 bytes leftover after parsing attributes in process `syz.3.1133'. [ 117.887808][T10436] openvswitch: netlink: Flow actions attr not present in new flow. [ 117.904635][T10436] RDS: rds_bind could not find a transport for ::ffff:100.1.1.0, load rds_tcp or rds_rdma? [ 117.931127][ C1] usbtmc 12-1:16.0: usbtmc_read_bulk_cb - nonzero read bulk status received: -71 [ 118.087343][T10455] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1139'. [ 118.094171][T10455] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1139'. [ 118.120358][T10458] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 118.125131][T10458] batadv_slave_1: entered promiscuous mode [ 118.133971][T10458] openvswitch: netlink: Missing key (keys=40, expected=2000) [ 118.164315][T10468] openvswitch: netlink: VXLAN extension message has 4 unknown bytes. [ 118.292296][T10486] xt_hashlimit: size too large, truncated to 1048576 [ 118.330981][T10491] overlayfs: failed to clone lowerpath [ 118.351151][T10492] binder: 10485:10492 ioctl 80404532 20000040 returned -22 [ 118.521983][T10506] /dev/nullb0: Can't lookup blockdev [ 118.828948][T10522] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 118.830838][T10522] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 118.833100][T10522] vhci_hcd vhci_hcd.0: Device attached [ 118.835409][T10522] bridge0: port 3(erspan0) entered blocking state [ 118.837322][T10522] bridge0: port 3(erspan0) entered disabled state [ 118.839222][T10522] erspan0: entered allmulticast mode [ 118.841586][T10522] erspan0: entered promiscuous mode [ 118.843398][T10522] bridge0: port 3(erspan0) entered blocking state [ 118.845298][T10522] bridge0: port 3(erspan0) entered forwarding state [ 118.850931][T10522] vhci_hcd vhci_hcd.0: port 0 already used [ 118.853094][T10523] vhci_hcd: connection closed [ 118.853307][ T6515] vhci_hcd: stop threads [ 118.855984][ T6515] vhci_hcd: release socket [ 118.857339][ T6515] vhci_hcd: disconnect device [ 119.702821][ T6067] usb 12-1: USB disconnect, device number 8 [ 119.780169][T10553] xt_hashlimit: size too large, truncated to 1048576 [ 119.832061][T10575] binder: 10552:10575 ioctl 80404532 20000040 returned -22 [ 119.846217][T10577] syz_tun: entered allmulticast mode [ 119.853637][T10576] syz_tun: left allmulticast mode [ 120.577307][T10619] __nla_validate_parse: 2 callbacks suppressed [ 120.577324][T10619] netlink: 32 bytes leftover after parsing attributes in process `syz.6.1181'. [ 120.589422][T10619] gfs2: path_lookup on ™6(ï+‰d‹QÌnB´!eU‚çVè!š`:Ñ 8×DSEíÄðÃÄèÎ Áy|YT¢®{-€íê°”,mb/ returned error -2 [ 120.617465][ T39] kauditd_printk_skb: 6 callbacks suppressed [ 120.617476][ T39] audit: type=1400 audit(1737335361.505:911): avc: denied { bind } for pid=10620 comm="syz.6.1182" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 120.919926][ T39] audit: type=1400 audit(1737335361.815:912): avc: denied { bind } for pid=10634 comm="syz.6.1186" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 120.997109][T10641] IPVS: ip_vs_edit_dest(): lower threshold is higher than upper threshold [ 121.000652][T10641] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1188'. [ 121.003106][T10641] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1188'. [ 121.138359][T10635] overlayfs: at least 2 lowerdir are needed while upperdir nonexistent [ 121.139568][T10650] macvlan0: entered allmulticast mode [ 121.181752][T10657] overlayfs: failed to resolve './file1': -2 [ 121.183960][T10658] overlayfs: failed to resolve './file1': -2 [ 121.188715][T10657] overlayfs: failed to resolve './file1': -2 [ 121.207615][T10660] xt_hashlimit: size too large, truncated to 1048576 [ 121.227340][T10662] futex_wake_op: syz.5.1196 tries to shift op by -1; fix this program [ 121.232726][T10662] syz.5.1196: attempt to access beyond end of device [ 121.232726][T10662] nbd5: rw=0, sector=0, nr_sectors = 2 limit=0 [ 121.236374][T10662] (syz.5.1196,10662,1):ocfs2_get_sector:1769 ERROR: status = -5 [ 121.238488][T10662] (syz.5.1196,10662,1):ocfs2_sb_probe:749 ERROR: status = -5 [ 121.240699][T10662] (syz.5.1196,10662,1):ocfs2_fill_super:990 ERROR: superblock probe failed! [ 121.243046][T10662] (syz.5.1196,10662,1):ocfs2_fill_super:1178 ERROR: status = -5 [ 121.261651][T10664] binder: 10659:10664 ioctl 80404532 20000040 returned -22 [ 121.783895][T10676] sch_tbf: burst 19872 is lower than device lo mtu (65550) ! [ 121.822290][T10681] xt_hashlimit: size too large, truncated to 1048576 [ 121.824534][T10681] xt_hashlimit: max too large, truncated to 1048576 [ 121.910643][T10684] netlink: 14 bytes leftover after parsing attributes in process `syz.6.1202'. [ 122.283282][T10692] team0: No ports can be present during mode change [ 122.331991][T10694] xt_hashlimit: size too large, truncated to 1048576 [ 122.385546][T10696] binder: 10693:10696 ioctl 80404532 20000040 returned -22 [ 122.436217][ T39] audit: type=1400 audit(1737335363.325:913): avc: denied { getopt } for pid=10697 comm="syz.5.1207" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 122.436606][T10698] tmpfs: Invalid gid '0x00000000ffffffff' [ 122.444899][T10698] fuse: Bad value for 'group_id' [ 122.447337][T10698] fuse: Bad value for 'group_id' [ 122.800587][ T6067] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 122.960546][ T6067] usb 10-1: Using ep0 maxpacket: 8 [ 122.963762][ T6067] usb 10-1: config index 0 descriptor too short (expected 301, got 45) [ 122.966869][ T6067] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 122.978026][ T6067] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 122.979831][T10729] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1216'. [ 122.981653][ T6067] usb 10-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 122.986663][ T6067] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 122.991980][ T6067] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 122.996437][ T6067] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 123.017548][T10737] Cannot find add_set index 4 as target [ 123.045559][ T39] audit: type=1400 audit(1737335363.935:914): avc: denied { listen } for pid=10741 comm="syz.6.1220" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 123.092383][T10748] xt_hashlimit: size too large, truncated to 1048576 [ 123.123668][T10746] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1218'. [ 123.153288][T10755] binder: 10747:10755 ioctl 80404532 20000040 returned -22 [ 123.210711][ T6067] usb 10-1: usb_control_msg returned -32 [ 123.212348][ T6067] usbtmc 10-1:16.0: can't read capabilities [ 123.441563][ T39] audit: type=1326 audit(1737335364.335:915): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=10758 comm="syz.6.1224" exe="/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb072185d29 code=0x7fc00000 [ 123.588778][T10770] usbtmc 10-1:16.0: usb_control_msg returned -32 [ 123.594296][ T6067] usb 10-1: USB disconnect, device number 13 [ 123.675232][T10780] openvswitch: netlink: Unknown nsh attribute 0 [ 123.677663][T10780] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 123.681154][T10779] openvswitch: netlink: Unknown nsh attribute 0 [ 123.683856][T10779] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 123.842639][T10793] sctp: [Deprecated]: syz.3.1233 (pid 10793) Use of int in maxseg socket option. [ 123.842639][T10793] Use struct sctp_assoc_value instead [ 123.888587][T10798] tmpfs: Bad value for 'mpol' [ 123.925220][T10800] xt_hashlimit: size too large, truncated to 1048576 [ 123.978846][T10802] binder: 10799:10802 ioctl 80404532 20000040 returned -22 [ 124.266342][T10812] netlink: 'syz.5.1238': attribute type 21 has an invalid length. [ 124.268597][T10812] IPv6: NLM_F_CREATE should be specified when creating new route [ 124.317565][ T39] audit: type=1400 audit(1737335365.205:916): avc: denied { mount } for pid=10814 comm="syz.5.1239" name="/" dev="tracefs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 124.341745][ T39] audit: type=1400 audit(1737335365.225:917): avc: denied { unmount } for pid=7078 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:tracefs_t tclass=filesystem permissive=1 [ 124.487476][T10827] openvswitch: netlink: Tunnel attr 6 has unexpected len 16 expected 0 [ 124.842649][T10847] xt_hashlimit: size too large, truncated to 1048576 [ 124.895297][T10854] binder: 10845:10854 ioctl 80404532 20000040 returned -22 [ 124.925719][T10857] netlink: 830 bytes leftover after parsing attributes in process `syz.5.1253'. [ 125.114853][ T65] Bluetooth: hci2: Malformed Event: 0x02 [ 125.304699][T10873] netlink: 1256 bytes leftover after parsing attributes in process `syz.7.1257'. [ 125.307072][T10873] openvswitch: netlink: Unknown key attributes 20 [ 125.398680][ T39] audit: type=1400 audit(1737335366.285:918): avc: denied { create } for pid=10874 comm="syz.7.1258" name="file0" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 125.405821][ T39] audit: type=1400 audit(1737335366.295:919): avc: denied { unlink } for pid=10874 comm="syz.7.1258" name="file0" dev="tmpfs" ino=737 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 125.443609][ T39] audit: type=1400 audit(1737335366.335:920): avc: denied { audit_read } for pid=10879 comm="syz.3.1260" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 125.447546][T10881] program syz.3.1260 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 125.493884][T10886] overlay: ./file1 is not a directory [ 125.511474][T10878] binder: 10877:10878 ioctl c0306201 20000680 returned -14 [ 125.627844][T10905] vivid-002: ================= START STATUS ================= [ 125.632617][T10905] vivid-002: Radio HW Seek Mode: Bounded [ 125.634412][T10905] vivid-002: Radio Programmable HW Seek: false [ 125.636107][T10905] vivid-002: RDS Rx I/O Mode: Block I/O [ 125.637687][T10905] vivid-002: Generate RBDS Instead of RDS: false [ 125.639506][T10905] vivid-002: RDS Reception: true [ 125.642738][T10905] vivid-002: RDS Program Type: 0 inactive [ 125.644417][T10905] vivid-002: RDS PS Name: inactive [ 125.645934][T10905] vivid-002: RDS Radio Text: inactive [ 125.647545][T10905] vivid-002: RDS Traffic Announcement: false inactive [ 125.649449][T10905] vivid-002: RDS Traffic Program: false inactive [ 125.652588][T10905] vivid-002: RDS Music: false inactive [ 125.654195][T10905] vivid-002: ================== END STATUS ================== [ 125.713009][ T39] audit: type=1400 audit(1737335366.605:921): avc: denied { create } for pid=10912 comm="syz.7.1270" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 125.719062][ T39] audit: type=1400 audit(1737335366.605:922): avc: denied { create } for pid=10912 comm="syz.7.1270" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_dnrt_socket permissive=1 [ 125.734379][T10918] xt_hashlimit: size too large, truncated to 1048576 [ 125.785519][T10910] binder: 10909:10910 ioctl 80404532 20000040 returned -22 [ 125.786087][ T39] audit: type=1400 audit(1737335366.675:923): avc: denied { listen } for pid=10925 comm="syz.3.1273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 125.794016][ T39] audit: type=1400 audit(1737335366.675:924): avc: denied { write } for pid=10925 comm="syz.3.1273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 125.800498][ T39] audit: type=1400 audit(1737335366.675:925): avc: denied { listen } for pid=10925 comm="syz.3.1273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 125.806065][ T39] audit: type=1400 audit(1737335366.675:926): avc: denied { accept } for pid=10925 comm="syz.3.1273" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 125.850361][T10930] syz_tun: entered allmulticast mode [ 126.002409][T10935] xt_hashlimit: size too large, truncated to 1048576 [ 126.329261][T10941] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1277'. [ 126.615439][T10925] syz_tun: left allmulticast mode [ 126.655439][T10960] xt_hashlimit: size too large, truncated to 1048576 [ 126.673358][T10961] netlink: 20 bytes leftover after parsing attributes in process `syz.7.1283'. [ 126.707023][T10964] binder: 10959:10964 ioctl 80404532 20000040 returned -22 [ 126.744389][T10968] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1286'. [ 126.757699][T10968] netlink: 80 bytes leftover after parsing attributes in process `syz.7.1286'. [ 126.762066][ T39] audit: type=1400 audit(1737335367.655:927): avc: denied { read write } for pid=10967 comm="syz.7.1286" name="uhid" dev="devtmpfs" ino=1296 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 126.769166][ T39] audit: type=1400 audit(1737335367.655:928): avc: denied { open } for pid=10967 comm="syz.7.1286" path="/dev/uhid" dev="devtmpfs" ino=1296 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:uhid_device_t tclass=chr_file permissive=1 [ 126.776709][T10968] netlink: 'syz.7.1286': attribute type 5 has an invalid length. [ 127.103740][T10979] JFS: discard option not supported on device [ 127.106677][T10979] syz.7.1289: attempt to access beyond end of device [ 127.106677][T10979] nbd7: rw=0, sector=64, nr_sectors = 8 limit=0 [ 127.116629][T10979] syz.7.1289: attempt to access beyond end of device [ 127.116629][T10979] nbd7: rw=0, sector=120, nr_sectors = 8 limit=0 [ 127.120737][T10979] Mount JFS Failure: -5 [ 127.204838][ T39] audit: type=1400 audit(1737335368.095:929): avc: denied { write } for pid=10983 comm="syz.3.1291" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 127.603102][T11002] xt_hashlimit: size too large, truncated to 1048576 [ 127.661542][T11004] binder: 11001:11004 ioctl 80404532 20000040 returned -22 [ 128.039282][T11017] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1302'. [ 128.142102][T11026] binder: BINDER_SET_CONTEXT_MGR already set [ 128.143899][T11026] binder: 11025:11026 ioctl 4018620d 20000100 returned -16 [ 128.146974][T11026] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1305'. [ 128.149473][T11026] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1305'. [ 128.152885][T11027] netlink: 16 bytes leftover after parsing attributes in process `syz.5.1305'. [ 128.155933][T11026] netlink: 64138 bytes leftover after parsing attributes in process `syz.5.1305'. [ 128.201735][T11032] 8021q: adding VLAN 0 to HW filter on device bond1 [ 128.205269][T11032] bond0: (slave bond1): Enslaving as an active interface with an up link [ 128.330226][T11037] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 128.390885][T11048] 9pnet_fd: Insufficient options for proto=fd [ 128.391100][T11049] 9pnet_fd: Insufficient options for proto=fd [ 128.581041][T11062] xt_hashlimit: size too large, truncated to 1048576 [ 128.632693][T11069] binder: 11061:11069 ioctl 80404532 20000040 returned -22 [ 128.676771][ T39] audit: type=1400 audit(1737335369.565:930): avc: denied { create } for pid=11073 comm="syz.6.1316" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmpvc_socket permissive=1 [ 129.049903][ T5937] Bluetooth: hci2: command 0x0c1a tx timeout [ 129.571662][T11110] xt_hashlimit: size too large, truncated to 1048576 [ 129.618828][T11112] netlink: 'syz.6.1330': attribute type 10 has an invalid length. [ 129.621509][T11112] bond0: (slave wlan1): Opening slave failed [ 129.624588][T11115] binder: 11109:11115 ioctl 80404532 20000040 returned -22 [ 129.626815][T11111] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 130.002880][T11121] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1332'. [ 130.571926][T11145] netlink: 'syz.6.1340': attribute type 10 has an invalid length. [ 130.580369][T11145] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 130.583779][T11145] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 130.622117][T11147] openvswitch: netlink: Either Ethernet header or EtherType is required. [ 130.937725][T11165] 9pnet_fd: Insufficient options for proto=fd [ 131.129858][ T65] Bluetooth: hci2: command 0x0c1a tx timeout [ 131.209957][ T1020] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 131.369834][ T1020] usb 10-1: Using ep0 maxpacket: 32 [ 131.376506][ T1020] usb 10-1: config 1 interface 0 altsetting 6 bulk endpoint 0x1 has invalid maxpacket 64 [ 131.382058][ T1020] usb 10-1: config 1 interface 0 has no altsetting 0 [ 131.386086][ T1020] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 131.388832][ T1020] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 131.391694][ T1020] usb 10-1: Product: syz [ 131.393218][ T1020] usb 10-1: Manufacturer: syz [ 131.395144][ T1020] usb 10-1: SerialNumber: syz [ 131.400710][T11167] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 131.549534][ T39] audit: type=1400 audit(1737335372.435:931): avc: denied { connect } for pid=11204 comm="syz.6.1351" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 131.577385][T11209] tipc: Failed to remove unknown binding: 66,1,1/0:3754177654/3754177656 [ 131.609589][ T1020] usb 10-1: USB disconnect, device number 14 [ 131.611852][T11213] xt_hashlimit: size too large, truncated to 1048576 [ 131.728957][T11219] tipc: Failed to remove unknown binding: 66,1,1/0:3754177654/3754177656 [ 131.731102][T11218] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 131.733756][T11219] tipc: Failed to remove unknown binding: 66,1,1/0:3754177654/3754177656 [ 131.786630][T11222] xt_l2tp: v2 tid > 0xffff: 150994944 [ 131.821870][ T39] audit: type=1326 audit(1737335372.715:932): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11166 comm="syz.5.1348" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f0fe9585d29 code=0x0 [ 131.928148][ T39] audit: type=1400 audit(1737335372.815:933): avc: denied { append } for pid=11224 comm="syz.7.1356" name="sg0" dev="devtmpfs" ino=721 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 131.990277][T11226] __nla_validate_parse: 1 callbacks suppressed [ 131.990288][T11226] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1356'. [ 132.008759][T11240] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1361'. [ 132.067446][T11243] netlink: 'syz.3.1361': attribute type 26 has an invalid length. [ 132.199898][ T63] usb 10-1: new low-speed USB device number 15 using dummy_hcd [ 132.206487][T11249] openvswitch: netlink: IP tunnel TTL not specified. [ 132.216023][T11249] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1365'. [ 132.251569][T11251] netlink: 'syz.7.1366': attribute type 2 has an invalid length. [ 132.339914][ T63] usb 10-1: device descriptor read/64, error -71 [ 132.367988][T11258] workqueue: Failed to create a rescuer kthread for wq "nfc3_nci_tx_wq": -EINTR [ 132.562677][ T1416] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.568315][ T1416] ieee802154 phy1 wpan1: encryption failed: -22 [ 132.589934][ T63] usb 10-1: new low-speed USB device number 16 using dummy_hcd [ 132.638601][T11274] ubi0: attaching mtd0 [ 132.645020][T11274] ubi0: scanning is finished [ 132.646961][T11274] ubi0: empty MTD device detected [ 132.730498][ T63] usb 10-1: device descriptor read/64, error -71 [ 132.756721][T11274] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB) [ 132.758970][T11274] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 132.760367][ T39] audit: type=1400 audit(1737335373.645:934): avc: denied { setopt } for pid=11280 comm="syz.6.1373" lport=40404 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 132.761385][T11274] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 132.773846][T11274] ubi0: VID header offset: 64 (aligned 64), data offset: 128 [ 132.776067][T11274] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 132.777996][T11274] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 132.780758][T11274] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 4227478719 [ 132.783632][T11274] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 132.786576][T11282] ubi0: background thread "ubi_bgt0d" started, PID 11282 [ 132.839968][ T63] usb usb10-port1: attempt power cycle [ 132.857032][ T39] audit: type=1326 audit(1737335373.745:935): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11290 comm="syz.6.1376" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb072185d29 code=0x0 [ 132.959069][ T39] audit: type=1326 audit(1737335373.845:936): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=11290 comm="syz.6.1376" exe="/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fb072185d29 code=0x0 [ 132.981689][T11296] ebt_among: wrong size: 2080 against expected 2280, rounded to 2280 [ 132.986323][T11296] cgroup: Unknown subsys name 'cpuset' [ 133.015423][T11298] netlink: 'syz.6.1378': attribute type 10 has an invalid length. [ 133.018032][T11298] bond0: (slave wlan1): Opening slave failed [ 133.041985][T11297] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 133.199949][ T63] usb 10-1: new low-speed USB device number 17 using dummy_hcd [ 133.209998][ T65] Bluetooth: hci2: command 0x0c1a tx timeout [ 133.222246][ T63] usb 10-1: device descriptor read/8, error -71 [ 133.414151][T11301] xt_hashlimit: size too large, truncated to 1048576 [ 133.472255][T11303] binder: 11300:11303 ioctl 80404532 20000040 returned -22 [ 133.479957][ T63] usb 10-1: new low-speed USB device number 18 using dummy_hcd [ 133.510335][ T63] usb 10-1: device descriptor read/8, error -71 [ 133.581690][T11305] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1380'. [ 133.586594][T11305] netlink: 4 bytes leftover after parsing attributes in process `syz.6.1380'. [ 133.589260][T11305] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 133.591862][T11305] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 133.594708][T11305] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 133.596941][T11305] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 133.619933][ T63] usb usb10-port1: unable to enumerate USB device [ 133.622216][T11305] bond0: (slave batadv0): Releasing backup interface [ 133.798818][T11307] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=770 sclass=netlink_route_socket pid=11307 comm=syz.6.1381 [ 133.869456][T11314] sctp: [Deprecated]: syz.6.1383 (pid 11314) Use of struct sctp_assoc_value in delayed_ack socket option. [ 133.869456][T11314] Use struct sctp_sack_info instead [ 133.895675][T11314] 9pnet: Could not find request transport: virtik [ 134.094418][T11240] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 134.272794][T11340] netlink: 32 bytes leftover after parsing attributes in process `syz.7.1390'. [ 134.334202][T11352] xt_hashlimit: size too large, truncated to 1048576 [ 134.386025][T11356] binder: 11351:11356 ioctl 80404532 20000040 returned -22 [ 134.670427][ T2296] usb 12-1: new low-speed USB device number 9 using dummy_hcd [ 134.832090][ T2296] usb 12-1: config 168 descriptor has 1 excess byte, ignoring [ 134.835316][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 134.839425][ T2296] usb 12-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 134.839978][T11373] 9pnet_fd: Insufficient options for proto=fd [ 134.841263][T11374] netlink: 124 bytes leftover after parsing attributes in process `syz.3.1400'. [ 134.841689][T11374] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1400'. [ 134.845986][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 134.853170][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 134.857668][ T2296] usb 12-1: config 168 descriptor has 1 excess byte, ignoring [ 134.861636][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 134.864700][ T2296] usb 12-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 134.868131][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 134.871400][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 134.875370][ T2296] usb 12-1: config 168 descriptor has 1 excess byte, ignoring [ 134.877548][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 134.882445][ T2296] usb 12-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 134.885792][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 134.889006][ T2296] usb 12-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 134.894781][ T2296] usb 12-1: string descriptor 0 read error: -22 [ 134.896908][ T2296] usb 12-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 134.899537][ T2296] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.909102][T11382] batadv_slave_1: left promiscuous mode [ 134.909884][ T2296] adutux 12-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 134.910951][T11382] batadv_slave_1: entered allmulticast mode [ 134.916501][ T39] audit: type=1400 audit(1737335375.805:937): avc: denied { connect } for pid=11383 comm="syz.6.1404" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=qipcrtr_socket permissive=1 [ 134.924019][ T39] audit: type=1400 audit(1737335375.815:938): avc: denied { shutdown } for pid=11385 comm="syz.5.1405" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1 [ 134.925280][T11386] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 134.929700][ T39] audit: type=1400 audit(1737335375.815:939): avc: denied { mount } for pid=11385 comm="syz.5.1405" name="/" dev="nfsd" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 134.939619][T11386] overlayfs: fs on './file0' does not support file handles, falling back to xino=off. [ 134.958479][ T39] audit: type=1400 audit(1737335375.845:940): avc: denied { unmount } for pid=7078 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nfsd_fs_t tclass=filesystem permissive=1 [ 134.972690][T11393] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 134.974753][T11393] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 134.978280][T11394] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 134.980509][T11393] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 134.982622][T11393] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 134.984664][T11393] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 134.986698][T11393] IPVS: nq: UDP 224.0.0.2:0 - no destination available [ 135.006429][T11399] veth0_to_bond: entered promiscuous mode [ 135.024021][T11402] syz.3.1410: attempt to access beyond end of device [ 135.024021][T11402] nbd3: rw=0, sector=2, nr_sectors = 2 limit=0 [ 135.028412][T11402] syz.3.1410: attempt to access beyond end of device [ 135.028412][T11402] nbd3: rw=0, sector=16, nr_sectors = 2 limit=0 [ 135.135812][T11414] xt_hashlimit: size too large, truncated to 1048576 [ 135.159239][ T2296] usb 12-1: USB disconnect, device number 9 [ 135.189003][T11421] binder: 11413:11421 ioctl 80404532 20000040 returned -22 [ 135.301298][T11425] cgroup: noprefix used incorrectly [ 135.739195][T11445] syz.3.1422: attempt to access beyond end of device [ 135.739195][T11445] nbd3: rw=0, sector=0, nr_sectors = 1 limit=0 [ 135.872595][T11451] netlink: 'syz.3.1424': attribute type 4 has an invalid length. [ 135.906093][T11457] loop2: detected capacity change from 0 to 7 [ 135.912374][T11457] loop2: [POWERTEC] p1 [ 135.916240][T11457] loop2: p1 start 791543808 is beyond EOD, truncated [ 136.188317][T11478] [ 136.189063][T11478] ====================================================== [ 136.191099][T11478] WARNING: possible circular locking dependency detected [ 136.193081][T11478] 6.13.0-rc7-syzkaller-00209-g9528d418de4d #0 Not tainted [ 136.195566][T11478] ------------------------------------------------------ [ 136.198278][T11478] syz.7.1433/11478 is trying to acquire lock: [ 136.200142][T11478] ffff88804fce3570 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}, at: walk_component+0x342/0x5b0 [ 136.203120][T11478] [ 136.203120][T11478] but task is already holding lock: [ 136.205219][T11478] ffff8880351c1088 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x27b/0x500 [ 136.207877][T11478] [ 136.207877][T11478] which lock already depends on the new lock. [ 136.207877][T11478] [ 136.210829][T11478] [ 136.210829][T11478] the existing dependency chain (in reverse order) is: [ 136.213361][T11478] [ 136.213361][T11478] -> #3 (&of->mutex){+.+.}-{4:4}: [ 136.215438][T11478] __mutex_lock+0x19b/0xa60 [ 136.216899][T11478] kernfs_fop_write_iter+0x27b/0x500 [ 136.218560][T11478] iter_file_splice_write+0x90f/0x10b0 [ 136.220235][T11478] do_splice+0x145c/0x1f60 [ 136.221631][T11478] __do_splice+0x327/0x360 [ 136.222901][T11478] __x64_sys_splice+0x187/0x250 [ 136.224448][T11478] do_syscall_64+0xcd/0x250 [ 136.225894][T11478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.227708][T11478] [ 136.227708][T11478] -> #2 (&pipe->mutex){+.+.}-{4:4}: [ 136.229847][T11478] __mutex_lock+0x19b/0xa60 [ 136.231427][T11478] pipe_lock+0x64/0x80 [ 136.232790][T11478] iter_file_splice_write+0x1eb/0x10b0 [ 136.234480][T11478] do_splice+0x145c/0x1f60 [ 136.235914][T11478] __do_splice+0x327/0x360 [ 136.237332][T11478] __x64_sys_splice+0x187/0x250 [ 136.238851][T11478] do_syscall_64+0xcd/0x250 [ 136.240273][T11478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.242108][T11478] [ 136.242108][T11478] -> #1 (sb_writers#6){.+.+}-{0:0}: [ 136.244112][T11478] mnt_want_write+0x6f/0x450 [ 136.245542][T11478] ovl_fileattr_set+0x10a/0x2c0 [ 136.247072][T11478] vfs_fileattr_set+0x7cc/0xc00 [ 136.248616][T11478] do_vfs_ioctl+0x24b/0x1990 [ 136.250070][T11478] __x64_sys_ioctl+0x11d/0x200 [ 136.251588][T11478] do_syscall_64+0xcd/0x250 [ 136.253024][T11478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.254822][T11478] [ 136.254822][T11478] -> #0 (&ovl_i_mutex_dir_key[depth]#2){++++}-{4:4}: [ 136.257294][T11478] __lock_acquire+0x249e/0x3c40 [ 136.258855][T11478] lock_acquire.part.0+0x11b/0x380 [ 136.260487][T11478] down_read+0x9a/0x330 [ 136.261861][T11478] walk_component+0x342/0x5b0 [ 136.263360][T11478] path_lookupat+0x17f/0x770 [ 136.264838][T11478] filename_lookup+0x221/0x5f0 [ 136.266360][T11478] kern_path+0x35/0x50 [ 136.267693][T11478] lookup_bdev+0xd9/0x280 [ 136.269119][T11478] resume_store+0x1d8/0x460 [ 136.270595][T11478] kobj_attr_store+0x55/0x80 [ 136.272077][T11478] sysfs_kf_write+0x117/0x170 [ 136.273571][T11478] kernfs_fop_write_iter+0x33d/0x500 [ 136.275253][T11478] vfs_write+0x5ae/0x1150 [ 136.276652][T11478] ksys_write+0x12b/0x250 [ 136.278053][T11478] do_syscall_64+0xcd/0x250 [ 136.279516][T11478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.281360][T11478] [ 136.281360][T11478] other info that might help us debug this: [ 136.281360][T11478] [ 136.284265][T11478] Chain exists of: [ 136.284265][T11478] &ovl_i_mutex_dir_key[depth]#2 --> &pipe->mutex --> &of->mutex [ 136.284265][T11478] [ 136.288120][T11478] Possible unsafe locking scenario: [ 136.288120][T11478] [ 136.290262][T11478] CPU0 CPU1 [ 136.291808][T11478] ---- ---- [ 136.293343][T11478] lock(&of->mutex); [ 136.294505][T11478] lock(&pipe->mutex); [ 136.296397][T11478] lock(&of->mutex); [ 136.298271][T11478] rlock(&ovl_i_mutex_dir_key[depth]#2); [ 136.299920][T11478] [ 136.299920][T11478] *** DEADLOCK *** [ 136.299920][T11478] [ 136.302507][T11478] 4 locks held by syz.7.1433/11478: [ 136.304006][T11478] #0: ffff8880518a09b8 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x267/0x390 [ 136.306590][T11478] #1: ffff88802aae8420 (sb_writers#9){.+.+}-{0:0}, at: ksys_write+0x12b/0x250 [ 136.309155][T11478] #2: ffff8880351c1088 (&of->mutex){+.+.}-{4:4}, at: kernfs_fop_write_iter+0x27b/0x500 [ 136.311908][T11478] #3: ffff88810169ca58 (kn->active#69){.+.+}-{0:0}, at: kernfs_fop_write_iter+0x29e/0x500 [ 136.314765][T11478] [ 136.314765][T11478] stack backtrace: [ 136.316463][T11478] CPU: 0 UID: 0 PID: 11478 Comm: syz.7.1433 Not tainted 6.13.0-rc7-syzkaller-00209-g9528d418de4d #0 [ 136.319588][T11478] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 136.319998][T11469] syz.6.1431: vmalloc error: size 3457024, failed to allocated page array size 6752, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null) [ 136.322662][T11478] Call Trace: [ 136.322669][T11478] [ 136.322675][T11478] dump_stack_lvl+0x116/0x1f0 [ 136.326838][T11469] ,cpuset=/ [ 136.327799][T11478] print_circular_bug+0x419/0x5d0 [ 136.328640][T11469] ,mems_allowed=0-1 [ 136.329966][T11478] check_noncircular+0x31a/0x400 [ 136.329982][T11478] ? stack_trace_save+0x95/0xd0 [ 136.329999][T11478] ? __pfx_check_noncircular+0x10/0x10 [ 136.330012][T11478] ? add_lock_to_list+0x17d/0x390 [ 136.333640][T11469] [ 136.334802][T11478] __lock_acquire+0x249e/0x3c40 [ 136.341334][T11478] ? __pfx___lock_acquire+0x10/0x10 [ 136.342838][T11478] ? lock_acquire.part.0+0x11b/0x380 [ 136.344364][T11478] ? find_held_lock+0x2d/0x110 [ 136.345775][T11478] lock_acquire.part.0+0x11b/0x380 [ 136.347265][T11478] ? walk_component+0x342/0x5b0 [ 136.348668][T11478] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 136.350281][T11478] ? rcu_is_watching+0x12/0xc0 [ 136.351672][T11478] ? trace_lock_acquire+0x14e/0x1f0 [ 136.353180][T11478] ? walk_component+0x342/0x5b0 [ 136.354603][T11478] ? lock_acquire+0x2f/0xb0 [ 136.355921][T11478] ? walk_component+0x342/0x5b0 [ 136.357335][T11478] down_read+0x9a/0x330 [ 136.358575][T11478] ? walk_component+0x342/0x5b0 [ 136.359985][T11478] ? __pfx_down_read+0x10/0x10 [ 136.361381][T11478] ? lookup_fast+0x155/0x540 [ 136.362751][T11478] walk_component+0x342/0x5b0 [ 136.364115][T11478] path_lookupat+0x17f/0x770 [ 136.365469][T11478] filename_lookup+0x221/0x5f0 [ 136.366862][T11478] ? __pfx_filename_lookup+0x10/0x10 [ 136.368393][T11478] ? getname_kernel+0x52/0x370 [ 136.369775][T11478] ? __asan_memcpy+0x3c/0x60 [ 136.371134][T11478] kern_path+0x35/0x50 [ 136.372318][T11478] lookup_bdev+0xd9/0x280 [ 136.373570][T11478] ? __pfx_lookup_bdev+0x10/0x10 [ 136.374953][T11478] ? __asan_memcpy+0x3c/0x60 [ 136.376265][T11478] resume_store+0x1d8/0x460 [ 136.377578][T11478] ? __pfx_resume_store+0x10/0x10 [ 136.379054][T11478] ? __pfx_lock_acquire.part.0+0x10/0x10 [ 136.380665][T11478] ? rcu_is_watching+0x12/0xc0 [ 136.382056][T11478] ? __pfx_resume_store+0x10/0x10 [ 136.383528][T11478] kobj_attr_store+0x55/0x80 [ 136.384866][T11478] ? __pfx_kobj_attr_store+0x10/0x10 [ 136.386399][T11478] sysfs_kf_write+0x117/0x170 [ 136.387762][T11478] kernfs_fop_write_iter+0x33d/0x500 [ 136.389283][T11478] ? __pfx_sysfs_kf_write+0x10/0x10 [ 136.390792][T11478] vfs_write+0x5ae/0x1150 [ 136.392048][T11478] ? __pfx_kernfs_fop_write_iter+0x10/0x10 [ 136.393725][T11478] ? __pfx___mutex_lock+0x10/0x10 [ 136.395180][T11478] ? __pfx_vfs_write+0x10/0x10 [ 136.396566][T11478] ksys_write+0x12b/0x250 [ 136.397816][T11478] ? __pfx_ksys_write+0x10/0x10 [ 136.399224][T11478] do_syscall_64+0xcd/0x250 [ 136.400540][T11478] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.402258][T11478] RIP: 0033:0x7fd900785d29 [ 136.403580][T11478] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 136.409053][T11478] RSP: 002b:00007fd9005f9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 136.411426][T11478] RAX: ffffffffffffffda RBX: 00007fd900975fa0 RCX: 00007fd900785d29 [ 136.413673][T11478] RDX: 0000000000000012 RSI: 0000000020000040 RDI: 0000000000000003 [ 136.415930][T11478] RBP: 00007fd900801b08 R08: 0000000000000000 R09: 0000000000000000 [ 136.418170][T11478] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.420426][T11478] R13: 0000000000000000 R14: 00007fd900975fa0 R15: 00007ffc72be86e8 [ 136.422676][T11478] [ 136.423569][T11469] CPU: 3 UID: 0 PID: 11469 Comm: syz.6.1431 Not tainted 6.13.0-rc7-syzkaller-00209-g9528d418de4d #0 [ 136.423663][ C0] vkms_vblank_simulate: vblank timer overrun [ 136.426650][T11469] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2~bpo12+1 04/01/2014 [ 136.430145][T11478] syz.7.1433: attempt to access beyond end of device [ 136.430145][T11478] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 136.431395][T11469] Call Trace: [ 136.435043][T11478] PM: Image not found (code -5) [ 136.435953][T11469] [ 136.438234][T11469] dump_stack_lvl+0x16c/0x1f0 [ 136.439607][T11469] warn_alloc+0x24d/0x3a0 [ 136.440850][T11469] ? __pfx_warn_alloc+0x10/0x10 [ 136.442248][T11469] ? __get_vm_area_node+0x1b0/0x2f0 [ 136.443755][T11469] ? __get_vm_area_node+0x1dc/0x2f0 [ 136.445264][T11469] __vmalloc_node_range_noprof+0x1105/0x1530 [ 136.446989][T11469] ? ip_set_sockfn_get+0x18f/0xd10 [ 136.448481][T11469] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 136.450275][T11469] ? __get_vm_area_node+0x1b0/0x2f0 [ 136.451790][T11469] ? __get_vm_area_node+0x1dc/0x2f0 [ 136.453302][T11469] __vmalloc_node_range_noprof+0xd85/0x1530 [ 136.454996][T11469] ? ip_set_sockfn_get+0x18f/0xd10 [ 136.456476][T11469] ? cred_has_capability.isra.0+0x192/0x2f0 [ 136.458194][T11469] ? ip_set_sockfn_get+0x18f/0xd10 [ 136.459692][T11469] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 136.461480][T11469] ? __pfx_lock_release+0x10/0x10 [ 136.462935][T11469] ? trace_lock_acquire+0x14e/0x1f0 [ 136.464385][T11469] ? __mutex_unlock_slowpath+0x164/0x690 [ 136.465951][T11469] ? cap_capable+0x1cf/0x240 [ 136.467274][T11469] ? ip_set_sockfn_get+0x18f/0xd10 [ 136.468769][T11469] vmalloc_noprof+0x6b/0x90 [ 136.470080][T11469] ? ip_set_sockfn_get+0x18f/0xd10 [ 136.471563][T11469] ip_set_sockfn_get+0x18f/0xd10 [ 136.472986][T11469] ? __pfx_lock_release+0x10/0x10 [ 136.474437][T11469] ? __pfx_ip_set_sockfn_get+0x10/0x10 [ 136.475998][T11469] ? nf_sockopt_find.constprop.0+0x221/0x290 [ 136.477715][T11469] nf_getsockopt+0x79/0xe0 [ 136.479026][T11469] ip_getsockopt+0x18e/0x1e0 [ 136.480365][T11469] ? __pfx_ip_getsockopt+0x10/0x10 [ 136.481840][T11469] ? lock_acquire+0x2f/0xb0 [ 136.483156][T11469] ? __might_fault+0xe3/0x190 [ 136.484516][T11469] ? __might_fault+0xe3/0x190 [ 136.485901][T11469] raw_getsockopt+0x4d/0x1e0 [ 136.487248][T11469] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 136.488959][T11469] do_sock_getsockopt+0x3fe/0x800 [ 136.490425][T11469] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 136.492025][T11469] ? lock_acquire+0x2f/0xb0 [ 136.493340][T11469] ? __fget_files+0x40/0x3a0 [ 136.494677][T11469] ? __fget_files+0x206/0x3a0 [ 136.496042][T11469] __sys_getsockopt+0x12f/0x260 [ 136.497449][T11469] __x64_sys_getsockopt+0xbd/0x160 [ 136.498932][T11469] ? do_syscall_64+0x91/0x250 [ 136.500293][T11469] ? lockdep_hardirqs_on+0x7c/0x110 [ 136.501787][T11469] do_syscall_64+0xcd/0x250 [ 136.503077][T11469] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 136.504742][T11469] RIP: 0033:0x7fb072185d29 [ 136.506020][T11469] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 136.511506][T11469] RSP: 002b:00007fb072f3b038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 136.513802][T11469] RAX: ffffffffffffffda RBX: 00007fb072375fa0 RCX: 00007fb072185d29 [ 136.515970][T11469] RDX: 0000000000000053 RSI: 0000000000000000 RDI: 0000000000000004 [ 136.518258][T11469] RBP: 00007fb072201b08 R08: 0000000020000080 R09: 0000000000000000 [ 136.520448][T11469] R10: 0000000020000000 R11: 0000000000000246 R12: 0000000000000000 [ 136.522604][T11469] R13: 0000000000000000 R14: 00007fb072375fa0 R15: 00007ffe0321da98 [ 136.524866][T11469] [ 136.529122][T11469] Mem-Info: [ 136.530382][T11469] active_anon:28 inactive_anon:24942 isolated_anon:0 [ 136.530382][T11469] active_file:22739 inactive_file:23177 isolated_file:0 [ 136.530382][T11469] unevictable:18055 dirty:21 writeback:0 [ 136.530382][T11469] slab_reclaimable:7820 slab_unreclaimable:79973 [ 136.530382][T11469] mapped:24320 shmem:19291 pagetables:1141 [ 136.530382][T11469] sec_pagetables:307 bounce:0 [ 136.530382][T11469] kernel_misc_reclaimable:0 [ 136.530382][T11469] free:375673 free_pcp:7156 free_cma:0 [ 136.545275][T11469] Node 0 active_anon:280kB inactive_anon:99600kB active_file:22692kB inactive_file:159036kB unevictable:68684kB isolated(anon):0kB isolated(file):0kB mapped:97280kB dirty:84kB writeback:0kB shmem:73616kB shmem_thp:2048kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:13648kB pagetables:4564kB sec_pagetables:1228kB all_unreclaimable? no [ 136.554599][T11469] Node 1 active_anon:0kB inactive_anon:0kB active_file:1856kB inactive_file:80kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:3548kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:112kB pagetables:0kB sec_pagetables:0kB all_unreclaimable? no [ 136.564175][T11469] Node 0 DMA free:368kB boost:0kB min:340kB low:424kB high:508kB reserved_highatomic:0KB active_anon:0kB inactive_anon:4kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:564kB local_pcp:96kB free_cma:0kB [ 136.572150][T11469] lowmem_reserve[]: 0 1240 0 0 0 [ 136.573611][T11469] Node 0 DMA32 free:31280kB boost:0kB min:27608kB low:34508kB high:41408kB reserved_highatomic:0KB active_anon:52632kB inactive_anon:47252kB active_file:49272kB inactive_file:132452kB unevictable:68684kB writepending:92kB present:2080628kB managed:1269888kB mlocked:0kB bounce:0kB free_pcp:8908kB local_pcp:256kB free_cma:0kB [ 136.581518][T11469] lowmem_reserve[]: 0 0 0 0 0 [ 136.589547][T11469] Node 1 Normal free:1471456kB boost:0kB min:39632kB low:49540kB high:59448kB reserved_highatomic:0KB active_anon:16kB inactive_anon:0kB active_file:1856kB inactive_file:80kB unevictable:3536kB writepending:0kB present:2097152kB managed:1781924kB mlocked:0kB bounce:0kB free_pcp:19276kB local_pcp:3344kB free_cma:0kB [ 136.597538][T11469] lowmem_reserve[]: 0 0 0 0 0 [ 136.598867][T11469] Node 0 DMA: 19*4kB (U) 6*8kB (U) 5*16kB (U) 1*32kB (U) 1*64kB (U) 1*128kB (U) 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 428kB [ 136.602656][T11469] Node 0 DMA32: 226*4kB (UME) 193*8kB (UME) 92*16kB (UME) 188*32kB (UME) 81*64kB (UME) 36*128kB (UME) 21*256kB (UME) 8*512kB (UM) 1*1024kB (M) 1*2048kB (M) 0*4096kB = 32272kB [ 136.607316][T11469] Node 1 Normal: 12*4kB (UME) 14*8kB (UME) 8*16kB (M) 67*32kB (UME) 9*64kB (UM) 15*128kB (ME) 6*256kB (ME) 9*512kB (UME) 6*1024kB (ME) 6*2048kB (UME) 352*4096kB (UM) = 1471296kB [ 136.612586][T11469] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 136.615283][T11469] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 136.617933][T11469] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 136.620884][T11469] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 136.623524][T11469] 81495 total pagecache pages [ 136.624893][T11469] 0 pages in swap cache [ 136.626081][T11469] Free swap = 124012kB [ 136.627275][T11469] Total swap = 124996kB [ 136.628485][T11469] 1048443 pages RAM [ 136.629589][T11469] 0 pages HighMem/MovableOnly [ 136.631261][T11469] 281650 pages reserved [ 136.632484][T11469] 0 pages cma reserved [ 136.735674][T11469] caif:caif_disconnect_client(): nothing to disconnect VM DIAGNOSIS: 01:09:37 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000069 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff851bf415 RDI=ffffffff9ab15b20 RBP=ffffffff9ab15ae0 RSP=ffffc900044a6f38 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=722d302e33312e36 R12=0000000000000000 R13=0000000000000069 R14=ffffffff851bf3b0 R15=0000000000000000 RIP=ffffffff851bf43f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007fd9005f96c0 ffffffff 00c00000 GS =0000 ffff88806a600000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000020001000 CR3=0000000000c04000 CR4=00352ef0 DR0=000000000000126c DR1=0000000000000003 DR2=0000000000000081 DR3=0000000000000002 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802a9a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802aa7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802aa1 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802ab5 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802b3b ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802c19 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd90094b488 00007fd90094b480 00007fd90094b478 00007fd90094b450 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd9014ad100 00007fd90094b440 00007fd90094b458 00007fd90094b4a0 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd90094b498 00007fd90094b490 00007fd90094b488 00007fd90094b480 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=0000000000000000 RBX=ffff88806a646860 RCX=ffffffff818e08bc RDX=ffff88802718a440 RSI=ffffffff818e0896 RDI=0000000000000005 RBP=0000000000000003 RSP=ffffc9000631f998 R8 =0000000000000005 R9 =0000000000000000 R10=0000000000000001 R11=0000000000000000 R12=ffffed100d4c8d0d R13=0000000000000001 R14=ffff88806a646868 R15=ffff88806a73fe40 RIP=ffffffff818e0898 RFL=00000293 [--S-A-C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88806a700000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000110c3e148c CR3=000000000df7e000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=000000000000003f Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c802a9a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c802aa7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c802aa1 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c802ab5 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c802b3b ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c802c19 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c94b488 00007f0a9c94b480 00007f0a9c94b478 00007f0a9c94b450 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9d4ad100 00007f0a9c94b440 00007f0a9c94b458 0004000700080006 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0a9c94b498 00007f0a9c94b490 00007f0a9c94b488 00007f0a9c94b480 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 6161616161616161 6161616161616161 6161616161616161 6161616161616161 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=0000000000000000 RBX=000000000001244a RCX=ffffffff81d6337f RDX=ffff888020964880 RSI=0000000000000001 RDI=0000000000000000 RBP=0000000000000001 RSP=ffffc9000163efa0 R8 =0000000000000005 R9 =0000000000000000 R10=0000000080000001 R11=0000000000000b92 R12=0000000080000001 R13=0000000000000008 R14=1ffff920002c7df7 R15=0000000000000001 RIP=ffffffff819a0f40 RFL=00000246 [---Z-P-] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c01300 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c01300 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff88806a800000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fd9005f8f98 CR3=0000000059e58000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008001 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802a9a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802aa7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802aa1 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802ab5 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802b3b ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd900802c19 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd90094b488 00007fd90094b480 00007fd90094b478 00007fd90094b450 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd9014ad100 00007fd90094b440 00007fd90094b458 00007fd90094b4a0 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007fd90094b498 00007fd90094b490 00007fd90094b488 00007fd90094b480 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=dffffc0000000000 RBX=ffffffff9aa69df0 RCX=ffffffff84a5b3cf RDX=0000000000000000 RSI=ffffffff8bd217a0 RDI=ffffffff9aa69df4 RBP=1ffff92001b99eae RSP=ffffc9000dccf568 R8 =0000000000000000 R9 =fffffbfff20bef92 R10=ffffffff905f7c97 R11=00000000000a4001 R12=ffffffff9aa69de8 R13=0000000000002115 R14=0000000000000000 R15=ffffc900355ef000 RIP=ffffffff817732a2 RFL=00000807 [-O---PC] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 00007f0fea3ac6c0 ffffffff 00c00000 GS =0000 ffff88806a900000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=00007fd6b49fff78 CR3=0000000048768000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000fffe0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000008000 Opmask01=0000000000000000 Opmask02=00000000ffffffef Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007ffc039b78c0 0000003000000018 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000001a0000000d0 00000000ffffffff ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0fe9602a9a ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0fe9602aa7 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0fe9602aa1 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0fe9602ab5 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0fe9602b3b ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00007f0fe9602c19 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000524f525245 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00524f5252450040 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 00e800a800000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000