last executing test programs: 12m18.312601856s ago: executing program 3 (id=156): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) pipe(&(0x7f00000001c0)) fsopen(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) r5 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0x8a5, 0x92, 0x1, 0x2, 0xd59f80, 0x19ef, 0x5, 0x19ef, 0x3, 0x4, 0x27ff, 0x2800, 0x2, 0xbb6, 0x0, 0x13, {0x8, 0xfffffffb}, 0xd0, 0x9}}) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = fcntl$dupfd(r3, 0x406, r3) write$binfmt_elf64(r6, &(0x7f00000004c0)=ANY=[], 0xfffffdcf) 12m17.136948796s ago: executing program 3 (id=161): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) syz_emit_ethernet(0x52, &(0x7f0000000000)=ANY=[@ANYBLOB="aa020000000000000060"], 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='&\x00\x00\x00\a'], 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r2 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) setsockopt$bt_hci_HCI_TIME_STAMP(r2, 0x0, 0x3, 0x0, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r4, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r2, 0xc0186405, &(0x7f0000000080)={0xfffffff8, 0x3ff, {0xffffffffffffffff}, {r4}, 0x2, 0x6}) r5 = memfd_create(&(0x7f0000000100)='\xa9\r\xac7A+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99\x18\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\xd5\xec\x10\xd7\x01M\x7f\xb7\x17@)\x8fG&\xcb\xe3\xc2\x80\xc3MD\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1f\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\tRJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd99C\x9fF\x9c[M=\xa0^\xa8\xed)\xe8Z\xe8\x9b&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xc9\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xe7\x9d\x9a\x8a\x86>\f\xa8b\xa5B5)\x80m\xff\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xb6\x1c+\xf7gT\x9a\x02\x99\xc2\x00\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6\x05\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84X\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa\x19\x06U)j!\x91\'\x98\xd2kFN\xfa\x80)O\xb9(!n\x9d\x13\x15\xf1\x1a\xb8y\x14l\xd1\x00\x00\x00\x00\x00\x00E\xfc\x00'/762, 0x5) ioctl$FS_IOC_RESVSP(r5, 0x402c5828, &(0x7f00000000c0)={0x0, 0x0, 0x1, 0xa43a6d}) 12m16.560824261s ago: executing program 3 (id=164): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) r6 = socket$inet(0x2, 0x1, 0x0) setsockopt$inet_mreqn(r6, 0x0, 0x27, &(0x7f0000000100)={@multicast2, @local}, 0xc) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) r7 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) accept4(r7, 0x0, 0x0, 0x800) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x103, 0xfffb, &(0x7f0000000000)) 12m15.449015425s ago: executing program 3 (id=167): r0 = socket$nl_crypto(0x10, 0x3, 0x15) r1 = socket$netlink(0x10, 0x3, 0x10) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4040aea0, &(0x7f0000000000)=@x86={0x9, 0x5, 0x9, 0x0, 0xbb04d98f, 0xfb, 0x5, 0x2, 0x3, 0x5, 0x3, 0x6, 0x0, 0x7a2, 0x95c, 0x4, 0x8f, 0x22, 0x1, '\x00', 0x2, 0x1}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', 0x0) pivot_root(&(0x7f0000001080)='./file0/../file0/../file0/../file0/file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0/../file0/file0\x00') sendmsg$NFT_BATCH(r1, &(0x7f0000002b40)={0x0, 0x0, &(0x7f0000002b00)={&(0x7f0000001e40)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [], {0x14, 0x11, 0x1, 0x0, 0x0, {0x2}}}, 0x28}}, 0x8000) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000002100)={0xe0, 0x13, 0x1, 0x0, 0x0, "", [@nested={0xcd, 0x54, 0x0, 0x1, [@generic="fb82af7e102bfa14d22155047a83ec7ec2a27d47304143ee9c9cc79081ea38d665867754d31765c290cbb88ccbf19369672ab3ed0a753288927170d7f699ef8be8d820972927517f90dd9e1ccfb21c0354e76f1019581f9a5502c11926b211bfe1f17985c9b32b8a539c7ba517fbc94a831030e537da559c7e92ae2b6b9c0bbbe4d122f98ba06745714329a7a3e433f129f55ad2c89af555fe6f85c3632b29995ffc73414d7b46415d9eea7d37092a85cc27f85472f17997031e4041dbd79bc55a7bdf7d021566e342"]}]}, 0xe0}], 0x1}, 0x0) socket$inet6_sctp(0xa, 0x0, 0x84) 12m15.317623082s ago: executing program 3 (id=168): r0 = socket$kcm(0x11, 0x200000000000002, 0x300) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000540)=@base={0x1, 0x7, 0x4, 0x5, 0x80}, 0x50) r2 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r2) ptrace$pokeuser(0x6, r2, 0x108, 0x4) ptrace$pokeuser(0x6, r2, 0x108, 0x7) r3 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_TIMEOUT(r3, 0x0, 0x486, &(0x7f0000004f00), &(0x7f0000004f40)=0xc) ioctl$XFS_IOC_PATH_TO_HANDLE(r1, 0xc01c5869, &(0x7f0000000140)={r1, &(0x7f0000000980)=')\x00\x12F\xdfR\xc4\xdb\x81\xe3\xc9\xc4\x1a\x7f9a2 \xfe\x9e\xc1W\x02\xce+\xa6\xdf\x91\xe0\x9d\x9dDE23-/\xbd}#\xbeRYE\x87\xbeM\x9b\xa1\xa5\xcf\xa6~\xeb\x13\xdcm\x81\xe7o\x93\xf6\xf8\x86\xcb\xc8N\xa5\xe4\xaba\x00\xe6g\x8er{\b\x8d\a\xfd\x15s\xef\r\x95\x1f\xfe\xf3\xad2\x91\x86\xb2g\xc1uh\x0f\xd8/\aQ\xb9\xdd\xe8\'|\xc4\xfa^\xe9\xf2^(\x92\x14~\x1e\x84\x817\xa2\xae&W\x19v\xeffR\xbe\xfdf\x99\xeeHS|H4N\xb4\x7f\b(\x1c\xee\x17P\x93\xb7\x02\xd5\xba\x8f\x9c\xfaJS\xcd\x02\x1a/\x1a|6\xa9\xc80\x1c\r\x88\x17V\x80\xe3x\xdb\xd4E\xd5\x96\x04_\xfc^\x80\x87J\x1a\x91\x0eZ', 0x402, &(0x7f0000000080)={@align=0x7, {0x161a, 0x200, 0xe9f, 0x9}}, 0x5d7, &(0x7f00000000c0)={@_ha_fsid}, &(0x7f0000000300)=0x8000}) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x6, 0xe, &(0x7f0000002fc0)=ANY=[@ANYBLOB="b702000000001700bfa300000000000007030000f0ffffff720af0ff1100000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000000000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd844a954b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129da487130d5f24bf901115e17392ac627c87881c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b85b941092314fd085f028f2ed1a4b9535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024a0041b1df65b3e1b9bf115646d14ce53d13d0ccacda1efc5f9094fa737c28b994a8512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4fdc4b4861004eefbc17f54f82a804d4a69bf9bc5fa77ee2922bd165a5a68488e010030166565a097b103b44b451de736bb6d43db8db03d4b7745fef1d04ec633dee254a6d491b849a5a787e814c4fd21a18986252a70f8f940b6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad791fa99dac06b57479321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c2d7f22b0d22772c25a61ec45c3af97a8f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d366501753a7ac7fedb8d34f5bc381604fcd46105c457e7dd13cab6692422a47e9ffe2d4a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c9585638c2153a6eee01738b0c10671f4f559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469608241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670100be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c183c160119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f0e399d1b9f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d300e4d455c36300000000022320178b00cc6ed7966130b547dbf8b497af002000000cd1d0000002000000001c800000000000000000000000928ee53595a779d243a48cea769470424d28804c024ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d74bf0a305790c9d644735efbf3411718d6ee7aebf9ef40662d7836d252c566f5ee934c679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd13da2022f23daec61854f640f701db0276652f6c031578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e93311ab5009c68c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada209bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6155e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2f085185cc92fe7f791e8f6429309d6adab4b7e508e5bf024ed8f8a005f2bcdb7c89739f5d81e750d50517a59a3ad09e8802e8f4f535447cc0facd5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5b473332f2011e6539db7384e1f58d81f2f2653c4d9818708e27c89b552d3fcd116bce9c764c714c9402c21d181aae59efb28d4f91652f6750b6ec962802c0320f8059195729d60c534ee8e8ff0755367fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf00000048d2570f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000749e1338636555009edf66be445d6975d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab0043ebf7c79a953e023f74afad591821610b857e8717764b633b21cb32f09f4db033e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536605a644e9e3d769db497c1960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000000000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd5c17d5486b0c8a6c769f952283a1f4e3842edb3d42c68a27ef6a1296dff7aa46e820a74f9530bdcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fdca4e9eda0072f6df342f3e7071e28ef6806bc8e139c49b91c76b0d3958f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7d116d2b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7194d1eb3de6a5f99f301f89c2ee627e949cdd22000026a9960503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db7f2d43ea8086cf059f40fa2640000cd9e7f2e236ef5f1e3a94b108eb9750b6bfb74dd35f5a31059c01517cf4b6641fce9a24b96767b837ca037a2050000c375c705c798e0e208e4a5259d0bda526b462af45a6e9a84aebe025c8a7f65819f397574db7ab01bd2b3e3cd28c5aec50f8edfe39a00bafd688a7eea04efdeed96f67012bc3f795edb68b5dec80ad31a858eb756c815e7695d00000000000000000000000000000000000000000000000000007ccf0ce549d97510f7f8765408bb702f0000006d4754d98b7064cf31a681421994e1f307f0ab4ff2e33d3c88fea5d218a276b77adfee7c8fb145783ee1f8cf632c2604eab3a62a28611da1cae5ce60003111ce5c96a1d6e45ee144ffa3dcca32a33f8f0ce2995b7b7aa0bce228cbf37412e1bdebae06edb51a134301b4627d4927287daf9dcae6720334862f3a18094f1edd9e3503379815dcfbbc8141f6e1bbb0901ae91357677fd9d2bb00d4f17fb441c2dfa2b424bf46ae299d68ac27792cdac2f09e99f4ab5546ba1e5ad6a329f24e73a9c38eec34bd4dcc1609f6150e2de72f6599a2310c3841f4bb7f39cabc82c9fdfff5587ed4fa84090635fa3445c4cc54478b2f98320944ac7cb1c4e414556f7b0b763a00a84327cec7e11b3470f0384b27bbfdd8b2472497e7fe8c5df7e0a00641872472efa21c9ad3979e642dcc85c17ca8e084aa9689b83426e2fdaa01f500000000000000000000f9fd84fa991466ff749afe900d02281b2bb60d458340c4f68ec34835760ceca945bf181a000000c000000000b4a76515564ae189de7c1765f0ff68a0388ca8dd2aa831d0e01f0d7ce74401a58cef60e63e97a50c18de54121ce66380224ab7b9c0d4710f2347bad2c9b3e41cc738c1092728687f33e5cdb077223dc82c2137b4e3ba6791a2cd764e654f904c9505b7c5e3b2897072e747534952dcda50cde3e4deb6ebf85a04c3e415112b01eed6515c845a8a20519cd21787d560e9d8283fa8ff0c17b63ba06577c26678ff45420a1f85df47dbfc44e534f71aae5693fb5df61c5096219091ce0cd8e1e2e79bf9d37779e52007c66a00e6ded1499ed3892ed1544d1577906b52e16c734d4aec07dd15faa768c97298be87dd34ce704ffe3da8b46708cf972de4f31c0705ac933db80bdcfcb35c0d4620d4ec270ff7c9ce1b78994dd2b28b9d1c5c469d4c1a61781dce2f1b54d6138bd3f7df9e9ca613bec407c1b8d1bd0c7cb9d76eebf2f17c", @ANYBLOB="f030a618c127760e8147d4b25ff979344444348b248d5c7ceaadcb1276ee26cfc26de72037f3414bf0f3d13d3f77a6ddfdb9b511bc3459b9c9a4b68a384f86b56da31d289f27865652066fc14f27e9c021acd466521fb0b21c30d3aedd4d3f6976892dcbf3cd34c55751f8b75ddf7ad125de85f011e68be4b457ad9cf2523092d0708c7c1177fa732c2e5ca10d58ae6c7b66cc5a7daa0c2a7be0d3e3d1b4b1acc58c7eae6f7aadbb6518584a649a74952501d6250a4fc140149ab49be80c746ef63c77e3c2febd37833c81b47cd893e1396d1bbcfcdf3975e7a36d6c5c19bd089413a2f97f16deeb3f106ed49eda7a1cc9b438948ab0f6c3eca033ebe6eafb187d825162e906a31d788bbfcb49816b3eb3c1d68b6f2800da79d2542d5197ea17a406595b94dbd8356062d65cc05bfb4dc5b328ab9d3cc6e3e08124a0f6c3b5b05cd79e0b0063484b9233ef963aa1a6d00770d3a1a7667fcb4f5567ba47368576e1c7a4754299aac921bd8a592f34693e0a7abf4d90cf82a88a58774d9709c343c6941b177cf5389c50aa116cc87d14e80d07712bb6c3007acaa9c23270a115f005996286c443c31da5168cfdc50cc3c70cd8d74857f47fe3779b3fed73c6421db5acafa212e579fa40f8f6ab232e9f252a748a60039139b46a13af20af56ca9f24092b2ec9a786f369da3f0aba2b4ddf77660a7a995e0ce8653daca8c355efbc9a7e12629d9f2d39c314120b2d73c4d14522719d001cfe0a40cb9c8cfefc81ceb4952caec45791bf0116710cc9728596758de6f8180a7e0073f8257e0db4f8f6745052c0cdc8099fd69acb4e50dbc91ef277b8a39602358fd97f9d65e785a39600ad8895c81e7400122307c6b3c06acabb1552c8029f159477eccf004756032babf19bf740d21b729c5b96b6c43ee6c0fd7ca5d74cd6af014107344abb4e33828c2a3010523d1a5281396b12595a61369dda00b5a674f5df4e79c5694b04763a5039a3cb158bbad73570539ccdee9768fb3a9dc0889dca2e52ee94e9fd53c07096b6f09cd7fe0465e3c7b5bc785ec34505f063a8d9d6d102d33cbe10bf6bd8136cf6157af5461a7201be88104338eb14be70a41db15fe042d478affa17a2e2bb0dbc05349bbe538146c17f186591debb3bd052298dfdcd79636e83cd25877a19a91786660ef6f6be10e2ccc45887d0c1aaade5dd71c48bf5400986b2384bf346a143daa1a9391fae1b984ae7e652c35658d639f7bdc9f9edd26751595e9dd70ed11571e6a3dad476f64d498f5b43a4c9dfd49d383306b6fcf3c0fc8d797aef43989b87a63b95214135309d6fec621f3af260ccd877d10869a7e8f3b248dfd143fd4150424e503e169cd8d2f59eb44280b41087349b98344430acbdeaa590325efc17521ab6c13a1bd8645a5d66113ccd7807e2a760d878cf0fa5f9255e8d4fc9df687728eb9df377195f3a841d8232e4eb433e6c6f742a920e40abfbd78656a0c16d13b7022a5a213bcb23d328b7c80c2f981d08c6d472be94f6e12f6f2f3002c466fe1cd014f13754a2793ef97367f280b49220c41bdf5bfbbc8a901948446a40bd0f837d9ffd4f0a5214b425fd1c396913e0dbbea8445f79b72548e3672078ec8485fd4f4f88fa0444731bcbe3344d9cb70d89f122da486f1ccc57435439191a31946a013da68c96bf0f4c684299e1ba513f1da87024fbc0d39585f48ff820e87af594f6ebd21b8daeafa772b2a98c59500952e164e5b5036bd81a4ca2e0ee724f07c707b60ad1a0c76382298c512fdba2ee9ef065c37b220daf16ac9a94c8f8a81834e47a2af9087ab8527fc0c4eca4df1e1d9ce17c41f0dec9858993bc831e8f0f54f82a4c600261dd78ea6eee52db5e2e9b54cd58ad0fcfb42026e9285fc32035f506cb3955854ab35a8d327536f3280fd8f2a216c47312b338a9d187d3e8952f8766df8ee11a84cdcdc9055d02dbe5dac1e25ee1d2c7ba4c2c5707b82af56e477c9911298b21f9d08adac2235c483fae13fb1dc8ec69881199a246fddd65231d1c80e7e0ea2a3ce025df1316e4c7ff0f062e8c33e7961d7147985c893a2594f2e957c71f3f940bba7bd7b8e650f62172b35eefd9a582df080e454ac17aa1ca37ad2db6dadc034cfb345df06bbfc30f883acebdb3fe929c54dcfc18cfeacb6248293312a7f8abc07d9b78cbd58629c4808f06ede4d1e2fc2d01325103c22ef4216c6edbf7191ac3d3673acc147193a5c4aaec2c6e7d0dc04c83091ccdeb692d79e55d8ee931116a2c1b3262b7a067a5c796cd7f9a49fb7e6f11e8ddfb549e6a50fa75e6192f24ae96d0bbdcb6721627019efc91719c22c57fa4531fa61e70ee9cddec3d7f1d9eea8d75e31f14e7c312770e500bd0be8202283fba0ac4e8c3475b7f27ec541c8ee2c60b0d09387d92f743e1385f43dca7b5ccfa6d237e57a1d7838da52cdc3d39abd19744b595f24e066fb0919c2699f7ba539ee3f831d3d57c1fc202e7eadde9f6fbd3f179985d31ae5328cf07fe4af8cfa33f89970a85f1577a8978754a49bda1e9bd1f96fa8a3b0a80f19a580e68cb4045722b70ebbe011f59777ad808728091a4a0b4dbdd5c12384603d15390fb85f2dd1f091bba86c19a6dcb61f7fe0f44704275105a4ba88d57cc694b200a0b3fc080d8b6c62baf497fdaac11f779a3c3b3d1efd1adc99f33bc88eddcf2280a0eed331f647760d402267bf9c848f173fd003e69134271817d9f89f1aa45ea8fec520bb45e0b7fd807f9077ed98a615508355db6722f41b710d21f4d213eb1c82e421b70dc94dd2013c17eaac1c6415d6075829500ca26593d7c9865eb87ffa3f786d7289ffce08b61968209c2ba274792c7442d6006547912848f1bdfcad35465fb8f9e1aef57fd804ecbd410b0f22986d9f583529f7bd285015ea916ab5ce0672fe98219a9d1201f2ef4d8b8b997a27386bc1d2a11c1e2e074d2b767537e8a51899fe9ea75557e2649e573b9ac30944781273b1074da7e9649d53b8914f590ac984c3f8ee044170bd681007cf219b5ccbc5cf9a48b4d5474c90fe199f5c95ba0f1b40340d56ff8935429f6c8d30c42cee2556eeb78e9f379c6d0682637c5fe344a834786e02ddbaff685e7809476fbf9196e3d1715ace67ecf8fd5fd73d35cd3784745946d83e02261cd95343b6ed576c512d64d9207f448145f7b3b32626323e01ad6b5a6e99747da5985a36ba49d8e85fbba48b4e4a39dd8a4d2149279a94abb07ff3825ef17c06d03b70733e662372c069ca7536de9f4c3300333548c9ade53d362a7d0f71da9088e04d6f2e8958b38c72e37af9b1f268fde8574de538f5cc7259f155be5975fff36d59e523167804c5d916382d2872d7a72b57bb8f62964ebc0b0d21afaccd611d34db0d35eb33295556cd5896a7f228bc71b588a5ae5f6122e87698f4a4e73ce4189baa2674aed449168de1e318230da58fa4a59ce9135ac015f89a6ffaa8ee692316024460a6f76c094a1d188bb337b60d0078aa0b6bc7af1240442c5f565587ba1cc77169610a56819f25d0cb69daa4ea9885c467cc3aae5764ead66091ac40e28c32ca66063614a2d1827286737d1cb04ca8dfb91f09a3959c6c78cec9da5567d5c75e882dfa772792e79dd00eae0bb25f5b9fb15a4529ce330857480ab736df2c974b1ed0f61e9d32dcd2a3499426e798cd696e01c6361662b173afdb5a998a1409c26e657a1f485a669d5f71bee1a159f72a6976310eb7781bb8053d6f84e83656ee17c02596e12504eed7fce34bae9f90db4c5e31b176f15a6a98aae166380d5f02dce6bb32f59992b722ac24686a8dd382db9d38d2e7cde349d58cc154e11a67aed16135ce712d4642496f463221c4655b4f3a2bbb64e74e6e99391b47bdcc221406c72187396b0519739bf743a159796d3b788c5a8a9ee6255a00bc6a1177d959e145e1918d1ef37a0e0d0ea2c345f892bdaabe7a8d00e4602d75ebcb84c984189f4aa5fd7506f72ad0abb2d7a54f130d2bbfa26ec06e7b159ff61b776ef60638f71dab629e9753779bc950aeea8242cd8d4ce29389e7a1665710ef3c711e530732565171ea91a0fbbd8d55a7cac34b94670a25fa02dab968196651fa6224886d4ddc369ac93caeea5741707fc82d7f208c0cfd6bc15e3476b96875c3891dbe1a340fdaa494f1eb1c6d0198d9bd85f297f8995915344b57ec3d129f81b25fa0fa0ae06301e92ffb1bccad23fcbc9ca9da45202d30dba2dce31faa7c7b1d3f0a409e689f7288bd7df660b1f59cfd3671d06377ea1a0dd25fba00b0800fef4b7fee0c0fb192e87c720e4867a63c1ec704c27d3c06078a277efe22ec7631c8d59a6939a516b7c4aa296013552be8cc0d638f7466f9c84dc933467136337ce47cc07c7e261633fdf64f368f7a9b060ff4ba7e0521cc02d7896dc419380a333b2d5cb8d3c36185751c5a27e9c42daf8919ee0c264bf9f71e471a7fb587d2bd7d9221c3b251815d8cfa688966b7720449bdb439c78305f4cdd183f6f50e784f9c6f789e01821b8aae9e30d7c05d9f5d6c46772c2bfa35f11746659ae7c7ab12edc74850fd62b8a16f9ae8a76dec0440ebb97a0a603bef1a8a04d7f0492c321c23038ac19a6ab71e55d081a4dff2f61b0aae0a469ed02a1673d328169142283d9a5c494ec72eaadfa3a09982562518ea8dc2ce5b8b44d2a950cbb6478b09bc87567675e623a30a8724c069c85d692ea7f62e30e9a365607b9f0308b2a92eace9b4fe117a56a5fe232352d2a6e27889e4c65dd9fbe4fa8090c2e41ba9373bd4bc7dd94eabb3f6b34911db037bd127dadd8933c01a53824dee96597c879dc58fb2691d228d56dc497f0e0571eb2b785f880c809f5d8364b051bbf810088f722ed10a5ff6ab5762f5a49c21591fb045bd62d1ef2cf5dae4259572400487e8af9a006bcf5db9727d6c2082b83223183d6f65e6395baf6b135ccb7c28f3021dbfd666656426c7e696d6b84738ef2f31b9ac0a39923406ce97d6887c9a574b0d45c68f38c8c83e567974bf085eef85282a1be5b38ce431e81033df2b0b8cc694f5b6db4a3ebcd93bfe56cbc94bd772f4bf067923f050bb0650d3d629f1a37972d9d44bd6f06ecf5232e7e9391cf97974aecb9a2026de74e240bffc05830cd35762786920464be5fba68d690d34e26400ed77e37382abbbe7c9fe4d6090c926584759a3a3239d09bf6a3a0288bfc98fecc9ae5bbfdc9c96e440948738314be3215ee543f4cd0d0d7399a8be480b3e9f732a883ed5b4ce0bdd1365dd2df9e57247ba88e8803e9800c93c799ab1dc77ee5c165f132a59cb83f56c748a67ad27f7bafafaecf817fd1df0ec60e9c5e4a269b98fb4201429adee5aec9b9499cb2fd43dba093869a2203598ea227516bd6217a89ca332c5aff4e4389c6a9c057df9c75cc34d09ad0bede1a4a0b1a37a13a2eaa299369294b4492d052b18d0c0914c20af26db297caec1eb15cd6f39b6bb96837c78f4eef9e1470d9f7c495bcc51338abbacdc65f6697595938d20639c9f155308704d063bfea1c73ade4fee24c38c7d6dcd74de69e968df5ef241230dda59268f86ef4fc1d40d406f2fe5d905917272be89b36349c146f34cd273c7da0ad83e6bab33bb91ceb8f1f8042a6b9263a475db57d70618146081f2906c87a82165b69a2288021c4048eb83072b0ff42e5415a3dbc8b8204ce712503edb728fd99843600a73077d97658082b13e2ce1d5fd31dbe860be801ac50551408127c5e2ead019eb1ceb1796a80b29be8f94c51b355ab73", @ANYRES16, @ANYRESHEX=r4], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x17, r4, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000040)={0x0, 0xffffffff}, 0x10}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r5, 0x18000000000002a0, 0xe, 0x0, &(0x7f0000000780)="b9ff03076003008c9c18ed0f6fd2", 0x0, 0xfe6, 0x60000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0xd, &(0x7f0000000240)=ANY=[@ANYRES32=r0, @ANYRES16=r5, @ANYRESDEC], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x24}, 0x94) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r6, &(0x7f0000e79000)=[{&(0x7f00003fb000)="f7", 0x1}], 0x1, 0x8) mremap(&(0x7f000020e000/0x2000)=nil, 0x2000, 0x400000, 0x3, &(0x7f000082a000/0x400000)=nil) mbind(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1, 0x0, 0x0, 0x2) syz_usb_connect(0x3, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000062a10b40450c1010fce60102030109021b00010000000009043200019740a40009058203ff"], 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read$char_usb(r7, &(0x7f0000000a80)=""/188, 0xba) 12m14.893487889s ago: executing program 3 (id=171): r0 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0x0) ftruncate(r0, 0x51a9497) r1 = socket$inet_tcp(0x2, 0x1, 0x0) io_submit(0x0, 0x1, &(0x7f0000000340)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0xe, 0xffffffffffffffff, &(0x7f00000000c0)='-5', 0x2, 0x0, 0x0, 0x4}]) setsockopt$inet_tcp_int(r1, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000200)={0x0, 0xffffffffffffffa4, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f00000012c0)={r5, 0x2, 0x7fff, 0x0, 0x0, [0x0], [0x2, 0x0, 0x0, 0x1], [0x59, 0x4, 0xffffeffe, 0x5ec], [0x0, 0x0, 0x0, 0x1]}) sendmsg$NFT_BATCH(r0, &(0x7f0000000f00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000900)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELOBJ={0x4c, 0x14, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x224, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x5b, 0x6, "59de22e6a18714817c669abb8ede42d0c2a11ad7cef06c33628160a357db41a1a80ee70fb35ef9a4534a4e6afc5f609e5c1cbb35df01ba87b34bd63a0e3f9573832af7dc6f1a5a1bf77eed3c545b049d317c3299f984fc"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x7b, 0x6, "e7c5ad8a35c19d7929faa6df80663e66264145ef1360cc48a31a488ff1630feabac9908b9029d9c4e245529ca926a4cfdf64a2def042b9c056b8afc75aa27cd310734ef62b00eca1d54d1232665ed7ef09c838bb63d5f839de65d3757cc2afa054ff6a8f3c1f6f7333a2fbec0f99dd1509b2479f70c7e9"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x7}, @NFTA_TABLE_USERDATA={0xeb, 0x6, "f37ae1e313ec0618821aef177d7e1e7124fd0d827d441729186c39e2d78b4d4cd57034a659b4b85ca2d0fbcfba1de17a4bab69d8a47cb3e6297a187a986d4dff9381e1279b814d06b52e5089feee224c023301da979cf1cdc1e795f9a6aa9a865174411376c592353cd8d30c17fca05e83ef464ab81f6b3f50a27775959d7adf50c285e353fbd2df4ad45049ee1f535fd08c4315a721e0f90f445564e1aeb118523cd1f3b6c52b9d87190a884be96dcc183c70482646c15d994b25180ddfc4d125b5c8ae9603db6385fed6e4dabee0065fcf162aaa8f27a3b917ead64ede2a44731ed02585c4bd"}]}, @NFT_MSG_NEWFLOWTABLE={0x28, 0x16, 0xa, 0x301, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x50, 0x8, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}]}, @NFTA_RULE_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x11c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0xf0, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'virt_wifi0\x00'}, {0x14, 0x1, 'pim6reg\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}, {0x14, 0x1, 'bond_slave_0\x00'}, {0x14, 0x1, 'macvlan0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'macsec0\x00'}, {0x14, 0x1, 'rose0\x00'}, {0x14, 0x1, 'veth0_virt_wifi\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syz_tun\x00'}, {0x14, 0x1, 'ip_vti0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELCHAIN={0x34, 0x5, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x130, 0x16, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK={0xdc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pimreg1\x00'}, {0x14, 0x1, 'ip6tnl0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'batadv_slave_0\x00'}, {0x14, 0x1, 'ip_vti0\x00'}, {0x14, 0x1, 'bridge_slave_0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vxcan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'macsec0\x00'}, {0x14, 0x1, 'veth1_to_bridge\x00'}]}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x590}, 0x1, 0x0, 0x0, 0x4001}, 0x4004801) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x278, 0xffffffff, 0x1b8, 0xf8, 0x0, 0xffffffff, 0xffffffff, 0x290, 0x290, 0x290, 0xffffffff, 0x4, 0x0, {[{{@ip={@loopback, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {0xff}, {}, 0x11, 0x0, 0x28}, 0x0, 0x70, 0x98, 0x0, {0x100000000000000}}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r7, 0x560a, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x800, 0x6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000440)={r6, 0x80000}) sendmsg$IPSET_CMD_GET_BYINDEX(r0, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x44, 0xf, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x6}, [@IPSET_ATTR_INDEX={0x6, 0xb, 0x4}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x4}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x20000010) 12m14.753938423s ago: executing program 32 (id=171): r0 = memfd_secret(0x80000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa, 0x11, r0, 0x0) ftruncate(r0, 0x51a9497) r1 = socket$inet_tcp(0x2, 0x1, 0x0) io_submit(0x0, 0x1, &(0x7f0000000340)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0xe, 0xffffffffffffffff, &(0x7f00000000c0)='-5', 0x2, 0x0, 0x0, 0x4}]) setsockopt$inet_tcp_int(r1, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x0, 0x8031, 0xffffffffffffffff, 0x0) close_range(r2, 0xffffffffffffffff, 0x0) r3 = syz_open_dev$dri(&(0x7f00000008c0), 0xd21, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f00000001c0)={0x0, &(0x7f00000000c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f0000000200)={0x0, 0xffffffffffffffa4, r4, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(r3, 0xc06864ce, &(0x7f00000012c0)={r5, 0x2, 0x7fff, 0x0, 0x0, [0x0], [0x2, 0x0, 0x0, 0x1], [0x59, 0x4, 0xffffeffe, 0x5ec], [0x0, 0x0, 0x0, 0x1]}) sendmsg$NFT_BATCH(r0, &(0x7f0000000f00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000ec0)={&(0x7f0000000900)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_DELOBJ={0x4c, 0x14, 0xa, 0x201, 0x0, 0x0, {0x3, 0x0, 0x5}, [@NFTA_OBJ_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x6}, @NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x5}, @NFTA_OBJ_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWTABLE={0x224, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0xa}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x5b, 0x6, "59de22e6a18714817c669abb8ede42d0c2a11ad7cef06c33628160a357db41a1a80ee70fb35ef9a4534a4e6afc5f609e5c1cbb35df01ba87b34bd63a0e3f9573832af7dc6f1a5a1bf77eed3c545b049d317c3299f984fc"}, @NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x4}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_TABLE_USERDATA={0x7b, 0x6, "e7c5ad8a35c19d7929faa6df80663e66264145ef1360cc48a31a488ff1630feabac9908b9029d9c4e245529ca926a4cfdf64a2def042b9c056b8afc75aa27cd310734ef62b00eca1d54d1232665ed7ef09c838bb63d5f839de65d3757cc2afa054ff6a8f3c1f6f7333a2fbec0f99dd1509b2479f70c7e9"}, @NFTA_TABLE_FLAGS={0x8, 0x2, 0x1, 0x0, 0x7}, @NFTA_TABLE_USERDATA={0xeb, 0x6, "f37ae1e313ec0618821aef177d7e1e7124fd0d827d441729186c39e2d78b4d4cd57034a659b4b85ca2d0fbcfba1de17a4bab69d8a47cb3e6297a187a986d4dff9381e1279b814d06b52e5089feee224c023301da979cf1cdc1e795f9a6aa9a865174411376c592353cd8d30c17fca05e83ef464ab81f6b3f50a27775959d7adf50c285e353fbd2df4ad45049ee1f535fd08c4315a721e0f90f445564e1aeb118523cd1f3b6c52b9d87190a884be96dcc183c70482646c15d994b25180ddfc4d125b5c8ae9603db6385fed6e4dabee0065fcf162aaa8f27a3b917ead64ede2a44731ed02585c4bd"}]}, @NFT_MSG_NEWFLOWTABLE={0x28, 0x16, 0xa, 0x301, 0x0, 0x0, {0x5, 0x0, 0xa}, [@NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz2\x00'}]}, @NFT_MSG_DELRULE={0x50, 0x8, 0xa, 0x801, 0x0, 0x0, {0x0, 0x0, 0x8}, [@NFTA_RULE_ID={0x8, 0x9, 0x1, 0x0, 0x3}, @NFTA_RULE_POSITION={0xc, 0x6, 0x1, 0x0, 0x3}, @NFTA_RULE_COMPAT={0x14, 0x5, 0x0, 0x1, [@NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_RULE_COMPAT_FLAGS={0x8, 0x2, 0x1, 0x0, 0x2}]}, @NFTA_RULE_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELFLOWTABLE={0x11c, 0x18, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x3}, [@NFTA_FLOWTABLE_HOOK={0xf0, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x68, 0x3, 0x0, 0x1, [{0x14, 0x1, 'virt_wifi0\x00'}, {0x14, 0x1, 'pim6reg\x00'}, {0x14, 0x1, 'veth1_to_bond\x00'}, {0x14, 0x1, 'bond_slave_0\x00'}, {0x14, 0x1, 'macvlan0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'macsec0\x00'}, {0x14, 0x1, 'rose0\x00'}, {0x14, 0x1, 'veth0_virt_wifi\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'syz_tun\x00'}, {0x14, 0x1, 'ip_vti0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}]}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_DELCHAIN={0x34, 0x5, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}, [@NFTA_CHAIN_TYPE={0xb, 0x7, 'filter\x00'}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x130, 0x16, 0xa, 0x201, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_HOOK={0xdc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'pimreg1\x00'}, {0x14, 0x1, 'ip6tnl0\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x40, 0x3, 0x0, 0x1, [{0x14, 0x1, 'batadv_slave_0\x00'}, {0x14, 0x1, 'ip_vti0\x00'}, {0x14, 0x1, 'bridge_slave_0\x00'}]}, @NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'vxcan1\x00'}]}, @NFTA_FLOWTABLE_HOOK_DEVS={0x2c, 0x3, 0x0, 0x1, [{0x14, 0x1, 'macsec0\x00'}, {0x14, 0x1, 'veth1_to_bridge\x00'}]}]}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x2}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_FLOWTABLE_FLAGS={0x8}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x590}, 0x1, 0x0, 0x0, 0x4001}, 0x4004801) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@filter={'filter\x00', 0x42, 0x4, 0x278, 0xffffffff, 0x1b8, 0xf8, 0x0, 0xffffffff, 0xffffffff, 0x290, 0x290, 0x290, 0xffffffff, 0x4, 0x0, {[{{@ip={@loopback, @loopback, 0x0, 0x0, 'veth0_to_batadv\x00', 'wlan0\x00', {0xff}, {}, 0x11, 0x0, 0x28}, 0x0, 0x70, 0x98, 0x0, {0x100000000000000}}, @REJECT={0x28}}, {{@uncond, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x8}}}, {{@uncond, 0x0, 0x70, 0xb0}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2d8) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r7, 0x560a, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x6, 0x800, 0x6}) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(r3, 0xc00c642d, &(0x7f0000000440)={r6, 0x80000}) sendmsg$IPSET_CMD_GET_BYINDEX(r0, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000280)={&(0x7f0000000140)={0x44, 0xf, 0x6, 0x801, 0x0, 0x0, {0x3, 0x0, 0x6}, [@IPSET_ATTR_INDEX={0x6, 0xb, 0x4}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x4}, @IPSET_ATTR_INDEX={0x6}, @IPSET_ATTR_INDEX={0x6, 0xb, 0x3}]}, 0x44}, 0x1, 0x0, 0x0, 0x50}, 0x20000010) 11m54.388379944s ago: executing program 4 (id=249): timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) pipe(&(0x7f00000001c0)) fsopen(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) r4 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0x8a5, 0x92, 0x1, 0x2, 0xd59f80, 0x19ef, 0x5, 0x19ef, 0x3, 0x4, 0x27ff, 0x2800, 0x2, 0xbb6, 0x0, 0x13, {0x8, 0xfffffffb}, 0xd0, 0x9}}) connect$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r5 = fcntl$dupfd(r3, 0x406, r3) write$binfmt_elf64(r5, &(0x7f00000004c0)=ANY=[], 0xfffffdcf) 11m53.2870867s ago: executing program 4 (id=252): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x1, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0xc0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x0, &(0x7f0000000180)=0x4, 0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0x0) r3 = openat$cgroup_subtree(r2, &(0x7f00000006c0), 0x2, 0x0) syz_open_procfs$pagemap(0x0, &(0x7f0000000500)) r4 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000340), 0x2440, 0x0) ioctl$PTP_EXTTS_REQUEST2(r4, 0xc4c03d12, &(0x7f0000000040)={0x5, 0x4}) write$cgroup_subtree(r3, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r3, &(0x7f0000000040)={[{0x2b, 'cpu'}]}, 0x5) setreuid(0xee00, 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x181c82, 0x0) write$sequencer(r5, 0x0, 0x0) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r2, 0x6, 0x16, &(0x7f0000000200)=[@timestamp, @timestamp], 0x2) socket$inet(0x2, 0x1, 0x0) syz_emit_ethernet(0x36, &(0x7f0000001800)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, @local, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x28, 0x64, 0x4000, 0x4, 0x2, 0x0, @empty, @multicast2}, @timestamp_reply={0x11, 0x0, 0x0, 0xe000, 0x2, 0x10001}}}}}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000400)=ANY=[@ANYRES32, @ANYBLOB='\x00'/10, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/11], 0x50) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) accept4(r6, 0x0, 0x0, 0x800) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x103, 0xfffb, &(0x7f0000000000)) 11m52.583207178s ago: executing program 4 (id=253): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000000)=ANY=[@ANYBLOB="8fedcb7907001175f37538e486dd637f4b22667f2f00db5b686158bbcfe8875a65969ff57b00000000000000000000000000ac"], 0xfdef) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0xc, 0x8, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000000000000000000000000000018020000", @ANYRES32=r0, @ANYBLOB="0000000000000000b703000000000000850000000d000000b70000000000000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400002}, 0x94) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffff7f}]}) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) listen(r4, 0x9) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) r6 = socket$vsock_stream(0x28, 0x1, 0x0) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) connect$vsock_stream(r6, &(0x7f0000000640)={0x28, 0x0, 0x2710}, 0x10) close_range(r3, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_GET_STATION(r2, &(0x7f0000000200)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="9000002e911dc0e00f9c26fd00", @ANYRES16=0x0, @ANYBLOB="020527bd7000fddbdf25110000000c00990002000000420000000600ed008d03000006001a01020000000500740003000000050074000200000006001000340600000500190002000000210013009883a486840501180b30e08081a42430a405b389128204b0c8600983ec0000000a000600080211000000000006001200040000000500e40000000000"], 0x90}, 0x1, 0x0, 0x0, 0x50}, 0x4044801) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r1, 0x3e8, 0xe80, 0x0, &(0x7f0000000000)="c1df07000000d30a298ee68886dd87", 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 11m52.51520829s ago: executing program 4 (id=255): r0 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$VIDIOC_SUBDEV_S_EDID(r0, 0xc0285628, &(0x7f00000001c0)={0x3, 0x1, 0x0, '\x00', 0x0}) r1 = openat$procfs(0xffffffffffffff9c, &(0x7f00000022c0)='/proc/sysvipc/msg\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x81899, 0x0) mount$bind(&(0x7f0000000080)='./file0/file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000600)=ANY=[@ANYBLOB="200000002f00090027bd700000000000040000000c0016"], 0x20}, 0x1, 0x0, 0x0, 0x42804}, 0x84) ioctl$DVB_DEMUX_DMX_GET_STC(r1, 0xc0106f32, &(0x7f0000000140)={0x100}) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000100), 0x20000, 0x0) r3 = getpid() sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) syz_pidfd_open(r3, 0x0) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000400)='\x00', 0x9901) bind$bt_rfcomm(r4, &(0x7f0000000180)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x1}, 0xa) pselect6(0x40, &(0x7f0000000080)={0x7, 0x101, 0xa, 0x7fff, 0x1, 0x0, 0xf, 0x1}, 0x0, 0x0, 0x0, 0x0) 11m51.558279099s ago: executing program 4 (id=261): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt(r0, 0xff, 0x7f, &(0x7f0000000000)='|>\fV', 0x4) r1 = socket$netlink(0x10, 0x3, 0x15) preadv2(r1, &(0x7f0000000180)=[{&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000080)=""/46, 0x2e}, {&(0x7f00000000c0)=""/131, 0x83}], 0x3, 0x1, 0x6, 0xe) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000100)={0x7, {0xbe, 0x82c, 0xfc8}}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r6 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r6, 0x1000006) fcntl$addseals(r6, 0x409, 0x7) ioctl$UDMABUF_CREATE(r5, 0x40187542, &(0x7f0000000000)={r6, 0x0, 0x0, 0x1000000}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r7 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r7, &(0x7f0000000680)={0x2020}, 0x2020) sendmsg$nl_route(r2, 0x0, 0x44004) 11m51.118563834s ago: executing program 4 (id=262): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt(r0, 0xff, 0x7f, &(0x7f0000000000)='|>\fV', 0x4) r1 = socket$netlink(0x10, 0x3, 0x15) preadv2(r1, &(0x7f0000000180)=[{&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000080)=""/46, 0x2e}, {&(0x7f00000000c0)=""/131, 0x83}], 0x3, 0x1, 0x6, 0xe) socket$nl_route(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000100)={0x7, {0xbe, 0x82c, 0xfc8}}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r5, 0x1000006) fcntl$addseals(r5, 0x409, 0x7) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x0, 0x1000000}) ioctl$DMA_BUF_IOCTL_SYNC(r6, 0x40086200, &(0x7f0000000580)=0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') 11m51.082399749s ago: executing program 33 (id=262): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt(r0, 0xff, 0x7f, &(0x7f0000000000)='|>\fV', 0x4) r1 = socket$netlink(0x10, 0x3, 0x15) preadv2(r1, &(0x7f0000000180)=[{&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000080)=""/46, 0x2e}, {&(0x7f00000000c0)=""/131, 0x83}], 0x3, 0x1, 0x6, 0xe) socket$nl_route(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r2 = socket(0x10, 0x3, 0x0) write(r2, &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000100)={0x7, {0xbe, 0x82c, 0xfc8}}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r5, 0x1000006) fcntl$addseals(r5, 0x409, 0x7) r6 = ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x0, 0x1000000}) ioctl$DMA_BUF_IOCTL_SYNC(r6, 0x40086200, &(0x7f0000000580)=0x1) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') 5m30.837510064s ago: executing program 2 (id=2087): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_GUEST_MEMFD(r1, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r2, 0x0) 5m30.523420805s ago: executing program 2 (id=2088): socket$nl_generic(0x10, 0x3, 0x10) r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x6b2201) mmap(&(0x7f00005b9000/0x1000)=nil, 0x1000, 0x1000003, 0x11012, r0, 0x68255000) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000300)=""/166) socket$key(0xf, 0x3, 0x2) prctl$PR_SET_MM(0x23, 0x6, &(0x7f0000ffc000/0x4000)=nil) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000200)={0x2, 0x4e20, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000000)={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x1b}}, 0x10) 5m29.663195344s ago: executing program 2 (id=2092): openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xcfa42, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xaf9ba000) r0 = syz_open_dev$evdev(&(0x7f0000000180), 0x8000002, 0x0) readv(r0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000080)=""/54, 0x36}], 0x2) 5m28.633217768s ago: executing program 2 (id=2098): syz_open_dev$hidraw(&(0x7f0000000000), 0x64, 0x40140) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000680), 0x40040, 0x0) r1 = openat$cdrom(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000600)={0x20, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ee}, 0x94) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000200)={0x6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000100)={0x5, 0xe, 0x3, 0x8}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x1}, 0x94) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x100, 0x100, 0x9, 0x1, 0x1}, 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000000), &(0x7f00000002c0), 0x8, r2}, 0x38) bpf$MAP_LOOKUP_BATCH(0x1b, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000100), 0x0, 0x3, r2}, 0x38) mkdirat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f00000000c0)='./file0/../file0/file0\x00', &(0x7f0000000100)='./file0/../file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000040)='./file0\x00', &(0x7f00000001c0)='./file0\x00', 0x0, 0x18d883, 0x0) mount$bind(&(0x7f0000000240)='.\x00', &(0x7f0000000280)='./file0\x00', 0x0, 0x1005848, 0x0) ioctl$CDROMVOLCTRL(r1, 0x30d, &(0x7f0000000340)={0x23, 0x5, 0xc, 0x87}) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCCONS(r3, 0x541d) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x80000000000, 0x4, 0xfffffffffffff30a, 0x7852, 0xfffffffffffffffe}, &(0x7f0000000000)={0x1f, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfff7fffffffffffe, 0x9}, 0x0, 0x0, 0x0) r4 = accept4(0xffffffffffffffff, &(0x7f0000000040)=@nfc, &(0x7f00000000c0)=0x80, 0x0) ioctl$sock_SIOCOUTQNSD(r4, 0x894b, &(0x7f0000000140)) socket$inet_sctp(0x2, 0x1, 0x84) 5m27.922847001s ago: executing program 2 (id=2101): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x3, 0x3, &(0x7f0000000000)=@framed={{0xc3, 0xa, 0xa, 0xfe00, 0xa0, 0x71, 0x10, 0x4c}}, &(0x7f0000000480)='syzkaller\x00'}, 0x80) 5m27.501153368s ago: executing program 2 (id=2106): openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xcfa42, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xaf9ba000) r0 = syz_open_dev$evdev(&(0x7f0000000180), 0x8000002, 0x0) readv(r0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000080)=""/54, 0x36}], 0x2) 5m27.411537879s ago: executing program 34 (id=2106): openat$nullb(0xffffffffffffff9c, &(0x7f0000000100), 0xcfa42, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xaf9ba000) r0 = syz_open_dev$evdev(&(0x7f0000000180), 0x8000002, 0x0) readv(r0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000080)=""/54, 0x36}], 0x2) 4m52.710879721s ago: executing program 6 (id=2226): r0 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000440)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd21, 0xfbffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_fq_codel={{0xd}, {0x4}}]}, 0x38}}, 0x400) sendmsg$nl_route_sched(r3, &(0x7f0000000580)={0x0, 0x0, &(0x7f00000006c0)={&(0x7f00000005c0)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r4, {0xfff2, 0xf}, {}, {0x7, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x5, 0x92, 0x5, 0x7, 0xfffffffc}, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x3}}}}]}]}}]}, 0x84}}, 0x4800) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$inet6(0xa, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x7}}) r6 = socket$kcm(0x11, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r6, &(0x7f0000000500)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x3f}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000180)='\r', 0x1}], 0x1}, 0x4) 4m51.869296536s ago: executing program 6 (id=2233): r0 = socket$igmp6(0xa, 0x3, 0x2) setsockopt(r0, 0xff, 0x7f, &(0x7f0000000000), 0x0) r1 = socket$netlink(0x10, 0x3, 0x15) preadv2(r1, &(0x7f0000000180)=[{&(0x7f0000000040)=""/37, 0x25}, {&(0x7f0000000080)=""/46, 0x2e}, {&(0x7f00000000c0)=""/131, 0x83}], 0x3, 0x1, 0x6, 0xe) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$DEVLINK_CMD_RELOAD(0xffffffffffffffff, 0x0, 0x30) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000200), 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) ioctl$VIDIOC_S_CROP(0xffffffffffffffff, 0x4014563c, &(0x7f0000000100)={0x7, {0xbe, 0x82c, 0xfc8}}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r3 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r4 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r5 = memfd_create(&(0x7f0000000080)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea\x7f\x8cZ7`_4t\xcda\x9b\x11\x11\x0e\xa1\xcf\x00'/51, 0x2) ftruncate(r5, 0x1000006) fcntl$addseals(r5, 0x409, 0x7) ioctl$UDMABUF_CREATE(r4, 0x40187542, &(0x7f0000000000)={r5, 0x0, 0x0, 0x1000000}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee7, 0x8031, 0xffffffffffffffff, 0x0) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000006100)='cmdline\x00') read$FUSE(r6, &(0x7f0000000680)={0x2020}, 0x2020) sendmsg$nl_route(r2, 0x0, 0x44004) 4m48.71008389s ago: executing program 6 (id=2238): pipe(&(0x7f00000001c0)) fsopen(0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x11, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000100)='syzkaller\x00', 0x2, 0xaf, &(0x7f0000000140)=""/175, 0x41100, 0x23, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3a}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x87}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000000002) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000400)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000e00)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) add_key$user(&(0x7f0000000000), &(0x7f00000001c0)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) add_key$user(&(0x7f00000003c0), 0x0, 0x0, 0x0, 0xfffffffffffffffd) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r3, &(0x7f0000000500)={0xa, 0x4e20, 0xbb6, @loopback, 0x5}, 0x28) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_SET_PES_FILTER(r4, 0x40146f2c, &(0x7f00000000c0)={0x1, 0x0, 0x3, 0x13, 0x4}) r5 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r5, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r5, 0xc0845657, &(0x7f0000000200)={0x0, @bt={0x8a5, 0x92, 0x1, 0x2, 0xd59f80, 0x19ef, 0x5, 0x19ef, 0x3, 0x4, 0x27ff, 0x2800, 0x2, 0xbb6, 0x0, 0x13, {0x8, 0xfffffffb}, 0xd0, 0x9}}) connect$inet6(r3, &(0x7f0000000480)={0xa, 0x4e20, 0x9, @loopback, 0x106}, 0x1c) setsockopt(0xffffffffffffffff, 0x0, 0x5, 0x0, 0x0) r6 = fcntl$dupfd(r3, 0x406, r3) write$binfmt_elf64(r6, &(0x7f00000004c0)=ANY=[], 0xfffffdcf) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) 4m47.53767123s ago: executing program 6 (id=2243): syz_open_dev$tty1(0xc, 0x4, 0x4) r0 = io_uring_setup(0x664b, &(0x7f0000000500)={0x0, 0x5e87, 0x0, 0x0, 0x337}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r1, &(0x7f0000000380)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f0000000340)={&(0x7f0000000300)={0x30, r2, 0x8, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r3}, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "00dfaffe03c7cec198d683db41dc6870"}]}, 0x30}}, 0x8040040) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000000c0)=0xf) r5 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x1ea1e2) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/pm_freeze_timeout', 0x68a41, 0x3) ioctl$LOOP_CONFIGURE(r5, 0x4c0a, &(0x7f0000000080)={r6, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0xa, 0x0, "faf98357e5a1149989fc8dbec3bd02b82a128bbad0099cebdc25f5abb534464c516bdd8a0f3500", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237641a8ccf162e43ac61f700000000009b4100000200", [0x9, 0xa]}}) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000004180)=@newtaction={0x488, 0x30, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [{0x474, 0x1, [@m_police={0x470, 0x1, 0x0, 0x0, {{0xb}, {0x444, 0x2, 0x0, 0x1, [[@TCA_POLICE_RATE={0x404, 0x2, [0x101, 0x1000, 0x800, 0x5ff, 0xfff, 0x7fff, 0x3a9a, 0xfff, 0xfffffffa, 0x6, 0x2, 0x8001, 0xdc, 0x1, 0x8, 0x4, 0x3, 0x5242, 0x0, 0x114e, 0x9, 0x6, 0x101, 0x3, 0xff, 0x7ff, 0xfffffffb, 0x80000000, 0x6177d997, 0xb63b8771, 0x1, 0xc, 0x1, 0x123a9273, 0x4, 0xff, 0x5, 0x100, 0x6, 0x5, 0x6, 0x4, 0x20, 0x4, 0x0, 0x9, 0x7ff, 0x3, 0x1, 0x7, 0x7, 0xd, 0xfffffffd, 0x7, 0x488, 0xc, 0xf74d, 0x8, 0x3d, 0x401, 0x5, 0x1, 0x7ff, 0x3, 0x9, 0xc, 0x3ff, 0x4139df5d, 0x9, 0xfffffff7, 0x1, 0x2, 0x1, 0x8f2c, 0x8000, 0x0, 0x2, 0x100, 0x66, 0x3, 0x5, 0x2, 0x200, 0x9, 0x76, 0x4, 0x10001, 0x4, 0x9, 0xe, 0x0, 0xf9, 0x9, 0x4ade, 0x3, 0x4000008, 0x4, 0xff, 0x0, 0x1, 0x800, 0x2bc, 0xffff, 0x7fff, 0x3b0a, 0x2, 0x0, 0x3, 0x200, 0x2, 0x9, 0x6, 0x9, 0x4, 0xc34d, 0x80000000, 0x50, 0x8, 0x0, 0xe, 0x6, 0x4, 0x4, 0x3, 0xe256, 0x80000000, 0xb, 0x7, 0x3, 0x5, 0x7, 0x5, 0x6, 0x6, 0x200, 0x7, 0xffffffff, 0x2, 0x5, 0xce3, 0x10c, 0x8000, 0x8, 0x6, 0x2, 0x7ff, 0x5, 0x6, 0xaa, 0x8, 0x1, 0x8, 0x4, 0x9, 0x3000, 0x3ff, 0x7, 0x40, 0x1, 0x4, 0x0, 0x8, 0x10000, 0x8, 0x7, 0x3, 0x417, 0x7fff, 0x6, 0x3, 0x7, 0x5, 0x2, 0x5, 0x9, 0x1, 0x0, 0x7, 0x5, 0x7, 0x0, 0x80000001, 0x10000, 0x6, 0xfff, 0x5e, 0x7fff, 0x6, 0xa159, 0x4, 0x1, 0x7, 0x4, 0x2, 0x8, 0x80, 0xfffffffc, 0x9e, 0x61aa91f9, 0x7, 0x81, 0xffff21e7, 0x4, 0x6, 0x7, 0x5, 0x3, 0x4ea, 0xfffffffd, 0x6d1, 0x8, 0x5, 0x6, 0x3, 0x6, 0x8, 0xfffffffb, 0x8, 0x1, 0xffff, 0x6, 0xfa9, 0x8, 0x10000, 0x2, 0x5635, 0x3ff, 0x3, 0x400, 0xedc, 0x8, 0x7, 0xd, 0xea1, 0xbef, 0x9, 0x3, 0xffff0000, 0x4, 0x335e, 0x3, 0xffffffff, 0x210f993b, 0x5, 0x6, 0x7, 0x6, 0x9, 0x2e6, 0xb, 0x0, 0x6, 0xffffffff, 0x2947, 0x8, 0x2]}], [@TCA_POLICE_TBF={0x3c, 0x1, {0xd616, 0x2, 0x8, 0x2, 0x67, {0x5, 0x0, 0x7, 0x9, 0x101, 0xffffffff}, {0x9, 0x0, 0x6, 0xfd, 0x3, 0x2}, 0xffffffff, 0x80000000, 0x100}}]]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x3}}}}]}]}, 0x488}, 0x1, 0x0, 0x0, 0x44090}, 0x2400c810) r8 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_inet_SIOCSIFADDR(r8, 0x891c, &(0x7f0000000080)={'batadv_slave_1\x00', {0x2, 0x0, @private=0xfffffffc}}) pwrite64(r5, &(0x7f0000000000)="37e389b3", 0x4, 0x1ff) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) r9 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r9, 0x0) r10 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r10, 0x8982, &(0x7f0000000000)={0x7, 'veth1_to_bond\x00', {0x8}, 0x9}) ioctl$FS_IOC_FSGETXATTR(r4, 0x400455c8, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 4m46.393849146s ago: executing program 6 (id=2244): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]}) close_range(r0, r0, 0x200000000000000) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000300)='ns/net\x00') r1 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r1, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa) r2 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r2, &(0x7f00000000c0)=[{&(0x7f00000001c0)="580000001400add427327b472545b45602117fffffff81000e224e217f000001925aa80020007b00090001e809000000ff0000f038c71036000000ffffffffffffffffffe7ee000000000000060002000000000000000000", 0x58}], 0x1) 4m46.309165565s ago: executing program 6 (id=2245): socket$inet6_sctp(0xa, 0x801, 0x84) openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) listen(0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x5) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002100), 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, &(0x7f00000001c0)="240000005800410f9c00f4f90085b3025cb1fddf08000100050100000800028001000000", 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x2, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f0000000240)=0x80000001) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r4, &(0x7f00000001c0)={0x18, 0x2, {0x3, @remote}}, 0x1e) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r5 = io_uring_setup(0x3451, &(0x7f0000000080)={0x0, 0x0, 0x4000, 0x0, 0x1b}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x9, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f00000003c0)=['\x00'], 0x1}) socketpair$unix(0x1, 0x2, 0x0, 0x0) 4m31.276679813s ago: executing program 35 (id=2245): socket$inet6_sctp(0xa, 0x801, 0x84) openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) listen(0xffffffffffffffff, 0x0) listen(0xffffffffffffffff, 0x5) openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) r0 = syz_open_dev$sndctrl(&(0x7f0000000600), 0x0, 0x8801) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000002100), 0x48) r1 = socket$nl_route(0x10, 0x3, 0x0) write(r1, &(0x7f00000001c0)="240000005800410f9c00f4f90085b3025cb1fddf08000100050100000800028001000000", 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x1}}}}, @m_ife={0x48, 0x2, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(0x0, 0x7, &(0x7f0000000240)=0x80000001) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$pptp(0x18, 0x1, 0x2) connect$pptp(r4, &(0x7f00000001c0)={0x18, 0x2, {0x3, @remote}}, 0x1e) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x3, 0x20000000ec071, 0xffffffffffffffff, 0x0) r5 = io_uring_setup(0x3451, &(0x7f0000000080)={0x0, 0x0, 0x4000, 0x0, 0x1b}) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f00000002c0)=[{&(0x7f0000001700)=""/4095, 0x440000}], 0x100000000000011a) mbind(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x0, 0x0, 0x9, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r0, 0xc1105517, &(0x7f0000001340)={{0x0, 0x0, 0x0, 0x8, 'syz0\x00'}, 0x3, 0x0, 0x8, 0x0, 0x1, 0x0, 'syz1\x00', &(0x7f00000003c0)=['\x00'], 0x1}) socketpair$unix(0x1, 0x2, 0x0, 0x0) 9.821454707s ago: executing program 1 (id=3293): socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000040)=@rxrpc=@in6={0x21, 0x3, 0x2, 0x1c, {0xa, 0x4e21, 0x6, @loopback, 0x2}}, 0x80, 0x0}, 0x4044890) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) bind$bt_hci(0xffffffffffffffff, 0x0, 0x39) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0/file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80) getdents64(r1, &(0x7f0000001dc0)=""/4096, 0x1000) lseek(r1, 0xffffffffffffffff, 0x1) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x1000, 0x0, 0x0, 0x0, 0x0, 0x0) bind$alg(0xffffffffffffffff, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) bind$netlink(0xffffffffffffffff, &(0x7f0000000200)={0x10, 0x0, 0xffffffff, 0x80065c9}, 0xc) r2 = socket$netlink(0x10, 0x3, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000008c80)=ANY=[@ANYBLOB="2c00000026000506"], 0x2c}}, 0x800) recvmmsg(r2, &(0x7f0000007700), 0x318, 0xfc0, 0x0) 8.817422495s ago: executing program 1 (id=3298): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000000)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010080000000000000000200000008000300", @ANYRES32=r2, @ANYBLOB="0800250002000000"], 0x24}}, 0x0) sendmsg$NL80211_CMD_SET_WIPHY_NETNS(r0, &(0x7f0000000340)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x80000000}, 0x3a, &(0x7f0000000280)={&(0x7f0000000100)={0x48, 0x0, 0x8, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x0, 0x1, 0x43}, @void, @void}}}, 0x48}, 0x1, 0x0, 0x0, 0x4000}, 0x1) socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x2000}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x2c, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_XFRM_DIR={0x5}, @NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}, {0x10, 0x1, 0x0, 0x1, @masq={{0x9}, @void}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xf0}}, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300100000000000fbdbdf2500000000000000000000000000000001fc00000000000000000000000000000100000004000000000a0060803b0000"], 0xb8}, 0x1, 0x0, 0x0, 0x80}, 0x20000044) sendmsg$nl_xfrm(r5, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000000000000000fc0000000000000001"], 0xb8}}, 0x20004000) sendmsg$nl_xfrm(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)=ANY=[@ANYBLOB="b80000001300e9990000020000000000fc0000000000000000"], 0xb8}, 0x1, 0x0, 0x0, 0x80c0}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000800)=ANY=[@ANYBLOB="b80000001300e9990500000000000000fc000000000000000000000000000000fc00000000000000000000000000000000000000000000000a0030"], 0xb8}}, 0x4000) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r6 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r6, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r7, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)={0x14, r10, 0x9c3fa077fa966179, 0x12, 0x0, {{0x7e}, {@void, @void}}}, 0x14}, 0x1, 0x0, 0x0, 0x8}, 0x4040800) fanotify_init(0x200, 0x0) 5.553034011s ago: executing program 5 (id=3309): r0 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$inet6_int(r0, 0x29, 0x11, 0x0, &(0x7f00000000c0)) r1 = socket$kcm(0x11, 0x3, 0x0) socket$packet(0x11, 0x0, 0x300) setsockopt$sock_attach_bpf(r1, 0x107, 0xf, &(0x7f0000000000), 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000140)=ANY=[@ANYRES8=r1], 0x64}}, 0x40800) sendmsg$kcm(r1, &(0x7f00000000c0)={&(0x7f0000000500)=@hci={0x1f, 0x0, 0x4}, 0x80, 0x0}, 0x40080) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = open(&(0x7f0000000040)='./bus\x00', 0x14507e, 0x0) r5 = eventfd2(0x156, 0x0) r6 = dup2(r5, r4) write$eventfd(r5, &(0x7f0000000000)=0xfffffffffffffffe, 0x8) ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f0000000000)={0x0, r4}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000240)=""/53, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x0, 0x0, &(0x7f0000000500)=""/73, 0x0}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000480)) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000340)=0xffffffff) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f00000000c0)={0x0, r6}) r7 = openat$cachefiles(0xffffff9c, &(0x7f0000000080), 0x40000, 0x0) bind$tipc(r7, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x40, 0x1}}, 0x10) r8 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r8, 0x5408, &(0x7f00000000c0)={0x8, 0x4000, 0xffff, 0x9dff, 0x7, "65c409beac98cb1e"}) r9 = openat(r4, &(0x7f00000002c0)='./file1\x00', 0x42, 0x43) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000400)=ANY=[@ANYBLOB="48006000ffe2ffffff000000", @ANYRES32=0x0, @ANYBLOB="802100000c400000140003006272696467655f736c6176655f30000014001680100001800c00090000010000010000a1"], 0x48}, 0x1, 0x0, 0x0, 0x8014}, 0x20000040) r11 = socket(0x22, 0x3, 0x0) mount$9p_fd(0x0, &(0x7f0000000080)='./file1\x00', &(0x7f0000000180), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX=r9, @ANYBLOB="4e63dff719e3e0023d", @ANYRESHEX=r11, @ANYBLOB=',\x00']) socket$inet6_tcp(0xa, 0x1, 0x0) 5.082837291s ago: executing program 7 (id=3310): r0 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000080), 0x449b5adc936789, 0x0) r1 = getpgid(0x0) sched_setscheduler(r1, 0x5, &(0x7f0000000100)=0x30) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000040)=0x200) write$dsp(r0, &(0x7f00000001c0)="5cba91a4", 0xffffffd9) 4.938153132s ago: executing program 7 (id=3311): syz_open_dev$tty1(0xc, 0x4, 0x4) r0 = io_uring_setup(0x664b, &(0x7f0000000500)={0x0, 0x5e87, 0x0, 0x0, 0x337}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r1, 0x0, 0x8040040) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) r3 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x1ea1e2) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0xa, 0x0, "faf98357e5a1149989fc8dbec3bd02b82a128bbad0099cebdc25f5abb534464c516bdd8a0f3500", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237641a8ccf162e43ac61f700000000009b4100000200", [0x9, 0xa]}}) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) pwrite64(r3, &(0x7f0000000000)="37e389b3", 0x4, 0x1ff) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r4, 0x8982, &(0x7f0000000000)={0x7, 'veth1_to_bond\x00', {0x8}, 0x9}) ioctl$FS_IOC_FSGETXATTR(r2, 0x400455c8, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 4.833074198s ago: executing program 0 (id=3312): ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f0000000100)) r0 = socket$kcm(0xa, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) lstat(0x0, &(0x7f0000000040)) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x28, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x241}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x1e, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) openat$procfs(0xffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) 4.018023544s ago: executing program 1 (id=3313): syz_usb_connect(0x0, 0x3f, &(0x7f0000000d40)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d010110000000"], 0x0) r0 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) r1 = openat$kvm(0x0, &(0x7f00000002c0), 0xa600, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000040), 0x228000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x1fffc) r3 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r3, &(0x7f0000000080), 0x10) sendmsg$can_bcm(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000200)=ANY=[@ANYBLOB="0500"/16, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0) sendmsg$can_bcm(r3, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x3, 0x2}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r2, 0x4068aea3, &(0x7f00000000c0)={0x79, 0x0, 0x1}) r4 = eventfd2(0x2, 0x800) ioctl$KVM_IRQFD(r2, 0x4020ae76, &(0x7f0000000000)={r4, 0x4}) write$eventfd(r4, &(0x7f0000000080)=0x430f, 0x8) ioctl$COMEDI_DEVCONFIG(r0, 0x40946400, 0x0) 3.755488328s ago: executing program 5 (id=3314): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="1800000054000100000000000000000707001afd1cbc0a6e11de43ff8e17af4400b9", @ANYRES32=0x0], 0x18}, 0x1, 0x0, 0x0, 0x44400}, 0x0) r1 = syz_clone3(&(0x7f00000002c0)={0x900100, &(0x7f0000000040), &(0x7f0000000080), &(0x7f00000000c0), {0x3e}, &(0x7f0000000100)=""/58, 0x3a, &(0x7f0000000180)=""/169, &(0x7f0000000280)=[0x0], 0x1}, 0x58) sched_setscheduler(r1, 0x6, &(0x7f0000000340)=0x2) 3.754522678s ago: executing program 0 (id=3315): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000030a0fdb00000000000000000a0000050900030073797a30000000000900010073797a31000000001400048008000240a04b3d02080001400000000308000540000000001c0008800c00014000000000000000090c000240000000000018ab6e14000000110001"], 0x8c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000a80)=ANY=[@ANYBLOB="140000001000010000000000000200000300000a34000000080a010200000000000000000a0000060900010073797a31000000000900020073797a3000"], 0x5c}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) 3.607400732s ago: executing program 0 (id=3316): mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) socket$igmp(0x2, 0x3, 0x2) prlimit64(0x0, 0xe, 0x0, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_mreq(r0, 0x29, 0x1b, &(0x7f0000000080)={@remote}, 0x14) r1 = socket$pppl2tp(0x18, 0x1, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) close(r2) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x400000, &(0x7f0000000700)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=00000008000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB="2c63c77e009cdde49f00", @ANYRESHEX=r2, @ANYBLOB=',\x00']) ioctl$SIOCSIFMTU(r1, 0x8922, &(0x7f0000000440)={'rose0\x00', 0x101}) syz_open_dev$sndmidi(&(0x7f0000000000), 0x1c2b, 0x400000) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSACTIVE(r3, 0x40087446, 0x0) r4 = syz_open_dev$vim2m(&(0x7f0000000040), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f0000000340)={0x800, 0x2, 0x1}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f00000012c0)=0x2) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc044560f, &(0x7f00000001c0)=@mmap={0x0, 0x2, 0x4, 0x10, 0xfffffffc, {0x77359400}, {0x2, 0x0, 0x0, 0x8, 0x0, 0x9, "20635698"}, 0x3, 0x1, {}, 0x4}) syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x1, 0x7fff0006}]}) ioctl$UI_SET_FFBIT(0xffffffffffffffff, 0x4004556b, 0x4076) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x8, 0x4, 0x8b, 0xfffa}, 0x1d, [0x7ffe, 0xc95a, 0x1, 0x9, 0x7c, 0x2, 0x1, 0x7f, 0x6, 0x4d, 0x9, 0x5f, 0x9, 0x5, 0xffff2d37, 0x88, 0x6, 0x3, 0x0, 0x6, 0x4, 0x8, 0x4, 0x3c5b, 0x1, 0x3, 0x8, 0x1, 0x1f461e2c, 0x0, 0xe660, 0x4, 0x7, 0x101, 0x7fff, 0x1, 0x80000000, 0x4, 0x103, 0xe, 0xfffffffb, 0x71, 0xfffffff8, 0x7, 0x0, 0x0, 0x8, 0x80003e, 0x208f, 0x10006, 0x10000006, 0x0, 0x5, 0x4, 0x8, 0x0, 0x2, 0x0, 0x5, 0x6, 0x8, 0xb, 0x1, 0x40], [0x1, 0xffff, 0x134, 0x47ffe, 0x9, 0xfffffff3, 0x2, 0xcb, 0x6, 0x80000000, 0x2bf, 0x6c9, 0x9, 0x6, 0x3, 0x0, 0x7, 0x5, 0x0, 0x8000000e, 0x312, 0x74, 0x81, 0x1, 0xf, 0x3, 0x8000, 0x3, 0x400, 0x5, 0x5, 0x7, 0xff, 0x5, 0x5, 0x5f31, 0x4, 0x4, 0x2, 0x100002, 0xa, 0x4, 0x9, 0x8, 0x800, 0x6, 0x7, 0x2, 0x1, 0xfe000000, 0xff7f, 0x2, 0x7f, 0x9, 0x2, 0xffffffff, 0x9, 0x1, 0x7, 0x80000003, 0x9, 0x4d, 0x42, 0x7], [0x2b, 0x4, 0x0, 0x5, 0xfffffffe, 0xfffff76b, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xb, 0x4, 0x5, 0x5, 0x0, 0x2983, 0x5, 0x8, 0x83, 0x80000003, 0x200009, 0x100003e7, 0x9, 0x5, 0x3, 0x2, 0xf38, 0x8, 0x3, 0x6d01, 0x8, 0x38, 0x800001, 0x200, 0x80, 0xf, 0xd, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x53cf697b, 0x4, 0x6, 0x10000, 0x7, 0x2, 0x3, 0x7ff, 0xfffffffc, 0x2, 0x1000004, 0x1000ffff, 0x0, 0x1a, 0x1c, 0x120000, 0x3, 0x8, 0x9, 0x4, 0x65], [0xa, 0xbb31, 0x3, 0xb, 0x5, 0x938, 0x6, 0x6, 0x0, 0x5, 0x20000ce7, 0x1ff, 0x2, 0xf58, 0x5, 0x3, 0x101, 0x10000, 0x6, 0x7ffe, 0x80000000, 0x200a620, 0x2, 0x0, 0x1, 0x4, 0x14c, 0x10, 0xe, 0x6, 0xffffffff, 0x80000000, 0x5, 0x8, 0x5, 0xee1, 0xfffff000, 0xffff, 0x9, 0x7f, 0x104, 0x9606, 0x7, 0x2, 0x4, 0x8006, 0x1, 0x0, 0x8, 0x8, 0x30b1d693, 0xa1f, 0x8, 0x7, 0x1, 0x6c1b, 0x2, 0x4, 0xb0b2748, 0x1, 0x1, 0x200, 0xffbf2441, 0xfff]}, 0x45c) r6 = openat$ptmx(0xffffff9c, &(0x7f0000001940), 0x101000, 0x0) ioctl$TIOCCONS(r6, 0x541d) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$BLKSSZGET(r2, 0x1268, &(0x7f0000000180)) 3.261596297s ago: executing program 5 (id=3317): mkdir(&(0x7f0000000600)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000800), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f000000b1c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(r0, &(0x7f00000042c0)="9ab1446569aa24b774753c9e994c09c24df9d42fa5a228e469b44cecf6f9f5ce5f77c93b1895aaac9cf34b37415f11fe22d6fa0162aa743b242e8fe0a8659e32fb543d7969d6513136a9f332a8074f8ee1e445277ddd5859eb5ac3321eb710be880a441031da9b31f791d54fb3c97cd8ee92b00cbf962be8eb5fd0b7cab207645f59cf87a8c41e2739dd8386b6bb84b627cbf5e09bac876ad4b215f0e510a853c5e8b9f7822b26771d72972290a1f9a6f0a46942be0d0eb7aa5145ff368863b14e9845926088f9f92d554e572926290dc6e6b574aea8c500fbe5697f881c0cec48282c6d07619248da0c3b9aa6f7c778525d1760051e4ba8ef31d3c8d3e1d4214ffa5261ce1fdbc12eba889968137f5c06fea233000296cf18df494b4e7b1bee7dc2f3751c37415d46f6d7ffb3d0f788f2100ee41266e6fba75b61af22e1d7b286507ff100cc34ed28d5a2c8be3231446874bbbde6f3c367ca802d64192ffcce1ea41b2cbc57f7500fc4f8f12fe02690c1c9785bbc35542b59d05600783cf4f4633b374101d8ed395303392b238d198f9f68c8ae928cbf3b558deec6d38ebaa526e749ac4e47dd5b838ec34f2820a1134252ae60159d4e030cf5e5d6f8de799a31e12ae57cfe5a1a3ded525c6e71271271d35a0056265362387a361f21ea0f4b6d46f6a83a8512687e43b31e11b1396d6e9e49cf42b693732e226b55d21a1203022f6be9f8ecccb68de3bf4ce99689514bd752f4e60bd2f8e376d7fae5b5fc8db0f53db8c52746671e361b9319419c1b3f3168b4797ebd2d118ee42dda4bc59dd0251236195c8cdafc0546354eeb28f4c7e71e8245a6ccaddfb858f61039c0ccf5acd924680aab38dd061fc7b123f24ac7f3d3c0cee43b61045bb1efea25af86088a0591f166e2f11ea4089860893b17ca5e3d99ec75131268e2e4e290c2bf15e4dde23284e4bdf6e549c096ce221d9c8a6c0fc78aa6a1c8b547c0e10738de2a1e8663e03ab0ce4594e244989f75b6672de1eee97ba7e6467a0da51c0e75d5866c405b03c4744d8d3fbb01eddba5a0361662269154c2f0e61a9433982eb904ff562896cbfa692eb1e6c644fcf6cbc103a76b712af706a47608d3e2f5d54d47d8e9906ab37ddf04004d32ce00200fc3c274666aeb618b27424d87b6a4b0262de4436b9e6f150bc798394c298b25a2c318fbe786185464057c0bcfcd1917230d78ee1a49eca12068fa676852c1099096c6cb98dfda27fedac41826516e42cc116f0cbb68f0f810418258dc5a65c0e1ada296176e17f8d762894c80542a79383cc1674a4f3d6520633ce80baba214c20628899f9ac826484c887713aed9c5caf13b40a598cb1e81f7b18dae39efc22dc99ff497e11f158edc2716ebe3bcd593691aa26523efc168e1394ab439c9a9270575ef34eeee9084b0a31b2d81d47c964ac61e600f75d9321d7474dde45bb8d0cc46510488ab68486d3ba6cc9c3ddb6f66f2e5d251ee285121e1645a2f5167fc5fb8ac4491c0d9d0423c7a8452efea2f5a30096a0fa47173f3a68500a5c755ea939c838d3be126a87ff6baa5a1fba638a5c64767d17f04201b935fcb1cb6afa175594f410f2ff773194c703e623876051e46bb0850a5016e65f8fa34b96bafdfe851a0756fe26fb63d52113c0935b0867f7dc8a94d887484b15e8f92b6a316a22c04a985cc94e432cd43f44001bcdbd48efcd463c402d3d181298e96db60fdb714b82e146567af5ae3fc0c3f9d241471b4d129f928d286f780facb1e84434610ab3379dfff0f64d57b4a1c2e96c98b693de952d26773d24e7a95eddbc450f79932d5332d27991c7bfbd3bc35bfeb9496fbebccb5e4c35c368e021dea643cb292d794d3d3bbcc960f989bef09763dc73d83cbf907485635265e81f87b712d958a66719230fc6466615a0e3bb998d48159e9e9c51959354a545966bcffa298c7673b4d32b991c886a997236642c0f104f6795feab9f48d0ffc74667f3f3e82473ac892ad25f4b13029b0b27fb1d86991ddc42bbc3fe584ed364e769f3bc72ed8749e7a654ec1a2ec7a01bd2d5caccdc6241a1b1ef2726db54d2c34ab47020b4c729b5994b43deb00ad959950e0051d2c0f27217397055e78f1dd3bd867a45e06c2134ae8981021aae881cc7b2049fe7c82d2127ec81d6430c8116355c8d0ab8b9291c688ed9b8dbb1ed6f1a99bb58a1be8d5737acbf9461b142c8982f52481195d35ef82aed4fa52385ea4ed00a739d01cad7af9f7c27d357748e24f28d22065ccb37300e8f5d8dae5ca79af7a50edc3e05184d1a2a6d59784d5ceeb1f1550a44ea03bee4dc5c27eb78f0032593c7d082e59211f83a8b91aa78bfb7e959328ee63af26a37b79ce5e5139eeebd12e28b2a26ad2fcbdca652524d036b324782d54247a48b9f8200b2d6d2c091c41366d677e3be6e136cec6c3080d608849135c6e3c7d695d2e226ae1ce999d730d7f79116ab85762e55a3e5a66a690ce0a4bb4fd1560c796e2797414b544ef78e29d55e4853fdbf3362085a65c46105f32c360a0a9867b984a5d0297fe0b06a45684ac801a8e66294cef6e5f3c48648884fbb2422fa00488df33a9a0ff1039c81f1939f2cd2f5fe8aa805af2d2332ac37244ed4a7b50265af8062752b0c16511e5f25e8aa2b60645675bc826557bb75474ca4787f6b584b2f83bc25192579104aa0baae79f396df0d31121f90db9acea9695ee0fe0c22df4db503ec8b2437b05f5d35a65722fa82eebd2aff4bcd3316a5cffc4b31913fd02f82130c77f320bf04bf8fa873d0e3f62122d6a5f87d3e908bedafed4a3cb6d9f73ff546f5a2b74a2493b1753e89b682352bb3166563518dcb190c7b3d9fd667c57978a670b192641a674dc92c2401d067b6767aa632ce32a401175c98200a52ab5d80dffa719746d0bff8a84bac4a56e0ab8124fc332b64ea662d01e1b73231a6638f01cf4d699448da228c16951149c8d3dab9a7e3be9a16c7d1ffb061818f8f9cb2b42739fae4a0d70c0701c8dceee785d36ef6413162de1917df01c693ef3e1f517e7fc46245209fee52f5c6a2f50ab3f56d67d1cd987282b24071d8ebb1bc5cd635957b2a7ad92d0650abd5bbc24b75885b6119592a3d715392718e52f9124c4ac95be3582abba4ac3a4049ee49fa8ceb9b59d4e1e2a069c9d482879fd8d27d5ac22ef870542453be22c2ec4ebf1472c19fbfb56aa0a3671297b020e3fe49d201a82a04420e90bda43691dacf92347bcbcae3742cc4abad4c8010c0afa15278795d4d76c482461ae78f30569e1dcf87b9b150d07a2bd81676ec6022422d490759ae1e861a6c4cd1f733bd772d60975a59356c385a4a390429f3d2131e7f616015261df6db3cc3ec261a53be10c4f197e71878984fee00e6d1069f79825194b7af434fb6bb86db18e11977f82928be35054543060cea94ebb4015d061f20f8454e056e7b6e4f9a1621ef2377d77659c20bf358c817519f1801be15ae3b5b42adfab367777a6789635a0dcdd1f2b97edecea0210768af67601d1b95a8850dddb6b1f4b0c2f52c835b0833d81966ad19e49ceb9dc9c729cd8334bc3ee5bb8c74186f5cc3e765b9fdd91d79baaab3d2ab64c15d655d1af7de9cf8d5d7c1baef24577843ce142331743b45b06104b6d0d4392e61ca8c07507ff5f831bbf720854db4debf64182aaebf899ba57626a48748fc2dcf016013d575595d24d383eef2da0ff0c9f6fe9c64b186cd4617e3f37635d7dacb58ec297f3ddb48ce4a5e00cc127267e18a1fdf209e098f2cb2e9c0630d15ec9b867b2b95ecf82ad2c0ba39df9c4d36d492bc9a55c4b767da966e4fd7f4d2fef5e91d0575177c05d240b50757031c76333d43bcc828ab2f0376e29d12d1261ce104a8ea488091326bc451c120c8c04d3e64835c893f55b312e248ad8fc1c32429d68e6b67bf45ab8a1cc3db22f9f01a2266b8349046d3d3e081eaa7f7020c73c0762d11a33b517b8f081da3c61ef63e1d40cd87d69c7ac7491fb61bb57c1fe2d218aff6d39b3e1fc847f0ed894e2f0b4d6a4ad03ba42e28bb1dfab645081f548e64ceb8ce15d2214bd66a14fe594aa447c3537eb493299fef0f9326236ea5dae44e23b34801fe06ee16c79545feaf2528421d6e7f9a256a7914d86bd053dc33c8c2043ba73714f5ff5f0507097a56c40b2190e77877d43be849ee2ac129e582930ced06d359eebb49eda4edb13819f91cecc449c9613d9659906179f8fefa34fecb7d21cdaf09a1ce8d094421da80796c97c02fc56171aaba53fd8a7f55de059044717df164f3571028f16995d51fc8829534cdf58dd134def1e43a34e4f5f372fa8e19d3b85881e99ecd45faa4fccfdb47e094ab06955f3960fac71294dd965f24a97cff36b9966cf1a4c3e96c3e14a3951dcc8a3e9371f7e1ae9df77ddb1a99172174adbee8ea57a0c9872a6d677c2875da88a6a7234bebf68a3cc0532a9809a4de4b4d419bff67b0ba825a7ae6e999087155378357ae67e2dd98697f1d10ffa4497dde6582571670456db995228b97d0ecb2fb30c2ba6c16038c40059815c56b35666cc1c5090f6c38e0f4c12abf79919951b85a2734d32dd12b239912d541f9163387a4aa0be0b7a12d9c6b56dbcf1e9aadcfd72e2664a84d6c5147c72bffe7c3560ccd8c447b748dcd26cc9ca2a85cded742a8dccdfd8e78c96e78d405a19faab9e57183b37583f94b3d416b2920c6b746427ed75c08dc3be02720c1edc4743229153c48f1239b222b9fe2e21c0ae28122bc44f9dc78a59f3485ac8057eb21f0857bcfea2d9ebbbcc197e7880d81515bb1cb7192d97c4258c09926d137e245977db40812b253f99a504bb68137d8d73ca4e7c808d50f1dcc600e6a6db90238ff44e075932fe668c066e6988a6a8b4a8485120c8e4d6511268a75d8f9b0f06689aac8cd621e90c62af1e59aa9efe928e9ea098661b408a2825c4f9aac1efd9d54d163a651054b9ab32719d2be3b176f6795ddad0f1310b9237181689f2f9dd34a41d4d4cd2d7569bf56e6a80bc24d90df3bdde0f9649e699f4ef70c4f3faf9553a231215416bba26c29f17861e0f265e9641b2307ed43d6fde23a378669f4ade874e54c20a5e902205dcaa79a3e8584a3f78a86e703451115a1717df882507c607297afac0a056a0f3509a57502fd2ffff6035d04b91f72f5e1a69ddafaf80f7b2f7a13f38c683988436585e6bc7fc2da328449675c234ec0acf5294ce06c72442beba15e65d6a3e1b5dc3c8f115e1005798383f79b0194f6b7d4b1b32371acbf22340af6e5ee3ea840f7ed451226daef3041fc194e051af2fb450022b394c774273b9575c974c324ecd7268435176ee28c54bb54c8e829232ca636f3bdef60ed460b5ff425936626dd16a3f436f08a863582a79f393378f60f6c8ecdd13d83073bfda2e9f8d0c74a841021cbb8c148e70bfc585627449cdd9fb3045db3ea08a96108b52ee8a4f5048a5d910355789f4bb85c1362955e267e719581c38a2648eaa0b516db6277d2ee3c6e1e1090df3f53a31b747d99887e337dadddab16a297d9e56797007a3d18ce333311c70bb1bf45bdae517ffc589419af643773bb30a1fbff7ecd4a8ae7456a608fe73547c2eda4f070d57dc70b65d867526c946a435ea581497da18646ce569eaf6ccf3474cd6e7aa3d6d4732836ff4167c9153757ce58a34864be6d479f7b4ea1d6480b9ac16c5bff346a74e74133234744df867e16b3d2f1f7db4b21b89019b520917ef863e60f52999d6946b9e09cb60054f49d8a255f02e4b62fff6e6adb9a167ea70a177d00b26f56e29b63138a2ebc30b956161a4ab25d5da1c207c3f762714f651341ae771e17d84fa1c86685f2fcb0a128c2e1208d1930e7ff0d8d55299154112af574b881be8b69cc1721d548ad4dc02632e184c47f9b394bf4a834e60fbead8c8bfbf5087f8454513b0b086ac97bbbb9aa342af9def758fe88f1e4570e65f93fd4a9868665d08fac0cf6ebde786995c433504ca01cdf83311aaae20cc76f819a4344a8ee4e26c1094cb00d2c8a67c733fffcd89e97534cacb08a64d75e8594fa31f0dcfcafb0d1bc184c7067fec6a48ddefd580d4d9a4128d8f70f6fc6562da683904766e982ecd0286064db6844131bb7962a0a497f7b97fefad88a0b128bdf8cca774b1c32cb4af259bfebccda036e7e4ea8962838dbb5c04ffab0a2f1481848a27f06171645daf5246a2e563f3ed60097a9d7023d6ba5c8a58d39f733b12baf0863d82c427460f51cf9e3f77281a42221725b7bb75c2116ab31f704661f090d3eeddd2aa6efc619946b4933c398b635fd04ba3758294965c568997e1ef44b0562804e6c64558f6cfa87662a988c321a856ead51c848528a4954f9ff1948d517d67bc11db66801648848bfb7ee12296428bc3ffec863e9c77ff31ee386197679adab2a0e93bbe0c66ffe9c4b09b636f6216faa373aa8271678cc57ad46898222df7e2d8b14a5b70130596c0430997c4c04d9b5187fd9bb26b71fd19aacc8e08a3239f0eebca7b2873062a19f327a4a282012ebf9898a5ab6310b8623c864d4dada3ded00ad201ce8f3973f90396f5edc1ba466e16247fe6b0ee98acfd53792cc0fea33647b841596655b8d9efbc14b50fe0b588e4c41e2cbd0a700529e7ca91122d3d1b26e52bf44a0c9fe37cdbc352357f13b2adc68e78a00f6dc88a8e6ea54bd0b2c8276f9e1bfebc8655a1f47b72c25ffa97f4463630cc21428ca3bb381a6d3171d28bb946f746f820247bf3f7bb69caaeb5c47026ca9997e586e657a9e1569312bb443299ef4cfeacc9aaf4fc3aaa4a77a21579234d2aab6fd0234398ae07ca7c57ac6d6a51e025744b1430abce27f7f9b0d0e45c051e34d20db95cadcc0e4e327dbd979166b33e39a3951d0b8dd62c0d1542b69583cfc07b127243cac4b052cb29ccb3592972698fa4cd84633d222d78b8741d5f903f8636d95cddfe2ef13829df9ce32705edfda51ded2f0ef38f60a33a2e00373107eef56a01acb5e05d849279b5987343c8bbc73ea660ceaf7c9b90c0a8e1412ff3f517cef8fe604d7a26e085170a76e1bf43f5d1bb77ee771fe841d59fe2cc2874d25bf991b4af6bf9ffe1bfbf3a5587006b60bab5bdfd5a3192e82d474ecab0ab656967856c84cba9469c5823c1d1bf104d2a21c071bb08b2a137883dd9c8f545d6958db8efa45263ae303de76e70f2f6a10e1858e6654004f2a099dc31950ee730c465e0a1822935e309d41650fba489aa3050eedbf3f058d24d1f04fc340966e42d72052d84a66789ccf75000c3fc83b8842badd6b22ddaaaf53ed34e25c1b638e3630d66a7903405052902cf8e7395d54679e2f4a2bf7c8c89b0dc38969376ea164fe97b37b1172e6e8f05a929aa373108e891a64e38e18b432a115a44d754811e03c4f4ae7c525a6b9b92aab0d16967ee1a64eeeb2207c094f6aa96f126d058eff22435a4ae76c31f888ee13b327d2cab4ab5a56abf4cae88c583dd67129271708aa17f4f10886ead0e12734314bd4a49e64349beba4abdf94a1fb23a72cf7e16b5af2f1706d9646a5ff7dbf5c7b1cb2c3781346167b15d4625841d9f3d14392db1d39101d37175c42c522229db0708544058d75cebf3e399cd443d1b943c6f3017a898bd49836a8d92519deb810712aed76602682ef0df2be270734eeda7f289a76f4684baf75702a1ac3da005e62b83f794b934cf882db5d50e5ed4aca868e300d690c0b10daf0a47486e9f49d1b08eac6cf5090ddd2443b1459b2df86ab3447b2b5c6afe8aadb410de6a84b640e326eb882832d1a9cb12e0b8f13aef579f404af8631cdd5a30a031dad19cdf247575dd223229330f19fe4d88c51242217397acf66b86c743de283d5df7212fce59af17eb702eccab192f56f054a33709d41841e4a39638e02b4210559593f9b5c44fd22d9da637ef1a3a0a41c40469990dc4beec30a05b67931c0560d9a59fa875f3e26fd1eb32655aa30c7a1cd3d541716fdaacdda206328f3cbc8f16fc2be26690f18963a16febbaf2cb6c199330579ca067c60b54cbdd211c1350e066448fb50ae28ed58788ac98f0ded3414c8735ab90639916e26ab29102cc2609035e56d9b9d2dbc98118835bcf0e437c77052efe2293d9f19b7197aa1b94b10997b0b1efdef251de8945a97fec885f032c3bee2447335230b866d7aef515b04664d0c59e18233f9a229969e3e17d69716413ca3bc55f5959e340627ea803f7b26f4a74295b295344a3685287093998a1ce75b1ed5d730c9aec812617b4c200a0250c9ef8ef7d2fcfc59ef97422eca746bc6451a5b77307d14c1cfa0ea2c8eb7cf7819644577a6456efec0af058a0e3c8ec371019009462bfe174a11368b57fbe3090208a57b2236b97edc32cda5c6fc988cbaaf91c4020a06a7ad45519eaa761e045fc84d3219b287206282347a031ef1e7b7dbc67de738fa8f9fe71c44201fd1d548f8aebe93bf502d64d4b5f470a419e3fcd87f0616b9813048311ed20ac2efd7f18dcd6889542208b50c28c8c0700f73fa33a964e38d699819cab2098c6ff081266721cdced87ff41948c84037485f30d38a99eeeb3ff4c3049742a29eb09bb35c358e732546267c165a62fee9e25abdafdb8a48785bd432d160797e7a41d580f59d7d8e59b3e6b954d39f86db33b8f7cabde43e8e04cac1fcf9aa6fdbe4326e0d9c782d9a630055b36f85c2b8efebf18f42ef14ee5eb1d33ca322db69704f8bb90bf30eb05908b8d8ed169580923f53a6539cc3b55baa47718053d2ff103c23d90f9cb49ddc7d759950f605bafabcb7953c042c0523b84da994529a87ad68fc6f0709fd7af5fc20e53a17d3f5fd4d25fc5ff6598c6ddfc34668a08ee5e066d81a65e7979c50c08febf76dc5a3a405f551bb8449d94ea0dfdad6dd6dd6d6e4486f4ae1d2523c05f46198d8af4da12873ebdf7d6b5f2d0f1b2d29759ab0d78e34ae6f17b7ab83518cf8b18836ea5630ee934e5ecc123f0d3fe6b803ae1f735d65dcadcaaf6660e02ecad0290f6ead0594733a10b2b1654a44244424fa8b3180b551ac401828203e61603b017106e2256f01b9f26db33897167d9defb54ddfe49334150574493895370bad46cc658667aa9a8ed333c86f112b2a542936af92e2f933254b6fb0b1a599eec3bf2e476ae6714e2486dd31b29e4d26838d84bd7a62c62beab3ba71642278ecaf2e50d70670d9fdff105019791d36321bc57fdfd8f65f2ea1cb188035ecabf6140e777b7e6d2177ac29e9a1a2f87dd54d96184bb1a855bd9efdadfc606f13621f40e07cd8be9c2435c8c90b4ccba5eb7ddcf8cf1f76617c9a9e011abf4a63ffe31df63ecacb8b1d2d653e613cb399ce079392f9ca2e226c60b6e8103447c24c1f80d42e1ee747997602ae3ccff8f9f98ce9b56f6f3e3c0ba507df8b2169539cfc946c42da72644feb9b3b582ce332f8b2eda02192958194903d17b3e9b4bd60d08cd9a7989d946ece6d8dc01d6b66a7851bb11e4b075d38081d3ce7bf1875fec9daf47a589abdb72763c9747b83a28389238b0279c8e41db6521130420851acac463664a97be2190aff921923475f2c1f8a87d1169229e5f10dd0a92221e61358b156020f2c9ca2cb6580743a8d5e3c59e6fd97a7a246211450c7c62f1891cedb434102f8794d81c1caf2c1b4ae18b7c4b9c88de5c51da33e3343cef76da0d00341c2e60c4562c162e41a7efa8290cc9061f3d6a592d5f104c5018f31bcaf912bdd37370fbf8fedf0aa9026c1142299197d67ab026756927b5864ea42c45a82c23c275697d31a1b7900670c9a3c967d12974543c11f20c367a336bea9b9ebe480f9c806528138dff35c5f56b1199b75748e9c5cf50e6a32397dc3eeb04c3636c0848a5e13df8a9758bacea231f34cba13b466360b0dec69f74f8bf9a2dcf3dd94fa3a7d27e8caae00240559d75875ef9c619416593ca0072e7f38caae5a530c62dbe00e38c12cb8b924d63fca4d5c3a4c8f50e8f4f86fc1fe2b163219c46c21eb783e587e18e07ab7e1927a646c4f154c5000cb65ce9528457c3c66f43d9ab7d61580df0ecfb31cb38e4cbcdc3dafcca57311abec6b74048c8b74505ba678a4db07ed7243c70a821aee66a487bf91fd273418f8ef657d1eeb9ea6f095d47641e9f9fa30599e8b9c6b4453a1a5e8afd86fcafb46dd095fa4a98a2b26470e2c799b08c6000f5c3c4e28961463724377f37813f3922484fda986eb7c93ae8365baf648acbb344ca7e044d7ba93e7ba35c31085f3f99c5fdb2f9f2845f00b8590395e8ff730b86f5dd7f52297b8ecd5d5a6bb452bcd12b98d6adb27e7ef0e84b9567c66093ca3edab7e64ac4f56360501d81823ea2b1595f934c5f61c8558304c16154109a983a2af8725c7af91b5bc57e555768aa8115236a6ccc921d472b608eb6b82c4ba3747d79027d7856fae5369aa325df6a76138a5b41a94377eeeb251087e0b8510d8890e3f7a0cffaeddb9d2c29bc89f952489f82ee2e2b485cd297e6d30683701623cf73ee9ee606baeae9c3afba287eff57731b9cfaf034b1f56c8b31a32a1078c4fcab298c3f925a8e7cacceb9edf7ba2e54d31033a25462021e4a3c0bf5af341b462ee4417024da7c12c7f385de3af129aef1338a9c1fd68323d07ff47ec8bcca66b44300624d02c9202a2d093c3c85fd922b57b3bd14162c8ca5690734b7e4e4b8980b73a8e9908a9fa3dd508b30e3b1e1fd4ec388affa27c4bc26ca2820e0a902d51ff94984e8894fa5fca7b8704b7600ca6d6b1b1527ea999fcdf8fe3b290ec0036cad222f92cf8a5a54d0fa91de6e74ef61f60a233c9f15fdc86226c3f688de15ed8f0c3f1bc3afcad87cee47a19384afc6a804f197339ebce4aca211dbe0504a000755d18f20c4ecacd4123acdff7653cbb26456499495662508c8186afb883f5481c6bdf88cf137e263bde9d62f054573e0d1454cc119c95d4d9011332bd77682f79debcf5c21f0be7e9a83a58cec34e7cfb17a8122e030669228e4d3d9e274a678c5b77e6180aacc2fa8eb9952c5b04de6b2c7bee591badab96a3c3248c275b5b8faf5394eacc427a840570033be5006c33ce2d2c6e54f08681c3f74ad2fe54bca6dc62a9d84f6c58509c1e5dd5cfcc7a358493d428de48dfc1bc3f74154801c97e6aae38445045320b4cf66c1e56eb6ea2c1218de65f120b463c5cfb9255b3a25eb6e848cbd977f0605d71c561c2a754f5761c31f84101ee8178782cc8cf70b41a2204c5cb2f3134d572327fe4bbc1792249dfcf0ae7ba5d81fb5ae4a7978d044085f3b7f2e398c05733e2bf456cae898f8b5a81e9c79179bb5ca716713fce643dabe21eaee4386e646e25ad3adc5a4ad40f9bd6743f5f742efb1a674ffdbd2ced56c646ae590eb8f10283b47f57e6f96ad76adebecb24df74020b096fdee3c8d780d563a915f73c8b0246b861cd3a8580d5cf75798e8cf1c5875724661a39277e7165fe48ed8d5e6a20d68239f626fe8ea434a4e6e03ea434ec68c4b92a0fc2af15a135d6cbaeeca39a0c1896dab33daac", 0x2000, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) write$FUSE_INIT(r0, &(0x7f0000000400)={0x50, 0x0, r1, {0x7, 0x2b, 0x10, 0x1c20040, 0x0, 0x0, 0xc0000000, 0x1, 0x0, 0x0, 0x100}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0xfffffffffffffff5, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x8, 0x80002, 0x5, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x6000, 0xd, r2, 0x0, 0x800000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x3, {0x5, 0x0, 0xd04, 0xfffffffffffffffc, 0x0, 0x100000, {0x0, 0x8, 0xfffffffffffffffd, 0x3, 0x0, 0x0, 0x4, 0x4, 0x4, 0x2000, 0x101, r2, r3, 0xf0ee, 0xb}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) open(&(0x7f0000000240)='./file0/file0\x00', 0x2, 0x74) (fail_nth: 13) 2.904233417s ago: executing program 5 (id=3318): bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB="0100000005000000fd0900008400000005010000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000021000000000000549e290e"], 0x50) setxattr$incfs_metadata(&(0x7f0000000800)='./cgroup\x00', 0x0, 0x0, 0x0, 0x1) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000300)={&(0x7f0000000440)=ANY=[@ANYBLOB="9feb010018000000000000007c0000007c00000002000000f3ff00000000000e00000000"], 0x0, 0x96, 0x0, 0x3}, 0x28) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r0 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r0, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x402) fsmount(0xffffffffffffffff, 0x0, 0x0) chdir(0x0) pselect6(0x40, &(0x7f0000000180)={0x6, 0x0, 0x1fd, 0x7d, 0xfffffffffffffffd, 0x7f, 0x104, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xae07, 0x9, 0x4, 0x15, 0x80000006, 0x8}, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_GUEST_MEMFD(r3, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r4, 0x0) get_mempolicy(0x0, 0x0, 0x6, &(0x7f0000006000/0x2000)=nil, 0x3) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000140)={'pim6reg1\x00', 0x1}) ioctl$TUNSETLINK(r5, 0x400454cd, 0x339) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000100)={'pim6reg1\x00', @broadcast}) 2.651075316s ago: executing program 0 (id=3319): r0 = bpf$ITER_CREATE(0xb, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), r0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="200000006800e97800000000000000000a0000000000000008000500", @ANYRES16=r3], 0x20}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000004380)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="240000001800090400000000000000000a000000000000030000000008001e0001"], 0x24}}, 0x0) r4 = socket$inet_sctp(0x2, 0x5, 0x84) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r4, 0x84, 0x64, &(0x7f0000001600), 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@ipv4_newroute={0x24, 0x18, 0x35f32a6dfa748ddd, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6}}, 0x24}}, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newlink={0x28, 0x10, 0x1, 0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x420}, [@IFLA_GROUP={0x8, 0x1b, 0x5000000}]}, 0x28}}, 0x0) r7 = socket(0x10, 0x3, 0x0) sendmsg$kcm(r7, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x404c080) sendmsg$NL80211_CMD_CHANNEL_SWITCH(r7, &(0x7f00000002c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x1}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x58, r1, 0x400, 0x70bd27, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5, 0x7b}}}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x20}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x15b}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x5}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x28f}, @NL80211_ATTR_WIPHY_FREQ={0x8, 0x26, @random=0x1eff}]]}, 0x58}, 0x1, 0x0, 0x0, 0x40015}, 0x8000) 2.342987325s ago: executing program 1 (id=3320): capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000080)) mknod(&(0x7f0000000080)='./bus\x00', 0x2, 0x0) r0 = socket$nl_crypto(0x10, 0x3, 0x15) prlimit64(0xffffffffffffffff, 0xc, &(0x7f0000000000)={0x5, 0x9}, &(0x7f0000000100)) sendmsg$netlink(r0, &(0x7f0000000880)={0x0, 0x0, &(0x7f0000000840)=[{&(0x7f0000000cc0)={0xe0, 0x10, 0x50b, 0x0, 0x0, "", [@nested={0xd0, 0xf7, 0x0, 0x1, [@nested={0x40, 0x47, 0x0, 0x1, [@typed={0x8, 0x24, 0x0, 0x0, @str='GPL\x00'}, @nested={0x4, 0xc0}, @typed={0xc, 0x94, 0x0, 0x0, @u64=0xb}, @typed={0x8, 0x17, 0x0, 0x0, @fd}, @typed={0x8, 0x143, 0x0, 0x0, @u32=0x7}, @typed={0x8, 0x15d, 0x0, 0x0, @uid}, @typed={0xc, 0x5c, 0x0, 0x0, @u64=0x3}]}, @nested={0x89, 0xc5, 0x0, 0x1, [@nested={0x4, 0x126}, @generic="46d9213f622d739eeae6218851ea3ec77eadb6db3fa8718aa4ca04caf710b906f7edc077b1d36670707c0176b30bf41d8d7f5da83a2f1ce9c11b9b588d92000a4d9060931a14bcde60c72ccd452df0e5d20eca88fbbd372d2e5ba712631b8a6f38c757dd63dd19d99868ed92cbcf22e9053895f0c2accadba66ecc1bc5f56c065e"]}]}]}, 0xe0}], 0x1}, 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) pipe2(&(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) vmsplice(r1, &(0x7f0000000140)=[{&(0x7f0000000100)="eb", 0x20000101}], 0x20, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r2 = syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) syz_usb_ep_write(0xffffffffffffffff, 0x81, 0x0, 0x0) preadv(r2, &(0x7f00000033c0)=[{&(0x7f0000000000)=""/55, 0x37}, {&(0x7f00000001c0)=""/141, 0x8d}, {&(0x7f0000000740)=""/4096, 0x1000}, {0x0}, {&(0x7f00000017c0)=""/159, 0x9f}, {&(0x7f00000023c0)=""/4096, 0x1000}], 0x6, 0x9, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xec776000) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r3, &(0x7f0000000a00)={'syz1\x00', {0x9, 0x7, 0x3, 0x5}, 0x3f, [0x9, 0x2, 0x18, 0x2, 0x2, 0x400, 0x80400000, 0x0, 0x8, 0x0, 0x6, 0x2, 0xfffffffb, 0x39, 0x747d5e13, 0x800, 0xfffffb9a, 0xfffffffe, 0x0, 0x8ea1, 0x2004, 0x3, 0x0, 0xf250, 0x80, 0x4800, 0x300000, 0x7, 0xe, 0x4623f, 0x0, 0x10001, 0x1ff, 0x8003, 0x0, 0x3, 0xd, 0x3, 0xba55, 0x8da8, 0x4, 0x200, 0x2, 0x4, 0xe, 0x4, 0x2, 0x6f, 0x8, 0x9, 0x1, 0x8001, 0x6, 0x2, 0x9, 0xfffbffff, 0x4, 0x6, 0x1000, 0x5, 0x3d, 0x8, 0xa, 0x5], [0x1, 0x1e, 0x3, 0x8000, 0xfffffffd, 0x3, 0x0, 0x25, 0x7, 0xfffffffc, 0x8, 0x7ff, 0x72c, 0x1c32, 0x3, 0x6, 0x10000, 0x400, 0x7ffd, 0x3, 0x4, 0xf, 0x5, 0x0, 0x981, 0x4, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x1000001, 0x10, 0xfffffff9, 0xfffffffd, 0x7, 0x1, 0xffffffff, 0x6, 0x8, 0x800, 0x7, 0x6, 0x96, 0xfffffff9, 0x2, 0x0, 0x2, 0x411, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0x7, 0x6, 0x2, 0x1, 0x1, 0x8, 0x7, 0x200, 0x3], [0x401, 0x4d, 0xffff, 0xcd3, 0x7, 0x1f, 0x404, 0x4, 0x4008, 0xc, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0xfffffff8, 0x3f92, 0x1000, 0x0, 0x10, 0x1, 0xfffffff9, 0x0, 0x1000, 0x80040101, 0x5, 0x4, 0x5, 0x200003, 0x2, 0x5, 0x80, 0x9, 0x8001, 0x10000, 0x0, 0x7, 0x400004, 0x3, 0x6d7e, 0x3, 0x8, 0x3, 0x101, 0x6, 0x9, 0x956, 0x0, 0x3ff, 0xe, 0x6, 0x100fffd, 0x2005, 0x400, 0x4, 0xea, 0x9, 0x20000005, 0x3, 0xd9, 0x0, 0x7d, 0x5d7, 0x7], [0x108e, 0xffff, 0x7, 0x3, 0x88, 0x2, 0x4000000, 0x4, 0x4c, 0x2, 0x763, 0xb, 0x402, 0x1, 0x9, 0x4001000, 0x7f, 0x5, 0x3fa6, 0x4, 0x0, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x3, 0x4, 0x2, 0x2851, 0x3b, 0x20000001, 0x5, 0x5, 0xa80a, 0x65f413f9, 0x4, 0x20006, 0x8a5, 0x86, 0x44, 0x409, 0x3, 0x4, 0x4, 0x10, 0xe, 0xffffffff, 0x7fff, 0xffff8a33, 0xfffffff9, 0x401, 0x3, 0x200, 0x7, 0x4edf, 0xfffffffd, 0xa, 0xe, 0x2, 0xf, 0xf, 0x136, 0x7fffffff]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) readv(r3, &(0x7f0000001240)=[{&(0x7f00000012c0)=""/41, 0x29}], 0x1) ioctl$UI_DEV_DESTROY(r3, 0x5502) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x8101, 0x0) write$binfmt_aout(r4, &(0x7f0000000340)=ANY=[], 0xff2e) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$lock(r5, 0x7, &(0x7f0000000100)={0x1, 0x1, 0x3, 0xfffffffffffffffe}) openat$procfs(0xffffffffffffff9c, &(0x7f0000000140)='/proc/consoles\x00', 0x0, 0x0) fcntl$lock(r5, 0x26, &(0x7f0000000080)) unshare(0x22020400) 2.246982647s ago: executing program 7 (id=3321): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000340), 0x1c9140, 0x0) io_setup(0x222, &(0x7f0000000180)=0x0) syz_emit_ethernet(0x4a, &(0x7f0000000000)={@local, @local, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "00ed6a", 0x14, 0x2c, 0x0, @remote, @local, {[], {{0x2c00, 0x2, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}}, 0x0) io_submit(r1, 0x1a, &(0x7f00000000c0)=[&(0x7f0000000200)={0x0, 0x0, 0x8, 0x0, 0x0, r0, &(0x7f0000000000)='%', 0x1a000}, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0}]) mount(&(0x7f0000000140)=@sg0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000000)='udf\x00', 0x208000, 0x0) 2.165277571s ago: executing program 0 (id=3322): r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_vs\x00') read(r0, &(0x7f0000001b00)=""/194, 0xc2) ioctl$EVIOCGVERSION(r0, 0x80044501, &(0x7f0000000040)=""/33) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003900)={0x1c, 0x41, 0x1, 0x70bd2c, 0x25dfdbfe, {0x4, 0x7c}, [@typed={0x8, 0x109, 0x0, 0x0, @u32=0x101}]}, 0x1c}, 0x1, 0x0, 0x0, 0xc090}, 0x40044) pselect6(0x40, &(0x7f0000000080)={0x4, 0x2, 0xffffffff, 0x3, 0x2, 0x0, 0x80000000, 0x9}, &(0x7f00000000c0)={0xfffffffffffff724, 0x4e, 0xfe1, 0x3fd4, 0x3, 0x8, 0x100000001, 0x7}, &(0x7f0000000100)={0x4f0b29d7, 0x0, 0x2, 0x8, 0xffffffffffffffff, 0x1ff, 0x4, 0x1}, &(0x7f0000000140), &(0x7f0000000200)={&(0x7f00000001c0)={[0x5, 0x1]}, 0x8}) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0xfffffffd, @local, 0x2}, 0x1a) r3 = fsopen(&(0x7f0000000940)='ramfs\x00', 0x1) unshare(0x28000600) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=@base={0x16, 0x100005, 0x5, 0x900, 0x1}, 0x50) bpf$MAP_GET_NEXT_KEY(0x4, 0x0, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fsmount(r3, 0x0, 0x6) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000000340)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) keyctl$instantiate_iov(0x14, 0x0, &(0x7f0000001940)=[{0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}, {0x0}], 0x9, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r5 = syz_open_dev$sndpcmp(&(0x7f0000000000), 0x1, 0xa0181) writev(r5, 0x0, 0x0) r6 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x8081) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$RDMA_NLDEV_CMD_RES_MR_GET(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000280)={0x0, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) 1.671873896s ago: executing program 7 (id=3323): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$IPVS_CMD_SET_INFO(r1, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) r2 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x4e22, @broadcast}, 0x10) listen(r2, 0x0) syz_emit_ethernet(0x36, &(0x7f00000002c0)=ANY=[@ANYBLOB="aaaaaa02000000000000009a58658446a026aaa4aaefe8ce9f00c305090ca9e935fc3f34002800667864010001ffffffff00004e220000000000000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="5cc2000090780005"], 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000800)={0x1f, 0xc, &(0x7f00000001c0)=@framed={{}, [@call={0x85, 0x0, 0x0, 0xe}, @printk={@d, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0xb0}}]}, &(0x7f0000000480)='GPL\x00', 0x7, 0x0, 0x0, 0x0, 0x11}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) getsockname$packet(r1, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000040)={0xe4}, 0x10) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0xfffffffffffffed5, &(0x7f0000000240)={&(0x7f0000000280)=@ipv6_getaddrlabel={0x24, 0x4a, 0x6d1c8b79a9711461, 0x0, 0x0, {}, [@IFAL_LABEL={0x8}]}, 0x24}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r4, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c0002000800010006"], 0x3c}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000440)=ANY=[@ANYBLOB="5800000010001f0a000000ff0100000000000000", @ANYRES32=0x0, @ANYBLOB="0600010008440000300012800b00010067656e65766500002000028014000700fe8000000000000000000000000000aa050009000100000008000a00", @ANYRES32=r4, @ANYBLOB], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x8000) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r6, 0x1, 0x1a, &(0x7f0000000000)={0x2, &(0x7f0000000180)=[{0x20, 0x0, 0x0, 0xfffff03c}, {0x6, 0x0, 0x0, 0x3}]}, 0x8) r7 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r7, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000380)=@newlink={0x38, 0x10, 0x503, 0x70bd2a, 0x700, {0x0, 0x0, 0x0, 0x0, 0x0, 0x3806}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @vti={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VTI_LOCAL={0x8, 0x4, @multicast1}]}}}]}, 0x38}}, 0x440b0) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r7, 0x89f2, &(0x7f00000005c0)={'ip_vti0\x00', &(0x7f00000004c0)={'gre0\x00', 0x0, 0x10, 0x8, 0x5, 0x200, {{0x5, 0x4, 0x1, 0x21, 0x14, 0x64, 0x0, 0xfb, 0x4, 0x0, @multicast1, @empty}}}}) arch_prctl$ARCH_MAP_VDSO_X32(0x2001, 0x8) 1.092938512s ago: executing program 5 (id=3324): ioctl$TIOCL_GETMOUSEREPORTING(0xffffffffffffffff, 0x541c, &(0x7f0000000100)) r0 = socket$kcm(0xa, 0x5, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) lstat(0x0, &(0x7f0000000040)) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000240)={0xffffffffffffffff, 0x0, 0x28, 0xe40, &(0x7f00000002c0)='\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f0000000300)=""/8, 0xa000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x4c) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = userfaultfd(0x801) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x241}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000000)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_CONTINUE(r2, 0xc020aa08, &(0x7f0000000080)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) setsockopt$sock_attach_bpf(r0, 0x84, 0x1e, 0x0, 0x0) socket$kcm(0x10, 0x2, 0x0) openat$procfs(0xffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCMIWAIT(0xffffffffffffffff, 0x545c, 0x0) 801.375963ms ago: executing program 0 (id=3325): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000840)=ANY=[@ANYBLOB="180300001f000100000000000000000005030080bbaf83418d3d3807418fb0f8ca9050472a8ee50b7604574904e0022f800c00a2800800ed0073797a0014003600fe880000000000000000000000000101080088800400c7004101828089ed77aab594e82d4130765cfe27a0474702ffffffff2f9058b43bbd4ec0aaa9a29b63124516a94dcb22e6b848ff43c4ec16d62c5c5519d4f3be498ed39fcaea8aedd4f2d112542cb024be83f11e60b3eb0431b54bf552948680dc1be5500553ff7ec1e37664c17a09e6c5aeaf6a93b6a435f09861142251f6b6d7ad9fff375e4e5fb5524271d4582c9bccc461c18bb51b9f4b80e2ae039a7154e85e51b21b87e65348e6a31ecd8b46860500000000000000a68c349c349d87b44b6ccb4c6165748f623009feaff556951d44fa69d1b6c74e019e3ae39d8a1bf06ce795da916b38ef8bfc3b4acaf16b2770bd536bd71fd0b8ca2aaca1d4c27481f11dea854f922c6eedf306c6eaefaaef25d38008e27e8079b660bf4c383fa855ba1c48c024da9ca571f91ea7e6740fc095d1505551418b7a3e7d2f3cb3b946d42bef990000006d0134801000588008003e00", @ANYRES32=0x0, @ANYBLOB="040000802fdc64a3cb68beebebe2487043912017df0e60a3d84ed15f81aa1d567cc762bf17c9edcc2418bceb0ee625d67558a560cc5cb15e4f38d09a7a05c4e9637e7a6cfae3f02923b74b46eeb09f54d7a254d9115d647375b576520350c2781ebe799dc9060dcf8c7b1a4f8bed00ae0004f0d526c38cacd8be99b1e59e8c6b349c6f3bca8a3d4464eade8399e188a92c1dd7608f9b6e0c5226e8594f410b0b5b14cb8bda48492a00a52ca0c3f770db9ff9f28b754923f5770e3ccf9350947ef826f66579a33eb9ba0f59cea3938d56f9df7033bf9ae6d80d01ed7eae95c23aae20ae3186b10226da539b3d36a83d82106370bcca942892fc02b855977ebfb8366ba4fe4b3767ea435128e3d9a5cf6081ec4c80b77c8951fda58a1b853ec8078274e06b0209e4de832101010161cca9292b68f3260a49e7deb3c38c5c93efc70695e51f6b140c29e4ded6a9f3a3484ad23d846823d67c5d5dc500000000000008007200", @ANYRES32=0x0, @ANYBLOB='\x00\x00\x00'], 0x318}], 0x1}, 0x40000) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a050000000000000000000500000009000100e86f7a30000000002c000000030a01010000000000000000050000000900010073797a30000000000900030073797a300000000048000000060a01040000004000000000200004801c0001800b00010074756e6e656c00000c00028008000140000000000900010073797a3000000000140000001100010000000000000000000000000a838852b85b0aba40a37621a04e64df655504a63cb288907c2e82d326df8bcd16fddabd8a7650e9d454e3284d504a848fea0cc68f89e35c7fb6488b01538577e517af200b7531eeb79f8496c8f49ffe57ee6395b13c1105168ca3388685875a412661e44d73291103c03bb1c4323d908847d6ef14a15fecf65ea07d66e2c66fc7224488c1979ad7d58f0bf6d724d9851b43b207bccbf79199054821211c19a515e5cae84658b43f13c75556e5b32c4b0c35d705cb05386b29023a9ce67abe3786631345da0a1fea27c34568c141f808d8cd3b174768d48a789f6972c8ce2e6089a5a87df468f8171fb6cf3c365849f05b8836b045dedcc0f8a01ff2a8e634ea93eed7ac8f925938efb4314f88293a97556035bbb03f058021f74befa86cb157e3f7f2ac028791c73bfc6edbc5a9d8ca64de42c08fb150eb6669c74795be0ef46835e5f7b8d3d051"], 0xbc}}, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r0) r4 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r4) sendmsg$TIPC_CMD_ENABLE_BEARER(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES8=r2, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x40000) ioctl$SIOCSIFHWADDR(r3, 0x8914, &(0x7f0000002280)={'pimreg0\x00', @multicast}) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) close(r5) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f00000001c0)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x5c, 0x24, 0x2, 0x70bd2b, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0x0, 0xe}, {0x2, 0x7}, {0xffe0, 0xf}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x2c, 0x2, [@TCA_FQ_PIE_MEMORY_LIMIT={0x8, 0x8, 0x10006}, @TCA_FQ_PIE_ALPHA={0x8, 0x5, 0x12}, @TCA_FQ_PIE_LIMIT={0x8, 0x1, 0x6}, @TCA_FQ_PIE_DQ_RATE_ESTIMATOR={0x8, 0xc, 0x1}, @TCA_FQ_PIE_QUANTUM={0x8, 0x7, 0x6}]}}]}, 0x5c}, 0x1, 0x0, 0x0, 0x20004061}, 0x4008000) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$int_in(r8, 0x40000000af01, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x40102, 0x0) ioctl$TUNSETIFF(r9, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) ioctl$VHOST_SET_VRING_ADDR(r8, 0x4028af11, &(0x7f0000000280)={0x0, 0x1, 0x0, &(0x7f0000001600)=""/118, 0x0, 0x3332f000}) ioctl$VHOST_SET_MEM_TABLE(r8, 0x4008af03, &(0x7f0000000000)) r10 = dup(r9) socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$VHOST_NET_SET_BACKEND(r8, 0x4008af30, &(0x7f0000000080)={0x1, r10}) r11 = dup(r8) ioctl$VHOST_NET_SET_BACKEND(r11, 0xaf02, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) socket$inet_tcp(0x2, 0x1, 0x0) 630.811677ms ago: executing program 1 (id=3326): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nbd(&(0x7f0000000000), 0xffffffffffffffff) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000100)={0xffffffffffffffff}) sendmsg$NBD_CMD_CONNECT(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000001a80)={&(0x7f0000000140)={0x3c, r1, 0x1, 0xffffffff, 0x0, {}, [@NBD_ATTR_SERVER_FLAGS={0xc, 0x5, 0x16c}, @NBD_ATTR_SIZE_BYTES={0xc, 0x2, 0x7fff}, @NBD_ATTR_SOCKETS={0x10, 0x7, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, {0x8, 0x1, r2}}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0xff7f}, 0x20000000) 474.937158ms ago: executing program 7 (id=3327): openat$qrtrtun(0xffffffffffffff9c, &(0x7f0000000100), 0x8000) r0 = socket$qrtr(0x2a, 0x2, 0x0) connect$qrtr(r0, &(0x7f0000000040)={0x2a, 0xffffffffffffffff, 0xfffffffe}, 0xc) writev(r0, &(0x7f0000001980)=[{&(0x7f0000000240)="f9", 0x1}], 0x1) close(0x3) 7.075433ms ago: executing program 5 (id=3328): openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee3, 0x8032, 0xffffffffffffffff, 0x28f41000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) r0 = gettid() timer_create(0x1, &(0x7f0000533fa0)={0x0, 0x21, 0x4, @tid=r0}, &(0x7f00000001c0)) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x7}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x181) openat(0xffffffffffffff9c, 0x0, 0x42, 0x0) chdir(&(0x7f0000000140)='./file0\x00') chown(&(0x7f0000000040)='./file1\x00', 0x0, 0x0) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x0) timer_settime(0x0, 0x0, &(0x7f00000000c0)={{}, {0x0, 0x3938700}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sched_setscheduler(0x0, 0x1, 0x0) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x1000007, 0x2172, 0xffffffffffffffff, 0x3000) prctl$PR_SET_MM(0x23, 0x8, &(0x7f0000001000/0x4000)=nil) munmap(&(0x7f0000002000/0x2000)=nil, 0x2000) r1 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='cmdline\x00') preadv(r1, &(0x7f0000000080)=[{&(0x7f0000001440)=""/4106, 0x100a}], 0x1, 0x300, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$netlink(0x10, 0x3, 0x8000000004) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000180)={0x1, &(0x7f0000000000)=[{0x81, 0x1, 0xff, 0x7fff7ffc}]}) close_range(r2, r2, 0x200000000000000) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0x6, 0x3, &(0x7f0000000d80)=ANY=[@ANYBLOB="1800000003000000000000000000000095"], &(0x7f0000000000)='syzkaller\x00'}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000040)={r3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1e, 0x0, 0x1b, 0x0, &(0x7f0000000f00)="00000000280000000000b48975e2a9e301ead441d182d2990491c8", 0x0, 0x2}, 0x4c) ioctl$FS_IOC_GETFLAGS(r3, 0x80046601, &(0x7f0000000080)) 211.741µs ago: executing program 7 (id=3329): syz_open_dev$tty1(0xc, 0x4, 0x4) r0 = io_uring_setup(0x664b, &(0x7f0000000500)={0x0, 0x5e87, 0x0, 0x0, 0x337}) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_EXTERNAL_AUTH(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000300)={0x30, 0x0, 0x8, 0x70bd25, 0x25dfdbfe, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_PMKID={0x14, 0x55, "00dfaffe03c7cec198d683db41dc6870"}]}, 0x30}}, 0x8040040) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$TIOCSETD(r2, 0x5423, &(0x7f00000000c0)=0xf) r3 = syz_open_dev$loop(&(0x7f0000000240), 0xffffffff7ffffffd, 0x1ea1e2) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f0000000080)={0xffffffffffffffff, 0x0, {0x0, 0x0, 0x0, 0x4, 0x4000000000000ffd, 0x0, 0x0, 0xa, 0x0, "faf98357e5a1149989fc8dbec3bd02b82a128bbad0099cebdc25f5abb534464c516bdd8a0f3500", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "715237641a8ccf162e43ac61f700000000009b4100000200", [0x9, 0xa]}}) socket$nl_route(0x10, 0x3, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) pwrite64(r3, &(0x7f0000000000)="37e389b3", 0x4, 0x1ff) openat$nvme_fabrics(0xffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) r4 = socket$kcm(0x10, 0x2, 0x0) ioctl$sock_SIOCGIFVLAN_SET_VLAN_FLAG_CMD(r4, 0x8982, &(0x7f0000000000)={0x7, 'veth1_to_bond\x00', {0x8}, 0x9}) ioctl$FS_IOC_FSGETXATTR(r2, 0x400455c8, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=3330): r0 = socket$pppl2tp(0x18, 0x1, 0x1) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) connect$inet6(r1, &(0x7f0000000180)={0xa, 0x4e20, 0x7, @remote, 0x6}, 0x1c) r2 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000001c0)=ANY=[@ANYBLOB="fc000000190001002dbd700000000000ff020000000000000000000000000001ac1414bb00000000000000000000000000000000000000080a"], 0xfc}}, 0x8000) sendmsg$L2TP_CMD_SESSION_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x34, r2, 0x1, 0x1070bd2c, 0x4, {0x5}, [@L2TP_ATTR_PW_TYPE={0x6, 0x1, 0x5}, @L2TP_ATTR_CONN_ID={0x8, 0x9, 0x2}, @L2TP_ATTR_SESSION_ID={0x8, 0xb, 0x1000000}, @L2TP_ATTR_PEER_SESSION_ID={0x8, 0xc, 0xaa8}]}, 0x34}, 0x1, 0x0, 0x0, 0x20008000}, 0x30) kernel console output (not intermixed with test programs): p2: p2 start 1702059890 is beyond EOD, truncated [ 692.566208][ T5832] usb 10-1: new high-speed USB device number 46 using dummy_hcd [ 692.636108][ T5754] Bluetooth: hci4: command 0x0406 tx timeout [ 692.718474][ T5832] usb 10-1: Using ep0 maxpacket: 32 [ 692.738475][ T5832] usb 10-1: unable to get BOS descriptor or descriptor too short [ 692.763724][ T5832] usb 10-1: config 14 has an invalid interface number: 57 but max is 1 [ 692.767033][ T5832] usb 10-1: config 14 has an invalid interface number: 228 but max is 1 [ 692.769946][ T5832] usb 10-1: config 14 has no interface number 0 [ 692.772011][ T5832] usb 10-1: config 14 has no interface number 1 [ 692.774139][ T5832] usb 10-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 692.779203][ T5832] usb 10-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 692.783073][ T5832] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 692.787486][ T5832] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 692.791323][ T5832] usb 10-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 692.797631][ T5832] usb 10-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 692.802033][ T5832] usb 10-1: config 14 interface 57 has no altsetting 0 [ 692.804313][ T5832] usb 10-1: config 14 interface 228 has no altsetting 0 [ 692.819941][ T5832] usb 10-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 692.825352][ T5832] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 692.831692][ T5832] usb 10-1: Product: syz [ 692.833387][ T5832] usb 10-1: Manufacturer: syz [ 692.838510][ T5832] usb 10-1: SerialNumber: syz [ 693.478649][ T5832] legousbtower 10-1:14.57: interrupt endpoints not found [ 694.024512][T16552] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2786'. [ 694.197110][T16555] openvswitch: netlink: Missing key (keys=40, expected=100) [ 694.227429][ T42] kauditd_printk_skb: 29 callbacks suppressed [ 694.227448][ T42] audit: type=1800 audit(1784271076.290:5967): pid=16555 uid=60929 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.0.2787" name="file1" dev="tmpfs" ino=566 res=0 errno=0 [ 694.312531][T16558] virt_wifi0 speed is unknown, defaulting to 1000 [ 694.316345][T16558] lo speed is unknown, defaulting to 1000 [ 694.400026][ T5832] legousbtower 10-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 694.405267][ T5832] legousbtower 10-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 694.557987][T16566] loop2: detected capacity change from 0 to 7 [ 694.563851][T16566] Dev loop2: unable to read RDB block 7 [ 694.565645][T16566] loop2: AHDI p1 p2 p3 [ 694.567338][T16566] loop2: partition table partially beyond EOD, truncated [ 694.569738][T16566] loop2: p1 start 1601398130 is beyond EOD, truncated [ 694.572280][T16566] loop2: p2 start 1702059890 is beyond EOD, truncated [ 694.685636][T16570] input: syz1 as /devices/virtual/input/input26 [ 695.286007][ T5754] Bluetooth: hci2: command 0x0405 tx timeout [ 695.436218][T16535] usb 10-1: LEGO USB Tower reset control request failed [ 695.462450][T11333] usb 10-1: USB disconnect, device number 46 [ 695.492777][T11333] legousbtower 10-1:14.228: LEGO USB Tower #-160 now disconnected [ 696.249487][ T42] audit: type=1326 audit(1784271078.300:5968): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.290953][T16586] netlink: 36 bytes leftover after parsing attributes in process `syz.7.2798'. [ 696.418095][ T42] audit: type=1326 audit(1784271078.300:5969): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.432548][ T42] audit: type=1326 audit(1784271078.350:5970): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=297 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.441755][ T42] audit: type=1326 audit(1784271078.350:5971): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.450178][ T42] audit: type=1326 audit(1784271078.360:5972): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=358 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.457258][ T42] audit: type=1326 audit(1784271078.360:5973): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.464086][ T42] audit: type=1326 audit(1784271078.360:5974): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.471166][ T42] audit: type=1326 audit(1784271078.360:5975): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.481598][ T42] audit: type=1326 audit(1784271078.360:5976): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=16581 comm="syz.7.2798" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7ff6fec code=0x7ffc0000 [ 696.536117][T14581] usb 12-1: new high-speed USB device number 7 using dummy_hcd [ 696.728783][T14581] usb 12-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 696.732983][T14581] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 696.742699][T14581] usb 12-1: Product: syz [ 696.744620][T14581] usb 12-1: Manufacturer: syz [ 696.748998][T14581] usb 12-1: SerialNumber: syz [ 696.792314][T14581] usb 12-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 696.800529][T16591] 9p: Bad value for 'rfdno' [ 696.936825][ T6056] usb 12-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 697.640558][T16599] macsec0: entered allmulticast mode [ 697.643049][T16599] veth1_macvtap: entered allmulticast mode [ 698.061970][ T6056] ath9k_htc 12-1:1.0: ath9k_htc: Target is unresponsive [ 698.065333][ T6056] ath9k_htc: Failed to initialize the device [ 698.096795][ T6056] usb 12-1: ath9k_htc: USB layer deinitialized [ 698.186842][T16608] kAFS: unparsable volume name [ 699.004492][T16583] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 699.007403][T16583] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 699.015624][T16583] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 699.017732][T16583] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 699.022672][T16583] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 699.031929][T16583] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 699.034709][T16583] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 699.037428][T16583] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 699.041222][T16583] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 699.089888][ T6763] usb 12-1: USB disconnect, device number 7 [ 699.178756][T16622] input: syz1 as /devices/virtual/input/input27 [ 699.192968][T16623] netlink: 'syz.1.2804': attribute type 5 has an invalid length. [ 699.436361][T16627] netlink: 'syz.7.2807': attribute type 1 has an invalid length. [ 699.439947][T16627] netlink: 224 bytes leftover after parsing attributes in process `syz.7.2807'. [ 699.515945][ T5754] Bluetooth: hci4: command 0x0406 tx timeout [ 700.038061][T16649] loop2: detected capacity change from 0 to 7 [ 700.048665][T16649] Dev loop2: unable to read RDB block 7 [ 700.051272][T16649] loop2: AHDI p1 p2 p3 [ 700.053043][T16649] loop2: partition table partially beyond EOD, truncated [ 700.065591][T16649] loop2: p1 start 1601398130 is beyond EOD, truncated [ 700.073192][T16649] loop2: p2 start 1702059890 is beyond EOD, truncated [ 700.087711][T15167] Dev loop2: unable to read RDB block 7 [ 700.089900][T15167] loop2: AHDI p1 p2 p3 [ 700.091251][T15167] loop2: partition table partially beyond EOD, truncated [ 700.093922][T16652] 9p: Bad value for 'rfdno' [ 700.095417][T15167] loop2: p1 start 1601398130 is beyond EOD, truncated [ 700.099725][T16651] virt_wifi0 speed is unknown, defaulting to 1000 [ 700.101829][T15167] loop2: p2 start 1702059890 is beyond EOD, truncated [ 700.134346][T16651] lo speed is unknown, defaulting to 1000 [ 700.396193][T14581] usb 6-1: new full-speed USB device number 45 using dummy_hcd [ 700.567613][T14581] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x45, changing to 0x5 [ 700.593676][T14581] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 200, setting to 64 [ 700.619582][T14581] usb 6-1: config 0 interface 0 has no altsetting 0 [ 700.667016][T14581] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 700.690997][T14581] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 700.741175][T14581] usb 6-1: Product: syz [ 700.752742][T14581] usb 6-1: Manufacturer: syz [ 700.765314][T14581] usb 6-1: SerialNumber: syz [ 700.840668][T14581] usb 6-1: config 0 descriptor?? [ 701.037858][ T5754] Bluetooth: hci2: command 0x0405 tx timeout [ 701.043405][ T5754] Bluetooth: hci3: command 0x040f tx timeout [ 701.047792][T13838] Bluetooth: hci1: command 0x0c1a tx timeout [ 701.314441][T16662] binder: 16660:16662 ioctl c0306201 0 returned -14 [ 701.436980][T14581] usb 6-1: selecting invalid altsetting 0 [ 701.611701][ T5754] Bluetooth: hci4: command 0x0406 tx timeout [ 701.636819][T16667] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2819'. [ 702.559820][T16677] trusted_key: syz.5.2820 sent an empty control message without MSG_MORE. [ 702.735051][T16680] loop2: detected capacity change from 0 to 7 [ 702.740338][T16680] Dev loop2: unable to read RDB block 7 [ 702.742206][T16680] loop2: AHDI p1 p2 p3 [ 702.743720][T16680] loop2: partition table partially beyond EOD, truncated [ 702.746542][T16680] loop2: p1 start 1601398130 is beyond EOD, truncated [ 702.749049][T16680] loop2: p2 start 1702059890 is beyond EOD, truncated [ 702.830545][T14581] usb 6-1: USB disconnect, device number 45 [ 702.933969][T16686] netlink: 24 bytes leftover after parsing attributes in process `syz.7.2823'. [ 702.939355][T16686] netlink: 40 bytes leftover after parsing attributes in process `syz.7.2823'. [ 703.058961][T16690] input: syz1 as /devices/virtual/input/input28 [ 703.126092][ T5754] Bluetooth: hci2: command 0x0405 tx timeout [ 703.126187][T13838] Bluetooth: hci1: command 0x0c1a tx timeout [ 703.988751][T16705] loop2: detected capacity change from 0 to 7 [ 704.029181][T16705] Dev loop2: unable to read RDB block 7 [ 704.036417][T16705] loop2: AHDI p1 p2 p3 [ 704.038239][T16705] loop2: partition table partially beyond EOD, truncated [ 704.049115][T16705] loop2: p1 start 1601398130 is beyond EOD, truncated [ 704.054246][T16705] loop2: p2 start 1702059890 is beyond EOD, truncated [ 704.716704][T16710] netlink: 20 bytes leftover after parsing attributes in process `syz.7.2829'. [ 704.796617][T16713] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2830'. [ 705.044506][T15167] block nbd64: NBD_DISCONNECT [ 705.195977][ T5754] Bluetooth: hci1: command 0x0c1a tx timeout [ 705.196301][T13838] Bluetooth: hci2: command 0x0405 tx timeout [ 705.386226][T13204] usb 10-1: new full-speed USB device number 47 using dummy_hcd [ 705.547694][T13204] usb 10-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x45, changing to 0x5 [ 705.554296][T13204] usb 10-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 200, setting to 64 [ 705.562652][T13204] usb 10-1: config 0 interface 0 has no altsetting 0 [ 705.567050][T13204] usb 10-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 705.571846][T13204] usb 10-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 705.589466][T13204] usb 10-1: Product: syz [ 705.590908][T13204] usb 10-1: Manufacturer: syz [ 705.595062][T13204] usb 10-1: SerialNumber: syz [ 705.600744][T13204] usb 10-1: config 0 descriptor?? [ 705.610829][T13204] usb 10-1: selecting invalid altsetting 0 [ 705.693861][T16738] netlink: 'syz.0.2835': attribute type 5 has an invalid length. [ 705.714357][T16734] input: syz1 as /devices/virtual/input/input29 [ 705.826736][T13204] usb 10-1: USB disconnect, device number 47 [ 705.956033][T12301] usb 6-1: new full-speed USB device number 46 using dummy_hcd [ 706.107554][T12301] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x45, changing to 0x5 [ 706.112065][T12301] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 200, setting to 64 [ 706.116585][T12301] usb 6-1: config 0 interface 0 has no altsetting 0 [ 706.122026][T12301] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 706.125349][T12301] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 706.129411][T12301] usb 6-1: Product: syz [ 706.130856][T12301] usb 6-1: Manufacturer: syz [ 706.132459][T12301] usb 6-1: SerialNumber: syz [ 706.135668][T12301] usb 6-1: config 0 descriptor?? [ 706.142426][T12301] usb 6-1: selecting invalid altsetting 0 [ 706.351624][T12301] usb 6-1: USB disconnect, device number 46 [ 706.425644][T16745] loop2: detected capacity change from 0 to 7 [ 706.430369][T16745] Dev loop2: unable to read RDB block 7 [ 706.432957][T16745] loop2: AHDI p1 p2 p3 [ 706.434696][T16745] loop2: partition table partially beyond EOD, truncated [ 706.438442][T16745] loop2: p1 start 1601398130 is beyond EOD, truncated [ 706.441185][T16745] loop2: p2 start 1702059890 is beyond EOD, truncated [ 706.875350][T16755] fuse: Bad value for 'group_id' [ 706.888739][T16755] fuse: Bad value for 'group_id' [ 707.685351][ T59] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 707.846896][T16766] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2844'. [ 708.015340][T16770] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2845'. [ 708.115144][ T59] usb 6-1: Using ep0 maxpacket: 32 [ 708.510060][ T59] usb 6-1: unable to get BOS descriptor or descriptor too short [ 708.625658][ T59] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 708.628332][ T59] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 708.631469][ T59] usb 6-1: config 14 has no interface number 0 [ 708.633743][ T59] usb 6-1: config 14 has no interface number 1 [ 708.635798][ T59] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 708.639367][ T59] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 708.643178][ T59] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 708.646745][ T59] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 708.649423][T16777] loop2: detected capacity change from 0 to 7 [ 708.650830][ T59] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 708.653556][T16777] Dev loop2: unable to read RDB block 7 [ 708.659445][ T59] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 708.659897][T16777] loop2: AHDI p1 p2 p3 [ 708.664649][ T59] usb 6-1: config 14 interface 57 has no altsetting 0 [ 708.665985][T16777] loop2: partition table partially beyond EOD, truncated [ 708.666099][T16777] loop2: p1 start 1601398130 is beyond EOD, truncated [ 708.666110][T16777] loop2: p2 start 1702059890 is beyond EOD, truncated [ 708.678914][ T59] usb 6-1: config 14 interface 228 has no altsetting 0 [ 708.683955][ T59] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 708.687707][ T59] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 708.693829][ T59] usb 6-1: Product: syz [ 708.695546][ T59] usb 6-1: Manufacturer: syz [ 708.697669][ T59] usb 6-1: SerialNumber: syz [ 708.801131][T16782] netlink: 20 bytes leftover after parsing attributes in process `syz.5.2848'. [ 709.365168][T16788] input: syz1 as /devices/virtual/input/input30 [ 709.785917][ T59] legousbtower 6-1:14.57: interrupt endpoints not found [ 710.021120][ T59] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 710.033771][ T59] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 710.225342][T16800] overlayfs: missing 'lowerdir' [ 710.230158][T16800] overlay: Unknown parameter 'fscontext' [ 710.783297][ C1] usb 6-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 710.788624][T14581] usb 6-1: USB disconnect, device number 47 [ 710.951475][T14581] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 711.011111][T16807] loop2: detected capacity change from 0 to 7 [ 711.019609][T16807] Dev loop2: unable to read RDB block 7 [ 711.024649][T16807] loop2: AHDI p1 p2 p3 [ 711.033418][T16807] loop2: partition table partially beyond EOD, truncated [ 711.044962][T16807] loop2: p1 start 1601398130 is beyond EOD, truncated [ 711.054810][T16807] loop2: p2 start 1702059890 is beyond EOD, truncated [ 711.447763][T16815] netlink: 'syz.5.2858': attribute type 5 has an invalid length. [ 711.474837][T16818] netlink: 4 bytes leftover after parsing attributes in process `syz.1.2859'. [ 711.576241][T16821] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 711.666254][ T6056] usb 5-1: new full-speed USB device number 48 using dummy_hcd [ 711.818809][ T6056] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 711.822921][ T6056] usb 5-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 711.826777][ T6056] usb 5-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 711.830620][ T6056] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 711.835583][ T6056] usb 5-1: config 0 descriptor?? [ 711.840733][ T6056] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 711.843405][ T6056] dvb-usb: bulk message failed: -22 (3/0) [ 711.848272][ T6056] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 711.852018][ T6056] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 711.854745][ T6056] usb 5-1: media controller created [ 711.858165][ T6056] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 711.873320][ T6056] dvb-usb: bulk message failed: -22 (6/0) [ 711.876717][ T6056] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 711.882800][ T6056] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.0/usb5/5-1/input/input31 [ 711.889169][ T6056] dvb-usb: schedule remote query interval to 150 msecs. [ 711.891930][ T6056] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 712.051648][ T6056] dvb-usb: bulk message failed: -22 (1/0) [ 712.067409][ T6056] dvb-usb: error while querying for an remote control event. [ 712.235204][T16828] ceph: No mds server is up or the cluster is laggy [ 712.236161][ T6056] dvb-usb: bulk message failed: -22 (1/0) [ 712.239821][ T6056] dvb-usb: error while querying for an remote control event. [ 712.415961][ T6056] dvb-usb: bulk message failed: -22 (1/0) [ 712.418425][ T6056] dvb-usb: error while querying for an remote control event. [ 712.463167][ T5840] usb 5-1: USB disconnect, device number 48 [ 712.477507][T16838] fuse: Bad value for 'group_id' [ 712.483292][T16838] fuse: Bad value for 'group_id' [ 712.489997][ T5840] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 712.619873][T16840] bridge0: port 3(vlan2) entered disabled state [ 712.622530][T16840] bridge0: port 2(bridge_slave_1) entered disabled state [ 712.625523][T16840] bridge0: port 1(bridge_slave_0) entered disabled state [ 712.872658][T16840] veth1_macvtap: left allmulticast mode [ 712.949286][ T13] netdevsim netdevsim1 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.953127][ T13] netdevsim netdevsim1 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.957867][ T13] netdevsim netdevsim1 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 712.961727][ T13] netdevsim netdevsim1 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 713.074115][T16844] loop2: detected capacity change from 0 to 7 [ 713.103552][T16844] Dev loop2: unable to read RDB block 7 [ 713.106101][T16844] loop2: AHDI p1 p2 p3 [ 713.107870][T16844] loop2: partition table partially beyond EOD, truncated [ 713.114597][T16844] loop2: p1 start 1601398130 is beyond EOD, truncated [ 713.126916][T16844] loop2: p2 start 1702059890 is beyond EOD, truncated [ 713.275793][T16851] FAULT_INJECTION: forcing a failure. [ 713.275793][T16851] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 713.287142][T16851] CPU: 3 UID: 0 PID: 16851 Comm: syz.5.2868 Tainted: G L syzkaller #0 PREEMPT(full) [ 713.287162][T16851] Tainted: [L]=SOFTLOCKUP [ 713.287166][T16851] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 713.287174][T16851] Call Trace: [ 713.287179][T16851] [ 713.287184][T16851] dump_stack_lvl+0x100/0x190 [ 713.287202][T16851] should_fail_ex.cold+0x5/0xa [ 713.287215][T16851] copy_fpstate_to_sigframe+0x82d/0xae0 [ 713.287234][T16851] ? do_raw_spin_lock+0x128/0x260 [ 713.287248][T16851] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 713.287269][T16851] ? posixtimer_deliver_signal+0x19d/0x6e0 [ 713.287283][T16851] ? x86_task_fpu+0x5f/0x90 [ 713.287299][T16851] get_sigframe+0x3fb/0x940 [ 713.287319][T16851] ? __pfx_get_sigframe+0x10/0x10 [ 713.287348][T16851] ? rcu_is_watching+0x12/0xc0 [ 713.287362][T16851] ? siginfo_layout+0x156/0x290 [ 713.287383][T16851] ia32_setup_rt_frame+0xe7/0xaf0 [ 713.287399][T16851] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 713.287416][T16851] arch_do_signal_or_restart+0x459/0x7a0 [ 713.287434][T16851] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 713.287455][T16851] ? fput+0x79/0x100 [ 713.287470][T16851] exit_to_user_mode_loop+0x139/0x6f0 [ 713.287488][T16851] ? rcu_is_watching+0x12/0xc0 [ 713.287501][T16851] do_int80_emulation+0x513/0x720 [ 713.287515][T16851] asm_int80_emulation+0x1a/0x20 [ 713.287531][T16851] RIP: 0023:0xf71c72eb [ 713.287541][T16851] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 713.287553][T16851] RSP: 002b:00000000f547d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 713.287565][T16851] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00000000f547d5c0 [ 713.287572][T16851] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 713.287578][T16851] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 713.287585][T16851] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 713.287591][T16851] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 713.287605][T16851] [ 713.665149][ T6056] usb 12-1: new high-speed USB device number 8 using dummy_hcd [ 714.429566][T16866] netlink: 'syz.5.2872': attribute type 5 has an invalid length. [ 714.476148][ T6056] usb 12-1: Using ep0 maxpacket: 32 [ 714.480252][ T6056] usb 12-1: unable to get BOS descriptor or descriptor too short [ 714.484482][ T6056] usb 12-1: config 14 has an invalid interface number: 57 but max is 1 [ 714.488985][ T6056] usb 12-1: config 14 has an invalid interface number: 228 but max is 1 [ 714.492295][ T6056] usb 12-1: config 14 has no interface number 0 [ 714.494794][ T6056] usb 12-1: config 14 has no interface number 1 [ 714.498577][ T6056] usb 12-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 714.503374][ T6056] usb 12-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 714.509069][ T6056] usb 12-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 714.514154][ T6056] usb 12-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 714.519146][ T6056] usb 12-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 714.523427][ T6056] usb 12-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 714.532445][ T6056] usb 12-1: config 14 interface 57 has no altsetting 0 [ 714.534986][ T6056] usb 12-1: config 14 interface 228 has no altsetting 0 [ 714.539942][ T6056] usb 12-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 714.544144][ T6056] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 714.547114][ T6056] usb 12-1: Product: syz [ 714.548485][ T6056] usb 12-1: Manufacturer: syz [ 714.550653][ T6056] usb 12-1: SerialNumber: syz [ 714.962465][ T6056] legousbtower 12-1:14.57: interrupt endpoints not found [ 714.996196][ T6763] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 715.146028][ T6763] usb 5-1: Using ep0 maxpacket: 8 [ 715.149937][ T6763] usb 5-1: config 0 has no interfaces? [ 715.154052][ T6763] usb 5-1: New USB device found, idVendor=0763, idProduct=2003, bcdDevice= 0.40 [ 715.157687][ T6763] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 715.160754][ T6763] usb 5-1: Product: syz [ 715.162429][ T6763] usb 5-1: Manufacturer: syz [ 715.164257][ T6763] usb 5-1: SerialNumber: syz [ 715.168623][ T6763] usb 5-1: config 0 descriptor?? [ 715.367118][ T6056] legousbtower 12-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 715.436433][ T6056] legousbtower 12-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 715.499420][ T6056] usb 5-1: USB disconnect, device number 49 [ 716.121029][ T846] usb 12-1: USB disconnect, device number 8 [ 716.141566][ T846] legousbtower 12-1:14.228: LEGO USB Tower #-160 now disconnected [ 717.823746][T16905] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2884'. [ 718.104904][T15167] block nbd64: NBD_DISCONNECT [ 718.285168][T15167] udevd[15167]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 718.343224][T16916] netlink: 'syz.5.2886': attribute type 5 has an invalid length. [ 718.839008][T16924] 9p: Bad value for 'rfdno' [ 720.190712][T16942] netlink: 'syz.0.2890': attribute type 5 has an invalid length. [ 720.436108][T12301] usb 6-1: new high-speed USB device number 48 using dummy_hcd [ 720.617493][T12301] usb 6-1: Using ep0 maxpacket: 32 [ 720.622900][T12301] usb 6-1: unable to get BOS descriptor or descriptor too short [ 720.626828][T12301] usb 6-1: config 14 has an invalid interface number: 57 but max is 1 [ 720.629576][T12301] usb 6-1: config 14 has an invalid interface number: 228 but max is 1 [ 720.632831][T12301] usb 6-1: config 14 has no interface number 0 [ 720.635524][T12301] usb 6-1: config 14 has no interface number 1 [ 720.639952][T12301] usb 6-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 720.644295][T12301] usb 6-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 720.650240][T12301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 720.654885][T12301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 720.658437][T12301] usb 6-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 720.663093][T12301] usb 6-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 720.668275][T12301] usb 6-1: config 14 interface 57 has no altsetting 0 [ 720.671040][T12301] usb 6-1: config 14 interface 228 has no altsetting 0 [ 720.675771][T12301] usb 6-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 720.678826][T12301] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 720.681480][T12301] usb 6-1: Product: syz [ 720.682962][T12301] usb 6-1: Manufacturer: syz [ 720.684665][T12301] usb 6-1: SerialNumber: syz [ 721.106101][T12301] legousbtower 6-1:14.57: interrupt endpoints not found [ 721.543221][T12301] legousbtower 6-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 721.562773][T12301] legousbtower 6-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 721.731323][T16967] fuse: Bad value for 'group_id' [ 721.733636][T16967] fuse: Bad value for 'group_id' [ 722.096806][T16977] netlink: 20 bytes leftover after parsing attributes in process `syz.0.2904'. [ 722.279545][T15167] udevd[15167]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 722.496098][ C2] usb 6-1: tower_interrupt_in_callback: usb_submit_urb failed (-1) [ 722.508567][ T59] usb 6-1: USB disconnect, device number 48 [ 722.548824][ T59] legousbtower 6-1:14.228: LEGO USB Tower #-160 now disconnected [ 723.437353][T17013] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2914'. [ 723.456650][T17013] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2914'. [ 723.462336][T17013] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2914'. [ 723.468187][T17013] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2914'. [ 723.853746][T17016] virt_wifi0 speed is unknown, defaulting to 1000 [ 723.864312][T17016] lo speed is unknown, defaulting to 1000 [ 724.257513][T12301] usb 10-1: new low-speed USB device number 48 using dummy_hcd [ 724.430123][T12301] usb 10-1: config 168 descriptor has 1 excess byte, ignoring [ 724.433791][T12301] usb 10-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 724.441218][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 724.447500][T12301] usb 10-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 724.456045][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 724.464202][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 724.472055][T12301] usb 10-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 724.486165][T12301] usb 10-1: config 168 interface 0 has no altsetting 0 [ 724.492174][T12301] usb 10-1: config 168 descriptor has 1 excess byte, ignoring [ 724.495373][T12301] usb 10-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 724.501306][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 724.511433][T12301] usb 10-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 724.516740][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 724.525595][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 724.531985][T12301] usb 10-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 724.540895][T12301] usb 10-1: config 168 interface 0 has no altsetting 0 [ 724.547267][T12301] usb 10-1: config 168 descriptor has 1 excess byte, ignoring [ 724.550443][T12301] usb 10-1: too many endpoints for config 168 interface 0 altsetting 188: 100, using maximum allowed: 30 [ 724.554097][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x3 has invalid maxpacket 77, setting to 8 [ 724.559818][T12301] usb 10-1: config 168 interface 0 altsetting 188 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 724.566284][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 724.574373][T12301] usb 10-1: config 168 interface 0 altsetting 188 endpoint 0x8F has invalid maxpacket 65535, setting to 8 [ 724.577885][T12301] usb 10-1: config 168 interface 0 altsetting 188 has 2 endpoint descriptors, different from the interface descriptor's value: 100 [ 724.584328][T12301] usb 10-1: config 168 interface 0 has no altsetting 0 [ 724.599600][T12301] usb 10-1: string descriptor 0 read error: -22 [ 724.603061][T12301] usb 10-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 724.606274][T12301] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 724.666641][T12301] adutux 10-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 724.854236][T17022] FAULT_INJECTION: forcing a failure. [ 724.854236][T17022] name failslab, interval 1, probability 0, space 0, times 0 [ 724.859103][T17022] CPU: 3 UID: 0 PID: 17022 Comm: syz.5.2916 Tainted: G L syzkaller #0 PREEMPT(full) [ 724.859132][T17022] Tainted: [L]=SOFTLOCKUP [ 724.859139][T17022] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 724.859150][T17022] Call Trace: [ 724.859157][T17022] [ 724.859164][T17022] dump_stack_lvl+0x100/0x190 [ 724.859190][T17022] should_fail_ex.cold+0x5/0xa [ 724.859210][T17022] should_failslab+0xc2/0x120 [ 724.859226][T17022] __kmalloc_cache_noprof+0x91/0x6c0 [ 724.859244][T17022] ? lockdep_hardirqs_on+0x78/0x100 [ 724.859263][T17022] ? dummy_urb_enqueue+0xa3/0x880 [ 724.859291][T17022] dummy_urb_enqueue+0xa3/0x880 [ 724.859317][T17022] ? usb_hcd_map_urb_for_dma+0x28a/0x1190 [ 724.859341][T17022] ? __lock_acquire+0x49f/0x1a40 [ 724.859366][T17022] usb_hcd_submit_urb+0x268/0x2150 [ 724.859392][T17022] usb_submit_urb+0x827/0x19b0 [ 724.859405][T17022] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 724.859424][T17022] adu_read+0x99e/0x1960 [ 724.859441][T17022] ? __pfx_adu_read+0x10/0x10 [ 724.859453][T17022] ? __pfx_default_wake_function+0x10/0x10 [ 724.859466][T17022] ? bpf_lsm_file_permission+0x9/0x10 [ 724.859483][T17022] ? security_file_permission+0x76/0x210 [ 724.859498][T17022] ? rw_verify_area+0xce/0x6d0 [ 724.859513][T17022] ? __pfx_adu_read+0x10/0x10 [ 724.859525][T17022] vfs_read+0x1e4/0xb40 [ 724.859543][T17022] ? __pfx_vfs_read+0x10/0x10 [ 724.859559][T17022] ? find_held_lock+0x2b/0x80 [ 724.859571][T17022] ? __fget_files+0x215/0x3d0 [ 724.859588][T17022] ? __fget_files+0x215/0x3d0 [ 724.859606][T17022] ? __fget_files+0x21f/0x3d0 [ 724.859627][T17022] ksys_read+0x12a/0x250 [ 724.859643][T17022] ? __pfx_ksys_read+0x10/0x10 [ 724.859659][T17022] ? ksys_write+0x1ac/0x250 [ 724.859676][T17022] ? __pfx_ksys_write+0x10/0x10 [ 724.859695][T17022] __do_fast_syscall_32+0xe7/0x970 [ 724.859707][T17022] ? lockdep_hardirqs_on+0x78/0x100 [ 724.859726][T17022] do_fast_syscall_32+0x32/0x70 [ 724.859737][T17022] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 724.859753][T17022] RIP: 0023:0xf708efec [ 724.859769][T17022] Code: Unable to access opcode bytes at 0xf708efc2. [ 724.859774][T17022] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000003 [ 724.859787][T17022] RAX: ffffffffffffffda RBX: 0000000000000009 RCX: 0000000080000a80 [ 724.859794][T17022] RDX: 00000000000000ba RSI: 0000000000000000 RDI: 0000000000000000 [ 724.859801][T17022] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 724.859808][T17022] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 724.859815][T17022] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 724.859829][T17022] [ 724.863073][T12301] usb 10-1: USB disconnect, device number 48 [ 725.448379][T17048] FAULT_INJECTION: forcing a failure. [ 725.448379][T17048] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 725.452502][T17048] CPU: 1 UID: 0 PID: 17048 Comm: syz.7.2924 Tainted: G L syzkaller #0 PREEMPT(full) [ 725.452532][T17048] Tainted: [L]=SOFTLOCKUP [ 725.452537][T17048] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 725.452544][T17048] Call Trace: [ 725.452548][T17048] [ 725.452553][T17048] dump_stack_lvl+0x100/0x190 [ 725.452570][T17048] should_fail_ex.cold+0x5/0xa [ 725.452583][T17048] _copy_from_user+0x2e/0xd0 [ 725.452600][T17048] get_compat_msghdr+0xb3/0x480 [ 725.452618][T17048] ? __pfx_get_compat_msghdr+0x10/0x10 [ 725.452634][T17048] ? rcu_is_watching+0x12/0xc0 [ 725.452646][T17048] ? ___sys_recvmsg+0x177/0x1a0 [ 725.452663][T17048] ? kfree+0x1e5/0x6c0 [ 725.452679][T17048] ? __lock_acquire+0x49f/0x1a40 [ 725.452697][T17048] ___sys_recvmsg+0x193/0x1a0 [ 725.452715][T17048] ? __pfx____sys_recvmsg+0x10/0x10 [ 725.452740][T17048] ? __pfx___might_resched+0x10/0x10 [ 725.452760][T17048] do_recvmmsg+0x54d/0x740 [ 725.452779][T17048] ? __pfx_do_recvmmsg+0x10/0x10 [ 725.452798][T17048] ? find_held_lock+0x2b/0x80 [ 725.452810][T17048] ? ksys_write+0x190/0x250 [ 725.452827][T17048] ? ksys_write+0x190/0x250 [ 725.452849][T17048] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 725.452862][T17048] __sys_recvmmsg+0x21f/0x270 [ 725.452889][T17048] ? __pfx___sys_recvmmsg+0x10/0x10 [ 725.452905][T17048] ? ksys_write+0x1ac/0x250 [ 725.452923][T17048] __ia32_compat_sys_recvmmsg_time32+0xc4/0x160 [ 725.452940][T17048] ? __do_fast_syscall_32+0x98/0x970 [ 725.452951][T17048] ? lockdep_hardirqs_on+0x78/0x100 [ 725.452969][T17048] __do_fast_syscall_32+0xe7/0x970 [ 725.452980][T17048] ? lockdep_hardirqs_on+0x78/0x100 [ 725.452999][T17048] do_fast_syscall_32+0x32/0x70 [ 725.453015][T17048] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 725.453030][T17048] RIP: 0023:0xf7ff6fec [ 725.453042][T17048] Code: Unable to access opcode bytes at 0xf7ff6fc2. [ 725.453047][T17048] RSP: 002b:00000000f549550c EFLAGS: 00000292 ORIG_RAX: 0000000000000151 [ 725.453059][T17048] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000800053c0 [ 725.453066][T17048] RDX: 0000000000000a32 RSI: 0000000000000060 RDI: 0000000000000000 [ 725.453072][T17048] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 725.453079][T17048] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 725.453085][T17048] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 725.453099][T17048] [ 726.253262][T17056] pim6reg: entered allmulticast mode [ 726.302812][T17053] pim6reg: left allmulticast mode [ 726.314280][T17055] input: syz1 as /devices/virtual/input/input32 [ 726.838821][ T42] kauditd_printk_skb: 20 callbacks suppressed [ 726.838834][ T42] audit: type=1800 audit(1784271108.910:5997): pid=17065 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.2928" name="/" dev="fuse" ino=1 res=0 errno=0 [ 726.888903][T17065] Process accounting resumed [ 727.131098][T17080] loop2: detected capacity change from 0 to 7 [ 727.136214][T17080] Dev loop2: unable to read RDB block 7 [ 727.140135][T17080] loop2: unable to read partition table [ 727.142350][T17080] loop2: partition table beyond EOD, truncated [ 727.151867][T17080] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 728.715211][T17109] input: syz1 as /devices/virtual/input/input33 [ 728.783175][T15167] udevd[15167]: setting owner of /dev/input/event4 to uid=0, gid=104 failed: No such file or directory [ 728.805261][T17111] ieee802154 phy0 wpan0: encryption failed: -22 [ 729.447040][ T6763] usb 10-1: new full-speed USB device number 49 using dummy_hcd [ 729.623599][ T6763] usb 10-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x45, changing to 0x5 [ 729.639072][ T6763] usb 10-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 200, setting to 64 [ 729.657513][ T6763] usb 10-1: config 0 interface 0 has no altsetting 0 [ 729.687768][ T6763] usb 10-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 729.709780][ T6763] usb 10-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 729.721860][ T6763] usb 10-1: Product: syz [ 729.728512][ T6763] usb 10-1: Manufacturer: syz [ 729.734262][ T6763] usb 10-1: SerialNumber: syz [ 729.838625][ T6763] usb 10-1: config 0 descriptor?? [ 729.882651][T17122] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2950'. [ 729.887015][T17122] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2950'. [ 729.920886][ T6763] usb 10-1: selecting invalid altsetting 0 [ 730.345897][ T6763] usb 10-1: USB disconnect, device number 49 [ 730.620658][T17138] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2952'. [ 731.188362][T17138] virt_wifi0 speed is unknown, defaulting to 1000 [ 731.192345][T17138] lo speed is unknown, defaulting to 1000 [ 732.265323][T17155] input: syz1 as /devices/virtual/input/input34 [ 733.542089][T17177] overlay: filesystem on ./file0 is read-only [ 733.940613][T17182] FAULT_INJECTION: forcing a failure. [ 733.940613][T17182] name failslab, interval 1, probability 0, space 0, times 0 [ 733.948449][T17182] CPU: 0 UID: 0 PID: 17182 Comm: syz.7.2967 Tainted: G L syzkaller #0 PREEMPT(full) [ 733.948469][T17182] Tainted: [L]=SOFTLOCKUP [ 733.948473][T17182] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 733.948480][T17182] Call Trace: [ 733.948485][T17182] [ 733.948490][T17182] dump_stack_lvl+0x100/0x190 [ 733.948508][T17182] should_fail_ex.cold+0x5/0xa [ 733.948521][T17182] should_failslab+0xc2/0x120 [ 733.948536][T17182] __kmalloc_noprof+0xfc/0x820 [ 733.948549][T17182] ? __local_bh_enable_ip+0x9e/0x120 [ 733.948561][T17182] ? ___neigh_create+0x1532/0x2940 [ 733.948580][T17182] ___neigh_create+0x1532/0x2940 [ 733.948600][T17182] ? __lock_acquire+0x49f/0x1a40 [ 733.948618][T17182] ? nf_nat_ipv6_fn+0xff/0x2d0 [ 733.948633][T17182] ? __pfx____neigh_create+0x10/0x10 [ 733.948653][T17182] ip6_finish_output2+0xffa/0x1ce0 [ 733.948671][T17182] __ip6_finish_output+0x357/0xdf0 [ 733.948686][T17182] ip6_output+0x2aa/0xa60 [ 733.948699][T17182] ? __pfx_ip6_output+0x10/0x10 [ 733.948713][T17182] ? __pfx_ip6_finish_output+0x10/0x10 [ 733.948725][T17182] ? lock_acquire+0x1b9/0x370 [ 733.948743][T17182] ? __pfx_ip6_output+0x10/0x10 [ 733.948755][T17182] ip6_local_out+0xcb/0x1f0 [ 733.948770][T17182] ip6_send_skb+0x112/0x430 [ 733.948784][T17182] ip6_push_pending_frames+0x3b/0x50 [ 733.948798][T17182] icmpv6_push_pending_frames+0x2c1/0x450 [ 733.948820][T17182] icmp6_send+0x2197/0x3c60 [ 733.948847][T17182] ? __pfx_icmp6_send+0x10/0x10 [ 733.948864][T17182] ? __lock_acquire+0x49f/0x1a40 [ 733.948887][T17182] ? find_held_lock+0x2b/0x80 [ 733.948899][T17182] ? ip6_neigh_lookup+0x7be/0xc00 [ 733.948911][T17182] ? ip6_neigh_lookup+0x7be/0xc00 [ 733.948928][T17182] ? __ipv6_addr_type+0xe8/0x2e0 [ 733.948943][T17182] ? ip6_link_failure+0x31/0x580 [ 733.948960][T17182] ip6_link_failure+0x31/0x580 [ 733.948978][T17182] ? __pfx_ip6_link_failure+0x10/0x10 [ 733.948995][T17182] ip6_tnl_xmit+0x52a/0x3970 [ 733.949017][T17182] ? __pfx_ip6_tnl_xmit+0x10/0x10 [ 733.949038][T17182] ? ip6_tnl_parse_tlv_enc_lim+0x333/0x710 [ 733.949057][T17182] ip6_tnl_start_xmit+0x6c6/0x1760 [ 733.949076][T17182] ? __pfx_ip6_tnl_start_xmit+0x10/0x10 [ 733.949106][T17182] ? netif_skb_features+0x9cf/0x13f0 [ 733.949167][T17182] dev_hard_start_xmit+0x121/0x760 [ 733.949199][T17182] __dev_queue_xmit+0x1b9d/0x4940 [ 733.949225][T17182] ? look_up_lock_class+0x55/0x120 [ 733.949244][T17182] ? __pfx___dev_queue_xmit+0x10/0x10 [ 733.949261][T17182] ? register_lock_class+0x40/0x560 [ 733.949282][T17182] ? __lock_acquire+0x49f/0x1a40 [ 733.949310][T17182] neigh_connected_output+0x3b7/0x5d0 [ 733.949337][T17182] ip6_finish_output2+0xb0f/0x1ce0 [ 733.949355][T17182] __ip6_finish_output+0x357/0xdf0 [ 733.949370][T17182] ip6_output+0x2aa/0xa60 [ 733.949382][T17182] ? __pfx_ip6_output+0x10/0x10 [ 733.949396][T17182] ? __pfx_ip6_finish_output+0x10/0x10 [ 733.949408][T17182] ? ip6_xmit+0x13ff/0x24a0 [ 733.949419][T17182] ? ip6_xmit+0x13ff/0x24a0 [ 733.949432][T17182] ? __pfx_ip6_output+0x10/0x10 [ 733.949444][T17182] ip6_xmit+0x1006/0x24a0 [ 733.949461][T17182] ? __pfx_ip6_xmit+0x10/0x10 [ 733.949474][T17182] ? __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 733.949491][T17182] ? __pfx_dst_output+0x10/0x10 [ 733.949511][T17182] sctp_v6_xmit+0xd3c/0x1240 [ 733.949528][T17182] ? sctp_chunk_put+0x1a0/0x2d0 [ 733.949540][T17182] ? __pfx_sctp_v6_xmit+0x10/0x10 [ 733.949554][T17182] ? lockdep_hardirqs_on+0x78/0x100 [ 733.949570][T17182] ? crc32c+0x1a5/0x360 [ 733.949585][T17182] ? skb_crc32c+0x6e4/0x8e0 [ 733.949608][T17182] sctp_packet_transmit+0x22ec/0x3060 [ 733.949637][T17182] sctp_packet_singleton+0x19e/0x370 [ 733.949654][T17182] ? __pfx_sctp_packet_singleton+0x10/0x10 [ 733.949676][T17182] ? sctp_outq_select_transport+0x20d/0x720 [ 733.949695][T17182] sctp_outq_flush+0x315/0x3350 [ 733.949711][T17182] ? _raw_spin_unlock_irqrestore+0x1/0x80 [ 733.949731][T17182] ? __pfx_sctp_outq_flush+0x10/0x10 [ 733.949750][T17182] ? sctp_outq_tail+0x68c/0xa90 [ 733.949769][T17182] sctp_do_sm+0xce1/0x5be0 [ 733.949791][T17182] ? __pfx_sctp_do_sm+0x10/0x10 [ 733.949825][T17182] ? __sk_mem_raise_allocated+0x789/0x1570 [ 733.949842][T17182] sctp_primitive_ASSOCIATE+0x9c/0xd0 [ 733.949862][T17182] sctp_sendmsg_to_asoc+0xa6a/0x1c50 [ 733.949876][T17182] ? __asan_memcpy+0x20/0x60 [ 733.949887][T17182] ? sctp_assoc_set_primary+0x276/0x310 [ 733.949903][T17182] ? sctp_assoc_add_peer+0x252/0x14f0 [ 733.949921][T17182] ? __pfx_sctp_sendmsg_to_asoc+0x10/0x10 [ 733.949935][T17182] ? sctp_connect_new_asoc+0x41e/0x770 [ 733.949952][T17182] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 733.949968][T17182] ? sctp_endpoint_lookup_assoc+0x15c/0x2a0 [ 733.949982][T17182] ? sctp_endpoint_lookup_assoc+0x15c/0x2a0 [ 733.949999][T17182] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 733.950016][T17182] sctp_sendmsg+0x1144/0x22e0 [ 733.950035][T17182] ? __pfx___might_resched+0x10/0x10 [ 733.950052][T17182] ? __pfx_sctp_sendmsg+0x10/0x10 [ 733.950070][T17182] ? aa_sk_perm+0x309/0xaa0 [ 733.950090][T17182] ? aa_sock_msg_perm.isra.0+0x100/0x1b0 [ 733.950109][T17182] ? __pfx_sctp_sendmsg+0x10/0x10 [ 733.950125][T17182] inet_sendmsg+0x11c/0x140 [ 733.950139][T17182] ____sys_sendmsg+0x9c9/0xbe0 [ 733.950155][T17182] ? __pfx_inet_sendmsg+0x10/0x10 [ 733.950168][T17182] ? __pfx_____sys_sendmsg+0x10/0x10 [ 733.950188][T17182] ? _kstrtoull+0x13c/0x1f0 [ 733.950198][T17182] ? __pfx__kstrtoull+0x10/0x10 [ 733.950210][T17182] ___sys_sendmsg+0x190/0x1e0 [ 733.950228][T17182] ? __pfx____sys_sendmsg+0x10/0x10 [ 733.950244][T17182] ? __lock_acquire+0x49f/0x1a40 [ 733.950277][T17182] __sys_sendmmsg+0x309/0x440 [ 733.950292][T17182] ? __pfx___sys_sendmmsg+0x10/0x10 [ 733.950305][T17182] ? find_held_lock+0x2b/0x80 [ 733.950321][T17182] ? __mutex_unlock_slowpath+0x35d/0x930 [ 733.950342][T17182] ? fput+0x79/0x100 [ 733.950354][T17182] ? ksys_write+0x1ac/0x250 [ 733.950373][T17182] __ia32_compat_sys_sendmmsg+0x9d/0x100 [ 733.950389][T17182] ? lockdep_hardirqs_on+0x78/0x100 [ 733.950407][T17182] __do_fast_syscall_32+0xe7/0x970 [ 733.950418][T17182] ? lockdep_hardirqs_on+0x78/0x100 [ 733.950437][T17182] do_fast_syscall_32+0x32/0x70 [ 733.950449][T17182] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 733.950463][T17182] RIP: 0023:0xf7ff6fec [ 733.950478][T17182] Code: Unable to access opcode bytes at 0xf7ff6fc2. [ 733.950483][T17182] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000159 [ 733.950495][T17182] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080001d80 [ 733.950502][T17182] RDX: 0000000000000001 RSI: 00000000000005dc RDI: 0000000000000000 [ 733.950509][T17182] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 733.950515][T17182] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 733.950522][T17182] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 733.950536][T17182] [ 734.259820][T17187] loop2: detected capacity change from 0 to 7 [ 734.272483][T17187] Dev loop2: unable to read RDB block 7 [ 734.277484][T17187] loop2: unable to read partition table [ 734.280173][T17187] loop2: partition table beyond EOD, truncated [ 734.283010][T17187] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 735.082962][T17193] loop2: detected capacity change from 0 to 7 [ 735.089772][T17193] Dev loop2: unable to read RDB block 7 [ 735.100767][T17193] loop2: unable to read partition table [ 735.103334][T17193] loop2: partition table beyond EOD, truncated [ 735.114789][T17193] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 735.526067][ T6192] usb 12-1: new high-speed USB device number 9 using dummy_hcd [ 735.539209][ T6341] usb 6-1: new full-speed USB device number 49 using dummy_hcd [ 735.679349][ T6192] usb 12-1: Using ep0 maxpacket: 32 [ 735.683135][ T6192] usb 12-1: unable to get BOS descriptor or descriptor too short [ 735.686587][ T6192] usb 12-1: config 14 has an invalid interface number: 57 but max is 1 [ 735.689452][ T6192] usb 12-1: config 14 has an invalid interface number: 228 but max is 1 [ 735.692056][ T6192] usb 12-1: config 14 has no interface number 0 [ 735.694044][ T6192] usb 12-1: config 14 has no interface number 1 [ 735.696707][ T6192] usb 12-1: config 14 interface 228 altsetting 5 has a duplicate endpoint with address 0x8, skipping [ 735.700176][ T6192] usb 12-1: config 14 interface 228 altsetting 5 has an endpoint descriptor with address 0xD1, changing to 0x81 [ 735.704122][ T6192] usb 12-1: config 14 interface 228 altsetting 5 endpoint 0x81 has an invalid bInterval 109, changing to 10 [ 735.708656][ T6192] usb 12-1: config 14 interface 228 altsetting 5 endpoint 0x81 has invalid maxpacket 57993, setting to 1024 [ 735.712690][ T6192] usb 12-1: config 14 interface 228 altsetting 5 endpoint 0x9 has an invalid bInterval 122, changing to 10 [ 735.716400][ T6192] usb 12-1: config 14 interface 228 altsetting 5 has 4 endpoint descriptors, different from the interface descriptor's value: 3 [ 735.720489][ T6192] usb 12-1: config 14 interface 57 has no altsetting 0 [ 735.722614][ T6192] usb 12-1: config 14 interface 228 has no altsetting 0 [ 735.726646][ T6192] usb 12-1: New USB device found, idVendor=0694, idProduct=0001, bcdDevice=78.13 [ 735.729687][ T6192] usb 12-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 735.732326][ T6192] usb 12-1: Product: syz [ 735.733721][ T6192] usb 12-1: Manufacturer: syz [ 735.735260][ T6192] usb 12-1: SerialNumber: syz [ 736.141817][ T6192] legousbtower 12-1:14.57: interrupt endpoints not found [ 736.199529][ T6341] usb 6-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x45, changing to 0x5 [ 736.204117][ T6341] usb 6-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 200, setting to 64 [ 736.207585][ T6341] usb 6-1: config 0 interface 0 has no altsetting 0 [ 736.211668][ T6341] usb 6-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 736.215223][ T6341] usb 6-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 736.217982][ T6341] usb 6-1: Product: syz [ 736.219600][ T6341] usb 6-1: Manufacturer: syz [ 736.221062][ T6341] usb 6-1: SerialNumber: syz [ 736.223915][ T6341] usb 6-1: config 0 descriptor?? [ 736.228735][ T6341] usb 6-1: selecting invalid altsetting 0 [ 736.440718][ T6341] usb 6-1: USB disconnect, device number 49 [ 736.542603][ T6192] legousbtower 12-1:14.228: LEGO USB Tower firmware version is 228.166 build 40507 [ 736.549287][ T6192] legousbtower 12-1:14.228: LEGO USB Tower #-160 now attached to major 180 minor 0 [ 737.336872][T17224] FAULT_INJECTION: forcing a failure. [ 737.336872][T17224] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 737.347115][T17224] CPU: 2 UID: 0 PID: 17224 Comm: syz.7.2977 Tainted: G L syzkaller #0 PREEMPT(full) [ 737.347148][T17224] Tainted: [L]=SOFTLOCKUP [ 737.347155][T17224] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 737.347167][T17224] Call Trace: [ 737.347174][T17224] [ 737.347181][T17224] dump_stack_lvl+0x100/0x190 [ 737.347223][T17224] should_fail_ex.cold+0x5/0xa [ 737.347243][T17224] _copy_to_user+0x32/0xd0 [ 737.347271][T17224] simple_read_from_buffer+0xcb/0x170 [ 737.347298][T17224] proc_fail_nth_read+0x1af/0x230 [ 737.347322][T17224] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 737.347351][T17224] ? rw_verify_area+0xce/0x6d0 [ 737.347373][T17224] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 737.347396][T17224] vfs_read+0x1e4/0xb40 [ 737.347426][T17224] ? __pfx_vfs_read+0x10/0x10 [ 737.347449][T17224] ? find_held_lock+0x2b/0x80 [ 737.347470][T17224] ? __fget_files+0x215/0x3d0 [ 737.347501][T17224] ? __fget_files+0x21f/0x3d0 [ 737.347535][T17224] ksys_read+0x12a/0x250 [ 737.347562][T17224] ? __pfx_ksys_read+0x10/0x10 [ 737.347595][T17224] do_int80_emulation+0x14b/0x720 [ 737.347619][T17224] asm_int80_emulation+0x1a/0x20 [ 737.347637][T17224] RIP: 0023:0xf71f72eb [ 737.347653][T17224] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 737.347669][T17224] RSP: 002b:00000000f54954bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 737.347688][T17224] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f54955d0 [ 737.347701][T17224] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 737.347711][T17224] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 737.347722][T17224] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 737.347732][T17224] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 737.347755][T17224] [ 737.874263][ T6192] usb 12-1: USB disconnect, device number 9 [ 737.946234][ T6192] legousbtower 12-1:14.228: LEGO USB Tower #-160 now disconnected [ 738.203252][T17231] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2987'. [ 738.214103][T17231] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2987'. [ 738.218996][T17231] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2987'. [ 738.223502][T17231] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2987'. [ 739.422853][ T846] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 740.109636][ T846] usb 5-1: config 0 interface 0 altsetting 255 has an endpoint descriptor with address 0x45, changing to 0x5 [ 740.179367][ T846] usb 5-1: config 0 interface 0 altsetting 255 endpoint 0x5 has invalid maxpacket 200, setting to 64 [ 740.183008][ T846] usb 5-1: config 0 interface 0 has no altsetting 0 [ 740.196613][ T846] usb 5-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 740.200524][ T846] usb 5-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 740.203434][ T846] usb 5-1: Product: syz [ 740.204743][ T846] usb 5-1: Manufacturer: syz [ 740.206722][ T846] usb 5-1: SerialNumber: syz [ 740.211702][ T846] usb 5-1: config 0 descriptor?? [ 740.220974][ T846] usb 5-1: selecting invalid altsetting 0 [ 740.361512][T17277] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2999'. [ 740.372197][T17277] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2999'. [ 740.376587][T17277] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2999'. [ 740.380548][T17277] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2999'. [ 740.428163][T12301] usb 5-1: USB disconnect, device number 50 [ 740.640036][T17280] FAULT_INJECTION: forcing a failure. [ 740.640036][T17280] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 740.648504][T17280] CPU: 2 UID: 0 PID: 17280 Comm: syz.1.3000 Tainted: G L syzkaller #0 PREEMPT(full) [ 740.648525][T17280] Tainted: [L]=SOFTLOCKUP [ 740.648529][T17280] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 740.648536][T17280] Call Trace: [ 740.648541][T17280] [ 740.648545][T17280] dump_stack_lvl+0x100/0x190 [ 740.648563][T17280] should_fail_ex.cold+0x5/0xa [ 740.648577][T17280] _copy_from_user+0x2e/0xd0 [ 740.648594][T17280] do_tcp_setsockopt+0x73e/0x2b50 [ 740.648612][T17280] ? __pfx_do_tcp_setsockopt+0x10/0x10 [ 740.648629][T17280] ? iput.part.0+0x981/0x1050 [ 740.648645][T17280] ? iput.part.0+0x1a0/0x1050 [ 740.648661][T17280] ? iput+0x3a/0x40 [ 740.648672][T17280] ? __mptcp_nmpc_sk+0x100/0x880 [ 740.648691][T17280] tcp_setsockopt+0xe2/0x100 [ 740.648706][T17280] ? __local_bh_enable_ip+0x9e/0x120 [ 740.648720][T17280] mptcp_setsockopt+0x86e/0x3300 [ 740.648734][T17280] ? rcu_read_lock_any_held+0x6a/0xa0 [ 740.648751][T17280] ? __pfx_mptcp_setsockopt+0x10/0x10 [ 740.648768][T17280] ? aa_sock_opt_perm+0xfe/0x1b0 [ 740.648785][T17280] ? sock_common_setsockopt+0x2e/0xf0 [ 740.648801][T17280] ? __pfx_sock_common_setsockopt+0x10/0x10 [ 740.648818][T17280] do_sock_setsockopt+0xf3/0x1d0 [ 740.648835][T17280] __sys_setsockopt+0x119/0x190 [ 740.648850][T17280] __ia32_sys_setsockopt+0xbc/0x160 [ 740.648863][T17280] ? __do_fast_syscall_32+0x98/0x970 [ 740.648874][T17280] ? lockdep_hardirqs_on+0x78/0x100 [ 740.648893][T17280] __do_fast_syscall_32+0xe7/0x970 [ 740.648904][T17280] ? lockdep_hardirqs_on+0x78/0x100 [ 740.648922][T17280] do_fast_syscall_32+0x32/0x70 [ 740.648934][T17280] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 740.648949][T17280] RIP: 0023:0xf7fe5fec [ 740.648974][T17280] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 740.648981][T17280] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 000000000000016e [ 740.648993][T17280] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000006 [ 740.649000][T17280] RDX: 0000000000000022 RSI: 0000000080000140 RDI: 0000000000000004 [ 740.649007][T17280] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 740.649014][T17280] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 740.649041][T17280] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 740.649056][T17280] [ 740.965201][T17283] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3001'. [ 741.085374][T17288] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3002'. [ 742.112298][T17300] loop2: detected capacity change from 0 to 7 [ 742.132700][T17300] Dev loop2: unable to read RDB block 7 [ 742.134879][T17300] loop2: unable to read partition table [ 742.139511][T17300] loop2: partition table beyond EOD, truncated [ 742.145358][T17300] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 742.257320][ T5150] Dev loop2: unable to read RDB block 7 [ 742.259714][ T5150] loop2: unable to read partition table [ 742.262183][ T5150] loop2: partition table beyond EOD, truncated [ 743.382238][T17313] __nla_validate_parse: 2 callbacks suppressed [ 743.382259][T17313] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3012'. [ 743.588142][T17317] FAULT_INJECTION: forcing a failure. [ 743.588142][T17317] name failslab, interval 1, probability 0, space 0, times 0 [ 743.593570][T17317] CPU: 0 UID: 0 PID: 17317 Comm: syz.5.3013 Tainted: G L syzkaller #0 PREEMPT(full) [ 743.593624][T17317] Tainted: [L]=SOFTLOCKUP [ 743.593638][T17317] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 743.593648][T17317] Call Trace: [ 743.593655][T17317] [ 743.593663][T17317] dump_stack_lvl+0x100/0x190 [ 743.593689][T17317] should_fail_ex.cold+0x5/0xa [ 743.593710][T17317] should_failslab+0xc2/0x120 [ 743.593734][T17317] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 743.593757][T17317] ? __alloc_skb+0x140/0x710 [ 743.593780][T17317] __alloc_skb+0x140/0x710 [ 743.593799][T17317] ? __alloc_skb+0x5b7/0x710 [ 743.593817][T17317] ? __pfx___alloc_skb+0x10/0x10 [ 743.593834][T17317] ? genl_rcv_msg+0x4be/0x800 [ 743.593859][T17317] netlink_ack+0x117/0xb80 [ 743.593893][T17317] netlink_rcv_skb+0x333/0x420 [ 743.593920][T17317] ? __pfx_genl_rcv_msg+0x10/0x10 [ 743.593940][T17317] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 743.593975][T17317] ? netlink_deliver_tap+0x1ae/0xcc0 [ 743.594004][T17317] genl_rcv+0x28/0x40 [ 743.594020][T17317] netlink_unicast+0x585/0x850 [ 743.594050][T17317] ? __pfx_netlink_unicast+0x10/0x10 [ 743.594083][T17317] netlink_sendmsg+0x8b0/0xda0 [ 743.594114][T17317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 743.594145][T17317] ? apparmor_socket_sendmsg+0x15b/0x270 [ 743.594179][T17317] ____sys_sendmsg+0xa4d/0xbe0 [ 743.594206][T17317] ? __pfx_netlink_sendmsg+0x10/0x10 [ 743.594234][T17317] ? __pfx_____sys_sendmsg+0x10/0x10 [ 743.594270][T17317] ___sys_sendmsg+0x190/0x1e0 [ 743.594299][T17317] ? __pfx____sys_sendmsg+0x10/0x10 [ 743.594338][T17317] ? find_held_lock+0x2b/0x80 [ 743.594378][T17317] __sys_sendmsg+0x160/0x210 [ 743.594402][T17317] ? __pfx___sys_sendmsg+0x10/0x10 [ 743.594431][T17317] ? __pfx_ksys_write+0x10/0x10 [ 743.594465][T17317] __do_fast_syscall_32+0xe7/0x970 [ 743.594486][T17317] ? lockdep_hardirqs_on+0x78/0x100 [ 743.594516][T17317] do_fast_syscall_32+0x32/0x70 [ 743.594538][T17317] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 743.594559][T17317] RIP: 0023:0xf708efec [ 743.594582][T17317] Code: Unable to access opcode bytes at 0xf708efc2. [ 743.594591][T17317] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 743.594611][T17317] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001140 [ 743.594625][T17317] RDX: 0000000000000004 RSI: 0000000000000000 RDI: 0000000000000000 [ 743.594642][T17317] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 743.594654][T17317] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 743.594666][T17317] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 743.594693][T17317] [ 744.873138][T17322] input: syz1 as /devices/virtual/input/input36 [ 746.216524][T17347] netlink: 'syz.1.3023': attribute type 4 has an invalid length. [ 746.221035][T17347] netlink: 'syz.1.3023': attribute type 4 has an invalid length. [ 746.887836][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 747.105276][T17358] block nbd2: Receive control failed (result -32) [ 747.200394][T17360] Failed to get privilege flags for destination (handle=0x2:0x0) [ 747.649813][T17374] syzkaller0: entered promiscuous mode [ 747.651579][T17374] syzkaller0: entered allmulticast mode [ 748.704535][T14657] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 748.727721][T17395] netlink: 'syz.5.3036': attribute type 1 has an invalid length. [ 748.730121][T17395] netlink: 220 bytes leftover after parsing attributes in process `syz.5.3036'. [ 748.861758][T14657] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 748.866280][T14657] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 748.872736][T14657] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 748.877085][T14657] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 748.880471][T14657] usb 6-1: Product: syz [ 748.882258][T14657] usb 6-1: Manufacturer: syz [ 748.884745][T14657] usb 6-1: SerialNumber: syz [ 748.901292][T14657] cdc_mbim 6-1:1.0: skipping garbage [ 748.924586][T17400] input: syz1 as /devices/virtual/input/input38 [ 749.112260][T17389] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 749.490089][T17414] siw: device registration error -23 [ 749.578412][T17424] FAULT_INJECTION: forcing a failure. [ 749.578412][T17424] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 749.583763][T17424] CPU: 0 UID: 0 PID: 17424 Comm: syz.7.3045 Tainted: G L syzkaller #0 PREEMPT(full) [ 749.583792][T17424] Tainted: [L]=SOFTLOCKUP [ 749.583798][T17424] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 749.583809][T17424] Call Trace: [ 749.583816][T17424] [ 749.583823][T17424] dump_stack_lvl+0x100/0x190 [ 749.583850][T17424] should_fail_ex.cold+0x5/0xa [ 749.583870][T17424] _copy_to_user+0x32/0xd0 [ 749.583896][T17424] simple_read_from_buffer+0xcb/0x170 [ 749.583927][T17424] proc_fail_nth_read+0x1af/0x230 [ 749.583950][T17424] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 749.583974][T17424] ? rw_verify_area+0xce/0x6d0 [ 749.584000][T17424] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 749.584022][T17424] vfs_read+0x1e4/0xb40 [ 749.584051][T17424] ? __pfx_vfs_read+0x10/0x10 [ 749.584075][T17424] ? find_held_lock+0x2b/0x80 [ 749.584096][T17424] ? __fget_files+0x215/0x3d0 [ 749.584126][T17424] ? __fget_files+0x21f/0x3d0 [ 749.584157][T17424] ksys_read+0x12a/0x250 [ 749.584181][T17424] ? __pfx_ksys_read+0x10/0x10 [ 749.584213][T17424] do_int80_emulation+0x14b/0x720 [ 749.584235][T17424] asm_int80_emulation+0x1a/0x20 [ 749.584253][T17424] RIP: 0023:0xf71f72eb [ 749.584268][T17424] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 749.584286][T17424] RSP: 002b:00000000f54b64bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 749.584305][T17424] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54b65d0 [ 749.584316][T17424] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 749.584326][T17424] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 749.584336][T17424] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 749.584347][T17424] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 749.584370][T17424] [ 749.820283][T17389] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 749.826748][T14657] cdc_mbim 6-1:1.0: setting tx_max = 16384 [ 749.832879][T14657] cdc_mbim 6-1:1.0: cdc-wdm0: USB WDM device [ 749.909276][T14657] wwan wwan0: port wwan0mbim0 attached [ 750.007442][T17436] loop2: detected capacity change from 0 to 7 [ 750.015391][T14657] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.1-1, CDC MBIM, d6:4d:11:03:44:6f [ 750.019570][T17436] Dev loop2: unable to read RDB block 7 [ 750.026501][T17436] loop2: unable to read partition table [ 750.031519][T17436] loop2: partition table beyond EOD, truncated [ 750.037236][T17436] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 750.077145][T17389] libceph: resolve '400' (ret=-3): failed [ 750.255022][ T6341] usb 6-1: USB disconnect, device number 50 [ 750.258368][ T6341] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.1-1, CDC MBIM [ 750.378887][ T6341] wwan wwan0: port wwan0mbim0 disconnected [ 750.685528][T12547] Bluetooth: hci0: Frame reassembly failed (-84) [ 750.902673][T17448] loop9: detected capacity change from 0 to 524287999 [ 752.040352][T17453] FAULT_INJECTION: forcing a failure. [ 752.040352][T17453] name failslab, interval 1, probability 0, space 0, times 0 [ 752.046010][T17453] CPU: 2 UID: 0 PID: 17453 Comm: syz.1.3056 Tainted: G L syzkaller #0 PREEMPT(full) [ 752.046038][T17453] Tainted: [L]=SOFTLOCKUP [ 752.046044][T17453] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 752.046054][T17453] Call Trace: [ 752.046060][T17453] [ 752.046067][T17453] dump_stack_lvl+0x100/0x190 [ 752.046091][T17453] should_fail_ex.cold+0x5/0xa [ 752.046110][T17453] should_failslab+0xc2/0x120 [ 752.046131][T17453] kmem_cache_alloc_noprof+0x91/0x6a0 [ 752.046151][T17453] ? skb_clone+0x190/0x400 [ 752.046179][T17453] skb_clone+0x190/0x400 [ 752.046199][T17453] bpf_clone_redirect+0x166/0x500 [ 752.046221][T17453] ? __pfx___cant_migrate+0x10/0x10 [ 752.046244][T17453] bpf_prog_53f18857bc887b09+0x22/0x2a [ 752.046260][T17453] bpf_test_run+0x39c/0xa40 [ 752.046283][T17453] ? bpf_test_run+0x1c6/0xa40 [ 752.046307][T17453] ? __pfx_bpf_test_run+0x10/0x10 [ 752.046337][T17453] ? do_csum+0x1e5/0x380 [ 752.046367][T17453] bpf_prog_test_run_skb+0x15c4/0x3540 [ 752.046406][T17453] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 752.046432][T17453] ? fput+0x79/0x100 [ 752.046451][T17453] ? __pfx_bpf_prog_test_run_skb+0x10/0x10 [ 752.046474][T17453] __sys_bpf+0x2a12/0x4e80 [ 752.046499][T17453] ? __pfx___sys_bpf+0x10/0x10 [ 752.046516][T17453] ? find_held_lock+0x2b/0x80 [ 752.046534][T17453] ? get_pid_task+0xfc/0x250 [ 752.046552][T17453] ? get_pid_task+0xfc/0x250 [ 752.046576][T17453] ? proc_fail_nth_write+0x9f/0x220 [ 752.046596][T17453] ? find_held_lock+0x2b/0x80 [ 752.046618][T17453] ? rcu_read_lock_any_held+0x6a/0xa0 [ 752.046637][T17453] ? find_held_lock+0x2b/0x80 [ 752.046654][T17453] ? ksys_write+0x190/0x250 [ 752.046677][T17453] ? ksys_write+0x190/0x250 [ 752.046716][T17453] ? fput+0x79/0x100 [ 752.046735][T17453] ? __ia32_sys_bpf+0xcc/0x170 [ 752.046750][T17453] __ia32_sys_bpf+0xcc/0x170 [ 752.046767][T17453] ? __do_fast_syscall_32+0x98/0x970 [ 752.046785][T17453] __do_fast_syscall_32+0xe7/0x970 [ 752.046801][T17453] ? lockdep_hardirqs_on+0x78/0x100 [ 752.046828][T17453] do_fast_syscall_32+0x32/0x70 [ 752.046844][T17453] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 752.046865][T17453] RIP: 0023:0xf7fe5fec [ 752.046884][T17453] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 752.046892][T17453] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 752.046910][T17453] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 00000000800003c0 [ 752.046920][T17453] RDX: 0000000000000050 RSI: 0000000000000000 RDI: 0000000000000000 [ 752.046930][T17453] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 752.046939][T17453] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 752.046949][T17453] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 752.046988][T17453] [ 752.234245][T17457] netlink: 52 bytes leftover after parsing attributes in process `syz.5.3058'. [ 752.303779][T17462] loop2: detected capacity change from 0 to 7 [ 752.312642][T17462] Dev loop2: unable to read RDB block 7 [ 752.316350][T17462] loop2: unable to read partition table [ 752.318899][T17462] loop2: partition table beyond EOD, truncated [ 752.321705][T17462] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 752.367070][T17464] netlink: 'syz.0.3061': attribute type 1 has an invalid length. [ 752.400677][T17464] 8021q: adding VLAN 0 to HW filter on device bond1 [ 752.464995][T17467] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 752.559658][T12554] Bluetooth: hci5: Frame reassembly failed (-84) [ 752.717460][ T5749] Bluetooth: hci0: command 0x1003 tx timeout [ 752.718740][T13838] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 752.728164][T17483] overlayfs: failed lookup in lower (newroot/135, name='bus', err=-40): overlapping layers [ 752.807543][T17489] openvswitch: netlink: Flow actions attr not present in new flow. [ 752.809463][T17488] program syz.1.3069 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 752.810085][T17489] FAULT_INJECTION: forcing a failure. [ 752.810085][T17489] name failslab, interval 1, probability 0, space 0, times 0 [ 752.818937][T17489] CPU: 3 UID: 0 PID: 17489 Comm: syz.0.3070 Tainted: G L syzkaller #0 PREEMPT(full) [ 752.818956][T17489] Tainted: [L]=SOFTLOCKUP [ 752.818960][T17489] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 752.818967][T17489] Call Trace: [ 752.818971][T17489] [ 752.818976][T17489] dump_stack_lvl+0x100/0x190 [ 752.818993][T17489] should_fail_ex.cold+0x5/0xa [ 752.819005][T17489] should_failslab+0xc2/0x120 [ 752.819020][T17489] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 752.819035][T17489] ? __alloc_skb+0x140/0x710 [ 752.819049][T17489] __alloc_skb+0x140/0x710 [ 752.819060][T17489] ? __alloc_skb+0x5b7/0x710 [ 752.819072][T17489] ? __pfx___alloc_skb+0x10/0x10 [ 752.819083][T17489] ? genl_rcv_msg+0x4be/0x800 [ 752.819098][T17489] netlink_ack+0x117/0xb80 [ 752.819119][T17489] netlink_rcv_skb+0x333/0x420 [ 752.819136][T17489] ? __pfx_genl_rcv_msg+0x10/0x10 [ 752.819148][T17489] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 752.819165][T17489] ? rcu_is_watching+0x12/0xc0 [ 752.819181][T17489] ? __rcu_read_unlock+0x26a/0x5e0 [ 752.819198][T17489] ? rcu_is_watching+0x12/0xc0 [ 752.819213][T17489] genl_rcv+0x28/0x40 [ 752.819223][T17489] netlink_unicast+0x585/0x850 [ 752.819242][T17489] ? __pfx_netlink_unicast+0x10/0x10 [ 752.819263][T17489] netlink_sendmsg+0x8b0/0xda0 [ 752.819283][T17489] ? __pfx_netlink_sendmsg+0x10/0x10 [ 752.819302][T17489] ? apparmor_socket_sendmsg+0x15b/0x270 [ 752.819323][T17489] ____sys_sendmsg+0xa4d/0xbe0 [ 752.819339][T17489] ? __pfx_netlink_sendmsg+0x10/0x10 [ 752.819357][T17489] ? __pfx_____sys_sendmsg+0x10/0x10 [ 752.819380][T17489] ___sys_sendmsg+0x190/0x1e0 [ 752.819398][T17489] ? __pfx____sys_sendmsg+0x10/0x10 [ 752.819422][T17489] ? find_held_lock+0x2b/0x80 [ 752.819445][T17489] __sys_sendmsg+0x160/0x210 [ 752.819458][T17489] ? __pfx___sys_sendmsg+0x10/0x10 [ 752.819475][T17489] ? __pfx_ksys_write+0x10/0x10 [ 752.819494][T17489] __do_fast_syscall_32+0xe7/0x970 [ 752.819506][T17489] ? lockdep_hardirqs_on+0x78/0x100 [ 752.819525][T17489] do_fast_syscall_32+0x32/0x70 [ 752.819537][T17489] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 752.819551][T17489] RIP: 0023:0xf7ff7fec [ 752.819565][T17489] Code: Unable to access opcode bytes at 0xf7ff7fc2. [ 752.819571][T17489] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 752.819582][T17489] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000000 [ 752.819589][T17489] RDX: 000000000000c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 752.819596][T17489] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 752.819603][T17489] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 752.819609][T17489] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 752.819623][T17489] [ 752.826845][T17491] FAULT_INJECTION: forcing a failure. [ 752.826845][T17491] name failslab, interval 1, probability 0, space 0, times 0 [ 752.935984][T17493] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3072'. [ 752.939827][T17493] netlink: 'syz.0.3072': attribute type 3 has an invalid length. [ 752.943160][T17491] CPU: 0 UID: 0 PID: 17491 Comm: syz.7.3071 Tainted: G L syzkaller #0 PREEMPT(full) [ 752.943179][T17491] Tainted: [L]=SOFTLOCKUP [ 752.943183][T17491] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 752.943190][T17491] Call Trace: [ 752.943195][T17491] [ 752.943200][T17491] dump_stack_lvl+0x100/0x190 [ 752.943217][T17491] should_fail_ex.cold+0x5/0xa [ 752.943230][T17491] should_failslab+0xc2/0x120 [ 752.943258][T17491] kmem_cache_alloc_node_noprof+0x94/0x6b0 [ 752.943274][T17491] ? __alloc_skb+0x5b7/0x710 [ 752.943286][T17491] ? __alloc_skb+0x140/0x710 [ 752.943300][T17491] __alloc_skb+0x140/0x710 [ 752.943311][T17491] ? __alloc_skb+0x5b7/0x710 [ 752.943322][T17491] ? __pfx___alloc_skb+0x10/0x10 [ 752.943333][T17491] ? aa_label_sk_perm+0x194/0x5f0 [ 752.943350][T17491] alloc_skb_with_frags+0xdd/0x760 [ 752.943368][T17491] sock_alloc_send_pskb+0x801/0x980 [ 752.943382][T17491] ? __pfx_ref_tracker_alloc+0x10/0x10 [ 752.943398][T17491] ? is_bpf_text_address+0x8a/0x1a0 [ 752.943416][T17491] ? __pfx_sock_alloc_send_pskb+0x10/0x10 [ 752.943428][T17491] ? find_held_lock+0x2b/0x80 [ 752.943441][T17491] ? dev_get_by_index+0x180/0x380 [ 752.943453][T17491] ? dev_get_by_index+0x180/0x380 [ 752.943469][T17491] raw_sendmsg+0x32c/0x1480 [ 752.943484][T17491] ? __pfx_tomoyo_socket_sendmsg_permission+0x10/0x10 [ 752.943502][T17491] ? __pfx_raw_sendmsg+0x10/0x10 [ 752.943518][T17491] ? apparmor_socket_sendmsg+0x15b/0x270 [ 752.943540][T17491] ____sys_sendmsg+0xa4d/0xbe0 [ 752.943556][T17491] ? __pfx_raw_sendmsg+0x10/0x10 [ 752.943587][T17491] ? __pfx_____sys_sendmsg+0x10/0x10 [ 752.943612][T17491] ___sys_sendmsg+0x190/0x1e0 [ 752.943630][T17491] ? __pfx____sys_sendmsg+0x10/0x10 [ 752.943654][T17491] ? find_held_lock+0x2b/0x80 [ 752.943675][T17491] __sys_sendmsg+0x160/0x210 [ 752.943689][T17491] ? __pfx___sys_sendmsg+0x10/0x10 [ 752.943706][T17491] ? __pfx_ksys_write+0x10/0x10 [ 752.943726][T17491] __do_fast_syscall_32+0xe7/0x970 [ 752.943737][T17491] ? lockdep_hardirqs_on+0x78/0x100 [ 752.943756][T17491] do_fast_syscall_32+0x32/0x70 [ 752.943768][T17491] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 752.943783][T17491] RIP: 0023:0xf7ff6fec [ 752.943797][T17491] Code: Unable to access opcode bytes at 0xf7ff6fc2. [ 752.943802][T17491] RSP: 002b:00000000f54b650c EFLAGS: 00000292 ORIG_RAX: 0000000000000172 [ 752.943813][T17491] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 752.943820][T17491] RDX: 000000000000c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 752.943827][T17491] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 752.943833][T17491] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 752.943840][T17491] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 752.943854][T17491] [ 752.966776][T17497] netlink: 'syz.1.3073': attribute type 13 has an invalid length. [ 753.157124][T17505] virt_wifi0 speed is unknown, defaulting to 1000 [ 753.161069][T17505] lo speed is unknown, defaulting to 1000 [ 753.198158][T17506] fuse: Bad value for 'user_id' [ 753.203907][T17506] fuse: Bad value for 'user_id' [ 753.225113][T17507] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(8) [ 753.227292][T17507] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 753.231118][T17511] FAULT_INJECTION: forcing a failure. [ 753.231118][T17511] name failslab, interval 1, probability 0, space 0, times 0 [ 753.233198][T17507] vhci_hcd vhci_hcd.0: Device attached [ 753.236218][T17511] CPU: 2 UID: 0 PID: 17511 Comm: syz.1.3075 Tainted: G L syzkaller #0 PREEMPT(full) [ 753.236244][T17511] Tainted: [L]=SOFTLOCKUP [ 753.236250][T17511] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 753.236260][T17511] Call Trace: [ 753.236267][T17511] [ 753.236273][T17511] dump_stack_lvl+0x100/0x190 [ 753.236298][T17511] should_fail_ex.cold+0x5/0xa [ 753.236318][T17511] should_failslab+0xc2/0x120 [ 753.236340][T17511] __kmalloc_noprof+0xfc/0x820 [ 753.236357][T17511] ? __kmalloc_noprof+0x343/0x820 [ 753.236374][T17511] ? bpf_test_init.isra.0+0x88/0x100 [ 753.236400][T17511] bpf_test_init.isra.0+0x88/0x100 [ 753.236424][T17511] bpf_prog_test_run_xdp+0x57e/0x1670 [ 753.236457][T17511] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 753.236487][T17511] ? fput+0x79/0x100 [ 753.236504][T17511] ? __bpf_prog_get+0x97/0x2a0 [ 753.236525][T17511] ? __pfx_bpf_prog_test_run_xdp+0x10/0x10 [ 753.236549][T17511] __sys_bpf+0x2a12/0x4e80 [ 753.236572][T17511] ? __pfx___sys_bpf+0x10/0x10 [ 753.236590][T17511] ? find_held_lock+0x2b/0x80 [ 753.236608][T17511] ? get_pid_task+0xfc/0x250 [ 753.236627][T17511] ? get_pid_task+0xfc/0x250 [ 753.236660][T17511] ? proc_fail_nth_write+0x9f/0x220 [ 753.236703][T17511] ? find_held_lock+0x2b/0x80 [ 753.236726][T17511] ? rcu_read_lock_any_held+0x6a/0xa0 [ 753.236745][T17511] ? find_held_lock+0x2b/0x80 [ 753.236762][T17511] ? ksys_write+0x190/0x250 [ 753.236785][T17511] ? ksys_write+0x190/0x250 [ 753.236825][T17511] ? fput+0x79/0x100 [ 753.236872][T17511] ? __ia32_sys_bpf+0xcc/0x170 [ 753.236889][T17511] __ia32_sys_bpf+0xcc/0x170 [ 753.236906][T17511] ? __do_fast_syscall_32+0x98/0x970 [ 753.236928][T17511] __do_fast_syscall_32+0xe7/0x970 [ 753.236944][T17511] ? lockdep_hardirqs_on+0x78/0x100 [ 753.236985][T17511] do_fast_syscall_32+0x32/0x70 [ 753.237003][T17511] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 753.237025][T17511] RIP: 0023:0xf7fe5fec [ 753.237046][T17511] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 753.237053][T17511] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 753.237070][T17511] RAX: ffffffffffffffda RBX: 000000000000000a RCX: 0000000080000080 [ 753.237081][T17511] RDX: 000000000000004c RSI: 0000000000000000 RDI: 0000000000000000 [ 753.237091][T17511] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 753.237101][T17511] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 753.237110][T17511] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 753.237133][T17511] [ 753.355016][T12547] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 753.357891][T12547] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 753.585966][ T846] usb 38-1: SetAddress Request (15) to port 0 [ 753.588482][ T846] usb 38-1: new SuperSpeed USB device number 15 using vhci_hcd [ 753.714978][T17509] vhci_hcd: connection reset by peer [ 753.717858][ T12] vhci_hcd vhci_hcd.0: stop threads [ 753.724426][ T12] vhci_hcd vhci_hcd.0: release socket [ 753.729753][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 753.916538][T14657] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 754.067837][T14657] usb 6-1: config 0 has an invalid interface number: 199 but max is 1 [ 754.070882][T14657] usb 6-1: config 0 has no interface number 1 [ 754.072905][T14657] usb 6-1: config 0 interface 199 altsetting 2 endpoint 0xA has invalid wMaxPacketSize 0 [ 754.076171][T14657] usb 6-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 754.079484][T14657] usb 6-1: config 0 interface 199 has no altsetting 0 [ 754.082509][T14657] usb 6-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 754.085249][T14657] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 754.087927][T14657] usb 6-1: SerialNumber: syz [ 754.094322][T14657] usb 6-1: config 0 descriptor?? [ 754.322958][T17525] syzkaller0: entered promiscuous mode [ 754.324729][T17525] syzkaller0: entered allmulticast mode [ 754.475792][ T5840] hid-generic 0000:0000:0000.000B: unknown main item tag 0x0 [ 754.496059][ T5840] hid-generic 0000:0000:0000.000B: hidraw1: HID v0.00 Device [syz0] on syz0 [ 754.613016][T17528] fido_id[17528]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 754.636053][T13838] Bluetooth: hci5: command 0x1003 tx timeout [ 754.636681][ T5754] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 754.649045][T17532] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 754.923439][T17546] fuse: Bad value for 'group_id' [ 754.925916][T17546] fuse: Bad value for 'group_id' [ 755.128555][T17553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3086'. [ 755.136450][T17553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3086'. [ 755.145554][T17553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3086'. [ 755.151381][T17553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3086'. [ 755.155214][T17553] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3086'. [ 756.591462][T14657] uvcvideo 6-1:0.199: Found UVC 0.00 device (0002:0000) [ 756.597455][T14657] uvcvideo 6-1:0.199: No valid video chain found. [ 756.627936][T14657] usb 6-1: USB disconnect, device number 51 [ 756.699651][T17567] loop2: detected capacity change from 0 to 7 [ 756.710293][T17567] Dev loop2: unable to read RDB block 7 [ 756.715007][T17567] loop2: unable to read partition table [ 756.721963][T17567] loop2: partition table beyond EOD, truncated [ 756.726009][T17567] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 756.875758][T17575] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3093'. [ 756.996178][T17576] Bluetooth: MGMT ver 1.23 [ 757.198535][T17579] syzkaller0: entered promiscuous mode [ 757.241481][T17579] syzkaller0: entered allmulticast mode [ 758.578439][T17592] fuse: Bad value for 'group_id' [ 758.580165][T17592] fuse: Bad value for 'group_id' [ 758.636807][ T846] usb 38-1: device descriptor read/8, error -110 [ 759.026991][ T846] usb usb38-port1: attempt power cycle [ 759.262048][T17601] netlink: 'syz.7.3100': attribute type 1 has an invalid length. [ 759.279867][T17604] openvswitch: netlink: Flow key attr not present in new flow. [ 759.345343][T17601] 8021q: adding VLAN 0 to HW filter on device bond1 [ 759.541695][T17608] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3104'. [ 759.550797][T17608] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3104'. [ 759.555198][T17608] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3104'. [ 759.559756][T17608] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3104'. [ 759.591468][ T846] usb usb38-port1: unable to enumerate USB device [ 759.782326][T17611] FAULT_INJECTION: forcing a failure. [ 759.782326][T17611] name failslab, interval 1, probability 0, space 0, times 0 [ 759.797182][T17611] CPU: 3 UID: 0 PID: 17611 Comm: syz.1.3102 Tainted: G L syzkaller #0 PREEMPT(full) [ 759.797204][T17611] Tainted: [L]=SOFTLOCKUP [ 759.797220][T17611] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 759.797228][T17611] Call Trace: [ 759.797233][T17611] [ 759.797238][T17611] dump_stack_lvl+0x100/0x190 [ 759.797256][T17611] should_fail_ex.cold+0x5/0xa [ 759.797269][T17611] should_failslab+0xc2/0x120 [ 759.797284][T17611] __kmalloc_node_track_caller_noprof+0xf9/0x830 [ 759.797300][T17611] ? kstrdup_const+0x63/0x80 [ 759.797314][T17611] kstrdup+0x51/0xe0 [ 759.797326][T17611] kstrdup_const+0x63/0x80 [ 759.797338][T17611] __kernfs_new_node+0x9b/0xa10 [ 759.797358][T17611] ? __pfx___kernfs_new_node+0x10/0x10 [ 759.797379][T17611] ? find_held_lock+0x2b/0x80 [ 759.797391][T17611] ? kernfs_root+0xee/0x2a0 [ 759.797406][T17611] ? kernfs_root+0xee/0x2a0 [ 759.797425][T17611] kernfs_create_dir_ns+0xa6/0x2b0 [ 759.797446][T17611] sysfs_create_dir_ns+0x13a/0x2b0 [ 759.797462][T17611] ? __pfx_sysfs_create_dir_ns+0x10/0x10 [ 759.797476][T17611] ? find_held_lock+0x2b/0x80 [ 759.797488][T17611] ? kobject_add_internal+0x25f/0x930 [ 759.797503][T17611] ? kobject_add_internal+0x25f/0x930 [ 759.797518][T17611] ? class_dir_child_ns_type+0xd/0x60 [ 759.797535][T17611] kobject_add_internal+0x2c8/0x930 [ 759.797552][T17611] kobject_add+0x16a/0x1e0 [ 759.797566][T17611] ? __pfx_kobject_add+0x10/0x10 [ 759.797581][T17611] ? get_device_parent+0x1b3/0x4c0 [ 759.797596][T17611] ? kobject_put+0xb9/0x640 [ 759.797610][T17611] ? device_add+0xc4d/0x1970 [ 759.797628][T17611] device_add+0x294/0x1970 [ 759.797657][T17611] ? __pfx_device_add+0x10/0x10 [ 759.797676][T17611] ? _find_next_bit+0x85/0x110 [ 759.797695][T17611] input_register_device+0x7d2/0xe00 [ 759.797712][T17611] uinput_ioctl_handler.isra.0+0x8d8/0x1d20 [ 759.797731][T17611] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 759.797746][T17611] ? __pfx_uinput_ioctl_handler.isra.0+0x10/0x10 [ 759.797765][T17611] ? irqentry_exit+0x24d/0xa00 [ 759.797776][T17611] ? irqentry_exit+0x24d/0xa00 [ 759.797791][T17611] ? __ia32_compat_sys_ioctl+0xce/0x360 [ 759.797807][T17611] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 759.797824][T17611] ? __pfx_uinput_compat_ioctl+0x10/0x10 [ 759.797842][T17611] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 759.797859][T17611] __do_fast_syscall_32+0xe7/0x970 [ 759.797871][T17611] ? lockdep_hardirqs_on+0x78/0x100 [ 759.797890][T17611] do_fast_syscall_32+0x32/0x70 [ 759.797901][T17611] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 759.797916][T17611] RIP: 0023:0xf7fe5fec [ 759.797930][T17611] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 759.797935][T17611] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 759.797947][T17611] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000005501 [ 759.797955][T17611] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 759.797961][T17611] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 759.797967][T17611] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 759.797974][T17611] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 759.797987][T17611] [ 760.004716][T17611] kobject: kobject_add_internal failed for input39 (error: -12 parent: input) [ 760.344528][T17616] 9p: Bad value for 'rfdno' [ 760.555514][T17619] fuse: Bad value for 'group_id' [ 760.574835][T17619] fuse: Bad value for 'group_id' [ 760.659006][T17626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3105'. [ 760.669683][T17626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3105'. [ 760.675644][T17626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3105'. [ 760.679619][T17626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3105'. [ 760.683371][T17626] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3105'. [ 762.667464][T17655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3116'. [ 762.682128][T17655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3116'. [ 762.688072][T17655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3116'. [ 762.694702][T17655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3116'. [ 762.699136][T17655] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3116'. [ 763.258820][T17666] openvswitch: netlink: Key 17 has unexpected len 2 expected 4 [ 763.662363][T17676] fuse: Bad value for 'group_id' [ 763.669352][T17676] fuse: Bad value for 'group_id' [ 763.931312][ T5452] veth0_vlan: left promiscuous mode [ 763.941852][T12301] veth0_vlan: entered promiscuous mode [ 764.975212][T17719] tunl0: Caught tx_queue_len zero misconfig [ 765.062179][T17715] syzkaller0: entered promiscuous mode [ 765.064565][T17715] syzkaller0: entered allmulticast mode [ 765.322119][T17701] input: syz1 as /devices/virtual/input/input41 [ 766.035826][T17734] fuse: Bad value for 'group_id' [ 766.042920][T17734] fuse: Bad value for 'group_id' [ 766.813723][T17747] usb usb1: usbfs: process 17747 (syz.7.3139) did not claim interface 0 before use [ 766.819186][T17747] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 767.983534][ T5840] usb 12-1: new high-speed USB device number 10 using dummy_hcd [ 768.775989][ T5840] usb 12-1: Using ep0 maxpacket: 16 [ 768.781684][ T5840] usb 12-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 768.785591][ T5840] usb 12-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 768.789224][ T5840] usb 12-1: Product: syz [ 768.790997][ T5840] usb 12-1: Manufacturer: syz [ 768.793465][ T5840] usb 12-1: SerialNumber: syz [ 768.803545][ T5840] usb 12-1: config 0 descriptor?? [ 769.134518][ T59] usb 12-1: USB disconnect, device number 10 [ 769.192401][T17783] forcing mempool usage for bio_alloc_bioset+0x8e7/0x1070 [ 770.106564][T17807] __nla_validate_parse: 5 callbacks suppressed [ 770.106580][T17807] netlink: 36 bytes leftover after parsing attributes in process `syz.7.3154'. [ 770.111345][T17807] netlink: 16 bytes leftover after parsing attributes in process `syz.7.3154'. [ 770.114095][T17807] netlink: 36 bytes leftover after parsing attributes in process `syz.7.3154'. [ 771.591901][T17823] 9p: Bad value for 'rfdno' [ 772.325404][ T42] audit: type=1800 audit(1784271154.390:5998): pid=17814 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.3156" name="bus" dev="ramfs" ino=69393 res=0 errno=0 [ 772.491029][T17838] fuse: Bad value for 'group_id' [ 772.492779][T17838] fuse: Bad value for 'group_id' [ 772.616051][ T846] usb 12-1: new high-speed USB device number 11 using dummy_hcd [ 772.766206][ T846] usb 12-1: Using ep0 maxpacket: 16 [ 772.772809][ T846] usb 12-1: config index 0 descriptor too short (expected 65, got 36) [ 772.777667][ T846] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 772.785998][ T846] usb 12-1: config 0 has no interfaces? [ 772.791793][ T846] usb 12-1: New USB device found, idVendor=1781, idProduct=0898, bcdDevice= 0.00 [ 772.805995][ T846] usb 12-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 772.811767][ T846] usb 12-1: config 0 descriptor?? [ 773.053201][T17833] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3161'. [ 773.066242][T17833] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3161'. [ 773.080374][T17833] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3161'. [ 773.096290][T17833] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3161'. [ 773.103300][T17833] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3161'. [ 773.107823][T17833] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3161'. [ 773.111801][T17833] netlink: 28 bytes leftover after parsing attributes in process `syz.7.3161'. [ 773.132877][ T846] usb 12-1: string descriptor 0 read error: -71 [ 773.137385][ T846] usb 12-1: USB disconnect, device number 11 [ 773.275717][T13838] Bluetooth: hci0: sending frame failed (-49) [ 773.291294][ T5754] Bluetooth: hci0: Opcode 0x1003 failed: -49 [ 773.958418][T17866] 9p: Bad value for 'rfdno' [ 774.881606][T17886] xt_CT: You must specify a L4 protocol and not use inversions on it [ 779.331620][T17920] overlayfs: option "workdir=./bus" is useless in a non-upper mount, ignore [ 779.378977][T17920] overlayfs: missing 'lowerdir' [ 779.624385][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 779.650102][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 779.659828][ T6763] usb 6-1: new full-speed USB device number 52 using dummy_hcd [ 779.760323][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 779.852925][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 779.876339][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 779.880629][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 780.038892][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 780.051909][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 780.057398][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 780.096657][T17925] netlink: 'syz.0.3184': attribute type 3 has an invalid length. [ 780.155623][ T6763] usb 6-1: config 0 has an invalid interface number: 117 but max is 1 [ 780.190770][ T6763] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 780.213522][ T6763] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 780.234525][ T6763] usb 6-1: config 0 has no interface number 0 [ 780.242828][ T6763] usb 6-1: too many endpoints for config 0 interface 117 altsetting 112: 44, using maximum allowed: 30 [ 780.266488][ T6763] usb 6-1: config 0 interface 117 altsetting 112 has 0 endpoint descriptors, different from the interface descriptor's value: 44 [ 780.275319][ T6763] usb 6-1: config 0 interface 117 has no altsetting 0 [ 780.306115][ T6763] usb 6-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 780.366274][ T6763] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 780.423696][ T6763] usb 6-1: config 0 descriptor?? [ 780.601710][T17938] ALSA: mixer_oss: invalid OSS volume 'PHlâ6žžqÓ†ØÈÌONEOUT' [ 780.663132][T17938] ALSA: mixer_oss: invalid index 137438 [ 780.790557][ T5888] libceph: connect (1)[c::]:6789 error -101 [ 780.800553][ T5888] libceph: mon0 (1)[c::]:6789 connect error [ 781.063131][T17945] 9p: Bad value for 'rfdno' [ 781.141812][T14657] libceph: connect (1)[c::]:6789 error -101 [ 781.160063][T14657] libceph: mon0 (1)[c::]:6789 connect error [ 781.694791][ T5888] libceph: connect (1)[c::]:6789 error -101 [ 781.772517][ T5888] libceph: mon0 (1)[c::]:6789 connect error [ 782.422989][T17922] ceph: No mds server is up or the cluster is laggy [ 782.817101][ T6763] usb 6-1: string descriptor 0 read error: -71 [ 782.833330][ T6763] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 782.868266][ T6763] dvb-usb: bulk message failed: -22 (3/0) [ 782.903727][ T6763] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 782.932711][ T6763] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 782.936137][ T6763] usb 6-1: media controller created [ 782.947569][ T6763] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 782.982941][ T6763] dvb-usb: bulk message failed: -22 (6/0) [ 782.985593][ T6763] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 783.003284][ T6763] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb6/6-1/input/input46 [ 783.033859][ T6763] dvb-usb: schedule remote query interval to 150 msecs. [ 783.038110][ T6763] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 783.069294][ T6763] usb 6-1: USB disconnect, device number 52 [ 783.428404][ T6763] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 791.787904][T17969] __nla_validate_parse: 13 callbacks suppressed [ 791.787928][T17969] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3193'. [ 792.352999][T17982] 9p: Bad value for 'rfdno' [ 792.537645][T17967] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 792.541871][T17967] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 792.546257][T17967] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 792.560174][ T42] audit: type=1800 audit(1784271174.600:5999): pid=17967 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3192" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 793.507696][T17995] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3198'. [ 793.556318][T17995] netlink: 20 bytes leftover after parsing attributes in process `syz.0.3198'. [ 793.782327][T18002] input: syz1 as /devices/virtual/input/input47 [ 794.246667][ T6763] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 794.501616][ T6763] usb 5-1: Using ep0 maxpacket: 16 [ 794.518924][ T6763] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 794.532189][ T6763] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 794.537345][ T6763] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 794.543860][ T6763] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 794.547879][ T6763] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 794.555425][ T6763] usb 5-1: config 0 descriptor?? [ 795.236164][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.239403][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.298738][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.315597][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.319803][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.323441][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.328020][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.347186][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.350046][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.354326][ T6763] microsoft 0003:045E:07DA.000C: unknown main item tag 0x0 [ 795.373848][ T6763] input: HID 045e:07da as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/0003:045E:07DA.000C/input/input48 [ 795.488091][ T6763] microsoft 0003:045E:07DA.000C: input,hidraw1: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.0-1/input0 [ 795.593187][ T6763] usb 5-1: USB disconnect, device number 51 [ 795.946482][T18022] fido_id[18022]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb5/report_descriptor': No such file or directory [ 797.644843][T18037] 9p: Bad value for 'rfdno' [ 797.721389][ T6056] usb 5-1: new full-speed USB device number 52 using dummy_hcd [ 797.909116][ T6056] usb 5-1: not running at top speed; connect to a high speed hub [ 797.914450][ T6056] usb 5-1: config 3 has an invalid interface number: 161 but max is 0 [ 797.950648][T18043] netlink: 32 bytes leftover after parsing attributes in process `syz.1.3209'. [ 797.972952][ T6056] usb 5-1: config 3 has no interface number 0 [ 797.979074][ T6056] usb 5-1: config 3 interface 161 altsetting 2 endpoint 0x9 has invalid maxpacket 1023, setting to 64 [ 797.986513][ T6056] usb 5-1: config 3 interface 161 has no altsetting 0 [ 798.008929][ T6056] usb 5-1: language id specifier not provided by device, defaulting to English [ 798.055697][T18044] loop5: detected capacity change from 0 to 7 [ 798.331659][ T6056] usb 5-1: New USB device found, idVendor=19d2, idProduct=1084, bcdDevice=50.4f [ 798.342161][ T6056] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 798.532510][T18044] Dev loop5: unable to read RDB block 7 [ 798.535470][T18044] loop5: unable to read partition table [ 798.573765][T18044] loop5: partition table beyond EOD, truncated [ 798.589367][T18044] loop_reread_partitions: partition scan of loop5 (úù) failed (rc=-5) [ 799.090038][ T6056] option 5-1:3.161: GSM modem (1-port) converter detected [ 799.104216][ T6056] usb 5-1: USB disconnect, device number 52 [ 799.227346][ T6056] option 5-1:3.161: device disconnected [ 802.387844][T18084] input: syz1 as /devices/virtual/input/input50 [ 802.390262][T18084] input: failed to attach handler leds to device input50, error: -6 [ 808.318373][ T1439] ieee802154 phy0 wpan0: encryption failed: -22 [ 809.288833][T18101] 9p: Bad value for 'rfdno' [ 809.537824][T18105] gfs2: error -5 reading superblock [ 811.249013][T18123] netlink: 36 bytes leftover after parsing attributes in process `syz.1.3223'. [ 812.353744][T18144] veth0: entered promiscuous mode [ 812.362230][T18142] veth0: left promiscuous mode [ 812.639795][T18148] 9p: Bad value for 'rfdno' [ 812.828672][T18152] netlink: 20 bytes leftover after parsing attributes in process `syz.7.3234'. [ 813.039564][T18158] openvswitch: netlink: Key type 30 is not supported [ 813.496098][T14657] usb 10-1: new full-speed USB device number 50 using dummy_hcd [ 813.689790][T14657] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 813.694774][T14657] usb 10-1: config 0 interface 0 has no altsetting 0 [ 813.700588][T14657] usb 10-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 813.751476][T14657] usb 10-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 813.836728][T14657] usb 10-1: Product: syz [ 813.838625][T14657] usb 10-1: Manufacturer: syz [ 813.879347][T14657] usb 10-1: SerialNumber: syz [ 813.920943][T14657] usb 10-1: config 0 descriptor?? [ 814.349026][T14657] snd-usb-audio 10-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 814.354984][T14657] usb 10-1: USB disconnect, device number 50 [ 814.594324][T18171] udevd[18171]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb10/10-1/10-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 815.526686][T18191] 9p: Bad value for 'rfdno' [ 815.637494][T18193] binder: 18192:18193 ioctl c0306201 0 returned -14 [ 815.895701][T18198] FAULT_INJECTION: forcing a failure. [ 815.895701][T18198] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 815.907765][T18198] CPU: 2 UID: 0 PID: 18198 Comm: syz.1.3246 Tainted: G L syzkaller #0 PREEMPT(full) [ 815.907795][T18198] Tainted: [L]=SOFTLOCKUP [ 815.907801][T18198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 815.907810][T18198] Call Trace: [ 815.907816][T18198] [ 815.907823][T18198] dump_stack_lvl+0x100/0x190 [ 815.907846][T18198] should_fail_ex.cold+0x5/0xa [ 815.907860][T18198] ? prepare_alloc_pages+0x16d/0x5f0 [ 815.907885][T18198] should_fail_alloc_page+0xeb/0x140 [ 815.907909][T18198] prepare_alloc_pages+0x1f0/0x5f0 [ 815.907932][T18198] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 815.907987][T18198] ? rcu_is_watching+0x12/0xc0 [ 815.908004][T18198] ? trace_mm_page_alloc+0x164/0x1c0 [ 815.908023][T18198] ? __alloc_frozen_pages_noprof+0x2d1/0x2dc0 [ 815.908041][T18198] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 815.908058][T18198] ? is_bpf_text_address+0x8a/0x1a0 [ 815.908077][T18198] ? bpf_ksym_find+0x124/0x1c0 [ 815.908092][T18198] ? __pfx_stack_trace_consume_entry+0x10/0x10 [ 815.908112][T18198] ? is_bpf_text_address+0x94/0x1a0 [ 815.908130][T18198] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 815.908146][T18198] ? __kernel_text_address+0xd/0x30 [ 815.908181][T18198] alloc_pages_bulk_noprof+0x5de/0x13c0 [ 815.908203][T18198] ? policy_nodemask+0xed/0x4f0 [ 815.908228][T18198] ? __pfx_alloc_pages_bulk_noprof+0x10/0x10 [ 815.908258][T18198] __kasan_populate_vmalloc+0xf0/0x210 [ 815.908282][T18198] alloc_vmap_area+0x95d/0x2bb0 [ 815.908308][T18198] ? kasan_save_track+0x14/0x30 [ 815.908326][T18198] ? __kasan_kmalloc+0xaa/0xb0 [ 815.908346][T18198] ? __pfx_alloc_vmap_area+0x10/0x10 [ 815.908368][T18198] ? __get_vm_area_node+0x101/0x330 [ 815.908392][T18198] __get_vm_area_node+0x1ca/0x330 [ 815.908417][T18198] __vmalloc_node_range_noprof+0x228/0x1630 [ 815.908442][T18198] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 815.908462][T18198] ? find_held_lock+0x2b/0x80 [ 815.908480][T18198] ? process_measurement+0x4c8/0x2350 [ 815.908496][T18198] ? process_measurement+0x4c8/0x2350 [ 815.908513][T18198] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 815.908541][T18198] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 815.908567][T18198] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 815.908599][T18198] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 815.908619][T18198] __vmalloc_node_noprof+0xad/0xf0 [ 815.908641][T18198] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 815.908664][T18198] __vmalloc_noprof+0xa3/0x120 [ 815.908686][T18198] ? __pfx___vmalloc_noprof+0x10/0x10 [ 815.908711][T18198] ? rcu_is_watching+0x12/0xc0 [ 815.908728][T18198] ? apparmor_capable+0x1d7/0x4d0 [ 815.908747][T18198] bpf_prog_alloc_no_stats+0x58/0x640 [ 815.908768][T18198] ? security_capable+0x80/0x260 [ 815.908794][T18198] bpf_prog_alloc+0x3b/0x200 [ 815.908812][T18198] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 815.908836][T18198] bpf_prog_load+0x4a9/0x2fa0 [ 815.908868][T18198] ? __pfx_bpf_prog_load+0x10/0x10 [ 815.908896][T18198] ? __lock_acquire+0x49f/0x1a40 [ 815.908938][T18198] __sys_bpf+0x18dc/0x4e80 [ 815.908959][T18198] ? __pfx___sys_bpf+0x10/0x10 [ 815.908975][T18198] ? find_held_lock+0x2b/0x80 [ 815.908990][T18198] ? get_pid_task+0xfc/0x250 [ 815.909007][T18198] ? get_pid_task+0xfc/0x250 [ 815.909028][T18198] ? proc_fail_nth_write+0x9f/0x220 [ 815.909047][T18198] ? find_held_lock+0x2b/0x80 [ 815.909068][T18198] ? rcu_read_lock_any_held+0x6a/0xa0 [ 815.909086][T18198] ? find_held_lock+0x2b/0x80 [ 815.909101][T18198] ? ksys_write+0x190/0x250 [ 815.909122][T18198] ? ksys_write+0x190/0x250 [ 815.909157][T18198] ? fput+0x79/0x100 [ 815.909174][T18198] ? __ia32_sys_bpf+0xcc/0x170 [ 815.909187][T18198] __ia32_sys_bpf+0xcc/0x170 [ 815.909202][T18198] ? __do_fast_syscall_32+0x98/0x970 [ 815.909219][T18198] __do_fast_syscall_32+0xe7/0x970 [ 815.909233][T18198] ? lockdep_hardirqs_on+0x78/0x100 [ 815.909258][T18198] do_fast_syscall_32+0x32/0x70 [ 815.909273][T18198] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 815.909293][T18198] RIP: 0023:0xf7fe5fec [ 815.909313][T18198] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 815.909320][T18198] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 815.909337][T18198] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000600 [ 815.909347][T18198] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 815.909356][T18198] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 815.909364][T18198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 815.909373][T18198] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 815.909391][T18198] [ 815.909494][T18198] syz.1.3246: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 816.203802][T18198] CPU: 2 UID: 0 PID: 18198 Comm: syz.1.3246 Tainted: G L syzkaller #0 PREEMPT(full) [ 816.203833][T18198] Tainted: [L]=SOFTLOCKUP [ 816.203839][T18198] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 816.203849][T18198] Call Trace: [ 816.203857][T18198] [ 816.203865][T18198] dump_stack_lvl+0x100/0x190 [ 816.203891][T18198] warn_alloc.cold+0x94/0xa8 [ 816.203910][T18198] ? __pfx_warn_alloc+0x10/0x10 [ 816.203927][T18198] ? lockdep_hardirqs_on+0x78/0x100 [ 816.203999][T18198] ? __get_vm_area_node+0x2cd/0x330 [ 816.204027][T18198] ? __get_vm_area_node+0x208/0x330 [ 816.204052][T18198] __vmalloc_node_range_noprof+0xccd/0x1630 [ 816.204078][T18198] ? find_held_lock+0x2b/0x80 [ 816.204096][T18198] ? process_measurement+0x4c8/0x2350 [ 816.204114][T18198] ? process_measurement+0x4c8/0x2350 [ 816.204135][T18198] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 816.204164][T18198] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 816.204197][T18198] ? tomoyo_check_open_permission+0x1db/0x3c0 [ 816.204225][T18198] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 816.204245][T18198] __vmalloc_node_noprof+0xad/0xf0 [ 816.204269][T18198] ? bpf_prog_alloc_no_stats+0x58/0x640 [ 816.204291][T18198] __vmalloc_noprof+0xa3/0x120 [ 816.204313][T18198] ? __pfx___vmalloc_noprof+0x10/0x10 [ 816.204337][T18198] ? rcu_is_watching+0x12/0xc0 [ 816.204360][T18198] ? apparmor_capable+0x1d7/0x4d0 [ 816.204379][T18198] bpf_prog_alloc_no_stats+0x58/0x640 [ 816.204399][T18198] ? security_capable+0x80/0x260 [ 816.204431][T18198] bpf_prog_alloc+0x3b/0x200 [ 816.204451][T18198] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 816.204475][T18198] bpf_prog_load+0x4a9/0x2fa0 [ 816.204509][T18198] ? __pfx_bpf_prog_load+0x10/0x10 [ 816.204537][T18198] ? __lock_acquire+0x49f/0x1a40 [ 816.204577][T18198] __sys_bpf+0x18dc/0x4e80 [ 816.204600][T18198] ? __pfx___sys_bpf+0x10/0x10 [ 816.204617][T18198] ? find_held_lock+0x2b/0x80 [ 816.204635][T18198] ? get_pid_task+0xfc/0x250 [ 816.204654][T18198] ? get_pid_task+0xfc/0x250 [ 816.204680][T18198] ? proc_fail_nth_write+0x9f/0x220 [ 816.204700][T18198] ? find_held_lock+0x2b/0x80 [ 816.204723][T18198] ? rcu_read_lock_any_held+0x6a/0xa0 [ 816.204743][T18198] ? find_held_lock+0x2b/0x80 [ 816.204761][T18198] ? ksys_write+0x190/0x250 [ 816.204784][T18198] ? ksys_write+0x190/0x250 [ 816.204853][T18198] ? fput+0x79/0x100 [ 816.204873][T18198] ? __ia32_sys_bpf+0xcc/0x170 [ 816.204888][T18198] __ia32_sys_bpf+0xcc/0x170 [ 816.204906][T18198] ? __do_fast_syscall_32+0x98/0x970 [ 816.204925][T18198] __do_fast_syscall_32+0xe7/0x970 [ 816.204942][T18198] ? lockdep_hardirqs_on+0x78/0x100 [ 816.204968][T18198] do_fast_syscall_32+0x32/0x70 [ 816.204984][T18198] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 816.205004][T18198] RIP: 0023:0xf7fe5fec [ 816.205026][T18198] Code: Unable to access opcode bytes at 0xf7fe5fc2. [ 816.205034][T18198] RSP: 002b:00000000f54a650c EFLAGS: 00000292 ORIG_RAX: 0000000000000165 [ 816.205051][T18198] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000600 [ 816.205061][T18198] RDX: 0000000000000080 RSI: 0000000000000000 RDI: 0000000000000000 [ 816.205070][T18198] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 816.205078][T18198] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 816.205087][T18198] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 816.205107][T18198] [ 816.205175][T18198] Mem-Info: [ 816.817120][T18198] active_anon:2562 inactive_anon:3581 isolated_anon:0 [ 816.817120][T18198] active_file:4068 inactive_file:23197 isolated_file:0 [ 816.817120][T18198] unevictable:1768 dirty:413 writeback:0 [ 816.817120][T18198] slab_reclaimable:6713 slab_unreclaimable:71105 [ 816.817120][T18198] mapped:24606 shmem:1843 pagetables:1533 [ 816.817120][T18198] sec_pagetables:314 bounce:0 [ 816.817120][T18198] kernel_misc_reclaimable:0 [ 816.817120][T18198] free:46153 free_pcp:9449 free_cma:0 [ 816.855107][T18198] Node 0 active_anon:20kB inactive_anon:40kB active_file:4kB inactive_file:2212kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:2076kB dirty:4kB writeback:0kB shmem:3536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8992kB pagetables:1644kB sec_pagetables:1120kB all_unreclaimable? yes Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 816.916206][T18198] Node 1 active_anon:10528kB inactive_anon:14284kB active_file:16268kB inactive_file:90576kB unevictable:3536kB isolated(anon):0kB isolated(file):0kB mapped:96348kB dirty:1648kB writeback:0kB shmem:3836kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:8060kB pagetables:4488kB sec_pagetables:136kB all_unreclaimable? no Balloon:0kB gpu_active:0kB gpu_reclaim:0kB [ 816.937826][T18198] Node 0 DMA free:2536kB boost:2048kB min:2808kB low:2996kB high:3184kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 816.957544][T18198] lowmem_reserve[]: 0 280 280 280 280 [ 816.972612][T18198] Node 0 DMA32 free:20008kB boost:4096kB min:16872kB low:20064kB high:23256kB reserved_highatomic:0KB free_highatomic:0KB active_anon:20kB inactive_anon:40kB active_file:4kB inactive_file:2212kB unevictable:3536kB writepending:4kB zspages:320kB present:1032196kB managed:287100kB mlocked:0kB bounce:0kB free_pcp:3468kB local_pcp:2364kB free_cma:0kB [ 816.991360][T18198] lowmem_reserve[]: 0 0 0 0 0 [ 817.010839][T18198] Node 1 DMA32 free:157972kB boost:0kB min:47144kB low:58928kB high:70712kB reserved_highatomic:0KB free_highatomic:0KB active_anon:12660kB inactive_anon:14284kB active_file:16268kB inactive_file:90576kB unevictable:3536kB writepending:1648kB zspages:2148kB present:1048432kB managed:948212kB mlocked:0kB bounce:0kB free_pcp:36208kB local_pcp:8928kB free_cma:0kB [ 817.029677][T18198] lowmem_reserve[]: 0 0 0 0 0 [ 817.045675][T18198] Node 0 DMA: 138*4kB (U) 46*8kB (U) 9*16kB (U) 10*32kB (U) 2*64kB (U) 2*128kB (U) 1*256kB (U) 1*512kB (U) 0*1024kB 0*2048kB 0*4096kB = 2536kB [ 817.052924][T18198] Node 0 DMA32: 582*4kB (UME) 206*8kB (UE) 36*16kB (UE) 143*32kB (UE) 42*64kB (UME) 16*128kB (UME) 4*256kB (U) 4*512kB (UM) 3*1024kB (U) 0*2048kB 0*4096kB = 20008kB [ 817.075807][T18198] Node 1 DMA32: 2577*4kB (UE) 1192*8kB (UME) 433*16kB (UE) 572*32kB (UME) 126*64kB (UME) 113*128kB (UME) 89*256kB (UM) 62*512kB (UM) 33*1024kB (UM) 1*2048kB (U) 0*4096kB = 157972kB [ 817.084141][T18198] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 817.107075][T18209] binder_alloc: binder_alloc_mmap_handler: 18205 80ffc000-81000000 already mapped failed -16 [ 817.138850][T18198] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=2048kB [ 817.145157][T18198] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 817.155055][T18198] Node 1 hugepages_total=4 hugepages_free=4 hugepages_surp=0 hugepages_size=2048kB [ 817.161942][T18198] 29651 total pagecache pages [ 817.163885][T18198] 545 pages in swap cache [ 817.236749][T18198] Free swap = 116492kB [ 817.238426][T18198] Total swap = 124996kB [ 817.262580][T18198] 524155 pages RAM [ 817.264297][T18198] 0 pages HighMem/MovableOnly [ 817.275978][T18198] 211487 pages reserved [ 817.278009][T18198] 0 pages cma reserved [ 817.660791][T18218] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3253'. [ 817.667676][ T6763] usb 12-1: new full-speed USB device number 12 using dummy_hcd [ 817.756810][T18218] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 817.864726][ T6763] usb 12-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 817.873136][ T6763] usb 12-1: config 0 interface 0 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 817.881067][ T6763] usb 12-1: config 0 interface 0 has no altsetting 0 [ 817.886949][ T6763] usb 12-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 817.893240][ T6763] usb 12-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 817.900359][T18209] virt_wifi0 speed is unknown, defaulting to 1000 [ 817.905087][T18209] lo speed is unknown, defaulting to 1000 [ 817.906799][ T6763] usb 12-1: Product: syz [ 817.909549][ T6763] usb 12-1: Manufacturer: syz [ 817.911518][ T6763] usb 12-1: SerialNumber: syz [ 817.916146][ T6763] usb 12-1: config 0 descriptor?? [ 817.988516][ T6763] snd-usb-audio 12-1:0.0: probe with driver snd-usb-audio failed with error -22 [ 818.095331][T18171] udevd[18171]: error opening ATTR{/sys/devices/platform/dummy_hcd.7/usb12/12-1/12-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 818.150836][ T5888] usb 12-1: USB disconnect, device number 12 [ 818.681675][T18229] 9p: Bad value for 'rfdno' [ 819.067074][T18236] validate_nla: 43 callbacks suppressed [ 819.067098][T18236] netlink: 'syz.5.3257': attribute type 8 has an invalid length. [ 819.270236][T18240] random: crng reseeded on system resumption [ 819.346839][T12554] Bluetooth: hci0: Frame reassembly failed (-84) [ 821.381867][T13838] Bluetooth: hci0: command 0x1003 tx timeout [ 821.391449][ T5754] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 823.676604][T18307] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3277'. [ 825.826560][T18315] virt_wifi0 speed is unknown, defaulting to 1000 [ 825.831271][T18315] lo speed is unknown, defaulting to 1000 [ 826.083210][T12535] Bluetooth: hci0: Frame reassembly failed (-84) [ 826.100661][ T62] Bluetooth: hci0: Frame reassembly failed (-84) [ 826.486010][T18326] sch_fq: defrate 0 ignored. [ 826.518135][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3283'. [ 826.572678][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3283'. [ 826.590110][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3283'. [ 826.607563][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3283'. [ 826.614017][T18329] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3283'. [ 827.274973][T18335] nvme_fabrics: unknown parameter or missing value '0x0000000000000000' in ctrl creation request [ 827.425660][T18335] tmpfs: Unknown parameter '18446744073709551615mpol' [ 827.500524][ T6763] usb 5-1: new low-speed USB device number 53 using dummy_hcd [ 827.683149][ T6763] usb 5-1: Invalid ep0 maxpacket: 32 [ 827.819468][ T6763] usb 5-1: new low-speed USB device number 54 using dummy_hcd [ 828.008106][ T6763] usb 5-1: Invalid ep0 maxpacket: 32 [ 828.010693][ T6763] usb usb5-port1: attempt power cycle [ 828.076369][T13838] Bluetooth: hci0: command 0x1003 tx timeout [ 828.083898][ T5754] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 828.344886][T18361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3293'. [ 828.349146][T18361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3293'. [ 828.390040][T18361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3293'. [ 828.395021][T18361] netlink: 8 bytes leftover after parsing attributes in process `syz.1.3293'. [ 828.402463][ T6763] usb 5-1: new low-speed USB device number 55 using dummy_hcd [ 828.487547][ T6763] usb 5-1: Invalid ep0 maxpacket: 32 [ 828.621888][ T6763] usb 5-1: new low-speed USB device number 56 using dummy_hcd [ 828.707063][ T6763] usb 5-1: Invalid ep0 maxpacket: 32 [ 828.711352][ T6763] usb usb5-port1: unable to enumerate USB device [ 829.272962][T18370] i2c i2c-1: dtv_property_process_set: SET cmd 0x00000000 undefined [ 829.416610][T18372] __nla_validate_parse: 1 callbacks suppressed [ 829.416634][T18372] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3298'. [ 829.423904][T18372] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3298'. [ 829.430217][T18372] netlink: 4 bytes leftover after parsing attributes in process `syz.1.3298'. [ 829.470553][T18377] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3299'. [ 829.500523][T18377] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3299'. [ 829.506162][T18377] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3299'. [ 829.511016][T18377] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3299'. [ 829.584094][T18377] netlink: 8 bytes leftover after parsing attributes in process `syz.7.3299'. [ 830.346891][ T42] audit: type=1800 audit(1784271212.400:6000): pid=18384 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.3298" name="regulatory.db" dev="sda1" ino=448 res=0 errno=0 [ 830.405657][T18384] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -4 [ 830.442606][T18384] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -4 [ 830.498970][T18384] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 831.623804][T18408] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3307'. [ 831.638613][T18408] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3307'. [ 834.241389][T14657] usb 6-1: new high-speed USB device number 53 using dummy_hcd [ 834.488908][T14657] usb 6-1: Using ep0 maxpacket: 8 [ 834.509884][T14657] usb 6-1: config index 0 descriptor too short (expected 301, got 45) [ 834.513679][T14657] usb 6-1: config 16 has an invalid descriptor of length 0, skipping remainder of the config [ 834.536238][T14657] usb 6-1: config 16 has 0 interfaces, different from the descriptor's value: 1 [ 834.546370][T14657] usb 6-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 834.552037][T14657] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 834.802254][T14657] usb 6-1: USB disconnect, device number 53 [ 834.823306][T18445] FAULT_INJECTION: forcing a failure. [ 834.823306][T18445] name failslab, interval 1, probability 0, space 0, times 0 [ 834.831059][T18445] CPU: 3 UID: 0 PID: 18445 Comm: syz.5.3317 Tainted: G L syzkaller #0 PREEMPT(full) [ 834.831088][T18445] Tainted: [L]=SOFTLOCKUP [ 834.831094][T18445] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 834.831104][T18445] Call Trace: [ 834.831111][T18445] [ 834.831119][T18445] dump_stack_lvl+0x100/0x190 [ 834.831144][T18445] should_fail_ex.cold+0x5/0xa [ 834.831164][T18445] should_failslab+0xc2/0x120 [ 834.831184][T18445] __kmalloc_noprof+0xfc/0x820 [ 834.831203][T18445] ? tomoyo_encode2+0xfb/0x3c0 [ 834.831229][T18445] tomoyo_encode2+0xfb/0x3c0 [ 834.831254][T18445] tomoyo_encode+0x29/0x50 [ 834.831273][T18445] tomoyo_realpath_from_path+0x18c/0x690 [ 834.831300][T18445] tomoyo_check_open_permission+0x2af/0x3c0 [ 834.831320][T18445] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 834.831338][T18445] ? __lock_acquire+0x49f/0x1a40 [ 834.831361][T18445] ? __lock_acquire+0x49f/0x1a40 [ 834.831394][T18445] ? hook_file_open+0x24f/0x8f0 [ 834.831431][T18445] ? path_get+0x61/0x80 [ 834.831451][T18445] tomoyo_file_open+0x6b/0x90 [ 834.831475][T18445] security_file_open+0xb5/0x1e0 [ 834.831496][T18445] do_dentry_open+0x588/0x14d0 [ 834.831528][T18445] vfs_open+0x82/0x3f0 [ 834.831550][T18445] path_openat+0x2873/0x4280 [ 834.831584][T18445] ? __pfx_path_openat+0x10/0x10 [ 834.831613][T18445] do_file_open+0x20e/0x430 [ 834.831639][T18445] ? __pfx_do_file_open+0x10/0x10 [ 834.831702][T18445] ? alloc_fd+0x471/0x7a0 [ 834.831732][T18445] ? do_getname+0x191/0x390 [ 834.831753][T18445] do_sys_openat2+0x10f/0x1e0 [ 834.831772][T18445] ? __pfx_do_sys_openat2+0x10/0x10 [ 834.831794][T18445] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 834.831811][T18445] ? __fget_files+0x21f/0x3d0 [ 834.831836][T18445] __ia32_compat_sys_open+0xfe/0x1c0 [ 834.831856][T18445] ? __pfx___ia32_compat_sys_open+0x10/0x10 [ 834.831876][T18445] ? fput+0x79/0x100 [ 834.831892][T18445] ? ksys_write+0x1ac/0x250 [ 834.831914][T18445] ? __pfx_ksys_write+0x10/0x10 [ 834.831941][T18445] __do_fast_syscall_32+0xe7/0x970 [ 834.831958][T18445] ? lockdep_hardirqs_on+0x78/0x100 [ 834.831985][T18445] do_fast_syscall_32+0x32/0x70 [ 834.832003][T18445] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 834.832023][T18445] RIP: 0023:0xf708efec [ 834.832046][T18445] Code: Unable to access opcode bytes at 0xf708efc2. [ 834.832053][T18445] RSP: 002b:00000000f545c50c EFLAGS: 00000292 ORIG_RAX: 0000000000000005 [ 834.832071][T18445] RAX: ffffffffffffffda RBX: 0000000080000240 RCX: 0000000000000002 [ 834.832081][T18445] RDX: 0000000000000074 RSI: 0000000000000000 RDI: 0000000000000000 [ 834.832091][T18445] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 834.832101][T18445] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 834.832110][T18445] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 834.832133][T18445] [ 834.832154][T18445] ERROR: Out of memory at tomoyo_realpath_from_path. [ 835.028439][T18445] orangefs_devreq_open: device cannot be opened in blocking mode [ 835.290163][T13838] Bluetooth: hci0: command 0x1003 tx timeout [ 835.400160][ T5754] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 835.864079][T18455] /dev/sg0: Can't lookup blockdev [ 835.897767][T18456] input: syz1 as /devices/virtual/input/input53 [ 835.954650][T18459] __nla_validate_parse: 3 callbacks suppressed [ 835.954671][T18459] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3322'. [ 835.979719][T18459] openvswitch: netlink: Flow set message rejected, Key attribute missing. [ 836.412859][T18464] netlink: 'syz.7.3323': attribute type 1 has an invalid length. [ 836.807149][T18464] 8021q: adding VLAN 0 to HW filter on device bond2 [ 837.241467][T18473] netlink: 772 bytes leftover after parsing attributes in process `syz.0.3325'. [ 837.249710][T18473] netlink: 12 bytes leftover after parsing attributes in process `syz.0.3325'. [ 837.899918][T18477] nbd3: detected capacity change from 0 to 63 [ 837.932163][T17358] block nbd3: Receive control failed (result -32) [ 838.071403][T18489] netlink: 72 bytes leftover after parsing attributes in process `syz.1.3330'. [ 838.104771][ T5113] [ 838.106198][ T5113] ====================================================== [ 838.109476][ T5113] WARNING: possible circular locking dependency detected [ 838.114973][ T5113] syzkaller #0 Tainted: G L [ 838.117936][ T5113] ------------------------------------------------------ [ 838.121930][ T5113] kworker/2:1H/5113 is trying to acquire lock: [ 838.124978][ T5113] ffff88802a4ffe68 (&nsock->tx_lock){+.+.}-{4:4}, at: nbd_queue_rq+0x428/0x1080 [ 838.129364][ T5113] [ 838.129364][ T5113] but task is already holding lock: [ 838.132959][ T5113] ffff888027ed0178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xba/0x1080 [ 838.136570][ T5113] [ 838.136570][ T5113] which lock already depends on the new lock. [ 838.136570][ T5113] [ 838.142312][ T5113] [ 838.142312][ T5113] the existing dependency chain (in reverse order) is: [ 838.146956][ T62] Bluetooth: hci0: Frame reassembly failed (-84) [ 838.147274][ T5113] [ 838.147274][ T5113] -> #6 (&cmd->lock){+.+.}-{4:4}: [ 838.147307][ T5113] lock_acquire+0x1b9/0x370 [ 838.156648][ T5113] __mutex_lock+0x1a4/0x1bd0 [ 838.160199][ T5113] nbd_queue_rq+0xba/0x1080 [ 838.163200][ T5113] blk_mq_dispatch_rq_list+0x422/0x1e70 [ 838.166172][ T5113] __blk_mq_sched_dispatch_requests+0xcea/0x1620 [ 838.169258][ T5113] blk_mq_sched_dispatch_requests+0xd7/0x1c0 [ 838.171995][ T5113] blk_mq_run_work_fn+0x135/0x380 [ 838.174335][ T5113] process_one_work+0xa23/0x1940 [ 838.177043][ T5113] worker_thread+0x5ef/0xe50 [ 838.179582][ T5113] kthread+0x370/0x450 [ 838.182143][ T5113] ret_from_fork+0x72b/0xd50 [ 838.184545][ T5113] ret_from_fork_asm+0x1a/0x30 [ 838.187663][ T5113] [ 838.187663][ T5113] -> #5 (set->srcu){.+.+}-{0:0}: [ 838.191615][ T5113] lock_sync+0x9d/0x110 [ 838.194568][ T5113] __synchronize_srcu+0xa2/0x300 [ 838.197977][ T5113] blk_mq_quiesce_queue+0x149/0x1c0 [ 838.201527][ T5113] elevator_switch+0x17b/0x7e0 [ 838.204279][ T5113] elevator_change+0x352/0x530 [ 838.207297][ T5113] elevator_set_default+0x29e/0x360 [ 838.213490][ T5113] blk_register_queue+0x48e/0x630 [ 838.223765][ T5113] __add_disk+0x73f/0xe40 [ 838.226625][ T5113] add_disk_fwnode+0x118/0x480 [ 838.230055][ T5113] nbd_dev_add+0x77a/0xb10 [ 838.248921][ T5113] nbd_init+0x291/0x2b0 [ 838.251725][ T5113] do_one_initcall+0x11d/0x700 [ 838.255024][ T5113] kernel_init_freeable+0x6ea/0x7b0 [ 838.258337][ T5113] kernel_init+0x1f/0x1e0 [ 838.261524][ T5113] ret_from_fork+0x72b/0xd50 [ 838.264314][ T5113] ret_from_fork_asm+0x1a/0x30 [ 838.267269][ T5113] [ 838.267269][ T5113] -> #4 (&q->elevator_lock){+.+.}-{4:4}: [ 838.282162][ T5113] lock_acquire+0x1b9/0x370 [ 838.284074][ T5113] __mutex_lock+0x1a4/0x1bd0 [ 838.285974][ T5113] elevator_change+0x1bc/0x530 [ 838.288150][ T5113] elevator_set_none+0x92/0xf0 [ 838.290607][ T5113] blk_mq_update_nr_hw_queues+0x4c1/0x15f0 [ 838.307653][ T5113] nbd_start_device+0x1a6/0xbd0 [ 838.310827][ T5113] nbd_genl_connect+0xff2/0x1a40 [ 838.314498][ T5113] genl_family_rcv_msg_doit+0x214/0x300 [ 838.316833][ T5113] genl_rcv_msg+0x560/0x800 [ 838.318672][ T5113] netlink_rcv_skb+0x159/0x420 [ 838.320631][ T5113] genl_rcv+0x28/0x40 [ 838.323873][ T5113] netlink_unicast+0x585/0x850 [ 838.326845][ T5113] netlink_sendmsg+0x8b0/0xda0 [ 838.329746][ T5113] ____sys_sendmsg+0xa4d/0xbe0 [ 838.332591][ T5113] ___sys_sendmsg+0x190/0x1e0 [ 838.334774][ T5113] __sys_sendmsg+0x160/0x210 [ 838.337317][ T5113] __do_fast_syscall_32+0xe7/0x970 [ 838.340155][ T5113] do_fast_syscall_32+0x32/0x70 [ 838.342123][ T5113] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 838.345436][ T5113] [ 838.345436][ T5113] -> #3 (&q->q_usage_counter(io)#50){++++}-{0:0}: [ 838.350192][ T5113] lock_acquire+0x1b9/0x370 [ 838.352511][ T5113] blk_alloc_queue+0x610/0x790 [ 838.355052][ T5113] blk_mq_alloc_queue+0x174/0x290 [ 838.357568][ T5113] __blk_mq_alloc_disk+0x29/0x120 [ 838.360335][ T5113] nbd_dev_add+0x492/0xb10 [ 838.362925][ T5113] nbd_init+0x291/0x2b0 [ 838.365766][ T5113] do_one_initcall+0x11d/0x700 [ 838.368781][ T5113] kernel_init_freeable+0x6ea/0x7b0 [ 838.372377][ T5113] kernel_init+0x1f/0x1e0 [ 838.375275][ T5113] ret_from_fork+0x72b/0xd50 [ 838.378303][ T5113] ret_from_fork_asm+0x1a/0x30 [ 838.381682][ T5113] [ 838.381682][ T5113] -> #2 (fs_reclaim){+.+.}-{0:0}: [ 838.387075][ T5113] lock_acquire+0x1b9/0x370 [ 838.390494][ T5113] fs_reclaim_acquire+0xc4/0x100 [ 838.393867][ T5113] __kmalloc_noprof+0xce/0x820 [ 838.396759][ T5113] tls_sw_sendmsg+0x10f4/0x2b10 [ 838.399838][ T5113] inet6_sendmsg+0x11c/0x140 [ 838.402957][ T5113] sock_sendmsg+0x28c/0x410 [ 838.405996][ T5113] splice_to_socket+0xb3c/0x11a0 [ 838.409293][ T5113] direct_splice_actor+0x192/0x690 [ 838.412880][ T5113] splice_direct_to_actor+0x345/0xa30 [ 838.417402][ T5113] do_splice_direct+0x174/0x240 [ 838.420642][ T5113] do_sendfile+0xadc/0xe20 [ 838.423758][ T5113] __ia32_compat_sys_sendfile+0x1e5/0x220 [ 838.427879][ T5113] __do_fast_syscall_32+0xe7/0x970 [ 838.431377][ T5113] do_fast_syscall_32+0x32/0x70 [ 838.434654][ T5113] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 838.438669][ T5113] [ 838.438669][ T5113] -> #1 (sk_lock-AF_INET6-NBD){+.+.}-{0:0}: [ 838.443356][ T5113] lock_acquire+0x1b9/0x370 [ 838.446150][ T5113] lock_sock_nested+0x41/0xf0 [ 838.449035][ T5113] inet_shutdown+0x67/0x410 [ 838.451809][ T5113] nbd_mark_nsock_dead+0xae/0x5c0 [ 838.455079][ T5113] recv_work+0x5fb/0x8c0 [ 838.459863][ T5113] process_one_work+0xa23/0x1940 [ 838.462941][ T5113] worker_thread+0x5ef/0xe50 [ 838.468140][ T5113] kthread+0x370/0x450 [ 838.470074][ T5113] ret_from_fork+0x72b/0xd50 [ 838.473108][ T5113] ret_from_fork_asm+0x1a/0x30 [ 838.475198][ T5113] [ 838.475198][ T5113] -> #0 (&nsock->tx_lock){+.+.}-{4:4}: [ 838.489678][ T5113] check_prev_add+0xeb/0xe60 [ 838.494946][ T5113] __lock_acquire+0x136c/0x1a40 [ 838.498937][ T5113] lock_acquire+0x1b9/0x370 [ 838.505018][ T5113] __mutex_lock+0x1a4/0x1bd0 [ 838.508798][ T5113] nbd_queue_rq+0x428/0x1080 [ 838.511176][ T5113] blk_mq_dispatch_rq_list+0x422/0x1e70 [ 838.517502][ T5113] __blk_mq_sched_dispatch_requests+0xcea/0x1620 [ 838.520100][ T5113] blk_mq_sched_dispatch_requests+0xd7/0x1c0 [ 838.523105][ T5113] blk_mq_run_work_fn+0x135/0x380 [ 838.525799][ T5113] process_one_work+0xa23/0x1940 [ 838.528475][ T5113] worker_thread+0x5ef/0xe50 [ 838.530811][ T5113] kthread+0x370/0x450 [ 838.532835][ T5113] ret_from_fork+0x72b/0xd50 [ 838.534812][ T5113] ret_from_fork_asm+0x1a/0x30 [ 838.538527][ T5113] [ 838.538527][ T5113] other info that might help us debug this: [ 838.538527][ T5113] [ 838.542730][ T5113] Chain exists of: [ 838.542730][ T5113] &nsock->tx_lock --> set->srcu --> &cmd->lock [ 838.542730][ T5113] [ 838.547574][ T5113] Possible unsafe locking scenario: [ 838.547574][ T5113] [ 838.550135][ T5113] CPU0 CPU1 [ 838.552349][ T5113] ---- ---- [ 838.554499][ T5113] lock(&cmd->lock); [ 838.556442][ T5113] lock(set->srcu); [ 838.559382][ T5113] lock(&cmd->lock); [ 838.561958][ T5113] lock(&nsock->tx_lock); [ 838.564309][ T5113] [ 838.564309][ T5113] *** DEADLOCK *** [ 838.564309][ T5113] [ 838.567963][ T5113] 4 locks held by kworker/2:1H/5113: [ 838.570325][ T5113] #0: ffff888020f69d40 ((wq_completion)kblockd){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940 [ 838.575797][ T5113] #1: ffffc90003397d08 ((work_completion)(&(&hctx->run_work)->work)){+.+.}-{0:0}, at: process_one_work+0x988/0x1940 [ 838.581530][ T5113] #2: ffff888027718a98 (set->srcu){.+.+}-{0:0}, at: blk_mq_run_work_fn+0x127/0x380 [ 838.585023][ T5113] #3: ffff888027ed0178 (&cmd->lock){+.+.}-{4:4}, at: nbd_queue_rq+0xba/0x1080 [ 838.588166][ T5113] [ 838.588166][ T5113] stack backtrace: [ 838.590083][ T5113] CPU: 2 UID: 0 PID: 5113 Comm: kworker/2:1H Tainted: G L syzkaller #0 PREEMPT(full) [ 838.590104][ T5113] Tainted: [L]=SOFTLOCKUP [ 838.590110][ T5113] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 838.590122][ T5113] Workqueue: kblockd blk_mq_run_work_fn [ 838.590144][ T5113] Call Trace: [ 838.590151][ T5113] [ 838.590158][ T5113] dump_stack_lvl+0x100/0x190 [ 838.590175][ T5113] print_circular_bug.cold+0x178/0x1c7 [ 838.590198][ T5113] check_noncircular+0x146/0x160 [ 838.590221][ T5113] check_prev_add+0xeb/0xe60 [ 838.590241][ T5113] __lock_acquire+0x136c/0x1a40 [ 838.590264][ T5113] lock_acquire+0x1b9/0x370 [ 838.590283][ T5113] ? nbd_queue_rq+0x428/0x1080 [ 838.590303][ T5113] ? __pfx___might_resched+0x10/0x10 [ 838.590325][ T5113] __mutex_lock+0x1a4/0x1bd0 [ 838.590340][ T5113] ? nbd_queue_rq+0x428/0x1080 [ 838.590358][ T5113] ? nbd_queue_rq+0x428/0x1080 [ 838.590377][ T5113] ? __pfx___mutex_lock+0x10/0x10 [ 838.590390][ T5113] ? pick_task_fair+0xe6/0x1bf0 [ 838.590405][ T5113] ? irqentry_exit+0x24d/0xa00 [ 838.590419][ T5113] ? lock_acquire+0x1b9/0x370 [ 838.590440][ T5113] ? nbd_queue_rq+0x428/0x1080 [ 838.590458][ T5113] nbd_queue_rq+0x428/0x1080 [ 838.590479][ T5113] ? __pfx_nbd_queue_rq+0x10/0x10 [ 838.590500][ T5113] ? __lock_acquire+0x49f/0x1a40 [ 838.590520][ T5113] blk_mq_dispatch_rq_list+0x422/0x1e70 [ 838.590546][ T5113] ? sbitmap_get+0x1d7/0x360 [ 838.590560][ T5113] ? __pfx_blk_mq_dispatch_rq_list+0x10/0x10 [ 838.590582][ T5113] ? __blk_mq_alloc_driver_tag+0x27a/0x7a0 [ 838.590604][ T5113] __blk_mq_sched_dispatch_requests+0xcea/0x1620 [ 838.590628][ T5113] ? __pfx___blk_mq_sched_dispatch_requests+0x10/0x10 [ 838.590652][ T5113] blk_mq_sched_dispatch_requests+0xd7/0x1c0 [ 838.590672][ T5113] blk_mq_run_work_fn+0x135/0x380 [ 838.590690][ T5113] ? blk_mq_run_work_fn+0x127/0x380 [ 838.590707][ T5113] process_one_work+0xa23/0x1940 [ 838.590729][ T5113] ? __pfx_process_one_work+0x10/0x10 [ 838.590750][ T5113] ? __pfx_blk_mq_run_work_fn+0x10/0x10 [ 838.590772][ T5113] worker_thread+0x5ef/0xe50 [ 838.590792][ T5113] ? __pfx_worker_thread+0x10/0x10 [ 838.590810][ T5113] ? kthread+0x13a/0x450 [ 838.590827][ T5113] ? __pfx_worker_thread+0x10/0x10 [ 838.590843][ T5113] kthread+0x370/0x450 [ 838.590859][ T5113] ? __pfx_kthread+0x10/0x10 [ 838.590876][ T5113] ret_from_fork+0x72b/0xd50 [ 838.590892][ T5113] ? __pfx_ret_from_fork+0x10/0x10 [ 838.590907][ T5113] ? __switch_to+0x800/0x10f0 [ 838.590926][ T5113] ? __pfx_kthread+0x10/0x10 [ 838.590943][ T5113] ret_from_fork_asm+0x1a/0x30 [ 838.590965][ T5113] [ 838.770714][ T5113] block nbd3: Dead connection, failed to find a fallback [ 838.774260][ T5113] block nbd3: shutting down sockets [ 838.778120][ T5113] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 838.783925][ T5113] Buffer I/O error on dev nbd3, logical block 0, async page read [ 838.788855][ T5113] I/O error, dev nbd3, sector 2 op 0x0:(READ) flags 0x0 phys_seg 3 prio class 2 [ 838.795025][ T5113] Buffer I/O error on dev nbd3, logical block 1, async page read SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 838.803463][ T5113] Buffer I/O error on dev nbd3, logical block 2, async page read [ 838.811245][ T5113] Buffer I/O error on dev nbd3, logical block 3, async page read [ 838.818416][ T5909] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 838.824757][ T5909] Buffer I/O error on dev nbd3, logical block 0, async page read [ 838.829765][ T5909] Buffer I/O error on dev nbd3, logical block 1, async page read [ 838.834409][ T5909] Buffer I/O error on dev nbd3, logical block 2, async page read [ 838.840208][ T5909] Buffer I/O error on dev nbd3, logical block 3, async page read [ 838.843875][ T5909] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 838.849148][ T5909] Buffer I/O error on dev nbd3, logical block 0, async page read [ 838.867678][ T5909] Buffer I/O error on dev nbd3, logical block 1, async page read [ 838.871243][ T5113] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 838.902408][ T5113] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 838.912678][ T5113] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 838.925411][ T5113] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 838.931934][ T5113] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 4 prio class 2 [ 838.937591][T18171] ldm_validate_partition_table(): Disk read failed. [ 838.971773][ T5113] I/O error, dev nbd3, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 2 [ 838.976855][T18171] Dev nbd3: unable to read RDB block 0 [ 838.982080][T18171] nbd3: unable to read partition table [ 839.028664][T18171] ldm_validate_partition_table(): Disk read failed. [ 839.034887][T18171] Dev nbd3: unable to read RDB block 0 [ 839.054443][T18485] GUP no longer grows the stack in syz.5.3328 (18485): 80004000-8000a000 (80002000) [ 839.062973][T18171] nbd3: unable to read partition table [ 839.065591][T18485] CPU: 0 UID: 0 PID: 18485 Comm: syz.5.3328 Tainted: G L syzkaller #0 PREEMPT(full) [ 839.065625][T18485] Tainted: [L]=SOFTLOCKUP [ 839.065632][T18485] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 839.065643][T18485] Call Trace: [ 839.065649][T18485] [ 839.065658][T18485] dump_stack_lvl+0x100/0x190 [ 839.065682][T18485] gup_vma_lookup.cold+0x83/0x96 [ 839.065706][T18485] __get_user_pages+0x241/0x32a0 [ 839.065732][T18485] ? rcu_is_watching+0x12/0xc0 [ 839.065753][T18485] ? mtree_load+0x311/0xa90 [ 839.065772][T18485] ? __pfx___get_user_pages+0x10/0x10 [ 839.065794][T18485] ? lock_release+0x24d/0x310 [ 839.065819][T18485] get_user_pages_remote+0x3d2/0xb10 [ 839.066148][T18485] ? mas_root_expand+0x6e0/0x750 [ 839.066170][T18485] ? __pfx_get_user_pages_remote+0x10/0x10 [ 839.066196][T18485] __access_remote_vm+0x3bb/0x890 [ 839.066220][T18485] ? __pfx___access_remote_vm+0x10/0x10 [ 839.066239][T18485] ? proc_pid_cmdline_read+0x4aa/0x9a0 [ 839.066261][T18485] proc_pid_cmdline_read+0x552/0x9a0 [ 839.066280][T18485] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 839.066300][T18485] ? bpf_lsm_file_permission+0x9/0x10 [ 839.066325][T18485] ? security_file_permission+0x76/0x210 [ 839.066346][T18485] ? rw_verify_area+0xce/0x6d0 [ 839.066368][T18485] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 839.066386][T18485] vfs_readv+0x5d8/0x8d0 [ 839.066412][T18485] ? __pfx_vfs_readv+0x10/0x10 [ 839.066435][T18485] ? putname+0xb1/0x110 [ 839.066451][T18485] ? rcu_is_watching+0x12/0xc0 [ 839.066472][T18485] ? __fget_files+0x21f/0x3d0 [ 839.066500][T18485] ? do_preadv+0x1ac/0x270 [ 839.066518][T18485] do_preadv+0x1ac/0x270 [ 839.066536][T18485] ? __pfx_do_preadv+0x10/0x10 [ 839.066557][T18485] ? rcu_is_watching+0x12/0xc0 [ 839.066575][T18485] __do_fast_syscall_32+0xe7/0x970 [ 839.066593][T18485] do_fast_syscall_32+0x32/0x70 [ 839.066611][T18485] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 839.066636][T18485] RIP: 0023:0xf708efec [ 839.066660][T18485] Code: Unable to access opcode bytes at 0xf708efc2. [ 839.066669][T18485] RSP: 002b:00000000f547d50c EFLAGS: 00000292 ORIG_RAX: 000000000000014d [ 839.066689][T18485] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000080 [ 839.066701][T18485] RDX: 0000000000000001 RSI: 0000000000000300 RDI: 0000000000000000 [ 839.066711][T18485] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 839.066720][T18485] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 839.066730][T18485] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 839.066746][T18485] [ 840.156998][ T5754] Bluetooth: hci0: Opcode 0x1003 failed: -110 [ 840.460995][ T12] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.634318][ T12] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.732177][ T12] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 840.896804][ T12] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 841.267206][ T12] bridge_slave_1: left allmulticast mode [ 841.269763][ T12] bridge_slave_1: left promiscuous mode [ 841.272123][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 841.297713][ T12] bridge_slave_0: left allmulticast mode [ 841.300195][ T12] bridge_slave_0: left promiscuous mode [ 841.302846][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 841.628714][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 841.653251][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 841.660586][ T12] bond0 (unregistering): Released all slaves [ 841.679245][ T12] bond1 (unregistering): Released all slaves [ 841.694598][ T5452] 8021q: adding VLAN 0 to HW filter on device eth14 [ 842.035479][ T5452] 8021q: adding VLAN 0 to HW filter on device eth15 [ 842.400054][ T12] hsr_slave_0: left promiscuous mode [ 842.405075][ T12] hsr_slave_1: left promiscuous mode [ 842.415741][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 842.421400][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 842.430387][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 842.435081][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 842.504648][ T12] veth1_macvtap: left promiscuous mode [ 842.509434][ T12] veth0_macvtap: left promiscuous mode [ 842.512967][ T12] veth1_vlan: left promiscuous mode [ 842.521730][ T12] veth0_vlan: left promiscuous mode [ 842.812139][ T12] team0 (unregistering): Port device team_slave_1 removed [ 842.832550][ T12] team0 (unregistering): Port device team_slave_0 removed [ 842.938058][ T5452] 8021q: adding VLAN 0 to HW filter on device eth16 [ 843.295500][ T5452] 8021q: adding VLAN 0 to HW filter on device eth17 [ 843.671717][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.733729][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.791065][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 843.863136][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 844.005154][ T12] vlan2: left promiscuous mode [ 844.007178][ T12] dummy0: left promiscuous mode [ 844.009370][ T12] bridge0: port 3(vlan2) entered disabled state [ 844.027360][ T12] bridge_slave_1: left allmulticast mode [ 844.030442][ T12] bridge_slave_1: left promiscuous mode [ 844.034010][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 844.039664][ T12] bridge_slave_0: left allmulticast mode [ 844.072899][ T12] bridge_slave_0: left promiscuous mode [ 844.075040][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 844.441212][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 844.466581][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 844.483622][ T12] bond0 (unregistering): Released all slaves [ 844.500737][ T5452] 8021q: adding VLAN 0 to HW filter on device eth18 [ 844.782464][ T5452] 8021q: adding VLAN 0 to HW filter on device eth19 [ 845.109648][ T12] hsr_slave_1: left promiscuous mode [ 845.113870][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 845.133567][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 845.147968][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 845.156485][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 845.181402][ T12] veth1_macvtap: left promiscuous mode [ 845.183986][ T12] veth0_macvtap: left promiscuous mode [ 845.199291][ T12] veth1_vlan: left promiscuous mode [ 845.201847][ T12] veth0_vlan: left promiscuous mode [ 845.546585][ T12] team0 (unregistering): Port device team_slave_1 removed [ 845.554408][ T12] team0 (unregistering): Port device team_slave_0 removed [ 845.635831][ T5452] 8021q: adding VLAN 0 to HW filter on device eth21 [ 846.072235][ T5452] 8021q: adding VLAN 0 to HW filter on device eth20