last executing test programs: 16m3.143534961s ago: executing program 32 (id=704): r0 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r1 = syz_open_dev$cec(&(0x7f0000000000), 0x0, 0x0) ioctl$CEC_DQEVENT(r1, 0xc0506107, 0x0) ioctl$CEC_DQEVENT(r1, 0xc0506107, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="540000000206030000000000000000000d00000005000400000000000900020073797a31000000000d0003006c6973743a736574000000000500050002000000050001"], 0x54}}, 0x0) r4 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION(r4, 0x79f, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0xa0000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CAP_DIRTY_LOG_RING(r6, 0x4068aea3, &(0x7f0000000240)={0xc0, 0x0, 0x8000}) ioctl$KVM_CLEAR_DIRTY_LOG(r6, 0xc018aec0, &(0x7f0000000000)={0x10200, 0x40, 0x380, 0x0}) r7 = syz_genetlink_get_family_id$nbd(&(0x7f0000000380), 0xffffffffffffffff) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$nbd(&(0x7f0000000040), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)) sendmsg$NBD_CMD_CONNECT(r8, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f00000000c0)={0x34, r9, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SERVER_FLAGS={0xc}, @NBD_ATTR_INDEX={0x8, 0x1, 0x0}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}]}, 0x34}}, 0x20000000) sendmsg$NBD_CMD_DISCONNECT(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)={0x1c, r7, 0x1, 0x70bd27, 0x25dfdbfc, {}, [@NBD_ATTR_INDEX={0x8, 0x1, 0x0}]}, 0x1c}, 0x1, 0x0, 0x0, 0x24040090}, 0xc0) 14m43.445940233s ago: executing program 33 (id=1059): r0 = openat$binfmt(0xffffffffffffff9c, 0x0, 0x41, 0x1ff) fstat(r0, &(0x7f0000000000)) syz_usb_connect(0x2, 0x9a2, &(0x7f0000000100)=ANY=[@ANYBLOB="ab04f8aaa15ac52c1578fbfe51c5392a3cef4854627e6e70fb185b9c454235475ff5bb56c31db38b0f972ef9d51a7be97f36719045ffbd19213c5dd5d666fdd1009b760b635b438b16ccdd456dae6808aba2dc4b56f0e715fbc967b04082f06ba67aba3b0c1162ec2b56f84b13438786e02556bcdfc285fdcf1d481df18079f8aca5539ea321f5cca10c3570bd6452fb0af84cf5cb94a63e2fe8310125def3e7fead7c248c8efac16f07dec2c1711949452a2477b0e983ddc5f9bbaf21447a8036ad753274b87ba6f39cf4627a7d93cb339acd657b235b525a430f3a5a8eada36e8696fc5297c0df8b889944485461519854ea4b4870", @ANYBLOB="af94cb36b13bbf904780d4ae02b3ce8bf9095d35fc2ab6b4175577314b40a235e747efc3b489d75f2b43433ab2aa8992fe26986f990a2bb359ff10ffe12089a77da4ebd4975b8bfa121f311364379246477401a7e57b5dd8447a2f770503e06aa8e84495b5fc32bcd9ced9df43b7dae6861b988bec5881ae1ba80123527674b5298aadc3c59d37c8e30bf92558c4356fd0a06b802d55baf2746d8d4370d7e6d4f1", @ANYRESDEC], 0x0) 14m31.61604311s ago: executing program 0 (id=1102): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f00000000c0)=[{0x28, 0x0, 0x0, 0xffffefff}, {0x6}]}, 0x10) (async) sendmmsg(r1, &(0x7f0000000180), 0x4000190, 0x0) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$IPCTNL_MSG_CT_GET_STATS(r0, &(0x7f00000004c0)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x1000}, 0xc, &(0x7f0000000480)={&(0x7f0000000280)={0x14, 0x5, 0x1, 0x401, 0x0, 0x0, {0x1, 0x0, 0x7}, [""]}, 0x14}, 0x1, 0x0, 0x0, 0x48044}, 0xc4) (async) setsockopt$inet6_tcp_int(r3, 0x6, 0x4, &(0x7f0000000000)=0x4, 0x4) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r4, 0x84, 0x18, 0x0, 0x0) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1400000010000100ab5a0000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4024}, 0x4000010) (async) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x40008d0}, 0x40) ioctl$LOOP_CONFIGURE(0xffffffffffffffff, 0x4c0a, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_SIZE(r5, 0x28, 0x0, &(0x7f0000000b40)=0x100, 0x8) syz_usb_connect(0x1, 0x2d, &(0x7f0000000180)=ANY=[], 0x0) (async, rerun: 64) r6 = add_key$keyring(&(0x7f0000000000), &(0x7f0000000040)={'syz', 0x1}, 0x0, 0x0, 0xffffffffffffffff) (rerun: 64) keyctl$KEYCTL_WATCH_KEY(0x20, r6, 0xffffffffffffffff, 0x7f) r7 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r7, &(0x7f0000000080)={0xa, 0x0, 0x0, @empty, 0x9}, 0x1c) (async) r8 = syz_open_dev$vim2m(&(0x7f0000000080), 0x1000001, 0x2) (async) pipe2$9p(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) (async, rerun: 32) r10 = syz_open_dev$video4linux(&(0x7f0000000100), 0x7, 0x40000) (rerun: 32) ioctl$VIDIOC_S_STD(r10, 0x40085618, &(0x7f00000001c0)=0x100) (async) write$P9_RSTAT(r9, &(0x7f0000000340)={0x41, 0x7d, 0x2, {0x0, 0x3a, 0x8, 0x4a9, {0x1, 0x3, 0x8}, 0x20800000, 0x264a832f, 0x5, 0x401, 0x2, '\xca+', 0x1, '#', 0x3, 'syz', 0x1, '@'}}, 0x41) (async) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x81c0, 0x0) (async) r11 = landlock_create_ruleset(&(0x7f0000000140)={0x4000}, 0x18, 0x0) landlock_restrict_self(r11, 0x0) (async, rerun: 64) truncate(&(0x7f0000000240)='./file0\x00', 0x1) (rerun: 64) ioctl$vim2m_VIDIOC_S_CTRL(r8, 0xc008561c, &(0x7f0000000000)={0x980912, 0x3}) (async) sendmmsg$inet(r7, &(0x7f0000001040)=[{{0x0, 0x0, &(0x7f0000000f40)=[{&(0x7f0000000800)="3aae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda1632799bbc98425c433384d8a8e4071ff39a36dfdfdf05af35a4ddd340cfecd7ec935f4ce7d3e851583ba1cf53a90a7f7bce5703de57ce93ddef7849b30a01de0637e6d5e507b801d32e582e0c2d564539ebfc84c098a23e765552767b122885fb1629e9c180be47da7931bd125b80de15aab0c56a2edf2e0483b87f5ab299dc046076203dea10ccbfc631d5bf4a87ce67004519f248f086346ce6a8a9d181789a59f81d9b7f6781daac3e229914b8b8998c15c3b6302a519331cb05995bc60b7cb872dd3b5b43331c77c5d72e21f7bd2b1a915ff3204e3f20d3a20b22d6a58155b5a4ebf6d1d1cd90c656ecada531c07ff91deb3efa91762cdecfbcc43553750f22ac5c18cc5e8b6f790c2f4e6373af9f98d10e6df49ff8e5cbcbd68e11ed0b967add11410dc2e34f08dea658eb95d4d1153b4c6093192a340eb30fcc71619888c6486746a049585d249efb96b9cace83320b8f96b40ebe3a9a788d05a053380d1026b9434df87a3a387549bcabe88684c4dbf0da9a5212f3dbc8d1dff240856691243b203d7edd4d3cc89a38a6c80fdb1229a01044af7aaecb20d5570ebf24b30bbc6dfc3f70d85cd9f0d60ebd8fedd161d199d9997a0e2d18d1c99bc7158564e0ddb4673055de196535d706d142e1dc7d404583923cb1b286cfc5418884ac7e605d93652dc48ff690894405a0b6abc3c4d0f6a16c0a95c0508bd7eeffcd1da0b17f7701448658864b429e9472edfeffbf34d6e7c78f4aa73c0", 0x2de}, {&(0x7f0000000bc0)="ab29d92826349952eb8f7a2a74f535bc9739c1df57144c51a3391625b8b5354134b06ef1355506aeae96e3f097503998f375a054cf3d7de4fe53ea51518955349cdbadca60e1c65cc18dbe99369be03e492fb55fc9067bb6f7f7c3ee1720000000054a63ac58225ed0502f5ac8999e0c74a5dbb320bd54ec813e8bee6bfa5cbfb0726ac1b6ad97d802d5fae186f0769421fb965c7396854e2a3ac844a3769f8449901ba5e2b2da1ff6119aeb26ac204cfc6b54be73b6f195491ae2c0cb26b0cba61dae7a17740e8112ff188919c6e2e31a2a074863edba4a0e58b61faec4a42c29d7f9e48a43b8cb7d3c5a1e5aa67f87538140f8d633a54bceb8b1dda2397ea147d3b26e903f608b6ab1844ea7cf630d828118bba0f0f85e2e6316ae1ed9a2a7d08a05c170cb76bf111930df0cf760f7768571afdefe82a95296cee7c010f748a97046efcc774e7d85edbd5058104fef4942fb4430da89f67d1fea33bf2acfb793a6e453a8a28cd5c4b733fc8e8f630932206960e9076c7d7fc99fce018701c50d39b811a7427a7a9fcb340c2755541f228462010ec40ba945a0febd460dad5d548f1be090f5dbaa8ae8835dc47ed2537681827f6129759272574cf58e2f33e47a0e416573cfdcfb44ed9dd4ce41af4de9c471c49f12f090934c3b32f2f4777c65b1574826727f5f62", 0x1e9}, {&(0x7f00000003c0)="05437c98b91b1455046f57b5fc913814bde2bbeac2104eaea9c9d01a7838d859207067c10aa7352abbdf98e9bf033a3184a11e84639d3b9164d9c5d729f3dd409d39ff041e657c8df70e1607d58c863d5f323f6d5cf367cd939f790732e8d2310e876fcb299cd44b72bda697035b7b475bc35afbb483db39ac864dbee0c9760c22a1d32d83588afd7c994652413b22db76874ca052ef2013317eb7fcc5677e9d", 0xa0}, {&(0x7f0000000200)="f610e61fc81cc3edc86f0500194d27a5a42cf1880b0dfd1ecd", 0x19}], 0x4, 0x0, 0x0, 0x900}}], 0x1, 0x0) 14m31.414723844s ago: executing program 0 (id=1103): r0 = syz_open_dev$usbfs(&(0x7f0000000040), 0x12, 0x80801) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) r4 = syz_open_dev$video4linux(&(0x7f0000000000), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r4, 0xc0945662, &(0x7f00000000c0)={0x0, 0x0, '\x00', {0x0, @reserved}}) r5 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r5, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@get={0xe0, 0x13, 0x1, 0x0, 0x0, {{'cbc(blowfish)\x00'}}}, 0xe0}}, 0x0) r6 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000000)='/dev/comedi3\x00', 0x0, 0x0) ioctl$COMEDI_SUBDINFO(r6, 0x80486402, &(0x7f0000000040)) r7 = socket$inet6(0xa, 0x2, 0x0) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000200)="2e0400001d008104e00f80ecdb4cb9f207c804a00d000000880802fb0a0002000a0ada1b40d80800c500c59bbcb8", 0x2e}], 0x1, 0x0, 0x0, 0x5865}, 0x0) r9 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x204200, 0x0) bind$inet6(r9, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @multicast1}}, 0x1c) readv(r7, &(0x7f00000001c0)=[{&(0x7f0000000a40)=""/69, 0x45}], 0x1) ioctl$SIOCGSTAMPNS(r7, 0x8907, 0x0) getpeername$inet6(0xffffffffffffffff, &(0x7f0000002100)={0xa, 0x0, 0x0, @loopback}, &(0x7f0000002140)=0x1c) r10 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) setsockopt$inet_int(r9, 0x0, 0x1, &(0x7f0000000100)=0x7, 0x4) pipe2$9p(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) write$9p(r12, &(0x7f0000000040)="9daa3de1b1c00bceab43eaba112d8410b9f4ad13ec1904c71b71f4de", 0x1c) sendmsg$BATADV_CMD_GET_BLA_CLAIM(r9, &(0x7f0000002240)={&(0x7f0000002180)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f0000002200)={&(0x7f00000021c0)={0x24, 0x0, 0x100, 0x70bd27, 0x25dfdbfb, {}, [@BATADV_ATTR_AGGREGATED_OGMS_ENABLED={0x5, 0x29, 0x1}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x24}}, 0x0) read$FUSE(r11, &(0x7f00000000c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) wait4(r13, 0x0, 0x2, 0x0) writev(r10, &(0x7f00000000c0)=[{&(0x7f0000000140)='2', 0x1}], 0x1) r14 = syz_clone3(&(0x7f0000002540)={0x4800000, &(0x7f0000002280), &(0x7f00000022c0), &(0x7f0000002300), {0x2}, &(0x7f0000002340)=""/228, 0xe4, &(0x7f0000002440)=""/147, &(0x7f0000002500)=[r13, r13, r13], 0x3}, 0x58) prlimit64(r14, 0x6, 0x0, 0x0) sendmsg$NL80211_CMD_CONNECT(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000002600)={0x1d0, r2, 0x5, 0xffffdfff, 0x8, {{}, {@val={0x8, 0x3, r3}, @void}}, [@fils_params=[@NL80211_ATTR_FILS_ERP_RRK={0xca, 0xfc, "60dfc799b0ae2a2574dd0b599227637ad5b590ed7544841e445e16bad9f3df03b40183c1f1e49495221bdcd3b535192a192d2796eee85b0bbd62e2847ceaf3a27cd382e3b02bc71c3754a5c11881797a3b6444fb1440cc3d0c2dd04568b40cfbc2670f88711f68560f2290098c81c7f835d024aa8fc54adbfa620ae9c67167b448041293ffc02dfaed901206aa5cec453caf58f11c5db0c4ccd53c93a63a1dfdbf8262ad3be425169a2202a7a3f614ae4fe9006d1ce9bf0471fb19ecb30be80697c55816a08b"}, @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0xfff8}, @NL80211_ATTR_FILS_ERP_RRK={0xc, 0xfc, "1154249058915b50"}, @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0xfffc}, @NL80211_ATTR_FILS_ERP_REALM={0xa7, 0xfa, "a80085e743be9bd608845da02f4cf2439ae7cbe730d61a9557f649e4e5cb7739ccb42623b5f2c501bdc619a1c457abd4edfa8375355d715834be6c00421856580d02ba05730a442e3b04313dc83c9f1949a6ac8396fa4a622ec0f3bbbdbebb7dfa1539947bef81ac7f0f181c7e9f319d8408aba1bea51eb54838d5c4283d1b390b0b2d804cfa3873b61c9d043795ce7f6a174ddb704edfd4399abfb0a3f8b43f3e3623"}, @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0x8000}, @NL80211_ATTR_FILS_ERP_USERNAME={0x6, 0xf9, "7202"}, @NL80211_ATTR_FILS_ERP_NEXT_SEQ_NUM={0x6, 0xfb, 0x3}], @crypto_settings=[@NL80211_ATTR_AKM_SUITES={0x4}, @NL80211_ATTR_WPA_VERSIONS={0x8, 0x4b, 0x1}]]}, 0x1d0}}, 0x488c4) ioctl$USBDEVFS_RELEASEINTERFACE(r0, 0x8038550a, 0xffffffffffffffff) 14m30.072584319s ago: executing program 0 (id=1106): arch_prctl$ARCH_GET_XCOMP_PERM(0x1022, &(0x7f0000000000)) arch_prctl$ARCH_GET_XCOMP_PERM(0x1022, &(0x7f0000000040)) 14m29.946485169s ago: executing program 0 (id=1107): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x199901a, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x325099, 0x0) (async) mount$bind(&(0x7f0000000080)='./file0/../file0\x00', &(0x7f0000000100)='./file0/file0\x00', 0x0, 0x325099, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f00000001c0)='./file0/../file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) (async) move_mount(r0, &(0x7f00000001c0)='./file0/../file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r1, 0x84, 0x64, &(0x7f0000000580)=[@in={0x2, 0x4e21, @local}], 0x10) sendmsg$inet_sctp(r1, &(0x7f0000000000)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000003c0)='\x00', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) (async) sendmsg$inet_sctp(r1, &(0x7f0000000000)={&(0x7f0000000340)=@in={0x2, 0x4e21, @local}, 0x10, &(0x7f00000006c0)=[{&(0x7f00000003c0)='\x00', 0x1}], 0x1, 0x0, 0x0, 0x804c040}, 0x1) read(r1, &(0x7f0000000140)=""/4, 0x4) syz_usb_connect(0x1, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d0009058223"], 0x0) 14m26.874567829s ago: executing program 0 (id=1116): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000002c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x2, &(0x7f0000000200)=@gcm_256={{0x304}, "3f60eb8f2777c39a", "5985e81ad0d9585bc175cbecd3f55eb699e3070cc206f3ba527c85bde06fbf19", "bc5ec28f", "b200"}, 0x38) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x4, &(0x7f0000000100)=@gcm_256={{}, "2474794233890da1", "d830005894bf527ae179a740634a1236f3678de8ea2d0d661607e24300", "5615d9f5", "7c5cec21691a43fe"}, 0x38) r2 = dup(r0) r3 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$TIOCL_GETKMSGREDIRECT(r3, 0x541c, &(0x7f0000000000)) r4 = socket(0x26, 0x3, 0x2) setsockopt$MRT6_DEL_MIF(r4, 0x29, 0xc8, 0x0, 0xc000000) write$UHID_INPUT(r2, &(0x7f0000001980)={0x9, {"a2e3ad214fc752f91b2909094bf70e0dd038e7ff7fc6e5539b324c078b089b34383b6d1a0890e0878f0e1ac6e7049b076d959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b33310d076d0936cd3b78130daa61d8e809ea889b5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae19397d696d0d758f2dc7d1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc94681359bad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828563e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b4bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd75c2f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6ea94f88a4facfd4c735a20307c737afae5136651b1b9bd522dcb399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab83c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00303000000000000007fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57fa9c0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe360500000000000000b77940b5f07722e47a08d3679507000000000000934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e90f39c3dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) 14m25.928143158s ago: executing program 0 (id=1118): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) syz_usb_connect(0x5, 0x24, &(0x7f0000000640)={{0x12, 0x1, 0x300, 0x74, 0x27, 0xcc, 0x8, 0x5dc, 0x1, 0x1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa, 0x2, 0xa0, 0x7, [{{0x9, 0x4, 0x51, 0x4, 0x0, 0x2c, 0x80, 0x6, 0x1}}]}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0xa1001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x20100) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000080)={0x9c9, 0x3, 0x0, 'queue0\x00', 0x200000}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180), 0x4) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) r4 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000040)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6085, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x3, 0x30, 0x2, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x0, 0x1, {0x9, 0x21, 0x69, 0x7, 0x1, {0x22, 0x33c}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x5, 0x3, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x9, 0x2, 0x3}}]}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x110, 0x2, 0x80, 0x8, 0x10, 0x7}, 0x10, &(0x7f0000000280)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xe, 0x14, 0xb, 0xf, 0x6, 0x6}]}, 0x9, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x140a}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x421}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x340a}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x6a}}, {0x8d, &(0x7f00000003c0)=ANY=[@ANYBLOB="8d03abcf43dd5b5cf3cf20d042bbe64429840ab2317e5884b7587ddbf135b7b7d1cddf91dc638b46bb185be7aa66ee723128c8660b9a891c7ce8a54a0b44fc06233ee2a6754e2d14d2561135a981ff0f04b7f2da5ceff74be6a1c79e6d3ae80963919ba743d3b0ce5e838b8f42eb658318679e902449f2ab50307f4491259be1086355ccee48ac0f66def153d9"]}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x4c3f}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x3420}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x500a}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x3401}}]}) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x7, &(0x7f0000000040)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000000), &(0x7f00000000c0)="909a074fa4975c7f3b7a6e3334880fc3bd94d4843cc503a79ec097d3b56fbd2ebc0ae5451b357ad1b581e82d6729274f73e5d8e314b1af9ad3102f0fe4bb8c0179a51db8e1a888c18bd30c99edc3e2985e5db0a3ab09e932018d92cb312de79893780833e7f5b4a9dba9cb6effb1e6ccf36b38821debb74fe484a5c36e6c337eeb"}}, &(0x7f0000000180)) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000540)={0x28, 0x0, 0xffffffff, @hyper}, 0x10, 0x800) 14m25.231447021s ago: executing program 34 (id=1118): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) syz_usb_connect(0x5, 0x24, &(0x7f0000000640)={{0x12, 0x1, 0x300, 0x74, 0x27, 0xcc, 0x8, 0x5dc, 0x1, 0x1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa, 0x2, 0xa0, 0x7, [{{0x9, 0x4, 0x51, 0x4, 0x0, 0x2c, 0x80, 0x6, 0x1}}]}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0xa1001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x20100) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000080)={0x9c9, 0x3, 0x0, 'queue0\x00', 0x200000}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180), 0x4) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) r4 = openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_PRIME_FD_TO_HANDLE(r4, 0xc00c642e, &(0x7f0000000040)) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x1ff) syz_usb_connect$hid(0x2, 0x3f, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x8, 0x17ef, 0x6085, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x3, 0x30, 0x2, [{{0x9, 0x4, 0x0, 0x5, 0x1, 0x3, 0x1, 0x0, 0x1, {0x9, 0x21, 0x69, 0x7, 0x1, {0x22, 0x33c}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x5, 0x3, 0x3}}, [{{0x9, 0x5, 0x2, 0x3, 0x200, 0x9, 0x2, 0x3}}]}}}]}}]}}, &(0x7f00000005c0)={0xa, &(0x7f0000000240)={0xa, 0x6, 0x110, 0x2, 0x80, 0x8, 0x10, 0x7}, 0x10, &(0x7f0000000280)={0x5, 0xf, 0x10, 0x1, [@wireless={0xb, 0x10, 0x1, 0xe, 0x14, 0xb, 0xf, 0x6, 0x6}]}, 0x9, [{0x4, &(0x7f00000002c0)=@lang_id={0x4, 0x3, 0x140a}}, {0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x421}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x340a}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x6a}}, {0x8d, &(0x7f00000003c0)=ANY=[@ANYBLOB="8d03abcf43dd5b5cf3cf20d042bbe64429840ab2317e5884b7587ddbf135b7b7d1cddf91dc638b46bb185be7aa66ee723128c8660b9a891c7ce8a54a0b44fc06233ee2a6754e2d14d2561135a981ff0f04b7f2da5ceff74be6a1c79e6d3ae80963919ba743d3b0ce5e838b8f42eb658318679e902449f2ab50307f4491259be1086355ccee48ac0f66def153d9"]}, {0x4, &(0x7f0000000480)=@lang_id={0x4, 0x3, 0x4c3f}}, {0x4, &(0x7f00000004c0)=@lang_id={0x4, 0x3, 0x3420}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x500a}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x3401}}]}) socket$inet6_tcp(0xa, 0x1, 0x0) timer_create(0x7, &(0x7f0000000040)={0x0, 0x1f, 0x2, @thr={&(0x7f0000000000), &(0x7f00000000c0)="909a074fa4975c7f3b7a6e3334880fc3bd94d4843cc503a79ec097d3b56fbd2ebc0ae5451b357ad1b581e82d6729274f73e5d8e314b1af9ad3102f0fe4bb8c0179a51db8e1a888c18bd30c99edc3e2985e5db0a3ab09e932018d92cb312de79893780833e7f5b4a9dba9cb6effb1e6ccf36b38821debb74fe484a5c36e6c337eeb"}}, &(0x7f0000000180)) accept4$vsock_stream(0xffffffffffffffff, &(0x7f0000000540)={0x28, 0x0, 0xffffffff, @hyper}, 0x10, 0x800) 12m24.010532296s ago: executing program 3 (id=1517): ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) (async) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040)=[@in6={0xa, 0x4e24, 0x6, @empty, 0x3}], 0x1c) (async) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = dup(r1) (async) rt_sigaction(0x20, 0x0, &(0x7f0000000380)={&(0x7f0000000140)="f20f8e341b341bf82b710026f3440faedac4e27d1d318f491891c6c4617167302e3e660fe6a30e000000f04383720406426e420f01da", 0x0, 0x0}, 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x3, 0x0, 0x2, 0x1000, &(0x7f0000003000/0x1000)=nil}) r3 = socket$kcm(0x10, 0x3, 0x10) sendmsg$kcm(r3, &(0x7f0000000000)={0x0, 0xffffffffffffffb3, &(0x7f0000000040)=[{&(0x7f00000000c0)="1400000016000b63d25a8064000000000124fc60", 0x14}], 0x1}, 0x8c4) (async) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) syz_kvm_setup_cpu$x86(r2, r0, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) (async) r5 = timerfd_create(0x7, 0x0) timerfd_settime(r5, 0x0, &(0x7f0000007000)={{0x0, 0x4}, {0x0, 0x3938700}}, 0x0) readv(r5, &(0x7f0000000200)=[{&(0x7f0000000040)=""/52, 0x34}], 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) (async) landlock_create_ruleset(&(0x7f0000000080)={0x8000}, 0x18, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) (async) r6 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001500)=[{&(0x7f0000000040)="d80000001a0081044e81f782db4cb904021d08007b490d4f1e81f8d815000100ef05142603600e12080005007a010401a80016002000034004000000035c0461c9d67f6f940071342e875fab7cb6cec6cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b141993c034e653fe8efe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9ee5350db798262f3d40fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e", 0xd8}], 0x1}, 0x4000000) 12m23.829841618s ago: executing program 3 (id=1518): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)=ANY=[@ANYBLOB="d417000010"], 0x17d4}, 0x1, 0x0, 0x0, 0x8054}, 0x50) 12m23.714718243s ago: executing program 3 (id=1519): openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x141800, 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f0000000440)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000900)={[{@index_on}]}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) ioprio_set$uid(0x3, 0x0, 0x0) quotactl$Q_SYNC(0xffffffff80000100, 0x0, 0x0, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0x5}) ioctl$KVM_CAP_SPLIT_IRQCHIP(0xffffffffffffffff, 0x4068aea3, &(0x7f0000000100)={0x79, 0x0, 0xb6b}) 12m23.558464535s ago: executing program 3 (id=1521): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0xfe, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x2, 0x1, 0x3, 0x0, 0x3, 0x0, {0x9, 0x21, 0x81ff, 0x0, 0x1, {0x22, 0x3}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0x0, 0xfc}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) setitimer(0x0, &(0x7f00000000c0)={{0xffffffff}, {0xffffffff}}, 0x0) (async, rerun: 32) syz_usb_control_io$hid(r0, &(0x7f0000000100)={0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="400109"], 0x0, 0x0, 0x0}, 0x0) (async, rerun: 32) r1 = syz_usb_connect$cdc_ncm(0x3, 0x85, &(0x7f0000000140)={{0x12, 0x1, 0x310, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x73, 0x2, 0x1, 0xf, 0x80, 0xc, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f130b2de36"}, {0x5, 0x24, 0x0, 0x9}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x68, 0x8000, 0xb}, {0x6, 0x24, 0x1a, 0x0, 0x30}, [@country_functional={0x6, 0x24, 0x7, 0x3, 0x6}, @mbim={0xc, 0x24, 0x1b, 0xa, 0x83, 0xd, 0x3, 0x8, 0x8}]}, {{0x9, 0x5, 0x81, 0x3, 0x40, 0x1, 0x2f, 0x7}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0x4, 0x1, 0x1}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x3, 0x8, 0x3}}}}}}}]}}, &(0x7f00000000c0)={0xa, &(0x7f0000000080)={0xa, 0x6, 0x300, 0x7, 0xa1, 0x80, 0xff, 0xfc}, 0x5, &(0x7f0000000200)={0x5, 0xf, 0x5}, 0x2, [{0xae, &(0x7f00000002c0)=@string={0xae, 0x3, "f9a8f033d3983c27550dcf9c58888893700641a988ca171cd24ad53f55b58088e1f7bf69da090a5f804c0f0970c8ef937d3206b55b881adf8d14d2ac784836069099e58e9214462998275ea378ac80d6a1da1bf5eb422418aca31ac736357aca428c09ed738420fa1ff4317ea1fe10feedd70babed3c4e20372eb542b03f2f7f1c45762b712b4fccf85377cbe2b5d536af79e08c52b96e50faf9605ab5fb375896115e31a794a35b74299da5"}}, {0x59, &(0x7f0000000380)=@string={0x59, 0x3, "74c2e64efebee1b420fba38254990eaf2d667cf84a0089cb2de1814e800714560be81a1a45a3e8b48f9a94ce0fb177909d392045297682eb8402302f352b187cbd1003b76f22f0f6596ccb402be529436f312a3253183d"}}]}) syz_usb_control_io$cdc_ncm(r1, &(0x7f00000004c0)={0x14, &(0x7f0000000400)={0x20, 0x10, 0x5e, {0x5e, 0x11, "23f655c11a8de919d53325d2863fc0d5c59cb3b569202bbed244db34bdd1919bbff1c83998e74c9ba302efe201e8d8052c224af2f9209ed1b0a0da9468e23ed3c66c424745ad18a760979985c2c577cd0acbb6712cfb4002040d7f0f"}}, &(0x7f0000000480)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000700)={0x44, &(0x7f0000000500)={0x40, 0x1b, 0xa, "6adc2edcd12348b5ea6d"}, &(0x7f0000000540)={0x0, 0xa, 0x1, 0x5}, &(0x7f0000000580)={0x0, 0x8, 0x1, 0x3}, &(0x7f00000005c0)={0x20, 0x80, 0x1c, {0x6, 0xa44, 0x3, 0xfff, 0x254a, 0x5, 0x6, 0xc6, 0x2, 0x9, 0x7, 0x4}}, &(0x7f0000000600)={0x20, 0x85, 0x4, 0x5}, &(0x7f0000000640)={0x20, 0x83, 0x2}, &(0x7f0000000680)={0x20, 0x87, 0x2, 0x3}, &(0x7f00000006c0)={0x20, 0x89, 0x2}}) 12m22.813232598s ago: executing program 3 (id=1523): syz_usb_connect$uac1(0x2, 0xa6, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000106b1d01010000000003010902940003010040000904000000010100000a2401000000020102132406000006000000281ab0ab2c90619b34000000000000000000000924030000000000000924050000f8211cfd0924030500000004000724050401"], 0x0) (async) r0 = syz_usb_connect$uac1(0x2, 0xa6, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000000106b1d01010000000003010902940003010040000904000000010100000a2401000000020102132406000006000000281ab0ab2c90619b34000000000000000000000924030000000000000924050000f8211cfd0924030500000004000724050401"], 0x0) syz_emit_vhci(&(0x7f0000000040)=@HCI_VENDOR_PKT={0xff, 0x40}, 0x2) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) (async) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000003c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x24, r2, 0x401, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x10) (async) sendmsg$NL80211_CMD_GET_KEY(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x24, r2, 0x401, 0x70bd2d, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_KEY_TYPE={0x8, 0x37, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x10}, 0x10) chdir(&(0x7f0000000080)='./file1\x00') syz_emit_vhci(&(0x7f00000000c0)=@HCI_EVENT_PKT={0x4, @hci_ev_remote_version={{0xc, 0x8}, {0x9, 0xc8, 0x7, 0x2, 0x1ff}}}, 0xb) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x1e2) mount(0x0, &(0x7f0000000280)='./file0\x00', &(0x7f0000000300)='devpts\x00', 0x0, 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, 0x0) syz_usb_control_io$uac1(r0, &(0x7f0000000280)={0x14, 0x0, &(0x7f0000000080)=ANY=[@ANYRESOCT=r0]}, 0x0) 12m21.45332134s ago: executing program 3 (id=1528): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) syz_usb_connect(0x5, 0x24, &(0x7f0000000640)={{0x12, 0x1, 0x300, 0x74, 0x27, 0xcc, 0x8, 0x5dc, 0x1, 0x1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa, 0x2, 0xa0, 0x7, [{{0x9, 0x4, 0x51, 0x4, 0x0, 0x2c, 0x80, 0x6, 0x1}}]}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0xa1001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x20100) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180), 0x4) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 12m6.274450377s ago: executing program 35 (id=1528): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) syz_usb_connect(0x5, 0x24, &(0x7f0000000640)={{0x12, 0x1, 0x300, 0x74, 0x27, 0xcc, 0x8, 0x5dc, 0x1, 0x1, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xa, 0x2, 0xa0, 0x7, [{{0x9, 0x4, 0x51, 0x4, 0x0, 0x2c, 0x80, 0x6, 0x1}}]}}]}}, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0}) r1 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0xa1001) ioctl$SNDRV_TIMER_IOCTL_SELECT(r1, 0x40345410, &(0x7f0000000300)={{0x0, 0x2}}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000140), 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x20100) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r2, 0x40605346, &(0x7f0000000280)={0x0, 0x0, {0x3}}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r1, 0x54a2) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f0000000180), 0x4) prctl$PR_SET_SECUREBITS(0x1c, 0x1d) setuid(0xee01) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) 11m47.062591481s ago: executing program 6 (id=1634): r0 = syz_open_dev$cec(&(0x7f0000000300), 0x0, 0x80) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000795d6c08450c3a616dc4010203010902120001000000000904"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, 0x0, &(0x7f0000000400)={0x2c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r1, 0x0, 0x0) syz_usb_control_io(r1, 0x0, &(0x7f0000000800)={0x84, &(0x7f0000000280)={0x40, 0x0, 0x1, "12"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, 0x0, 0x0) syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000580)={0x34, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x20, 0x0, 0x6, {0x4, "3c3fb7c6"}}, 0x0, 0x0}) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000140)={"fbff00", 0xfffe, 0x5, 0x4, 0x29, 0x2, "0000000300000000000900", '\x00\x00#\x00', "1e69199f", "e86eade4", ["e2ff00", "000000000000000000000082", "0c000004dd372a9000"]}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f0000000080)={0x2, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f0000000040)={0x2, 0x0, 0x4}) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r2 = socket$inet(0x2, 0x2, 0x0) ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f00000001c0)={"825397841105bdc87f2f470ecf7cabaeb59d7cdd2b85832e059500bef040c6f2", 0xffffffffffffffff, 0xffffffffffffffff}) ioctl$BTRFS_IOC_GET_SUBVOL_INFO(r3, 0x81f8943c, &(0x7f0000000480)) setsockopt$inet_mreqn(r2, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc) r4 = signalfd(r2, &(0x7f00000002c0)={[0xb548]}, 0x8) sendmsg$NFNL_MSG_COMPAT_GET(r4, &(0x7f0000000400)={&(0x7f0000000340)={0x10, 0x0, 0x0, 0x2}, 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x24, 0x0, 0xb, 0x201, 0x0, 0x0, {0x2, 0x0, 0x2}, [@NFTA_COMPAT_TYPE={0x8}, @NFTA_COMPAT_REV={0x8, 0x2, 0x1, 0x0, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000001}, 0x80c1) setsockopt$inet_msfilter(r2, 0x0, 0x29, &(0x7f0000000000)=ANY=[@ANYBLOB="e00000027fa80a010100000004"], 0x57) setsockopt$inet_mreqsrc(r2, 0x0, 0x24, &(0x7f0000000440)={@multicast2, @loopback, @empty}, 0xc) r5 = socket$inet(0x2, 0x2, 0x0) r6 = socket$inet_udplite(0x2, 0x2, 0x88) getsockopt$IPT_SO_GET_INFO(r6, 0x0, 0x40, &(0x7f0000000200)={'security\x00', 0x0, [0xfffffffa, 0x468, 0x9, 0x6, 0xffff]}, &(0x7f0000000280)=0x54) r7 = openat$vsock(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$BINDER_WRITE_READ(r7, 0x7b9, &(0x7f0000001480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) accept$inet(r7, &(0x7f00000000c0)={0x2, 0x0, @local}, &(0x7f0000000100)=0x5e) setsockopt$inet_mreqn(r5, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0x40) 11m44.753606473s ago: executing program 6 (id=1643): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) syz_usb_connect(0x1, 0x54, &(0x7f0000000240)=ANY=[@ANYBLOB="12015002b186260843195722d9ad010203010902420001c00382400904"], &(0x7f00000021c0)={0x0, 0x0, 0x0, 0x0}) getsockopt$WPAN_SECURITY_LEVEL(r1, 0x0, 0x2, &(0x7f0000000100), &(0x7f0000000140)=0x4) setsockopt$bt_l2cap_L2CAP_OPTIONS(r0, 0x6, 0x1, &(0x7f0000000000)={0xb, 0x3ff, 0x627, 0x9, 0xfb, 0x2, 0x2}, 0xc) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000080)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0xaea}}, './file0\x00'}) r3 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101301) ioctl$USBDEVFS_DISCONNECT_CLAIM(r3, 0x8108551b, 0x0) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000200), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000002c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000300)={0xffffffffffffffff}, 0x2, 0xe}}, 0x20) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x100, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000040)={0x1, 0x3, 0x6000, 0x2000, &(0x7f0000fa3000/0x2000)=nil}) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000080)={0x26e8, 0x0, 0x0, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) ioctl$KVM_CREATE_DEVICE(r7, 0xc018aec0, &(0x7f00000000c0)={0x1}) write$RDMA_USER_CM_CMD_RESOLVE_ADDR(r4, &(0x7f0000000680)={0x15, 0x110, 0xfa08, {r5, 0x0, 0x10, 0x10, 0x0, @in={0x2, 0x4e23, @empty}, @in={0x2, 0x0, @empty}}}, 0x118) write$RDMA_USER_CM_CMD_QUERY(r4, &(0x7f00000001c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000480), r5, 0x2}}, 0x18) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r2, 0x8040942d, &(0x7f00000000c0)) r8 = socket$nl_route(0x10, 0x3, 0x0) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r9, &(0x7f0000d84000)={0xa, 0x4e22, 0x0, @local, 0x7}, 0x1c) r10 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r10, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000007c0)=ANY=[@ANYBLOB="3801000010001307000000000000fdffff030045ba0000000000000000000002fe8000000000000000000000000000bb00000001000000000200000000000000899a2bc2cc92d9824056340817c6ab25263d4e2c83", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="fe8000000000000000000000000000bb000004d33200000001000000000000000000000000000000000000000000000000000000000000000000000000000000feffffffffffffff0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000048000200636263286165732900"/240], 0x138}}, 0x0) setsockopt$inet6_tcp_int(r9, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) r11 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r11, 0x4010640d, &(0x7f0000000280)={0x5}) sendto$inet6(0xffffffffffffffff, &(0x7f0000000380)="e8b28f", 0x3, 0x20000045, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @private1={0xfc, 0x1, '\x00', 0x1}}, 0x1c) shutdown(r9, 0x1) sendmsg$netlink(r8, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="240000001a00010004000000ffdbdf250a00fc003a2a5e247b00000008001c8004000000"], 0x24}], 0x1}, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000280)=0x200, 0x4) 11m41.612450523s ago: executing program 6 (id=1653): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_POWER_SAVE(r0, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000080)={0x40, r1, 0x400, 0x70bd29, 0x25dfdbfe, {{}, {@void, @val={0xc, 0x99, {0x9, 0x58}}}}, [@NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8, 0x5d, 0x1}, @NL80211_ATTR_PS_STATE={0x8}, @NL80211_ATTR_PS_STATE={0x8}]}, 0x40}, 0x1, 0x0, 0x0, 0x4000000}, 0xc4) syz_usb_connect(0x5, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12011003c08b25203c41a4819fae0102030109021b0002000750000904fbd400ffffff030904020700ff"], &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0}) (async) syz_usb_connect(0x5, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12011003c08b25203c41a4819fae0102030109021b0002000750000904fbd400ffffff030904020700ff"], &(0x7f0000001180)={0x0, 0x0, 0x0, 0x0}) 11m40.227458178s ago: executing program 6 (id=1658): socket$netlink(0x10, 0x3, 0x0) socket$inet6_mptcp(0xa, 0x1, 0x106) socket(0xa, 0x80805, 0xfffffffc) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x40, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x2, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x8e, 0x10001, 0x8000, 0x5, 0x2, 0x9, 0x80000c1, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x1, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x4, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fbf, 0x35db, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x5, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x5, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x400, 0x40, 0x6, 0x7, 0x7, 0x5, 0x4, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x100006, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd83, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x2, 0x20bfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x5393, 0x1, 0x1b18]}, 0x45c) sendmsg$ETHTOOL_MSG_LINKINFO_SET(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x14}, 0x1, 0x0, 0x0, 0x2010}, 0x4001) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x180, 0x4, 0x3ff, 0xf5, 0x0, 0x7fffffffffffb, 0x5, 0x3, 0x6, 0x0, 0x63, 0x1, 0x8001], 0x1, 0x80002}) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000100)=[{{&(0x7f0000000180)={0x2, 0x4e27, @empty}, 0x10, 0x0}}], 0x1, 0x20004840) ioctl$KVM_RUN(r3, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000140)={0x1ff, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, &(0x7f0000000340)="c4c3ed48e9070f08c4e2fd8c12650f01c3f30f09b8008000000f23d80f21f835400000700f23f80f01c2c4c201bc5a000f01c3c7442400dd4123e0c744240208000000c7442406000000000f011424", 0x4f}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x0) capset(&(0x7f0000000200)={0x19980330}, &(0x7f0000000000)={0x4, 0x4, 0x0, 0x0, 0x0, 0x7}) fcntl$getown(r1, 0x9) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x89f0, &(0x7f0000001440)={'bridge0\x00', &(0x7f0000000180)=@ethtool_ringparam={0x10}}) r7 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000300)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r7, 0x0, 0x0) syz_usb_control_io$printer(r7, 0x0, 0x0) 11m37.06253385s ago: executing program 6 (id=1674): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x7f, 0x2) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000000000000000000000000000000000000000000000000000000000000006000000000a00"/64, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000c00000000000000000000000000000000000000000000000000000000000000ffffffffffffffff000000000000000000000000000000000000000000000000000a000000000000feffffffff7f400002000000000000080000000000000000010000000000000044000500ac1414bb000000000000000000000000000000003c00000002000000fe8000000000000000000000000000aa0600000004030000010400"/180], 0xfc}}, 0x0) r2 = socket$inet6_sctp(0xa, 0x801, 0x84) sendmmsg$inet6(r2, &(0x7f0000002300)=[{{&(0x7f00000000c0)={0xa, 0x4e22, 0x3, @remote, 0x20}, 0x1c, &(0x7f0000000580)=[{&(0x7f00000001c0)="cc", 0x1}], 0x1}}], 0x1, 0x4c840) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x3, &(0x7f0000000000)='source', &(0x7f00000023c0)='[\x8bw#\x9b\x94\xb6@\x874L\xf5U\xd7\xcb+3#\x8c\xe7t%\xabsH8,\x999\xa9\":|\x98\xc5\xd5\xba\x8d\x96d&\x8dn\x00\xdb\xd2\r!A\xfb\\%\xc8\xf4\xaa\xf6:\x91t\xf3\r\xde\x1f$\xd3\x9f\xf4\x17\x00o\x1aia\xdb\x10\xd1&\x81\xba\x9d\x91\xf7\x92\xfb}\x91\x8d\xbav5{\xe4M;\xa2:\xe0\xfc\xa2G\xd3bBM\xe3i\xfc\xfb\xc1\xa1|\x90\xd5\x8d;', 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_XSAVE(r4, 0x5000aea5, &(0x7f00000006c0)={[0x224, 0x4, 0xbefc, 0xffff, 0x8, 0xe9, 0x3, 0x2, 0x6, 0x0, 0x8, 0x2, 0x4, 0x9, 0x6, 0x2, 0xea, 0x3, 0x2, 0x3, 0x4, 0x3, 0x3c, 0xffffffff, 0x5, 0xed, 0x8, 0xf, 0x1, 0x562, 0x4, 0x7, 0x283, 0x5, 0x800, 0x3, 0xfffffff4, 0x9, 0x200, 0x8, 0x8, 0xff, 0x1, 0x6, 0x2, 0x1, 0xfff, 0x191c5b23, 0x7, 0x6, 0x5, 0x7, 0x9, 0x8d7, 0x8, 0x1, 0x1, 0x2, 0x7, 0x1, 0x101, 0x9, 0x2, 0x4, 0x0, 0x8, 0xffff, 0x6, 0x0, 0x9, 0x7fffffff, 0xfffffff8, 0x319269b4, 0x1, 0x7, 0x10001, 0x5710, 0x8, 0xe, 0x6, 0x9, 0x6, 0x27, 0x7fff, 0x3, 0x9, 0x3, 0x99a, 0x92, 0xe6, 0x3, 0x8, 0x8, 0x2, 0x0, 0x100, 0x4, 0x0, 0x3, 0x81, 0x5, 0x8, 0x2, 0xfffffffb, 0x0, 0x7, 0x300000, 0x2, 0x4, 0x6, 0x9, 0x9, 0xab, 0x4e56, 0xf, 0x0, 0x7d4, 0xa, 0x6, 0x7fffffff, 0x6a, 0x0, 0xc, 0x0, 0x5, 0x1, 0x1, 0x1, 0x9, 0xc0000, 0x0, 0x3, 0xfffffffe, 0x3, 0xce00, 0x0, 0xa9, 0x4, 0x76, 0xb01, 0x7fff, 0x1, 0x7, 0x37, 0x7fffffff, 0x7, 0x2, 0x4, 0xb, 0x44, 0x0, 0xf08b, 0x59, 0xe, 0x3, 0xa356, 0x40, 0x0, 0x9, 0x1, 0x6, 0x1ff, 0xe, 0xff, 0x5, 0x800, 0x5, 0x36, 0xead, 0x10b400, 0xaf1, 0x401, 0x3, 0xfffffff8, 0x6, 0x2, 0x4, 0x5, 0x7b66, 0xa, 0x4, 0xa, 0x2, 0x10, 0x6, 0x22, 0x0, 0x4c7ce3ca, 0x21, 0x5, 0x7, 0x3, 0x40, 0x7, 0x3, 0xa7d6, 0x6, 0x8, 0x200, 0xe, 0x7, 0xfd0c, 0x4000000, 0x7, 0x6, 0xffff, 0x8, 0x40, 0x2, 0x6, 0x0, 0x7e3, 0x5, 0x3, 0x9, 0x5, 0x4, 0x3, 0x162d0, 0x3, 0x2, 0x9, 0x23, 0x66, 0x0, 0x3ad, 0x7fffffff, 0x2, 0x10000, 0x10000, 0xb, 0xb, 0x3, 0x7ff, 0x8, 0xfc6, 0x4f, 0xa2, 0x4, 0x0, 0x0, 0x7, 0x169, 0x400, 0x4, 0x80000000, 0x81, 0x9, 0x5, 0x4, 0x2283, 0x3, 0xd6, 0x8000000, 0x5, 0xfffeffff, 0x2, 0x1, 0x7, 0x3, 0x4, 0xbf, 0x529, 0x400, 0xdf, 0x9, 0x3, 0x20ec, 0x12e, 0x10000, 0x6, 0x7, 0x1, 0x7, 0x1, 0x2, 0x0, 0x2, 0x8, 0x0, 0x9, 0x3, 0x2, 0x6, 0xe, 0x10001, 0xc9, 0x9, 0xe, 0x7, 0x0, 0x8, 0x3c34000, 0xcaf, 0x2, 0x80000000, 0xffffffff, 0x2, 0x6, 0x3, 0xa, 0x4, 0x8, 0x1, 0x0, 0x352, 0x666, 0x6, 0x2, 0x9, 0x401, 0x8, 0xf5, 0x6000000, 0x401, 0xfffffffb, 0x62, 0x7, 0x80, 0x8, 0x6, 0xb1, 0x200, 0x81, 0x1, 0x0, 0xff, 0x66a40000, 0x2, 0xd0, 0x178, 0x4ed, 0x3, 0xe1, 0x50, 0x81, 0x553, 0x6, 0x8, 0x2, 0x9, 0x4, 0xffffffb1, 0x6, 0x7f, 0xb6, 0x7f, 0xf, 0x7fffffff, 0x70c82be1, 0x6, 0x401, 0x4, 0x5, 0x0, 0x29f, 0x7, 0x5, 0xe6f, 0x3, 0xfffff5d7, 0x8, 0xd4, 0x9a, 0x1, 0x7, 0x1, 0x3, 0x204, 0x1, 0x3, 0x5, 0x6, 0x8000, 0x8, 0xc968, 0x1, 0x4c7, 0x0, 0x7, 0xfffffff1, 0x4, 0x8, 0x80, 0x8a, 0x22fa9b08, 0x200, 0xfffffff8, 0x1, 0x8, 0x7f, 0x2d, 0x1, 0x81, 0x5, 0x808c4e, 0x5, 0x4, 0x6, 0x7, 0x6, 0x75ea, 0x8, 0x8, 0x0, 0x9, 0x7, 0x9, 0x6, 0x7f, 0x9, 0x2, 0x9, 0x7, 0x5, 0x800, 0x6, 0xffff, 0x6, 0x0, 0xfffffffd, 0xc1, 0x3, 0x20, 0x80000001, 0x9, 0xd, 0x6, 0xc, 0x8, 0x4a, 0x4, 0x2, 0x6, 0x3, 0x80000000, 0x0, 0x7fff, 0x71da, 0x0, 0x10, 0x2051, 0x4, 0x8, 0x5, 0x1, 0x3, 0x4, 0x3, 0x3, 0x5, 0x8, 0x100, 0x1, 0x7, 0x800, 0x80, 0x1ff, 0xeb2, 0x2, 0x7fff, 0x0, 0x3, 0x9, 0xc5b1, 0x9, 0x7, 0x3, 0xff3f, 0x1ff, 0x2, 0x8, 0x1, 0x7, 0x5, 0x8, 0x58d, 0x71, 0x7, 0xff, 0x3, 0x62, 0x0, 0x60d2, 0x8, 0x0, 0x2, 0xabc6, 0x1, 0x6, 0x2, 0x0, 0x7, 0xfffffffe, 0x41ff, 0x1, 0xc, 0x7c5, 0x48, 0x7ff, 0x7fff, 0x0, 0x8, 0x100, 0x7fffffff, 0x9, 0xa, 0x5, 0x7, 0x6, 0x9, 0x2, 0xb7ec, 0x1, 0x8001, 0x9, 0x5, 0x8, 0x6, 0x1, 0x9, 0x4, 0x6, 0xf3, 0x7, 0x3, 0x9, 0x4f1, 0x59, 0x7, 0x4, 0x1ff, 0x0, 0x1000, 0x9, 0x2, 0x1, 0x4f46, 0x69, 0xfffff68f, 0x2, 0x0, 0x400, 0x9, 0x9, 0x0, 0xa14, 0x0, 0x4, 0x7, 0x6, 0x5, 0x4, 0xfffffff7, 0x9, 0xbd, 0x8, 0x73, 0x30000000, 0x80, 0xfffffffd, 0x7, 0xc, 0x3, 0x8, 0x800, 0x6, 0x2, 0x101, 0x0, 0x7, 0x0, 0x9000, 0x4, 0x0, 0x9, 0x1, 0x5, 0x4, 0x80000000, 0x40, 0x8, 0x1, 0x7fff, 0x36ed, 0xd1a1, 0x4, 0x0, 0x3, 0x650c80fa, 0x9, 0x0, 0x3, 0x6e4d, 0x6, 0x80000000, 0x4, 0x100, 0x1, 0x8, 0x6, 0x101, 0x2, 0x10, 0x101, 0xe, 0xfffffffc, 0x9, 0x1, 0x4, 0x4ad, 0x9, 0x0, 0x7, 0xa, 0x101, 0x6, 0x3, 0xffff, 0x3, 0x7ff, 0x2, 0x1, 0x6, 0x800, 0x45b, 0x190, 0x1, 0x10001, 0x400, 0x7f, 0x85d1, 0xc, 0xfff, 0x153, 0x6, 0x0, 0x64d6a6dc, 0x6, 0x1, 0x0, 0x8, 0x400, 0x8, 0x4, 0x5, 0xa041, 0x5, 0x20000000, 0x1, 0x0, 0x6bd, 0x7, 0x800, 0x4, 0x8, 0x400, 0x81000000, 0x4, 0xb, 0x5, 0x7, 0xb, 0x3, 0xdf8, 0x5, 0x8, 0x200, 0xb, 0x800, 0x62fca6b8, 0x32, 0x3000, 0x401, 0x9, 0x1, 0xffff, 0x0, 0x5a, 0x9, 0x81, 0x5, 0x10001, 0x6, 0x9, 0x101, 0x9, 0xb, 0x3ff, 0x2000031, 0xce8a, 0xfffffffb, 0x200, 0x8, 0x80000000, 0x4, 0x11f9, 0x4, 0x5, 0x9, 0x3ff, 0x1, 0x3, 0x920d, 0x1, 0x583, 0x6, 0x1, 0x8, 0x3, 0xffff, 0xfffffffe, 0x0, 0x0, 0x4c611a3c, 0x0, 0x0, 0x409da820, 0x400, 0xc, 0x0, 0x4, 0x1, 0xe3f, 0xfff, 0x5, 0xb, 0x1000, 0x2, 0x100, 0x7, 0x6, 0x0, 0x0, 0x9, 0xff, 0x8, 0x3, 0xd, 0x9, 0x8, 0x9, 0x4, 0x9, 0x3, 0x4, 0x3, 0x7, 0x8001, 0x3ff, 0x5, 0x3c, 0x3, 0x8, 0x100, 0x5, 0x2, 0x4, 0x1, 0x0, 0x8, 0x8, 0xffffff6c, 0xd2fd, 0xf, 0x8001, 0x200, 0x7f, 0x7, 0x6, 0x1, 0xfffffe00, 0xfffffe00, 0x95d3, 0x3c, 0x7, 0x3, 0x7, 0x3, 0x1, 0x8, 0x0, 0x6, 0x1457, 0xe, 0xfff, 0xda36, 0xfffffffb, 0x2, 0xf79, 0x0, 0x4, 0x755, 0x4, 0xe, 0x3, 0x6, 0x0, 0x96b6, 0x7, 0xedaf, 0x8b, 0x4, 0x800, 0x2, 0x9, 0x4, 0x1, 0x8, 0x3ff, 0x0, 0x401, 0x1, 0x1, 0x7, 0xff, 0x401, 0x3, 0xffff76bf, 0x18d, 0x4, 0x0, 0xe, 0xb, 0x10001, 0x1, 0x7ff, 0x80000001, 0x5, 0x8, 0x400000, 0xff, 0x1, 0x3, 0x80, 0x0, 0x9, 0x400, 0x101, 0xc, 0x4, 0x1, 0x1ff, 0x4, 0x2, 0x40, 0x4, 0x1ff, 0x800, 0x0, 0x80000000, 0x6, 0x2, 0x33, 0x5, 0x1, 0x7, 0x5103fc93, 0xfffffff2, 0x7fffffff, 0x80000001, 0x4, 0x1000, 0x5, 0x8, 0x9, 0x4, 0x10000, 0xfffffff8, 0x0, 0x81, 0x6, 0x3ff, 0x6ecc, 0x7fff, 0x6, 0x7, 0x7, 0x9, 0x4, 0x3, 0x7, 0xd8670, 0x3, 0xffffffff, 0x26, 0x3, 0x101, 0x80000000, 0x3, 0x7, 0x8, 0x4, 0xb81, 0xb, 0x5, 0x5, 0x5, 0x5, 0x401, 0x7fff, 0x0, 0x86, 0x6, 0x2, 0x8, 0xb1e8, 0x846, 0x1, 0x77, 0x10, 0x2, 0x9, 0x8000, 0x4, 0x2c, 0x6, 0x1, 0xa8, 0x0, 0xa, 0xf5d, 0xc47b, 0x5, 0xffffffff, 0x1e, 0xae, 0x8, 0x0, 0x8, 0xb4ef, 0x6, 0x3, 0x3, 0x3, 0x800, 0x90, 0x1, 0x9, 0x2, 0xffffff28, 0xfffff2c8, 0x2, 0x3, 0x3, 0x1ecc, 0x1, 0x40, 0x60, 0xfff, 0x7, 0x1400000, 0x3, 0x7ff, 0x4, 0xfffffffa, 0x8, 0x8, 0x1, 0x5, 0x3, 0xf085, 0x3, 0x9, 0x80000000, 0x10001, 0x0, 0x6, 0x7ff, 0x8, 0x3cf, 0x7, 0x19220447, 0xffff661d, 0x56c0, 0x0, 0x8c, 0x1, 0x7, 0xfffffd6d, 0x6, 0x8, 0x9, 0x9, 0x401, 0xd, 0x9302, 0x25e5, 0xfffffffe, 0x4, 0x1, 0x0, 0xa2, 0xfffffffd, 0x10001, 0x9, 0x9, 0x9, 0x2, 0x2, 0x6, 0x200, 0xfffff001, 0x8, 0x38d0, 0x7, 0xff, 0x0, 0x82, 0x4, 0xfffffff7, 0xa, 0x6, 0x8, 0x8, 0x101, 0x1, 0x6, 0x146, 0x9, 0x5, 0x6, 0x6, 0x10000]}) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_EVENTS(r5, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0xe) r6 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r6, 0xc0d05605, &(0x7f00000005c0)={0x2, @sliced={0x0, [0x8, 0x800, 0x4464, 0x4, 0x7, 0x9, 0x76, 0x2, 0x7, 0x2, 0xe, 0x4, 0x8, 0x6, 0x2, 0x9, 0x3, 0x5, 0x4, 0x3, 0x2, 0x1ff, 0x0, 0x3, 0x8, 0x1, 0x4, 0x7ff, 0x9244, 0x8, 0xfff9, 0xfffb, 0x5, 0x5, 0x2a8, 0x9, 0x9, 0x6, 0x800, 0x1ff, 0xe, 0xfffe, 0x4d8, 0x7, 0x1, 0xdd, 0x8, 0x8], 0x6}}) shutdown(r5, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000180)=[@in6={0xa, 0x4e24, 0x4, @ipv4={'\x00', '\xff\xff', @remote}, 0x10001}]}, &(0x7f0000000440)=0x10) setsockopt$inet_sctp6_SCTP_AUTH_DELETE_KEY(r5, 0x84, 0x19, &(0x7f00000001c0)={r7, 0x4}, 0x8) r8 = socket$nl_rdma(0x10, 0x3, 0x14) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000140)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_MPATH(r9, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r10, @ANYBLOB="010027bd7000dbdf25170000000800030000", @ANYRES32=r11, @ANYBLOB], 0x1c}, 0x1, 0x0, 0x0, 0x48814}, 0x20020010) r12 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r12, 0x40086602, &(0x7f00000001c0)=0x10) r13 = socket$nl_generic(0x10, 0x3, 0x10) r14 = syz_genetlink_get_family_id$devlink(&(0x7f0000000080), r13) sendmsg$DEVLINK_CMD_SB_POOL_GET(r13, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000016c0)=ANY=[@ANYBLOB="40c377767b000000", @ANYRES16=r14, @ANYBLOB="010029bd7000fddbdf250f000000080001007063690011000200303030303a30303a31302e300000000008000b0000000000060011000d000000"], 0x40}, 0x1, 0x0, 0x0, 0x800}, 0x4) getsockopt$inet_sctp_SCTP_MAX_BURST(r12, 0x84, 0x14, &(0x7f00000000c0), &(0x7f0000000100)=0x4) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r5, 0x84, 0x21, &(0x7f0000000080)=0x7, 0x4) 11m36.993939518s ago: executing program 6 (id=1675): openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x4000) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r0, &(0x7f00000004c0)=[{&(0x7f00000001c0)="10cf05d503", 0x5}], 0x1, 0xa) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001d906e20501dc6609b620103000109021b0001000010000904f7000176246700090582020002"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000000380)=""/206, 0xce}], 0x1, 0x5ff, 0x4) close_range(r2, 0xffffffffffffffff, 0x200000000000000) mremap(&(0x7f0000a01000/0x4000)=nil, 0x4000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000050a000/0x1000)=nil, 0x1000, 0x6000, 0x71895bd1a45b0b0f, &(0x7f0000166000/0x6000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) 11m21.446184403s ago: executing program 36 (id=1675): openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), 0x4000) pipe(&(0x7f0000000300)={0xffffffffffffffff}) vmsplice(r0, &(0x7f00000004c0)=[{&(0x7f00000001c0)="10cf05d503", 0x5}], 0x1, 0xa) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='blkio.bfq.io_wait_time_recursive\x00', 0x275a, 0x0) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100001d906e20501dc6609b620103000109021b0001000010000904f7000176246700090582020002"], 0x0) r3 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) preadv(r3, &(0x7f0000000240)=[{&(0x7f0000000380)=""/206, 0xce}], 0x1, 0x5ff, 0x4) close_range(r2, 0xffffffffffffffff, 0x200000000000000) mremap(&(0x7f0000a01000/0x4000)=nil, 0x4000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000050a000/0x1000)=nil, 0x1000, 0x6000, 0x71895bd1a45b0b0f, &(0x7f0000166000/0x6000)=nil) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r1, 0x0) 9m39.110566875s ago: executing program 8 (id=2145): r0 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r0, &(0x7f0000000180)=@in6={0x21, 0x1, 0x2, 0x1c, {0xa, 0x4e1d, 0x8, @ipv4={'\x00', '\xff\xff', @loopback}, 0x8}}, 0x24) bind$rxrpc(r0, &(0x7f0000000080)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x4e21, @local}}, 0x24) mount$bpf(0x0, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000080), 0x80, &(0x7f00000001c0)=ANY=[@ANYBLOB='mode=00000000000000000000015,\x00']) 9m38.980468223s ago: executing program 8 (id=2146): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) ioctl$sock_bt_hci(r0, 0x800448d2, 0x0) (async, rerun: 64) r1 = socket$key(0xf, 0x3, 0x2) (rerun: 64) r2 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r2, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f00000001c0)={0x28, 0x6, r3, 0x0, &(0x7f0000000100)="0e", 0x1, 0x3ff}) (async) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f0000000200)={0x28, 0x3, r3, 0x0, &(0x7f0000000a40)="7f", 0x1, 0x4}) ioctl$IOMMU_IOAS_MAP$PAGES(r2, 0x3b85, &(0x7f00000002c0)={0x28, 0x4, r3, 0x0, &(0x7f0000ffb000/0x1000)=nil, 0x1000, 0x7}) ioctl$IOMMU_IOAS_MAP(r2, 0x3b85, &(0x7f0000000140)={0x28, 0x4, r3, 0x0, &(0x7f0000000300)="b1", 0x1, 0x8000000000000801}) (async) ioctl$IOMMU_IOAS_UNMAP(r2, 0x3b86, &(0x7f0000000180)={0x18, r3, 0x40, 0xfffffffb}) (async) ioctl$FS_IOC_GET_ENCRYPTION_POLICY(r1, 0x400c6615, &(0x7f0000000000)={0x0, @aes256, 0x0, @desc2}) (async) r4 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_mtu_probing\x00', 0x2, 0x0) syz_usb_connect(0x5, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="120100000cb768405e0483020b990102030109022400010000000009040000025c291d000905090000000006f808050ae500c4"], 0x0) (async, rerun: 64) r5 = socket$packet(0x11, 0x2, 0x300) (rerun: 64) ioctl$ifreq_SIOCGIFINDEX_vcan(r5, 0x8933, &(0x7f0000000200)={'vcan0\x00', 0x0}) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) (async) sendto$packet(r5, &(0x7f0000000080)="18", 0x10, 0x0, &(0x7f00000000c0)={0x11, 0xc, r6, 0x1, 0x0, 0x6, @multicast}, 0x14) (async) read$FUSE(r4, 0x0, 0x0) (async) syz_usb_connect(0x3, 0x2d, &(0x7f0000000240)=ANY=[@ANYRESDEC=r5, @ANYRESOCT=r3], 0x0) (async, rerun: 64) sendmsg$key(0xffffffffffffffff, &(0x7f0000001e40)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[], 0x70}}, 0x40) (rerun: 64) 9m38.669945758s ago: executing program 8 (id=2148): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f00000003c0)={0x0, 0x0, r2, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r1, 0xc06864ce, &(0x7f0000000280)={r3, 0x0, 0x10001, 0x0, 0x0, [0x0], [0x0, 0x0, 0x4], [], [0x0, 0x3, 0x400000028, 0xfffffffffffffffc]}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000100)={r4}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r1, 0xc00c642d, &(0x7f0000000180)={r4, 0x80000}) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0xb, 0x59032, 0xffffffffffffffff, 0x0) r6 = userfaultfd(0x801) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0xa031, 0xffffffffffffffff, 0x0) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) r7 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_TLV_COMMAND(r7, 0xc008551c, &(0x7f00000020c0)={0x4, 0x8, [0x0, 0x0]}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) ioctl$UFFDIO_COPY(r6, 0xc028aa03, &(0x7f0000000100)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000339000/0x1000)=nil, 0x800000}) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000580)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={0x24, r8, 0x1, 0x70bd29, 0x25dfdbff, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_SCAN_FLAGS={0x8, 0x9e, 0x10}]}, 0x24}, 0x1, 0x0, 0x0, 0x90}, 0x84) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={{0x14}, [@NFT_MSG_NEWRULE={0x70, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x4}, [@NFTA_RULE_EXPRESSIONS={0x44, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_LIMIT_TYPE={0x8}]}}}, {0x24, 0x1, 0x0, 0x1, @cmp={{0x8}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_CMP_OP={0x8, 0x2, 0x1, 0x0, 0x5}, @NFTA_CMP_SREG={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_CMP_DATA={0x4}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x98}, 0x1, 0x0, 0x0, 0x850}, 0x0) 9m38.369298243s ago: executing program 8 (id=2152): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x40000, 0x0) mmap(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1000001, 0x32, 0xffffffffffffffff, 0x0) ioctl$KVM_GET_MSR_INDEX_LIST(r0, 0xc004ae02, &(0x7f00000017c0)) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x3b, 0x90, 0x67, 0x40, 0x45e, 0x473, 0xe434, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1c, 0x2, 0x2, 0x32, 0x52, 0xd3, 0x0, [], [{{0x9, 0x5, 0x4, 0x2, 0x0, 0x0, 0xfa}}, {{0x9, 0x5, 0x81, 0x2, 0x40, 0x0, 0x3d, 0x1}}]}}]}}]}}, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001780)={0xfffffd00, 0x3e, 0x105, 0xfffffffe, 0x0, {0x1, 0x7c}, [@typed={0x14, 0x106, 0x0, 0x0, @ipv4=@multicast2}, @nested={0x100c, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @generic="1ad4bcd078ab695f1c91d1f5e92c1182a247099ea27dc0d74ac837640cdcddddd033af5477e08934db17c53f34e474c40da627404b2d72915c2239416c20a288b32ea49df01cd3775060a9faa379c82b70e5dbc5fc2072dacbc59b521158f3b3e296b34e52a3ec9c6ca78b908a782cc32e42427109d5ed8cab33b83a674ce14dca53c1ebb532d7294cc2df43cd5a01eb3a9ac51667d96ae39fd25f2f2c9a08445998f09b10bdcb70d3ef6b5b13a00bfd38c4d0278bdb555333156c59dfc915a2faf7bd71382a76582a97f626cedeea58d10177a563ed0c9e5c9fc383cffef3bb68c6a789cd827551bdfd94217f253ac07352e60c8363e05c4f65775d64bcecb97ca10bc62f523a67a368212164367c0b519229be06727b22ba8a47dc3ad6c0e0310e79ecca0c73b3d35bf77b38cc576b4b6c7ce56207afc49462bdf7ed264c15d11f48778ca85fc3705f954046be8dd0d69274c83e91ec115dce4fdda8dd4002fcb597049af999f93e5b35ef1c0361b29ad4146d4cf498a0fc968fdfd2c1df94a11c02f2bab0f8916261eba11687c0abcc958eaa16dbf9b64b484e2290b45303fb411b9d26b66f7f35749a662f155b95ba901d58af955e3b27ff4b9b8a3bb1a46b6ecd712ddbf358a063916e3af0254f83069b3a9346452bef99c1cc0ef3e03839b8a1d9e530017b4c45e2c08c335f3e5882d52157d9aed33bc731cd6140032f56fa378144c6aec541e4ec19309e8aec5fb7a67a74bb8df811a05249ace3c6b275b2ebba5197bf041627d1dfcd3cab9ae652b951c1714969176b3dea6140bc7b6e0a1e4a838eb776ed6cc045fdd327ceaa765ec1c8216beec193bb81a5ddeaa8a49263ed73a8f109a32ec33909b95fe24a05543a825ad1e4c176c041ccf9e131e54a298c4ed62974b8c2d5c4c44785ed3ac95c4e1f2c4254b39ba357c2b91073d971327ec6e9524a17f543f29b58dfc4e8d60717bd99913b44d0c7abbe22c83e2c6ddf6ffb9b31cbe3b28fd514b7ffdfe6addfd6461a679e8b599df9bb1b3df0a244f2506d6b7092eecedc8e2710df1bd2ffcf08b24f14a14eab750e5a9478b8d7491de6df234a81c3a723456e6d3e3cf32722c35d9a19e1dbad3ecbe2464185e41c29dea4eb13b88f07c62028973b97b3ec584fa75e361ca4d9aaa0ddc0f714618ddb86d336c20767ab8dbc0f9b012fce5417a2ae64eb06dc65c92502e98ca470b53d8e1303880f56e2b41fb821e83c3bce516a5feecaac94ea0afe0fc99a90f0c4f21e46f50ea43fb9f2f90e24642c9e612f8c94fe9abdd776b9c3ea105c570c8340e8f67ff0b2b448dce9164f89e6064e397110b3faaf1867d3ebcfdc5bdb7a80dba1115792cf9779c0e3af1fd5631341db2c64943c2e6172926297f44ca0fbe9a09a863fabc90077fab4807bc70a8631ee082b6622bbdb3df06d427b13da5ded9cf5bf22cf4915e811a423b62a3249f4a2cd7b3e5e71810e43ae811f11a9aac0984f9e50f2b9446c1c79bc0896c48c7f56bc25e917025150d4d51309cf755054c63e80a9d98262869936d43dff509637af3260820afece9879eefc13cb572a06d65b685c292debc87efac38cd6eb5c162fb249a1fc9aafa92c61027ed35eee2788a3011ff2e1d365cad73abb6480e3aa15b390905e25107da3543acaa0d337bcacb31b4c75882a97bcb79612de07cd6b44090a626eb1456fca81c700f82e796a3bad1902bc9ddddca0dca52ebea5e1ceba5dfce23b544657bb8cdd9051baad3dcd2a028d09f5f0373656aa1ce187695838bfc6c8935e65a3cebc6d91efa17bb9afb5f27eb039b11e2f8bc5223ffcb164055a8f505d1419dc94d0c7ecf5569f29649e69ad09412311e4576580fff8578a96df6a05ef7e12e265d895faf839097ecfc428957b06d02edffce5f324a274205d788e944a282ed895f4cb4cf5d69ab41d8e56aa04cda5f2dee75b3a4fbf7e4cc933f5813e04da2a9460400412ba0785f5d49d5d5a8ba275c954f83e16874b47763001383c97bb7e06a89832cfc50ebe31e8ea5297c5d19d39b2f03bfa6f284e5f5a17075351edf3bdbea123b74ebd0afa580c9271c594fa8f82a3b03c33fccad49b9be4ae5188e8dab0a63fbfae69d3ed01520a867b0d3850c9b142bdef1cdcc962299c4be06baafa20660773ee0aa9412f3fb77b48a7418de50cf777f6efb52ac069ec2ec9a1850afe6821feb97d8c0516b12120f48dd9c044ef9c4f09977b55c933a6dc6ab4b5747b4cb220fae2f7241d1e15cfeff50d97e6535c047e6af887fb2b4a515743c09b2277f9cd829011161c9b5ddd5f103f7db8abf57e3fcb3c8199ccb41b85dbe9a05f076de4fa7f169b6883e73b8270f7a35068d6c99e395e411abeb45fabdc764bdd5dc7b467dc1185f6d9daba9f1d55b4dae5978266fcbdf1916bf451665e4b8c35c5bb922475fea9c7b641343f1a6ced804b770e1365edbc43fa082c206ec05b9200760e2b5a856dd6bb8ec682b652c0156c0ac0a2597e877d92b03097f8b08c8b945115f4acc88fe4ae9e25757828629133440e41594fb34b91ad68c1b771c354e60426f0602b6244c2268a0ca54261b02d26c6df8838ea02f8ec76664c49669dd44057fc4665a657563c9bcca1ea0b1e972e3989531ab7ebe6b2743493c4c9057743fd80371aad797adc830275724c6144b6f67ee7956ca56cf871f73ca51045a5a14c1e6830dbea47d5f63e97bf4006df06653b8516f5066e72664e65d6cf394a6110d21c092369af3aba30dabc7230d0826a2887398a138b2303e877b24a8027db6e1c1a1a4b473b6fc1f7583c33e770157a11703e329f48f4450f69aecd2e855d3216985ac15aa15494ce96371553d117fe5a73d1b56f0ef7268100bcfb58473bcfce618a6771d02a76023431637cc68ec03d430b22a7ec01f0126935e603b4ea93cb4c53a7bfde0272fdbc47f36605233722bb35c7fe29707712f480f207efedd530b3753a3c0c7f68839e9d1318df923073d910c7cff4a21d07779c0b72250b1c43339449f6a262fa1c7621a9d6fdef39ed3662da1766a9a525887f71b4824270730becab1dc68dedffd1fce9ffe2f4aae49abdf90e902340aaf40b3b8db800014832a934141b3d625b5bfdbd23954fdf7acaa4054eb40091fdf175deea2a9e05fa3a9d55257068831428f56bf676a61b3a599bb317fc56f59de0f89b3a55540ffa280ca7b5878477b6060dfe36054ffb6b75da757f0e01007145e115731b857eda6bf8c78f4ac99743d7b597e0f0c9a2cc8b521bd2652190d44dc067283859b3353cedd2d9e820400a7f56b6327ac3fdf8b80997a1c80b22e0be17daf4dd134f92a7290c828deff22e65b5955f12af902eae3af2cced3d1660342b28a769f486dc3b69f4756e1a18952fd92d3eb7334d7693e7e0daa40b23b18d397690da23df991898a69c3df0b54b67e92f9fdb4922f9acf5efa40a3df339483799be4039f1f1494015504a2cf0e2950029d2bbf1895462e9951bc69072f61f2402356693cf1794781e7f2a370306703ed723a0201cec8fa642c21ee260c0b9383a1097c2c4836a3486faedf3958c5d21fe7b41bb8f94111e121528edd2dd8dd646499715211875984424b9c932da2db812e6f685ae0513f60b53b24db20ff62136bebc5fe6bce6d69a57422718e91081a8d73db36b24746e8c1bce2e2fa9b94c853c90acd996537a6339f65cdab918d46bab0bdb6dc2635d981b7ab371f3ea600edd9ae17ef1b916acc2f6643f4b9297a8ee362a32c9e75e10e1765e2c81ca16dde1284aff99c93aa6bedd1708dff9819f7bb312459bcfe097cf0cb403aacc59f11f8cb179d56ee632fc2372c092d75c4f795070acca0110100af26733677fa1724fded835bde9ace0377dc0ace817c9fa0024a080067a6e8f8528d05d8b86e1f35a65119427d93bc3094f0ce131bda3381d0542a65f416342171e2e9e899798aeb67b4303c23e46322e528a492dda4af9dc98778fecbd7be7f8254ac723500ca23c84fb80e8a3691b7cbb3661db046117ac65d7993f589aee96ae37c4f8e2acbcfd2b4dad93301c24149f46e536b7b7838a8b8c184f70c8fa713af6ce1f9a2e47873089b5d9ba2bece2e411f748a98241ffa63dad0944d5e912e487388d0cf9bfe048e9606fb6ba37f901b669acd8814857a42643b8a261dc6fc900f8c7f7d3767c8e02a4edc4db6224bfffe2695f61b803cf1ce0281061b21f393ad3f4beff04b96dd64ce833f6857e250bfd6241acdf29822b4ec8a4c9868442a1723a228d59d523043a999e200acc76de1bc475b680cfa4870a401dc8dfce4643462a6957617856f634f0a057b38d430e113389c16a6aa8059866abd361f8bfc5806852dd80606f688e2464dcfb113028513762272f435da0e70f8fe52c3a5f1bf71b143f72af6f295b0373de95dc8943c32119e127fdb9bbe2bfb243314c017224720cfe001a9faca58ee8b4edb33b6cd0fcd8ad143d0ddf8fc9cfc67e9f2f9720ed69df41fd5e8cf994e0de2c2b39fd70490eb5d1fd93b30ed5dd43d50628316022f95dbdd9047ebc9732059ad2cba3b9109b627f8258fcc4074b5df6ddd730f3cdc96d3e53e54d0e993fbd24a9847985668b66ee3ae4a0a0334644d7fcdd528dc8791e8e087482c418034b88639b4b816bbcc2080de7699f097935f017817989e81e67d60d801e5d79274fc4024007d51d86b9d0b1e803c13500b062a6f5777690d4fc104943ddc381128c0bdeb96cae98324ddda400f06e0893f46123e28db4d81955829555f1c8c04a53ef7c46414db4be4c5c77f116899c67b5f5b30b27cd5bb9c898a240bc7d2105e47284d74a9ffebd05da99912f996209cfad12fe029020087aea98398dc83233eb433ad69172254f818ba6d5f8cb512ecf75da62fef553f5cab3fd4b41473ef10157754c0d6718da7ce848651dce2d5f2c77d5c89ac3543fe3eab00c0ed67f333740dbefce789c500b6ce5909357526f28cf0931bc06925f4b473724440f57ed7e3ed9b347fe6549c176332fb73a667adfba52649313783f333f970f8c5764e5dc5aaf1764e2e84ad66aa62a60466edbda6ffd3c14fb931d8a723d8835ebf52b862e87b1f2dab73cb425937491a6674b99114d802ba6d0258c2201a83a890c299ec1d702fe51298f9a25261d5f32e589292136bf8c6bb60b20c5b26e250629f41b4239c11c5b561c243340a7d92229f466dd314958b3f1dc3d654a012054fe3f04e1dd3b503af24838bd4739209d57186025a256cdac8664c130fad030fb3e30c3abff1e261f0f341dc86cb82d00f982234e59e770807316db9687f50aabb6e24de0b34199969b015321f78f9bd8a545b1d66f720fbce27b9109cb728a2737319b540806a20515473149dbea3219ec9ac384660a136af7c3069a7bb1eb4e6c6c15b286f61da4aedbbeb59794d493a2c2dcb931e00b31ac56882a50f438f9862b0083f377c27a87fa0bc556dd2969323903820bd93ebb53d6cabd991539aaa9b3d4fdad99019763932e990a6a484403421ab542518be66f9066a8a5447ad959354d2c623d95a9f26fdbd1aeb62f5b07d956c138b037ac30532c6d761e6a5a34b5ff45969df7f0e63fbae2663a6f29e7f2a128c36bef295448cacd123901e1e7ab08dc6be3a3826ad3c039221159cd63f42676b627eb81d9d8ccc00928354e05ddf5a725a4876f3d79f07428b78e6db5858f5fdfb5d1b99f16ebec5a8457ce0b9188ecad01e5350b630738dec33ddc5606a776b606fcf5fbdffa2e941c31710b"]}, @nested={0x4, 0x2}]}, 0x1038}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) r2 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r2, 0x89e2, &(0x7f0000000040)={r2}) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r1) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r1, &(0x7f00000001c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000000140)={&(0x7f0000000740)={0x82c, r3, 0x0, 0x70bd2c, 0x25dfdbff, {{}, {@void, @void}}, [@NL80211_ATTR_TX_RATES={0x150, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x38, 0x0, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x21, 0x1, [0x4, 0x6c, 0x6, 0x6c, 0x1b, 0x12, 0x6, 0x1f, 0x12, 0x48, 0xb, 0x9, 0xb, 0xb, 0x6c, 0x12, 0x1, 0x36, 0x9, 0x12, 0x36, 0x6, 0x9, 0x18, 0x9, 0x30, 0x36, 0x48, 0x4]}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_5GHZ={0x6c, 0x1, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x50, 0x18, 0x6a, 0x6c, 0x60, 0x4, 0x60, 0x6, 0x0, 0x2, 0x4, 0x7b, 0x16, 0x3, 0x60, 0x18, 0x6c, 0x0, 0xb, 0x16, 0x4, 0x6c, 0x9, 0xc, 0x60]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x4c9, 0x0, 0xe, 0x8, 0x0, 0x7, 0x9]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xff, 0x1000, 0x800, 0x2, 0x8, 0xffd3, 0x8, 0x1ff]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}, @NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0x3, 0x5, 0x8f9, 0x7, 0x9, 0x8, 0x2]}}]}, @NL80211_BAND_5GHZ={0x14, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5}, @NL80211_TXRATE_HT={0x8, 0x2, [{0x3, 0xa}, {0x4, 0x6}, {0x5, 0x9}, {0x1, 0x5}]}]}, @NL80211_BAND_60GHZ={0x7c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_LEGACY={0x1e, 0x1, [0x16, 0x2, 0x12, 0x30, 0x60, 0x24, 0x48, 0xb, 0x16, 0x12, 0x6, 0x1b, 0x6, 0xb, 0x1, 0x30, 0x9, 0x60, 0x9, 0x48, 0x48, 0xc, 0x1, 0x3, 0x6c, 0x5]}, @NL80211_TXRATE_HT={0x30, 0x2, [{0x0, 0x6}, {0x2, 0x3}, {0x2, 0x7}, {0x0, 0x2}, {0x1, 0x5}, {0x1, 0x2}, {0x0, 0x3}, {0x0, 0x1}, {0x2, 0x7}, {0x6, 0x7}, {0x3, 0x4}, {0x1, 0x4}, {0x0, 0xa}, {0x1, 0x7}, {0x4, 0x5}, {0x0, 0x4}, {0x1}, {0x2, 0x5}, {0x0, 0x5}, {0x2, 0xa}, {0x0, 0x1}, {0x1, 0xa}, {0x3, 0x3}, {0x6, 0x6}, {0x0, 0x1}, {0x1, 0x5}, {0x6, 0xa}, {0x0, 0x7}, {0x5, 0x2}, {0x7, 0x8}, {0x5, 0x3}, {0x2, 0x7}, {0x3, 0x2}, {0x6, 0x5}, {0x3, 0xa}, {0x0, 0x5}, {0x5, 0x7}, {0x3, 0x1}, {0x1}, {0x1, 0x5}, {0x1, 0x6}, {0x0, 0x3}, {0x7, 0x2}, {0x6, 0x2}]}, @NL80211_TXRATE_LEGACY={0x17, 0x1, [0x48, 0x30, 0x4, 0x12, 0xb, 0x36, 0x16, 0x0, 0x5, 0x30, 0x18, 0x6c, 0x5, 0x34, 0x6, 0x6, 0x6c, 0x24, 0x6c]}]}]}, @NL80211_ATTR_TX_RATES={0x1ac, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x60, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HT={0x3d, 0x2, [{0x0, 0x2}, {0x5, 0x8}, {0x7, 0x8}, {0x7}, {0x1, 0x1}, {0x7, 0x7}, {0x1}, {0x4, 0x1}, {0x4, 0x6}, {0x5, 0x8}, {0x0, 0x6}, {0x1, 0x3}, {0x2, 0x9}, {0x7, 0x3}, {0x5, 0x5}, {0x0, 0x5}, {0x2, 0xa}, {0x6}, {0x3, 0x6}, {0x3, 0x6}, {0x7, 0xa}, {0x7, 0x9}, {0x7, 0x3}, {0x1, 0x4}, {0x5, 0xa}, {0x7, 0x4}, {0x2, 0x5}, {0x6, 0x4}, {0x0, 0x7}, {0x5, 0x5}, {0x2, 0x8}, {0x6, 0x5}, {0x1, 0x2}, {0x4, 0xa}, {0x6, 0xa}, {0x0, 0xa}, {0x7, 0x9}, {0x5, 0xa}, {0x3, 0x7}, {0x2, 0x7}, {0x3}, {0x1, 0x7}, {0x6, 0x2}, {0x1, 0x5}, {0x3, 0x1}, {0x7, 0x9}, {0x2, 0x4}, {0x4, 0xa}, {0x7, 0x7}, {0x1, 0x7}, {0x0, 0x5}, {0x4, 0x8}, {0x6, 0x9}, {0x0, 0x8}, {0x5}, {0x3, 0x5}, {0x0, 0x8}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x8, 0xfffa, 0x0, 0x802, 0x7350, 0x5]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_5GHZ={0x34, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x1ff, 0x4, 0x6, 0x200, 0x101, 0x3, 0x1, 0x3a10]}}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x1, 0x48, 0x36, 0x59, 0x0, 0x9, 0x2, 0x6c, 0x2d, 0x30, 0x18, 0x9, 0x5]}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}]}, @NL80211_BAND_2GHZ={0xac, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x23, 0x2, [{0x7, 0xa}, {0x5, 0x2}, {0x6, 0x2}, {0x4, 0x8}, {0x0, 0x5}, {}, {0x2, 0xa}, {0x4, 0x3}, {0x7, 0x9}, {0x1, 0x9}, {0x5, 0x3}, {0x2, 0x5}, {0x0, 0xa}, {0x0, 0x6}, {0x5, 0x3}, {0x5, 0x4}, {0x1, 0x6}, {0x7, 0xa}, {0x1, 0x9}, {0x6}, {0x1, 0x6}, {0x2, 0x4}, {0x1, 0x9}, {0x5, 0x6}, {0x0, 0x8}, {0x3, 0x7}, {0x2}, {0x3, 0x1}, {0x5, 0x7}, {0x4, 0xa}, {0x2, 0x8}]}, @NL80211_TXRATE_LEGACY={0x24, 0x1, [0x3, 0x12, 0x16, 0x6, 0x75, 0x9, 0x6c, 0x0, 0x12, 0x2, 0x9, 0x9, 0x12, 0x16, 0x3, 0x2, 0x36, 0x6, 0x16, 0x9, 0x9, 0x4, 0x1, 0x4, 0x48, 0x36, 0x24, 0x3, 0x12, 0x5, 0x24, 0x48]}, @NL80211_TXRATE_HT={0x3f, 0x2, [{0x6, 0x3}, {0x2, 0x3}, {0x2, 0x8}, {0x3}, {0x0, 0x2}, {0x0, 0x4}, {0x3}, {0x3, 0x1}, {0x4, 0x5}, {0x1, 0x7}, {0x5, 0x2}, {0x1, 0x8}, {0x0, 0x4}, {0x7, 0x7}, {0x2, 0xa}, {0x5}, {0x0, 0xa}, {0x3, 0x8}, {0x5, 0x2}, {0x0, 0x6}, {0x0, 0x9}, {0x1, 0x4}, {0x6, 0x6}, {0x6, 0x3}, {0x6, 0x5}, {0x4, 0x5}, {0x4, 0x2}, {}, {0x2, 0x6}, {0x0, 0x4}, {0x4}, {0x0, 0x9}, {0x1, 0x8}, {0x2, 0x2}, {0x3}, {0x2, 0x4}, {0x0, 0x3}, {0x1, 0x2}, {0x3, 0x5}, {0x6, 0x9}, {0x0, 0x8}, {0x1, 0x3}, {0x3, 0xa}, {0x7, 0x9}, {0x4, 0x5}, {0x7, 0x5}, {0x2, 0x2}, {0x1, 0x3}, {0x5, 0x3}, {0x7, 0x3}, {0x1, 0x3}, {0x4, 0x6}, {0x1, 0x7}, {0x5, 0x7}, {0x6, 0x2}, {0x1, 0x9}, {0x6, 0x5}, {0x2, 0x7}, {0x7, 0x9}]}, @NL80211_TXRATE_HT={0x1e, 0x2, [{0x3, 0x6}, {0x5, 0x5}, {0x7, 0x6}, {0x7}, {0x3, 0x4}, {0x2}, {0x1, 0x9}, {0x3, 0x6}, {}, {0x7, 0x3}, {0x7, 0x4}, {0x0, 0x8}, {0x2, 0xa}, {0x2, 0x7}, {0x7, 0x3}, {0x7}, {0x5, 0x4}, {0x2, 0x8}, {0x0, 0x2}, {0x4, 0x4}, {0x0, 0x7}, {0x7, 0x8}, {0x5, 0x2}, {0x1, 0x5}, {0x7, 0x3}, {0x2, 0x4}]}]}, @NL80211_BAND_60GHZ={0x34, 0x2, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x9, 0x4, 0x5, 0xffff, 0x11f, 0x7, 0x9, 0x8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HT={0xa, 0x2, [{0x0, 0x2}, {0x0, 0x4}, {0x3, 0x2}, {0x3, 0x6}, {0x5, 0x6}, {0x0, 0x9}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x2}]}, @NL80211_BAND_2GHZ={0x34, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0xc, 0x4895, 0x40, 0xef57, 0x2, 0x5, 0x7, 0x13fc]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x0, 0xafe, 0x0, 0x3, 0x6, 0x8f, 0x8, 0x88de]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}]}, @NL80211_ATTR_TX_RATES={0x180, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0xe8, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x81, 0x3, 0x0, 0x5, 0x2, 0x40, 0x5, 0x3]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0x2, 0x6, 0x7, 0x7ff, 0x21, 0xcb3, 0x8]}}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x3, 0x800, 0xfffe, 0x1, 0x4, 0x4, 0x6, 0x800]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0x6, 0xb, 0x2, 0x9, 0x9, 0x5, 0x4, 0x6c, 0x1, 0x4, 0x48, 0x1, 0xc, 0xb, 0xc, 0x1b]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x7, 0x0, 0x0, 0x4, 0xb, 0x3, 0xb085, 0x5]}}, @NL80211_TXRATE_HT={0x48, 0x2, [{0x0, 0x7}, {0x6, 0x8}, {0x1, 0x2}, {0x7, 0x3}, {0x1, 0x1}, {0x5, 0x8}, {0x0, 0x7}, {0x1, 0x7}, {0x3, 0x8}, {0x3, 0x1}, {0x0, 0x4}, {0x4, 0x2}, {0x3, 0x9}, {0x6, 0x8}, {0x1}, {0x2}, {0x6, 0x5}, {0x0, 0x4}, {0x7, 0x3}, {0x0, 0x5}, {0x4, 0x8}, {0x2, 0x5}, {0x0, 0xa}, {0x7, 0x9}, {0x5, 0x5}, {0x2, 0x8}, {0x2}, {0x2, 0x3}, {0x3, 0xa}, {0x6, 0x2}, {0x4, 0xa}, {0x1, 0x2}, {0x1, 0x7}, {0x0, 0x4}, {0x5, 0x8}, {0x2, 0x5}, {0x1, 0x3}, {0x7, 0x1}, {0x1}, {0x0, 0x4}, {0x2, 0x4}, {0x2, 0x3}, {0x7, 0x5}, {0x0, 0x7}, {0x0, 0x7}, {0x6, 0x5}, {0x1, 0x4}, {0x7, 0x9}, {0x0, 0x8}, {0x0, 0x4}, {0x1, 0x9}, {0x7, 0x1}, {0x3, 0x8}, {0x7, 0x6}, {0x7, 0x2}, {0x7, 0x1}, {0x3, 0x5}, {0x7}, {0x5, 0xa}, {0x6, 0x1}, {0x3}, {0x5, 0x6}, {0x6, 0x4}, {0x2, 0x4}, {0x0, 0x9}, {0x3}, {0x0, 0x8}, {0x6, 0x4}]}, @NL80211_TXRATE_HT={0x2f, 0x2, [{0x2, 0x8}, {0x6, 0x2}, {0x6, 0x4}, {0x4, 0x2}, {0x5, 0x3}, {0x0, 0x9}, {0x0, 0x7}, {0x5, 0x6}, {0x1}, {0x1, 0x6}, {0x1, 0x2}, {0x1, 0x8}, {0x6, 0x5}, {0x3, 0x8}, {0x1, 0x4}, {0x3, 0xa}, {0x7, 0x5}, {0x1, 0x7}, {0x0, 0x1}, {0x1, 0x1}, {0x7, 0x2}, {0x6}, {0x5, 0xa}, {0x5, 0x4}, {0x5, 0x7}, {0x7, 0x1}, {0x2, 0x3}, {0x1, 0x6}, {0x2, 0x7}, {0x4, 0x9}, {0x2, 0x4}, {0x4, 0x8}, {0x0, 0x9}, {0x1, 0x1}, {0x0, 0x6}, {0x2, 0x4}, {0x1, 0xa}, {0x3, 0x3}, {0x1, 0x1}, {0x4, 0x2}, {0x0, 0x8}, {0x1, 0x4}, {0x7, 0x1}]}]}, @NL80211_BAND_2GHZ={0x4c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x4, 0xff42, 0x7, 0x9, 0x5, 0x2, 0x400, 0xfff8]}}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x8, 0x4, 0xffff, 0x2, 0xa462, 0x400, 0x10]}}]}, @NL80211_BAND_6GHZ={0x34, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x1d, 0x1, [0x6, 0x1b, 0x4, 0xc, 0x36, 0x1b, 0x30, 0x18, 0x18, 0x5, 0x6c, 0x12, 0x1, 0xb, 0x36, 0x24, 0xc, 0x60, 0xb, 0x5, 0x30, 0x5, 0x18, 0x1, 0xb]}, @NL80211_TXRATE_LEGACY={0x5, 0x1, [0x12]}, @NL80211_TXRATE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_GI={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x134, 0x5a, 0x0, 0x1, [@NL80211_BAND_2GHZ={0x40, 0x0, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x2bd2, 0x3, 0x0, 0x8, 0x6, 0x8001, 0x2, 0xffdf]}}, @NL80211_TXRATE_LEGACY={0x14, 0x1, [0x3, 0xb, 0x2, 0x9, 0x18, 0x12, 0x30, 0xeb8dae31de22a2e5, 0x5, 0x24, 0x0, 0x16, 0xb, 0x3, 0x1b, 0x1]}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x7, 0x5, 0xbc70, 0xe, 0x2, 0x128, 0x0, 0x1]}}]}, @NL80211_BAND_6GHZ={0x4c, 0x3, 0x0, 0x1, [@NL80211_TXRATE_LEGACY={0x4}, @NL80211_TXRATE_HT={0x43, 0x2, [{0x0, 0x4}, {0x6, 0x2}, {0x4, 0x4}, {0x3, 0x9}, {0x6, 0x4}, {0x1, 0x8}, {0x0, 0x7}, {0x1, 0x9}, {0x4}, {0x3, 0x2}, {0x7}, {0x4, 0x7}, {0x3, 0x2}, {0x3, 0x1}, {0x5, 0x2}, {0x6, 0x4}, {0x2, 0x8}, {0x6, 0x1}, {0x3, 0x2}, {0x3, 0x1}, {0x0, 0x1}, {0x3, 0x7}, {0x4, 0x7}, {0x3, 0x6}, {0x0, 0x5}, {0x6, 0x7}, {0x7, 0x6}, {0x1}, {0x1, 0x4}, {0x1, 0xa}, {0x3, 0x9}, {0x0, 0x6}, {0x3, 0x2}, {0x0, 0x3}, {0x4, 0x8}, {0x3}, {0x1, 0x4}, {}, {0x7, 0x9}, {0x4}, {0x3, 0x5}, {0x4, 0x1}, {0x1, 0x9}, {0x7, 0xa}, {0x1, 0x5}, {0x0, 0x8}, {0x3, 0x5}, {0x5}, {0x4, 0x8}, {0x2}, {}, {0x4, 0x6}, {0x3, 0x8}, {0x1, 0x7}, {0x0, 0x3}, {0x5, 0x1}, {0x2, 0x3}, {0x7, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x0, 0xa}, {0x4, 0x9}, {0x6, 0x2}]}]}, @NL80211_BAND_2GHZ={0x90, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HT={0x22, 0x2, [{0x3, 0x3}, {0x0, 0xa}, {0x3, 0x1}, {0x3}, {0x1, 0x6}, {0x0, 0x5}, {}, {0x0, 0x8}, {0x6, 0x3}, {0x6, 0x9}, {0x6}, {0x5, 0x9}, {0x1, 0x5}, {0x7, 0x3}, {0x0, 0x5}, {0x7, 0x2}, {0x0, 0x1}, {0x6, 0x2}, {0x2, 0x5}, {0x5, 0x3}, {0x4, 0x4}, {0x2, 0x9}, {0x3, 0x7}, {0x1, 0x6}, {0x1, 0x9}, {0x2, 0x2}, {0x7, 0xa}, {0x2, 0x9}, {0x7, 0x8}, {0x3, 0x9}]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xc, 0x5c09, 0x0, 0x3, 0xb22, 0xd27, 0xfff6, 0xfff]}}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0xf, 0x7, 0x9, 0xf558, 0x2, 0x1000, 0xfff9, 0x6]}}, @NL80211_TXRATE_HT={0x37, 0x2, [{0x1, 0x4}, {0x0, 0x2}, {0x4, 0x2}, {0x6, 0x8}, {0x0, 0x4}, {0x6, 0x3}, {0x5, 0x9}, {0x1, 0x1}, {0x4, 0x3}, {0x1, 0x3}, {0x5, 0x4}, {0x5, 0x9}, {0x2, 0x9}, {0x1, 0x1}, {0x5, 0x2}, {0x2}, {0x6, 0x9}, {0x4, 0x9}, {0x2, 0x3}, {0x4, 0x5}, {0x4, 0xa}, {0x2}, {0x2}, {0x1, 0x8}, {0x1, 0x5}, {0x1, 0xa}, {0x2, 0x1}, {0x1, 0x4}, {0x3, 0x8}, {0x0, 0x1a}, {0x5, 0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x0, 0x8}, {0x5, 0xa}, {0x7}, {}, {0x6, 0x8}, {0x5, 0x5}, {0x6, 0x4}, {0x2, 0x5}, {0x2, 0x6}, {0x3, 0x2}, {0x7, 0x7}, {0x0, 0x8}, {0x4, 0x5}, {0x3, 0x8}, {0x4}, {0x4, 0x7}, {0x5, 0x8}, {0x6}]}]}, @NL80211_BAND_6GHZ={0x14, 0x3, 0x0, 0x1, [@NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE_LTF={0x5}]}]}, @NL80211_ATTR_TX_RATES={0x1e8, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x2, 0x0, 0x9c, 0x4, 0x86b, 0x0, 0x4, 0x8000]}}]}, @NL80211_BAND_60GHZ={0x74, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0xfffc, 0x4, 0x1ff, 0x9, 0x1a, 0x80, 0xffff, 0xf2]}}, @NL80211_TXRATE_HT={0x27, 0x2, [{0x4, 0x6}, {0x5, 0x3}, {0x4, 0x2}, {0x4, 0x4}, {0x6, 0x6}, {0x7, 0x7}, {0x6, 0x8}, {0x4, 0x9}, {0x7, 0x7}, {0x6}, {0x7, 0x5}, {0x3, 0x7}, {0x4}, {0x4, 0x2}, {0x0, 0x2}, {0x4, 0x5}, {0x6, 0x3}, {0x5, 0x6}, {0x3}, {0x7, 0x8}, {0x4, 0x4}, {0x4, 0x9}, {0x6, 0x5}, {0x7, 0x1}, {0x0, 0xa}, {0x1, 0x9}, {0x4}, {0x6, 0x4}, {0x0, 0x7}, {0x0, 0x5}, {0x0, 0x5}, {0x2, 0x1}, {0x7, 0x9}, {0x4, 0x4}, {0x0, 0x1}]}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_HT={0x13, 0x2, [{0x4, 0x2}, {0x4, 0xb}, {0x1, 0xa}, {0x5, 0x7}, {0x4, 0x9}, {0x0, 0xa}, {0x6, 0x6}, {0x3, 0x5}, {0x5, 0x1}, {0x7, 0x5}, {0x0, 0x3}, {0x7, 0x4}, {0x5, 0x7}, {0x6, 0xa}, {0x4, 0x9}]}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}]}, @NL80211_BAND_60GHZ={0x1c, 0x2, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}]}, @NL80211_BAND_6GHZ={0x50, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HT={0x4c, 0x2, [{0x7, 0x2}, {0x4, 0x3}, {0x1, 0x7}, {0x0, 0x8}, {0x0, 0x4}, {0x5, 0x9}, {0x1, 0x4}, {0x4, 0xa}, {0x5, 0x6}, {0x3, 0xa}, {0x2}, {0x3, 0x3}, {0x5, 0x7}, {0x5, 0x6}, {0x1, 0xa}, {0x0, 0x5}, {0x3, 0x1}, {0x0, 0x1}, {0x5, 0x9}, {0x2, 0x1}, {0x3, 0x2}, {0x7, 0x9}, {0x3, 0x3}, {0x3, 0x2}, {0x0, 0x1}, {0x1, 0xa}, {0x1, 0x4}, {0x3, 0xa}, {0x6, 0x4}, {0x4, 0x6}, {0x3}, {0x1, 0x4}, {0x5, 0xa}, {0x2}, {0x6, 0x5}, {0x7, 0x7}, {0x5, 0x3}, {0x3, 0x1}, {0x1, 0x9}, {0x5, 0xa}, {0x6, 0xa}, {0x2}, {0x6, 0x1}, {0x3, 0x5}, {0x1, 0x8}, {0x4, 0xa}, {0x0, 0x6}, {0x6, 0x5}, {0x1, 0x5}, {}, {0x0, 0x2}, {0x1, 0xa}, {0x1, 0x8}, {0x5, 0x6}, {0x7, 0x4}, {0x7, 0x7}, {0x4, 0x7}, {0x6, 0xa}, {0x2, 0x1}, {0x4, 0x2}, {0x2, 0x2}, {0x0, 0x9}, {0x7}, {0x0, 0x4}, {0x1, 0x8}, {0x1, 0x5}, {0x6, 0x1}, {0x4, 0x9}, {0x7, 0x5}, {0x1, 0x9}, {}, {0x2, 0x3}]}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE={0x14, 0x5, {[0x5, 0x0, 0x6, 0x5, 0x7, 0x4, 0x1, 0x9]}}, @NL80211_TXRATE_HE_GI={0x5}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x800, 0x7f, 0x9, 0x8001, 0x8, 0x1, 0x5, 0x4]}}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}, @NL80211_BAND_5GHZ={0xc, 0x1, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5}]}, @NL80211_BAND_2GHZ={0x3c, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_LEGACY={0x19, 0x1, [0x9, 0xc, 0x1b, 0x60, 0xc, 0x18, 0x24, 0x12, 0x5, 0x60, 0x6, 0x48, 0x24, 0x30, 0x2e, 0x0, 0x2, 0x18, 0x16, 0x1, 0x2]}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x1ff, 0x1, 0x5, 0x2e69, 0x7, 0xfff8, 0x171, 0x2]}}]}, @NL80211_BAND_6GHZ={0x68, 0x3, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x1, 0x81, 0x4, 0x2, 0x5, 0x820, 0x2, 0x9]}}, @NL80211_TXRATE_LEGACY={0x11, 0x1, [0x6c, 0x9, 0x3, 0x30, 0x3, 0xc, 0x16, 0xc, 0x36, 0x36, 0x1, 0x5, 0x5]}, @NL80211_TXRATE_HT={0x24, 0x2, [{0x7, 0x5}, {0x6, 0x8}, {0x5, 0x3}, {0x1}, {0x6, 0x1}, {0x5, 0x9}, {0x1, 0x3}, {0x6, 0x5}, {0x2, 0x6}, {0x6, 0x9}, {0x7, 0x6}, {0x4, 0xa}, {0x1, 0x6}, {0x7, 0x4}, {0x1, 0x6}, {0x5, 0x7}, {0x6, 0x3}, {0x3, 0x16}, {0x6, 0x1}, {0x4, 0x8}, {0x7, 0x7}, {0x5, 0x2}, {0x7, 0x7}, {0x3, 0x6}, {0x6, 0xa}, {0x1, 0x7}, {0x5, 0x4}, {0x6}, {0x7}, {0x0, 0x1}, {0x1, 0x2}, {0x2}]}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_GI={0x5, 0x4, 0x2}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}, @NL80211_ATTR_TX_RATES={0x80, 0x5a, 0x0, 0x1, [@NL80211_BAND_60GHZ={0x4}, @NL80211_BAND_5GHZ={0x4}, @NL80211_BAND_6GHZ={0x60, 0x3, 0x0, 0x1, [@NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}, @NL80211_TXRATE_VHT={0x14, 0x3, {[0x6, 0x6, 0x800, 0xea53, 0xfffe, 0x4, 0x3, 0x8a4]}}, @NL80211_TXRATE_GI={0x5, 0x4, 0x1}, @NL80211_TXRATE_HE_GI={0x5, 0x6, 0x2}, @NL80211_TXRATE_GI={0x5}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x9, 0x0, 0xe0, 0x7, 0x0, 0x5, 0x7, 0xc21f]}}, @NL80211_TXRATE_HE={0x14, 0x5, {[0x0, 0x727, 0x5, 0x8, 0x10, 0xf91a, 0x1, 0x1000]}}]}, @NL80211_BAND_2GHZ={0x14, 0x0, 0x0, 0x1, [@NL80211_TXRATE_HE_GI={0x5, 0x6, 0x1}, @NL80211_TXRATE_HE_LTF={0x5, 0x7, 0x1}]}]}]}, 0x82c}, 0x1, 0x0, 0x0, 0x84}, 0x4000000) sendmsg$kcm(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000640)="d8000000180081054e81f782db4cb904021d080406037c09e8fe55a10a0015400200142603600e122f00160006000500a80006002000064007d57f5494007134cf6efb8000a007a290457f0189b316277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a483455aeb4edbb57a5025ccca9e00b60db798262f3d40fad95667e006dcdfb8951f215ce3bbce81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92782f9ffcdb020e6f3baf26d57a0000000000008de6d7b140540d4719", 0xd9}], 0x1, 0x0, 0x0, 0x4a0f0000}, 0x0) 9m37.676336884s ago: executing program 8 (id=2153): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ieee802154(&(0x7f0000000980), r0) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_genetlink_get_family_id$team(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000001300)={'team0\x00', 0x0}) (async, rerun: 64) r5 = socket$inet6_udplite(0xa, 0x2, 0x88) (rerun: 64) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000080)={'team_slave_1\x00', 0x0}) syz_usb_connect$cdc_ncm(0x1, 0x72, &(0x7f0000000380)=ANY=[@ANYBLOB="12010102020000202505a1a440000102030109026000020102d0020904000001020d000009240600017bdea2b0052400e9550d240f0110000000090003008006241a010010090581030002a9d00109040100e4010d00000904010102020d0000090582020002050356090503020004081003"], &(0x7f0000000580)={0xa, &(0x7f0000000400)={0xa, 0x6, 0x201, 0x3, 0x2, 0x8b, 0x30, 0x5}, 0x33, &(0x7f0000000440)={0x5, 0xf, 0x33, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x6, "a3ea35949bdd44434ad2cb62b586da5e"}, @ext_cap={0x7, 0x10, 0x2, 0x4, 0x1, 0x8, 0x7}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x401, 0xf0f, 0x5, [0xc0]}, @ptm_cap={0x3}]}, 0x1, [{0xf1, &(0x7f0000000480)=@string={0xf1, 0x3, "31d1c175e6b902b185737d5571d455cfb1451c74e11736586ec3c5dcd5d7de67d4cb7f40b353ce1d09f716bfd088661861ecf2de42fba6c8dae7fb9cd1ab8b355b9828b85b8ecd7639764612542166cd0f0bb93fd19d69d8af5264da6343c56f5c6b7d79b3e6962d24d8e3f9f6fdc2d6450539d9ed31b4c626d74244ba7218d4cbf04514a7ddca36fe0ee98ea427c3628e55e437f4a1912c503853614264317e24a57bd7038c8fa2769c7fdec7e354c389cfad08f193b1108cf92ee19d4c49a1bf7ea0689932091e0973c60cb37752f84db7bc6ed4fadc80feee54759f891c0cbb771ccf775f32c9e37c3f56176a37"}}]}) (async) sendmsg$TEAM_CMD_OPTIONS_SET(r2, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000180)=ANY=[@ANYBLOB='\'y\x00\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000100000008000100", @ANYRES32=r4, @ANYBLOB="44000280400001002400010071756575655f6964000000000000000000000000000000000000000000000000050003000300000008000400ff07000008000600", @ANYRES32=r6, @ANYBLOB], 0x60}, 0x1, 0x0, 0x0, 0x8094}, 0x0) (async, rerun: 32) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000140), r2) (async, rerun: 32) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000000)) (async) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) (async) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) (async) r8 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) (async) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$devlink(&(0x7f0000002340), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_PORT_UNSPLIT(r9, &(0x7f0000002480)={0x0, 0x0, &(0x7f0000002440)={&(0x7f0000002380)={0x3c, r10, 0x1, 0x70bd2d, 0x25dfdbfe, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x1}}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000041}, 0x0) sendmsg$DEVLINK_CMD_SB_TC_POOL_BIND_GET(r8, &(0x7f0000000280)={&(0x7f0000000100)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000200)={&(0x7f0000000600)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="00012cbd7000fcdbdf2517000000080001007063690011000200303030303a30303a31302ed501b0ba1f58bca6eafcf9bc349a0400080003000100000008000b000800000006001600ff0300000500120001000000"], 0x50}, 0x1, 0x0, 0x0, 0x34004011}, 0x8000) r11 = openat$zero(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) read(r11, &(0x7f0000000040)=""/148, 0xffffff96) sendmsg$BATADV_CMD_GET_DAT_CACHE(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000002c0)={0x14, r7, 0x305, 0x0, 0x0, {0x7}}, 0x14}, 0x1, 0x0, 0x0, 0x4004018}, 0x20000000) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) timer_settime(r12, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) (async) r13 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0) getdents(r13, &(0x7f0000001fc0)=""/184, 0xb8) (async) socket$igmp6(0xa, 0x3, 0x2) 9m37.536928968s ago: executing program 8 (id=2154): syz_open_dev$tty1(0xc, 0x4, 0x1) (async) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, &(0x7f00000004c0)={0x0, 0x3, 0x14}, 0x8, 0x0, 0x8, 0x0, 0x43a, 0x0, 0x0}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f0000000080)=[0xee00]) (async) getgroups(0x1, &(0x7f0000000080)=[0xee00]) setregid(0x0, r4) (async) setregid(0x0, r4) r5 = syz_clone(0x22000000, 0x0, 0x0, 0x0, 0x0, 0x0) setresgid(0xee00, 0x0, 0x0) (async) setresgid(0xee00, 0x0, 0x0) prlimit64(r5, 0x9, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003640)={0x2c, 0x2b, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @ipv4=@broadcast}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @pid}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) (async) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003640)={0x2c, 0x2b, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @ipv4=@broadcast}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @pid}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000000)={0x0, 0xfe, {0x0, 0x0, 0xfffffffe, 0x18, 0x0, 0x64, 0x3}}) r6 = dup(r0) socket$alg(0x26, 0x5, 0x0) (async) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha256\x00'}, 0x58) getpriority(0x1, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0xfffffffffffffda7) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x80000) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x80000) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r6, 0x10f, 0x80, &(0x7f0000000080)=0x3, 0x4) ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0) socket$xdp(0x2c, 0x3, 0x0) (async) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000100)={0x0, 0x24000, 0x400, 0x6, 0x2}, 0x20) ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f0000000200)) (async) ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f0000000200)) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) r10 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {'wfdno', 0x3d, r10}}) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000140)={0x0, 0x1, 0x0, &(0x7f0000000600)=""/52, 0x0, 0x10000}) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000004c0)=""/79, 0x0}) 9m22.508406806s ago: executing program 37 (id=2154): syz_open_dev$tty1(0xc, 0x4, 0x1) (async) r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) r1 = syz_open_dev$usbfs(&(0x7f0000000140), 0x77, 0x3501) ioctl$USBDEVFS_SUBMITURB(r1, 0x8038550a, &(0x7f0000000000)=@urb_type_control={0x2, {}, 0x0, 0x61, &(0x7f00000004c0)={0x0, 0x3, 0x14}, 0x8, 0x0, 0x8, 0x0, 0x43a, 0x0, 0x0}) r2 = openat$rtc(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) setgroups(0x0, 0x0) getgroups(0x1, &(0x7f0000000080)=[0xee00]) (async) getgroups(0x1, &(0x7f0000000080)=[0xee00]) setregid(0x0, r4) (async) setregid(0x0, r4) r5 = syz_clone(0x22000000, 0x0, 0x0, 0x0, 0x0, 0x0) setresgid(0xee00, 0x0, 0x0) (async) setresgid(0xee00, 0x0, 0x0) prlimit64(r5, 0x9, 0x0, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003640)={0x2c, 0x2b, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @ipv4=@broadcast}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @pid}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) (async) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003640)={0x2c, 0x2b, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0xc, 0x1, 0x0, 0x1, [@typed={0x8, 0x6, 0x0, 0x0, @ipv4=@broadcast}]}, @nested={0xc, 0x2, 0x0, 0x1, [@typed={0x8, 0x1, 0x0, 0x0, @pid}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0x8010) ioctl$RTC_WKALM_SET(r2, 0x4028700f, &(0x7f0000000000)={0x0, 0xfe, {0x0, 0x0, 0xfffffffe, 0x18, 0x0, 0x64, 0x3}}) r6 = dup(r0) socket$alg(0x26, 0x5, 0x0) (async) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000180)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_sha256\x00'}, 0x58) getpriority(0x1, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, 0x0, 0xfffffffffffffda7) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x80000) (async) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x80000) r8 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) setsockopt$TIPC_SRC_DROPPABLE(r6, 0x10f, 0x80, &(0x7f0000000080)=0x3, 0x4) ioctl$VHOST_SET_VRING_BASE(r8, 0xaf01, 0x0) socket$xdp(0x2c, 0x3, 0x0) (async) r9 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r9, 0x11b, 0x4, &(0x7f0000000100)={0x0, 0x24000, 0x400, 0x6, 0x2}, 0x20) ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f0000000200)) (async) ioctl$PPPIOCGIDLE64(r6, 0x8010743f, &(0x7f0000000200)) syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') (async) r10 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000300)='.\x00', &(0x7f0000000080), 0x0, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r10}, 0x2c, {'wfdno', 0x3d, r10}}) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000140)={0x0, 0x1, 0x0, &(0x7f0000000600)=""/52, 0x0, 0x10000}) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000004c0)=""/79, 0x0}) 5m3.720580803s ago: executing program 7 (id=3244): r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r0) (async, rerun: 64) r1 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) (rerun: 64) ioctl$USBDEVFS_CONTROL(r1, 0xc0185500, &(0x7f00000006c0)={0x2, 0xf, 0x4, 0x1, 0x0, 0x5, 0x0}) ptrace$getregset(0x4204, r0, 0x2, &(0x7f0000000000)={0x0}) (async, rerun: 32) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(0xffffffffffffffff, 0x8983, 0x0) (async, rerun: 32) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000380), 0x4000000004882, 0x0) (async) io_setup(0x1, &(0x7f00000004c0)=0x0) io_submit(r3, 0xf3, &(0x7f00000000c0)=[&(0x7f0000000140)={0x3a0012fb, 0x2759, 0x19, 0x1, 0x0, r2, &(0x7f0000000000)="98", 0x3e8000072a, 0x1000000, 0x0, 0x10}]) (async) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) (async, rerun: 32) r4 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) (rerun: 32) r5 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000240)={0x1, 0x1f, 0x200008}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r5, 0xc02064b2, &(0x7f0000000000)={0x7fff, 0x8, 0x100, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000080)={0x2, 0x5, 0x3}) (async) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r5, 0xc00464b4, &(0x7f0000000200)={r6}) (async) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r4, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x4}) (async) r7 = openat$tun(0xffffffffffffff9c, &(0x7f0000000980), 0x0, 0x0) ioctl$SIOCGSKNS(r7, 0x894c, 0x0) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mount$cgroup(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f00000001c0), 0x2010042, &(0x7f0000000340)={[{@subsystem='hugetlb'}, {@subsystem='memory'}, {@clone_children}, {@xattr}, {}, {@xattr}, {@cpuset_v2_mode}, {@clone_children}]}) (async) mount(0x0, &(0x7f00000001c0)='./file0\x00', 0x0, 0x40078, &(0x7f0000000000)) 5m3.479775491s ago: executing program 7 (id=3245): move_pages(0x0, 0x1, &(0x7f00000021c0)=[&(0x7f0000001000/0x1000)=nil], &(0x7f0000001180), &(0x7f0000002180), 0x0) openat$dir(0xffffffffffffff9c, &(0x7f0000001a00)='./file1\x00', 0x40, 0x0) syz_open_dev$ndb(&(0x7f00000000c0), 0x0, 0x80000) mount(&(0x7f0000000000)=@nbd={'/dev/nbd', 0x0}, &(0x7f0000004a00)='./file1\x00', &(0x7f0000000040)='cramfs\x00', 0x2008087, 0x0) 5m3.346464962s ago: executing program 7 (id=3246): r0 = socket$kcm(0x10, 0x2, 0x0) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000000)="d8000000100081044e814382db44b904021d08000b000000e8fe55a1180015000600142603600e1209000d00e803006c", 0x30}], 0x1}, 0x0) r2 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080), 0x0, 0x0, 0x0, 0x4000}, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000000)="d8000000210081", 0x7}], 0x1}, 0x0) io_setup(0xae, &(0x7f0000000000)=0x0) io_cancel(r3, &(0x7f0000000340)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x5, 0x0, 0x57deb2c1d03c6cbb}, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r4, &(0x7f0000000000)=ANY=[], 0x33fe0) ioctl$VIDIOC_CREATE_BUFS(r2, 0xc100565c, &(0x7f0000000080)={0x0, 0x3, 0x3, {0x8, @vbi={0x7, 0x1f, 0x3456534b, 0x3831354f, [0xb7f9, 0xa56], [0x0, 0x9], 0x2}}, 0x80000}) write$cgroup_subtree(r0, &(0x7f0000000000)=ANY=[], 0xfe33) 5m1.639950009s ago: executing program 7 (id=3248): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000400)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file1/file0\x00', 0x0) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) (async) mount$bind(&(0x7f0000000100)='.\x00', &(0x7f0000000280)='./file1/file0\x00', 0x0, 0x1085408, 0x0) socket$kcm(0x10, 0x2, 0x10) (async) r0 = socket$kcm(0x10, 0x2, 0x10) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$net_dm(&(0x7f0000000540), r2) (async) r3 = syz_genetlink_get_family_id$net_dm(&(0x7f0000000540), r2) sendmsg$NET_DM_CMD_STOP(r2, 0x0, 0x44000) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r3, 0x1, 0x70b525, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) (async) sendmsg$NET_DM_CMD_START(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)={0x14, r3, 0x1, 0x70b525, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$kcm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmmsg(r0, &(0x7f00000018c0)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000001940)=""/4096, 0x1000}, {&(0x7f0000001500)=""/223, 0xdf}], 0x2}, 0x6}], 0x1, 0x42, 0x0) openat$rtc(0xffffffffffffff9c, &(0x7f0000000200), 0x20800, 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) (async) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f00000003c0), 0x0, &(0x7f00000004c0)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file1/file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') (async) chdir(&(0x7f00000001c0)='./bus\x00') r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='blkio.bfq.sectors_recursive\x00', 0x275a, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) setresuid(r5, r5, 0x0) newfstatat(0xffffffffffffff9c, &(0x7f0000000040)='./bus\x00', &(0x7f00000002c0), 0x6000) ioctl$sock_kcm_SIOCKCMUNATTACH(r4, 0x89e1, &(0x7f0000000340)={r0}) ioctl$FS_IOC_RESVSP(r4, 0xc0189436, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x4, 0x3}) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r6, &(0x7f0000000100)={0x0, 0x57, &(0x7f0000000000)={&(0x7f0000000800)={0x28, 0x2d, 0xb, 0x70bd26, 0x4000, {0xb}, [@typed={0x14, 0x2, 0x0, 0x0, @ipv6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}]}, 0x28}}, 0x8010) 5m1.346391488s ago: executing program 7 (id=3249): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r2) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000280)=@req={0x2, 0x7, 0x2, 0xd1a3}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000ac0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fcdbdf251800000008000300", @ANYRES32=r5, @ANYBLOB="400030803c000180080001"], 0x5c}}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f00000000c0)={'wpan0\x00', 0x0}) r9 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r9) r11 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r12 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r12, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00', 0x0}) r14 = socket$inet6(0xa, 0x80002, 0x0) sendmmsg$inet6(r14, &(0x7f0000002f00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004000)=[@pktinfo={{0x24, 0x29, 0x32, {@private2, r13}}}], 0x28}}], 0x1, 0x20005485) ioctl$sock_SIOCGIFINDEX_802154(r11, 0x8933, &(0x7f0000000640)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, r10, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r15}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xfe}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfe}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_LBT_MODE={0x5}, @NL802154_ATTR_LBT_MODE={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r15}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x54}}, 0x4000000) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r1, 0x70b, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000051}, 0x40000a0) 4m59.006072764s ago: executing program 7 (id=3253): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) read$FUSE(0xffffffffffffffff, &(0x7f00000010c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r1 = syz_open_procfs$pagemap(r0, &(0x7f0000001080)) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020400090c00000000000000000000000500060000000e000a004e230000000600000000000000000000000000000081020000000000000002000100000000000000000200000000030005000000000002004e22e06200010000000000000000a850ba30db"], 0x60}}, 0x20040802) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000000)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xe4, 0x0, 0x42, 0x5c}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) (async) read$FUSE(0xffffffffffffffff, &(0x7f00000010c0)={0x2020}, 0x2020) (async) syz_open_procfs$pagemap(r0, &(0x7f0000001080)) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r2, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020400090c00000000000000000000000500060000000e000a004e230000000600000000000000000000000000000081020000000000000002000100000000000000000200000000030005000000000002004e22e06200010000000000000000a850ba30db"], 0x60}}, 0x20040802) (async) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000000)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xe4, 0x0, 0x42, 0x5c}) (async) 4m58.210493591s ago: executing program 38 (id=3253): madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) read$FUSE(0xffffffffffffffff, &(0x7f00000010c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) r1 = syz_open_procfs$pagemap(r0, &(0x7f0000001080)) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020400090c00000000000000000000000500060000000e000a004e230000000600000000000000000000000000000081020000000000000002000100000000000000000200000000030005000000000002004e22e06200010000000000000000a850ba30db"], 0x60}}, 0x20040802) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000000)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xe4, 0x0, 0x42, 0x5c}) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) (async) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) (async) mremap(&(0x7f00005ab000/0x1000)=nil, 0x1000, 0x1000, 0x7, &(0x7f0000ffe000/0x1000)=nil) (async) read$FUSE(0xffffffffffffffff, &(0x7f00000010c0)={0x2020}, 0x2020) (async) syz_open_procfs$pagemap(r0, &(0x7f0000001080)) (async) socket$key(0xf, 0x3, 0x2) (async) sendmsg$key(r2, &(0x7f0000000000)={0x0, 0x3, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="020400090c00000000000000000000000500060000000e000a004e230000000600000000000000000000000000000081020000000000000002000100000000000000000200000000030005000000000002004e22e06200010000000000000000a850ba30db"], 0x60}}, 0x20040802) (async) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f0000000000)={0x60, 0x0, &(0x7f0000001000/0x3000)=nil, &(0x7f0000ffb000/0x4000)=nil, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0xe4, 0x0, 0x42, 0x5c}) (async) 3m29.886000225s ago: executing program 9 (id=3600): r0 = syz_usb_connect(0x0, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="12014101f2c59620d016b8108edee501030109022400010000100009040002020083ec0009050602000202000a09058202"], 0x0) r1 = syz_open_dev$sg(&(0x7f0000001600), 0x0, 0x40042) syz_open_dev$dri(0x0, 0x1, 0x4200) setsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010003f6fdd140402090b975f601020301090224000201005004090400f7f8c773b808090504105802030d580904a1"], &(0x7f0000000e80)={0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r2, 0x0, 0x0) write$binfmt_aout(r1, 0x0, 0x31) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000005c0)={0x44, &(0x7f0000000e40)={0x40, 0x9, 0xc, "00004700000040f400bec073"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000340)={0x1c, &(0x7f00000002c0)={0x40, 0x15, 0x28, "c923f8cf0672367eeb464395e7c0766fff142feac0913317937bce3c6951a09621007891d3103d15"}, 0x0, 0x0}) 3m27.92944726s ago: executing program 9 (id=3605): r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000180)='/proc/meminfo\x00', 0x0, 0x0) lseek(r0, 0x9, 0x0) sendmsg$kcm(r0, &(0x7f0000000200)={&(0x7f0000000000)=@pppoe={0x18, 0x0, {0x1, @empty, 'veth0_to_bridge\x00'}}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000140)="7704f9061f4aa29d7c70a805a9c51c6b991b15c916a29f9d50c0bfa994234a57ca1527754651c730573fe3c5a0dca6f37b533ff149585a18e411bf3db66e92a1244636207219910e737864658987623f5e164a6f43a3528715d5e20b4a519406439fc0ad7c554eadf66ac133634f72b625f9b5f876735488ec44efe2a33b64165bfe126bb5bba2340c6b5df388f84d3f8302fe8fb9db77aed34fe146f407afccdc0a4fa6", 0xa4}], 0x1, &(0x7f00000002c0)}, 0x20000000) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0006}]}) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) bind$nfc_llcp(r2, &(0x7f0000000240)={0x27, 0x0, 0x0, 0x0, 0x0, 0x0, "d9298498abdba7f061bd1ca44c226af5160e961711a07760760beeab11e88509de7f1939e8abff005597c8ef039a5be42200", 0x38}, 0x60) listen(r2, 0x0) fsopen(&(0x7f0000000000)='binfmt_misc\x00', 0x0) close_range(r1, 0xffffffffffffffff, 0x0) socket$netlink(0x10, 0x3, 0x2) 3m27.762387636s ago: executing program 9 (id=3607): syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000c4b20710200e01015a7a0102030109021b00010000000009040000012e6d0a150905ff27"], 0x0) r0 = socket(0x10, 0x2, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, @dev, @dev={0xfe, 0x80, '\x00', 0x37}, 0x0, 0x0, 0x0, 0x1}}) (async) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x0, 0x20, 0x0, 0x0, 0x0, @dev, @dev={0xfe, 0x80, '\x00', 0x37}, 0x0, 0x0, 0x0, 0x1}}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r0, 0x89f3, &(0x7f0000000080)={'syztnl1\x00', &(0x7f0000000180)={'syztnl1\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @mcast2, @loopback, 0x0, 0x0, 0x0, 0x4007}}) openat$ipvs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/sys/net/ipv4/vs/lblcr_expiration\x00', 0x2, 0x0) 3m26.474570175s ago: executing program 9 (id=3611): syz_clone(0xc0000000, &(0x7f0000000340)="ee6005401ab1443ee6a54546e3001e2557b37256cd4fef267848aa2495a2d293", 0x20, 0x0, 0x0, 0x0) r0 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r0}, &(0x7f0000bbdffc)) ptrace$setregs(0xd, r0, 0x7, &(0x7f00000004c0)="03756afb7babc8da4960614d9a744cfb07017b8f86232c7757a79f3a28986685eb57a76ae3b3271145065354f35d530895be4b038eee67fc4046e0ff6650a03ddd9451ec60646980d46c1850296a46c93bdb19980495aab3f8136875e5070a334a25a366ee085499135204ade554348c0b3ea0371d1c1464d7118776088862c3614e1ebc2df92305f04d4dcd71b8c4") r1 = socket(0x200000100000011, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'hsr0\x00', 0x0}) bind$packet(r1, &(0x7f0000000080)={0x11, 0x0, r3, 0x1, 0x7, 0x6, @local}, 0x14) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$ieee802154(&(0x7f00000001c0), r4) ioctl$sock_SIOCGIFINDEX_802154(r5, 0x8933, &(0x7f0000000340)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x38, r6, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r7}]}, 0x38}, 0x4, 0x700000002000000, 0x0, 0x80}, 0x40000) sendmsg$netlink(r1, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f00000001c0)=ANY=[@ANYRESOCT=r1], 0x34}], 0x1, 0x0, 0x0, 0x800}, 0x4001) prctl$PR_SET_NO_NEW_PRIVS(0x59616d61, 0x1) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) sendmsg(r2, &(0x7f0000000980)={&(0x7f00000000c0)=@ll={0x11, 0xf8, r3, 0x1, 0x3, 0x6, @broadcast}, 0x80, &(0x7f0000000480)=[{&(0x7f0000000380)="d62c1c95e5e928234becf788ce70c2752145abd38c3e4f4e035352ba55dcead1e5ab4cde988f0c1a312b3eab7e8525e3e66795a76b1b4ca1daae87865aff5d094bbcd1332d4b7aee2e5c755a3010fd2841d7f3a9e46a82cca611c0d0520f6ede0fd8a09f8e589c1dc85302b0a22ebb9998e10b2f533012a03bdec716c5d8030dd5391cf7f9880b33dc18f5bf22e534732b2f04d495c3f4a24542746fad03d84dcc28a8f679282908b75cf9572d266a9034fc469d8d18a922ef9e3176784f3afea5a9acde11818075d07ee87da8edfced10f1c46d43607b6182", 0xd9}, {&(0x7f0000000140)="38dd37f6e11e6b5d90594fa57e31463fffd3ab", 0x13}, {&(0x7f0000000240)="a6be6e53c5765922e4ce4263a4c94642ab5b64eb14f12075ef3e0be4d626dfdb807752d7640894eda09c38de8c310ef5e48c75c15334559523cf5afde73b763f1f880413e142da792ef2d925bcc0d6eff97e5cf71ac43bdfc78bf678341a29432c1cd7b05c59c5bfd3f53eb37fb975771be1a573715c74bb21522e7076e8e03680f332f3", 0x84}], 0x3, &(0x7f00000004c0)}, 0x0) r9 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) mincore(&(0x7f0000f0c000/0x3000)=nil, 0x0, &(0x7f0000afaf0a)=""/246) write$tun(r8, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000141200006c07010033d43afffe800000000000000000000000000010ff02000000000000000000000000000189"], 0x340a) 3m26.147693857s ago: executing program 9 (id=3612): r0 = openat(0xffffffffffffff9c, &(0x7f0000000500)='.\x00', 0x0, 0x0) fsetxattr$system_posix_acl(r0, &(0x7f0000000000)='system.posix_acl_access\x00', &(0x7f0000000140)=ANY=[@ANYBLOB="02000000010001000000000002000300", @ANYRES32=r0, @ANYBLOB="0400050000000000100008000000000020000000000000005801d124669f931c04018481df79a5cba34f92f89e41c1aed2f8c5b8169dcc35341229ff6550d673878f1e"], 0x2c, 0x3) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe6000/0x18000)=nil, &(0x7f0000000140)=[@textreal={0x8, &(0x7f0000000080)="66b9800000c00f326635010000000f3065f22ef2e300660ffb830050440f20c0663505000000440f22c00d02000f01f3660f7c27ba4300ec0f019dc900660f3880620a", 0x43}], 0x1, 0x44, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$HIDIOCGRDESCSIZE(r0, 0x80044801, &(0x7f0000000100)) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r3, 0x4601, &(0x7f0000000040)={0x60, 0x80, 0x3c00, 0x2000, 0x0, 0x0, 0x0, 0x0, {0x10}, {0x0, 0xfffffffe, 0x5}, {0x0, 0x0, 0x1}}) 3m25.994701985s ago: executing program 9 (id=3613): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) ioctl$TIOCSBRK(r0, 0x5427) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x5575, 0x5b377261, 0x5, 0xfffffff7, 0x6, "9f329156167c8393622499a3240682050afe9c", 0x1, 0x40}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x88, 0x94, 0x5b, 0x40, 0x46d, 0x8b7, 0xca8e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xdd, 0xc5, 0x42}}]}}]}}, 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x88, 0x94, 0x5b, 0x40, 0x46d, 0x8b7, 0xca8e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xdd, 0xc5, 0x42}}]}}]}}, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r1) syz_usb_connect$cdc_ncm(0x1, 0xb2, &(0x7f0000000480)=ANY=[@ANYBLOB="12010003020000202505a1a44000010203010902a0000201fd50050904000001020d00000a2406000102c5d4d40605240006000d240f0105000000ff0004000b06241a04000012240706d8000c00930e460400008100050008241c10000507000424020b1524120500a317a88b045e4f01a607c0ffcb7e392a0c2407fd01018000020007000905810310000601040904010000020d00000904010102020d0000090582020004040403090503020004100306129758970e78304ea0f45b41f7aff2831de448a6ad04db350babcd238689427ee1cfadd9519b998036cfd1321cc67138b8fb3efafa4e773fa0576e1151e1fd3aee0f"], &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x0, 0xa, 0x88, 0x3, 0xff}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x4, [{0x2, &(0x7f0000000180)=@string={0x2}}, {0x4, &(0x7f0000000200)=@lang_id={0x4}}, {0xea, &(0x7f0000000240)=@string={0xea, 0x3, "47aa6f40270578d23921db2fde7fcb003d505ec4305023da9164d117b11350bd8d7e80efcc5dc68d5529d150fdf8eab193eec054b7677f45c52159a245a9d68e99ab18bef04516fc64c1e720da8549d71f9b876cc94b18812ced8d9d04276e9629f861a6eadc124a54f4742eb3e6d766f7ac8f45f8f8fec3d49173e1e22724c469b19d31a38c6339a16bf09c51fce1f1b244bf71feee5a7aea80ab44d44df3bd13f6e7aaca2321fe9456400670c99a4adb78897c3e6f3e4d07fb4e2922812f7b3c88a499be6ebf5d6311ea7373c7456de327cca47488a34fa21eab32d10c906bd5b9e9bfb1f60653"}}, {0x96, &(0x7f0000000340)=@string={0x96, 0x3, "281ae85c0d9fb96dfd9c5e69fdd73a578935343b7cbe59c9dbfa8db5b4fd433d80f874ff9fb9b1025691c5f041b97fbfd18ac2d911c20a7d6e504ce6c3bc6a439ea9f556254c73297e48a1a6284a6a6a16f583b6d49617172511f64f8af5daf45e3fd8536d801eb3aaf9ad069a635b8b6e67cffa0e369d1cd062f3cf7e74462061e5bd6bad7dd98bc92db69e4b7720a6036fb809"}}]}) (async) syz_usb_connect$cdc_ncm(0x1, 0xb2, &(0x7f0000000480)=ANY=[@ANYBLOB="12010003020000202505a1a44000010203010902a0000201fd50050904000001020d00000a2406000102c5d4d40605240006000d240f0105000000ff0004000b06241a04000012240706d8000c00930e460400008100050008241c10000507000424020b1524120500a317a88b045e4f01a607c0ffcb7e392a0c2407fd01018000020007000905810310000601040904010000020d00000904010102020d0000090582020004040403090503020004100306129758970e78304ea0f45b41f7aff2831de448a6ad04db350babcd238689427ee1cfadd9519b998036cfd1321cc67138b8fb3efafa4e773fa0576e1151e1fd3aee0f"], &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x0, 0xa, 0x88, 0x3, 0xff}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x4, [{0x2, &(0x7f0000000180)=@string={0x2}}, {0x4, &(0x7f0000000200)=@lang_id={0x4}}, {0xea, &(0x7f0000000240)=@string={0xea, 0x3, "47aa6f40270578d23921db2fde7fcb003d505ec4305023da9164d117b11350bd8d7e80efcc5dc68d5529d150fdf8eab193eec054b7677f45c52159a245a9d68e99ab18bef04516fc64c1e720da8549d71f9b876cc94b18812ced8d9d04276e9629f861a6eadc124a54f4742eb3e6d766f7ac8f45f8f8fec3d49173e1e22724c469b19d31a38c6339a16bf09c51fce1f1b244bf71feee5a7aea80ab44d44df3bd13f6e7aaca2321fe9456400670c99a4adb78897c3e6f3e4d07fb4e2922812f7b3c88a499be6ebf5d6311ea7373c7456de327cca47488a34fa21eab32d10c906bd5b9e9bfb1f60653"}}, {0x96, &(0x7f0000000340)=@string={0x96, 0x3, "281ae85c0d9fb96dfd9c5e69fdd73a578935343b7cbe59c9dbfa8db5b4fd433d80f874ff9fb9b1025691c5f041b97fbfd18ac2d911c20a7d6e504ce6c3bc6a439ea9f556254c73297e48a1a6284a6a6a16f583b6d49617172511f64f8af5daf45e3fd8536d801eb3aaf9ad069a635b8b6e67cffa0e369d1cd062f3cf7e74462061e5bd6bad7dd98bc92db69e4b7720a6036fb809"}}]}) 3m10.947859737s ago: executing program 39 (id=3613): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) sendfile(r0, r1, 0x0, 0x20000023896) ioctl$TIOCSBRK(r0, 0x5427) ioctl$TCSETSW2(r0, 0x402c542c, &(0x7f0000000000)={0x5575, 0x5b377261, 0x5, 0xfffffff7, 0x6, "9f329156167c8393622499a3240682050afe9c", 0x1, 0x40}) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x88, 0x94, 0x5b, 0x40, 0x46d, 0x8b7, 0xca8e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xdd, 0xc5, 0x42}}]}}]}}, 0x0) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x88, 0x94, 0x5b, 0x40, 0x46d, 0x8b7, 0xca8e, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x7f, 0x0, 0xc0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xdd, 0xc5, 0x42}}]}}]}}, 0x0) ioctl$LOOP_SET_FD(r1, 0x4c00, r1) syz_usb_connect$cdc_ncm(0x1, 0xb2, &(0x7f0000000480)=ANY=[@ANYBLOB="12010003020000202505a1a44000010203010902a0000201fd50050904000001020d00000a2406000102c5d4d40605240006000d240f0105000000ff0004000b06241a04000012240706d8000c00930e460400008100050008241c10000507000424020b1524120500a317a88b045e4f01a607c0ffcb7e392a0c2407fd01018000020007000905810310000601040904010000020d00000904010102020d0000090582020004040403090503020004100306129758970e78304ea0f45b41f7aff2831de448a6ad04db350babcd238689427ee1cfadd9519b998036cfd1321cc67138b8fb3efafa4e773fa0576e1151e1fd3aee0f"], &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x0, 0xa, 0x88, 0x3, 0xff}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x4, [{0x2, &(0x7f0000000180)=@string={0x2}}, {0x4, &(0x7f0000000200)=@lang_id={0x4}}, {0xea, &(0x7f0000000240)=@string={0xea, 0x3, "47aa6f40270578d23921db2fde7fcb003d505ec4305023da9164d117b11350bd8d7e80efcc5dc68d5529d150fdf8eab193eec054b7677f45c52159a245a9d68e99ab18bef04516fc64c1e720da8549d71f9b876cc94b18812ced8d9d04276e9629f861a6eadc124a54f4742eb3e6d766f7ac8f45f8f8fec3d49173e1e22724c469b19d31a38c6339a16bf09c51fce1f1b244bf71feee5a7aea80ab44d44df3bd13f6e7aaca2321fe9456400670c99a4adb78897c3e6f3e4d07fb4e2922812f7b3c88a499be6ebf5d6311ea7373c7456de327cca47488a34fa21eab32d10c906bd5b9e9bfb1f60653"}}, {0x96, &(0x7f0000000340)=@string={0x96, 0x3, "281ae85c0d9fb96dfd9c5e69fdd73a578935343b7cbe59c9dbfa8db5b4fd433d80f874ff9fb9b1025691c5f041b97fbfd18ac2d911c20a7d6e504ce6c3bc6a439ea9f556254c73297e48a1a6284a6a6a16f583b6d49617172511f64f8af5daf45e3fd8536d801eb3aaf9ad069a635b8b6e67cffa0e369d1cd062f3cf7e74462061e5bd6bad7dd98bc92db69e4b7720a6036fb809"}}]}) (async) syz_usb_connect$cdc_ncm(0x1, 0xb2, &(0x7f0000000480)=ANY=[@ANYBLOB="12010003020000202505a1a44000010203010902a0000201fd50050904000001020d00000a2406000102c5d4d40605240006000d240f0105000000ff0004000b06241a04000012240706d8000c00930e460400008100050008241c10000507000424020b1524120500a317a88b045e4f01a607c0ffcb7e392a0c2407fd01018000020007000905810310000601040904010000020d00000904010102020d0000090582020004040403090503020004100306129758970e78304ea0f45b41f7aff2831de448a6ad04db350babcd238689427ee1cfadd9519b998036cfd1321cc67138b8fb3efafa4e773fa0576e1151e1fd3aee0f"], &(0x7f0000000400)={0xa, &(0x7f0000000100)={0xa, 0x6, 0x0, 0xa, 0x88, 0x3, 0xff}, 0x5, &(0x7f0000000140)={0x5, 0xf, 0x5}, 0x4, [{0x2, &(0x7f0000000180)=@string={0x2}}, {0x4, &(0x7f0000000200)=@lang_id={0x4}}, {0xea, &(0x7f0000000240)=@string={0xea, 0x3, "47aa6f40270578d23921db2fde7fcb003d505ec4305023da9164d117b11350bd8d7e80efcc5dc68d5529d150fdf8eab193eec054b7677f45c52159a245a9d68e99ab18bef04516fc64c1e720da8549d71f9b876cc94b18812ced8d9d04276e9629f861a6eadc124a54f4742eb3e6d766f7ac8f45f8f8fec3d49173e1e22724c469b19d31a38c6339a16bf09c51fce1f1b244bf71feee5a7aea80ab44d44df3bd13f6e7aaca2321fe9456400670c99a4adb78897c3e6f3e4d07fb4e2922812f7b3c88a499be6ebf5d6311ea7373c7456de327cca47488a34fa21eab32d10c906bd5b9e9bfb1f60653"}}, {0x96, &(0x7f0000000340)=@string={0x96, 0x3, "281ae85c0d9fb96dfd9c5e69fdd73a578935343b7cbe59c9dbfa8db5b4fd433d80f874ff9fb9b1025691c5f041b97fbfd18ac2d911c20a7d6e504ce6c3bc6a439ea9f556254c73297e48a1a6284a6a6a16f583b6d49617172511f64f8af5daf45e3fd8536d801eb3aaf9ad069a635b8b6e67cffa0e369d1cd062f3cf7e74462061e5bd6bad7dd98bc92db69e4b7720a6036fb809"}}]}) 2.791097794s ago: executing program 1 (id=4766): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200737997310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000025c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x90}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 2.674413563s ago: executing program 5 (id=4767): r0 = syz_usb_connect(0x3, 0x73, &(0x7f0000000400)=ANY=[@ANYBLOB="12010000396d0940fd101315ce7e0102030109026100010000000009040001"], 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x10b200, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x3, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x2) r4 = dup(r3) syz_kvm_setup_cpu$x86(r4, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text16={0x10, 0x0}], 0x1, 0x4a, 0x0, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) syz_init_net_socket$llc(0x1a, 0x1, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r6, 0xae60) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) getsockopt$sock_int(r7, 0x1, 0x2d, 0x0, &(0x7f0000000100)) r8 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000100)="0f01ca66b80500000066b9ed1a00000f01c166dfb20d00360fc75c5e0f5adbbaf80c66b8f40f398e66efbafc0cb02eee6766c7442400bc0000006766c74424020c0000006766c744240600000000670f01142464640fc7be7281baf80c66b800ef9d8866efbafc0ced66b91e0a000066b80000000066ba000000800f30", 0x7d}], 0x1, 0x43, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe8000/0x18000)=nil, &(0x7f00000000c0)=[@text16={0x10, 0x0}], 0x1, 0x99fe681834aac99b, 0x0, 0x0) ioctl$KVM_SET_TSC_KHZ_cpu(r5, 0xaea2, 0x8) ioctl$KVM_RUN(r8, 0xae80, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) 2.640286828s ago: executing program 1 (id=4768): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000700)={{0x14}, [@NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x54, 0x1, 0x0, 0x1, @match={{0xa}, @val={0x44, 0x2, 0x0, 0x1, [@NFTA_MATCH_REV={0x8}, @NFTA_MATCH_INFO={0x2c, 0x3, "5c8f022482395afa4d23edfcbe6d55b57cb15e63c15c46395916e2b388abc3d6ce2316334e8278ad"}, @NFTA_MATCH_NAME={0xa, 0x1, 'limit\x00'}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xac}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) r1 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000000), 0x28a02, 0x0) ioctl$KDGKBLED(r1, 0x4b64, &(0x7f0000000040)) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0x19) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) ioctl$TIOCGLCKTRMIOS(r1, 0x40085500, &(0x7f0000000100)={0x46, 0x200, 0xee1, 0x3781, 0xa, "a14c0c4837b25ba1055c8b3a9bc480a9edfb67"}) 2.414481063s ago: executing program 1 (id=4770): r0 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EXT4_IOC_GET_ES_CACHE(r0, 0xc020662a, &(0x7f0000000640)={0x10001, 0x1, 0x2, 0xfffffe00, 0x3, 0x0, [{0x1, 0x1, 0x39, '\x00', 0x1}, {0xfffffffffffffeff, 0x8, 0xfffffffffffffffa, '\x00', 0x200}, {0x5, 0x6, 0xfa67, '\x00', 0x100}]}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) (async) openat$full(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r3 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r3, 0x84, 0x72, &(0x7f0000000080)={0x0, 0x2}, &(0x7f00000000c0)=0xc) (async) r4 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000600), r1) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r6 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x1000, 0x2}) r8 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000180)='/sys/kernel/debug/binder/state\x00', 0x0, 0x0) (async) r9 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) (async) r11 = dup3(r10, r9, 0x0) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000040)={0x10, 0x0, &(0x7f0000000440)=[@request_death={0x400c6313}], 0x0, 0x1000000, 0x0}) read$FUSE(r8, &(0x7f0000005180)={0x2020}, 0x2020) (async) ioctl$sock_bt_hci(r6, 0x800448f0, &(0x7f0000000000)="1e19") (async) syz_usb_connect$cdc_ecm(0x5, 0x53, &(0x7f0000000140)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x41, 0x1, 0x1, 0x7, 0x10, 0x8, [{{0x9, 0x4, 0x0, 0x9d, 0x2, 0x2, 0x6, 0x0, 0x1, {{0xb, 0x24, 0x6, 0x0, 0x0, "b140a3aee262"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x1ff, 0x7, 0xa9e8, 0xf7}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xb, 0x5, 0xc}}, {{0x9, 0x5, 0x3, 0x2, 0x20, 0xd, 0x8, 0x6}}}}}]}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x200, 0x2, 0xfd, 0xfa, 0xff, 0xf}, 0x5, &(0x7f0000000240)={0x5, 0xf, 0x5}, 0x3, [{0x56, &(0x7f0000000280)=@string={0x56, 0x3, "9f1a2d427da7b2352f3c8b7d5fa8bbc1724a8a2b64ac3a6782b65759eb924516b6f4baa76caea05ce02ad44530261aca17841df53eb4790946bfb0f084df014fe91c18bdba69dba91009dcb0329897f898d12d28"}}, {0xf9, &(0x7f0000000300)=@string={0xf9, 0x3, "9c12f30c8a457223f9882e2d7317dc51fa959ad0ce4ab4b4cf176db16082e53712d1be12efdaeed80c8ada2f99c1b46338559944790a1e2adb0e37c1ac3eb7b102098d128c72fafcd30146143308a6d5e4499356252519638e615507ee6636c97a3e51d3370393fdf14c01c01581e7641bdea5eef6dc7a980c95c08529c4a20274b509de752bc9d8ba54bfbd72aea5cf3bf1128a867933983eb69c9c7a3b3dea666b7b2e0650f73ee7e699f118f862445d58deec688d8e89426d2be4453176c7429119aa034bb7435b405726c1c8cbff99103cc3be000c147be832123dfdd392534e70e9739480645969b121741ac5000d3b1f68a02664"}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x140c}}]}) (async) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) (async) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)={{0x14}, [@NFT_MSG_DELCHAIN={0x30, 0x5, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x4}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x5}}}, 0x58}, 0x1, 0x0, 0x0, 0x8001}, 0x0) (async) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000001cc0)={'wpan1\x00'}) openat$audio(0xffffff9c, &(0x7f00000000c0), 0x4003, 0x0) (async) sendmsg$NL802154_CMD_DEL_SEC_DEVKEY(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000002040)={&(0x7f0000001d00)=ANY=[@ANYBLOB="14000000", @ANYRES16=r4, @ANYBLOB="010026bd7400fbdbdf251e000000"], 0x14}, 0x1, 0x0, 0x0, 0x4080}, 0x92df6bfe019efb2b) (async) poll(&(0x7f00000000c0)=[{r0, 0x80}], 0x1, 0x2) 1.674113785s ago: executing program 1 (id=4774): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22}, 0x1c) connect$inet6(r0, &(0x7f0000000600)={0x2, 0x4e23, 0x0, @dev={0xfe, 0x80, '\x00', 0x34}, 0x4}, 0x1c) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x2, 0x240, 0x9b99}, 0x9, [0x7, 0x8, 0x5, 0x9, 0x8, 0x155f, 0x6, 0x5, 0x25cd, 0x1, 0xa4, 0x6, 0xa2b9, 0x6, 0x7, 0xe4, 0x9, 0xfc000000, 0x3, 0xbbf, 0x4a732f64, 0x8, 0x9, 0xd, 0x2, 0x12a3, 0x6, 0x1, 0x2, 0x4, 0x7, 0x81, 0x8a, 0x79, 0x558e0d31, 0x4, 0x0, 0x91, 0x4, 0x4, 0x7, 0x2, 0x5, 0x400, 0x7fff, 0x5, 0xa7, 0x81, 0x9, 0xf9a2, 0x80000001, 0xff, 0x0, 0x2, 0x2, 0x3, 0x7, 0x1, 0x7ff, 0x4, 0x4007f, 0xffffffff, 0x6, 0x6], [0x9, 0x3, 0x6, 0x5f, 0x4, 0xc66, 0xa8a9, 0x73, 0x8e, 0x10001, 0x7, 0x5, 0x2, 0x9, 0x4, 0x5, 0x1000, 0x0, 0x200b398, 0x400000, 0x0, 0x2, 0x1c, 0x7, 0x1, 0x2, 0x54f5bad8, 0x8, 0xfffffffd, 0x400, 0xffff58b9, 0x4c2336d3, 0x4, 0x0, 0xfffffff8, 0x401, 0x46, 0xf1, 0x4, 0xab00000, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x7fff, 0x762, 0x1cb, 0x1, 0x4, 0x6, 0x438, 0x2, 0x9, 0x95, 0x8000, 0x6, 0xfffffff9, 0x200004, 0x1000, 0xfffff801, 0x5], [0x2, 0x1, 0xffff, 0x3, 0x2, 0x2e6bf783, 0x80000001, 0xb, 0x5, 0x491, 0x8d3, 0x6, 0x8, 0x3ff, 0x2, 0x400, 0x40, 0x6, 0x7, 0x7, 0x5, 0x0, 0x5, 0x9, 0x0, 0x3, 0x9, 0x3, 0xc7, 0xfff, 0x200, 0x8000, 0x400, 0x3e55, 0xff, 0xd3, 0x7, 0x3435, 0x3, 0x9, 0xfd, 0x401, 0x101, 0xdd80, 0x60a2, 0x17fc, 0x9d26, 0x5, 0x8, 0x2, 0x2, 0x6, 0x8000, 0xf45, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xfffffffc, 0x10000, 0x1, 0x8, 0x1], [0xa772, 0x1, 0x5, 0x1afa, 0xbfc, 0x8, 0x7c81, 0x7f, 0xfffffff8, 0x40, 0xff, 0x5, 0x7fffffff, 0x7, 0x4, 0x9, 0x81, 0x3, 0x9d86, 0x9, 0xfffffff7, 0x8, 0x40f1, 0x2, 0x3, 0x101, 0x80000001, 0x7777, 0xfff, 0x2, 0x100, 0xd8ce, 0x7fffffff, 0x624dfaee, 0xc, 0x7f, 0x1000, 0x1ff, 0x2000005, 0xffffffff, 0x10000, 0x0, 0x8001, 0x7fff, 0x1000, 0x6, 0xf, 0xe, 0x5337, 0x26d, 0x6, 0xfffffff9, 0x4, 0xfffffff9, 0x9, 0x4, 0x463f, 0x4, 0xdab, 0x1, 0x8, 0x13ffd, 0x1, 0x1b18]}, 0x45c) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="14020000100001000000", @ANYRES32=0x0, @ANYBLOB="6401010100000000000000000000000000000000330000007f0000010000000000000000000000000000000000000000ffff"], 0x214}, 0x1, 0x0, 0x0, 0x20004001}, 0x0) setxattr$system_posix_acl(0x0, 0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000001000000000000000400000000000000100000000000000020"], 0x24, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(r3, 0x8208ae63, &(0x7f0000000880)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x2, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x9e, 0x6, 0x6, 0x7f}}) ioctl$KVM_SET_REGS(r4, 0x4090ae82, &(0x7f0000000000)={[0x7fffffffffffffff, 0xfff, 0x0, 0x180, 0x4, 0x14, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x5, 0x6, 0x800, 0x45, 0x4, 0xbdb], 0x1, 0x1c4213}) ioctl$KVM_RUN(r4, 0xae80, 0x0) r5 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r6 = dup(r5) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x37}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r5, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text16={0x10, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) connect$inet6(r0, &(0x7f0000000100)={0xa, 0x4e21, 0x10000, @local, 0xfffffffe}, 0x1c) socket$netlink(0x10, 0x3, 0x8000000004) r8 = syz_open_dev$video4linux(&(0x7f0000000080), 0x1, 0x200000) ioctl$VIDIOC_G_MODULATOR(r8, 0xc0445636, &(0x7f0000000540)={0x4, "8356e61f8f26986638c1003c323e44541928e59655abaca3244a520c905438b4", 0x100, 0x7fff, 0x7, 0x19, 0x1}) pipe(&(0x7f0000000000)={0xffffffffffffffff}) writev(r9, &(0x7f00000004c0)=[{&(0x7f0000000140)="68c70febd87decc7eede883953b2943c028ac71b4230128bd226052828efca6ee76708a30b3b3dec7e75ad436c3cc046a12ede7d34707b6148686f1289e3fb393863c5fc1889a05d970587476619932686fb3626b2cf5a4a0a350fa1ffaa81849b69293b4c29ac0fe04b9cac88a29594ab9185fdc079c0cbbe2911289520fe386046c87465ac15d90d58d9022153d43f6c", 0x91}, {&(0x7f0000000200)="16b315070e0a9c829df251e71f03e830b798cd2c9b68a5e6a733d34421db6668c65d4186a0c4d7789ced70162d7dbe7cef3b7cb1c95b25ce733bd73525a006134af10c0404d3c0d4d7408a44836e382f3d2768cdec4c553daa7d3e3e41f29442a2b66dff83f9770494c30356b1e41952988497c56363377bb722d78242354c82716c0059350ec031c9581a0d9bac23040034f188e93a51b10164e883560de617163d8e469f62df1966f92cff299d66d937d7c9aad8ce55c209af2870a5ec39309ff5", 0xc2}, {&(0x7f0000000640)="1f7600dbcf9f17aa0189ac2bf1cb989d10446a8e3e0f51325c79fdccff3785182fdadb91a5d7779707c02c76751bd3ad86157fcb1b3be59079756882cc08931a4c315e0c0000000000000000002dbcd8fa262dd15917654446785285a09baa8ae27cd4c3675249bbe60595676cd35466a0213bad6ac60760685c43cd096c6e0b413fc1dcd496bf5e0783c68436497eaee5f21b98072122cd7da74ec5761e00cdc666d87ec9ac112dcf45bf2fb857590fef19206517ddc1e3bd3c3fcc3cce3b1501cbbc95aab341cc97559bb8c94a94bc1876d2b76eb3af2e13545484756cf0cdbf6875f4e619b860b6b9bd4597da44717d18b310fe410c66670b39ffcb6b6c280e5f03aa2f398c6ed376f2d3988abb50f15be75e4a9893ef365a5dc3d734d3f4f7f4afa24fb04ad7003e43", 0x12b}, {&(0x7f0000000300)="f638ec539c83cb2a346909c0b7a069e896b7c49af1743e6b911a0a761cad785de480d7b96ae406bb958a87a09b498dfb2eeed06288d6caa314b058a86aaa5fc6da0f61e42cefd4e16c44cf0b11f89968d637ccede66bb3c1eff162998cc2985ab4d4030c9c6ee2e4e110620219b30b8345e90ae17cacce306be3cacbf6215910853f24", 0x83}, {&(0x7f00000003c0)="e34d715d8322148f886e2aa7cb7da8c4a3d22a319ef9a09e41366531435c12aa5fb3b6d3e9747cdb5ea459de9d8684419037b4d712ad8cbc0cd7d558cab3700ca2a2721dccdc3d7d9e2d17aaac444beeb148a0401b80a87abd85fe76c8b6be13a1656396644b57f2ed3fe7a991a427afae7e98aa9e9e1f28b3406dd7df8efba952fac941ff01b856f26f92983896d5211f34536fb6326dc680b485434066308520cff08fdb8337e76ca26f0c16f8b8a3444c830af034b67556e5d430102337c84377a5d6c70cbd71b869635dad5335140ed8ca9dfc67d83d94020ebcde00c02b8c8f2858b7c0db13625d322d71f17cb29c5fa25d00", 0xf5}], 0x5) 1.565933711s ago: executing program 2 (id=4775): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x301, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x12}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x90}}, 0x0) 1.486467356s ago: executing program 4 (id=4776): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a3200000000140000001100"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a3100000000080005400000000209000200737997310000000008000a40fffffffc14000000110001"], 0x64}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000025c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x90}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 1.483070382s ago: executing program 1 (id=4777): r0 = socket$kcm(0xa, 0x5, 0x0) r1 = mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000002, 0x5d031, 0xffffffffffffffff, 0x0) r2 = userfaultfd(0x80001) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000100)) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x5}) syz_io_uring_complete(r1) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f00000000c0)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) r3 = socket$netlink(0x10, 0x3, 0x400000000000004) writev(r3, &(0x7f0000019440)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80ffe0090f000060000000a2bc5603ca00000f7f89000000200000004a2471083ec6991778581acb6c0101ff0000000309", 0x48}], 0x1) sendmsg$kcm(r0, &(0x7f0000000600)={&(0x7f0000000100)=@in={0x2, 0x4e21, @remote}, 0x80, &(0x7f0000000000)=[{&(0x7f00000006c0)='@', 0x1}], 0x1, &(0x7f0000000040)=[{0x10, 0x84, 0x8}], 0x10}, 0x41) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_int(r4, 0x29, 0x4e, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r5 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_CLIENT(r5, 0x404c534a, &(0x7f0000001280)) syz_80211_inject_frame(&(0x7f0000000300), &(0x7f0000000ec0)=@data_frame={@msdu=@type11={{0x0, 0x2, 0xb, 0x1, 0x1, 0x1, 0x1, 0x1, 0x1, 0x0, 0x1}, {0xfc}, @device_b, @device_b, @device_b, {0x0, 0x5ae}, @broadcast, @value={0x2, 0x1, 0x1, 0x0, 0x7}, @value=@ver_80211n={0x0, 0x80, 0x0, 0x2, 0x0, 0x3, 0x1, 0x0, 0x1}}}, 0x24) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000080)={0x58, 0x2, 0x6, 0x201, 0x0, 0x0, {0xc, 0x0, 0x80}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0x10060000}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x12, 0x3, 'hash:net,port\x00'}]}, 0x58}}, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_trace', 0x2202, 0x0) write$cgroup_subtree(r7, &(0x7f0000000080)=ANY=[@ANYBLOB='-5'], 0x9) finit_module(r7, &(0x7f0000000180)='\xff\xff\xff\xff\xff\xff', 0x1) r8 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) process_vm_writev(r8, &(0x7f0000001c80)=[{&(0x7f0000019100)=""/162, 0xa2}], 0x1, &(0x7f0000001d80)=[{&(0x7f0000001cc0)=""/116, 0x74}], 0x1, 0x0) r9 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_PVERSION(r9, 0x80045700, &(0x7f0000000300)) r10 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/stats\x00', 0x0, 0x0) ioctl$INCFS_IOC_GET_FILLED_BLOCKS(r10, 0x80286722, &(0x7f0000000140)={&(0x7f0000000040)=""/208, 0xd0, 0x6, 0x9}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) 1.409846291s ago: executing program 5 (id=4778): r0 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x8502, 0x0) write$sndseq(r0, &(0x7f00000005c0)=[{0x6, 0x0, 0x0, 0x0, @tick, {0x2}, {0xf}, @queue={0x9, {0x4, 0x2}}}, {0x0, 0x0, 0x0, 0x0, @time, {0x7}, {}, @queue}, {0x0, 0x0, 0x0, 0x0, @tick=0x2, {0x5}, {}, @time=@time={0x7}}, {0x0, 0x0, 0x0, 0x0, @tick, {}, {}, @note={0x0, 0x0, 0x11}}], 0x70) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000001c0)) ioctl$IOMMU_IOAS_COPY(0xffffffffffffffff, 0x3b83, &(0x7f0000000040)={0x28, 0x5, 0x0, 0x0, 0x3, 0xfffffffffefffffa, 0x3fff}) r1 = memfd_create(&(0x7f0000000480)='\xff\x00l\x1e\xa00x0) ptrace$setregset(0x4205, r4, 0x2, &(0x7f00000003c0)={&(0x7f0000000340)="3819bec43de7f4f69d51215a69100cb5cbdca14d229a297e2d1eee729c93d20dcf1a1c679c8cab1a5f9869de69c0450a5129c70201937fc22d5a1841efd358c7d94a5b5621351be4b710d1651874", 0x4e}) ioctl$UDMABUF_CREATE(r3, 0x40187542, &(0x7f0000000040)={r1, 0x0, 0x0, 0x2000}) ioctl$AUTOFS_DEV_IOCTL_EXPIRE(0xffffffffffffffff, 0xc018937c, &(0x7f00000000c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x4}}, './file0\x00'}) shutdown(r5, 0x1) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000180)={0x80000000}, 0x19a) write(r6, &(0x7f0000000000)="240000001a005f0400f9f4070009040180000000000000200000000008001d0040000000", 0x24) ioctl$USBDEVFS_SETINTERFACE(r5, 0x80085504, &(0x7f0000000140)={0xd408, 0x7de}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000040)="c01803001d000b20d25a80648c2594f90124fc60100c03000218000005", 0x1d}], 0x1, 0x0, 0x0, 0x4000}, 0x3500000000000000) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000240)={0x0, 0x20, &(0x7f0000000200)=[@in={0x2, 0x4e20, @remote}, @in={0x2, 0x4e24, @multicast1}]}, &(0x7f0000000280)=0x10) setsockopt$inet_sctp_SCTP_MAX_BURST(r5, 0x84, 0x14, &(0x7f00000002c0)=@assoc_value={r7, 0xffffd0f0}, 0x8) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r8, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB="340000003d0007010000000000000000047c000049ff08800c0001"], 0x34}, 0x1, 0x0, 0x0, 0x800}, 0xc000) 1.342533146s ago: executing program 2 (id=4779): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x100}, 0x1, 0x0, 0x0, 0x8001}, 0x24000000) 1.281951963s ago: executing program 5 (id=4780): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000240), 0x20000, 0x0) ioctl$EVIOCGLED(r0, 0x80284504, &(0x7f0000000000)=""/56) r1 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_open_dev$midi(&(0x7f0000000000), 0x3, 0x88c02) syz_usb_disconnect(r1) 1.258649449s ago: executing program 4 (id=4781): request_key(&(0x7f0000000000)='.dead\x00', 0x0, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000100)) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x68, 0x2, 0x6, 0x5, 0x0, 0x0, {0x0, 0x0, 0xfffc}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_CADT_FLAGS={0x8, 0x8, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:mac\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_PORT_TO={0x6, 0x5, 0x1, 0x0, 0x4e24}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x68}, 0x1, 0x0, 0x0, 0x40}, 0x0) 1.215027307s ago: executing program 2 (id=4782): rt_tgsigqueueinfo(0x0, 0x0, 0x30, 0x0) r0 = creat(&(0x7f0000000180)='./file0\x00', 0x0) close(r0) r1 = timerfd_create(0x0, 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x0, &(0x7f00000001c0)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r0, @ANYBLOB=',wfdno=', @ANYRESHEX=r1, @ANYBLOB="bc02"]) socket(0x10, 0x2, 0x0) 1.006561683s ago: executing program 2 (id=4783): r0 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) bind$inet(r0, &(0x7f0000000100)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@mss, @sack_perm, @window={0x3, 0x7}, @sack_perm, @window={0x3, 0x3, 0x401}, @window], 0x63) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4) sendto$inet(r0, &(0x7f0000000000), 0xffffffffffffff94, 0x12, 0x0, 0x12) ftruncate(r0, 0x3) ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000040)={0x8, 0x7}) recvfrom$inet(r0, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) 1.006219206s ago: executing program 4 (id=4784): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r2) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000280)=@req={0x2, 0x7, 0x2, 0xd1a3}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000ac0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fcdbdf251800000008000300", @ANYRES32=r5, @ANYBLOB="400030803c000180080001"], 0x5c}}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r8) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00', 0x0}) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r13, &(0x7f0000002f00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004000)=[@pktinfo={{0x24, 0x29, 0x32, {@private2, r12}}}], 0x28}}], 0x1, 0x20005485) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f0000000640)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, r9, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r14}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xfe}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfe}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_LBT_MODE={0x5}, @NL802154_ATTR_LBT_MODE={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r14}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x54}}, 0x4000000) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r1, 0x70b, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000051}, 0x40000a0) 881.070726ms ago: executing program 4 (id=4785): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) openat$ptp0(0xffffffffffffff9c, &(0x7f0000000140), 0x2001, 0x0) clock_adjtime(0xffffffd3, &(0x7f0000000440)={0x3, 0x0, 0x8000008c1f, 0x800000000, 0x0, 0xbc, 0x400, 0x6, 0x0, 0x0, 0x81, 0x80000000000, 0x7125, 0x1, 0x102, 0x200, 0xfffffffffffffffc, 0x1, 0x3, 0x4, 0x1, 0xffff, 0x0, 0x8, 0x0, 0x80000000000000}) r1 = add_key$fscrypt_v1(&(0x7f0000000100), &(0x7f00000001c0)={'fscrypt:', @desc2}, &(0x7f00000002c0)={0x0, "a204ed584a940dadd45cd3afc43914fce1d5cbd011a5397d4966db2cf1ab4e6b10cac9f89be94b14a5b2d53bb7a59aa3d279268a3474e759aa7df64542364541", 0x2c}, 0x48, 0xfffffffffffffff8) add_key(&(0x7f0000000040)='syzkaller\x00', &(0x7f00000000c0)={'syz', 0x1}, &(0x7f0000000540)="9c33fb69f6c4cfa347a3821dcd3264ac0d8ba86e498082847bb263ed58d46c5802357a8597a690ebcddc69c97524fa1958b15488758559d0e42d006009239706bbf1d0a831f56ac51635a7f0e955d95d31bcffae306dde94a08242d819a8c693e30540d9487ceba5641dbfc8eb78a3b91484da0eb5876fb5d09a53cc36c1e56e1b80056791c44e5b0c673099f3925131f77407e69cc1e1394d4dbfaf7341e9c41cc16b416f34e5f63d7a6a9c4ff70991532662a02c8a5925e5bbc409e4fab365291c4fc282c9892055c314ab7bc292dd4ac0fd9f63f873cdac22f06d2c12ad6acc68fa90d862490584fecb80313fd7201cdf5cb6e576377cb89a002e7d276a12f8f9f9fd81ee98d5df988cb3cd0945a192d6f06cd72e7a158e2a6eaf603e8738f3744100564fde6a6217b7c2f6b413796976905c23336040128841a279d32e4535e63234a735cedcec5e43a10cc7f0cb6926a10e35a5a263286e54a2e9741caf288f36d45c8ed1c4a68beeb391062299fb7d410254e06279e6bd5cc427e4130767b51996b5a4df97a617fcf18c592a516a44e0dc9b5b6c481891f39ad9c5cc45c38f146c676e1a68d6f2aaa40ae21ad5c2e70568d7574db891704e5e9faba52e2eae1d9341d96d956a3aa54ff69aacd71bc4085336912223fcfb733dd403a7afdf5162ff748407906b0d5e9fb442acd03eb3d47d9c04116766e87f31bccabb1e905ed499ecf3144624fc70da4cd73ce1ea05b4c4a2e296ecee590312f2004264a91d6a7497cbbb3b3dd55e7821be2e506dc480e5db5c4c7bae668e0407d5d1f6bfeda2b3cb26617030893836d2a6eefdfdcf071206bc92946c9f5446a1f9dc8cff659098d30448e906ab8b22d54e212a3ad0fe8054df134c7609784788fd5f25cf7602d8a8e4cc2f565087d2e822fd6bb8bc3e8f1b0e75c3c5a77706152460e6433bed11d20521827dbf81dcefb223fe02c23e45d94503bbeb18cbc44dd175fdda02c04de4c2fcb1d6503839d64265b9b309bdd21bb18e3d30be07db10dc08c858212c991884ec2f8a2d9466cf26349e24e637ffc156be55dd2bbdd2e19e06c891a9f543b182fb4ee1d184ce29c65c0e45f2ff00234619f902e90654d4ff3c65fe39c8368d2b03ecb002057ed584dd8c24a6bdcd6c0b99685d2e428b8acf28fab8675458472562d07979e7c043dff5eed61ca4882902a3190b30b7b55e3db9e7f7f6cd89009f92712cf953224fe69a6f62f0d168c64d1ad713745aeb605c86159f7cd155cf334a75632dcc6ffb9b77c99b5fd2250c0925deb897f301a517673352ebf0e5c4eaea6222084884cd05f0c90ce44923b6746849f0d1626b510c614b8e39979ad4ab0aa946d9cc5dca6f6b707b1c05142d463ce36e3214601eea49cd6fcca07277fa4834552db094353b2d730d38fdc7f584cc05c07dc76d2c9c6bf72e38539e6ddcbe954888d0c8b4fc73c8b09712cc9bfe3b8cbe2f2f237acff58bbd628641d991dc8434a738fdee81d7582a068dffc8b04e00e72340da817d34bddd87a63152739b0575bccef7cd369f67ad8ce4f15c598cc8b8f9aba48bfffe864daab6917c3d49c7167b0b038c9a1ea4edabba6f6c978b80cb2f0c4522924b438dcc646934818958ad72ec7ba98eacf3d91f61acb21baef8dcf232d344cd9236b63d129e4c6e795667f0cec6a8941564025afdf7a2577e5601774fea7daa92ef2e9d7c1c27ff5e6ff47cf338b972379c1b8cb9eb7ae7f781b3bf20555a2a943ae77df5adf9f9759234f505fd821c560289ae5bbc80ecbe0ddccd33c5b8952170aefa4acfcc16064ac5425ab7204f9a6eba6d7e2de47097a9ae144c1d9929fa4dcb70e4f68f98af11dcf7690566df89a8947a34a1f267cf0c433b8349d9f6492f79569fa584b5dfd92d7c8a1001b51b58a41586678710c97930338eaf95d4ff3110a2d0967457a76d993dc8d56ae70d43784cabdad795374bb01ccfdf03c9001ddeb5e2479a6f833b83d1ade1ca001f6fea4a9ad074cdeae786f0fd774ad288655b2e78a9d214eb2872c3b375b339bc68535bc63ca1ef8884871fa62c03617b0c5acfe3fe9734c8aa5055999fd11719f4e00005426a42d771e34e6754944087d619ece1881fc45c5baf7f2e1cf0d2f32f99b9a301b71ed82d2a28f6aa14ea4fa8ed799320a66a4fe116255100cba85f2e54f81d0044355ff71b28adabc3829b28a7510852d8ee1ade837a71178c059a7569d084123dcb7c1d44f15887f0afacf87535ecab9c3a9c253af3cfb884066a5668761d942951ba9f57f5e9b6ac6dad4a91f7b4f44446a5110101fb43ac089cafc8236e6c94afe4669dc86042a46073cba6fe8e856bb41a6bf3e81abe60da212a236bb5aaf7e96f6a5fc3ac2e5efebdfcf6917cec4410d35fa354e7cbaeea3935f2401fd5025fdca4211d673e74b1bf091209ec4279ebb69f00922233c7210568b8143e509522b594da5c9abc311d5ba7c1446939c4f39a84e4d0ca11e2413361f67b9994a3cdbd384ee15372ea8309aa6dac58f0703174401ef8ee9e3f294e5203eb71357725c15059650fceaa5d988dccd1154500a2a454730f60671efb1fb6b5603d8239d070ce9ea4d0cc42213f81f35e7e7e0cb35eb01349eedba346b135a7d1f16d985b4879f26db9874ea6771851b246eaab309b80e1b1ac0a0646db68b70f249864dbf053254e1e956da656681fad1afd0543c1c05e06cec6212d080846dba080ed3bc05da77632f3b5aa0a9b81c311395fd6c29de6e9d3ade47a5662127df904fc0d8a049332047c9fad1b4ad8c3d6942caacc76e2e9f3d22682f53856bee4c4d8b13667bccf7126fcc73ee41e9a5cd9bf195e3865873e65bd508c46f25b14de07aeda2175e14714e46ba78e8f6e246ca88ff52ffc015706aca6eb5c0533e8f9dff9b6fb60c425f100ba35a922e6e9086a40d011a6f205e1e6c452788ed1137f88d81488a3db63f5a7a6d138a397e95c47952b1f4dccc0c09e3551d93b9660359de5e188d809f402c5f3ef9faf3af198d8e73c5e9e436e8530add4cb116eb28a1f0b28b7a98f5c708ca16f83babf61fd877fba73ce9765ab9a071bbf38a4c058c9816105b1b68ebf76ce267d3d32873cba8a60fa51762fb6fa1f0072129e583b8a1a761992d0a0801a92c5e859c6713d4aa21f8b058f76b0843c5de46d462f6a4410106a3f432b9732994e9b36e4445078f21c2950d68ed2001ef2624fd44553c22f84befb12b69c637b4d83d86e4758eedb0e7e755cacf5ff1da199ceae4327cb8534174d6340ccb86cb0fe66f17662e49699b68e82f8ec130623edbd60367f2b1fd5aa6e41af36fe426c13bcf70bd873225df8586ded4637da07c7b33d2b8d2a04ce7900a13fab44a8e0be859387d16711260081c7a8332b1346f28a217069bd993895c4ad1119e2c83ba09d27b4b32dc35f9bc70af67a6bab5824e4f7429acdf84d58189e63a7ccd9890e1eb623cd0b2732754fa09132052804cd4e2ea01f97030352680bfe7d5d713852245888036b269b58ca3edaa6c6f6fa7cf77e5fd6193af644da2324e356dba47d91884434ae05d16e700e0a4dc53ba19476d664318b3850c4a082ca437c0bb97325610ea42a85cc6ba7cfbf9b17badd5f01d172446678dfa1b17ad84ca31a68795ca54370d198fb16004036674eada406bd4bb64e131bfe5586ffa8f4b452ea4288193af6988a583a32aca66c878b895e6fd1d513874e44d2d9a082d1b1de699636d8a9d31d2033cb7b58a8ec522f04e6f26e8d66cb1d0d86c4a6b9a8ee61bd68d97329dbaa8eabde88c98ff8de3440c972b0a73c8b414b02772b009d203de3fbbbcd548930f8179b25d95f02dd1db3c5a57fecc0b2edb00b7f44a25625f5c7b40840c67807d461a196d6902f2a313d49c0d7e3a80f94dd44e827af67473679b43c597be655d3aec4dc3fcfbfeb729add2252e00eb6100a8324ffcd801bebb9dfc7fe131fbbec33a23acf39c4627d7dcc127d9c98bfa19f5e3c474fda2ddca23726720fbde68504e530272a5d8800fed6bf8c108781e2023b592cd868009c49dbeb019b2e4030454e2c14d1a913a6b53a16cd6dfc251c48544ce84909e8d50f61cdb62ac4ee95ccba2e869681ef5277384579ff74585137812ebb246159022e6bd868d072fd64d39b09bd93ccaf124f7ac910f354fb7f39191f37008e3a4a48fdc07e891a5fe939a4706471377827059739e65b7f8dff72183c6584a3aabedc38592c5153d2d9ed31d22778ce6a6ce852d579aa84124069254fa8ef72f766d2da70748a106b6e2fa54fdea11a129f5a5eac7ff448dfa22cc6633fe79b997481b994451feb35e8855a23b631d3a820b9080e671dab22bf3e9bad394d96359acfa2249b8108bf5afa699d17ee16d028599ab5854928f8ddcade09550a81382d7d905e04c1be8c5250734963799da3a230c0b25032266791f4e5d1f6574eb5cd19da9b24729882f188f0230c8360c3c535103340fb903dce377e3407d2399b57cbd4dd88e9d10d546838c26522730ffe09ebb68eb6e38dfbb95a9bb2b2471f9954d79403068bde53ba6bc6c5a48719c3a9b7ce96911068a3bb1345f2352316e2bd3b6fe3ba789fc1caed70e551d7d3afa4cea7e6931c71e05fb2d78bd0663027d4c1c5fe545413bd1ff2eedea0cda7372f458b17b11652b771a6d04f7cc258f59b162b01082541f63d519fc342c5b84c3926398005d2d8e5f3049ec60c57c870d4c148d5df257f8460d5723d6878c872e390790843909c9d9fe2914c7e354c4add95f3316c9efca6a2a61ed814f5f4d30aa0e23e1277cf97d6757216e495895c82f7bec66fee139b332fb50abab9cb32992b5838bd3139214fc43873e6b13c65fd5b8342fee21541b368a55f645b3a9a2e8b61ed0f6bb30f8fc1649acd230f58d9f5ec52bcf713d34ae66e6d5cc5edd4d46ba502002ba827a706540fcf8d5d2825776ef85a80a6355dea9adb7425768e1a03b56f5813cad743f9a99446aad9011b7c3677589180457c686f6a587f787fa29ed2b9524fd34dd73f2aee6cdb18ef35f0c3143210008c5ce20b4187f5ea5d8dd5fd86819625b40f7ab62466ec84948593538ad4d8abc517c62c169577c3b1c2a93af25af166e9a9af7d62b060de9b4c54040419afffcc42efc1326690d4a7a88a15e87a4b41286d05e60673ad6a758d9ee5012a485f55f2f92ba3e98db54265905fdc7192ad5236e06802a1ef549ad5bec6da407c8c338becdb2689b7d995ffb2e0cc6bf6bfe020bcbdb0e09d88b82a8c9022ac9cbe0382d925de3871c640198c451e79248807b81bdcc6bb119307af6f8f179a821d3117cb13d86f9253923958b76989974eddb392f16c15107d4262f78b9f406567320f055ecb0755a8e3ecd20bed5be68d3a9f171b21b17819cd5737a1d84531a28db89d05cf76869fc1a6038655259ab4bb9fa1d441659ed7a898fcb8b7ff2058f0a27f5f08fb3a9c28632c79e7a645b80b78ee51fd7dc59f987388a78e466daf85db988e1e3057980de0d76cb61b6b677173123e3ef5bf8670bdd48b1d0dbb417f790cc928cc2cfaa49cc61febd4032d535990c038fab2fd8904ad653f02f0170e27a91ed17b6962372a4ec60a6add1a2c161c38595bd601b72bf3e34d6b679c61863f94d2a6d57092580dcba3997b339479f5ef0973c2ce4838d853b50d8cbfbc376e26977f86442c3307a84d48d3a46cf54f3efa89acf850edbc9ab64b9fd9014559f155c850aaabcec4e59b0af374f7f474a02cee17ae82d9d8", 0x1000, r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$alg(0xffffffffffffffff, &(0x7f0000000d40)=[{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f00000006c0)="9eacc7a4ffcb23", 0x7}], 0x1, 0x0, 0x0, 0x20008000}, {0x0, 0x0, &(0x7f0000000a00)=[{&(0x7f00000002c0)}, {0x0}, {&(0x7f0000000800)="145ba3f67fa1b84a7c8f12440ed4d6c39c8c0627d7163c3b2a948c21a8a97faf1fb3a1e14c979750fe8d01ed2e712b6f6655bbd69e864d75284d563a1b37b66ac66c4466f94137e02e5dd043b7326a8db880a318ff7f613831732875255c42e1e8f6b492a0c7af5f51d08e14b43c95b9e07238d73d", 0x75}], 0x3, 0x0, 0x0, 0x80}], 0x2, 0x40800) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000680)=ANY=[@ANYBLOB="f4060000", @ANYRES16, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r3, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) mlock(&(0x7f0000663000/0x3000)=nil, 0x3000) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000280), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001580)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="010025bd7000fcdbdf254400000008000300", @ANYRES32=r6, @ANYBLOB="04002400080063000045ec8a1b0018000303030303030000fb08a048161cfb5bb9278ab087ffb90661294b8f080b2296c39d79d81e862b80a77324cad5fd81980aedd085fa11397ad7976528bfb9640b87b510fd725a2d0c2212d059b1d7f7397b8b41336b83251a4f56d648dacde72de0eeb5594dc23b26ca67e56e4b20db1c6e5915445f70a13b7ecd5ee919da"], 0x34}, 0x1, 0x0, 0x0, 0x20004805}, 0x80) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x15, &(0x7f0000000080), 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) shmat(0x0, &(0x7f0000ffa000/0x3000)=nil, 0x4000) mprotect(&(0x7f00003fd000/0xc00000)=nil, 0xc00000, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r4, 0xc0285700, &(0x7f0000000340)={0xcf, "c0bea40bcf325904ae8c2f53e0b96aa95c1bd74f9fe9307da94140dc5d98ac8f"}) syz_usb_connect$cdc_ncm(0x0, 0x76, &(0x7f0000000240)=ANY=[@ANYBLOB="12010000020000402505a1a44000010203010902640002010000000904010001020d00e7052406000105240000000d240f0100000000000000000006241a0000"], 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r4, 0xc01864c6, &(0x7f00000003c0)={&(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0], 0x4, 0x80800, 0x0, 0xffffffffffffffff}) ioctl$UFFDIO_POISON(r7, 0xc020aa08, &(0x7f0000001540)={{&(0x7f0000967000/0x1000)=nil, 0x1000}, 0x1}) 379.201536ms ago: executing program 1 (id=4786): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) syz_usb_connect$uac1(0x5, 0xc0, &(0x7f0000000580)={{0x12, 0x1, 0x141, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xae, 0x3, 0x1, 0x8, 0x0, 0x8, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0xb}, [@input_terminal={0xc, 0x24, 0x2, 0x4, 0x205, 0x1, 0x2, 0x3, 0x6, 0x7}, @processing_unit={0x8, 0x24, 0x7, 0x1, 0x3, 0x3, 'R'}, @mixer_unit={0x8, 0x24, 0x4, 0x3b, 0x2c, "7a8a33"}, @input_terminal={0xc, 0x24, 0x2, 0x1, 0x204, 0x5, 0x1, 0x1, 0xe4, 0x9}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0x11, 0x24, 0x2, 0x1, 0x81, 0x2, 0xde, 0x5, "e8646e8ee09cf68aff"}, @format_type_i_continuous={0x8, 0x24, 0x2, 0x1, 0x5, 0x1, 0xd2, 0xfe}, @as_header={0x7, 0x24, 0x1, 0x5, 0x9, 0x3}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x1, 0x1, 0x8, {0x7, 0x25, 0x1, 0x0, 0x6, 0x1}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x1, 0x5, 0x1}]}, {{0x9, 0x5, 0x82, 0x9, 0x400, 0x7, 0x80, 0x8, {0x7, 0x25, 0x1, 0x2, 0x3, 0xfff7}}}}}}}]}}, &(0x7f0000000340)={0xa, &(0x7f0000000140)={0xa, 0x6, 0x300, 0x8, 0x7, 0x6, 0x8, 0x3}, 0x3d, &(0x7f00000002c0)={0x5, 0xf, 0x3d, 0x5, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0xe, 0x8, 0x6, 0x3}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0xd9, "67cd65dd5f18f8f02f07a3634f7e4f5b"}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0x3, "db560f44f8fe7f6ef339e2efaa9fd088"}]}, 0x1, [{0x4, &(0x7f0000000300)=@lang_id={0x4, 0x3, 0x1009}}]}) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r0, 0x400454cd, 0x336) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)=""/40, &(0x7f0000000040)=""/56, &(0x7f0000000080)=""/51}) openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x430400, 0x0) mount(0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)='usrquota') mknodat$null(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1, 0x103) sendmsg$NL80211_CMD_SET_BSS(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f0000000380), 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x58, 0x0, 0x8, 0x70bd27, 0x25dfdbfb, {{}, {@void, @val={0xc, 0x99, {0x7fff, 0x32}}}}, [@NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x28}, @NL80211_ATTR_BSS_HT_OPMODE={0x6, 0x6d, 0xfff8}, @NL80211_ATTR_BSS_SHORT_SLOT_TIME={0x5, 0x1e, 0x80}, @NL80211_ATTR_BSS_CTS_PROT={0x5, 0x1c, 0x4a}, @NL80211_ATTR_BSS_SHORT_PREAMBLE={0x5, 0x1d, 0x9}, @NL80211_ATTR_P2P_CTWINDOW={0x5, 0xa2, 0xff}, @NL80211_ATTR_P2P_OPPPS={0x5, 0xa3, 0x1}]}, 0x58}, 0x1, 0x0, 0x0, 0x4000}, 0x44004) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f00000001c0)={0x40000001fe0000}) fallocate(r3, 0x1, 0xffffffff, 0x80000000) ioctl$VIDIOC_QUERYMENU(0xffffffffffffffff, 0xc02c5625, &(0x7f0000000180)={0x8000, 0xc5fb, @value=0x3}) r4 = add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000000540)="bc3009bb66682c9d4233b0cc644f5fdae5b9d17f7ada03bc77aea173022c18232e1fb162caf50d08fda40c6e9c515c4a2c", 0x31, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, r5, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) mount(&(0x7f0000000300), &(0x7f00000001c0)='./file0\x00', &(0x7f0000000080)='ubifs\x00', 0x0, 0x0) close(0x3) 226.638378ms ago: executing program 5 (id=4787): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x22000, 0x0) read$FUSE(r0, 0x0, 0x0) (async) move_pages(0x0, 0x0, 0x0, 0x0, 0x0, 0xb) (async) syz_io_uring_setup(0x6c6, &(0x7f0000000000)={0x0, 0xef6d, 0x20, 0x2, 0xff}, 0x0, 0x0) 223.448438ms ago: executing program 4 (id=4788): r0 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000140)={0x1d, r3, 0x2, {0x2, 0x0, 0x4}, 0x2}, 0x18) r4 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r4, &(0x7f0000000140)={0x1d, r5, 0x2, {0x2, 0x0, 0x4}, 0x2}, 0x18) r6 = openat$cgroup_procs(r1, &(0x7f0000000180)='cgroup.procs\x00', 0x2, 0x0) readv(r6, &(0x7f0000000440)=[{&(0x7f00000002c0)=""/252, 0xfc}], 0x1) r7 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) setuid(0xee01) socket$inet6_sctp(0xa, 0x1, 0x84) ioctl$SW_SYNC_IOC_INC(r1, 0x40045701, &(0x7f0000000100)=0xf) ioctl$IOC_PR_PREEMPT_ABORT(r7, 0x401870cc, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x104) r8 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') r9 = socket$can_j1939(0x1d, 0x2, 0x7) getsockopt$sock_int(r9, 0x1, 0x26, 0x0, &(0x7f0000000080)) mount$9p_fd(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000040), 0x2209400, &(0x7f0000000080)=ANY=[@ANYBLOB='trans=fd,rfdn\x00=', @ANYRES32=r7, @ANYBLOB=',wfdno=', @ANYRES16=r8, @ANYRES64=r8]) mount(0x0, &(0x7f0000000240)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x800, &(0x7f0000000040)='usrquota') 176.23373ms ago: executing program 5 (id=4789): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x24000000) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000025c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0xb}]}, @NFT_MSG_DELSETELEM={0x2c, 0xe, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0xa}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x90}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 106.60763ms ago: executing program 2 (id=4790): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000009b00)={0x0, 0x100}, 0x1, 0x0, 0x0, 0x8001}, 0x24000000) 35.382694ms ago: executing program 4 (id=4791): r0 = socket(0x10, 0x3, 0x0) r1 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f0000000100)={0x6, 0x1f, 0x6}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f00000000c0)={0xdb, 0x1ff, 0xb}) r3 = syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x20400) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000340)={0xda2, 0x8166, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000200)={0x200, 0x1fb, 0xc38}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r2, 0xc02064b2, &(0x7f00000001c0)={0x7, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000040)={0x49, 0x7fff, 0x2}) close_range(r2, r3, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000240)={0xbad, 0x80, 0x3}) write(r0, &(0x7f0000000000)="2400000011005f0414f9f4070009040081000000200000000000000008000f0001000000", 0x24) 34.344266ms ago: executing program 5 (id=4792): r0 = syz_open_dev$vim2m(&(0x7f0000000000), 0x7f, 0x2) r1 = open(&(0x7f00000001c0)='./file0\x00', 0x200, 0x80) newfstatat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x0}, 0x4000) read$FUSE(r0, &(0x7f0000000b40)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) mount$fuseblk(&(0x7f0000000100), &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x80004, &(0x7f0000000400)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x6000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@default_permissions}], [{@obj_user={'obj_user', 0x3d, '*.'}}, {@seclabel}, {@hash}]}}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={{0x14}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @quota={{0xa}, @val={0x18, 0x2, 0x0, 0x1, [@NFTA_QUOTA_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_QUOTA_BYTES={0xc, 0x1, 0x1, 0x0, 0xd}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}}, 0x0) r5 = syz_usb_connect(0x0, 0x36, &(0x7f0000000b00)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0) syz_usb_control_io$printer(r5, 0x0, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) r6 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_DELDEST(r6, 0x0, 0x488, &(0x7f0000000080)={{0x0, @multicast2, 0x4e23, 0x4, 'sed\x00', 0x2, 0x80000000, 0x9}, {@dev={0xac, 0x14, 0x14, 0x2c}, 0x4e20, 0x4, 0x0, 0x886, 0x2}}, 0x44) r7 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x802, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r7, 0x4018620d, &(0x7f0000000100)) r8 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r9 = dup3(r8, r7, 0x0) ioctl$BINDER_WRITE_READ(r8, 0xc0306201, &(0x7f0000000380)={0x0, 0x1000000, 0x0, 0x1, 0x0, &(0x7f0000000280)="f8"}) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000040)='./binderfs/binder0\x00', 0x0, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r10, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f0000004a80)={0x73622a85, 0x100, 0x1}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000004c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r9, 0xc0306201, &(0x7f00000001c0)={0x4c, 0x0, &(0x7f0000000fc0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x48, 0x18, &(0x7f0000000300)={@flat=@weak_binder={0x77622a85, 0x100a, 0x8000000000}, @flat=@weak_binder={0x77622a85, 0x1100, 0x3}}, &(0x7f0000000200)={0x0, 0x18, 0x30}}}], 0x0, 0x0, 0x0}) mmap$binder(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1, 0x11, r7, 0x10000000000) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000004a40)={0x44, 0x0, &(0x7f00000049c0)=[@transaction={0x40406300, {0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}], 0x0, 0x0, 0x0}) ioctl$BINDER_THREAD_EXIT(r9, 0x40046208, 0x0) syz_usb_control_io$cdc_ecm(r5, 0x0, &(0x7f0000000680)={0x1c, &(0x7f0000000040)=ANY=[@ANYBLOB="401506"], 0x0, 0x0}) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) 0s ago: executing program 2 (id=4793): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), r2) r4 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) setsockopt$packet_rx_ring(r4, 0x107, 0x5, &(0x7f0000000280)=@req={0x2, 0x7, 0x2, 0xd1a3}, 0x10) ioctl$sock_SIOCGIFINDEX_802154(r2, 0x8933, &(0x7f0000000ac0)={'wpan0\x00', 0x0}) sendmsg$NL802154_CMD_DEL_SEC_KEY(r2, &(0x7f0000000c80)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='\\\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd7000fcdbdf251800000008000300", @ANYRES32=r5, @ANYBLOB="400030803c000180080001"], 0x5c}}, 0x20000000) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000040)={'wpan4\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) ioctl$sock_SIOCGIFINDEX_802154(r0, 0x8933, 0x0) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000100), r8) r10 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r11 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000340)={'veth0_to_hsr\x00', 0x0}) r13 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r13, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x7}, 0x1c) sendmmsg$inet6(r13, &(0x7f0000002f00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000004000)=[@pktinfo={{0x24, 0x29, 0x32, {@private2, r12}}}], 0x28}}], 0x1, 0x20005485) ioctl$sock_SIOCGIFINDEX_802154(r10, 0x8933, &(0x7f0000000640)={'wpan0\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_DEV(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)={0x50, r9, 0x852dd6c070cd7e4d, 0x0, 0x0, {}, [@IEEE802154_ATTR_LLSEC_FRAME_COUNTER={0x8}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5}, @IEEE802154_ATTR_HW_ADDR={0xc}, @IEEE802154_ATTR_LLSEC_DEV_KEY_MODE={0x5}, @IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r14}, @IEEE802154_ATTR_PAN_ID={0x6, 0x6, 0xfe}, @IEEE802154_ATTR_SHORT_ADDR={0x6, 0x4, 0xfe}]}, 0x50}, 0x4, 0x700000000000000}, 0x0) sendmsg$NL802154_CMD_SET_LBT_MODE(r0, &(0x7f0000000200)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f00000001c0)={&(0x7f0000000140)={0x54, r3, 0x1, 0x70bd2c, 0x25dfdbfe, {}, [@NL802154_ATTR_LBT_MODE={0x5}, @NL802154_ATTR_LBT_MODE={0x5}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r6}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r7}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8}, @NL802154_ATTR_IFINDEX={0x8, 0x3, r14}, @NL802154_ATTR_LBT_MODE={0x5}]}, 0x54}}, 0x4000000) sendmsg$IEEE802154_LLSEC_LIST_DEV(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000002c0)={0x14, r1, 0x70b, 0x70bd26, 0x25dfdbfe}, 0x14}, 0x1, 0x0, 0x0, 0x4000051}, 0x40000a0) kernel console output (not intermixed with test programs): sb 2-1: new high-speed USB device number 2 using dummy_hcd [ 1036.432212][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.440736][ T984] gspca_stk1135: Sensor write failed [ 1036.446138][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.452976][ T984] gspca_stk1135: Sensor write failed [ 1036.458883][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.465819][ T984] gspca_stk1135: Sensor read failed [ 1036.471304][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.478134][ T984] gspca_stk1135: Sensor read failed [ 1036.486097][ T984] gspca_stk1135: Detected sensor type unknown (0x0) [ 1036.493192][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.501451][ T984] gspca_stk1135: Sensor read failed [ 1036.507413][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.514465][ T984] gspca_stk1135: Sensor read failed [ 1036.520071][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.526638][ T984] gspca_stk1135: Sensor write failed [ 1036.539989][ T984] gspca_stk1135: serial bus timeout: status=0x00 [ 1036.546901][ T984] gspca_stk1135: Sensor write failed [ 1036.552474][ T984] stk1135 6-1:0.0: probe with driver stk1135 failed with error -71 [ 1036.569828][T16395] usb 2-1: device descriptor read/64, error -71 [ 1036.585729][ T984] usb 6-1: USB disconnect, device number 96 [ 1036.654348][T20391] chnl_net:caif_netlink_parms(): no params data found [ 1036.764116][ T12] bridge_slave_1: left allmulticast mode [ 1036.771066][ T12] bridge_slave_1: left promiscuous mode [ 1036.776895][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 1036.792907][ T12] bridge_slave_0: left allmulticast mode [ 1036.799021][ T12] bridge_slave_0: left promiscuous mode [ 1036.805668][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 1036.840204][T16395] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 1036.995263][T16395] usb 2-1: device descriptor read/64, error -71 [ 1037.122430][T16395] usb usb2-port1: attempt power cycle [ 1037.130168][ T12] dvmrp0 (unregistering): left allmulticast mode [ 1037.275873][T20391] bridge0: port 1(bridge_slave_0) entered blocking state [ 1037.284479][T20391] bridge0: port 1(bridge_slave_0) entered disabled state [ 1037.292588][T20391] bridge_slave_0: entered allmulticast mode [ 1037.303081][T20391] bridge_slave_0: entered promiscuous mode [ 1037.313148][T20391] bridge0: port 2(bridge_slave_1) entered blocking state [ 1037.321325][T20391] bridge0: port 2(bridge_slave_1) entered disabled state [ 1037.328805][T20391] bridge_slave_1: entered allmulticast mode [ 1037.340451][T20391] bridge_slave_1: entered promiscuous mode [ 1037.362948][ T12] tipc: Disabling bearer [ 1037.369135][ T12] tipc: Left network mode [ 1037.389862][T16399] usb 6-1: new high-speed USB device number 97 using dummy_hcd [ 1037.489549][T16395] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 1037.522173][T16395] usb 2-1: device descriptor read/8, error -71 [ 1037.570965][T20391] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1037.593916][T20391] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1037.604275][T16399] usb 6-1: Using ep0 maxpacket: 32 [ 1037.628813][T16399] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1037.677939][T16399] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1037.707565][T16399] usb 6-1: config 0 interface 0 altsetting 245 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1037.730286][T16399] usb 6-1: config 0 interface 0 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 1037.745622][T16399] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1037.755249][T16399] usb 6-1: config 0 interface 0 has no altsetting 1 [ 1037.765404][T16399] usb 6-1: New USB device found, idVendor=0582, idProduct=0033, bcdDevice=8e.57 [ 1037.789137][T16399] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1037.801053][T16395] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 1037.812839][T16399] usb 6-1: Product: syz [ 1037.817171][T16399] usb 6-1: Manufacturer: syz [ 1037.830344][T16395] usb 2-1: device descriptor read/8, error -71 [ 1037.831689][T20391] team0: Port device team_slave_0 added [ 1037.844380][T16399] usb 6-1: SerialNumber: syz [ 1037.853045][T16399] usb 6-1: config 0 descriptor?? [ 1037.872939][T16399] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 1037.921903][T16399] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1037.949067][T16395] usb usb2-port1: unable to enumerate USB device [ 1037.976503][T16399] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 1038.040050][T20391] team0: Port device team_slave_1 added [ 1038.073317][T16395] usb 6-1: USB disconnect, device number 97 [ 1038.089367][T11577] udevd[11577]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1038.115464][T17686] Bluetooth: hci0: command tx timeout [ 1038.278664][T20391] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1038.286806][T20391] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1038.314099][T20391] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1038.350242][T20391] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1038.357348][T20391] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1038.384653][ C0] vkms_vblank_simulate: vblank timer overrun [ 1038.395740][T20391] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1038.417557][ T12] hsr_slave_0: left promiscuous mode [ 1038.424226][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1038.435146][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1040.180791][T17686] Bluetooth: hci0: command tx timeout [ 1040.216711][T20391] hsr_slave_0: entered promiscuous mode [ 1040.222703][T16393] libceph: connect (1)[c::]:6789 error -101 [ 1040.222911][T16393] libceph: mon0 (1)[c::]:6789 connect error [ 1040.235764][T20391] hsr_slave_1: entered promiscuous mode [ 1040.273127][T20391] debugfs: 'hsr0' already exists in 'hsr' [ 1040.279963][T20391] Cannot create hsr debugfs directory [ 1040.489677][T16399] usb 6-1: new high-speed USB device number 98 using dummy_hcd [ 1040.520004][T16393] libceph: connect (1)[c::]:6789 error -101 [ 1040.526165][T16393] libceph: mon0 (1)[c::]:6789 connect error [ 1040.665034][T16399] usb 6-1: New USB device found, idVendor=055f, idProduct=c420, bcdDevice=6a.33 [ 1040.692226][T16399] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1040.757233][T16399] usb 6-1: config 0 descriptor?? [ 1040.785061][T16399] gspca_main: sunplus-2.14.0 probing 055f:c420 [ 1040.897104][ T12] IPVS: stop unused estimator thread 0... [ 1041.072120][T16393] libceph: connect (1)[c::]:6789 error -101 [ 1041.078429][T16393] libceph: mon0 (1)[c::]:6789 connect error [ 1041.230233][T16391] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 1041.407203][T16391] usb 2-1: config 0 has an invalid interface number: 219 but max is 0 [ 1041.437067][T16391] usb 2-1: config 0 has no interface number 0 [ 1041.477649][T16391] usb 2-1: New USB device found, idVendor=1a0a, idProduct=0101, bcdDevice=95.fe [ 1041.499445][T16391] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1041.517109][T16391] usb 2-1: Product: syz [ 1041.529711][T16391] usb 2-1: Manufacturer: syz [ 1041.539750][T16391] usb 2-1: SerialNumber: syz [ 1041.548211][T16391] usb 2-1: config 0 descriptor?? [ 1041.571905][T16391] usb_ehset_test 2-1:0.219: probe with driver usb_ehset_test failed with error -32 [ 1041.600054][T20453] ceph: No mds server is up or the cluster is laggy [ 1041.643159][T16399] gspca_sunplus: reg_w_riv err -71 [ 1041.678180][T16399] sunplus 6-1:0.0: probe with driver sunplus failed with error -71 [ 1041.705652][T16399] usb 6-1: USB disconnect, device number 98 [ 1041.722432][T20391] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 1041.776814][T20391] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 1041.778313][T16391] usb 2-1: USB disconnect, device number 6 [ 1041.831787][T20391] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 1041.852881][T20391] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 1042.058756][T20391] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1042.104890][T20391] 8021q: adding VLAN 0 to HW filter on device team0 [ 1042.133398][T20083] bridge0: port 1(bridge_slave_0) entered blocking state [ 1042.140826][T20083] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1042.171955][T20083] bridge0: port 2(bridge_slave_1) entered blocking state [ 1042.179361][T20083] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1042.261166][T17686] Bluetooth: hci0: command tx timeout [ 1043.113866][T20391] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1043.287333][T20539] smc: net device bond0 applied user defined pnetid SYZ2 [ 1043.319021][T20539] netlink: 14 bytes leftover after parsing attributes in process `syz.5.3730'. [ 1043.524184][ T984] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 1043.743707][ T984] usb 2-1: Using ep0 maxpacket: 8 [ 1043.767835][ T984] usb 2-1: config 179 has an invalid interface number: 65 but max is 0 [ 1043.778083][ T984] usb 2-1: config 179 has no interface number 0 [ 1043.785250][ T984] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1043.797564][ T984] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1043.811032][ T984] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1043.823887][ T984] usb 2-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1043.837094][ T984] usb 2-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1043.839174][T20539] smc: removing net device bond0 with user defined pnetid SYZ2 [ 1043.852688][ T984] usb 2-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1043.852723][ T984] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1043.887389][T20540] raw-gadget.1 gadget.1: fail, usb_ep_enable returned -22 [ 1043.915241][T20539] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1043.983031][T20539] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1044.009015][T20539] bond0 (unregistering): Released all slaves [ 1044.340394][T17686] Bluetooth: hci0: command tx timeout [ 1044.362922][T20540] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1044.394962][T20391] veth0_vlan: entered promiscuous mode [ 1044.400323][T20540] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1044.418996][T16400] usb 2-1: USB disconnect, device number 7 [ 1044.419024][ C0] xpad 2-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1044.434595][ C0] xpad 2-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1044.454589][T20391] veth1_vlan: entered promiscuous mode [ 1044.515013][T20391] veth0_macvtap: entered promiscuous mode [ 1044.527533][T20391] veth1_macvtap: entered promiscuous mode [ 1044.551279][T20391] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1044.568853][T20391] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1044.590064][T16401] usb 6-1: new high-speed USB device number 100 using dummy_hcd [ 1044.599866][ T49] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.609349][ T49] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.626054][ T49] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.635614][ T49] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1044.733086][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1044.749048][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1044.749056][T16401] usb 6-1: Using ep0 maxpacket: 16 [ 1044.763039][T16401] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1044.780238][T16401] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1044.791080][T16401] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1044.805647][T16401] usb 6-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1044.816395][ T1146] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1044.816675][T16401] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1044.828740][ T1146] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1044.854981][T16401] usb 6-1: config 0 descriptor?? [ 1045.259948][T16395] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 1045.283133][T16401] microsoft 0003:045E:07DA.0049: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.5-1/input0 [ 1045.307542][T16401] microsoft 0003:045E:07DA.0049: no inputs found [ 1045.316235][T16401] microsoft 0003:045E:07DA.0049: could not initialize ff, continuing anyway [ 1045.416082][T16395] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1045.429924][T16395] usb 2-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.00 [ 1045.441455][T16395] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1045.455160][T16395] usb 2-1: config 0 descriptor?? [ 1045.511729][T20559] virtio-fs: tag not found [ 1045.529903][T20559] syzkaller1: entered promiscuous mode [ 1045.535861][T20559] syzkaller1: entered allmulticast mode [ 1045.555675][T20559] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1045.566594][T20559] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1045.676889][T16395] thrustmaster 0003:044F:B654.004A: item fetching failed at offset 6/7 [ 1045.681136][ T5907] usb 6-1: USB disconnect, device number 100 [ 1045.686896][T16395] thrustmaster 0003:044F:B654.004A: parse failed [ 1045.701628][T16395] thrustmaster 0003:044F:B654.004A: probe with driver thrustmaster failed with error -22 [ 1045.875351][T20563] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1045.885152][T20563] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1045.896594][T16400] usb 2-1: USB disconnect, device number 8 [ 1046.759573][T16400] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 1046.959947][T16400] usb 2-1: Using ep0 maxpacket: 8 [ 1046.979685][T16400] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1046.989969][T16400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1046.998274][T16400] usb 2-1: Product: syz [ 1047.007687][T16400] usb 2-1: Manufacturer: syz [ 1047.016098][T16400] usb 2-1: SerialNumber: syz [ 1047.036630][T16400] usb 2-1: config 0 descriptor?? [ 1047.057264][T16400] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1047.255678][T16400] gspca_sonixj: reg_w1 err -71 [ 1047.263276][T16400] sonixj 2-1:0.0: probe with driver sonixj failed with error -71 [ 1047.277484][T16400] usb 2-1: USB disconnect, device number 9 [ 1047.372911][T20601] overlayfs: lowerdir is in-use as upperdir/workdir of another mount, accessing files from both mounts will result in undefined behavior. [ 1047.387969][T20601] overlayfs: overlapping lowerdir path [ 1048.069555][T16395] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 1048.069660][T16401] usb 6-1: new high-speed USB device number 101 using dummy_hcd [ 1048.230690][T16395] usb 2-1: Using ep0 maxpacket: 16 [ 1048.255275][T16395] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1048.267517][T16401] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1048.267593][T16401] usb 6-1: no configurations [ 1048.267609][T16401] usb 6-1: can't read configurations, error -22 [ 1048.290060][T16395] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1048.300598][T16395] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1048.314095][T16395] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 1048.324314][T16395] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1048.336533][T16395] usb 2-1: config 0 descriptor?? [ 1048.797429][T16395] microsoft 0003:045E:07DA.004B: hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.1-1/input0 [ 1048.812415][T16395] microsoft 0003:045E:07DA.004B: no inputs found [ 1048.819143][T16395] microsoft 0003:045E:07DA.004B: could not initialize ff, continuing anyway [ 1049.002803][T20606] virtio-fs: tag not found [ 1049.016608][T20606] syzkaller1: entered promiscuous mode [ 1049.023982][T20606] syzkaller1: entered allmulticast mode [ 1049.042485][T20606] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1049.052631][T20606] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1049.144067][ T5907] usb 2-1: USB disconnect, device number 10 [ 1049.443980][T20635] netlink: 'syz.5.3752': attribute type 12 has an invalid length. [ 1049.453573][T20635] netlink: 128 bytes leftover after parsing attributes in process `syz.5.3752'. [ 1049.463206][T20635] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1049.578505][T20643] binder: 20640:20643 ioctl c0c89425 200000000840 returned -22 [ 1049.597201][T20643] netlink: 48 bytes leftover after parsing attributes in process `syz.2.3754'. [ 1049.953080][T20661] netlink: 'syz.1.3759': attribute type 1 has an invalid length. [ 1049.960987][T20661] netlink: 'syz.1.3759': attribute type 101 has an invalid length. [ 1049.975513][T20661] netlink: 232 bytes leftover after parsing attributes in process `syz.1.3759'. [ 1050.009780][T16395] usb 6-1: new high-speed USB device number 103 using dummy_hcd [ 1050.172589][T16395] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 1050.199698][T16395] usb 6-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1050.224539][T16395] usb 6-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1050.231581][T20668] input: syz1 as /devices/virtual/input/input113 [ 1050.247703][T16395] usb 6-1: config 220 has no interface number 2 [ 1050.255640][T16395] usb 6-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1050.274096][T16395] usb 6-1: config 220 interface 0 has no altsetting 0 [ 1050.285003][T16395] usb 6-1: config 220 interface 76 has no altsetting 0 [ 1050.295848][T16395] usb 6-1: config 220 interface 1 has no altsetting 0 [ 1050.307448][T16395] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1050.323117][T16395] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.331812][T16395] usb 6-1: Product: syz [ 1050.336027][T16395] usb 6-1: Manufacturer: syz [ 1050.342922][T16395] usb 6-1: SerialNumber: syz [ 1050.519566][T16400] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 1050.563314][T16395] usb 6-1: Found UVC 7.01 device syz (8086:0b07) [ 1050.570236][T16395] usb 6-1: No valid video chain found. [ 1050.575865][T16395] usb 6-1: selecting invalid altsetting 0 [ 1050.607258][T16395] usb 6-1: selecting invalid altsetting 0 [ 1050.615852][T16395] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 1050.633233][T16395] usb 6-1: USB disconnect, device number 103 [ 1050.680644][T16400] usb 2-1: Using ep0 maxpacket: 16 [ 1050.687981][T16400] usb 2-1: config index 0 descriptor too short (expected 16456, got 72) [ 1050.698161][T16400] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 1050.706519][T16400] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 1050.718567][T16400] usb 2-1: config 0 has an invalid interface number: 125 but max is 1 [ 1050.728253][T16400] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1050.738446][T16400] usb 2-1: config 0 has no interface number 0 [ 1050.745353][T16400] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x4 has invalid maxpacket 21760, setting to 64 [ 1050.757371][T16400] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0xB has invalid wMaxPacketSize 0 [ 1050.767440][T16400] usb 2-1: config 0 interface 125 altsetting 4 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1050.777885][T16400] usb 2-1: config 0 interface 125 altsetting 1 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1050.791431][T16400] usb 2-1: config 0 interface 125 has no altsetting 0 [ 1050.798312][T16400] usb 2-1: config 0 interface 125 has no altsetting 2 [ 1050.807023][T16400] usb 2-1: New USB device found, idVendor=050d, idProduct=0002, bcdDevice=23.27 [ 1050.817790][T16400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1050.827842][T16400] usb 2-1: Product: syz [ 1050.834646][T16400] usb 2-1: Manufacturer: syz [ 1050.840454][T16400] usb 2-1: SerialNumber: syz [ 1050.847462][T16400] usb 2-1: config 0 descriptor?? [ 1050.857209][T16400] usb 2-1: selecting invalid altsetting 2 [ 1051.112418][T20673] cgroup: release_agent respecified [ 1051.180509][T20675] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3765'. [ 1051.485209][T20686] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 1051.539747][T16395] usb 6-1: new high-speed USB device number 104 using dummy_hcd [ 1051.710129][T16395] usb 6-1: Using ep0 maxpacket: 8 [ 1051.736769][T16395] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1051.753706][T16395] usb 6-1: New USB device found, idVendor=046d, idProduct=0892, bcdDevice=6d.2a [ 1051.767911][T16395] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1051.782818][T16395] usb 6-1: config 0 descriptor?? [ 1051.810374][T16395] gspca_main: vc032x-2.14.0 probing 046d:0892 [ 1051.874926][T16400] usb 2-1: USB disconnect, device number 11 [ 1051.913331][T20699] xt_time: invalid argument - start or stop time greater than 23:59:59 [ 1052.679662][T16400] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 1052.837215][T16400] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 1052.845989][T16400] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1052.862064][T16400] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1052.875703][T20684] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1052.877398][T16400] usb 2-1: config 220 has no interface number 2 [ 1052.890483][T20684] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1052.896824][T16400] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1052.913432][T16400] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1052.920421][T16400] usb 2-1: config 220 interface 76 has no altsetting 0 [ 1052.927570][T16400] usb 2-1: config 220 interface 1 has no altsetting 0 [ 1052.939283][T16400] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1052.955011][T16400] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1052.964282][T16400] usb 2-1: Product: syz [ 1052.970240][T16400] usb 2-1: Manufacturer: syz [ 1052.975357][T16400] usb 2-1: SerialNumber: syz [ 1053.053524][T16395] gspca_vc032x: reg_w err -71 [ 1053.058545][T16395] vc032x 6-1:0.0: probe with driver vc032x failed with error -71 [ 1053.081468][T16395] usb 6-1: USB disconnect, device number 104 [ 1053.208527][T16400] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 1053.217732][T16400] usb 2-1: No valid video chain found. [ 1053.223963][T16400] usb 2-1: selecting invalid altsetting 0 [ 1053.258290][T16400] usb 2-1: selecting invalid altsetting 0 [ 1053.265305][T16400] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 1053.279595][T16400] usb 2-1: USB disconnect, device number 12 [ 1053.880225][T16400] kernel write not supported for file /sg0 (pid: 16400 comm: kworker/1:9) [ 1054.372784][T20749] loop6: detected capacity change from 0 to 524287999 [ 1054.824039][T16401] usb 6-1: new high-speed USB device number 105 using dummy_hcd [ 1054.838978][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1054.849907][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1055.009568][T16401] usb 6-1: Using ep0 maxpacket: 32 [ 1055.018950][T16401] usb 6-1: config 0 interface 0 altsetting 128 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1055.034300][T16401] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1055.044186][T16401] usb 6-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 1055.055083][T16401] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1055.069675][T16393] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 1055.088053][T16401] usb 6-1: config 0 descriptor?? [ 1055.249711][T16393] usb 2-1: Using ep0 maxpacket: 16 [ 1055.257069][T16393] usb 2-1: config 252 has an invalid interface number: 165 but max is 0 [ 1055.266009][T16393] usb 2-1: config 252 has no interface number 0 [ 1055.274156][T16393] usb 2-1: too many endpoints for config 252 interface 165 altsetting 109: 63, using maximum allowed: 30 [ 1055.285774][T16393] usb 2-1: config 252 interface 165 altsetting 109 has 0 endpoint descriptors, different from the interface descriptor's value: 63 [ 1055.306615][T16393] usb 2-1: config 252 interface 165 has no altsetting 0 [ 1055.318010][T16393] usb 2-1: New USB device found, idVendor=0b32, idProduct=300d, bcdDevice=d4.cd [ 1055.328093][T16393] usb 2-1: New USB device strings: Mfr=0, Product=16, SerialNumber=0 [ 1055.337853][T16393] usb 2-1: Product: syz [ 1055.515265][T16401] hid (null): report_id 0 is invalid [ 1055.530815][T16401] corsair-cpro 0003:1B1C:0C10.004C: unknown main item tag 0x0 [ 1055.538941][T16401] corsair-cpro 0003:1B1C:0C10.004C: unknown main item tag 0x0 [ 1055.552172][T16401] corsair-cpro 0003:1B1C:0C10.004C: report_id 0 is invalid [ 1055.560403][T16401] corsair-cpro 0003:1B1C:0C10.004C: item 0 0 1 8 parsing failed [ 1055.569152][T16401] corsair-cpro 0003:1B1C:0C10.004C: probe with driver corsair-cpro failed with error -22 [ 1055.579731][T16393] usb 2-1: USB disconnect, device number 13 [ 1055.726053][T20756] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1055.736200][T20756] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1057.038141][T20773] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3789'. [ 1057.048242][T20773] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3789'. [ 1057.546508][T16401] usb 6-1: USB disconnect, device number 105 [ 1058.009580][T16401] usb 6-1: new high-speed USB device number 106 using dummy_hcd [ 1058.036235][T20805] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1058.179559][T20809] netlink: 280 bytes leftover after parsing attributes in process `syz.4.3799'. [ 1058.190810][T16401] usb 6-1: Using ep0 maxpacket: 16 [ 1058.207986][T16401] usb 6-1: New USB device found, idVendor=0644, idProduct=8021, bcdDevice=38.b7 [ 1058.217782][T16401] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1058.226718][T16401] usb 6-1: Product: syz [ 1058.232053][T16401] usb 6-1: Manufacturer: syz [ 1058.236823][T16401] usb 6-1: SerialNumber: syz [ 1058.245297][T16401] usb 6-1: config 0 descriptor?? [ 1058.255253][T16401] hub 6-1:0.0: bad descriptor, ignoring hub [ 1058.261899][T16401] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1058.534808][T20792] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1058.554145][T20792] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1059.059761][T16401] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 1059.080683][ T24] usb 6-1: reset high-speed USB device number 106 using dummy_hcd [ 1059.092672][ T24] usb 6-1: device reset changed ep0 maxpacket size! [ 1059.106905][ T24] usb 6-1: USB disconnect, device number 106 [ 1059.233881][T16401] usb 2-1: config 220 has an invalid interface number: 76 but max is 2 [ 1059.242857][T16401] usb 2-1: config 220 contains an unexpected descriptor of type 0x2, skipping [ 1059.252081][T16401] usb 2-1: config 220 has an invalid descriptor of length 0, skipping remainder of the config [ 1059.263263][T16401] usb 2-1: config 220 has no interface number 2 [ 1059.270149][T16401] usb 2-1: config 220 interface 1 altsetting 5 has 0 endpoint descriptors, different from the interface descriptor's value: 12 [ 1059.285178][T16401] usb 2-1: config 220 interface 0 has no altsetting 0 [ 1059.292864][T16401] usb 2-1: config 220 interface 76 has no altsetting 0 [ 1059.301658][T16401] usb 2-1: config 220 interface 1 has no altsetting 0 [ 1059.313373][T16401] usb 2-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1059.323845][T16401] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1059.332582][T16401] usb 2-1: Product: syz [ 1059.337166][T16401] usb 2-1: Manufacturer: syz [ 1059.342357][T16401] usb 2-1: SerialNumber: syz [ 1059.423295][ T24] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1059.561973][T16401] usb 2-1: Found UVC 7.01 device syz (8086:0b07) [ 1059.568681][T16401] usb 2-1: No valid video chain found. [ 1059.574466][T16401] usb 2-1: selecting invalid altsetting 0 [ 1059.580652][ T24] usb 6-1: Using ep0 maxpacket: 8 [ 1059.593795][ T24] usb 6-1: config 127 has an invalid interface number: 171 but max is 1 [ 1059.604613][ T24] usb 6-1: config 127 has an invalid descriptor of length 0, skipping remainder of the config [ 1059.616537][T16401] usb 2-1: selecting invalid altsetting 0 [ 1059.624843][ T24] usb 6-1: config 127 has 1 interface, different from the descriptor's value: 2 [ 1059.635153][T16401] usbtest 2-1:220.1: probe with driver usbtest failed with error -22 [ 1059.644525][ T24] usb 6-1: config 127 has no interface number 0 [ 1059.654872][ T24] usb 6-1: config 127 interface 171 has no altsetting 0 [ 1059.662791][T16401] usb 2-1: USB disconnect, device number 14 [ 1059.677555][ T24] usb 6-1: New USB device found, idVendor=04e2, idProduct=1414, bcdDevice=c5.b9 [ 1059.687163][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1059.698587][ T24] usb 6-1: Product: syz [ 1059.703891][ T24] usb 6-1: Manufacturer: syz [ 1059.708759][ T24] usb 6-1: SerialNumber: syz [ 1059.934202][ T24] usb 6-1: USB disconnect, device number 107 [ 1060.359525][T16395] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 1060.509600][T16395] usb 2-1: Using ep0 maxpacket: 8 [ 1060.519063][T16395] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 1060.527764][T16395] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1060.539617][T16395] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1060.556959][T16395] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1060.572318][T16395] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1060.583038][T20840] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1060.586143][T16395] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1060.602532][T16395] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1060.828172][T20838] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1060.838467][T20838] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1060.855511][T16395] usb 2-1: usb_control_msg returned -71 [ 1060.861792][T16395] usbtmc 2-1:16.0: can't read capabilities [ 1060.876615][T16395] usb 2-1: USB disconnect, device number 15 [ 1060.929967][T16401] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1061.106315][T16401] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1061.137868][T16401] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1061.147772][T16401] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1061.156772][T16401] usb 6-1: Product: syz [ 1061.162922][T16401] usb 6-1: Manufacturer: syz [ 1061.167884][T16401] usb 6-1: SerialNumber: syz [ 1061.323685][T20852] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3811'. [ 1061.336200][T20853] netlink: 104 bytes leftover after parsing attributes in process `syz.2.3811'. [ 1061.351375][T20852] netlink: 'syz.2.3811': attribute type 10 has an invalid length. [ 1061.362330][T20852] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3811'. [ 1061.391862][T20852] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 1061.399738][T20852] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 1061.423851][T20852] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1061.918728][T20871] netlink: 12 bytes leftover after parsing attributes in process `syz.1.3814'. [ 1062.010475][T16401] cdc_ncm 6-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 1062.017227][T16401] cdc_ncm 6-1:1.0: dwNtbInMaxSize=15 is too small. Using 2048 [ 1062.031455][T16401] cdc_ncm 6-1:1.0: setting rx_max = 2048 [ 1062.179797][T16395] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 1062.226507][T16401] cdc_ncm 6-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.5-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 1062.252193][T16401] usb 6-1: USB disconnect, device number 108 [ 1062.262742][T16401] cdc_ncm 6-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.5-1, CDC NCM (NO ZLP) [ 1062.333269][T16395] usb 2-1: device descriptor read/64, error -71 [ 1062.597888][T16395] usb 2-1: new high-speed USB device number 17 using dummy_hcd [ 1062.729700][T16395] usb 2-1: device descriptor read/64, error -71 [ 1062.770621][T20876] ieee802154 phy1 wpan1: encryption failed: -22 [ 1062.849752][T16395] usb usb2-port1: attempt power cycle [ 1063.189557][T16395] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1063.210287][T16395] usb 2-1: device descriptor read/8, error -71 [ 1063.329702][T16401] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1063.449571][T16395] usb 2-1: new high-speed USB device number 19 using dummy_hcd [ 1063.471109][T16395] usb 2-1: device descriptor read/8, error -71 [ 1063.496072][T16401] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1063.505494][T16401] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1063.515241][T16401] usb 6-1: Product: syz [ 1063.519696][T16401] usb 6-1: Manufacturer: syz [ 1063.524495][T16401] usb 6-1: SerialNumber: syz [ 1063.583542][T16395] usb usb2-port1: unable to enumerate USB device [ 1063.738854][T20887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1063.749278][T20887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1064.168349][T20887] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1064.177673][T20887] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1064.652134][ T30] audit: type=1326 audit(6049220278.988:204): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=20890 comm="syz.2.3820" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fba4178eba9 code=0x0 [ 1064.675228][ C0] vkms_vblank_simulate: vblank timer overrun [ 1064.997837][T20894] fuse: Bad value for 'rootmode' [ 1065.016519][T20894] U9: renamed from lo (while UP) [ 1065.053928][T20894] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 1065.063531][T20894] comedi comedi3: 8255: I/O port conflict (0x2,4) [ 1065.070810][T16401] rtl8150 6-1:1.0: couldn't reset the device [ 1065.072140][T20894] comedi comedi3: 8255: I/O port conflict (0x40000001,4) [ 1065.078331][T16401] rtl8150 6-1:1.0: probe with driver rtl8150 failed with error -5 [ 1065.101403][T20894] comedi comedi3: 8255: I/O port conflict (0x5c952399,4) [ 1065.133418][T20894] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 1065.144603][T20894] comedi comedi3: 8255: I/O port conflict (0x3ff,4) [ 1065.170805][T20894] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 1065.192759][T20894] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1065.212876][T20894] comedi comedi3: 8255: I/O port conflict (0x9,4) [ 1065.246273][T20894] comedi comedi3: 8255: I/O port conflict (0x4e1cb,4) [ 1065.263125][T20894] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 1065.698985][T20921] input: syz1 as /devices/virtual/input/input114 [ 1065.770249][T16400] usb 2-1: new high-speed USB device number 20 using dummy_hcd [ 1065.949239][T16400] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1065.962104][T16400] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1065.976539][T16400] usb 2-1: New USB device found, idVendor=046d, idProduct=c534, bcdDevice= 0.00 [ 1065.987828][T16400] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1066.005217][T16400] usb 2-1: config 0 descriptor?? [ 1066.070304][ T5907] usb 6-1: USB disconnect, device number 109 [ 1066.646596][T16400] usbhid 2-1:0.0: can't add hid device: -71 [ 1066.657074][T16400] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1066.672912][T16400] usb 2-1: USB disconnect, device number 20 [ 1066.727048][T20931] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3830'. [ 1066.999686][T16399] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1067.129602][T16399] usb 6-1: device descriptor read/64, error -71 [ 1067.216161][T20933] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1067.379670][T16399] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1067.509512][T16399] usb 6-1: device descriptor read/64, error -71 [ 1067.620652][T16399] usb usb6-port1: attempt power cycle [ 1067.959642][T16399] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1067.980428][T16399] usb 6-1: device descriptor read/8, error -71 [ 1068.219611][T16399] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1068.250238][T16399] usb 6-1: device descriptor read/8, error -71 [ 1068.360201][T16399] usb usb6-port1: unable to enumerate USB device [ 1068.746030][T20948] 9pnet_fd: Insufficient options for proto=fd [ 1069.500050][ T984] usb 2-1: new high-speed USB device number 21 using dummy_hcd [ 1069.670066][ T984] usb 2-1: Using ep0 maxpacket: 16 [ 1069.678084][ T984] usb 2-1: config 0 has an invalid interface number: 97 but max is 1 [ 1069.686295][ T984] usb 2-1: config 0 has an invalid interface number: 201 but max is 1 [ 1069.694915][ T984] usb 2-1: config 0 has no interface number 0 [ 1069.701578][ T984] usb 2-1: config 0 has no interface number 1 [ 1069.707897][ T984] usb 2-1: config 0 interface 97 has no altsetting 0 [ 1069.714811][ T984] usb 2-1: config 0 interface 201 has no altsetting 0 [ 1069.729585][ T984] usb 2-1: New USB device found, idVendor=046d, idProduct=08c6, bcdDevice=cc.27 [ 1069.747699][ T984] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1069.765185][ T984] usb 2-1: Product: syz [ 1069.769669][ T984] usb 2-1: Manufacturer: syz [ 1069.774476][ T984] usb 2-1: SerialNumber: syz [ 1069.788766][ T984] usb 2-1: config 0 descriptor?? [ 1070.007272][ T984] uvcvideo 2-1:0.97: probe with driver uvcvideo failed with error -22 [ 1070.025248][ T984] usb 2-1: USB disconnect, device number 21 [ 1070.099757][T16400] usb 6-1: new high-speed USB device number 114 using dummy_hcd [ 1070.229511][T16400] usb 6-1: device descriptor read/64, error -71 [ 1070.489567][T16400] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1070.629634][T16400] usb 6-1: device descriptor read/64, error -71 [ 1070.743474][T16400] usb usb6-port1: attempt power cycle [ 1070.809795][T16401] usb 2-1: new high-speed USB device number 22 using dummy_hcd [ 1070.966038][T16401] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 1070.974474][T16401] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 255, changing to 11 [ 1070.986307][T16401] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 59391, setting to 1024 [ 1071.001939][T16401] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1071.015893][T16401] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1071.025841][T16401] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1071.037747][T16401] usb 2-1: config 0 descriptor?? [ 1071.044773][T20988] raw-gadget.2 gadget.1: fail, usb_ep_enable returned -22 [ 1071.099844][T16400] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1071.120786][T16400] usb 6-1: device descriptor read/8, error -71 [ 1071.379613][T16400] usb 6-1: new high-speed USB device number 117 using dummy_hcd [ 1071.401400][T16400] usb 6-1: device descriptor read/8, error -71 [ 1071.511308][T16400] usb usb6-port1: unable to enumerate USB device [ 1071.885192][T16401] usbhid 2-1:0.0: can't add hid device: -71 [ 1071.891574][T16401] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 1071.904463][T16401] usb 2-1: USB disconnect, device number 22 [ 1072.016607][T20994] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3847'. [ 1072.026665][T20994] netlink: 176 bytes leftover after parsing attributes in process `syz.2.3847'. [ 1072.677433][ T30] audit: type=1400 audit(6049220287.008:205): apparmor="DENIED" operation="setprocattr" info="invalid" error=-22 profile="unconfined" pid=21006 comm="syz.4.3852" [ 1073.166943][T21029] netlink: 24 bytes leftover after parsing attributes in process `syz.5.3856'. [ 1073.461787][T16401] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 1073.584411][T21037] netlink: 'syz.1.3859': attribute type 4 has an invalid length. [ 1073.604023][T21037] netlink: 'syz.1.3859': attribute type 4 has an invalid length. [ 1073.619694][T16401] usb 6-1: Using ep0 maxpacket: 32 [ 1073.634009][T16401] usb 6-1: config index 0 descriptor too short (expected 156, got 27) [ 1073.648457][T16401] usb 6-1: too many endpoints for config 0 interface 0 altsetting 191: 144, using maximum allowed: 30 [ 1073.675286][T16401] usb 6-1: config 0 interface 0 altsetting 191 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1073.688061][T16401] usb 6-1: config 0 interface 0 altsetting 191 has 1 endpoint descriptor, different from the interface descriptor's value: 144 [ 1073.705507][T16401] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1073.717213][T16401] usb 6-1: New USB device found, idVendor=0f11, idProduct=1021, bcdDevice=86.66 [ 1073.733945][T16401] usb 6-1: New USB device strings: Mfr=85, Product=120, SerialNumber=172 [ 1073.743779][T16401] usb 6-1: Product: syz [ 1073.748188][T16401] usb 6-1: Manufacturer: syz [ 1073.755886][T16401] usb 6-1: SerialNumber: syz [ 1073.767027][T16401] usb 6-1: config 0 descriptor?? [ 1073.775630][T16401] ldusb 6-1:0.0: Interrupt out endpoint not found (using control endpoint instead) [ 1073.788276][T16401] ldusb 6-1:0.0: LD USB Device #0 now attached to major 180 minor 0 [ 1073.951181][T16395] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1074.109577][T16395] usb 2-1: Using ep0 maxpacket: 32 [ 1074.117093][T16395] usb 2-1: config 0 has an invalid interface number: 51 but max is 0 [ 1074.125380][T16395] usb 2-1: config 0 has no interface number 0 [ 1074.134507][T16395] usb 2-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 1074.143825][T16395] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1074.152437][T16395] usb 2-1: Product: syz [ 1074.156830][T16395] usb 2-1: Manufacturer: syz [ 1074.161648][T16395] usb 2-1: SerialNumber: syz [ 1074.172411][T16395] usb 2-1: config 0 descriptor?? [ 1074.182594][T16395] quatech2 2-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 1074.384435][T16395] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB0 [ 1074.399240][T16395] usb 2-1: Quatech 2nd gen USB to Serial Driver converter now attached to ttyUSB1 [ 1074.786344][T21039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1074.796394][T21039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1074.825163][ C0] usb 2-1: qt2_read_bulk_callback - non-zero urb status: -71 [ 1074.825674][T16401] usb 2-1: USB disconnect, device number 23 [ 1074.867818][T16401] quatech-serial ttyUSB0: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB0 [ 1074.917281][T16401] quatech-serial ttyUSB1: Quatech 2nd gen USB to Serial Driver converter now disconnected from ttyUSB1 [ 1074.938315][T21047] Failed to get privilege flags for destination (handle=0x2:0x3) [ 1074.956975][T16401] quatech2 2-1:0.51: device disconnected [ 1075.073416][T21051] netlink: 4 bytes leftover after parsing attributes in process `syz.2.3862'. [ 1075.534221][T21065] netlink: 88 bytes leftover after parsing attributes in process `syz.2.3864'. [ 1075.543828][T21065] netlink: 8 bytes leftover after parsing attributes in process `syz.2.3864'. [ 1075.628307][T21067] syzkaller1: entered promiscuous mode [ 1075.635399][T21067] syzkaller1: entered allmulticast mode [ 1075.643840][T21067] PF_CAN: dropped non conform CAN FD skbuff: dev type 65534, len 40 [ 1076.174126][T16399] usb 6-1: USB disconnect, device number 118 [ 1076.186916][T16399] ldusb 6-1:0.0: LD USB Device #0 now disconnected [ 1076.209518][T16401] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1076.284427][T21081] 9pnet: Limiting 'msize' to 1048576 as this is the maximum supported by transport fd [ 1076.348330][T21085] binder: 21084:21085 ioctl 0 200000000140 returned -22 [ 1076.382317][T16401] usb 2-1: config 1 has an invalid interface number: 7 but max is 0 [ 1076.399447][T16401] usb 2-1: config 1 has no interface number 0 [ 1076.405839][T16401] usb 2-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1076.425073][T16401] usb 2-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1076.437454][T16401] usb 2-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1076.455686][T16401] usb 2-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1076.466357][T16401] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1076.479013][T16401] usb 2-1: Product: syz [ 1076.485724][T16401] usb 2-1: Manufacturer: syz [ 1076.494132][T16401] usb 2-1: SerialNumber: syz [ 1076.511437][T21078] raw-gadget.3 gadget.1: fail, usb_ep_enable returned -22 [ 1076.834626][T16401] usb 2-1: Error in usbnet_get_endpoints (-71) [ 1076.866364][T16401] usb 2-1: USB disconnect, device number 24 [ 1078.159620][T16401] usb 6-1: new full-speed USB device number 119 using dummy_hcd [ 1078.321896][T16401] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1078.334553][T16401] usb 6-1: New USB device found, idVendor=18d1, idProduct=1eaf, bcdDevice=b1.f8 [ 1078.344606][T16401] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1078.354143][T16401] usb 6-1: Product: syz [ 1078.358753][T16401] usb 6-1: Manufacturer: syz [ 1078.365441][T16401] usb 6-1: SerialNumber: syz [ 1078.373413][T16401] usb 6-1: config 0 descriptor?? [ 1078.540182][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.546400][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.553319][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.559466][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.565169][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.572489][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.578207][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.584896][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.591124][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.592574][T16401] usb 6-1: Cannot retrieve CPort count: -71 [ 1078.596989][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.608654][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.610761][T16401] usb 6-1: Cannot retrieve CPort count: -71 [ 1078.626993][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.627752][T16401] es2_ap_driver 6-1:0.0: probe with driver es2_ap_driver failed with error -71 [ 1078.633420][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.650440][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.654067][T16401] usb 6-1: USB disconnect, device number 119 [ 1078.656436][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.668687][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.675956][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.681923][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.688396][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.694445][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.700783][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.706713][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.713014][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.719045][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.725276][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.736596][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.742900][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.748589][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.756329][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.762966][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.768808][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.776247][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.782339][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.788451][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.795213][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.801377][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.807294][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.813229][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.819347][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.825461][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.831252][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.837159][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.843120][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.848835][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.863366][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.869106][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.883031][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.891023][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.897813][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.907732][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.913745][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.924037][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.944488][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.957246][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.975717][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.985558][T21120] libceph: resolve '4' (ret=-3): failed [ 1078.995771][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.002412][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.008408][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.018151][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.034612][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.043742][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.062812][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.068909][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.073436][T16401] IPVS: starting estimator thread 0... [ 1079.091807][T21120] libceph: resolve '4' (ret=-3): failed [ 1079.190160][T21129] IPVS: using max 24 ests per chain, 57600 per kthread [ 1079.670003][T16401] usb 6-1: new high-speed USB device number 120 using dummy_hcd [ 1079.834775][T16401] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1079.846751][T16401] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1079.866803][T16401] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1079.876165][T16401] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1079.884515][T16401] usb 6-1: Product: syz [ 1079.889102][T16401] usb 6-1: Manufacturer: syz [ 1079.893965][T16401] usb 6-1: SerialNumber: syz [ 1079.907884][T16401] cdc_mbim 6-1:1.0: skipping garbage [ 1080.110747][T21147] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1080.311676][T21167] block nbd4: not configured, cannot reconfigure [ 1080.318742][T21167] CIFS: No dialect specified on mount. Default has changed to a more secure dialect, SMB2.1 or later (e.g. SMB3.1.1), from CIFS (SMB1). To use the less secure SMB1 dialect to access old servers which do not support SMB3.1.1 (or even SMB3 or SMB2.1) specify vers=1.0 on mount. [ 1080.345437][ C0] vkms_vblank_simulate: vblank timer overrun [ 1080.361669][T21167] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1080.365896][T21169] 9pnet_fd: Insufficient options for proto=fd [ 1080.472523][T21173] Invalid source name [ 1080.477879][T21173] UBIFS error (pid: 21173): cannot open "ubifs", error -22 [ 1080.762972][T21147] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1080.783480][T16401] cdc_mbim 6-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 1080.791398][T16401] cdc_mbim 6-1:1.0: setting rx_max = 2048 [ 1080.995560][T16401] cdc_mbim 6-1:1.0: setting tx_max = 184 [ 1081.007843][T16401] cdc_mbim 6-1:1.0: cdc-wdm0: USB WDM device [ 1081.018743][T16401] wwan wwan0: port wwan0mbim0 attached [ 1081.033650][T16401] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.5-1, CDC MBIM, ae:d6:48:b1:03:a8 [ 1081.055735][T16401] usb 6-1: USB disconnect, device number 120 [ 1081.068859][T16401] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.5-1, CDC MBIM [ 1081.131874][T16401] wwan wwan0: port wwan0mbim0 disconnected [ 1081.884031][T21202] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3904'. [ 1082.682005][T21222] netlink: 128 bytes leftover after parsing attributes in process `syz.2.3909'. [ 1082.790378][T21226] netlink: 'syz.2.3911': attribute type 10 has an invalid length. [ 1082.812287][T21226] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1082.827408][T21226] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 1082.839169][T21226] netlink: 'syz.2.3911': attribute type 10 has an invalid length. [ 1082.847836][T21226] netlink: 40 bytes leftover after parsing attributes in process `syz.2.3911'. [ 1082.857904][T21226] batadv0: entered promiscuous mode [ 1082.863380][T21226] batadv0: entered allmulticast mode [ 1082.876275][T21226] bond0: (slave batadv0): Releasing backup interface [ 1082.886809][T21226] bridge0: port 3(batadv0) entered blocking state [ 1082.898441][T21226] bridge0: port 3(batadv0) entered disabled state [ 1082.939987][ T13] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 1082.950326][ T13] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 1082.997538][T21228] overlayfs: failed to create directory ./bus/work (errno: 22); mounting read-only [ 1084.473221][T21251] overlayfs: failed to clone upperpath [ 1085.404712][ T30] audit: type=1326 audit(6049220300.746:206): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21253 comm="syz.1.3921" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9c47f8eba9 code=0x7ffe0000 [ 1085.671018][T21261] syzkaller1: entered promiscuous mode [ 1085.679348][T21261] syzkaller1: entered allmulticast mode [ 1085.698472][T21261] syzkaller1: left promiscuous mode [ 1085.708219][T21261] syzkaller1: left allmulticast mode [ 1085.874178][T21264] binder: BINDER_SET_CONTEXT_MGR already set [ 1085.880874][T21264] binder: 21263:21264 ioctl 4018620d 200000000100 returned -16 [ 1085.891860][T21264] binder: BINDER_SET_CONTEXT_MGR already set [ 1085.898354][T21264] binder: 21263:21264 ioctl 4018620d 200000004a80 returned -16 [ 1086.085927][T21268] netlink: 'syz.5.3926': attribute type 4 has an invalid length. [ 1086.447920][T21284] kvm: vcpu 2: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 1086.760242][T21295] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1086.938288][T21301] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1087.189583][T16395] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 1087.359998][T16395] usb 6-1: Using ep0 maxpacket: 16 [ 1087.372235][T16395] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 80, setting to 64 [ 1087.406820][T16395] usb 6-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ec.7e [ 1087.426816][T16395] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1087.439947][T16395] usb 6-1: Product: syz [ 1087.445776][T16395] usb 6-1: Manufacturer: syz [ 1087.461253][T16395] usb 6-1: SerialNumber: syz [ 1087.464223][T21303] overlayfs: failed to clone upperpath [ 1087.467442][T21304] overlayfs: failed to clone upperpath [ 1087.496610][T16395] usb 6-1: config 0 descriptor?? [ 1087.507661][T16395] hub 6-1:0.0: bad descriptor, ignoring hub [ 1087.515667][T16395] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1087.528888][T16395] input: syz syz as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input116 [ 1088.137923][T21314] overlayfs: missing 'lowerdir' [ 1088.211339][T21316] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1088.234260][T21316] overlay: Unknown parameter 'appraise' [ 1088.671844][ T5217] usb 6-1: reset high-speed USB device number 121 using dummy_hcd [ 1088.831900][ T5217] usb 6-1: device firmware changed [ 1088.841209][T16395] usb 6-1: USB disconnect, device number 121 [ 1088.989735][T16395] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 1089.139549][T16395] usb 6-1: Using ep0 maxpacket: 16 [ 1089.150506][T16395] usb 6-1: config 0 has an invalid interface number: 68 but max is 0 [ 1089.159086][T16395] usb 6-1: config 0 has no interface number 0 [ 1089.165553][T16395] usb 6-1: config 0 interface 68 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1089.181309][T16395] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=dc.c4 [ 1089.191688][T16395] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1089.200934][T16395] usb 6-1: Product: syz [ 1089.205452][T16395] usb 6-1: Manufacturer: syz [ 1089.210471][T16395] usb 6-1: SerialNumber: syz [ 1089.219980][T16395] usb 6-1: config 0 descriptor?? [ 1089.241574][T16395] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1089.437894][T21322] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1089.449329][T21322] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1089.463552][ T13] usb 6-1: Failed to submit usb control message: -71 [ 1089.467466][ T984] usb 6-1: USB disconnect, device number 122 [ 1089.485760][ T13] usb 6-1: unable to send the bmi data to the device: -71 [ 1089.496997][ T13] usb 6-1: unable to get target info from device [ 1089.504313][ T13] usb 6-1: could not get target info (-71) [ 1089.512232][ T13] usb 6-1: could not probe fw (-71) [ 1090.288126][T21352] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1090.318352][T21352] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1090.358742][T21356] netlink: 72 bytes leftover after parsing attributes in process `syz.2.3953'. [ 1090.509735][T16395] usb 6-1: new high-speed USB device number 123 using dummy_hcd [ 1090.672429][T16395] usb 6-1: New USB device found, idVendor=1d50, idProduct=6089, bcdDevice=d0.1d [ 1090.681900][T16395] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=16 [ 1090.690637][T16395] usb 6-1: SerialNumber: syz [ 1090.699063][T16395] usb 6-1: config 0 descriptor?? [ 1090.907147][T16395] hackrf 6-1:0.0: usb_control_msg() failed -71 request 0e [ 1090.916753][T16395] hackrf 6-1:0.0: Could not detect board [ 1090.922631][T16395] hackrf 6-1:0.0: probe with driver hackrf failed with error -71 [ 1090.933756][T16395] usb 6-1: USB disconnect, device number 123 [ 1091.518520][T21362] netlink: 8 bytes leftover after parsing attributes in process `syz.4.3956'. [ 1091.595595][T21374] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1092.476836][T21386] netlink: 763 bytes leftover after parsing attributes in process `syz.5.3964'. [ 1094.239727][T14425] usb 6-1: new high-speed USB device number 124 using dummy_hcd [ 1094.390036][T14425] usb 6-1: Using ep0 maxpacket: 32 [ 1094.399246][T14425] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has an invalid bInterval 128, changing to 11 [ 1094.412081][T14425] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1094.422207][T14425] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB7, changing to 0x87 [ 1094.434116][T14425] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x87 has an invalid bInterval 0, changing to 7 [ 1094.447958][T14425] usb 6-1: New USB device found, idVendor=0e6f, idProduct=582c, bcdDevice=31.68 [ 1094.457679][T14425] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1094.466110][T14425] usb 6-1: Product: syz [ 1094.470424][T14425] usb 6-1: Manufacturer: syz [ 1094.475071][T14425] usb 6-1: SerialNumber: syz [ 1094.482476][T14425] usb 6-1: config 0 descriptor?? [ 1094.494495][T14425] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/input/input118 [ 1094.506539][ T5217] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1094.522590][ T5217] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1094.533581][ C0] xpad 6-1:0.0: xpad_irq_in - usb_submit_urb failed with result -1 [ 1094.604566][ T5217] xpad 6-1:0.0: xpad_try_sending_next_out_packet - usb_submit_urb failed with result -90 [ 1094.706731][T21431] 9pnet: p9_errstr2errno: server reported unknown error [ 1094.816619][T14425] usb 6-1: USB disconnect, device number 124 [ 1095.106843][T21441] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1096.023907][T21469] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1096.180057][ C1] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1096.269659][ T5907] usb 6-1: new high-speed USB device number 125 using dummy_hcd [ 1096.419614][ T5907] usb 6-1: Using ep0 maxpacket: 8 [ 1096.426690][ T5907] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1096.435304][ T5907] usb 6-1: config 179 has no interface number 0 [ 1096.441785][ T5907] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1096.453074][ T5907] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1096.464464][ T5907] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1096.476396][ T5907] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1096.494147][ T5907] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1096.509193][ T5907] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1096.585265][ T5907] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1096.621711][T21476] netlink: 14436 bytes leftover after parsing attributes in process `syz.2.3987'. [ 1096.632171][T21468] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1096.658026][T21476] openvswitch: netlink: Missing key (keys=40, expected=200000) [ 1096.668919][ T30] audit: type=1326 audit(6049220312.006:207): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21477 comm="syz.1.3988" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f9c47f8eba9 code=0x0 [ 1096.721810][T21479] fuse: Unknown parameter '0x0000000000000005' [ 1096.870144][ T5907] input: Generic X-Box pad as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:179.65/input/input119 [ 1097.049844][T14425] usb 6-1: USB disconnect, device number 125 [ 1097.049855][ C1] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1097.067628][ C1] dummy_hcd dummy_hcd.5: timer fired with no URBs pending? [ 1097.807613][T21487] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1097.928763][T21487] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1098.028364][T21487] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1098.158256][T21487] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1098.356480][ T36] netdevsim netdevsim5 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1098.427178][ T12] netdevsim netdevsim5 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1098.463738][ T13] netdevsim netdevsim5 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1098.494036][ T13] netdevsim netdevsim5 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1098.979661][T16401] usb 6-1: new high-speed USB device number 126 using dummy_hcd [ 1099.718889][T21512] kvm: pic: non byte read [ 1099.724326][T21512] kvm: pic: level sensitive irq not supported [ 1099.724420][T21512] kvm: pic: non byte read [ 1099.834381][T21517] ADFS-fs (nullb0): error: can't find an ADFS filesystem on dev nullb0. [ 1099.860316][T21518] overlay: filesystem on ./bus not supported as upperdir [ 1100.402636][ T30] audit: type=1326 audit(6049220315.746:208): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21505 comm="syz.5.4000" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fe79518eba9 code=0x7fc00000 [ 1100.532235][T21543] comedi comedi3: 8255: I/O port conflict (0x10003,4) [ 1100.539266][T21543] comedi comedi3: 8255: I/O port conflict (0x10000,4) [ 1100.548485][T21543] comedi comedi3: 8255: I/O port conflict (0x7f,4) [ 1100.556655][T21543] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 1100.563662][T21543] comedi comedi3: 8255: I/O port conflict (0x7,4) [ 1100.570402][T21543] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 1102.181587][T21577] 9p filesystem being mounted at /230/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 1102.342591][T21583] input: syz1 as /devices/virtual/input/input120 [ 1103.139275][T14425] IPVS: starting estimator thread 0... [ 1103.239652][T21609] IPVS: using max 46 ests per chain, 110400 per kthread [ 1103.440550][T21630] netlink: 'syz.1.4029': attribute type 27 has an invalid length. [ 1103.539124][T21636] netlink: 'syz.1.4029': attribute type 27 has an invalid length. [ 1103.620481][T21630] bridge0: port 2(bridge_slave_1) entered disabled state [ 1103.631087][T21630] bridge0: port 1(bridge_slave_0) entered disabled state [ 1103.729904][ T984] usb 6-1: new high-speed USB device number 127 using dummy_hcd [ 1103.851506][T21630] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1103.885582][T21630] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1103.906928][ T984] usb 6-1: config 0 interface 0 altsetting 185 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1103.928469][ T984] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1103.946912][ T984] usb 6-1: New USB device found, idVendor=05ac, idProduct=027a, bcdDevice= 0.00 [ 1103.960965][ T984] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1103.981827][ T984] usb 6-1: config 0 descriptor?? [ 1104.155999][ T1146] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1104.175464][ T1146] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1104.187005][ T1146] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1104.213125][ T1146] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1104.445006][ T984] usbhid 6-1:0.0: can't add hid device: -71 [ 1104.455045][ T984] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1104.476477][ T984] usb 6-1: USB disconnect, device number 127 [ 1104.605198][T21673] overlayfs: failed to create directory ./bus/work (errno: 13); mounting read-only [ 1104.615140][T21673] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1104.627200][T21673] overlayfs: failed to get uuid (/file1, err=-95); falling back to uuid=null. [ 1104.868736][T21679] netlink: 'syz.4.4037': attribute type 29 has an invalid length. [ 1105.049268][T21690] netlink: 20 bytes leftover after parsing attributes in process `syz.4.4039'. [ 1105.229873][T14425] usb 6-1: new full-speed USB device number 2 using dummy_hcd [ 1105.386506][T14425] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1105.398193][T14425] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1105.412199][T14425] usb 6-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 1105.421754][T14425] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1105.432575][T14425] usb 6-1: config 0 descriptor?? [ 1105.835589][T21710] overlayfs: missing 'lowerdir' [ 1105.927350][T14425] uclogic 0003:28BD:0042.004D: interface is invalid, ignoring [ 1106.122615][T14425] usb 6-1: USB disconnect, device number 2 [ 1106.222449][T21731] netlink: 180 bytes leftover after parsing attributes in process `syz.1.4046'. [ 1106.388374][T21740] CIFS mount error: No usable UNC path provided in device string! [ 1106.388374][T21740] [ 1106.399727][T21740] CIFS: VFS: CIFS mount error: No usable UNC path provided in device string! [ 1106.538856][T21753] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.4049'. [ 1106.557518][T21744] netlink: 16402 bytes leftover after parsing attributes in process `syz.4.4049'. [ 1107.019528][T21642] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1107.189907][T21642] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 1107.209520][T21642] usb 6-1: config 220 has an invalid descriptor of length 128, skipping remainder of the config [ 1107.231953][T21642] usb 6-1: config 220 has no interface number 2 [ 1107.243590][T21642] usb 6-1: config 220 interface 1 altsetting 5 has an invalid endpoint descriptor of length 6, skipping [ 1107.266109][T21642] usb 6-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 1107.280282][T21642] usb 6-1: config 220 interface 0 has no altsetting 0 [ 1107.287584][T21642] usb 6-1: config 220 interface 76 has no altsetting 0 [ 1107.295494][T21642] usb 6-1: config 220 interface 1 has no altsetting 0 [ 1107.307991][T21642] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1107.317914][T21642] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1107.326773][T21642] usb 6-1: Product: syz [ 1107.331736][T21642] usb 6-1: Manufacturer: syz [ 1107.336491][T21642] usb 6-1: SerialNumber: syz [ 1107.558818][T21642] usb 6-1: selecting invalid altsetting 0 [ 1107.583025][T21642] usb 6-1: Found UVC 7.01 device syz (8086:0b07) [ 1107.611720][T21642] usb 6-1: No valid video chain found. [ 1107.627072][T21642] usb 6-1: selecting invalid altsetting 0 [ 1107.633974][T21642] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 1107.650192][T21642] usb 6-1: USB disconnect, device number 3 [ 1108.235955][T21794] input: syz1 as /devices/virtual/input/input121 [ 1108.323484][T21770] syz.2.4055: vmalloc error: size 33558528, failed to allocated page array size 65544, mode:0xdc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1108.348841][T21770] CPU: 1 UID: 0 PID: 21770 Comm: syz.2.4055 Not tainted syzkaller #0 PREEMPT(full) [ 1108.348875][T21770] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1108.348890][T21770] Call Trace: [ 1108.348910][T21770] [ 1108.348920][T21770] dump_stack_lvl+0x189/0x250 [ 1108.348948][T21770] ? __pfx_rcu_read_unlock_special+0x10/0x10 [ 1108.348974][T21770] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1108.348995][T21770] ? __pfx__printk+0x10/0x10 [ 1108.349024][T21770] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1108.349053][T21770] ? cpuset_print_current_mems_allowed+0x1f/0x360 [ 1108.349105][T21770] warn_alloc+0x214/0x310 [ 1108.349139][T21770] ? __pfx_warn_alloc+0x10/0x10 [ 1108.349177][T21770] ? __get_vm_area_node+0x28f/0x300 [ 1108.349204][T21770] ? xskq_create+0xbf/0x170 [ 1108.349232][T21770] __vmalloc_node_range_noprof+0x67e/0x12f0 [ 1108.349292][T21770] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1108.349317][T21770] ? xskq_create+0x56/0x170 [ 1108.349347][T21770] ? __kasan_kmalloc+0x93/0xb0 [ 1108.349379][T21770] vmalloc_user_noprof+0xad/0xf0 [ 1108.349403][T21770] ? xskq_create+0xbf/0x170 [ 1108.349426][T21770] xskq_create+0xbf/0x170 [ 1108.349453][T21770] xsk_init_queue+0xb0/0x110 [ 1108.349490][T21770] xsk_setsockopt+0x57b/0x8d0 [ 1108.349516][T21770] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1108.349541][T21770] ? __pfx_aa_sk_perm+0x10/0x10 [ 1108.349577][T21770] ? aa_sock_opt_perm+0xff/0x1b0 [ 1108.349604][T21770] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 1108.349635][T21770] ? __pfx_xsk_setsockopt+0x10/0x10 [ 1108.349658][T21770] do_sock_setsockopt+0x17c/0x1b0 [ 1108.349694][T21770] __x64_sys_setsockopt+0x13f/0x1b0 [ 1108.349729][T21770] do_syscall_64+0xfa/0xfa0 [ 1108.349756][T21770] ? lockdep_hardirqs_on+0x9c/0x150 [ 1108.349781][T21770] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1108.349802][T21770] ? clear_bhb_loop+0x60/0xb0 [ 1108.349829][T21770] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1108.349850][T21770] RIP: 0033:0x7fba4178eba9 [ 1108.349870][T21770] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1108.349891][T21770] RSP: 002b:00007fba426ca038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036 [ 1108.349925][T21770] RAX: ffffffffffffffda RBX: 00007fba419d6090 RCX: 00007fba4178eba9 [ 1108.349941][T21770] RDX: 0000000000000003 RSI: 000000000000011b RDI: 0000000000000003 [ 1108.349955][T21770] RBP: 00007fba41811e19 R08: 0000000000000004 R09: 0000000000000000 [ 1108.349969][T21770] R10: 00002000000005c0 R11: 0000000000000246 R12: 0000000000000000 [ 1108.349983][T21770] R13: 00007fba419d6128 R14: 00007fba419d6090 R15: 00007ffdcbaceaf8 [ 1108.350021][T21770] [ 1108.623454][T21770] Mem-Info: [ 1108.623596][T21770] active_anon:8448 inactive_anon:0 isolated_anon:0 [ 1108.623596][T21770] active_file:7563 inactive_file:49689 isolated_file:0 [ 1108.623596][T21770] unevictable:768 dirty:70 writeback:0 [ 1108.623596][T21770] slab_reclaimable:10475 slab_unreclaimable:103191 [ 1108.623596][T21770] mapped:31520 shmem:1374 pagetables:1876 [ 1108.623596][T21770] sec_pagetables:0 bounce:0 [ 1108.623596][T21770] kernel_misc_reclaimable:0 [ 1108.623596][T21770] free:1270678 free_pcp:39837 free_cma:0 [ 1108.623663][T21770] Node 0 active_anon:33792kB inactive_anon:0kB active_file:30252kB inactive_file:198412kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:125964kB dirty:280kB writeback:0kB shmem:3960kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:13656kB pagetables:7332kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1108.623720][T21770] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:344kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:116kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:48kB pagetables:172kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1108.623771][T21770] Node 0 DMA free:15328kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:32kB local_pcp:32kB free_cma:0kB [ 1108.623836][T21770] lowmem_reserve[]: 0 2495 2496 2496 2496 [ 1108.623890][T21770] Node 0 DMA32 free:1181368kB boost:0kB min:34216kB low:42768kB high:51320kB reserved_highatomic:0KB free_highatomic:0KB active_anon:33740kB inactive_anon:0kB active_file:30252kB inactive_file:197332kB unevictable:1536kB writepending:280kB zspages:0kB present:3129332kB managed:2555276kB mlocked:0kB bounce:0kB free_pcp:131000kB local_pcp:66548kB free_cma:0kB [ 1108.623958][T21770] lowmem_reserve[]: 0 0 1 1 1 [ 1108.624008][T21770] Node 0 Normal free:0kB boost:0kB min:12kB low:12kB high:12kB reserved_highatomic:0KB free_highatomic:0KB active_anon:52kB inactive_anon:0kB active_file:0kB inactive_file:1080kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1132kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1108.624080][T21770] lowmem_reserve[]: 0 0 0 0 0 [ 1108.624128][T21770] Node 1 Normal free:3886016kB boost:0kB min:55668kB low:69584kB high:83500kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:344kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:28316kB local_pcp:21056kB free_cma:0kB [ 1108.624192][T21770] lowmem_reserve[]: 0 0 0 0 0 [ 1108.624241][T21770] Node 0 DMA: 0*4kB 0*8kB 0*16kB 1*32kB (U) 1*64kB (U) 1*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 1*2048kB (M) 3*4096kB (M) = 15328kB [ 1108.624467][T21770] Node 0 DMA32: 2740*4kB (UME) 1402*8kB (UME) 701*16kB (UME) 549*32kB (UME) 240*64kB (UME) 270*128kB (UME) 137*256kB (UME) 80*512kB (ME) 31*1024kB (UM) 9*2048kB (UM) 233*4096kB (UM) = 1181456kB [ 1108.624685][T21770] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1108.624811][T21770] Node 1 Normal: 240*4kB (UME) 58*8kB (UME) 55*16kB (UE) 162*32kB (UME) 56*64kB (UME) 13*128kB (UE) 6*256kB (UME) 4*512kB (UME) 1*1024kB (M) 1*2048kB (E) 944*4096kB (M) = 3886016kB [ 1108.625023][T21770] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1108.625043][T21770] Node 0 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 1108.625185][T21770] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1108.625216][T21770] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 1108.625236][T21770] 58622 total pagecache pages [ 1108.625247][T21770] 0 pages in swap cache [ 1108.625257][T21770] Free swap = 124996kB [ 1108.625268][T21770] Total swap = 124996kB [ 1108.625281][T21770] 2097051 pages RAM [ 1108.625292][T21770] 0 pages HighMem/MovableOnly [ 1108.625303][T21770] 426334 pages reserved [ 1108.625312][T21770] 0 pages cma reserved [ 1108.688400][ C0] vkms_vblank_simulate: vblank timer overrun [ 1108.702478][T21775] netlink: 763 bytes leftover after parsing attributes in process `syz.4.4057'. [ 1108.727576][ C0] vkms_vblank_simulate: vblank timer overrun [ 1108.758748][ C0] vkms_vblank_simulate: vblank timer overrun [ 1108.790422][ C0] vkms_vblank_simulate: vblank timer overrun [ 1108.830984][ C0] vkms_vblank_simulate: vblank timer overrun [ 1108.832003][T21802] netlink: 64 bytes leftover after parsing attributes in process `syz.5.4061'. [ 1109.099761][T21778] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4057'. [ 1110.383797][T21887] mac80211_hwsim hwsim29 : renamed from wlan1 (while UP) [ 1110.949284][T21916] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4076'. [ 1111.432379][T21643] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1111.589584][T21643] usb 6-1: Using ep0 maxpacket: 32 [ 1111.603278][T21643] usb 6-1: config 1 interface 0 altsetting 9 has 2 endpoint descriptors, different from the interface descriptor's value: 1 [ 1111.620248][T21643] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1111.633629][T21643] usb 6-1: New USB device found, idVendor=28bd, idProduct=0094, bcdDevice= 0.40 [ 1111.646613][T21643] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1111.655583][T21643] usb 6-1: Product: syz [ 1111.660825][T21643] usb 6-1: Manufacturer: syz [ 1111.665476][T21643] usb 6-1: SerialNumber: syz [ 1112.073088][T21950] genirq: Flags mismatch irq 4. 00200000 (pcl816) vs. 00200080 (ttyS0) [ 1112.107885][T21643] usbhid 6-1:1.0: can't add hid device: -71 [ 1112.121329][T21643] usbhid 6-1:1.0: probe with driver usbhid failed with error -71 [ 1112.150475][T21643] usb 6-1: USB disconnect, device number 4 [ 1112.339768][T21965] netlink: zone id is out of range [ 1112.345151][T21965] netlink: zone id is out of range [ 1112.352448][T21965] netlink: del zone limit has 8 unknown bytes [ 1112.763698][T21994] netlink: 156 bytes leftover after parsing attributes in process `syz.1.4094'. [ 1112.939792][T21647] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1113.193237][T21647] usb 6-1: config 220 has an invalid interface number: 76 but max is 2 [ 1113.204888][T21647] usb 6-1: config 220 has an invalid descriptor of length 128, skipping remainder of the config [ 1113.226952][T21647] usb 6-1: config 220 has no interface number 2 [ 1113.239167][T21647] usb 6-1: config 220 interface 1 altsetting 5 has an invalid endpoint descriptor of length 6, skipping [ 1113.250917][T21647] usb 6-1: config 220 interface 1 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 12 [ 1113.275094][T21647] usb 6-1: config 220 interface 0 has no altsetting 0 [ 1113.296111][T21647] usb 6-1: config 220 interface 76 has no altsetting 0 [ 1113.304731][T21647] usb 6-1: config 220 interface 1 has no altsetting 0 [ 1113.322470][T21647] usb 6-1: New USB device found, idVendor=8086, idProduct=0b07, bcdDevice=6c.b9 [ 1113.332881][T21647] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1113.342125][T21647] usb 6-1: Product: syz [ 1113.353902][T21647] usb 6-1: Manufacturer: syz [ 1113.359008][T21647] usb 6-1: SerialNumber: syz [ 1113.601266][T21647] usb 6-1: selecting invalid altsetting 0 [ 1113.627409][T21647] usb 6-1: Found UVC 7.01 device syz (8086:0b07) [ 1113.641696][T21647] usb 6-1: No valid video chain found. [ 1113.674584][T21647] usb 6-1: selecting invalid altsetting 0 [ 1113.683184][T21647] usbtest 6-1:220.1: probe with driver usbtest failed with error -22 [ 1113.708704][T21647] usb 6-1: USB disconnect, device number 5 [ 1114.469563][T21642] usb 6-1: new high-speed USB device number 6 using dummy_hcd [ 1114.639625][T21642] usb 6-1: Using ep0 maxpacket: 16 [ 1114.647972][T21642] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1114.665433][T21642] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 96 [ 1114.685081][T21642] usb 6-1: config 1 interface 0 altsetting 0 bulk endpoint 0x3 has invalid maxpacket 8 [ 1114.695467][T21642] usb 6-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 18 [ 1114.710788][T21642] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1114.721140][T21642] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1114.729251][T21642] usb 6-1: SerialNumber: syz [ 1114.739275][T22037] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1114.747684][T22037] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1114.756770][T21642] hub 6-1:1.0: bad descriptor, ignoring hub [ 1114.762954][T21642] hub 6-1:1.0: probe with driver hub failed with error -5 [ 1114.959655][T22037] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1114.972727][T22037] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1115.377913][T22072] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4115'. [ 1115.415199][T21642] cdc_ether 6-1:1.0 usb0: register 'cdc_ether' at usb-dummy_hcd.5-1, CDC Ethernet Device, 42:42:42:42:42:42 [ 1115.721000][T21642] usb 6-1: USB disconnect, device number 6 [ 1115.746310][T21642] cdc_ether 6-1:1.0 usb0: unregister 'cdc_ether' usb-dummy_hcd.5-1, CDC Ethernet Device [ 1115.837144][T22096] overlayfs: failed to clone upperpath [ 1116.264877][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1116.279335][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1116.357799][T22128] binder: 22126:22128 ioctl c0306201 200000000080 returned -14 [ 1117.300772][T22174] 9pnet: p9_errstr2errno: server reported unknown error @c [ 1117.473688][T22183] 9p filesystem being mounted at /78/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 1117.499551][T21642] usb 6-1: new high-speed USB device number 7 using dummy_hcd [ 1117.659640][T21642] usb 6-1: Using ep0 maxpacket: 8 [ 1117.674849][T21642] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 1117.686951][T21642] usb 6-1: can't read configurations, error -22 [ 1117.781130][T17686] Bluetooth: hci0: command tx timeout [ 1117.819757][T21642] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1117.979900][T21642] usb 6-1: Using ep0 maxpacket: 8 [ 1117.988588][T21642] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 1117.998621][T21642] usb 6-1: can't read configurations, error -22 [ 1118.006498][T21642] usb usb6-port1: attempt power cycle [ 1118.349621][T21642] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1118.370133][T21642] usb 6-1: Using ep0 maxpacket: 8 [ 1118.378145][T21642] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 1118.386781][T21642] usb 6-1: can't read configurations, error -22 [ 1118.519662][T21642] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1118.540204][T21642] usb 6-1: Using ep0 maxpacket: 8 [ 1118.547656][T21642] usb 6-1: config index 0 descriptor too short (expected 9, got 0) [ 1118.556213][T21642] usb 6-1: can't read configurations, error -22 [ 1118.563210][T21642] usb usb6-port1: unable to enumerate USB device [ 1118.832041][T22199] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4142'. [ 1120.167547][T22217] veth1_macvtap: left promiscuous mode [ 1120.178535][T22217] veth1_macvtap: entered promiscuous mode [ 1120.479558][T21637] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1120.631602][T21637] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1120.644394][T21637] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1120.656818][T21637] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1120.671310][T21637] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1120.684717][T21637] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1120.704490][T21637] usb 6-1: config 0 descriptor?? [ 1120.922386][T22219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1120.932318][T22219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1121.150324][T21637] usbhid 6-1:0.0: can't add hid device: -71 [ 1121.156813][T21637] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1121.171024][T21637] usb 6-1: USB disconnect, device number 11 [ 1121.576082][T22241] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4149'. [ 1121.929493][T21642] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1122.109554][T21642] usb 6-1: Using ep0 maxpacket: 8 [ 1122.128992][T21642] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1122.159564][T21642] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E [ 1122.180575][T21642] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 7 [ 1122.212772][T21642] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0 [ 1122.243896][T21642] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1122.293893][T21642] usb 6-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46 [ 1122.303357][T21642] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35 [ 1122.317492][T22268] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1122.327370][T21642] usb 6-1: Product: syz [ 1122.336467][T21642] usb 6-1: Manufacturer: syz [ 1122.341682][T21642] usb 6-1: SerialNumber: syz [ 1122.347231][T22268] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1122.370567][T21642] usb 6-1: config 0 descriptor?? [ 1122.578812][T21642] radio-si470x 6-1:0.0: DeviceID=0x0000 ChipID=0x0000 [ 1122.599079][T21642] radio-si470x 6-1:0.0: This driver is known to work with firmware version 12, but the device has firmware version 0. [ 1122.757921][T22286] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4156'. [ 1122.781407][T21642] radio-si470x 6-1:0.0: software version 0, hardware version 0 [ 1122.795817][T21642] radio-si470x 6-1:0.0: This driver is known to work with hardware version 1, but the device has hardware version 0. [ 1122.821206][T21642] radio-si470x 6-1:0.0: If you have some trouble using this driver, please report to V4L ML at linux-media@vger.kernel.org [ 1123.039609][T21642] radio-si470x 6-1:0.0: submitting int urb failed (-90) [ 1123.240337][T22291] veth0_to_hsr: mtu less than device minimum [ 1123.549752][T21642] radio-si470x 6-1:0.0: si470x_set_report: usb_control_msg returned -110 [ 1123.562252][T21642] radio-si470x 6-1:0.0: probe with driver radio-si470x failed with error -22 [ 1124.713559][ T984] usb 6-1: USB disconnect, device number 12 [ 1125.130019][ T984] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1125.308334][ T984] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1125.338014][ T984] usb 6-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 1125.358284][ T984] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1125.400537][ T984] usb 6-1: config 0 descriptor?? [ 1125.828098][ T984] keytouch 0003:0926:3333.004E: fixing up Keytouch IEC report descriptor [ 1125.857084][ T984] input: HID 0926:3333 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/0003:0926:3333.004E/input/input122 [ 1126.173606][ T984] keytouch 0003:0926:3333.004E: input,hidraw0: USB HID v0.00 Keyboard [HID 0926:3333] on usb-dummy_hcd.5-1/input0 [ 1126.347525][ T984] usb 6-1: USB disconnect, device number 13 [ 1126.739912][T22362] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4170'. [ 1127.461321][T21647] usb 6-1: new high-speed USB device number 14 using dummy_hcd [ 1127.629768][T21647] usb 6-1: Using ep0 maxpacket: 16 [ 1127.638264][T21647] usb 6-1: config 0 has an invalid interface number: 227 but max is 0 [ 1127.647725][T21647] usb 6-1: config 0 has no interface number 0 [ 1127.669315][T21647] usb 6-1: config 0 interface 227 has no altsetting 0 [ 1127.686161][T21647] usb 6-1: New USB device found, idVendor=05ac, idProduct=0264, bcdDevice=28.6b [ 1127.697092][T21647] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1127.714736][T21647] usb 6-1: Product: syz [ 1127.728071][T21647] usb 6-1: Manufacturer: syz [ 1127.734167][T21647] usb 6-1: SerialNumber: syz [ 1127.751724][T21647] usb 6-1: config 0 descriptor?? [ 1127.777761][T21647] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.227/input/input123 [ 1128.025462][T22390] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1128.090390][T22390] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1128.153647][T21647] usb 6-1: USB disconnect, device number 14 [ 1128.164058][ T5217] bcm5974 6-1:0.227: could not read from device [ 1128.262098][T11690] udevd[11690]: Unable to EVIOCGABS device "/dev/input/event4" [ 1128.344149][T11690] udevd[11690]: Unable to EVIOCGABS device "/dev/input/event4" [ 1128.359835][T11690] udevd[11690]: Unable to EVIOCGABS device "/dev/input/event4" [ 1128.367612][T11690] udevd[11690]: Unable to EVIOCGABS device "/dev/input/event4" [ 1128.746268][T22429] fuse: Unknown parameter '0xffffffffffffffff 8m6\4\́W$kǾ [ 1128.746268][T22429] Twq9GC\' [ 1129.817049][T22449] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1130.209606][T21637] usb 6-1: new high-speed USB device number 15 using dummy_hcd [ 1130.369462][T21637] usb 6-1: Using ep0 maxpacket: 16 [ 1130.388156][T21637] usb 6-1: config 1 has an invalid interface number: 214 but max is 0 [ 1130.406807][T21637] usb 6-1: config 1 has no interface number 0 [ 1130.419822][T21637] usb 6-1: config 1 interface 214 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 1130.439414][T21637] usb 6-1: config 1 interface 214 altsetting 2 bulk endpoint 0x81 has invalid maxpacket 64 [ 1130.455680][T21637] usb 6-1: config 1 interface 214 has no altsetting 0 [ 1130.474767][T21637] usb 6-1: New USB device found, idVendor=07b4, idProduct=010a, bcdDevice= 1.02 [ 1130.505468][T21637] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1130.536038][T21637] usb 6-1: Product: syz [ 1130.545925][T21637] usb 6-1: Manufacturer: syz [ 1130.575346][T21637] usb 6-1: SerialNumber: syz [ 1130.591820][T22458] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1130.604582][T22458] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1130.631837][T21637] ums-alauda 6-1:1.214: USB Mass Storage device detected [ 1130.653067][T21637] scsi host1: usb-storage 6-1:1.214 [ 1130.863636][T22458] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1130.959984][T21637] usb 6-1: USB disconnect, device number 15 [ 1131.326116][T22488] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1132.852101][T22520] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4193'. [ 1133.244203][T22545] delete_channel: no stack [ 1133.278566][T22545] delete_channel: no stack [ 1133.337152][T22545] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1133.479584][T16398] usb 6-1: new high-speed USB device number 16 using dummy_hcd [ 1133.660453][T16398] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 1133.687606][T16398] usb 6-1: New USB device found, idVendor=07fd, idProduct=0004, bcdDevice=b9.bf [ 1133.700009][T16398] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1133.729665][T16398] usb 6-1: Product: syz [ 1133.734173][T16398] usb 6-1: Manufacturer: syz [ 1133.738783][T16398] usb 6-1: SerialNumber: syz [ 1133.775228][T16398] usb 6-1: config 0 descriptor?? [ 1133.802654][T16398] usb 6-1: Waiting for MOTU Microbook II to boot up... [ 1133.814351][T16398] usb 6-1: failed setting the sample rate for Motu MicroBook II: -22 [ 1133.829539][T16398] snd-usb-audio 6-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 1134.178375][T22557] netlink: 180 bytes leftover after parsing attributes in process `syz.4.4200'. [ 1134.221269][T22557] fuse: Bad value for 'fd' [ 1134.810538][ T984] usb 6-1: USB disconnect, device number 16 [ 1135.043163][T22254] syz.1.4152 (22254) used greatest stack depth: 16008 bytes left [ 1135.909169][T22579] cgroup: Bad value for 'name' [ 1139.161248][T22616] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4212'. [ 1142.880152][T21647] usb 6-1: new full-speed USB device number 17 using dummy_hcd [ 1142.947859][T22667] netdevsim netdevsim4: loading /lib/firmware/. failed with error -22 [ 1142.958475][T22667] netdevsim netdevsim4: Direct firmware load for . failed with error -22 [ 1142.972609][T22667] netdevsim netdevsim4: Falling back to sysfs fallback for: . [ 1143.051740][T21647] usb 6-1: config index 0 descriptor too short (expected 61, got 45) [ 1143.053833][T22673] netlink: 'syz.2.4225': attribute type 1 has an invalid length. [ 1143.061130][T21647] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1143.061160][T21647] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1143.063456][T21647] usb 6-1: New USB device found, idVendor=1843, idProduct=0200, bcdDevice=81.89 [ 1143.086239][T22673] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4225'. [ 1143.114362][T21647] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1143.131915][T21647] usb 6-1: Product: syz [ 1143.141210][T21647] usb 6-1: Manufacturer: syz [ 1143.149224][T21647] usb 6-1: SerialNumber: syz [ 1143.200135][T21647] usb 6-1: config 0 descriptor?? [ 1143.450623][T21644] usb 6-1: USB disconnect, device number 17 [ 1143.939566][T22627] Bluetooth: hci2: command 0x0406 tx timeout [ 1143.955864][T22627] Bluetooth: hci3: command 0x0406 tx timeout [ 1144.292524][T22713] netlink: 60 bytes leftover after parsing attributes in process `syz.1.4232'. [ 1144.359545][T16398] usb 6-1: new high-speed USB device number 18 using dummy_hcd [ 1144.403640][T22715] netlink: 'syz.1.4232': attribute type 29 has an invalid length. [ 1144.415186][T22715] netlink: 'syz.1.4232': attribute type 29 has an invalid length. [ 1144.509540][T16398] usb 6-1: Using ep0 maxpacket: 16 [ 1144.521657][T16398] usb 6-1: config 0 has an invalid interface number: 105 but max is 0 [ 1144.531138][T16398] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1144.559468][T16398] usb 6-1: config 0 has no interface number 0 [ 1144.568669][T16398] usb 6-1: New USB device found, idVendor=046d, idProduct=08f3, bcdDevice= b.28 [ 1144.583531][T16398] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1144.599524][T16398] usb 6-1: Product: syz [ 1144.604303][T16398] usb 6-1: Manufacturer: syz [ 1144.608951][T16398] usb 6-1: SerialNumber: syz [ 1144.634062][T16398] usb 6-1: config 0 descriptor?? [ 1144.643827][T16398] usb 6-1: Found UVC 0.00 device syz (046d:08f3) [ 1144.653696][T16398] usb 6-1: No valid video chain found. [ 1144.846184][T16398] usb 6-1: USB disconnect, device number 18 [ 1145.514972][T22735] netlink: 'syz.5.4236': attribute type 1 has an invalid length. [ 1145.524022][T22735] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4236'. [ 1146.727864][T22769] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4244'. [ 1146.907848][T22777] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4246'. [ 1146.935546][T22779] netlink: 72 bytes leftover after parsing attributes in process `syz.2.4245'. [ 1147.482341][T22799] netlink: 'syz.1.4252': attribute type 1 has an invalid length. [ 1147.502774][T22799] netlink: 'syz.1.4252': attribute type 2 has an invalid length. [ 1147.613361][T22804] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4253'. [ 1148.033460][T22824] netlink: 'syz.5.4265': attribute type 29 has an invalid length. [ 1148.048617][T22824] netlink: 'syz.5.4265': attribute type 29 has an invalid length. [ 1148.071583][T22824] netlink: 'syz.5.4265': attribute type 29 has an invalid length. [ 1148.093946][T22824] netlink: 'syz.5.4265': attribute type 29 has an invalid length. [ 1148.124636][T22829] netlink: 'syz.1.4267': attribute type 29 has an invalid length. [ 1148.151886][T22828] syzkaller0: entered promiscuous mode [ 1148.170380][T22828] syzkaller0: entered allmulticast mode [ 1148.179039][T22829] netlink: 'syz.1.4267': attribute type 29 has an invalid length. [ 1148.220308][T22829] netlink: 'syz.1.4267': attribute type 29 has an invalid length. [ 1148.239518][T22829] netlink: 'syz.1.4267': attribute type 29 has an invalid length. [ 1148.248518][T22833] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4269'. [ 1148.279904][T22833] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4269'. [ 1148.402988][T22840] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.4270'. [ 1148.435165][T22835] netlink: 4083 bytes leftover after parsing attributes in process `syz.2.4270'. [ 1149.312738][T22879] netlink: 'syz.4.4291': attribute type 29 has an invalid length. [ 1149.354826][T22879] netlink: 'syz.4.4291': attribute type 29 has an invalid length. [ 1149.945942][T22908] __nla_validate_parse: 5 callbacks suppressed [ 1149.945963][T22908] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4305'. [ 1150.001518][T22911] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4305'. [ 1150.198674][T22917] netlink: 64 bytes leftover after parsing attributes in process `syz.5.4309'. [ 1150.380038][T22925] netlink: 14 bytes leftover after parsing attributes in process `syz.1.4312'. [ 1150.486425][T22928] netlink: 'syz.5.4313': attribute type 29 has an invalid length. [ 1150.505553][T22928] netlink: 'syz.5.4313': attribute type 29 has an invalid length. [ 1150.541780][T22928] netlink: 44 bytes leftover after parsing attributes in process `syz.5.4313'. [ 1151.046039][T22958] netlink: 3 bytes leftover after parsing attributes in process `syz.2.4328'. [ 1151.085079][T22959] netlink: 28 bytes leftover after parsing attributes in process `syz.4.4327'. [ 1151.320052][T22970] netlink: 4083 bytes leftover after parsing attributes in process `syz.5.4332'. [ 1151.369942][T22967] netlink: 4083 bytes leftover after parsing attributes in process `syz.5.4332'. [ 1151.418917][T22974] netlink: 4083 bytes leftover after parsing attributes in process `syz.5.4332'. [ 1152.757651][T23038] tc_dump_action: action bad kind [ 1153.584490][T23070] validate_nla: 3 callbacks suppressed [ 1153.584513][T23070] netlink: 'syz.1.4380': attribute type 33 has an invalid length. [ 1154.783683][T23127] netlink: 'syz.1.4404': attribute type 29 has an invalid length. [ 1154.802257][T23127] netlink: 'syz.1.4404': attribute type 29 has an invalid length. [ 1154.835115][T23127] netlink: 'syz.1.4404': attribute type 29 has an invalid length. [ 1154.854022][T23127] netlink: 'syz.1.4404': attribute type 29 has an invalid length. [ 1154.966341][T23134] netlink: 'syz.2.4407': attribute type 1 has an invalid length. [ 1155.181460][T23144] netlink: 'syz.5.4412': attribute type 35 has an invalid length. [ 1155.195873][T23146] __nla_validate_parse: 19 callbacks suppressed [ 1155.195899][T23146] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4413'. [ 1156.328886][T23193] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4432'. [ 1157.527811][T23214] netlink: 'syz.4.4442': attribute type 1 has an invalid length. [ 1157.696444][T23216] netlink: 15999 bytes leftover after parsing attributes in process `syz.4.4443'. [ 1158.454827][T23234] netlink: 'syz.4.4450': attribute type 11 has an invalid length. [ 1158.610629][T23236] sock: sock_timestamping_bind_phc: sock not bind to device [ 1161.694223][T23186] netlink: 'syz.1.4431': attribute type 29 has an invalid length. [ 1161.711588][T23197] netlink: 'syz.2.4434': attribute type 29 has an invalid length. [ 1161.936487][T23259] netlink: 132 bytes leftover after parsing attributes in process `syz.4.4456'. [ 1162.023313][T16398] hid-generic 0000:0000:0000.004F: unknown main item tag 0x0 [ 1162.045272][T16398] hid-generic 0000:0000:0000.004F: hidraw0: HID v0.00 Device [syz1] on syz0 [ 1162.498561][T23272] netlink: 152 bytes leftover after parsing attributes in process `syz.1.4458'. [ 1162.511827][T23272] netlink: 5 bytes leftover after parsing attributes in process `syz.1.4458'. [ 1162.521368][T23272] A link change request failed with some changes committed already. Interface team0 may have been left with an inconsistent configuration, please check. [ 1162.617019][T23276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1162.648786][T23276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1162.830259][T16398] usb 6-1: new low-speed USB device number 19 using dummy_hcd [ 1162.996624][T16398] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1163.011052][T16398] usb 6-1: config 1 has an invalid interface number: 131 but max is 0 [ 1163.032302][T16398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1163.059870][T16398] usb 6-1: config 1 has no interface number 0 [ 1163.077026][T16398] usb 6-1: config 1 interface 131 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1163.106610][T16398] usb 6-1: config 1 interface 131 has no altsetting 0 [ 1163.127196][T16398] usb 6-1: string descriptor 0 read error: -22 [ 1163.143298][T16398] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1163.177739][T16398] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1163.240609][T16398] usb 6-1: bad CDC descriptors [ 1163.372901][T23319] netlink: 'syz.4.4466': attribute type 10 has an invalid length. [ 1163.407201][T23319] team0: Port device dummy0 added [ 1163.425438][T23319] netlink: 'syz.4.4466': attribute type 10 has an invalid length. [ 1163.439251][T21647] usb 6-1: USB disconnect, device number 19 [ 1163.503420][T23319] team0: Port device dummy0 removed [ 1163.535421][T23319] bond0: (slave dummy0): Enslaving as an active interface with an up link [ 1163.738417][T23336] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1164.512737][ T52] Bluetooth: hci3: unknown advertising packet type: 0x82 [ 1164.512893][ T52] Bluetooth: hci3: Malformed LE Event: 0x02 [ 1164.756959][T23359] fuse: Bad value for 'fd' [ 1165.049486][T21644] usb 6-1: new high-speed USB device number 20 using dummy_hcd [ 1165.211427][T21644] usb 6-1: config 2 has an invalid descriptor of length 0, skipping remainder of the config [ 1165.230658][T21644] usb 6-1: New USB device found, idVendor=7a69, idProduct=0001, bcdDevice=a8.6b [ 1165.240076][T21644] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1165.248299][T21644] usb 6-1: Product: syz [ 1165.269435][T21644] usb 6-1: Manufacturer: syz [ 1165.274457][T21644] usb 6-1: SerialNumber: syz [ 1165.293254][T21644] usb 6-1: dvb_usb_v2: found a '774 Friio White ISDB-T USB2.0' in warm state [ 1165.522168][T21644] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1165.544985][T21644] dvbdev: DVB: registering new adapter (774 Friio White ISDB-T USB2.0) [ 1165.555654][T21644] usb 6-1: media controller created [ 1165.565061][T23400] afs: Unknown parameter 'flgc' [ 1165.593290][T21644] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1165.860774][T21644] usb 6-1: USB disconnect, device number 20 [ 1165.966893][T23421] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4491'. [ 1165.979177][T23421] netlink: 33 bytes leftover after parsing attributes in process `syz.1.4491'. [ 1165.998149][T23421] netlink: 33 bytes leftover after parsing attributes in process `syz.1.4491'. [ 1166.229728][T21644] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 1166.369522][T21644] usb 6-1: device descriptor read/64, error -71 [ 1166.609831][T21644] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 1166.749463][T21644] usb 6-1: device descriptor read/64, error -71 [ 1166.859895][T21644] usb usb6-port1: attempt power cycle [ 1167.006401][T23443] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4497'. [ 1167.209485][T21644] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 1167.250458][T21644] usb 6-1: device descriptor read/8, error -71 [ 1167.421715][T23457] netlink: 28 bytes leftover after parsing attributes in process `syz.1.4500'. [ 1167.489735][T21644] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 1167.520403][T21644] usb 6-1: device descriptor read/8, error -71 [ 1167.630004][T21644] usb usb6-port1: unable to enumerate USB device [ 1168.179624][T21637] usb 6-1: new low-speed USB device number 25 using dummy_hcd [ 1168.342286][T21637] usb 6-1: config 0 has an invalid interface number: 55 but max is 0 [ 1168.359526][T21637] usb 6-1: config 0 has no interface number 0 [ 1168.370009][T21637] usb 6-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1168.384649][T21637] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1168.396458][T21637] usb 6-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1168.412193][T21637] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1168.427776][T21637] usb 6-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid wMaxPacketSize 0 [ 1168.442445][T21637] usb 6-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1168.458153][T21637] usb 6-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1168.473321][T21637] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1168.490732][T21637] usb 6-1: config 0 descriptor?? [ 1168.500315][T23472] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1168.532145][T21637] ldusb 6-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1168.975114][T21637] usb 6-1: USB disconnect, device number 25 [ 1168.986532][T21637] ldusb 6-1:0.55: LD USB Device #0 now disconnected [ 1169.211322][T23506] /dev/nullb0: Can't lookup blockdev [ 1170.192345][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1170.202991][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1170.210642][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1170.259837][T16398] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 1170.433703][T16398] usb 6-1: Using ep0 maxpacket: 8 [ 1170.454241][T16398] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1170.465455][T16398] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1170.480829][T16398] usb 6-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1170.498460][T16398] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1170.516194][T16398] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1170.529099][T16398] usb 6-1: Product: syz [ 1170.542817][T16398] usb 6-1: Manufacturer: syz [ 1170.547583][T16398] usb 6-1: SerialNumber: syz [ 1170.781103][T16398] usb 6-1: 0:2 : does not exist [ 1170.816355][T16398] usb 6-1: USB disconnect, device number 26 [ 1170.851672][T23575] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 1171.134998][T23589] netlink: 'syz.4.4520': attribute type 10 has an invalid length. [ 1171.177900][T23539] infiniband syz2: set down [ 1171.185164][T23539] infiniband syz2: added vxcan1 [ 1171.186576][T23589] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1171.194130][T23539] syz2: rxe_create_cq: returned err = -12 [ 1171.227263][T23539] infiniband syz2: Couldn't create ib_mad CQ [ 1171.235072][T23539] infiniband syz2: Couldn't open port 1 [ 1171.236967][T23589] team0: Port device bond0 added [ 1171.286078][T16398] vxcan1 speed is unknown, defaulting to 1000 [ 1171.343475][T23539] RDS/IB: syz2: added [ 1171.347963][T23539] smc: adding ib device syz2 with port count 1 [ 1171.369230][T23539] smc: ib device syz2 port 1 has no pnetid [ 1171.401248][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1171.409939][T16398] vxcan1 speed is unknown, defaulting to 1000 [ 1171.877409][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1171.919146][T23607] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4526'. [ 1172.006088][T23609] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1172.289175][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1172.724996][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1173.176525][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1173.545025][T23654] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4538'. [ 1173.632931][T23539] vxcan1 speed is unknown, defaulting to 1000 [ 1173.799496][ T984] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 1173.949506][ T984] usb 6-1: device descriptor read/64, error -71 [ 1174.189555][ T984] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 1174.352687][ T984] usb 6-1: device descriptor read/64, error -71 [ 1174.440799][T23677] CIFS: iocharset name too long [ 1174.470061][ T984] usb usb6-port1: attempt power cycle [ 1174.819428][ T984] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 1174.863987][ T984] usb 6-1: device descriptor read/8, error -71 [ 1175.109466][ T984] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 1175.131262][ T984] usb 6-1: device descriptor read/8, error -71 [ 1175.250040][ T984] usb usb6-port1: unable to enumerate USB device [ 1175.270719][ C0] vkms_vblank_simulate: vblank timer overrun [ 1175.513912][T23686] netlink: 'syz.4.4548': attribute type 27 has an invalid length. [ 1175.978753][T23699] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4552'. [ 1176.555455][T23718] dvmrp0: entered allmulticast mode [ 1176.710082][T23733] 9pnet_fd: Insufficient options for proto=fd [ 1176.899735][T21637] usb 6-1: new full-speed USB device number 31 using dummy_hcd [ 1176.973076][T23743] netlink: 64 bytes leftover after parsing attributes in process `syz.2.4563'. [ 1177.042634][T21637] usb 6-1: device descriptor read/64, error -71 [ 1177.301980][T21637] usb 6-1: new full-speed USB device number 32 using dummy_hcd [ 1177.433745][T23756] comedi comedi3: 8255: I/O port conflict (0x5,4) [ 1177.436577][T23755] overlayfs: failed to clone upperpath [ 1177.451302][T23756] comedi comedi3: 8255: I/O port conflict (0x2,4) [ 1177.466728][T23756] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1177.479487][T21637] usb 6-1: device descriptor read/64, error -71 [ 1177.482169][T23756] comedi comedi3: 8255: I/O port conflict (0x5c95239c,4) [ 1177.496215][T23756] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1177.516521][T23756] comedi comedi3: 8255: I/O port conflict (0x3ff,4) [ 1177.538781][T23756] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 1177.548509][T23759] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4566'. [ 1177.569246][T23756] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1177.596675][T23756] comedi comedi3: 8255: I/O port conflict (0x1,4) [ 1177.609708][T21637] usb usb6-port1: attempt power cycle [ 1177.611392][T23756] comedi comedi3: 8255: I/O port conflict (0x9,4) [ 1177.639173][T23756] comedi comedi3: 8255: I/O port conflict (0x6,4) [ 1177.647506][T23756] comedi comedi3: 8255: I/O port conflict (0x4,4) [ 1177.658840][T23756] comedi comedi3: 8255: I/O port conflict (0x10,4) [ 1177.704892][ T1302] aoe: packet could not be sent on bond0. consider increasing tx_queue_len [ 1177.714994][T23756] comedi comedi3: 8255: I/O port conflict (0xffffffff8000008b,4) [ 1177.723472][ T1302] ieee802154 phy1 wpan1: encryption failed: -22 [ 1177.734288][T23756] comedi comedi3: 8255: I/O port conflict (0xfffffffffffffffe,4) [ 1177.742680][T23756] comedi comedi3: 8255: I/O port conflict (0xb,4) [ 1177.749494][T23756] comedi comedi3: 8255: I/O port conflict (0xfffffffffffffff5,4) [ 1177.757394][T23756] comedi comedi3: 8255: I/O port conflict (0xffffffffffffeadb,4) [ 1177.765527][T23756] comedi comedi3: 8255: I/O port conflict (0x3,4) [ 1177.949710][T21637] usb 6-1: new full-speed USB device number 33 using dummy_hcd [ 1177.981018][T21637] usb 6-1: device descriptor read/8, error -71 [ 1178.229450][T21637] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 1178.250285][T21637] usb 6-1: device descriptor read/8, error -71 [ 1178.360113][T21637] usb usb6-port1: unable to enumerate USB device [ 1178.648802][T23777] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4570'. [ 1180.099575][T21637] usb 6-1: new high-speed USB device number 35 using dummy_hcd [ 1180.229449][T21637] usb 6-1: device descriptor read/64, error -71 [ 1180.469764][T21637] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 1180.609601][T21637] usb 6-1: device descriptor read/64, error -71 [ 1180.723734][T21637] usb usb6-port1: attempt power cycle [ 1180.995579][T23806] netlink: 14593 bytes leftover after parsing attributes in process `syz.4.4578'. [ 1181.079868][T21637] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 1181.110220][T21637] usb 6-1: device descriptor read/8, error -71 [ 1181.160691][T23811] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4579'. [ 1181.349479][T21637] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 1181.371338][T21637] usb 6-1: device descriptor read/8, error -71 [ 1181.494203][T21637] usb usb6-port1: unable to enumerate USB device [ 1182.637303][T23837] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4589'. [ 1183.691666][T23870] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4594'. [ 1183.729539][T23870] netlink: 72 bytes leftover after parsing attributes in process `syz.5.4594'. [ 1183.758135][T23871] netlink: 'syz.5.4594': attribute type 10 has an invalid length. [ 1183.766711][T23871] netlink: 55 bytes leftover after parsing attributes in process `syz.5.4594'. [ 1183.827772][T23870] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1184.857299][T23931] 9pnet_fd: Insufficient options for proto=fd [ 1185.269799][ T984] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 1185.427256][ T984] usb 6-1: config 0 has an invalid interface number: 153 but max is 0 [ 1185.436088][ T984] usb 6-1: config 0 has no interface number 0 [ 1185.456390][ T984] usb 6-1: too many endpoints for config 0 interface 153 altsetting 218: 104, using maximum allowed: 30 [ 1185.472858][ T984] usb 6-1: config 0 interface 153 altsetting 218 has 0 endpoint descriptors, different from the interface descriptor's value: 104 [ 1185.499004][ T984] usb 6-1: config 0 interface 153 has no altsetting 0 [ 1185.516348][ T984] usb 6-1: New USB device found, idVendor=1199, idProduct=6852, bcdDevice=57.34 [ 1185.536270][ T984] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1185.548920][ T984] usb 6-1: Product: syz [ 1185.556118][ T984] usb 6-1: Manufacturer: syz [ 1185.562793][ T984] usb 6-1: SerialNumber: syz [ 1185.571128][ T984] usb 6-1: config 0 descriptor?? [ 1185.790751][ T984] sierra 6-1:0.153: Sierra USB modem converter detected [ 1185.818013][ T984] usb 6-1: USB disconnect, device number 39 [ 1185.836972][ T984] sierra 6-1:0.153: device disconnected [ 1186.405889][T23974] 9p filesystem being mounted at /226/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 1186.799512][T16398] usb 6-1: new high-speed USB device number 40 using dummy_hcd [ 1186.969493][T16398] usb 6-1: Using ep0 maxpacket: 32 [ 1186.983797][T16398] usb 6-1: New USB device found, idVendor=06a2, idProduct=0003, bcdDevice=b4.8c [ 1186.999414][T16398] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1187.007553][T16398] usb 6-1: Product: syz [ 1187.026250][T16398] usb 6-1: Manufacturer: syz [ 1187.039551][T16398] usb 6-1: SerialNumber: syz [ 1187.047975][T16398] usb 6-1: config 0 descriptor?? [ 1187.076941][T16398] gspca_main: gspca_topro-2.14.0 probing 06a2:0003 [ 1187.292180][T16398] gspca_topro: reg_w err -71 [ 1187.320973][T16398] gspca_topro: Sensor soi763a [ 1187.344524][T16398] usb 6-1: USB disconnect, device number 40 [ 1188.813203][T24073] fuse: Unknown parameter '00000000000000000007' [ 1189.016575][T24077] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4639'. [ 1190.189454][T21642] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 1190.371427][T21642] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1190.411308][T21642] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1190.440772][T21642] usb 6-1: New USB device found, idVendor=0543, idProduct=e621, bcdDevice= 0.00 [ 1190.461157][T21642] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1190.490431][T21642] usb 6-1: config 0 descriptor?? [ 1190.650589][T24118] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4650'. [ 1190.672984][T24118] overlayfs: missing 'workdir' [ 1190.709136][T24118] overlayfs: upper fs does not support RENAME_WHITEOUT. [ 1190.726872][T24118] overlayfs: failed to set xattr on upper [ 1190.733419][T24118] overlayfs: ...falling back to redirect_dir=nofollow. [ 1190.741024][T24118] overlayfs: ...falling back to index=off. [ 1190.747397][T24118] overlayfs: ...falling back to uuid=null. [ 1190.759901][T24118] overlayfs: conflicting lowerdir path [ 1190.925412][T21642] viewsonic 0003:0543:E621.0050: unknown main item tag 0x0 [ 1190.949225][T21642] viewsonic 0003:0543:E621.0050: unknown main item tag 0x0 [ 1190.957530][T21642] viewsonic 0003:0543:E621.0050: unknown main item tag 0x0 [ 1190.976422][T21642] viewsonic 0003:0543:E621.0050: unknown main item tag 0x0 [ 1191.006697][T21642] viewsonic 0003:0543:E621.0050: unknown main item tag 0x0 [ 1191.039476][T21642] viewsonic 0003:0543:E621.0050: unknown main item tag 0x0 [ 1191.059996][T21642] viewsonic 0003:0543:E621.0050: unknown main item tag 0x0 [ 1191.076572][T24132] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4653'. [ 1191.087286][T21642] viewsonic 0003:0543:E621.0050: hidraw0: USB HID v0.00 Device [HID 0543:e621] on usb-dummy_hcd.5-1/input0 [ 1191.144337][T21642] usb 6-1: USB disconnect, device number 41 [ 1191.377281][T24139] fido_id[24139]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.5/usb6/report_descriptor': No such file or directory [ 1191.698927][T24167] overlayfs: failed to clone upperpath [ 1191.731681][T24169] tipc: Enabling of bearer rejected, failed to enable media [ 1191.795057][T24169] netlink: 44 bytes leftover after parsing attributes in process `syz.1.4658'. [ 1191.805228][T24169] netlink: 'syz.1.4658': attribute type 6 has an invalid length. [ 1191.819160][T24169] netlink: 'syz.1.4658': attribute type 5 has an invalid length. [ 1191.832075][T24169] netlink: 'syz.1.4658': attribute type 4 has an invalid length. [ 1191.948529][T24180] 9pnet_fd: Insufficient options for proto=fd [ 1192.254087][T24192] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4667'. [ 1192.469568][T21642] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 1192.624669][T21642] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 129, changing to 11 [ 1192.636998][T21642] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1192.658152][T21642] usb 6-1: New USB device found, idVendor=2179, idProduct=0077, bcdDevice= 0.00 [ 1192.668430][T21642] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1192.704200][T21642] usb 6-1: config 0 descriptor?? [ 1193.193852][T21642] uclogic 0003:2179:0077.0051: interface is invalid, ignoring [ 1194.490343][T24249] netlink: 'syz.4.4683': attribute type 11 has an invalid length. [ 1194.715141][T24252] trusted_key: encrypted_key: key user:syz not found [ 1194.855603][T24264] usb usb8: usbfs: process 24264 (syz.5.4686) did not claim interface 0 before use [ 1195.040097][ T52] Bluetooth: hci5: ACL packet for unknown connection handle 200 [ 1195.209787][T24283] tipc: Started in network mode [ 1195.218002][T24283] tipc: Node identity 100, cluster identity 4711 [ 1195.248051][T24283] tipc: Node number set to 256 [ 1195.439726][T24295] netlink: 'syz.5.4696': attribute type 21 has an invalid length. [ 1195.454813][T24295] netlink: 128 bytes leftover after parsing attributes in process `syz.5.4696'. [ 1195.471293][T24295] netlink: 3 bytes leftover after parsing attributes in process `syz.5.4696'. [ 1195.555495][T24301] 9pnet_virtio: no channels available for device ./file0 [ 1195.947040][T24319] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4703'. [ 1196.810894][T24333] 9p filesystem being mounted at /255/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 1197.357527][T24354] 9p filesystem being mounted at /351/file0 supports timestamps until 2106-02-07 (0xffffffff) [ 1197.407115][ T30] audit: type=1326 audit(6049220413.741:209): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=24353 comm="syz.1.4712" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f9c47f8eba9 code=0x0 [ 1198.231752][T24374] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4718'. [ 1199.075730][T24401] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1199.097412][T24401] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1199.131433][T24404] netlink: 8 bytes leftover after parsing attributes in process `syz.4.4726'. [ 1199.567725][T24408] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1199.633232][T24408] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1200.416525][T24426] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4731'. [ 1202.639597][T24459] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1202.678553][T24459] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1204.536589][T24489] netlink: 64 bytes leftover after parsing attributes in process `syz.4.4746'. [ 1205.557975][T24511] comedi comedi0: Minor 47 could not be opened [ 1205.638038][T24513] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1205.701779][T24513] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1205.726250][T24517] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1205.788267][T24517] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1205.983272][T24527] vxcan1 speed is unknown, defaulting to 1000 [ 1206.148794][T24540] netlink: 'syz.4.4760': attribute type 6 has an invalid length. [ 1206.168731][T24540] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4760'. [ 1207.430488][T24579] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1207.439552][T24579] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1207.440203][T24578] xt_limit: Overflow, try lower: 604147548/4200216962 [ 1207.633280][T24579] kvm: emulating exchange as write [ 1207.810268][T24598] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4771'. [ 1208.630456][T24626] dlm: no locking on control device [ 1208.644254][T24626] netlink: 16 bytes leftover after parsing attributes in process `syz.5.4778'. [ 1208.687749][T24623] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1208.845633][T24635] 9pnet_fd: Insufficient options for proto=fd [ 1208.875180][T24636] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1208.918042][T24636] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1209.151061][T24646] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4785'. [ 1209.694809][T24648] Invalid source name [ 1209.700100][T24648] UBIFS error (pid: 24648): cannot open "usrquota", error -22 [ 1210.007884][T24660] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4791'. [ 1210.012391][T24661] ================================================================== [ 1210.033383][T24661] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.042148][T24661] Write of size 1280 at addr ffffc9000213ab40 by task vivid-000-vid-c/24661 [ 1210.051294][T24661] [ 1210.053715][T24661] CPU: 1 UID: 0 PID: 24661 Comm: vivid-000-vid-c Not tainted syzkaller #0 PREEMPT(full) [ 1210.053736][T24661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1210.053747][T24661] Call Trace: [ 1210.053754][T24661] [ 1210.053761][T24661] dump_stack_lvl+0x189/0x250 [ 1210.053781][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.053805][T24661] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1210.053820][T24661] ? __pfx__printk+0x10/0x10 [ 1210.053843][T24661] ? _raw_spin_lock_irqsave+0xb3/0xf0 [ 1210.053862][T24661] ? __virt_addr_valid+0xdc/0x5c0 [ 1210.053888][T24661] ? __virt_addr_valid+0xdc/0x5c0 [ 1210.053912][T24661] print_report+0xca/0x240 [ 1210.053928][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.053950][T24661] kasan_report+0x118/0x150 [ 1210.053973][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.053998][T24661] kasan_check_range+0x2b0/0x2c0 [ 1210.054018][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.054041][T24661] __asan_memcpy+0x40/0x70 [ 1210.054057][T24661] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.054105][T24661] vivid_thread_vid_cap_tick+0xfff/0x5fd0 [ 1210.054139][T24661] ? rcu_read_lock_sched_held+0x89/0x100 [ 1210.054169][T24661] ? ktime_get+0x3e/0x1f0 [ 1210.054192][T24661] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 1210.054219][T24661] ? lockdep_hardirqs_on+0x9c/0x150 [ 1210.054241][T24661] vivid_thread_vid_cap+0x8da/0x10d0 [ 1210.054269][T24661] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 1210.054289][T24661] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1210.054306][T24661] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1210.054326][T24661] ? __kthread_parkme+0x7b/0x200 [ 1210.054346][T24661] ? __kthread_parkme+0x1a1/0x200 [ 1210.054369][T24661] kthread+0x711/0x8a0 [ 1210.054394][T24661] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 1210.054413][T24661] ? __pfx_kthread+0x10/0x10 [ 1210.054437][T24661] ? _raw_spin_unlock_irq+0x23/0x50 [ 1210.054453][T24661] ? lockdep_hardirqs_on+0x9c/0x150 [ 1210.054470][T24661] ? __pfx_kthread+0x10/0x10 [ 1210.054493][T24661] ret_from_fork+0x4bc/0x870 [ 1210.054513][T24661] ? __pfx_ret_from_fork+0x10/0x10 [ 1210.054534][T24661] ? __switch_to_asm+0x39/0x70 [ 1210.054550][T24661] ? __switch_to_asm+0x33/0x70 [ 1210.054567][T24661] ? __pfx_kthread+0x10/0x10 [ 1210.054589][T24661] ret_from_fork_asm+0x1a/0x30 [ 1210.054613][T24661] [ 1210.054619][T24661] [ 1210.295616][T24661] The buggy address belongs to a 3-page vmalloc region starting at 0xffffc90002138000 allocated at vb2_vmalloc_alloc+0xef/0x340 [ 1210.310106][T24661] The buggy address belongs to the physical page: [ 1210.317329][T24661] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0xffff888000000000 pfn:0x59da9 [ 1210.328325][T24661] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 1210.335642][T24661] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 1210.344402][T24661] raw: ffff888000000000 0000000000000000 00000001ffffffff 0000000000000000 [ 1210.353455][T24661] page dumped because: kasan: bad access detected [ 1210.360136][T24661] page_owner tracks the page as allocated [ 1210.365955][T24661] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 24658, tgid 24657 (syz.5.4792), ts 1210003915818, free_ts 1209820647628 [ 1210.386219][T24661] post_alloc_hook+0x240/0x2a0 [ 1210.391277][T24661] get_page_from_freelist+0x21e4/0x22c0 [ 1210.397043][T24661] __alloc_frozen_pages_noprof+0x181/0x370 [ 1210.403147][T24661] alloc_pages_mpol+0x232/0x4a0 [ 1210.408270][T24661] alloc_pages_noprof+0xa9/0x190 [ 1210.413835][T24661] __vmalloc_node_range_noprof+0x97d/0x12f0 [ 1210.420196][T24661] vmalloc_user_noprof+0xad/0xf0 [ 1210.425410][T24661] vb2_vmalloc_alloc+0xef/0x340 [ 1210.430538][T24661] __vb2_queue_alloc+0x9c2/0x15a0 [ 1210.435659][T24661] vb2_core_reqbufs+0xc31/0x1420 [ 1210.440691][T24661] __vb2_init_fileio+0x318/0xff0 [ 1210.445647][T24661] __vb2_perform_fileio+0x284/0x1600 [ 1210.451099][T24661] vb2_fop_read+0x273/0x360 [ 1210.455808][T24661] v4l2_read+0x19c/0x2c0 [ 1210.460322][T24661] vfs_read+0x200/0xa30 [ 1210.464491][T24661] ksys_read+0x145/0x250 [ 1210.468743][T24661] page last free pid 23 tgid 23 stack trace: [ 1210.474736][T24661] __free_frozen_pages+0xbc4/0xd30 [ 1210.480416][T24661] tlb_remove_table_rcu+0x85/0x100 [ 1210.485909][T24661] rcu_core+0xcab/0x1770 [ 1210.490244][T24661] handle_softirqs+0x286/0x870 [ 1210.495384][T24661] run_ksoftirqd+0x9b/0x100 [ 1210.499981][T24661] smpboot_thread_fn+0x542/0xa60 [ 1210.505099][T24661] kthread+0x711/0x8a0 [ 1210.509296][T24661] ret_from_fork+0x4bc/0x870 [ 1210.513906][T24661] ret_from_fork_asm+0x1a/0x30 [ 1210.518766][T24661] [ 1210.521088][T24661] Memory state around the buggy address: [ 1210.527386][T24661] ffffc9000213af00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1210.535822][T24661] ffffc9000213af80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 1210.544422][T24661] >ffffc9000213b000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1210.552676][T24661] ^ [ 1210.557108][T24661] ffffc9000213b080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1210.565843][T24661] ffffc9000213b100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 1210.574094][T24661] ================================================================== [ 1210.619507][T24661] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 1210.627438][T24661] CPU: 0 UID: 0 PID: 24661 Comm: vivid-000-vid-c Not tainted syzkaller #0 PREEMPT(full) [ 1210.637712][T24661] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1210.647974][T24661] Call Trace: [ 1210.651281][T24661] [ 1210.654324][T24661] dump_stack_lvl+0x99/0x250 [ 1210.659228][T24661] ? __asan_memcpy+0x40/0x70 [ 1210.663946][T24661] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1210.669177][T24661] ? __pfx__printk+0x10/0x10 [ 1210.674170][T24661] vpanic+0x237/0x6d0 [ 1210.678202][T24661] ? __pfx_vpanic+0x10/0x10 [ 1210.682815][T24661] ? preempt_schedule+0xae/0xc0 [ 1210.687722][T24661] ? __pfx_preempt_schedule+0x10/0x10 [ 1210.693630][T24661] panic+0xb9/0xc0 [ 1210.697490][T24661] ? __pfx_panic+0x10/0x10 [ 1210.701955][T24661] ? _raw_spin_unlock_irqrestore+0xfd/0x110 [ 1210.707973][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.714060][T24661] check_panic_on_warn+0x89/0xb0 [ 1210.719453][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.725648][T24661] end_report+0x78/0x160 [ 1210.730183][T24661] kasan_report+0x129/0x150 [ 1210.734932][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.740771][T24661] kasan_check_range+0x2b0/0x2c0 [ 1210.745901][T24661] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.751811][T24661] __asan_memcpy+0x40/0x70 [ 1210.756234][T24661] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 1210.761910][T24661] vivid_thread_vid_cap_tick+0xfff/0x5fd0 [ 1210.768006][T24661] ? rcu_read_lock_sched_held+0x89/0x100 [ 1210.773918][T24661] ? ktime_get+0x3e/0x1f0 [ 1210.778439][T24661] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 1210.784799][T24661] ? lockdep_hardirqs_on+0x9c/0x150 [ 1210.790308][T24661] vivid_thread_vid_cap+0x8da/0x10d0 [ 1210.795722][T24661] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 1210.801735][T24661] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1210.807818][T24661] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1210.814245][T24661] ? __kthread_parkme+0x7b/0x200 [ 1210.819955][T24661] ? __kthread_parkme+0x1a1/0x200 [ 1210.825180][T24661] kthread+0x711/0x8a0 [ 1210.829534][T24661] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 1210.835612][T24661] ? __pfx_kthread+0x10/0x10 [ 1210.840323][T24661] ? _raw_spin_unlock_irq+0x23/0x50 [ 1210.845640][T24661] ? lockdep_hardirqs_on+0x9c/0x150 [ 1210.851195][T24661] ? __pfx_kthread+0x10/0x10 [ 1210.856070][T24661] ret_from_fork+0x4bc/0x870 [ 1210.861044][T24661] ? __pfx_ret_from_fork+0x10/0x10 [ 1210.866254][T24661] ? __switch_to_asm+0x39/0x70 [ 1210.871203][T24661] ? __switch_to_asm+0x33/0x70 [ 1210.876242][T24661] ? __pfx_kthread+0x10/0x10 [ 1210.881024][T24661] ret_from_fork_asm+0x1a/0x30 [ 1210.885799][T24661] [ 1210.889340][T24661] Kernel Offset: disabled [ 1210.893940][T24661] Rebooting in 86400 seconds..