last executing test programs: 14m10.415995693s ago: executing program 32 (id=97): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x44, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)={0x44, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @broadcast}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10040047}, 0x240008c4) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, 0x9, 0x6, 0x201, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x10, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @loopback}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)=ANY=[@ANYBLOB='8\x00\x00\x00\n'], 0x38}, 0x1, 0x0, 0x0, 0x10048047}, 0x4000050) r3 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$cgroup_subtree(r3, 0x0, 0x32600) r4 = socket$vsock_stream(0x28, 0x1, 0x0) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r3, 0xc018937e, &(0x7f00000040c0)={{0x1, 0x1, 0x18, r4, {0x2}}, './file1\x00'}) syz_mount_image$ext4(&(0x7f00000000c0)='ext4\x00', &(0x7f0000000180)='./file0\x00', 0x20044e, &(0x7f00000001c0)={[{@minixdf}, {@jqfmt_vfsv0}, {@inlinecrypt}, {@noblock_validity}, {@usrjquota}]}, 0x1, 0x454, &(0x7f0000000400)="$eJzs3M9vFFUcAPDvTH8gArYi/uCHWkVj44+WAioHD2o08YCJiR702LSFIIUaWhMhRMAYPBlj4t149F/wpBdjPJl41bshIYYL4GnM7M7Q3WV3oWWX0e7nkwy8N/OG97775u2+mbdLAANrIv8jidgaEX9ExFg921xgov7XtStn565fOTuXRJa9+3dSK3f1ytm5smh53pYiM5lGpJ8nsbtNvcunzxyfXVxcOFXkp1dOfDS9fPrMC8dOzB5dOLpwcv+hQwcPzLz80v4XexJn3qaruz5d2rPzrQ++fvvwl03xt8TRIxPdDj6dZT2urlrbGtLJcIUNYU2GIiLvrpHa+B+LoVjtvLF487NKGwf0VZZl2ZbOh89nwAaWRHPekIdBUX7Q5/e/5dY6CXi1f9OPyl1+rX4DlMd9rdhqB7IsO1eUGWm5v+2liYh4//w/3+Zb9Oc5BABAkx/z+c/z7eZ/aTzUUO6+Ym1oPCLuj4jtEfFAROyIiAcjamUfjohH1lh/6yLJzfOf9NK6ArtN+fzvlWJtq2n+F2lZZHyoyG2rxT+SHDm2uLCveE0mY2RTnp/pUsdPb/z+VadjjfO/fMvrL+eCRTsuDW9qPmd+dmX2TmJudPlCxK7hdvEnN1YCkojYGRG71lnHsWe/39Pp2K3j76IH60zZdxHP1Pv/fLTEX0q6r09O3xOLC/umy6viZr/+dvGdTvXfUfw9kPf/vW2v/xvxjyeN67XLa6/j4p9fdLynWe/1P5q8V0uPFvs+mV1ZOTUTMZocrje6cf/+1XPLfFk+j39yb/vxvz1WX4ndEZFfxI9GxGMR8XjR9ici4smI2Nsl/l9ef+rD9cffX3n882vq/9XEaLTuaZ8YOv7zD02Vjt8U//Xu/X+wlpos9tzO+9/ttGt9VzMAAAD8/6QRsTWSdOpGOk2npurfl98RkS4uLa88d2Tp45Pz9d8IjMdIWj7pGmt4HjpT3NbX8xciov7VgvL4geK58TdDm2v5qbmlxfmqg4cBt6XD+M/9NVR164C+G47YVHUbgGr4vSYMLuMfBpfxD4OrzfjfXEU7gLuv3ef/uQraAdx9LePfsh8MEPf/MLg6jv+N/D//ADU+/2EgLW+OW/9Ivmui/JfWefqGTcTIf6IZd57IkradG2nVDZPoZ6La9yUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIBe+TcAAP//yinjzA==") syz_usb_connect$uac3(0x3, 0x80, 0x0, 0x0) syz_read_part_table(0x40a2, &(0x7f0000000000)="$eJzsz89JA1EQB+Bfsn8jQhQU7MGL2oU3D6YBa/DuyRYsIsQCBMEu7MEqnqzZVTx4DIp832Fn3swwy4TfVabk9fK0+96qx3iQ9M9TaVNKyTy52RwOIbl/2ra6fhxvX75WnJ2n2etn2U9ym2ooXT8kF/V2/Wq9y9MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIC/4yTJMkm5G16z+fBtPrt1Zh9xkaTLVZvp9TbNLFKNWZ8qzTB+lDwe//jD+ZSs1js4BwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD439r0Scrynf05OEEghoIAOohJ9GR1tmENXmzBIuzBWixD8OJCArukgL29dxrmw8Cf2+9/WItj0lJ6POQ3jvfUXjzefSNt3jhv8XNJajndnrm+dvwFAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABY2IEDAQAAAAAg/9dGqKqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqsIOHJAAAAAACPr/uh2BAgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACwUAAAAP//JLsnIw==") mknod$loop(0x0, 0x0, 0x1) creat(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x194) 13m11.979446236s ago: executing program 33 (id=216): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) sendmsg$TIPC_CMD_ENABLE_BEARER(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}}, 0x0) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r5 = socket$unix(0x1, 0x5, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000740)=@newqdisc={0x68, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x0, 0xb}, {0xffff, 0xffff}, {0x0, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x3c, 0x2, [@TCA_TBF_PBURST={0x8, 0x7, 0xb86}, @TCA_TBF_PARMS={0x28, 0x1, {{0xa, 0x2, 0xffff, 0x7, 0xcc, 0x3}, {0x0, 0x1, 0x7, 0x8, 0x7f, 0x9}, 0xa6, 0x4, 0x1bb6}}, @TCA_TBF_BURST={0x8, 0x6, 0x7f}]}}]}, 0x68}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) close(r4) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r9, 0x0, 0x4008000) ioctl$SIOCSIFHWADDR(r4, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 13m11.961796066s ago: executing program 34 (id=217): r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000000)=0x200000000) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) ioctl$XFS_IOC_PATH_TO_FSHANDLE(r0, 0xc0385868, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) sendmmsg(r2, 0x0, 0x0, 0x41) openat$sequencer(0xffffffffffffff9c, &(0x7f00000001c0), 0xa0602, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r3 = syz_open_dev$sndmidi(0x0, 0x2, 0x143102) writev(r3, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000003140)={0x30, 0x3e, 0x107, 0x3, 0x25dfdbfd, {0x1, 0x7c}, [@typed={0xa, 0x1, 0x0, 0x0, @str='l2\b\x12\x12\x00'}, @nested={0x10, 0x2, 0x0, 0x1, [@typed={0xc, 0xa, 0x0, 0x0, @u64=0x1000}]}]}, 0x30}, 0x1, 0x0, 0x0, 0x4000811}, 0x400c000) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000480)={0xffffffffffffffff, 0x1, 0x4000, 0xfffff000}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r4 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r4, 0x10e, 0xc, &(0x7f00000001c0)={0x28, 0x1d, 0xfffffffb, 0xffffffff}, 0x10) write(r4, &(0x7f0000000040)="1b0000001e005f0214f6fffffffffff80700"/27, 0x1b) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x8, &(0x7f0000000280)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@nfs_export_on}]}) unlink(&(0x7f0000000080)='./file0/file1\x00') 13m11.471385291s ago: executing program 35 (id=218): socket$tipc(0x1e, 0x5, 0x0) socket$pppoe(0x18, 0x1, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(0xffffffffffffffff, 0x0, 0x800) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{0x0}], 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000007c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(sm4)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000001280), 0x0) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x40880) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, 0x0}, 0x0) ioctl$KVM_HAS_DEVICE_ATTR(0xffffffffffffffff, 0x4018aee3, &(0x7f00000000c0)=@attr_other={0x0, 0xffffff00, 0x3, &(0x7f0000000080)=0x3}) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0301, 0x0) ioctl$DVB_DEMUX_DMX_START(0xffffffffffffffff, 0x6f29) r2 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(r2, 0xc040564a, &(0x7f0000000140)={0x0, 0x0, 0x1003}) mknod(&(0x7f0000000000)='./file0\x00', 0x6000, 0x77b) r3 = syz_init_net_socket$llc(0x1a, 0x1, 0x0) r4 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) sendmsg$TIPC_CMD_GET_REMOTE_MNG(0xffffffffffffffff, &(0x7f0000000500)={&(0x7f00000001c0)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000400)={&(0x7f00000003c0)={0x1c, 0x0, 0x201, 0x70bd2d, 0x25dfdbfd, {}, ["", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40840}, 0x24054049) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000100)='test_dummy_encryption', &(0x7f0000000240)='v1\x00ul\x00\x00\x00\x00\x00loc\x8d\x8b#\xe0\xb9\xbd\"\xeb.\xc7]\xa67\x97 \xc9\xfc|\x85o7Z\xdc}U\x8c\xdd\n\xaa?4\xafq\x1d\xf6(\xe6\x9em_\x1a\xbfDi\x15\x81\xd47\x8e\x86\xa2u~FC\x9c\xe3\x98\x87\x98\xf7\xa2\xb5\x12\x8cv\xe4_\x91\xa8G!mm\f\xcf\xfb[\xd5Qf\x15\xfe\xc80\xad\xaa\xe9', 0x0) connect$llc(r3, &(0x7f0000000180)={0x1a, 0x0, 0x0, 0x8, 0x0, 0x0, @multicast}, 0x10) sendmmsg(r3, &(0x7f0000001380), 0x3fffffffffffeed, 0x0) 13m9.435909586s ago: executing program 36 (id=220): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0xb5001, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x1, 0x1) r3 = socket$unix(0x1, 0x1, 0x0) listen(r3, 0x0) pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0xa64a, 0x0, 0x8000, 0x4, 0x58}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'macvtap0\x00', 0x7101}) r4 = fsopen(&(0x7f0000001340)='cgroup2\x00', 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000000)={0x7, 0x4, 0xd8f9}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, 0xffffffffffffffff, 0x100000) r5 = fsmount(r4, 0x0, 0x80) openat$cgroup_procs(r5, &(0x7f00000002c0)='cgroup.procs\x00', 0x2, 0x0) r6 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r2, 0x0, 0x400) sendmsg$nl_route_sched(r6, 0x0, 0x4800) 13m9.389726107s ago: executing program 37 (id=219): socket$inet_tcp(0x2, 0x1, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r0 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) ioctl$BLKZEROOUT(0xffffffffffffffff, 0x127f, &(0x7f0000000100)={0xa00}) fsopen(0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000b, 0x12, r2, 0x2000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x17) 10m48.72937617s ago: executing program 6 (id=483): sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x40880, 0x0) sendmmsg$alg(r2, 0x0, 0x0, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f0000000280)=@tipc=@id={0x1e, 0x3, 0x1, {0x4e21}}, 0x80, 0x0}, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 10m48.519385637s ago: executing program 8 (id=485): socket$netlink(0x10, 0x3, 0xc) syz_mount_image$ext4(&(0x7f0000000040)='ext4\x00', &(0x7f00000001c0)='./file2\x00', 0x404, &(0x7f0000000280)={[{@max_batch_time={'max_batch_time', 0x3d, 0x3}}, {@jqfmt_vfsold}, {@debug_want_extra_isize={'debug_want_extra_isize', 0x3d, 0x6a}}, {@user_xattr}, {@errors_remount}, {@nombcache}]}, 0x1, 0x42f, &(0x7f0000000940)="$eJzs289rHFUcAPDvzCat/WViqT+aVo1WMfgjadJae/CiKHhQEPRQjzFJS+y2kSaCLUGjSD1Kwbt4FPwLPOlF1JPgVe9SKJJLq6eV2Z1Jdje7aZJustX9fGCS92be8t53Z97ue/N2AuhZw9mfJGJ/RPweEQO1bGOB4dq/W8uLU38vL04lUam89VdSLXdzeXGqKFq8bl+R6YtIP0viSIt65y9fOT9ZLs9cyvNjCxfeH5u/fOW52QuT52bOzVycOH365InxF05NPN+ROLO4bg59NHf08GvvXHtj6sy1d3/+Ninib4qjQ4bXO/hkpdLh6rrrQF066etiQ9iUUq2bRn+1/w9EKVZP3kC8+mlXGwdsq0qlUnmg/eGlCvA/lkS3WwB0R/FFn81/i22Hhh53hRsv1SZAWdy38q12pC/SvEx/0/y2k4Yj4szSP19lW2zPfQgAgAbfZ+OfZ1uN/9Kovy90b76GMhgR90XEwYg4FRGHIuL+iGrZByPioU3W37xIsnb8k17fUmAblI3/XszXthrHf8XoLwZLee5ANf7+5OxseeZ4/p6MRP/uLD++Th0/vPLbF+2O1Y//si2rvxgL5u243re78TXTkwuTdxJzvRufRAz1tYo/WVkJSCLicEQMbbGO2ae/Odru2O3jX0cH1pkqX0c8VTv/S9EUfyFZf31y7J4ozxwfK66KtX759eqb7eq/o/g7IDv/e1te/yvxDyb167Xzm6/j6h+ft53TbPX635W83bDvw8mFhUvjEbuS12uNrt8/0VRuYrV8Fv/Isdb9/2CsvhNHIiK7iB+OiEci4tG87Y9FxOMRcWyd+H96+Yn3th7/9srin97U+V9N7IrmPa0TpfM/ftdQ6eBm4s/O/8lqaiTfs5HPv420a2tXMwAAAPz3pBGxP5J0dCWdpqOjtd/wH4q9aXlufuGZs3MfXJyuPSMwGP1pcadroO5+6Hg+rS/yE035E/l94y9Le6r50am58nS3g4cet69N/8/8Wep264Bt53kt6F36P/Qu/R96l/4PvatF/9/TjXYAO6/V9//HXWgHsPOa+r9lP+gh5v/Qu/R/6F36P/Sk+T1x+4fkJSTWJCK9K5ohsU2Jbn8yAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAdMa/AQAA//9QOObV") write$UHID_INPUT(0xffffffffffffffff, 0x0, 0x0) socket(0x18, 0x1, 0x80000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000340)=ANY=[@ANYBLOB="d80000000001010400000000000000000a0000003c0001802c00018014000300fe8000000000000000000000000000aa1400040000000000000000000000ffff0a0101020c00028005000100000000003c0002802c00018014000300fc02000000000000000000000000000014000400fe8000000000000000000000000000aa0c0002800500010000000000080007400000000044000f800800034000000006080002400000000108000340000000ce08000240000000030800034058696a8c0800024000000001080001"], 0xd8}, 0x1, 0x0, 0x0, 0x40}, 0x0) 10m47.955755275s ago: executing program 6 (id=487): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$inet_smc(0x2b, 0x1, 0x0) ioctl$sock_inet_tcp_SIOCINQ(r3, 0x541b, &(0x7f00000000c0)) sendmsg$nl_generic(0xffffffffffffffff, 0x0, 0x4040) 10m46.800097791s ago: executing program 6 (id=489): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x6) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) r6 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0xe, 0x4, &(0x7f0000000400)=ANY=[@ANYBLOB], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)={@map=r5, r6, 0x5}, 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r5}, &(0x7f00000006c0), &(0x7f0000000700)=r4}, 0x20) sendmsg$inet(r3, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) 10m44.871135791s ago: executing program 6 (id=492): syz_usb_connect$cdc_ecm(0x0, 0x81, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010102020000402505a1a440000102030109026f000141fe70800904000d0302060004092406000080513054052400f7000d0f0f01050000000300050002052415020007240a09fe0c001524120900a317a88b045e4f01a607c0ffcb7e392a"], &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) 10m42.961909811s ago: executing program 8 (id=499): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_sctp(0x2, 0x1, 0x84) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x1, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x1, r2, 0x80000}) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f0000000040)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 10m42.604116693s ago: executing program 6 (id=500): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ff4000/0xa000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000817000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r0 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) readahead(r0, 0x0, 0xf) 10m42.540224185s ago: executing program 6 (id=503): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc044}, 0xc000) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4) socket(0x10, 0x3, 0x0) getpid() syz_open_dev$media(0x0, 0x7fdffffe, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000000)=@fragment={0x88, 0x0, 0x5, 0x1, 0x0, 0x1, 0x8000064}, 0x8) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e26}, 0x73) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x7ffffff7) 10m41.905677525s ago: executing program 8 (id=506): r0 = socket$nl_generic(0x10, 0x3, 0x10) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r2, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x10000}}]}}]}, 0x48}}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r5, {0xc, 0xc}, {0x6, 0xfff1}, {0x7}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 10m39.548022469s ago: executing program 8 (id=509): syz_mount_image$ext4(&(0x7f0000000080)='ext4\x00', &(0x7f00000000c0)='./file0\x00', 0xa003, &(0x7f0000000740)={[{@journal_async_commit}, {@bh}, {@stripe={'stripe', 0x3d, 0xffffffffffffffff}}, {@lazytime}, {@nojournal_checksum}], [{@fsmagic={'fsmagic', 0x3d, 0x5}}, {@hash}, {@rootcontext={'rootcontext', 0x3d, 'user_u'}}, {@fsname={'fsname', 0x3d, 'nogrpid'}}, {@pcr={'pcr', 0x3d, 0x3d}}, {@uid_eq}]}, 0x0, 0x62c, &(0x7f0000000840)="$eJzs3c9rXNUeAPDvnfxO3ntJw+O917fQgGgL2qRJWyki2CK4qqX+WAhuHJu01E5/0EQ0tdIU6kYQNy4EVy6sC/8HLQiu/AdcuHEllSLSjVJ05E7ujNNk7mQSMzNt5vOByZwz586cc5t8e86cOedOAD1rKv1RiNgdEReTiMm6sv7ICqdWj7vzy5WT6S2Jcvmln5O4cjVZqX+tJLsfi4i04PfxSL6JiMm+9fUuLl8+WyyVFi5l+ZmlcxdnFpcv7ztzrnh64fTC+bkn5w4fOnjo8Oz+umedem6z57erLn3s+htvjb9//NXPPrmbzH7+/fEkjtQanZ7XZl97I1MxFeVM/ePpv+vh7a6sS/pqfyd/SdY+sNazbWwQm1L9/Q1ExH9jPPrqfpvj8d4LXW0c0FblJGp9FNBrEvEPPao6Dqi+t2/tffBgm0clQCfcPhrxWC3+ByKiGv/9q3ODMVyZGxi9k9wzz5NExP5tqD+t49uvj19Pb9GmeTigsZVrQ9kU+Nr+P6nE5kQMV3Kjdwr3xH8hm8adyOYPX2xezXhewdSafFb/0FbPB2jdyrWI+F+j8f++ys9m8f9adp8+/voW68+JfwAAAAAAAGALbh6NiCcaff5XqK3/GWyw/mcsIo5sQ/0bf/5XuLUN1QAN3D4a8XTD9b+F6iETfVnun5X1AAPJqTOlhf0R8a+I2BsDQ2l+tv5Fv6h7dkTs+2Dy47z669f/pbe0/upawKwdt/rXrAaaLy4Vt+HUoefdvhbx//5G8Z/U+v+kQf+fxvfFFuuYfPTGibyyjeMfaJfypxF7Gvb/Se2YpPn1OWYq44GZ6qhgvYfe+fDLvPrFP3RP2v+PNo//oaT+ej2Lm3v9wYg4sNxfzivfKP7ToX+j8f9g8nJf1O1EfLu4tHRpNmIwObb+8bnNtRkeJMOtH/puRFTioRovafzvfaT5/F9t/F8XhyPZNb5a8Z8/xn7IK9P/Q/ek8T/fvP+fuLf/33xi7sbEV3n1n2hp/u9gpU/fmz1i/g+aazVAu91OAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgQFSLiH5EUpmvpQmF6OmIsIv4do4XShcWlx09dePP8fFpW+f7/QvWbfsdX80n1+/8n6vJza/IHImJXRHzUN1LJT5+8UJrv9skDAAAAAAAAAAAAAAAAAADAfWJs9W7d/v/Uj33Nn/t8+5sHtFt/dr9BvAM7UH+3GwB0jfiH3iX+oXflx/+vd8sVHW0O0EGt9v/lq21uCNBxWxz/+7gAdgDv/6FXDbR22HC72wF0g/4fAAAAAAB2lF0P3/wuiYiVp0Yqt9RgVlb7YHCkW60D2qmQVzDU2XYAnWcNL/QuS3+gd7W4+BfYwZJa6reGm/3zV/8n7WkQAAAAAAAAAAAAALDOnt0t7P8HdqTc/f/Ajtdk/3+jjT0uFwA7iP3/0Ltc5guoDvbzvunf/n8AAAAAAAAAAAAAuA8MXz5bLJUWLi0ut5y4upmD/37ip8greqaTzdiuxErxvmjGg5AYiIg1ReXx1T/bs8XSK9HZ9lQjphN1DXawrpxEl/4/AgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA1vkzAAD//y6EJ6E=") prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8f}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x0, 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000002800)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet6(0xa, 0x3, 0x8000000003c) setsockopt$inet6_MCAST_JOIN_GROUP(0xffffffffffffffff, 0x29, 0x2a, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) io_setup(0x200, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x38, 0x0, 0x0) getsockopt$inet6_int(r3, 0x29, 0x7, 0x0, 0x0) syz_create_resource$binfmt(&(0x7f0000001400)='./file0\x00') openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xcda\x9b\x11X\x0e\xa1\xcf\x1a\x98S7\xc9\x00'/47, 0x2) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) 10m37.039100077s ago: executing program 8 (id=516): sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$inet_sctp(0x2, 0x1, 0x84) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x1, 0x7fffffff}]}) r3 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r3, 0xc0184800, &(0x7f0000000100)={0x1, r2, 0x80000}) ioctl$DMA_BUF_IOCTL_SYNC(r4, 0x40086200, &(0x7f0000000040)=0x7) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) 10m35.772838757s ago: executing program 8 (id=521): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x2000) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="0815000000051104000000000000000001000005540201"], 0x1508}}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x400000000000004) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800, 0x1}, 0x20) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0x0, r7}, 0x10) writev(r5, &(0x7f0000000100)=[{&(0x7f0000000200)}], 0x1) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001380)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0xe, 0x5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MPU={0x8, 0xe, 0x65}]}}]}, 0x3c}}, 0x4000010) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r8, 0x29, 0x37, &(0x7f0000000300)={0xbe}, 0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3fffffffffff, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000002c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0xfffffffd, @loopback, 0x4}, r10}}, 0x30) 10m22.171950374s ago: executing program 38 (id=503): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) openat$vicodec1(0xffffffffffffff9c, 0x0, 0x2, 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc044}, 0xc000) mprotect(&(0x7f0000ffb000/0x3000)=nil, 0x3000, 0x4) socket(0x10, 0x3, 0x0) getpid() syz_open_dev$media(0x0, 0x7fdffffe, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_opts(r1, 0x29, 0x3b, &(0x7f0000000000)=@fragment={0x88, 0x0, 0x5, 0x1, 0x0, 0x1, 0x8000064}, 0x8) connect$inet6(r1, &(0x7f00000002c0)={0xa, 0x4e26}, 0x73) sendmmsg(r1, &(0x7f00000092c0), 0x4ff, 0x7ffffff7) 10m19.812983928s ago: executing program 39 (id=521): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() newfstatat(0xffffffffffffff9c, 0x0, 0x0, 0x2000) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$OSF_MSG_ADD(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="0815000000051104000000000000000001000005540201"], 0x1508}}, 0x10) r5 = socket$netlink(0x10, 0x3, 0x400000000000004) r6 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r6, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800, 0x1}, 0x20) setsockopt$XDP_TX_RING(r6, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000400)={'dummy0\x00', 0x0}) bind$xdp(r6, &(0x7f0000000100)={0x2c, 0x0, r7}, 0x10) writev(r5, &(0x7f0000000100)=[{&(0x7f0000000200)}], 0x1) r8 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001380)=@newqdisc={0x3c, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0xe, 0x5}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_MPU={0x8, 0xe, 0x65}]}}]}, 0x3c}}, 0x4000010) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r8, 0x29, 0x37, &(0x7f0000000300)={0xbe}, 0x8) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x3fffffffffff, &(0x7f00000000c0)={0xffffffffffffffff}, 0x2, 0x9}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r0, &(0x7f00000002c0)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e23, 0xfffffffd, @loopback, 0x4}, r10}}, 0x30) 8m37.246133145s ago: executing program 7 (id=792): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000140)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8m35.301682575s ago: executing program 7 (id=797): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000100)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) personality(0x619641b6fb4b8591) uname(0x0) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000080)={{0x1, 0x1, 0x18, r2, {0x8, 0x6}}, './file0\x00'}) ioctl$MEDIA_IOC_G_TOPOLOGY(r5, 0xc0487c04, &(0x7f00000009c0)={0x0, 0x2, 0x0, &(0x7f0000000380)=[{}, {}], 0x5, 0x0, &(0x7f00000006c0)=[{}, {}, {}, {}, {}], 0x2, 0x0, &(0x7f0000000900)=[{}, {}], 0x2, 0x0, &(0x7f0000000940)=[{}, {}]}) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003840), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000002c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_DEL_KEY(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000200)={0x2c, r6, 0x1, 0x70bd26, 0x25dfdbfd, {{}, {@val={0x8, 0x3, r7}, @void}}, [@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}, @NL80211_ATTR_MAC={0xa}]}, 0x2c}, 0x1, 0x0, 0x0, 0x8000}, 0x8c0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000002c0)=0x7e) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000540)=0x9) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000040)=0x7) ioctl$TIOCSTI(r3, 0x5412, &(0x7f0000000000)=0x7e) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x3, 0x4, &(0x7f0000000140)=@framed={{0x18, 0x2, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0xdfffffff}, [@call={0x85, 0x0, 0x0, 0x5}]}, &(0x7f0000000000)='syzkaller\x00', 0x2}, 0x94) 8m34.293861716s ago: executing program 7 (id=800): sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$nl_generic(0x10, 0x3, 0x10) shmget$private(0x0, 0x3000, 0x0, &(0x7f0000ffd000/0x3000)=nil) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000380)=0x7) r0 = getpid() sched_setscheduler(r0, 0x1, &(0x7f00000000c0)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setgroups(0x0, 0x0) shmctl$SHM_INFO(0x0, 0xe, 0x0) 8m32.648641446s ago: executing program 7 (id=803): r0 = socket(0x10, 0x803, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$cuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r5 = socket(0x40000000015, 0x805, 0x0) getsockopt(r5, 0x114, 0x271d, 0x0, &(0x7f0000000000)) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, r6, {0x0, 0xffe1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x4}}]}, 0x30}}, 0x8000) sendmsg$nl_route_sched(r0, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x24040084) socket$nl_netfilter(0x10, 0x3, 0xc) r7 = fsopen(0x0, 0x1) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) fsmount(r7, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)) fanotify_init(0x1a, 0x1) syz_io_uring_setup(0x7db6, 0x0, 0x0, 0x0, 0x0) socket$packet(0x11, 0x2, 0x300) r8 = socket$kcm(0x29, 0x2, 0x0) read(r8, 0x0, 0x0) 8m31.043878296s ago: executing program 7 (id=808): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0xe, 0x4, 0x8, 0x7}, 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x3, 0xc, &(0x7f0000000140)=@framed={{}, [@ringbuf_output={{0x18, 0x5, 0x1, 0x0, r0}, {}, {0x3, 0x3, 0x3, 0xa, 0x5}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x1e}}]}, &(0x7f0000000380)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 8m29.568292641s ago: executing program 7 (id=811): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r4, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r5, 0x0, 0x0, 0x20000081) openat$rtc(0xffffffffffffff9c, 0x0, 0x80000, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) r6 = syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setsig(0x4203, r6, 0xdf80, &(0x7f0000000080)={0x0, 0x7, 0xd}) 8m13.200758415s ago: executing program 40 (id=811): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x400000000008d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r3, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0026}]}) close_range(r4, 0xffffffffffffffff, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$packet(0x11, 0x3, 0x300) sendmmsg(r5, 0x0, 0x0, 0x20000081) openat$rtc(0xffffffffffffff9c, 0x0, 0x80000, 0x0) bind$inet(r3, &(0x7f0000000240)={0x2, 0x0, @local}, 0x6f) r6 = syz_clone(0x400, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r6) ptrace$setsig(0x4203, r6, 0xdf80, &(0x7f0000000080)={0x0, 0x7, 0xd}) 4m29.161714854s ago: executing program 0 (id=1331): openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$BTRFS_IOC_BALANCE_PROGRESS(0xffffffffffffffff, 0x84009422, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x4a102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000580), 0xaad80) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="30000000010101010000000000400000020000000c0019800800010008000000100001800c000280050001003a000000"], 0xfde2}}, 0x0) r2 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, &(0x7f0000000000)={0x2}) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000100), 0x101e01, 0x0) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000140)=0x15) ioctl$TIOCSTI(r3, 0x5412, &(0x7f00000002c0)=0x7e) syz_emit_ethernet(0xb1, &(0x7f0000001100)={@link_local, @random="0000fc00", @void, {@ipv4={0x800, @gre={{0x17, 0x4, 0x1, 0x6, 0xa3, 0x64, 0x0, 0x4, 0x2f, 0x0, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, {[@timestamp={0x44, 0x14, 0xe5, 0x0, 0x9, [0x3, 0x9b, 0xa8, 0x23]}, @cipso={0x86, 0x31, 0xffffffffffffffff, [{0x6, 0x4, "f0c0"}, {0x2, 0x2}, {0x5, 0xc, "2a285014176a8f428930"}, {0x6, 0xc, "be5f39f0b3ebc16ce1df"}, {0x2, 0x2}, {0x5, 0x6, "0ac356ab"}, {0x1, 0x5, "36cfab"}]}]}}, {{0x0, 0x0, 0x1, 0x0, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x2}, {0x0, 0x0, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x3, {{0x3, 0x1, 0xe2, 0x0, 0x1, 0x1, 0x1, 0x8}, 0x1, {0x8}}}, {0x8, 0x22eb, 0x4, {{0xf, 0x2, 0x2, 0x3, 0x0, 0x0, 0x6, 0x81}, 0x2, {0x9c, 0xbd, 0x0, 0x19, 0x1, 0x1, 0x3, 0x0, 0x1}}}, {0x8, 0x6558, 0x2, "f80f83"}}}}}}, 0x0) syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_LIST(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) r6 = syz_open_dev$ndb(&(0x7f0000000240), 0x0, 0x80200) ioctl$NBD_SET_FLAGS(r6, 0xab0a, 0x8) 4m27.140194576s ago: executing program 0 (id=1334): r0 = syz_open_procfs(0x0, &(0x7f0000000440)='net/if_inet6\x00') sendmsg$RDMA_NLDEV_CMD_GET(r0, 0x0, 0x24004004) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0x20}}, 0xc000) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r4, 0x84, 0x82, &(0x7f0000000200)={0x0, 0x2000, 0x102}, 0x30) read$FUSE(r0, &(0x7f0000002000)={0x2020}, 0x2020) 4m25.443056988s ago: executing program 0 (id=1339): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mount(0x0, &(0x7f00000001c0)='./file1\x00', 0x0, 0x0, 0x0) open(&(0x7f00000002c0)='.\x00', 0x80000, 0x12d) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000cc0)={'syz1\x00', {0xfff9, 0x6, 0x248, 0x9b9a}, 0x3a, [0xfffffff5, 0x0, 0x5, 0x10009, 0x8, 0x155f, 0x6, 0x2, 0x25cd, 0x401, 0x40000b4, 0xa, 0x2, 0x4, 0x81, 0xe4, 0x6, 0xfc000000, 0x9, 0xbbf, 0x200, 0x1, 0x48, 0x100d, 0x3, 0x12a0, 0x8000, 0x1, 0x7, 0x6, 0x7, 0x81, 0x40008a, 0x79, 0x2, 0x10001, 0x4, 0x91, 0x4, 0xe768, 0x16, 0x2, 0x5, 0x401, 0xfffffff5, 0x405, 0xa7, 0x84, 0x9, 0xf9a2, 0x80000001, 0xff, 0x2, 0x2, 0x2, 0x2, 0x7, 0x8, 0x7, 0x5, 0x4007f, 0xffffffff, 0x6], [0x3, 0x16e, 0x6, 0xf6ca, 0x4, 0xda, 0xb8a9, 0x20000070, 0x8e, 0xd50, 0x7, 0x5, 0xfffffffe, 0x80d, 0x5, 0xa7, 0x1000, 0x101, 0x200b395, 0x400000, 0x80000000, 0x4, 0x19, 0x7, 0x400001, 0x3, 0x3, 0xb, 0xffffff7f, 0x401, 0x6, 0x200, 0x96, 0x0, 0xfffffff6, 0x401, 0x6, 0xf1, 0x6, 0x55c, 0x5, 0x6, 0x2, 0x5, 0x3ff, 0x1ff, 0x1, 0x1, 0x0, 0x1ce, 0x1, 0x80000004, 0x80000001, 0x2, 0x2, 0x9, 0x95, 0x80000000, 0x4, 0xfffffff9, 0x40000003, 0x1000, 0xfffff804, 0x5], [0x2, 0xfffffffe, 0xfffc, 0x6, 0x2, 0x2e6bf783, 0xfffff100, 0x5, 0x400005, 0x491, 0x8d3, 0x200006, 0x8, 0x400, 0x2, 0x400, 0x41, 0x5, 0xee4b, 0x2008004, 0x1, 0x691, 0x5, 0x89, 0x3, 0x3, 0x9, 0x3, 0xc7, 0xffe, 0x10000a, 0x8000, 0x401, 0x3e55, 0x9, 0xd3, 0x8, 0x3437, 0x2, 0xd, 0x7, 0x601, 0x101, 0x200dd80, 0x60a0, 0x3, 0x9d26, 0x10000, 0x1, 0x2, 0x2, 0x4, 0x8000, 0x0, 0x3, 0xd500, 0x8, 0x77, 0x9, 0xa, 0x10000, 0x3, 0x8, 0x1], [0xa772, 0x2, 0x7, 0x1afa, 0xbfc, 0x8, 0x3, 0x7f, 0x55, 0x40, 0xc, 0x1005, 0x1, 0x8000007, 0x1e, 0x9, 0x81, 0x3, 0x9d86, 0xfffffeff, 0xffbffff7, 0x8, 0x7, 0x3, 0x939, 0x6, 0x80008001, 0x7777, 0x7fffffff, 0x2, 0x100, 0xffffffff, 0x7ffffffe, 0x4009, 0xc, 0x32d, 0x3, 0x1ff, 0x2000803, 0x6, 0x10000, 0x0, 0x8004, 0x6fff, 0x2, 0x3, 0xf, 0xe, 0x10, 0x26c, 0x6, 0xfffffff9, 0x4, 0xfffffff8, 0x9, 0xf, 0x463f, 0x4, 0xdad, 0x8003, 0x8, 0x14000, 0x1, 0x9]}, 0x45c) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x40040, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000000)={[0x35, 0xfff, 0x0, 0x40000000000180, 0x8, 0x80000000, 0xf2, 0xd, 0x7fffffffffffe, 0x7, 0x5, 0x0, 0x0, 0x5, 0x4, 0x8], 0x25000, 0x204344}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) dup(r4) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000000c0)="c20000361e0f01c3660fd2eff30f10f1b961020000b80e000000ba000000000f30b98d0200000f320b99f3530000660f6af7c4e2f91d20", 0x9}], 0x1, 0x1d, 0x0, 0x0) syz_kvm_setup_cpu$x86(r4, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000200)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) 4m24.832223997s ago: executing program 0 (id=1342): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x4000087, 0x2, 0x0) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r3, 0x1, 0x1a, &(0x7f0000000100)={0x2, &(0x7f0000000040)=[{0x30, 0x0, 0x0, 0xc8e}, {0x16}]}, 0x10) 4m21.888038898s ago: executing program 0 (id=1348): r0 = syz_clone(0x180000, 0x0, 0xfffffefb, 0x0, 0x0, 0x0) r1 = syz_pidfd_open(r0, 0x0) process_madvise(r1, 0x0, 0x0, 0x1, 0x0) 4m20.449266382s ago: executing program 0 (id=1350): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) semctl$IPC_RMID(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) 4m3.092142866s ago: executing program 41 (id=1350): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) semctl$IPC_RMID(0x0, 0x0, 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) 2m3.688871117s ago: executing program 2 (id=1896): syz_open_procfs$namespace(0x0, 0x0) add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) bind$inet(0xffffffffffffffff, &(0x7f0000000240)={0x2, 0x4e20, @multicast1}, 0x10) socket$kcm(0x29, 0x5, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r0, 0x60}], 0x1, 0x0, 0x0, 0x0) 2m3.505769512s ago: executing program 2 (id=1898): ioctl$UI_ABS_SETUP(0xffffffffffffffff, 0x401c5504, &(0x7f00000002c0)={0x3f}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xd, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={0x3c, 0x2, 0x6, 0x801, 0x0, 0x9, {}, [@IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_MAXELEM={0x8, 0x13, 0x0}]}]}, 0x3c}}, 0x0) sendmsg$L2TP_CMD_SESSION_DELETE(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x20006911}, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, 0x0, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f0000000ac0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x94) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c385a7af3", 0x5) r1 = accept4(r0, 0x0, 0x0, 0x800) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r2, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r3, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r4, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x8044) 2m3.320217479s ago: executing program 2 (id=1900): r0 = syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000002000040257d15a4400001040001090260004201000000090400000102090000052406000105240000000d240f01000004eaffffff1e0006031a000008048002000905", @ANYRES64], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r1, &(0x7f00000003c0)=[{&(0x7f0000000200)='\r', 0x1}], 0x1) syz_usb_disconnect(r0) 1m58.834435896s ago: executing program 2 (id=1915): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x8000, &(0x7f0000001dc0)={0xb, 0x0, 0x100000}, 0x20) mount(0x0, &(0x7f00000000c0)='.\x00', 0x0, 0x2251024, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = syz_create_resource$binfmt(&(0x7f0000000040)='./file1\x00') write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) execveat$binfmt(0xffffffffffffff9c, r5, 0x0, 0x0, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x4, 0x0, 0x7, 0x8000001}) mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000000c0)='tracefs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@userxattr}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) openat$dir(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0, 0x0) 1m51.823168242s ago: executing program 2 (id=1934): r0 = syz_open_procfs(0x0, &(0x7f0000000100)='mountinfo\x00') pread64(r0, &(0x7f0000002280)=""/4096, 0x1000, 0xd33) 1m51.534248471s ago: executing program 2 (id=1939): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80000) ioctl$int_in(r1, 0x5452, &(0x7f0000000580)=0x3) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="ad00"/16, 0x10) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) 1m36.411142216s ago: executing program 42 (id=1939): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000100)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) r1 = accept4(r0, 0x0, 0x0, 0x80000) ioctl$int_in(r1, 0x5452, &(0x7f0000000580)=0x3) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000)="ad00"/16, 0x10) recvmmsg(r1, &(0x7f0000002440), 0x3ffffffffffff67, 0x0, 0x0) 4.971678497s ago: executing program 1 (id=2313): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}, 0x1, 0x0, 0x0, 0x68840}, 0x4) recvmmsg(r0, &(0x7f0000003ac0)=[{{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000014c0)=""/4090, 0xffa}, {&(0x7f00000003c0)=""/184, 0xb8}, {&(0x7f0000000000)=""/107, 0x6b}], 0x3}, 0x2}, {{0x0, 0x0, 0x0}, 0x9}], 0x2, 0x2, 0x0) 3.683399297s ago: executing program 5 (id=2316): r0 = socket(0x10, 0x803, 0x0) sendto(r0, &(0x7f0000000080)="120000001200e7ef00341618a585107b462e", 0x12, 0x10, 0x0, 0x0) recvmmsg(r0, &(0x7f0000000b80)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000003d40)=""/4063, 0xfdf}, {&(0x7f0000000300)=""/202, 0xca}, {&(0x7f0000000500)=""/85, 0x55}, {&(0x7f0000000280)=""/86, 0x56}, {&(0x7f0000002d00)=""/4106, 0x100a}, {&(0x7f0000000400)=""/242, 0xf2}, {&(0x7f00000009c0)=""/259, 0x103}, {&(0x7f0000000640)=""/83, 0x53}, {&(0x7f00000007c0)=""/238, 0xee}, {&(0x7f0000000580)=""/128, 0x80}], 0xa}, 0x5e}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x1f75}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, 0x0}, 0x99c5}, {{0x0, 0x0, 0x0}, 0x2090d2}, {{0x0, 0x0, 0x0}, 0xe52}, {{0x0, 0x0, 0x0}, 0x7a}], 0x8, 0x2040, 0x0) 3.639727458s ago: executing program 1 (id=2318): r0 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) write$vga_arbiter(r0, &(0x7f0000000180)=ANY=[@ANYBLOB='trylock m'], 0xc) 3.639081149s ago: executing program 4 (id=2320): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0xc6, 0x4) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) io_uring_setup(0x4dc2, 0x0) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) 3.457095664s ago: executing program 5 (id=2321): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b9b0d9307", 0xe7}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2a91564fc364f1b971b0e005fe1d24f1b0d7f157b695c625cc39aac2d6f07b11d926c", 0xb7}, {&(0x7f0000000ac0)="3fe4c8a328", 0x5}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233", 0x19}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e68a60", 0xb0}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fae7a4a130246680b2", 0xd2}], 0x5, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.448033785s ago: executing program 1 (id=2322): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c8f68476969bf8c4bcd37ba24e4ba1683339879a11b854a7478f898805f327af12eaab8ac918c201b7f932e124796", 0x85, 0x5, 0xffffffff}], 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000700)=[{0x0}, {&(0x7f0000000740)}], 0x2}, 0x41) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b9b0d9307", 0xe7}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2a91564fc364f1b971b0e005fe1d24f1b0d7f157b695c625cc39aac2d6f07b11d926c", 0xb7}, {&(0x7f0000000ac0)="3fe4c8a328", 0x5}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e3853e4a118a5a2bcc52eeea6b2dc4fc", 0x2a}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e68a60", 0xb0}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c4", 0x66}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae", 0x39}], 0x6, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 3.327970138s ago: executing program 4 (id=2323): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) socket$pptp(0x18, 0x1, 0x2) syz_open_dev$video(&(0x7f0000000000), 0x8, 0x80) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7ffffbff], 0x0, 0x4}) 3.190702063s ago: executing program 5 (id=2325): r0 = socket$netlink(0x10, 0x3, 0x4) setsockopt$netlink_NETLINK_CAP_ACK(r0, 0x10e, 0xa, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, 0x0, 0x0) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-asm\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000400)=[{0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000140)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe1a}], 0x1, &(0x7f0000000a40)=ANY=[@ANYBLOB="180000000000000017010fff03000000010000000000000000000000000000001701000002000000000000007005baa38d33e2e1650de8f13f421b2d4b60252e76171216e42961c3b08d4d3dacb0a7089ff7cbfd613d46fa95d6e2f6e76ac3266c9b1a531c4bcf0e7071f117cca4e883b4a6eb5dee7a9ab4d05d7ee311ab1c55b817285e0c3714ee6137e3b8553de667701a7c93437583b5f0b285a188098c1ac4ebac40b315ff8db6f736992497879a42b95248fed4d4888970573d0e88ceead26d97e172588a3ad30fbd01b7bbeeaa668e835f7ae3113fe2d949bb47bc0b2c62541714cc0538601ae4bab19d69a5addee134dd447034da6dd89704603d31a3d25b9d5f46cfd43d9e29aac7422920d98e1463256bd4cc929373ad9000000000faf6a95a04ad3b9db9b230f8224a3d6db187a94e5dadfe181d20d3a4bd08e8b0e6eeb79fdee230dd852a36dfc9046d03b8f316b2d460ca5d08c515d914db8ce430ea0237911c440ee750fe787aaffa83b809651c529e4cf68c8219a827ea003c59e3e51b00cd7f9464f37be2eb3e1475819ad37edcc238b85ab205a2b394916815d9cf7bf3f8e3d19a4697756299e21f2afd3ae31e0f09b8153965635216de47156f4e5fc97cb04f9c5e13256be1d9e0a94f9c6387940de1bcd7b532d16ebba216601cf23be6a7c259550bd059a5a7aee85eb558de8201c1d9c7b29e27313f61cf0b07dd790071bdbceabdd32ce2bcc279b1575a1431b03e5dc37307d15a2782175c87dad1a3aadf48b382bea4ae0b423edee0e12ada4c1dacc40bf387630792ab5c7ed6e2ef7e8a77268b0ff8978ccddfa8da4521d24b3fddc70d181c20caa9a584df9b2e"], 0x18}], 0x4924924924924fd, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a300000000040000000030a01020000000000000000010000000900030073797a320000000014000480080002400000000008000140000000000900010073797a300000000054000000060a010400000000000000000100000008000b40000000000900010073797a30000000002c0004802800018008000100666962001c00028008000240000000030800034000000001080001400000001414000000110001"], 0xdc}}, 0x0) sendmsg$nl_xfrm(r6, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000e00)=@newsa={0x138, 0x10, 0x1, 0x0, 0x0, {{@in=@local, @in=@dev={0xac, 0x14, 0x14, 0x16}, 0x4e23, 0x0, 0x3, 0x3}, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x33}, @in=@local, {0x0, 0x0, 0x0, 0x402, 0x0, 0x0, 0x4}, {0x0, 0x0, 0x4}, {0x0, 0x200, 0x5}, 0x0, 0xfffffffe, 0xa, 0x1}, [@algo_auth={0x48, 0x1, {{'sha256\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) 3.190101092s ago: executing program 4 (id=2326): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="12010000000000404c05f20dafd60000000109022400010000000009040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="000657"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000200)={0x84, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.025447448s ago: executing program 9 (id=2327): syz_usb_connect$printer(0x1f, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c40000000000109022472510000000009040000120701030009050102000000000009058202"], 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$dsp(r1, &(0x7f00000002c0)=""/4096, 0x1000) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x2007fff, 0x1, 0x3, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0xffc, 0x9, 0x702, 0x3, 0x1, 0xfffffffa, 0xb, 0xa, 0x9, 0x4, 0x7, 0x10001, 0x100000, 0x762, 0x1, 0xd, 0xe, 0x2b12, 0x80100, 0x6, 0x1c00, 0xb, 0x7, 0x9, 0x8, 0x8000100, 0x3, 0x0, 0x10fdf, 0x9, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd3, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0xd, 0x8b, 0x5, 0x2b3, 0x8, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x5, 0x27f, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x800084, 0x100, 0x5, 0x2, 0x6, 0xb, 0x5, 0x20006, 0x5, 0x15, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8000, 0x1, 0x9fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 2.231613782s ago: executing program 1 (id=2328): r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000080)) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000000100)={0x4c, 0x0, &(0x7f00000001c0)=[@increfs_done={0x40106308, 0x3}], 0xfffffebb, 0x0, 0x0}) 2.126671515s ago: executing program 3 (id=2330): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x7fffe, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0x1, 0xb}, {0x4, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0xb}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048800}, 0x400c000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 2.068424787s ago: executing program 1 (id=2331): r0 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_HOPOPTS(r0, 0x29, 0x36, &(0x7f0000000180)=ANY=[], 0x8) connect$inet6(r0, &(0x7f00000004c0)={0xa, 0x0, 0x4, @mcast2, 0x7}, 0x1c) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, &(0x7f0000000080)='bridge0\x00', 0x10) sendto$inet6(r0, &(0x7f00000000c0)="cfc850defd27f31e", 0x8, 0x3b00, 0x0, 0x0) 1.927967331s ago: executing program 1 (id=2332): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f00000003c0)={0x2c, &(0x7f0000000080)={0x0, 0xe, 0x2d, {0x2d, 0x6, "de1d16a78e0af0bf6c7251704149ab9df53ae5bbed9e3f870815014b02e8fd03a1107239cbde838a1bd8e7"}}, 0x0, 0x0, 0x0, &(0x7f0000000380)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x47, 0x4, 0x3, 0x7f, 0xed, 0x55a, 0x54}}}, 0x0) 1.862868683s ago: executing program 9 (id=2333): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff}) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x101100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_REGISTER_COALESCED_MMIO(r2, 0x4010ae67, &(0x7f0000000180)={0x0, 0xd000}) close_range(r0, 0xffffffffffffffff, 0x0) 1.753542476s ago: executing program 3 (id=2334): syz_open_procfs$namespace(0x0, 0x0) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) socket$kcm(0x29, 0x5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$MSR(0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r0, 0x60}], 0x1, 0x0, 0x0, 0x0) 1.719964928s ago: executing program 9 (id=2335): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{0x0, 0x0, 0x5, 0xffffffff}], 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b9b0d9307", 0xe7}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2a91564fc364f1b971b0e005fe1d24f1b0d7f157b695c625cc39aac2d6f07b11d926c", 0xb7}, {&(0x7f0000000ac0)="3fe4c8a328", 0x5}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233", 0x19}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e68a60", 0xb0}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c466f76d6ff3618471f4f6574e1043766375eb889750ca25429f976089462bf1b689280ebc67640f4534eef4b7ffd85963bc5d8b114670c00f76cbdd722662dce5fc58daf323bf987ef7d646a99794c02b62b30e189691c4be9094ea58e9df52d9dbd9e0fae7a4a130246680b2", 0xd2}], 0x5, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 1.100018336s ago: executing program 9 (id=2336): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x66, &(0x7f0000000100)=0xc6, 0x4) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) io_uring_setup(0x4dc2, 0x0) chdir(0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x4000, 0x3, &(0x7f0000005000/0x4000)=nil) mremap(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4000, 0x0, &(0x7f0000001000/0x4000)=nil) 917.325973ms ago: executing program 5 (id=2337): socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x400000000010, 0x3, 0x0) syz_open_dev$vim2m(&(0x7f00000001c0), 0x7fff, 0x2) socket$pptp(0x18, 0x1, 0x2) syz_open_dev$video(&(0x7f0000000000), 0x8, 0x80) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000001480)) openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) openat$cuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000180), 0x2982, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = syz_open_dev$dri(&(0x7f0000000440), 0x1, 0x48240) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000040)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_ATOMIC(r0, 0xc03864bc, &(0x7f0000000180)={0x1, 0x1, &(0x7f00000000c0)=[r1], &(0x7f0000000180), &(0x7f0000000200), &(0x7f00000001c0)=[0x7ffffbff], 0x0, 0x4}) 815.683286ms ago: executing program 3 (id=2338): setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) r0 = socket$packet(0x11, 0x2, 0x300) getsockopt$packet_int(r0, 0x107, 0xb, &(0x7f0000000040), &(0x7f0000000200)=0x4) 768.148007ms ago: executing program 9 (id=2339): syz_open_dev$vim2m(0x0, 0x4003, 0x2) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x1011f, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) listen(r1, 0xa1) 659.94681ms ago: executing program 5 (id=2340): kexec_load(0x3, 0x1, &(0x7f00000005c0)=[{&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c8f68476969bf8c4bcd37ba24e4ba1683339879a11b854a7478f898805f327af12eaab8ac918c201b7f932e124796", 0x85, 0x5, 0xffffffff}], 0x0) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000700)=[{0x0}, {&(0x7f0000000740)}], 0x2}, 0x41) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000540), 0x82, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000280), 0x80, 0x0) sendmmsg$alg(r2, &(0x7f0000007640)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000740)="bd9c629b909dddebc0508bf412865663aded7919352b141faa7dc00680ce5a44ff1ed1c813c6c1e58e28c509cd269d0e79fff4d2ea4c1da69fa672c4f5eb15788aa929e9f5c94e443cf68a1759ee805958a7c76c8c7f11a39ea32c019c2f2c8cce48d92d659f623081974c0135dc1fe2a057f725a843c083e0620ffa607d3b9570a5b4094fca255491844b3d5cb63bab3d76ad07f9503d1450f1fb860b18ac983285f983e51262c539312073482f1538d9588323b836e6e2b7704dff3cbf89c2b828c7613310eafd664c946b1a6728154b1877257a8abe3d983344da083b86aee35e6b9b0d9307", 0xe7}], 0x1, &(0x7f00000008c0)=[@iv={0x68, 0x117, 0x2, 0x50, "bd19a432ebf20eb0a0ee39d005e869fe74b9842d9c92be0054aa20f9dbfeb8e59fa49c486a1a51c45c98c886185e506d1cf93255718fc79d6b6d1d434c678807c5ab4264c8ba94065d11d8ee27dd16f4"}, @assoc={0x18, 0x117, 0x4, 0x6}], 0x80, 0x40800}, {0x0, 0x0, &(0x7f0000003900)=[{&(0x7f00000009c0)="c2debd9e2d4617d17e01e704d3576f8b26b757ffa164a105efcaa28e5d52d4383258c148e95e4ee927dab4ba9cdbf4dbf6b0e19f8b7e9a95211ec6aedfd78a09200b7076afabdae9c87c6837e202845b6cf3ac6b728856d66eef286087e0154a40c153e5fe7505615fb53b33f629928c80aeea7fd091180968d44cd4544b6bb4c116f4d6c4c3d148eb273bd4fa76ad8f709ed07bd2a91564fc364f1b971b0e005fe1d24f1b0d7f157b695c625cc39aac2d6f07b11d926c", 0xb7}, {&(0x7f0000000ac0)="3fe4c8a328", 0x5}, {&(0x7f0000000b40)="86545d2157646172b815818bfd0e1457556266898579380233e0e3853e4a118a5a2bcc52eeea6b2dc4fc", 0x2a}, {&(0x7f0000000b80)="0d4842ef613cd072196eae2d74d31c309df1c61a888039b1a23acbea852fb54afae1761845284c6e484aa5154a2b418ffe2ac1d6363010c9d8f2d75a71eb55849202714884c6a0a760f5e028016a68fc07407f5671a5a4a8c91e9d056039df63390376a7359c6fc2059d1e3ffeec1ff0f4c09099e8e61c268324d0fc621f6dc2912e4bd5316ff808ac5126ade9b759e1489c04a517e992d7b56d9df469c0c906000e0f82c089ec12677e7ade15e68a60", 0xb0}, {&(0x7f0000000c40)="176d6b3905505e2a41391bf6fd66d8ad4ebc86e07694005204b0151bfa8dc581a5be209d8850a950791f10f76de79651272a11f6d7267276ff1596a47826a90a0b74b425d8ff2bbea5c5732f69a908c45b4b348abc24d2cd2031a9508ef8e3594bd12ebc38c4", 0x66}, {&(0x7f0000000d40)="7edb39aa76e39c9fc185dd49e1d028ba5e90ec3bb54d3c486f189f406945a495fe7b4ad51446c162f581368e4d711db9add53f7917e1dc55ae", 0x39}], 0x6, 0x0, 0x0, 0xc0}], 0x2, 0x48040) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3", 0x5) r4 = accept4(r3, 0x0, 0x0, 0x800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) 659.7303ms ago: executing program 3 (id=2341): openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) ioctl$KVM_SET_DEBUGREGS(0xffffffffffffffff, 0x4080aea2, &(0x7f0000000080)={[0xeeee0000, 0xeeef0000, 0xdddd0000, 0xb000], 0x2000000db, 0xc}) ioctl$KVM_SET_PIT(0xffffffffffffffff, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0x4000, 0x4, 0x5, 0x0, 0x8, 0x3, 0xa, 0x7e, 0x4, 0x11, 0x5, 0x80204}, {0x804, 0x1, 0x1, 0x45, 0x7, 0x6, 0x4, 0xff, 0x6, 0xfe, 0x6, 0x7f, 0x20c}, {0x1, 0x3, 0x38, 0x5, 0x84, 0x7, 0x14, 0x50, 0x0, 0x70, 0x4, 0x5}], 0xffbfffff}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)={0x1, 0x0, [{0xf88e470f, 0xed}]}) openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x20000, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000140)={0x3, 0x6}, 0x4) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x2, 0x2, 0x0, 0x4002004c4, 0x1004, 0x8000000000000000, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0xb3, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 640.234861ms ago: executing program 5 (id=2342): r0 = syz_usb_connect(0x0, 0x1cb, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000122f0d4071040403dfe4000000010902"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000200)={0x0, 0x22, 0xf, {[@global, @local=@item_4={0x3, 0x2, 0x0, "45501821"}, @global=@item_012={0x1, 0x1, 0x9, "f5"}, @global=@item_012={0x1, 0x1, 0x7, "84"}, @main=@item_4={0x3, 0x0, 0xb, "4070f43f"}]}}, 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGREPORT(r2, 0x400c4807, &(0x7f0000000040)={0x3, 0x100, 0x7}) syz_usb_control_io$lan78xx(r0, 0x0, &(0x7f0000000a40)={0x34, &(0x7f0000000a80)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) 607.392042ms ago: executing program 3 (id=2343): syz_usb_connect$printer(0x1f, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000000030020f003176c40000000000109022472510000000009040000120701030009050102000000000009058202"], 0x0) r0 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r0, 0xc004500a, &(0x7f0000001340)) ioctl$SNDCTL_DSP_CHANNELS(r0, 0xc0045006, &(0x7f0000000180)=0x6f) r1 = openat$dsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) read$dsp(r1, &(0x7f00000002c0)=""/4096, 0x1000) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000500)={'veth1\x00', &(0x7f0000000200)=@ethtool_per_queue_op={0x4b, 0xf, [0xa, 0x1, 0x2007fff, 0x1, 0x3, 0x9, 0xa4, 0xffb, 0x7, 0xb69, 0xc1, 0x4, 0x1, 0x3, 0x5, 0x101, 0xffc, 0x9, 0x702, 0x3, 0x1, 0xfffffffa, 0xb, 0xa, 0x9, 0x4, 0x7, 0x10001, 0x100000, 0x762, 0x1, 0xd, 0xe, 0x2b12, 0x80100, 0x6, 0x1c00, 0xb, 0x7, 0x9, 0x8, 0x8000100, 0x3, 0x0, 0x10fdf, 0x9, 0x5, 0x79b, 0x2, 0x1, 0x7f, 0x4, 0xa, 0x7, 0xf, 0x101, 0xd3, 0x1fa0860a, 0x7, 0xaa, 0x81, 0x2, 0x180000, 0xd, 0x8b, 0x5, 0x2b3, 0x8, 0x5, 0x2, 0x6, 0x9, 0x4, 0x7, 0x4009, 0x0, 0x4, 0x100002, 0x5, 0x27f, 0x0, 0x3, 0x0, 0x10001, 0x2, 0xffffffff, 0x6, 0x6, 0x9, 0x80000000, 0xfdffffff, 0x2, 0x2, 0x800084, 0x100, 0x5, 0x2, 0x6, 0xb, 0x5, 0x20006, 0x5, 0x15, 0xb, 0x2, 0xd9a, 0xd, 0x2a2, 0xfffffffd, 0x3, 0x2, 0x5, 0x8, 0x0, 0x4, 0x2, 0x40, 0x8, 0x4, 0x4, 0x401, 0x66cd, 0x8, 0x8000, 0x1, 0x9fc, 0xc5c, 0xffffffff]}}) poll(&(0x7f0000000000), 0x20000000000000b5, 0x9) 351.96873ms ago: executing program 4 (id=2344): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000280), 0x1, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000680)=@newqdisc={0x58, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x3, 0x6, 0x7, 0x200, 0x4, 0x8, 0x8ed, 0x10, 0x1}}}}]}, 0x58}, 0x1, 0x0, 0x0, 0x40088c1}, 0x8810) ioctl$SIOCSIFHWADDR(r1, 0x8914, 0x0) r4 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'syzkaller0\x00', 0x0}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd27, 0x7fffe, {0x0, 0x0, 0x0, r5, {0x0, 0xf}, {0x1, 0xb}, {0x4, 0x1}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_AUTORATE={0x8, 0x9, 0xb}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4048800}, 0x400c000) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$tipc(&(0x7f0000000380), r7) sendmsg$TIPC_CMD_ENABLE_BEARER(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000d0000000000010000000000000001410000001c001700000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x44081}, 0x0) 233.169534ms ago: executing program 4 (id=2345): r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r0, 0x10e, 0x4, 0x0, 0x0) 199.625064ms ago: executing program 9 (id=2346): syz_open_dev$swradio(&(0x7f0000000080), 0x0, 0x2) pipe2(&(0x7f0000000000)={0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x200000000000008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) symlinkat(&(0x7f0000000180)='.\x00', 0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x1) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f00000003c0)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file7\x00', 0x1ac) 47.801069ms ago: executing program 3 (id=2347): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a0000904000001030101000921000800012201000905", @ANYRES64], 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, &(0x7f00000002c0)=ANY=[@ANYBLOB="00000c000000070001"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f0000000180)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000280)=ANY=[@ANYBLOB=' '], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000740)={0x2c, &(0x7f00000004c0)={0x0, 0x11, 0x4, "c88b8cfe"}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000080)={0x84, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)={0x20, 0x0, 0x4, {0x1e0, 0x4}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 0s ago: executing program 4 (id=2348): syz_open_procfs$namespace(0x0, 0x0) add_key$user(&(0x7f0000000200), &(0x7f00000005c0), 0x0, 0x0, 0xfffffffffffffffd) socket$kcm(0x29, 0x5, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) syz_open_dev$MSR(0x0, 0x0, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) listen(r0, 0x90004) syz_emit_vhci(&(0x7f0000000140)=ANY=[@ANYBLOB="043e130100c90001"], 0x16) ppoll(&(0x7f00000000c0)=[{r0, 0x60}], 0x1, 0x0, 0x0, 0x0) kernel console output (not intermixed with test programs): idge0: port 3(veth1) entered blocking state [ 671.752223][T10161] bridge0: port 3(veth1) entered forwarding state [ 672.795563][ T26] audit: type=1326 audit(1782262784.798:100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10179 comm="syz.1.1211" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 673.496551][ T26] audit: type=1326 audit(1782262784.828:101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10179 comm="syz.1.1211" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 673.608822][ T26] audit: type=1326 audit(1782262784.828:102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10179 comm="syz.1.1211" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 673.634038][ T26] audit: type=1326 audit(1782262784.828:103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10179 comm="syz.1.1211" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=248 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 673.665267][ T26] audit: type=1326 audit(1782262784.828:104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10179 comm="syz.1.1211" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 673.716714][T10188] netlink: 'syz.0.1212': attribute type 10 has an invalid length. [ 673.761929][ T26] audit: type=1326 audit(1782262784.828:105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10179 comm="syz.1.1211" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 674.131455][ T26] audit: type=1326 audit(1782262784.828:106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10179 comm="syz.1.1211" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=231 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 674.382114][T10190] loop5: detected capacity change from 0 to 2048 [ 674.466028][T10190] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 674.532681][ T26] audit: type=1800 audit(1782262786.538:107): pid=10190 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.5.1214" name="file1" dev="loop5" ino=1369 res=0 errno=0 [ 676.086644][ T23] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 676.376574][ T23] usb 6-1: Using ep0 maxpacket: 8 [ 676.696779][ T23] usb 6-1: New USB device found, idVendor=0b48, idProduct=3007, bcdDevice=4f.64 [ 676.712625][ T23] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 676.824838][ T23] usb 6-1: Product: syz [ 676.861815][ T23] usb 6-1: Manufacturer: syz [ 676.872742][ T23] usb 6-1: SerialNumber: syz [ 676.917458][ T23] usb 6-1: config 0 descriptor?? [ 676.958695][ T23] dvb-usb: found a 'Technotrend TT Connect S2-3600' in warm state. [ 677.010675][ T23] pctv452e: pctv452e_power_ctrl: 1 [ 677.010675][ T23] [ 677.050107][ T23] usb 6-1: selecting invalid altsetting 3 [ 677.065483][ T23] pctv452e: pctv452e_power_ctrl: Warning set interface returned: -22 [ 677.065483][ T23] [ 677.086565][ T23] dvb-usb: bulk message failed: -22 (5/0) [ 677.122167][ T23] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 677.161458][T10217] dvb-usb: bulk message failed: -22 (7/0) [ 677.184981][ T23] dvbdev: DVB: registering new adapter (Technotrend TT Connect S2-3600) [ 677.234558][T10217] pctv452e: I2C error -22; AA 01 00 00 00 -> aa 01 31 03 00 00 00 [ 677.292421][ T23] usb 6-1: media controller created [ 677.301256][ T23] dvb-usb: bulk message failed: -22 (8/0) [ 677.576756][ T4235] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 678.049304][ T4235] usb 1-1: config index 0 descriptor too short (expected 45, got 36) [ 678.069351][ T4235] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 678.093541][ T4235] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 678.110099][ T4235] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 678.126555][ T23] pctv452e: I2C error -22; AA 02 A0 01 14 -> aa 02 31 04 a0 01 14 [ 678.135366][ T23] dvb-usb: MAC address reading failed. [ 678.173375][ T23] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 678.176532][ T4235] usb 1-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 678.372718][ T4235] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 678.405113][ T4235] usb 1-1: config 0 descriptor?? [ 679.213732][T10259] loop2: detected capacity change from 0 to 2048 [ 679.291595][ T23] DVB: Unable to find symbol stb0899_attach() [ 679.298269][ T23] dvb-usb: no frontend was attached by 'Technotrend TT Connect S2-3600' [ 679.402056][ T4235] plantronics 0003:047F:FFFF.0004: unknown main item tag 0xd [ 679.418241][ T4235] plantronics 0003:047F:FFFF.0004: No inputs registered, leaving [ 679.447984][T10259] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 679.491179][ T4235] plantronics 0003:047F:FFFF.0004: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.0-1/input0 [ 679.529391][T10268] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1231'. [ 680.150321][ T26] audit: type=1800 audit(1782262792.158:108): pid=10259 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.2.1230" name="file1" dev="loop2" ino=1369 res=0 errno=0 [ 680.250200][ T4235] usb 1-1: USB disconnect, device number 6 [ 680.346786][ T23] rc_core: IR keymap rc-tt-1500 not found [ 680.352747][ T23] Registered IR keymap rc-empty [ 680.387783][ T23] rc rc0: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 680.434160][ T23] input: Technotrend TT Connect S2-3600 as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input8 [ 680.609848][T10273] fido_id[10273]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 680.750720][ T23] dvb-usb: schedule remote query interval to 100 msecs. [ 681.309309][ T23] pctv452e: pctv452e_power_ctrl: 0 [ 681.309309][ T23] [ 681.317148][ T23] dvb-usb: Technotrend TT Connect S2-3600 successfully initialized and connected. [ 681.378061][ T23] usb 6-1: USB disconnect, device number 11 [ 681.981939][ T4206] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci8/hci8:201' [ 681.991800][ T4206] CPU: 0 PID: 4206 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 681.999433][ T4206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 682.009509][ T4206] Workqueue: hci8 hci_rx_work [ 682.014227][ T4206] Call Trace: [ 682.017514][ T4206] [ 682.020530][ T4206] dump_stack_lvl+0x188/0x250 [ 682.025213][ T4206] ? show_regs_print_info+0x20/0x20 [ 682.030421][ T4206] ? load_image+0x400/0x400 [ 682.035107][ T4206] sysfs_create_dir_ns+0x26a/0x290 [ 682.040270][ T4206] ? sysfs_warn_dup+0xa0/0xa0 [ 682.044978][ T4206] ? process_one_work+0x85f/0x1010 [ 682.050313][ T4206] ? do_raw_spin_unlock+0x11d/0x230 [ 682.055591][ T4206] kobject_add_internal+0x6e0/0xd90 [ 682.060819][ T4206] kobject_add+0x160/0x230 [ 682.065263][ T4206] ? kobject_init+0x1d0/0x1d0 [ 682.069955][ T4206] ? klist_children_get+0x50/0x50 [ 682.074989][ T4206] ? get_device_parent+0x121/0x3f0 [ 682.080116][ T4206] device_add+0x48c/0x1000 [ 682.084793][ T4206] hci_conn_add_sysfs+0xd1/0x1e0 [ 682.090101][ T4206] le_conn_complete_evt+0xc4b/0x15c0 [ 682.095652][ T4206] ? cs_le_create_conn+0x5e0/0x5e0 [ 682.100790][ T4206] ? __mutex_trylock_common+0x155/0x260 [ 682.106490][ T4206] hci_le_meta_evt+0x285/0x3cb0 [ 682.111389][ T4206] ? hci_event_packet+0x37e/0x1370 [ 682.116621][ T4206] ? __lock_acquire+0x7d10/0x7d10 [ 682.121660][ T4206] ? release_firmware_map_entry+0x190/0x190 [ 682.127569][ T4206] ? hci_remote_host_features_evt+0x290/0x290 [ 682.133667][ T4206] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 682.139311][ T4206] ? mark_lock+0x94/0x320 [ 682.143644][ T4206] ? mutex_unlock+0x10/0x10 [ 682.148323][ T4206] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 682.154389][ T4206] ? lock_chain_count+0x20/0x20 [ 682.159250][ T4206] ? __rwlock_init+0x140/0x140 [ 682.164009][ T4206] hci_event_packet+0xe4b/0x1370 [ 682.168978][ T4206] ? lockdep_hardirqs_on+0x94/0x140 [ 682.174200][ T4206] ? rcu_lock_release+0x20/0x20 [ 682.179047][ T4206] ? lock_acquire+0x208/0x400 [ 682.183737][ T4206] ? hci_send_to_monitor+0x9c/0x4a0 [ 682.188950][ T4206] hci_rx_work+0x255/0xa10 [ 682.193388][ T4206] process_one_work+0x85f/0x1010 [ 682.198610][ T4206] ? worker_detach_from_pool+0x240/0x240 [ 682.204272][ T4206] ? lockdep_hardirqs_off+0x70/0x100 [ 682.209607][ T4206] ? _raw_spin_lock_irq+0xb7/0xf0 [ 682.214643][ T4206] ? _raw_spin_lock_irqsave+0x100/0x100 [ 682.220299][ T4206] ? wq_worker_running+0x97/0x170 [ 682.225345][ T4206] worker_thread+0xaa6/0x1290 [ 682.230029][ T4206] ? lockdep_hardirqs_on+0x94/0x140 [ 682.235234][ T4206] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 682.241148][ T4206] kthread+0x436/0x520 [ 682.245322][ T4206] ? rcu_lock_release+0x20/0x20 [ 682.250203][ T4206] ? kthread_blkcg+0xd0/0xd0 [ 682.254792][ T4206] ret_from_fork+0x1f/0x30 [ 682.259212][ T4206] [ 682.264034][ T4206] kobject_add_internal failed for hci8:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 682.277416][ T4206] Bluetooth: hci8: failed to register connection device [ 682.310672][T10301] binder: 10299:10301 ioctl 4018620d 0 returned -22 [ 682.314721][ T23] dvb-usb: Technotrend TT Connect S2-3600 successfully deinitialized and disconnected. [ 682.886660][ T23] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 683.166684][ T23] usb 6-1: Using ep0 maxpacket: 8 [ 683.496721][ T23] usb 6-1: unable to get BOS descriptor or descriptor too short [ 683.714870][ T23] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 685.086846][ T23] usb 6-1: can't read configurations, error -71 [ 686.351903][ T1433] ieee802154 phy0 wpan0: encryption failed: -22 [ 686.358299][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 688.018763][T10370] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1256'. [ 690.099424][ T23] Bluetooth: hci8: command 0x0406 tx timeout [ 693.526732][ T23] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 697.056770][ T23] usb 2-1: device descriptor read/all, error -71 [ 698.275080][T10476] netlink: 'syz.0.1281': attribute type 1 has an invalid length. [ 698.518373][T10476] 8021q: adding VLAN 0 to HW filter on device bond1 [ 698.645777][T10481] bond1: (slave geneve2): making interface the new active one [ 698.892258][T10481] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 699.507042][T10481] syz.0.1281 (10481) used greatest stack depth: 19216 bytes left [ 699.558500][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 699.664333][T10494] IPv6: ADDRCONF(NETDEV_CHANGE): vcan0: link becomes ready [ 699.714176][T10494] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 699.722010][T10494] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 699.734748][T10494] A link change request failed with some changes committed already. Interface bridge_slave_0 may have been left with an inconsistent configuration, please check. [ 704.359007][ T26] audit: type=1326 audit(1782262816.348:109): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10531 comm="syz.2.1294" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faec8b07e59 code=0x0 [ 704.392976][T10543] loop0: detected capacity change from 0 to 512 [ 704.582941][T10543] EXT4-fs (loop0): Ignoring removed nomblk_io_submit option [ 704.788849][T10543] EXT4-fs (loop0): mounting ext3 file system using the ext4 subsystem [ 704.899518][T10543] EXT4-fs (loop0): 1 truncate cleaned up [ 704.927093][T10543] EXT4-fs (loop0): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 709.540444][T10569] netlink: 'syz.2.1301': attribute type 1 has an invalid length. [ 709.601291][T10569] 8021q: adding VLAN 0 to HW filter on device bond1 [ 709.663089][T10574] bond1: (slave geneve2): making interface the new active one [ 709.691678][T10574] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 709.708926][ T4876] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 709.846607][ T23] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 710.326683][ T23] usb 2-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 710.458061][ T23] usb 2-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 710.469747][ T23] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 710.480699][ T23] usb 2-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 710.897008][ T23] usb 2-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 710.969483][ T23] usb 2-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 711.089283][ T23] usb 2-1: Product: syz [ 711.093799][ T23] usb 2-1: Manufacturer: syz [ 711.157116][T10579] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 711.187705][ T23] cdc_wdm 2-1:1.0: skipping garbage [ 711.193102][ T23] cdc_wdm 2-1:1.0: skipping garbage [ 711.199384][ T23] cdc_wdm: probe of 2-1:1.0 failed with error -22 [ 711.407442][ T1111] usb 2-1: USB disconnect, device number 4 [ 711.660600][T10636] device syzkaller1 entered promiscuous mode [ 711.834533][T10644] futex_wake_op: syz.9.1325 tries to shift op by 144; fix this program [ 716.196481][ T13] usb 10-1: new full-speed USB device number 15 using dummy_hcd [ 716.349429][T10686] device syzkaller0 entered promiscuous mode [ 716.435886][ T26] audit: type=1326 audit(1782262828.438:110): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=10681 comm="syz.2.1338" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7faec8b07e59 code=0x0 [ 718.486629][ T13] usb 10-1: unable to get BOS descriptor or descriptor too short [ 719.696526][T10725] futex_wake_op: syz.2.1346 tries to shift op by 144; fix this program [ 721.245350][ T13] usb 10-1: unable to read config index 0 descriptor/start: -71 [ 721.262069][ T13] usb 10-1: can't read configurations, error -71 [ 723.711910][T10788] tipc: Enabling of bearer rejected, failed to enable media [ 728.128425][ T4700] usb 3-1: new high-speed USB device number 13 using dummy_hcd [ 729.477626][ T4700] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 729.488545][ T4700] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 729.596602][ T4700] usb 3-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 729.605741][ T4700] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 729.826450][ T4700] usb 3-1: SerialNumber: syz [ 731.138197][ T4700] usb 3-1: 0:2 : does not exist [ 731.167645][ T4700] usb 3-1: USB disconnect, device number 13 [ 732.178016][ T5699] udevd[5699]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 733.259976][T10915] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(5) [ 733.266739][T10915] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 733.358801][T10915] vhci_hcd vhci_hcd.0: Device attached [ 733.497013][T10916] vhci_hcd: connection closed [ 733.497395][ T4876] vhci_hcd: stop threads [ 733.559729][ T4876] vhci_hcd: release socket [ 733.596593][ T4876] vhci_hcd: disconnect device [ 733.626522][ T9073] usb 37-1: new low-speed USB device number 6 using vhci_hcd [ 735.801495][ T13] usb 3-1: new high-speed USB device number 14 using dummy_hcd [ 739.449293][ T13] usb 3-1: Using ep0 maxpacket: 16 [ 739.471835][T10965] loop2: detected capacity change from 0 to 7 [ 739.690595][T10965] Dev loop2: unable to read RDB block 7 [ 739.962537][ T9073] vhci_hcd: vhci_device speed not set [ 740.022435][T10965] loop2: unable to read partition table [ 740.124630][T10965] loop2: partition table beyond EOD, truncated [ 740.126603][ T13] usb 3-1: config 6 has an invalid interface number: 221 but max is 0 [ 740.155172][ T13] usb 3-1: config 6 has no interface number 0 [ 740.164185][ T13] usb 3-1: config 6 interface 221 has no altsetting 0 [ 740.176608][T10965] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 740.366646][ T13] usb 3-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=12.92 [ 740.409702][ T13] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 740.464196][ T13] usb 3-1: Product: syz [ 740.476237][T10976] lo speed is unknown, defaulting to 1000 [ 740.489846][ T13] usb 3-1: Manufacturer: syz [ 740.499577][ T13] usb 3-1: SerialNumber: syz [ 740.570083][ T13] usb 3-1: can't set config #6, error -71 [ 740.610693][ T13] usb 3-1: USB disconnect, device number 14 [ 740.678062][T10980] loop2: detected capacity change from 0 to 512 [ 740.796796][T10980] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 740.850628][T10976] chnl_net:caif_netlink_parms(): no params data found [ 740.888352][T10980] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 741.190883][T10980] EXT4-fs (loop2): 1 truncate cleaned up [ 741.326634][T10980] EXT4-fs (loop2): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 742.117990][T10976] bridge0: port 1(bridge_slave_0) entered blocking state [ 742.323109][T10976] bridge0: port 1(bridge_slave_0) entered disabled state [ 743.215113][ T9073] Bluetooth: hci3: command 0x0409 tx timeout [ 743.236332][T10976] device bridge_slave_0 entered promiscuous mode [ 743.247402][T10976] bridge0: port 2(bridge_slave_1) entered blocking state [ 743.263399][T10976] bridge0: port 2(bridge_slave_1) entered disabled state [ 743.271706][T10976] device bridge_slave_1 entered promiscuous mode [ 743.306187][T10976] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 743.368136][T10976] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 743.440409][T10976] team0: Port device team_slave_0 added [ 743.486062][T10976] team0: Port device team_slave_1 added [ 743.706197][T10976] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 743.731577][T10976] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 743.836795][T10976] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 743.888452][T10976] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 743.916045][T10976] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 744.016744][T10976] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 744.114135][T10976] device hsr_slave_0 entered promiscuous mode [ 744.143695][T10976] device hsr_slave_1 entered promiscuous mode [ 744.172156][T10976] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 744.210359][T10976] Cannot create hsr debugfs directory [ 745.306933][ T4700] Bluetooth: hci3: command 0x041b tx timeout [ 746.370720][T11070] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 747.275397][T11090] futex_wake_op: syz.5.1423 tries to shift op by 144; fix this program [ 747.436116][ T4700] Bluetooth: hci3: command 0x040f tx timeout [ 747.480455][T10976] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 747.520680][T10976] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 747.562985][T10976] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 747.597806][T10976] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 747.675776][T11096] netlink: 16178 bytes leftover after parsing attributes in process `syz.1.1425'. [ 747.714021][T10976] 8021q: adding VLAN 0 to HW filter on device bond0 [ 747.763197][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 747.780683][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 747.792083][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 747.813429][T10976] 8021q: adding VLAN 0 to HW filter on device team0 [ 747.851094][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 747.873317][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 747.929431][ T4348] bridge0: port 1(bridge_slave_0) entered blocking state [ 747.936625][ T4348] bridge0: port 1(bridge_slave_0) entered forwarding state [ 748.016891][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 748.064372][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 748.104092][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 748.137285][ T4348] bridge0: port 2(bridge_slave_1) entered blocking state [ 748.144419][ T4348] bridge0: port 2(bridge_slave_1) entered forwarding state [ 748.192734][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 748.221295][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 748.260825][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 748.299701][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 748.341368][T10976] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 748.389943][T10976] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 748.456327][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 748.513752][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 748.545290][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 748.602213][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 748.649176][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 748.682909][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 748.711775][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 748.754625][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 748.910567][T11114] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 749.946647][ T4451] Bluetooth: hci3: command 0x0419 tx timeout [ 750.611956][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 750.644822][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 752.861068][T10976] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 752.881727][T11168] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 753.028034][ T4876] netdevsim netdevsim0 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.115267][ T1324] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 753.125043][ T1324] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 753.175456][ T4876] netdevsim netdevsim0 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.226277][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 753.236033][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 753.248254][T10976] device veth0_vlan entered promiscuous mode [ 753.257069][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 753.265087][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 753.285128][ T4876] netdevsim netdevsim0 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.351103][T11186] futex_wake_op: syz.5.1445 tries to shift op by 144; fix this program [ 753.359778][ T4451] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 753.375997][T10976] device veth1_vlan entered promiscuous mode [ 753.413058][ T4876] netdevsim netdevsim0 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 753.486337][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 753.498977][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 753.594608][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 753.619191][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 753.643095][T10976] device veth0_macvtap entered promiscuous mode [ 753.679976][T10976] device veth1_macvtap entered promiscuous mode [ 753.762431][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 753.795889][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 753.806875][ T4451] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 753.845618][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 753.854276][ T4451] usb 10-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 753.881791][ T4451] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 753.892797][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 753.937177][ T4451] usb 10-1: config 0 descriptor?? [ 753.937639][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 753.983207][ T4451] pwc: Askey VC010 type 2 USB webcam detected. [ 754.016598][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.050411][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 754.104891][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.146019][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 754.176437][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.221560][T10976] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 754.299312][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 754.324242][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 754.356841][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 754.373025][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 754.400624][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.423607][ T4451] pwc: recv_control_msg error -32 req 02 val 2b00 [ 754.436555][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.476465][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.487512][ T4451] pwc: recv_control_msg error -32 req 02 val 2700 [ 754.524575][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.536741][ T4451] pwc: recv_control_msg error -32 req 02 val 2c00 [ 754.562611][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.576665][ T4451] pwc: recv_control_msg error -32 req 04 val 1000 [ 754.596918][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.626661][ T4451] pwc: recv_control_msg error -32 req 04 val 1300 [ 754.636613][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.686551][ T4451] pwc: recv_control_msg error -32 req 04 val 1400 [ 754.693227][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.713615][T10976] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 754.736691][ T4451] pwc: recv_control_msg error -32 req 02 val 2000 [ 754.755639][T10976] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 754.777687][ T4451] pwc: recv_control_msg error -32 req 02 val 2100 [ 754.803474][T10976] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 754.836842][ T4451] pwc: recv_control_msg error -32 req 04 val 1500 [ 754.868635][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 754.892826][ T4451] pwc: recv_control_msg error -32 req 02 val 2500 [ 754.897928][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 754.947766][T10976] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 754.975762][T10976] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 755.022707][T10976] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 755.053030][T10976] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 755.085275][ T4451] pwc: recv_control_msg error -32 req 02 val 2400 [ 755.934124][ T4451] pwc: recv_control_msg error -71 req 02 val 2900 [ 755.957667][ T4451] pwc: recv_control_msg error -71 req 02 val 2800 [ 755.986540][ T4451] pwc: recv_control_msg error -71 req 04 val 1100 [ 756.037049][ T4451] pwc: recv_control_msg error -71 req 04 val 1200 [ 756.058728][ T4291] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 756.082426][ T4291] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 756.118704][ T4451] pwc: Registered as video103. [ 756.154091][ T4451] input: PWC snapshot button as /devices/platform/dummy_hcd.9/usb10/10-1/input/input10 [ 756.224491][ T4291] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 756.248154][ T4451] usb 10-1: USB disconnect, device number 17 [ 756.277653][ T5683] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 756.285666][ T5683] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 756.369518][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 759.534696][T11249] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 760.546626][ T9073] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 761.113352][ T9073] usb 2-1: Using ep0 maxpacket: 32 [ 762.776723][ T9073] usb 2-1: config 0 has an invalid interface number: 61 but max is 1 [ 762.788984][ T9073] usb 2-1: config 0 has no interface number 1 [ 762.946701][ T9073] usb 2-1: New USB device found, idVendor=2058, idProduct=1005, bcdDevice=b5.f6 [ 762.973342][ T9073] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 762.989329][ T9073] usb 2-1: Product: syz [ 762.994115][ T9073] usb 2-1: Manufacturer: syz [ 763.003869][ T9073] usb 2-1: SerialNumber: syz [ 763.025938][ T9073] usb 2-1: config 0 descriptor?? [ 763.117647][T11291] futex_wake_op: syz.5.1464 tries to shift op by 144; fix this program [ 763.206636][ T9073] viperboard 2-1:0.61: version 0.00 found at bus 002 address 005 [ 763.327005][ T9073] viperboard-i2c viperboard-i2c.2.auto: failure setting i2c_bus_freq to 100 [ 763.370047][ T9073] viperboard-i2c: probe of viperboard-i2c.2.auto failed with error -5 [ 763.491964][T11296] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 763.516666][ T9073] viperboard 2-1:0.0: version 0.00 found at bus 002 address 005 [ 763.576627][ T9073] viperboard-i2c viperboard-i2c.5.auto: failure setting i2c_bus_freq to 100 [ 763.594186][ T9073] viperboard-i2c: probe of viperboard-i2c.5.auto failed with error -5 [ 763.662950][ T9073] usb 2-1: USB disconnect, device number 5 [ 763.872190][ T4876] device hsr_slave_0 left promiscuous mode [ 763.907208][ T4876] device hsr_slave_1 left promiscuous mode [ 764.005859][ T4876] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 764.043522][ T4876] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 764.537130][ T4876] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 764.871239][ T4876] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 765.092243][ T4876] device bridge_slave_1 left promiscuous mode [ 765.106826][ T4876] bridge0: port 2(bridge_slave_1) entered disabled state [ 765.157141][ T4876] device bridge_slave_0 left promiscuous mode [ 765.164131][ T4876] bridge0: port 1(bridge_slave_0) entered disabled state [ 766.761665][ T4876] device veth1_macvtap left promiscuous mode [ 766.768281][ T4876] device veth0_macvtap left promiscuous mode [ 766.906705][ T4876] bond1 (unregistering): (slave geneve2): Releasing active interface [ 766.921264][ T4876] bond1 (unregistering): Released all slaves [ 767.122896][ T4876] team0 (unregistering): Port device team_slave_1 removed [ 767.164142][ T4876] team0 (unregistering): Port device team_slave_0 removed [ 767.189880][ T4876] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 767.206029][ T4876] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 767.243808][T11356] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 767.352530][ T4876] bond0 (unregistering): Released all slaves [ 767.584762][T11327] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1471'. [ 767.599435][T11327] netlink: 'syz.1.1471': attribute type 7 has an invalid length. [ 767.639176][T11327] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 767.648385][T11327] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 767.657521][T11327] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 767.666487][T11327] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 767.705196][ T9073] lo speed is unknown, defaulting to 1000 [ 767.724119][T11327] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1471'. [ 767.766558][T11327] netlink: 'syz.1.1471': attribute type 7 has an invalid length. [ 768.057429][T11366] binder: 11365:11366 ioctl c0306201 2000000001c0 returned -14 [ 769.120766][T11374] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.129866][T11374] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.138829][T11374] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.147792][T11374] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 769.289705][T11374] netdevsim netdevsim2 netdevsim0: unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.298795][T11374] netdevsim netdevsim2 netdevsim1: unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.307923][T11374] netdevsim netdevsim2 netdevsim2: unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.316863][T11374] netdevsim netdevsim2 netdevsim3: unset [0, 0] type 1 family 0 port 8472 - 0 [ 769.780034][T11395] futex_wake_op: syz.3.1489 tries to shift op by 144; fix this program [ 770.327568][T11411] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 770.342164][T11408] device syzkaller0 entered promiscuous mode [ 770.425909][T11408] tipc: Started in network mode [ 770.446614][T11408] tipc: Node identity aa9b001734d4, cluster identity 4711 [ 770.460402][T11408] tipc: Enabled bearer , priority 0 [ 770.483321][T11407] tipc: Resetting bearer [ 770.547049][T11407] tipc: Disabling bearer [ 771.429789][T11444] netlink: 'syz.5.1504': attribute type 1 has an invalid length. [ 771.539077][T11444] 8021q: adding VLAN 0 to HW filter on device bond1 [ 771.593936][T11450] bond1: (slave geneve2): making interface the new active one [ 771.641000][T11450] bond1: (slave geneve2): Enslaving as an active interface with an up link [ 771.691086][ T1341] IPv6: ADDRCONF(NETDEV_CHANGE): bond1: link becomes ready [ 771.874578][T11450] syz.5.1504 (11450) used greatest stack depth: 17808 bytes left [ 773.957767][T11511] netlink: 16 bytes leftover after parsing attributes in process `syz.9.1520'. [ 774.390510][T11528] futex_wake_op: syz.1.1523 tries to shift op by 144; fix this program [ 775.508954][T11550] device syzkaller0 entered promiscuous mode [ 775.541215][T11550] tipc: Enabled bearer , priority 0 [ 775.601153][T11549] tipc: Resetting bearer [ 775.657276][T11549] tipc: Disabling bearer [ 776.528415][ T21] usb 3-1: new high-speed USB device number 15 using dummy_hcd [ 779.646541][ T21] usb 3-1: device descriptor read/all, error -71 [ 779.895986][T11591] ieee802154 phy1 wpan1: encryption failed: -22 [ 779.910122][T11587] futex_wake_op: syz.9.1537 tries to shift op by 144; fix this program [ 779.974699][T11592] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 780.461063][T11597] device syzkaller0 entered promiscuous mode [ 780.604034][T11597] tipc: Enabled bearer , priority 0 [ 780.740746][T11595] tipc: Resetting bearer [ 780.804186][T11595] tipc: Disabling bearer [ 783.676702][T11635] program syz.9.1551 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 784.021399][T11647] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 784.090781][T11646] loop9: detected capacity change from 0 to 512 [ 784.175321][T11646] EXT4-fs (loop9): Ignoring removed nomblk_io_submit option [ 784.236756][T11646] EXT4-fs (loop9): mounting ext3 file system using the ext4 subsystem [ 784.403763][T11646] EXT4-fs (loop9): 1 truncate cleaned up [ 784.422570][T11646] EXT4-fs (loop9): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 784.634170][T11655] futex_wake_op: syz.5.1555 tries to shift op by 144; fix this program [ 785.600813][T11664] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 785.706476][ T4234] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 786.046702][ T4234] usb 2-1: Using ep0 maxpacket: 8 [ 786.166737][ T4234] usb 2-1: config index 0 descriptor too short (expected 301, got 45) [ 786.175457][ T4234] usb 2-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 786.252773][ T4234] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 786.292159][ T4234] usb 2-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 786.332537][ T4234] usb 2-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 786.392191][ T4234] usb 2-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 786.424789][ T4234] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 786.539182][T11698] tipc: Enabling of bearer rejected, failed to enable media [ 786.726786][ T4234] usb 2-1: GET_CAPABILITIES returned 0 [ 786.732346][ T4234] usbtmc 2-1:16.0: can't read capabilities [ 786.936330][T11706] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 787.029614][ T4234] usb 2-1: USB disconnect, device number 6 [ 787.381043][T11716] loop3: detected capacity change from 0 to 512 [ 787.988216][T11723] futex_wake_op: syz.2.1571 tries to shift op by 144; fix this program [ 788.578275][T11716] EXT4-fs (loop3): Ignoring removed nomblk_io_submit option [ 788.694279][T11716] EXT4-fs (loop3): mounting ext3 file system using the ext4 subsystem [ 789.026837][T11716] EXT4-fs (loop3): 1 truncate cleaned up [ 789.062699][T11716] EXT4-fs (loop3): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 789.160540][ T4451] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 789.756633][ T4451] usb 3-1: Using ep0 maxpacket: 16 [ 790.276895][ T4451] usb 3-1: config 0 interface 0 altsetting 0 has an invalid endpoint with address 0xF3, skipping [ 790.379757][T11762] tipc: Enabled bearer , priority 0 [ 790.493087][ T4451] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 790.531693][ T4451] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 790.563464][T11764] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 790.611854][ T4451] usb 3-1: Product: syz [ 790.652119][ T4451] usb 3-1: Manufacturer: syz [ 790.723299][ T4451] usb 3-1: SerialNumber: syz [ 790.747831][ T4451] usb 3-1: config 0 descriptor?? [ 790.792395][T11761] tipc: Disabling bearer [ 793.761153][ T4451] usb 3-1: USB disconnect, device number 17 [ 794.070833][T11822] tipc: Enabling of bearer rejected, failed to enable media [ 794.102502][T11809] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 795.083764][T11832] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 795.183252][T11838] loop9: detected capacity change from 0 to 512 [ 796.059918][T11838] EXT4-fs (loop9): Ignoring removed nomblk_io_submit option [ 796.153949][T11838] EXT4-fs (loop9): mounting ext3 file system using the ext4 subsystem [ 796.245270][T11838] EXT4-fs (loop9): 1 truncate cleaned up [ 796.296495][T11838] EXT4-fs (loop9): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 796.320216][T11854] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 796.775213][T11868] tipc: Enabling of bearer rejected, failed to enable media [ 797.327626][T11883] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 797.892519][T11907] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 797.980988][T11913] device syzkaller0 entered promiscuous mode [ 798.031811][T11913] tipc: Started in network mode [ 798.064296][T11913] tipc: Node identity b2aacecfe2de, cluster identity 4711 [ 798.107499][T11913] tipc: Enabled bearer , priority 0 [ 798.158112][T11911] tipc: Resetting bearer [ 798.223256][T11911] tipc: Disabling bearer [ 798.797293][T11938] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 800.623775][T11978] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 801.157946][T11997] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 801.332439][ T1324] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.482989][ T1324] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.707889][ T1324] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 801.944599][ T1324] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 803.293867][T12031] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 803.546328][T12009] chnl_net:caif_netlink_parms(): no params data found [ 803.689260][T12042] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1653'. [ 803.974555][T12009] bridge0: port 1(bridge_slave_0) entered blocking state [ 803.997222][T12009] bridge0: port 1(bridge_slave_0) entered disabled state [ 804.020167][T12009] device bridge_slave_0 entered promiscuous mode [ 804.027531][ T4451] Bluetooth: hci0: command 0x0409 tx timeout [ 804.069174][T12009] bridge0: port 2(bridge_slave_1) entered blocking state [ 804.078528][T12009] bridge0: port 2(bridge_slave_1) entered disabled state [ 804.089433][T12009] device bridge_slave_1 entered promiscuous mode [ 804.195059][T12009] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 804.313338][T12009] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 804.454066][T12009] team0: Port device team_slave_0 added [ 804.468900][T12009] team0: Port device team_slave_1 added [ 804.494243][T12009] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 804.501560][T12009] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 804.529324][T12009] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 804.541660][T12009] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 804.548912][T12009] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 804.578567][T12009] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 804.700304][T12072] loop9: detected capacity change from 0 to 512 [ 804.745948][T12009] device hsr_slave_0 entered promiscuous mode [ 804.770930][T12072] EXT4-fs (loop9): Ignoring removed nomblk_io_submit option [ 804.936618][T12073] IPVS: Schedule: port zero only supported in persistent services, check your ipvs configuration [ 804.950778][T12072] EXT4-fs (loop9): mounting ext3 file system using the ext4 subsystem [ 805.001180][T12009] device hsr_slave_1 entered promiscuous mode [ 805.021803][T12009] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 805.057758][T12072] EXT4-fs (loop9): 1 truncate cleaned up [ 805.063716][T12072] EXT4-fs (loop9): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 805.072082][T12009] Cannot create hsr debugfs directory [ 805.996493][ T13] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 806.016405][ C0] raw-gadget.0 gadget: ignoring, device is not running [ 806.151557][ T5582] Bluetooth: hci0: command 0x041b tx timeout [ 806.336588][ T13] usb 3-1: device descriptor read/64, error -32 [ 806.438342][ T1324] device hsr_slave_0 left promiscuous mode [ 806.451717][ T1324] device hsr_slave_1 left promiscuous mode [ 806.474094][ T1324] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 806.492303][ T1324] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 806.511095][ T1324] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 806.546885][ T1324] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 806.565200][ T1324] device bridge_slave_1 left promiscuous mode [ 806.589990][ T1324] bridge0: port 2(bridge_slave_1) entered disabled state [ 806.616556][ T13] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 806.630210][ T1324] device bridge_slave_0 left promiscuous mode [ 806.731312][ T1324] bridge0: port 1(bridge_slave_0) entered disabled state [ 806.781657][ T1324] device veth1_macvtap left promiscuous mode [ 806.793463][ T1324] device veth0_macvtap left promiscuous mode [ 806.806498][ T1324] device veth1_vlan left promiscuous mode [ 806.812429][ T1324] device veth0_vlan left promiscuous mode [ 806.856530][ T13] usb 3-1: Using ep0 maxpacket: 16 [ 806.895740][T12124] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 807.136687][ T13] usb 3-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=de.06 [ 807.171319][ T13] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 807.235118][ T13] usb 3-1: Product: syz [ 807.258315][ T13] usb 3-1: Manufacturer: syz [ 807.281445][ T13] usb 3-1: SerialNumber: syz [ 807.331379][ T13] r8152-cfgselector 3-1: config 0 descriptor?? [ 807.617098][ T1324] team0 (unregistering): Port device team_slave_1 removed [ 807.681294][ T1324] team0 (unregistering): Port device team_slave_0 removed [ 807.723645][ T1324] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 807.772044][ T1324] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 807.840230][ T13] r8152-cfgselector 3-1: Unknown version 0x0000 [ 807.860376][ T13] r8152-cfgselector 3-1: bad CDC descriptors [ 807.860955][ T1324] bond0 (unregistering): Released all slaves [ 807.896679][ T13] r8152-cfgselector 3-1: Unknown version 0x0000 [ 807.920234][ T13] r8152-cfgselector 3-1: USB disconnect, device number 19 [ 807.973400][T12123] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1671'. [ 808.013585][T12123] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 808.039567][T12123] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 808.065238][T12123] bond0 (unregistering): Released all slaves [ 808.201316][ T5582] Bluetooth: hci0: command 0x040f tx timeout [ 809.095258][ T26] audit: type=1326 audit(1782262921.098:111): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 809.205012][ T26] audit: type=1326 audit(1782262921.198:112): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 809.249226][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 809.358682][T12147] loop9: detected capacity change from 0 to 512 [ 809.377736][T12009] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 809.413241][T12009] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 809.416578][T12147] EXT4-fs (loop9): Ignoring removed nomblk_io_submit option [ 809.451822][ T26] audit: type=1326 audit(1782262921.198:113): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 809.476509][T12147] EXT4-fs (loop9): mounting ext3 file system using the ext4 subsystem [ 809.503149][T12009] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 809.576127][ T26] audit: type=1326 audit(1782262921.198:114): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 809.604844][ T26] audit: type=1326 audit(1782262921.198:115): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 809.633350][ T26] audit: type=1326 audit(1782262921.198:116): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 809.674470][T12147] EXT4-fs (loop9): 1 truncate cleaned up [ 809.715781][T12147] EXT4-fs (loop9): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 809.724877][ T26] audit: type=1326 audit(1782262921.208:117): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 809.806558][T12009] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 810.105840][ T26] audit: type=1326 audit(1782262921.208:118): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 810.778988][ T26] audit: type=1326 audit(1782262921.208:119): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 811.069472][ T21] Bluetooth: hci0: command 0x0419 tx timeout [ 811.077477][ T26] audit: type=1326 audit(1782262921.208:120): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12143 comm="syz.2.1675" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7faec8b07e59 code=0x7ffc0000 [ 811.548063][T12009] 8021q: adding VLAN 0 to HW filter on device bond0 [ 811.765975][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 811.790332][T12187] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 811.804486][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 811.860419][T12009] 8021q: adding VLAN 0 to HW filter on device team0 [ 811.881997][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 811.919639][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 811.968310][ T144] bridge0: port 1(bridge_slave_0) entered blocking state [ 811.975583][ T144] bridge0: port 1(bridge_slave_0) entered forwarding state [ 812.018632][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 812.047405][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 812.070978][ T144] bridge0: port 2(bridge_slave_1) entered blocking state [ 812.078320][ T144] bridge0: port 2(bridge_slave_1) entered forwarding state [ 812.105345][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 812.136577][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 812.161746][ T4291] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 812.194581][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 812.222852][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 812.263740][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 812.297703][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 812.332331][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 812.521478][T12009] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 813.058226][T12009] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 813.341526][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 813.381303][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 813.576904][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 813.663181][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 813.682323][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 814.925430][T12229] tipc: Enabling of bearer rejected, failed to enable media [ 815.284555][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 815.303898][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 815.369188][T12009] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 815.473430][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 815.500570][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 815.619124][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 815.648542][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 815.687529][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 815.736139][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 815.779102][T12009] device veth0_vlan entered promiscuous mode [ 815.849789][T12009] device veth1_vlan entered promiscuous mode [ 816.297585][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 816.330626][ T5685] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 816.354876][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 816.381344][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 816.404264][T12009] device veth0_macvtap entered promiscuous mode [ 816.455618][T12009] device veth1_macvtap entered promiscuous mode [ 816.526108][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 816.627776][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.831141][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 816.842221][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 816.863439][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 817.335149][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.358808][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 817.419344][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 817.543040][T12009] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 818.641969][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 818.764313][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 818.838684][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 818.920654][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 818.974449][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 818.985330][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 818.995764][T12009] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 819.007074][T12009] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 819.018393][T12009] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 819.026547][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macvtap0: link becomes ready [ 819.035588][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): macsec0: link becomes ready [ 819.044463][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 819.053973][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 819.063647][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 819.074709][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 819.097588][T12009] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.126421][T12009] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.136044][T12009] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.173917][T12009] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 819.353285][ T26] kauditd_printk_skb: 13 callbacks suppressed [ 819.353303][ T26] audit: type=1326 audit(1782262931.358:134): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12290 comm="syz.5.1708" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f5f18751e59 code=0x7fc00000 [ 819.465222][ T145] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 819.496153][ T145] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 820.001702][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 820.248723][ T144] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 820.347551][ T144] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 820.593828][ T4348] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 821.199859][T12321] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 825.263279][T12381] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(4) [ 825.269910][T12381] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 825.334750][T12381] vhci_hcd vhci_hcd.0: Device attached [ 826.016779][ T7] usb 39-1: new low-speed USB device number 2 using vhci_hcd [ 826.474906][T12384] vhci_hcd: connection reset by peer [ 826.480931][ T1341] vhci_hcd: stop threads [ 826.485207][ T1341] vhci_hcd: release socket [ 826.511105][ T1341] vhci_hcd: disconnect device [ 827.066063][T12419] loop9: detected capacity change from 0 to 512 [ 827.228190][T12419] EXT4-fs (loop9): Ignoring removed nomblk_io_submit option [ 827.235571][T12419] EXT4-fs (loop9): mounting ext3 file system using the ext4 subsystem [ 827.374840][T12419] EXT4-fs (loop9): 1 truncate cleaned up [ 827.400801][T12419] EXT4-fs (loop9): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 827.549358][T12430] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 828.462876][T12443] program syz.1.1743 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 830.562965][T12494] loop2: detected capacity change from 0 to 512 [ 830.619238][T12494] EXT4-fs (loop2): Ignoring removed nomblk_io_submit option [ 831.251450][ T7] vhci_hcd: vhci_device speed not set [ 831.345020][T12494] EXT4-fs (loop2): mounting ext3 file system using the ext4 subsystem [ 831.493254][T12494] EXT4-fs (loop2): 1 truncate cleaned up [ 831.516527][T12494] EXT4-fs (loop2): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 833.635556][T12539] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 834.580669][ T7] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 835.114651][T12561] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 836.138181][T12579] program syz.9.1774 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 836.176811][ T7] usb 2-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 836.195062][ T7] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 836.252502][ T7] usb 2-1: Product: syz [ 836.271861][ T7] usb 2-1: Manufacturer: syz [ 836.294644][ T7] usb 2-1: SerialNumber: syz [ 836.417827][ T7] usb 2-1: can't set config #1, error -71 [ 836.447257][ T7] usb 2-1: USB disconnect, device number 7 [ 836.626557][ T5582] usb 10-1: new high-speed USB device number 18 using dummy_hcd [ 837.096548][ T5582] usb 10-1: Using ep0 maxpacket: 16 [ 837.253321][ T5582] usb 10-1: config 6 has an invalid interface number: 221 but max is 0 [ 837.287905][ T5582] usb 10-1: config 6 has no interface number 0 [ 837.303554][ T5582] usb 10-1: config 6 interface 221 has no altsetting 0 [ 837.526841][ T5582] usb 10-1: New USB device found, idVendor=2c42, idProduct=16f8, bcdDevice=12.92 [ 837.606190][ T5582] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 837.783375][ T5582] usb 10-1: Product: syz [ 837.875643][ T5582] usb 10-1: Manufacturer: syz [ 837.978408][ T5582] usb 10-1: SerialNumber: syz [ 838.477775][T12585] loop2: detected capacity change from 0 to 7 [ 838.492325][T12623] device syzkaller1 entered promiscuous mode [ 838.529971][T11599] Dev loop2: unable to read RDB block 7 [ 838.544840][T11599] loop2: unable to read partition table [ 838.572060][T11599] loop2: partition table beyond EOD, truncated [ 838.601386][T12585] Dev loop2: unable to read RDB block 7 [ 838.614986][T12585] loop2: unable to read partition table [ 838.632101][T12585] loop2: partition table beyond EOD, truncated [ 838.680299][T12585] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 839.296790][ T5582] f81534a_ctrl 10-1:6.221: failed to set register 0x116: -5 [ 839.304280][ T5582] f81534a_ctrl 10-1:6.221: failed to enable ports: -5 [ 839.336867][ T7] usb 2-1: new full-speed USB device number 8 using dummy_hcd [ 839.512829][ T5582] f81534a_ctrl: probe of 10-1:6.221 failed with error -5 [ 839.545529][ T5582] usb 10-1: USB disconnect, device number 18 [ 839.766670][ T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 839.784063][ T7] usb 2-1: config 1 interface 0 altsetting 0 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 839.826849][ T7] usb 2-1: config 1 interface 0 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 22 [ 839.956672][ T7] usb 2-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 839.966301][ T7] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 839.974746][ T7] usb 2-1: SerialNumber: syz [ 840.017497][T12637] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 840.037556][ T7] cdc_acm 2-1:1.0: Control and data interfaces are not separated! [ 840.389772][T12657] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 840.455084][ T7] cdc_acm 2-1:1.0: ttyACM0: USB ACM device [ 840.555037][ T7] usb 2-1: USB disconnect, device number 8 [ 840.748971][T12678] loop9: detected capacity change from 0 to 512 [ 840.823312][T12678] EXT4-fs (loop9): Ignoring removed nomblk_io_submit option [ 840.883252][T12678] EXT4-fs (loop9): mounting ext3 file system using the ext4 subsystem [ 840.958120][T12680] TCP: tcp_parse_options: Illegal window scaling value 150 > 14 received [ 841.276655][ T5582] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 841.321602][T12678] EXT4-fs (loop9): 1 truncate cleaned up [ 841.407899][T12678] EXT4-fs (loop9): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 841.900560][ T5582] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 841.912057][ T5582] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 841.924004][ T5582] usb 3-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.80 [ 841.944528][ T5582] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 842.169217][ T5582] usb 3-1: config 0 descriptor?? [ 842.610558][T12706] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 843.706530][ T5582] usbhid 3-1:0.0: can't add hid device: -71 [ 843.712726][ T5582] usbhid: probe of 3-1:0.0 failed with error -71 [ 843.745445][ T5582] usb 3-1: USB disconnect, device number 20 [ 845.030526][T12763] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 845.134660][ T26] audit: type=1326 audit(1782262957.138:135): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12768 comm="syz.3.1820" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fdc92d27e59 code=0x7ffc0000 [ 845.180683][ T26] audit: type=1326 audit(1782262957.178:136): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12768 comm="syz.3.1820" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=271 compat=0 ip=0x7fdc92d27e59 code=0x7ffc0000 [ 845.275263][T12774] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 845.709740][ T4238] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 846.107008][ T4238] usb 3-1: Using ep0 maxpacket: 16 [ 846.476546][ T4238] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 846.517048][ T4238] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 846.591721][ T4206] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 846.602280][ T4206] CPU: 1 PID: 4206 Comm: kworker/u5:8 Not tainted syzkaller #0 [ 846.609884][ T4206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 846.620229][ T4206] Workqueue: hci0 hci_rx_work [ 846.625113][ T4206] Call Trace: [ 846.628414][ T4206] [ 846.631369][ T4206] dump_stack_lvl+0x188/0x250 [ 846.636111][ T4206] ? show_regs_print_info+0x20/0x20 [ 846.641316][ T4206] ? load_image+0x400/0x400 [ 846.645862][ T4206] sysfs_create_dir_ns+0x26a/0x290 [ 846.651299][ T4206] ? sysfs_warn_dup+0xa0/0xa0 [ 846.656240][ T4206] ? process_one_work+0x85f/0x1010 [ 846.661490][ T4206] ? do_raw_spin_unlock+0x11d/0x230 [ 846.666982][ T4206] kobject_add_internal+0x6e0/0xd90 [ 846.672566][ T4206] kobject_add+0x160/0x230 [ 846.677091][ T4206] ? kobject_init+0x1d0/0x1d0 [ 846.681879][ T4206] ? klist_children_get+0x50/0x50 [ 846.687024][ T4206] ? get_device_parent+0x121/0x3f0 [ 846.692251][ T4206] device_add+0x48c/0x1000 [ 846.696737][ T4206] hci_conn_add_sysfs+0xd1/0x1e0 [ 846.701765][ T4206] le_conn_complete_evt+0xc4b/0x15c0 [ 846.707077][ T4206] ? cs_le_create_conn+0x5e0/0x5e0 [ 846.712208][ T4206] ? __mutex_trylock_common+0x155/0x260 [ 846.717863][ T4206] hci_le_meta_evt+0x285/0x3cb0 [ 846.723024][ T4206] ? hci_event_packet+0x37e/0x1370 [ 846.728155][ T4206] ? __lock_acquire+0x7d10/0x7d10 [ 846.733239][ T4206] ? hci_remote_host_features_evt+0x290/0x290 [ 846.740156][ T4206] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 846.746074][ T4206] ? mark_lock+0x94/0x320 [ 846.750433][ T4206] ? mutex_unlock+0x10/0x10 [ 846.755381][ T4206] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 846.761498][ T4206] ? lock_chain_count+0x20/0x20 [ 846.766658][ T4206] ? __rwlock_init+0x140/0x140 [ 846.771440][ T4206] hci_event_packet+0xe4b/0x1370 [ 846.776480][ T4206] ? lockdep_hardirqs_on+0x94/0x140 [ 846.781730][ T4206] ? rcu_lock_release+0x20/0x20 [ 846.786618][ T4206] ? hci_send_to_monitor+0x9c/0x4a0 [ 846.791905][ T4206] hci_rx_work+0x255/0xa10 [ 846.796452][ T4206] process_one_work+0x85f/0x1010 [ 846.801416][ T4206] ? worker_detach_from_pool+0x240/0x240 [ 846.807052][ T4206] ? lockdep_hardirqs_off+0x70/0x100 [ 846.812363][ T4206] ? _raw_spin_lock_irq+0xb7/0xf0 [ 846.817412][ T4206] ? _raw_spin_lock_irqsave+0x100/0x100 [ 846.822982][ T4206] ? wq_worker_running+0x97/0x170 [ 846.828018][ T4206] worker_thread+0xaa6/0x1290 [ 846.832711][ T4206] ? lockdep_hardirqs_on+0x94/0x140 [ 846.837919][ T4206] ? _raw_spin_unlock_irqrestore+0xc1/0x120 [ 846.843837][ T4206] kthread+0x436/0x520 [ 846.847941][ T4206] ? rcu_lock_release+0x20/0x20 [ 846.852794][ T4206] ? kthread_blkcg+0xd0/0xd0 [ 846.857484][ T4206] ret_from_fork+0x1f/0x30 [ 846.861953][ T4206] [ 846.867913][ T4206] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 846.882157][ T4206] Bluetooth: hci0: failed to register connection device [ 846.902522][ T4238] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 846.953245][ T4238] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 846.978226][ T4238] usb 3-1: config 0 descriptor?? [ 847.108560][T12807] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 847.236597][ T4238] usbhid 3-1:0.0: can't add hid device: -71 [ 847.246613][ T4238] usbhid: probe of 3-1:0.0 failed with error -71 [ 847.310562][ T4238] usb 3-1: USB disconnect, device number 21 [ 848.130818][T12840] loop1: detected capacity change from 0 to 512 [ 848.496740][T12840] EXT4-fs (loop1): Ignoring removed nomblk_io_submit option [ 848.940746][T12840] EXT4-fs (loop1): mounting ext3 file system using the ext4 subsystem [ 849.260435][T12840] EXT4-fs (loop1): 1 truncate cleaned up [ 849.266298][T12840] EXT4-fs (loop1): mounted filesystem without journal. Opts: noload,stripe=0x00000000000000dc,nomblk_io_submit,noload,abort,auto_da_alloc,,errors=continue. Quota mode: none. [ 849.351444][T12874] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 850.601510][T12903] overlayfs: failed to clone upperpath [ 850.775132][T12913] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 852.029251][ T5582] Bluetooth: hci9: Controller not accepting commands anymore: ncmd = 0 [ 852.050989][ T5582] Bluetooth: hci9: Injecting HCI hardware error event [ 852.095020][ T4203] Bluetooth: hci9: hardware error 0x00 [ 852.695476][T12958] overlayfs: maximum fs stacking depth exceeded [ 852.727218][T12958] overlayfs: maximum fs stacking depth exceeded [ 852.886492][ T7] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 852.929225][T12965] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 852.996508][ T1111] Bluetooth: hci0: command 0x0406 tx timeout [ 853.447507][ T7] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 854.030977][ T7] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 854.062141][ T7] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 854.086436][ T7] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 854.106736][ T7] usb 3-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 854.121906][ T7] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 854.162612][ T7] usb 3-1: config 0 descriptor?? [ 854.301863][T13000] overlayfs: maximum fs stacking depth exceeded [ 854.328326][T13000] overlayfs: maximum fs stacking depth exceeded [ 854.546717][ T7] hdpvr 3-1:0.0: firmware version 0xd9 dated ÚL–W@ô‚Ôõ'^£ñR"Î5ËçèÝD¤ÙBUN§Æ=rp]’ÑEÈ/ [ 854.584075][ T7] hdpvr 3-1:0.0: untested firmware, the driver might not work. [ 854.676520][ T1111] usb 2-1: new high-speed USB device number 9 using dummy_hcd [ 855.116469][ T1111] usb 2-1: Using ep0 maxpacket: 32 [ 855.256906][ T1111] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 855.566991][ T1111] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 855.648291][ T1111] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 855.846998][ T1111] usb 2-1: Product: syz [ 855.851222][ T1111] usb 2-1: Manufacturer: syz [ 855.855844][ T1111] usb 2-1: SerialNumber: syz [ 855.955460][ T1111] usb 2-1: config 0 descriptor?? [ 856.028059][T12996] raw-gadget.1 gadget: fail, usb_ep_enable returned -22 [ 856.047380][ T1111] hub 2-1:0.0: bad descriptor, ignoring hub [ 856.055038][ T1111] hub: probe of 2-1:0.0 failed with error -5 [ 856.076271][T13048] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 856.176899][ T7] hdpvr 3-1:0.0: Could not setup controls [ 856.187151][ T7] hdpvr 3-1:0.0: registering videodev failed [ 856.239579][ T7] hdpvr: probe of 3-1:0.0 failed with error -71 [ 856.296759][ T7] usb 3-1: USB disconnect, device number 22 [ 856.430349][ T4238] usb 2-1: USB disconnect, device number 9 [ 857.643798][ T4238] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 857.742176][T13079] overlayfs: maximum fs stacking depth exceeded [ 857.796852][T13083] overlayfs: maximum fs stacking depth exceeded [ 857.907948][ T4238] usb 2-1: Using ep0 maxpacket: 32 [ 858.046753][ T4238] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 858.236621][ T4238] usb 2-1: string descriptor 0 read error: -71 [ 858.308122][ T4238] usb 2-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 858.679154][ T4238] usb 2-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 858.919508][ T4238] usb 2-1: config 0 descriptor?? [ 858.966627][ T4238] usb 2-1: can't set config #0, error -71 [ 859.010752][ T4238] usb 2-1: USB disconnect, device number 10 [ 859.269684][ T9073] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 860.096899][ T9073] usb 3-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 860.108917][ T9073] usb 3-1: config 1 has an invalid descriptor of length 255, skipping remainder of the config [ 860.145519][ T9073] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 860.173881][ T9073] usb 3-1: config 1 interface 0 altsetting 0 has an invalid endpoint with address 0xFF, skipping [ 860.316882][ T9073] usb 3-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 860.336931][ T9073] usb 3-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 860.345050][ T9073] usb 3-1: Product: syz [ 860.372054][ T9073] usb 3-1: Manufacturer: syz [ 860.537821][T13100] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 860.623990][ T9073] cdc_wdm 3-1:1.0: skipping garbage [ 860.684916][ T9073] cdc_wdm 3-1:1.0: skipping garbage [ 860.696632][ T4238] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 860.754522][ T9073] cdc_wdm: probe of 3-1:1.0 failed with error -22 [ 860.966688][ T4238] usb 2-1: Using ep0 maxpacket: 8 [ 861.247061][ T4238] usb 2-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 861.299520][ T4238] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 861.439783][ T4238] usb 2-1: Product: syz [ 861.509827][ T4238] usb 2-1: Manufacturer: syz [ 861.582225][ T4238] usb 2-1: SerialNumber: syz [ 861.685388][ T4238] usb 2-1: config 0 descriptor?? [ 861.737248][ T4232] usb 3-1: USB disconnect, device number 23 [ 861.953241][ T4238] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 862.086032][ T4194] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci8/hci8:201' [ 862.095878][ T4194] CPU: 0 PID: 4194 Comm: kworker/u5:2 Not tainted syzkaller #0 [ 862.103633][ T4194] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 862.113892][ T4194] Workqueue: hci8 hci_rx_work [ 862.118753][ T4194] Call Trace: [ 862.122181][ T4194] [ 862.125289][ T4194] dump_stack_lvl+0x188/0x250 [ 862.130265][ T4194] ? show_regs_print_info+0x20/0x20 [ 862.135502][ T4194] ? load_image+0x400/0x400 [ 862.140092][ T4194] sysfs_create_dir_ns+0x26a/0x290 [ 862.145247][ T4194] ? sysfs_warn_dup+0xa0/0xa0 [ 862.149957][ T4194] ? process_one_work+0x85f/0x1010 [ 862.155207][ T4194] ? do_raw_spin_unlock+0x11d/0x230 [ 862.160718][ T4194] kobject_add_internal+0x6e0/0xd90 [ 862.165967][ T4194] kobject_add+0x160/0x230 [ 862.170427][ T4194] ? kobject_init+0x1d0/0x1d0 [ 862.175328][ T4194] ? klist_children_get+0x50/0x50 [ 862.180405][ T4194] ? get_device_parent+0x121/0x3f0 [ 862.185746][ T4194] device_add+0x48c/0x1000 [ 862.190425][ T4194] hci_conn_add_sysfs+0xd1/0x1e0 [ 862.195422][ T4194] le_conn_complete_evt+0xc4b/0x15c0 [ 862.200763][ T4194] ? cs_le_create_conn+0x5e0/0x5e0 [ 862.206028][ T4194] ? __mutex_trylock_common+0x155/0x260 [ 862.211699][ T4194] hci_le_meta_evt+0x285/0x3cb0 [ 862.216681][ T4194] ? hci_event_packet+0x37e/0x1370 [ 862.221897][ T4194] ? __lock_acquire+0x7d10/0x7d10 [ 862.226936][ T4194] ? hci_remote_host_features_evt+0x290/0x290 [ 862.233015][ T4194] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 862.238758][ T4194] ? mark_lock+0x94/0x320 [ 862.243101][ T4194] ? mutex_unlock+0x10/0x10 [ 862.247619][ T4194] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 862.253608][ T4194] ? lock_chain_count+0x20/0x20 [ 862.258581][ T4194] ? __rwlock_init+0x140/0x140 [ 862.263353][ T4194] hci_event_packet+0xe4b/0x1370 [ 862.268468][ T4194] ? lockdep_hardirqs_on+0x94/0x140 [ 862.273688][ T4194] ? rcu_lock_release+0x20/0x20 [ 862.278812][ T4194] ? hci_send_to_monitor+0x9c/0x4a0 [ 862.284049][ T4194] hci_rx_work+0x255/0xa10 [ 862.288552][ T4194] process_one_work+0x85f/0x1010 [ 862.293689][ T4194] ? worker_detach_from_pool+0x240/0x240 [ 862.299543][ T4194] ? lockdep_hardirqs_off+0x70/0x100 [ 862.305097][ T4194] ? _raw_spin_lock_irq+0xb7/0xf0 [ 862.310646][ T4194] ? _raw_spin_lock_irqsave+0x100/0x100 [ 862.316200][ T4194] ? wq_worker_running+0x97/0x170 [ 862.321241][ T4194] worker_thread+0xaa6/0x1290 [ 862.325974][ T4194] kthread+0x436/0x520 [ 862.330043][ T4194] ? rcu_lock_release+0x20/0x20 [ 862.334895][ T4194] ? kthread_blkcg+0xd0/0xd0 [ 862.339582][ T4194] ret_from_fork+0x1f/0x30 [ 862.344304][ T4194] [ 862.359556][ T4194] kobject_add_internal failed for hci8:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 862.373948][ T4194] Bluetooth: hci8: failed to register connection device [ 862.410077][T13153] overlayfs: failed to clone upperpath [ 862.805946][T13172] futex_wake_op: syz.3.1911 tries to shift op by 144; fix this program [ 863.897340][ T4203] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci1/hci1:201' [ 863.907826][ T4203] CPU: 1 PID: 4203 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 863.915763][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 863.926042][ T4203] Workqueue: hci1 hci_rx_work [ 863.930775][ T4203] Call Trace: [ 863.934184][ T4203] [ 863.937160][ T4203] dump_stack_lvl+0x188/0x250 [ 863.942072][ T4203] ? show_regs_print_info+0x20/0x20 [ 863.948116][ T4203] ? load_image+0x400/0x400 [ 863.952806][ T4203] sysfs_create_dir_ns+0x26a/0x290 [ 863.958299][ T4203] ? sysfs_warn_dup+0xa0/0xa0 [ 863.963269][ T4203] ? process_one_work+0x85f/0x1010 [ 863.968726][ T4203] ? do_raw_spin_unlock+0x11d/0x230 [ 863.974194][ T4203] kobject_add_internal+0x6e0/0xd90 [ 863.979581][ T4203] kobject_add+0x160/0x230 [ 863.984227][ T4203] ? kobject_init+0x1d0/0x1d0 [ 863.988985][ T4203] ? klist_children_get+0x50/0x50 [ 863.994126][ T4203] ? get_device_parent+0x121/0x3f0 [ 863.999435][ T4203] device_add+0x48c/0x1000 [ 864.004215][ T4203] hci_conn_add_sysfs+0xd1/0x1e0 [ 864.009598][ T4203] le_conn_complete_evt+0xc4b/0x15c0 [ 864.015073][ T4203] ? cs_le_create_conn+0x5e0/0x5e0 [ 864.020199][ T4203] ? __mutex_trylock_common+0x155/0x260 [ 864.026551][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 864.031527][ T4203] ? hci_event_packet+0x37e/0x1370 [ 864.036741][ T4203] ? __lock_acquire+0x7d10/0x7d10 [ 864.041786][ T4203] ? hci_remote_host_features_evt+0x290/0x290 [ 864.048015][ T4203] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 864.053917][ T4203] ? mark_lock+0x94/0x320 [ 864.058540][ T4203] ? mutex_unlock+0x10/0x10 [ 864.063053][ T4203] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 864.069129][ T4203] ? lock_chain_count+0x20/0x20 [ 864.074073][ T4203] ? __rwlock_init+0x140/0x140 [ 864.078844][ T4203] hci_event_packet+0xe4b/0x1370 [ 864.084048][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 864.089462][ T4203] ? rcu_lock_release+0x20/0x20 [ 864.094592][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 864.100177][ T4203] hci_rx_work+0x255/0xa10 [ 864.104651][ T4203] process_one_work+0x85f/0x1010 [ 864.109615][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 864.115254][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 864.120549][ T4203] ? _raw_spin_lock_irq+0xb7/0xf0 [ 864.125582][ T4203] ? _raw_spin_lock_irqsave+0x100/0x100 [ 864.131236][ T4203] ? wq_worker_running+0x97/0x170 [ 864.136712][ T4203] worker_thread+0xaa6/0x1290 [ 864.141596][ T4203] kthread+0x436/0x520 [ 864.145757][ T4203] ? rcu_lock_release+0x20/0x20 [ 864.150699][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 864.155336][ T4203] ret_from_fork+0x1f/0x30 [ 864.159777][ T4203] [ 864.164547][ T4203] kobject_add_internal failed for hci1:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 864.178161][ T4203] Bluetooth: hci1: failed to register connection device [ 864.230512][T13190] ubi16: attaching mtd0 [ 864.244678][T13190] ubi16: scanning is finished [ 864.263225][T13190] ubi16: empty MTD device detected [ 864.485086][T13190] ubi16: attached mtd0 (name "mtdram test device", size 0 MiB) [ 864.494830][T13190] ubi16: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes [ 864.502417][T13190] ubi16: min./max. I/O unit sizes: 1/64, sub-page size 1 [ 864.509805][T13190] ubi16: VID header offset: 64 (aligned 64), data offset: 128 [ 864.518283][T13190] ubi16: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0 [ 864.525377][T13190] ubi16: user volume: 0, internal volumes: 1, max. volumes count: 23 [ 864.533797][T13190] ubi16: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 2738945550 [ 864.544426][T13190] ubi16: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0 [ 864.556443][T13195] ubi16: background thread "ubi_bgt16d" started, PID 13195 [ 864.826711][ T4700] usb 10-1: new high-speed USB device number 19 using dummy_hcd [ 864.929014][ T4238] gspca_sonixj: reg_w1 err -71 [ 865.096533][ T4700] usb 10-1: Using ep0 maxpacket: 16 [ 865.106475][ T4238] sonixj: probe of 2-1:0.0 failed with error -71 [ 865.125847][ T4238] usb 2-1: USB disconnect, device number 11 [ 865.221665][T13205] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 865.274370][T13207] IPVS: set_ctl: invalid protocol: 108 100.1.1.2:20000 [ 865.286424][ T4700] usb 10-1: unable to get BOS descriptor or descriptor too short [ 865.318476][ T4700] usb 10-1: no configurations [ 865.323233][ T4700] usb 10-1: can't read configurations, error -22 [ 866.619217][T13232] futex_wake_op: syz.5.1928 tries to shift op by 144; fix this program [ 868.506507][ T9073] Bluetooth: hci8: command 0x0406 tx timeout [ 870.671997][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 871.582910][T13304] overlayfs: failed to clone lowerpath [ 875.264432][ T1341] Bluetooth: (null): Invalid header checksum [ 875.352422][ T1341] Bluetooth: (null): Invalid header checksum [ 875.463542][ T1341] Bluetooth: (null): Invalid header checksum [ 875.477396][ T145] Bluetooth: (null): Invalid header checksum [ 876.791322][T13357] overlayfs: maximum fs stacking depth exceeded [ 879.361832][T13415] overlayfs: maximum fs stacking depth exceeded [ 880.879886][T13445] program syz.3.1980 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 881.096645][ T5582] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 881.386638][ T5582] usb 2-1: Using ep0 maxpacket: 8 [ 881.569086][ T5582] usb 2-1: unable to get BOS descriptor or descriptor too short [ 881.832607][ T5582] usb 2-1: New USB device found, idVendor=058f, idProduct=6610, bcdDevice=48.05 [ 881.842271][ T5582] usb 2-1: New USB device strings: Mfr=2, Product=0, SerialNumber=3 [ 881.872110][ T5582] usb 2-1: Manufacturer: syz [ 881.884578][ T5582] usb 2-1: SerialNumber: syz [ 882.214437][ T5582] usb 2-1: dvb_usb_v2: found a 'Sigmatek DVB-110' in warm state [ 882.254113][ T5582] usb 2-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 882.288197][ T5582] dvbdev: DVB: registering new adapter (Sigmatek DVB-110) [ 882.332911][ T5582] usb 2-1: media controller created [ 882.418664][ T5582] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 882.617682][ T5582] zl10353_read_register: readreg error (reg=127, ret==0) [ 883.332750][ T5582] usb 2-1: USB disconnect, device number 12 [ 883.686571][T13512] tipc: Started in network mode [ 883.706726][T13512] tipc: Node identity 4, cluster identity 4711 [ 883.735857][T13512] tipc: Node number set to 4 [ 886.714663][T13572] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 890.216022][T13587] chnl_net:caif_netlink_parms(): no params data found [ 890.451743][ T1111] Bluetooth: hci3: command 0x0409 tx timeout [ 890.853065][T13587] bridge0: port 1(bridge_slave_0) entered blocking state [ 891.176488][T13587] bridge0: port 1(bridge_slave_0) entered disabled state [ 891.216295][T13587] device bridge_slave_0 entered promiscuous mode [ 891.297387][T13587] bridge0: port 2(bridge_slave_1) entered blocking state [ 891.315159][T13587] bridge0: port 2(bridge_slave_1) entered disabled state [ 891.602152][T13587] device bridge_slave_1 entered promiscuous mode [ 892.122583][T13640] netlink: 36 bytes leftover after parsing attributes in process `syz.9.2023'. [ 892.522710][ T1111] Bluetooth: hci3: command 0x041b tx timeout [ 892.537873][T13587] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 892.894837][T13587] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 893.601965][T13587] team0: Port device team_slave_0 added [ 893.618672][T13587] team0: Port device team_slave_1 added [ 893.710710][T13587] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 893.757884][T13587] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 893.813102][T13587] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 893.878281][T13587] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 893.903507][T13587] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 893.983473][T13587] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 894.114958][T13683] sg_write: data in/out 491584/136 bytes for SCSI command 0x0-- guessing data in; [ 894.114958][T13683] program syz.1.2036 not setting count and/or reply_len properly [ 894.137276][T13587] device hsr_slave_0 entered promiscuous mode [ 894.177081][T13587] device hsr_slave_1 entered promiscuous mode [ 894.197959][T13587] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 894.231008][T13587] Cannot create hsr debugfs directory [ 894.684103][ T21] Bluetooth: hci3: command 0x040f tx timeout [ 896.746831][ T1111] Bluetooth: hci3: command 0x0419 tx timeout [ 896.757165][T13587] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 896.808910][T13587] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 896.888963][T13587] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 896.946950][T13587] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 898.105853][T13587] 8021q: adding VLAN 0 to HW filter on device bond0 [ 898.586762][T13587] 8021q: adding VLAN 0 to HW filter on device team0 [ 898.636291][T13764] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2049'. [ 898.740903][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1: link becomes ready [ 898.760946][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0: link becomes ready [ 898.828056][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bridge: link becomes ready [ 898.877311][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_0: link becomes ready [ 898.885893][ T4283] bridge0: port 1(bridge_slave_0) entered blocking state [ 898.893135][ T4283] bridge0: port 1(bridge_slave_0) entered forwarding state [ 898.998311][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): bridge0: link becomes ready [ 899.038998][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bridge: link becomes ready [ 899.077397][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): bridge_slave_1: link becomes ready [ 899.103757][ T4283] bridge0: port 2(bridge_slave_1) entered blocking state [ 899.111015][ T4283] bridge0: port 2(bridge_slave_1) entered forwarding state [ 899.168957][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_bond: link becomes ready [ 899.344757][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_bond: link becomes ready [ 899.535710][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_team: link becomes ready [ 899.778878][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_0: link becomes ready [ 899.972909][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): team0: link becomes ready [ 900.136184][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_team: link becomes ready [ 900.217431][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): team_slave_1: link becomes ready [ 900.231729][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_hsr: link becomes ready [ 900.247208][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_0: link becomes ready [ 900.288146][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_hsr: link becomes ready [ 900.302872][ T4283] IPv6: ADDRCONF(NETDEV_CHANGE): hsr_slave_1: link becomes ready [ 900.360576][T13587] IPv6: ADDRCONF(NETDEV_CHANGE): hsr0: link becomes ready [ 901.264795][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan1: link becomes ready [ 901.273563][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): vxcan0: link becomes ready [ 901.334347][T13587] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 903.113130][T13834] tipc: Can't bind to reserved service type 1 [ 904.257322][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_virt_wifi: link becomes ready [ 904.744191][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_virt_wifi: link becomes ready [ 904.844845][ T5849] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_vlan: link becomes ready [ 904.858545][T13846] netlink: 12 bytes leftover after parsing attributes in process `syz.1.2063'. [ 904.860495][ T5849] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_vlan: link becomes ready [ 904.920076][T13587] device veth0_vlan entered promiscuous mode [ 904.961597][ T5849] IPv6: ADDRCONF(NETDEV_CHANGE): vlan0: link becomes ready [ 904.985390][ T5849] IPv6: ADDRCONF(NETDEV_CHANGE): vlan1: link becomes ready [ 905.040316][T13587] device veth1_vlan entered promiscuous mode [ 905.095791][ T26] audit: type=1326 audit(1782263017.098:137): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 905.165046][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan0: link becomes ready [ 905.192582][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): macvlan1: link becomes ready [ 905.195441][ T26] audit: type=1326 audit(1782263017.138:138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 905.367281][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_macvtap: link becomes ready [ 905.376046][ T145] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_macvtap: link becomes ready [ 905.448198][ T26] audit: type=1326 audit(1782263017.138:139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 905.674353][T13587] device veth0_macvtap entered promiscuous mode [ 905.994882][T13587] device veth1_macvtap entered promiscuous mode [ 906.122539][ T26] audit: type=1326 audit(1782263017.138:140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 906.213750][ T26] audit: type=1326 audit(1782263017.138:141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 906.256709][ T26] audit: type=1326 audit(1782263017.138:142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 906.270891][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 906.346569][ T26] audit: type=1326 audit(1782263017.138:143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 906.388564][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 906.427810][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 906.452075][ T26] audit: type=1326 audit(1782263017.138:144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 906.486631][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 906.528493][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 906.588197][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 906.597309][ T26] audit: type=1326 audit(1782263017.158:145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 906.628659][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 906.680478][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 906.711350][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0 [ 906.716477][ T26] audit: type=1326 audit(1782263017.158:146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13852 comm="syz.1.2065" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f3a1b16be59 code=0x7ffc0000 [ 906.732689][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 906.821052][T13587] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 906.898270][ T5683] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_0: link becomes ready [ 906.923581][ T5683] IPv6: ADDRCONF(NETDEV_CHANGE): veth0_to_batadv: link becomes ready [ 906.993916][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 907.050383][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 907.265414][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 907.296525][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 907.459118][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 907.723791][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 907.984542][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 908.066540][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 908.122347][T13587] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1 [ 908.133635][T13587] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems! [ 908.146688][T13587] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 908.188728][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): batadv_slave_1: link becomes ready [ 908.217953][ T4290] IPv6: ADDRCONF(NETDEV_CHANGE): veth1_to_batadv: link becomes ready [ 908.478805][T13587] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.543722][T13587] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.580674][T13587] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 908.833383][T13587] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 909.126401][T13917] futex_wake_op: syz.3.2077 tries to shift op by 144; fix this program [ 910.197183][ T4290] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 910.205295][ T4290] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 910.213944][ T5849] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 910.247456][ T5849] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 910.287575][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan0: link becomes ready [ 910.404351][ T144] IPv6: ADDRCONF(NETDEV_CHANGE): wlan1: link becomes ready [ 912.347029][ T21] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 912.757373][ T21] usb 2-1: New USB device found, idVendor=046d, idProduct=0870, bcdDevice=61.47 [ 912.854117][ T21] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 913.358136][ T21] usb 2-1: config 0 descriptor?? [ 913.408956][ T21] gspca_main: STV06xx-2.14.0 probing 046d:0870 [ 913.611365][T13977] futex_wake_op: syz.4.2090 tries to shift op by 144; fix this program [ 915.092410][ T21] usb 2-1: USB disconnect, device number 13 [ 915.487036][ T4238] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 915.950461][ T5849] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.016931][ T4238] usb 5-1: config 5 has an invalid interface number: 123 but max is 0 [ 916.055688][ T4238] usb 5-1: config 5 has no interface number 0 [ 916.096225][ T4238] usb 5-1: config 5 interface 123 altsetting 7 has an invalid endpoint with address 0x20, skipping [ 916.188259][ T4238] usb 5-1: config 5 interface 123 altsetting 7 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 916.216579][ T4238] usb 5-1: config 5 interface 123 has no altsetting 0 [ 916.307169][ T5849] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 916.386861][ T4238] usb 5-1: New USB device found, idVendor=3923, idProduct=718a, bcdDevice=d8.d7 [ 916.468644][ T4238] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 916.561533][ T4238] usb 5-1: Product: syz [ 916.613648][ T4238] usb 5-1: Manufacturer: syz [ 916.681808][ T4238] usb 5-1: SerialNumber: syz [ 916.891253][ T5849] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.251808][ T4238] comedi comedi5: Wrong number of endpoints [ 917.291118][ T4238] ni6501 5-1:5.123: driver 'ni6501' failed to auto-configure device. [ 917.373190][ T4238] usb 5-1: USB disconnect, device number 2 [ 917.430400][ T5849] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 917.678325][T14036] nfs: Unknown parameter 'smaCkf' [ 917.896487][ T5849] tipc: Left network mode [ 918.136280][T14046] overlayfs: failed to clone lowerpath [ 921.349249][T14101] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 922.646484][ T9073] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 922.977127][ T9073] usb 2-1: Using ep0 maxpacket: 16 [ 923.021182][ T5849] device hsr_slave_0 left promiscuous mode [ 923.048827][ T5849] device hsr_slave_1 left promiscuous mode [ 923.056925][ T5849] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 923.096723][ T9073] usb 2-1: config index 0 descriptor too short (expected 292, got 36) [ 923.115205][ T9073] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 923.134215][ T5849] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 923.164964][ T9073] usb 2-1: config 0 has no interfaces? [ 923.206135][ T9073] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 923.239171][ T9073] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 923.283563][ T9073] usb 2-1: config 0 descriptor?? [ 923.305438][ T5849] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 923.325732][ T5849] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 923.371930][ T5849] device veth1 left promiscuous mode [ 923.397051][ T5849] bridge0: port 3(veth1) entered disabled state [ 923.428008][ T5849] device bridge_slave_1 left promiscuous mode [ 923.436901][ T5849] bridge0: port 2(bridge_slave_1) entered disabled state [ 923.467533][ T5849] device bridge_slave_0 left promiscuous mode [ 923.492350][ T5849] bridge0: port 1(bridge_slave_0) entered disabled state [ 923.600567][ T4234] usb 2-1: USB disconnect, device number 14 [ 923.739570][T14143] overlayfs: failed to clone lowerpath [ 925.450989][T14156] af_packet: tpacket_rcv: packet too big, clamped from 40 to 4294967272. macoff=96 [ 926.404783][ T5849] device veth1_macvtap left promiscuous mode [ 926.416706][ T5849] device veth0_macvtap left promiscuous mode [ 926.423030][ T5849] device veth1_vlan left promiscuous mode [ 926.464073][ T5849] device veth0_vlan left promiscuous mode [ 929.075357][ T4700] Bluetooth: hci0: command 0x0406 tx timeout [ 930.791685][T14178] overlayfs: overlapping lowerdir path [ 930.801222][ T5849] bond1 (unregistering): (slave geneve2): Releasing active interface [ 930.811326][T14183] overlayfs: overlapping lowerdir path [ 930.856263][ T5849] bond1 (unregistering): Released all slaves [ 930.864653][ T4203] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci8/hci8:201' [ 930.874357][ T4203] CPU: 1 PID: 4203 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 930.882033][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 930.892236][ T4203] Workqueue: hci8 hci_rx_work [ 930.897435][ T4203] Call Trace: [ 930.900730][ T4203] [ 930.903736][ T4203] dump_stack_lvl+0x188/0x250 [ 930.908451][ T4203] ? show_regs_print_info+0x20/0x20 [ 930.913669][ T4203] ? load_image+0x400/0x400 [ 930.918616][ T4203] sysfs_create_dir_ns+0x26a/0x290 [ 930.924201][ T4203] ? sysfs_warn_dup+0xa0/0xa0 [ 930.929026][ T4203] ? process_one_work+0x85f/0x1010 [ 930.934535][ T4203] ? do_raw_spin_unlock+0x11d/0x230 [ 930.940075][ T4203] kobject_add_internal+0x6e0/0xd90 [ 930.946476][ T4203] kobject_add+0x160/0x230 [ 930.951256][ T4203] ? kobject_init+0x1d0/0x1d0 [ 930.956136][ T4203] ? klist_children_get+0x50/0x50 [ 930.961374][ T4203] ? get_device_parent+0x121/0x3f0 [ 930.966505][ T4203] device_add+0x48c/0x1000 [ 930.970951][ T4203] hci_conn_add_sysfs+0xd1/0x1e0 [ 930.975905][ T4203] le_conn_complete_evt+0xc4b/0x15c0 [ 930.981242][ T4203] ? cs_le_create_conn+0x5e0/0x5e0 [ 930.986374][ T4203] ? __mutex_trylock_common+0x155/0x260 [ 930.992045][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 930.997092][ T4203] ? hci_event_packet+0x37e/0x1370 [ 931.002223][ T4203] ? __lock_acquire+0x7d10/0x7d10 [ 931.007258][ T4203] ? hci_remote_host_features_evt+0x290/0x290 [ 931.013321][ T4203] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 931.018980][ T4203] ? mark_lock+0x94/0x320 [ 931.023334][ T4203] ? mutex_unlock+0x10/0x10 [ 931.028049][ T4203] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 931.034337][ T4203] ? lock_chain_count+0x20/0x20 [ 931.039211][ T4203] ? __rwlock_init+0x140/0x140 [ 931.044149][ T4203] hci_event_packet+0xe4b/0x1370 [ 931.049138][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 931.054369][ T4203] ? rcu_lock_release+0x20/0x20 [ 931.059240][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 931.064464][ T4203] hci_rx_work+0x255/0xa10 [ 931.068910][ T4203] process_one_work+0x85f/0x1010 [ 931.073875][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 931.079518][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 931.084818][ T4203] ? _raw_spin_lock_irq+0xb7/0xf0 [ 931.089854][ T4203] ? _raw_spin_lock_irqsave+0x100/0x100 [ 931.095419][ T4203] ? wq_worker_running+0x97/0x170 [ 931.100460][ T4203] worker_thread+0xaa6/0x1290 [ 931.105274][ T4203] kthread+0x436/0x520 [ 931.109354][ T4203] ? rcu_lock_release+0x20/0x20 [ 931.114226][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 931.119048][ T4203] ret_from_fork+0x1f/0x30 [ 931.123577][ T4203] [ 931.126858][ C1] vkms_vblank_simulate: vblank timer overrun [ 931.140596][ T4203] kobject_add_internal failed for hci8:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 931.154558][ T4203] Bluetooth: hci8: failed to register connection device [ 931.165562][ T4203] Bluetooth: hci8: link tx timeout [ 931.171138][ T4203] Bluetooth: hci8: killing stalled connection 10:aa:aa:aa:aa:aa [ 931.179459][ T4203] Bluetooth: hci8: link tx timeout [ 931.184590][ T4203] Bluetooth: hci8: killing stalled connection 00:00:00:00:00:00 [ 931.193073][ T4203] Bluetooth: hci8: killing stalled connection 00:00:00:00:00:00 [ 931.200777][ T4203] Bluetooth: hci8: killing stalled connection 11:aa:aa:aa:aa:aa [ 932.307051][ T1433] ieee802154 phy1 wpan1: encryption failed: -22 [ 932.557919][ T5849] team0 (unregistering): Port device team_slave_1 removed [ 932.584395][ T5849] team0 (unregistering): Port device team_slave_0 removed [ 933.280329][ T23] Bluetooth: hci8: command 0x0406 tx timeout [ 933.317510][ T5849] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 933.344929][ T5849] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 937.306617][ T13] Bluetooth: hci8: command 0x0406 tx timeout [ 937.445980][ T5849] bond0 (unregistering): Released all slaves [ 937.660647][T14232] loop1: detected capacity change from 0 to 2048 [ 937.695106][T14232] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 937.918052][ T26] kauditd_printk_skb: 3 callbacks suppressed [ 937.918070][ T26] audit: type=1800 audit(1782263049.928:150): pid=14232 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2155" name="file1" dev="loop1" ino=1369 res=0 errno=0 [ 937.945108][ C0] vkms_vblank_simulate: vblank timer overrun [ 937.979111][ T4203] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci8/hci8:201' [ 937.988770][ T4203] CPU: 0 PID: 4203 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 937.996448][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 938.006636][ T4203] Workqueue: hci8 hci_rx_work [ 938.011440][ T4203] Call Trace: [ 938.014835][ T4203] [ 938.017794][ T4203] dump_stack_lvl+0x188/0x250 [ 938.022509][ T4203] ? show_regs_print_info+0x20/0x20 [ 938.025167][T14240] tipc: Enabling of bearer rejected, failed to enable media [ 938.027734][ T4203] ? load_image+0x400/0x400 [ 938.027815][ T4203] sysfs_create_dir_ns+0x26a/0x290 [ 938.046445][ T4203] ? sysfs_warn_dup+0xa0/0xa0 [ 938.051156][ T4203] ? process_one_work+0x85f/0x1010 [ 938.056319][ T4203] ? do_raw_spin_unlock+0x11d/0x230 [ 938.061815][ T4203] kobject_add_internal+0x6e0/0xd90 [ 938.067142][ T4203] kobject_add+0x160/0x230 [ 938.071610][ T4203] ? kobject_init+0x1d0/0x1d0 [ 938.076323][ T4203] ? klist_children_get+0x50/0x50 [ 938.081685][ T4203] ? get_device_parent+0x121/0x3f0 [ 938.087108][ T4203] device_add+0x48c/0x1000 [ 938.093473][ T4203] hci_conn_add_sysfs+0xd1/0x1e0 [ 938.098448][ T4203] le_conn_complete_evt+0xc4b/0x15c0 [ 938.103850][ T4203] ? cs_le_create_conn+0x5e0/0x5e0 [ 938.109178][ T4203] ? __mutex_trylock_common+0x155/0x260 [ 938.114737][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 938.119684][ T4203] ? hci_event_packet+0x37e/0x1370 [ 938.124809][ T4203] ? __lock_acquire+0x7d10/0x7d10 [ 938.129967][ T4203] ? hci_remote_host_features_evt+0x290/0x290 [ 938.136130][ T4203] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 938.142386][ T4203] ? mark_lock+0x94/0x320 [ 938.146852][ T4203] ? mutex_unlock+0x10/0x10 [ 938.151712][ T4203] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 938.157787][ T4203] ? lock_chain_count+0x20/0x20 [ 938.162636][ T4203] ? __rwlock_init+0x140/0x140 [ 938.167406][ T4203] hci_event_packet+0xe4b/0x1370 [ 938.172345][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 938.177547][ T4203] ? rcu_lock_release+0x20/0x20 [ 938.182410][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 938.187704][ T4203] hci_rx_work+0x255/0xa10 [ 938.192228][ T4203] process_one_work+0x85f/0x1010 [ 938.197215][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 938.202941][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 938.208236][ T4203] ? _raw_spin_lock_irq+0xb7/0xf0 [ 938.213265][ T4203] ? _raw_spin_lock_irqsave+0x100/0x100 [ 938.218817][ T4203] ? wq_worker_running+0x97/0x170 [ 938.223961][ T4203] worker_thread+0xaa6/0x1290 [ 938.228781][ T4203] kthread+0x436/0x520 [ 938.233130][ T4203] ? rcu_lock_release+0x20/0x20 [ 938.238010][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 938.242625][ T4203] ret_from_fork+0x1f/0x30 [ 938.248064][ T4203] [ 938.251187][ C0] vkms_vblank_simulate: vblank timer overrun [ 938.257989][ T4203] kobject_add_internal failed for hci8:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 938.273545][ T4203] Bluetooth: hci8: failed to register connection device [ 938.280972][ T4203] Bluetooth: hci8: link tx timeout [ 938.286222][ T4203] Bluetooth: hci8: killing stalled connection 10:aa:aa:aa:aa:aa [ 938.294438][ T4203] Bluetooth: hci8: link tx timeout [ 938.299731][ T4203] Bluetooth: hci8: killing stalled connection 00:00:00:00:00:00 [ 938.307467][ T4203] Bluetooth: hci8: killing stalled connection 00:00:00:00:00:00 [ 938.315172][ T4203] Bluetooth: hci8: killing stalled connection 11:aa:aa:aa:aa:aa [ 938.790353][ T4700] usb 10-1: new high-speed USB device number 21 using dummy_hcd [ 939.116462][ T4700] usb 10-1: Using ep0 maxpacket: 32 [ 939.297491][ T4700] usb 10-1: config 0 has an invalid interface number: 35 but max is 0 [ 939.387620][ T4700] usb 10-1: config 0 has no interface number 0 [ 939.476900][ T4700] usb 10-1: config 0 interface 35 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 939.521219][T14267] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2161'. [ 939.536342][ T4700] usb 10-1: config 0 interface 35 altsetting 0 endpoint 0x85 has invalid wMaxPacketSize 0 [ 939.622231][T14261] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 939.628813][T14261] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 939.635591][T14267] bridge0: port 2(bridge_slave_1) entered disabled state [ 939.638868][T14261] vhci_hcd vhci_hcd.0: Device attached [ 939.643885][T14267] bridge0: port 1(bridge_slave_0) entered disabled state [ 939.748331][T14268] netlink: 52 bytes leftover after parsing attributes in process `syz.1.2161'. [ 939.820692][ T4700] usb 10-1: New USB device found, idVendor=10c4, idProduct=818a, bcdDevice=7d.ad [ 939.833863][ T4700] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 939.863447][ T4700] usb 10-1: Product: syz [ 939.878022][ T4700] usb 10-1: Manufacturer: syz [ 939.882795][ T4700] usb 10-1: SerialNumber: syz [ 939.893284][T14269] vhci_hcd: connection closed [ 939.983780][ T145] vhci_hcd: stop threads [ 939.995026][ T4700] usb 10-1: config 0 descriptor?? [ 940.000278][ T145] vhci_hcd: release socket [ 940.014490][ T145] vhci_hcd: disconnect device [ 940.063533][ T13] vhci_hcd: vhci_device speed not set [ 940.286563][ T4700] radio-si470x 10-1:0.35: this is not a si470x device. [ 940.390626][ T4700] radio-raremono 10-1:0.35: Thanko's Raremono connected: (10C4:818A) [ 941.831755][T14312] block device autoloading is deprecated and will be removed. [ 941.854074][ T4700] radio-raremono 10-1:0.35: V4L2 device registered as radio48 [ 941.917686][ T4700] usb 10-1: USB disconnect, device number 21 [ 942.122154][ T4700] radio-raremono 10-1:0.35: Thanko's Raremono disconnected [ 943.305213][T14347] loop1: detected capacity change from 0 to 2048 [ 943.409863][T14347] UDF-fs: INFO Mounting volume 'LiuxUDF', timestamp 2022/11/22 14:59 (1000) [ 943.504845][ T26] audit: type=1800 audit(1782263055.508:151): pid=14347 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2180" name="file1" dev="loop1" ino=1369 res=0 errno=0 [ 944.506386][ T13] Bluetooth: hci8: command 0x0406 tx timeout [ 944.726850][T14367] program syz.9.2185 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 948.171386][T14426] netlink: 'syz.9.2199': attribute type 2 has an invalid length. [ 948.677520][T14442] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2201'. [ 950.060170][T14456] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 952.017702][T14492] tipc: Enabling of bearer rejected, failed to enable media [ 952.329522][T14496] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2213'. [ 952.884543][T14515] netlink: 12 bytes leftover after parsing attributes in process `syz.3.2216'. [ 955.311251][T14540] device syzkaller0 entered promiscuous mode [ 955.363627][T14540] tipc: Enabled bearer , priority 0 [ 955.417267][T14539] tipc: Resetting bearer [ 955.517259][T14539] tipc: Disabling bearer [ 956.976763][ T26] audit: type=1326 audit(1782263068.978:152): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=14567 comm="syz.9.2231" exe="/root/ci2-linux-5-15-kasan/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f6d09d4ee59 code=0x0 [ 959.440941][T14609] tipc: Enabling of bearer rejected, failed to enable media [ 961.480199][T14665] netlink: 36 bytes leftover after parsing attributes in process `syz.4.2250'. [ 962.462702][T14678] tipc: Enabling of bearer rejected, failed to enable media [ 964.330236][T14697] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(5) [ 964.337104][T14697] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 964.368598][T14697] vhci_hcd vhci_hcd.0: Device attached [ 964.419941][T14698] vhci_hcd: connection closed [ 964.443755][ T4290] vhci_hcd: stop threads [ 964.487482][ T4290] vhci_hcd: release socket [ 964.501912][ T4290] vhci_hcd: disconnect device [ 964.636478][ T5582] vhci_hcd: vhci_device speed not set [ 964.770457][T14711] netlink: 36 bytes leftover after parsing attributes in process `syz.3.2265'. [ 965.563459][T14712] nf_conntrack: default automatic helper assignment has been turned off for security reasons and CT-based firewall rule not found. Use the iptables CT target to attach helpers instead. [ 967.446768][ T4700] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 967.746543][ T4700] usb 5-1: Using ep0 maxpacket: 16 [ 968.006801][ T4700] usb 5-1: config 1 has an invalid interface number: 105 but max is 0 [ 968.026775][ T4700] usb 5-1: config 1 has no interface number 0 [ 968.049342][ T4700] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x4 has invalid maxpacket 16 [ 968.109534][ T4700] usb 5-1: config 1 interface 105 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 64 [ 968.148080][ T4700] usb 5-1: config 1 interface 105 has no altsetting 0 [ 968.356549][ T4700] usb 5-1: New USB device found, idVendor=20f4, idProduct=e05a, bcdDevice=6c.6d [ 968.402699][ T4700] usb 5-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 968.423938][ T4700] usb 5-1: Product: syz [ 968.446798][ T4700] usb 5-1: Manufacturer: syz [ 968.451464][ T4700] usb 5-1: SerialNumber: syz [ 968.516840][T14725] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 968.626684][T14725] raw-gadget.0 gadget: fail, usb_ep_enable returned -22 [ 970.976610][ T4700] aqc111: probe of 5-1:1.105 failed with error -71 [ 971.023202][ T4700] usb 5-1: USB disconnect, device number 3 [ 978.320325][T14909] KVM: KVM_SET_CPUID{,2} after KVM_RUN may cause guest instability [ 978.340576][T14909] KVM: KVM_SET_CPUID{,2} will fail after KVM_RUN starting with Linux 5.16 [ 978.737691][ T4238] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 979.116599][ T4238] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 979.156407][ T4238] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 979.190605][ T4238] usb 5-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 979.234421][ T4238] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 979.285800][ T4238] usb 5-1: config 0 descriptor?? [ 979.430811][T14957] binder: 14956:14957 unknown command 0 [ 979.451134][T14957] binder: 14956:14957 ioctl c0306201 200000000100 returned -22 [ 979.611685][T14970] tipc: Enabling of bearer rejected, failed to enable media [ 979.799482][ T4238] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 979.831077][ T4238] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 979.856502][ T4238] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 979.890206][ T4238] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 979.902612][ T4203] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci0/hci0:201' [ 979.912577][ T4203] CPU: 0 PID: 4203 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 979.920163][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 979.930269][ T4203] Workqueue: hci0 hci_rx_work [ 979.935080][ T4203] Call Trace: [ 979.938681][ T4203] [ 979.941649][ T4203] dump_stack_lvl+0x188/0x250 [ 979.946455][ T4203] ? show_regs_print_info+0x20/0x20 [ 979.951690][ T4203] ? load_image+0x400/0x400 [ 979.956262][ T4203] sysfs_create_dir_ns+0x26a/0x290 [ 979.961498][ T4203] ? sysfs_warn_dup+0xa0/0xa0 [ 979.966354][ T4203] ? process_one_work+0x85f/0x1010 [ 979.971521][ T4203] ? do_raw_spin_unlock+0x11d/0x230 [ 979.972696][ T21] usb 2-1: new high-speed USB device number 15 using dummy_hcd [ 979.976760][ T4203] kobject_add_internal+0x6e0/0xd90 [ 979.976844][ T4203] kobject_add+0x160/0x230 [ 979.994083][ T4203] ? kobject_init+0x1d0/0x1d0 [ 979.998799][ T4203] ? klist_children_get+0x50/0x50 [ 980.003855][ T4203] ? get_device_parent+0x121/0x3f0 [ 980.008992][ T4203] device_add+0x48c/0x1000 [ 980.013431][ T4203] hci_conn_add_sysfs+0xd1/0x1e0 [ 980.018393][ T4203] le_conn_complete_evt+0xc4b/0x15c0 [ 980.023699][ T4203] ? cs_le_create_conn+0x5e0/0x5e0 [ 980.028821][ T4203] ? __mutex_trylock_common+0x155/0x260 [ 980.034377][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 980.039322][ T4203] ? hci_event_packet+0x37e/0x1370 [ 980.044440][ T4203] ? __lock_acquire+0x7d10/0x7d10 [ 980.049474][ T4203] ? hci_remote_host_features_evt+0x290/0x290 [ 980.055561][ T4203] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 980.061202][ T4203] ? mark_lock+0x94/0x320 [ 980.065538][ T4203] ? mutex_unlock+0x10/0x10 [ 980.070048][ T4203] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 980.076042][ T4203] ? lock_chain_count+0x20/0x20 [ 980.080915][ T4203] ? __rwlock_init+0x140/0x140 [ 980.085890][ T4203] hci_event_packet+0xe4b/0x1370 [ 980.090961][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 980.096192][ T4203] ? rcu_lock_release+0x20/0x20 [ 980.101070][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 980.106556][ T4203] hci_rx_work+0x255/0xa10 [ 980.111189][ T4203] process_one_work+0x85f/0x1010 [ 980.116181][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 980.121816][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 980.127213][ T4203] ? _raw_spin_lock_irq+0xb7/0xf0 [ 980.132336][ T4203] ? _raw_spin_lock_irqsave+0x100/0x100 [ 980.138073][ T4203] ? wq_worker_running+0x97/0x170 [ 980.143105][ T4203] worker_thread+0xaa6/0x1290 [ 980.147900][ T4203] kthread+0x436/0x520 [ 980.152262][ T4203] ? rcu_lock_release+0x20/0x20 [ 980.157122][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 980.161715][ T4203] ret_from_fork+0x1f/0x30 [ 980.166141][ T4203] [ 980.169230][ C0] vkms_vblank_simulate: vblank timer overrun [ 980.177233][ T4203] kobject_add_internal failed for hci0:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 980.190752][ T4203] Bluetooth: hci0: failed to register connection device [ 980.198196][ T4238] playstation 0003:054C:0DF2.0005: unknown main item tag 0x0 [ 980.215528][ T4238] playstation 0003:054C:0DF2.0005: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.4-1/input0 [ 980.346523][ T4238] playstation 0003:054C:0DF2.0005: Invalid byte count transferred, expected 20 got 0 [ 980.356567][ T4238] playstation 0003:054C:0DF2.0005: Failed to retrieve DualSense pairing info: -22 [ 980.366131][ T4238] playstation 0003:054C:0DF2.0005: Failed to get MAC address from DualSense [ 980.374998][ T4238] playstation 0003:054C:0DF2.0005: Failed to create dualsense. [ 980.386548][ T4238] playstation: probe of 0003:054C:0DF2.0005 failed with error -22 [ 980.522508][ T21] usb 2-1: config 0 has no interfaces? [ 980.529724][ T21] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 980.552505][ T21] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 980.574174][ T21] usb 2-1: config 0 descriptor?? [ 980.659918][ T21] usb 5-1: USB disconnect, device number 4 [ 980.849363][ T5582] usb 2-1: USB disconnect, device number 15 [ 981.242077][T15029] tipc: Started in network mode [ 981.252804][T15029] tipc: Node identity f22caefa154a, cluster identity 4711 [ 981.264826][T15029] tipc: Enabled bearer , priority 0 [ 981.277608][T15028] tipc: Disabling bearer [ 981.587123][ T5582] usb 2-1: new high-speed USB device number 16 using dummy_hcd [ 981.621903][ T4203] sysfs: cannot create duplicate filename '/devices/virtual/bluetooth/hci3/hci3:201' [ 981.632578][ T4203] CPU: 0 PID: 4203 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 981.640469][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 981.650765][ T4203] Workqueue: hci3 hci_rx_work [ 981.655499][ T4203] Call Trace: [ 981.658799][ T4203] [ 981.661760][ T4203] dump_stack_lvl+0x188/0x250 [ 981.666479][ T4203] ? show_regs_print_info+0x20/0x20 [ 981.671706][ T4203] ? load_image+0x400/0x400 [ 981.676450][ T4203] sysfs_create_dir_ns+0x26a/0x290 [ 981.681602][ T4203] ? sysfs_warn_dup+0xa0/0xa0 [ 981.686313][ T4203] ? process_one_work+0x85f/0x1010 [ 981.691459][ T4203] ? do_raw_spin_unlock+0x11d/0x230 [ 981.696693][ T4203] kobject_add_internal+0x6e0/0xd90 [ 981.701937][ T4203] kobject_add+0x160/0x230 [ 981.706400][ T4203] ? kobject_init+0x1d0/0x1d0 [ 981.711221][ T4203] ? klist_children_get+0x50/0x50 [ 981.716384][ T4203] ? get_device_parent+0x121/0x3f0 [ 981.721736][ T4203] device_add+0x48c/0x1000 [ 981.726206][ T4203] hci_conn_add_sysfs+0xd1/0x1e0 [ 981.731203][ T4203] le_conn_complete_evt+0xc4b/0x15c0 [ 981.736635][ T4203] ? cs_le_create_conn+0x5e0/0x5e0 [ 981.742003][ T4203] ? __mutex_trylock_common+0x155/0x260 [ 981.747682][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 981.752573][ T4203] ? hci_event_packet+0x37e/0x1370 [ 981.757722][ T4203] ? __lock_acquire+0x7d10/0x7d10 [ 981.762809][ T4203] ? hci_remote_host_features_evt+0x290/0x290 [ 981.769176][ T4203] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 981.774851][ T4203] ? mark_lock+0x94/0x320 [ 981.779223][ T4203] ? mutex_unlock+0x10/0x10 [ 981.783771][ T4203] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 981.789801][ T4203] ? lock_chain_count+0x20/0x20 [ 981.794756][ T4203] ? __rwlock_init+0x140/0x140 [ 981.799562][ T4203] hci_event_packet+0xe4b/0x1370 [ 981.804637][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 981.809989][ T4203] ? rcu_lock_release+0x20/0x20 [ 981.814877][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 981.820112][ T4203] hci_rx_work+0x255/0xa10 [ 981.824576][ T4203] process_one_work+0x85f/0x1010 [ 981.829570][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 981.835242][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 981.840577][ T4203] ? _raw_spin_lock_irq+0xb7/0xf0 [ 981.846140][ T4203] ? _raw_spin_lock_irqsave+0x100/0x100 [ 981.851733][ T4203] ? wq_worker_running+0x97/0x170 [ 981.856804][ T4203] worker_thread+0xaa6/0x1290 [ 981.861563][ T4203] kthread+0x436/0x520 [ 981.865757][ T4203] ? rcu_lock_release+0x20/0x20 [ 981.870692][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 981.875352][ T4203] ret_from_fork+0x1f/0x30 [ 981.879914][ T4203] [ 981.883018][ C0] vkms_vblank_simulate: vblank timer overrun [ 982.077552][ T4203] kobject_add_internal failed for hci3:201 with -EEXIST, don't try to register things with the same name in the same directory. [ 982.092450][ T4203] Bluetooth: hci3: failed to register connection device [ 982.100761][ T5582] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 982.169205][ T4203] ================================================================== [ 982.178118][ T4203] BUG: KASAN: use-after-free in l2cap_connect_cfm+0x6ff/0x10f0 [ 982.185912][ T4203] Read of size 8 at addr ffff888071ca9488 by task kworker/u5:5/4203 [ 982.193913][ T4203] [ 982.196257][ T4203] CPU: 1 PID: 4203 Comm: kworker/u5:5 Not tainted syzkaller #0 [ 982.203816][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 982.213905][ T4203] Workqueue: hci3 hci_rx_work [ 982.218623][ T4203] Call Trace: [ 982.221922][ T4203] [ 982.224883][ T4203] dump_stack_lvl+0x188/0x250 [ 982.229591][ T4203] ? show_regs_print_info+0x20/0x20 [ 982.234819][ T4203] ? load_image+0x400/0x400 [ 982.239358][ T4203] ? _raw_spin_lock_irqsave+0xbc/0x100 [ 982.244842][ T4203] ? __mutex_unlock_slowpath+0x658/0x6c0 [ 982.250540][ T4203] print_address_description+0x60/0x2d0 [ 982.256200][ T4203] ? l2cap_connect_cfm+0x6ff/0x10f0 [ 982.261420][ T4203] kasan_report+0xdf/0x130 [ 982.265982][ T4203] ? l2cap_connect_cfm+0x6ff/0x10f0 [ 982.271328][ T4203] l2cap_connect_cfm+0x6ff/0x10f0 [ 982.276484][ T4203] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 982.281799][ T4203] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 982.287221][ T4203] le_conn_complete_evt+0xd45/0x15c0 [ 982.292592][ T4203] ? cs_le_create_conn+0x5e0/0x5e0 [ 982.297820][ T4203] ? __mutex_trylock_common+0x155/0x260 [ 982.303407][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 982.308283][ T4203] ? hci_event_packet+0x37e/0x1370 [ 982.313418][ T4203] ? __lock_acquire+0x7d10/0x7d10 [ 982.318483][ T4203] ? hci_remote_host_features_evt+0x290/0x290 [ 982.324694][ T4203] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 982.330356][ T4203] ? mark_lock+0x94/0x320 [ 982.334793][ T4203] ? mutex_unlock+0x10/0x10 [ 982.339334][ T4203] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 982.345441][ T4203] ? lock_chain_count+0x20/0x20 [ 982.350320][ T4203] ? __rwlock_init+0x140/0x140 [ 982.355112][ T4203] hci_event_packet+0xe4b/0x1370 [ 982.360161][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 982.365478][ T4203] ? rcu_lock_release+0x20/0x20 [ 982.370391][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 982.375688][ T4203] hci_rx_work+0x255/0xa10 [ 982.380166][ T4203] process_one_work+0x85f/0x1010 [ 982.385170][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 982.391058][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 982.396384][ T4203] ? _raw_spin_lock_irq+0xb7/0xf0 [ 982.401447][ T4203] ? _raw_spin_lock_irqsave+0x100/0x100 [ 982.407061][ T4203] ? wq_worker_running+0x97/0x170 [ 982.412305][ T4203] worker_thread+0xaa6/0x1290 [ 982.417073][ T4203] kthread+0x436/0x520 [ 982.421268][ T4203] ? rcu_lock_release+0x20/0x20 [ 982.426336][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 982.431205][ T4203] ret_from_fork+0x1f/0x30 [ 982.436045][ T4203] [ 982.439355][ T4203] [ 982.441819][ T4203] Allocated by task 4203: [ 982.446452][ T4203] __kasan_kmalloc+0xb5/0xf0 [ 982.451087][ T4203] l2cap_chan_create+0x4c/0x730 [ 982.456196][ T4203] l2cap_sock_alloc+0x13a/0x200 [ 982.461719][ T4203] l2cap_sock_new_connection_cb+0xe0/0x1d0 [ 982.467642][ T4203] l2cap_connect_cfm+0x35d/0x10f0 [ 982.473004][ T4203] le_conn_complete_evt+0xd45/0x15c0 [ 982.478326][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 982.483219][ T4203] hci_event_packet+0xe4b/0x1370 [ 982.488189][ T4203] hci_rx_work+0x255/0xa10 [ 982.492821][ T4203] process_one_work+0x85f/0x1010 [ 982.497784][ T4203] worker_thread+0xaa6/0x1290 [ 982.502493][ T4203] kthread+0x436/0x520 [ 982.506594][ T4203] ret_from_fork+0x1f/0x30 [ 982.511038][ T4203] [ 982.513377][ T4203] Freed by task 15041: [ 982.517464][ T4203] kasan_set_track+0x4b/0x70 [ 982.522082][ T4203] kasan_set_free_info+0x1f/0x40 [ 982.527055][ T4203] ____kasan_slab_free+0xd5/0x110 [ 982.532114][ T4203] slab_free_freelist_hook+0xea/0x170 [ 982.537517][ T4203] kfree+0xef/0x2a0 [ 982.541357][ T4203] l2cap_sock_cleanup_listen+0xea/0x270 [ 982.546932][ T4203] l2cap_sock_release+0x66/0x1e0 [ 982.551899][ T4203] sock_close+0xd5/0x240 [ 982.556257][ T4203] __fput+0x234/0x930 [ 982.560259][ T4203] task_work_run+0x125/0x1a0 [ 982.564891][ T4203] exit_to_user_mode_loop+0x10f/0x130 [ 982.570412][ T4203] exit_to_user_mode_prepare+0xee/0x180 [ 982.576119][ T4203] syscall_exit_to_user_mode+0x16/0x40 [ 982.581630][ T4203] do_syscall_64+0x58/0xa0 [ 982.586114][ T4203] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 982.592049][ T4203] [ 982.594394][ T4203] Last potentially related work creation: [ 982.600424][ T4203] kasan_save_stack+0x35/0x60 [ 982.605142][ T4203] kasan_record_aux_stack+0xb8/0x100 [ 982.610454][ T4203] call_rcu+0x189/0x950 [ 982.614643][ T4203] __vlan_del+0x77c/0x920 [ 982.619013][ T4203] br_vlan_flush+0x23e/0x3b0 [ 982.623634][ T4203] br_dev_uninit+0x2a/0x70 [ 982.628221][ T4203] unregister_netdevice_many+0x1417/0x19f0 [ 982.634148][ T4203] default_device_exit_batch+0x364/0x3c0 [ 982.639903][ T4203] cleanup_net+0x791/0xba0 [ 982.644355][ T4203] process_one_work+0x85f/0x1010 [ 982.649327][ T4203] worker_thread+0xaa6/0x1290 [ 982.654063][ T4203] kthread+0x436/0x520 [ 982.658175][ T4203] ret_from_fork+0x1f/0x30 [ 982.662628][ T4203] [ 982.664977][ T4203] The buggy address belongs to the object at ffff888071ca9000 [ 982.664977][ T4203] which belongs to the cache kmalloc-2k of size 2048 [ 982.679089][ T4203] The buggy address is located 1160 bytes inside of [ 982.679089][ T4203] 2048-byte region [ffff888071ca9000, ffff888071ca9800) [ 982.692717][ T4203] The buggy address belongs to the page: [ 982.698468][ T4203] page:ffffea0001c72a00 refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x71ca8 [ 982.709619][ T4203] head:ffffea0001c72a00 order:3 compound_mapcount:0 compound_pincount:0 [ 982.718678][ T4203] flags: 0xfff00000010200(slab|head|node=0|zone=1|lastcpupid=0x7ff) [ 982.726719][ T4203] raw: 00fff00000010200 0000000000000000 0000000100000001 ffff888016c42000 [ 982.735345][ T4203] raw: 0000000000000000 0000000080080008 00000001ffffffff 0000000000000000 [ 982.744045][ T4203] page dumped because: kasan: bad access detected [ 982.750669][ T4203] page_owner tracks the page as allocated [ 982.756528][ T4203] page last allocated via order 3, migratetype Unmovable, gfp_mask 0x1d20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC|__GFP_HARDWALL), pid 4942, ts 154116789247, free_ts 133359052040 [ 982.777243][ T4203] get_page_from_freelist+0x1bbd/0x1ca0 [ 982.782831][ T4203] __alloc_pages+0x1ee/0x480 [ 982.787458][ T4203] new_slab+0xc0/0x4b0 [ 982.791556][ T4203] ___slab_alloc+0x80a/0xdd0 [ 982.796455][ T4203] kmem_cache_alloc_trace+0x1a5/0x2a0 [ 982.801875][ T4203] nbp_vlan_add+0x1d7/0x370 [ 982.806495][ T4203] br_vlan_info+0xfd/0x460 [ 982.810954][ T4203] br_process_vlan_info+0x545/0x7f0 [ 982.816175][ T4203] br_afspec+0x1ec/0x4d0 [ 982.820451][ T4203] br_setlink+0x2da/0x8c0 [ 982.824818][ T4203] rtnl_bridge_setlink+0x4ba/0x720 [ 982.830068][ T4203] rtnetlink_rcv_msg+0x844/0xf30 [ 982.835088][ T4203] netlink_rcv_skb+0x1f5/0x440 [ 982.839974][ T4203] netlink_unicast+0x774/0x920 [ 982.844774][ T4203] netlink_sendmsg+0x8ba/0xbe0 [ 982.849669][ T4203] ____sys_sendmsg+0x5b7/0x8f0 [ 982.854592][ T4203] page last free stack trace: [ 982.859290][ T4203] free_unref_page_prepare+0x637/0x6c0 [ 982.864967][ T4203] free_unref_page+0x8f/0x2a0 [ 982.869684][ T4203] __vunmap+0x8b9/0xa50 [ 982.873882][ T4203] kcov_close+0x27/0x50 [ 982.878277][ T4203] __fput+0x234/0x930 [ 982.882385][ T4203] task_work_run+0x125/0x1a0 [ 982.887063][ T4203] do_exit+0x626/0x20c0 [ 982.891243][ T4203] do_group_exit+0x12e/0x300 [ 982.895984][ T4203] get_signal+0x6d6/0x12d0 [ 982.900571][ T4203] arch_do_signal_or_restart+0xe7/0x12c0 [ 982.906338][ T4203] exit_to_user_mode_loop+0x9e/0x130 [ 982.911755][ T4203] exit_to_user_mode_prepare+0xee/0x180 [ 982.917339][ T4203] syscall_exit_to_user_mode+0x16/0x40 [ 982.922850][ T4203] do_syscall_64+0x58/0xa0 [ 982.927649][ T4203] entry_SYSCALL_64_after_hwframe+0x66/0xd0 [ 982.933793][ T4203] [ 982.936159][ T4203] Memory state around the buggy address: [ 982.941910][ T4203] ffff888071ca9380: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 982.948693][T15081] tipc: Enabling of bearer rejected, failed to enable media [ 982.950096][ T4203] ffff888071ca9400: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 982.967642][ T4203] >ffff888071ca9480: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 982.975819][ T4203] ^ [ 982.980357][ T4203] ffff888071ca9500: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 982.988451][ T4203] ffff888071ca9580: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 982.996627][ T4203] ================================================================== [ 983.004711][ T4203] Disabling lock debugging due to kernel taint [ 983.032330][ T5582] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 983.060876][ T5582] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 983.089639][ T5582] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 983.096419][ T4203] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 983.105989][ T4203] CPU: 0 PID: 4203 Comm: kworker/u5:5 Tainted: G B syzkaller #0 [ 983.114968][ T4203] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/09/2026 [ 983.123957][ T5582] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 983.125045][ T4203] Workqueue: hci3 hci_rx_work [ 983.137831][ T4203] Call Trace: [ 983.141145][ T4203] [ 983.144101][ T4203] dump_stack_lvl+0x188/0x250 [ 983.148810][ T4203] ? show_regs_print_info+0x20/0x20 [ 983.151053][ T5582] usb 2-1: config 0 descriptor?? [ 983.154449][ T4203] ? load_image+0x400/0x400 [ 983.154487][ T4203] panic+0x2e5/0x810 [ 983.154513][ T4203] ? bpf_jit_dump+0xd0/0xd0 [ 983.172669][ T4203] ? _raw_spin_unlock_irqrestore+0x10d/0x120 [ 983.178864][ T4203] ? _raw_spin_unlock+0x40/0x40 [ 983.183836][ T4203] ? l2cap_connect_cfm+0x6ff/0x10f0 [ 983.189104][ T4203] check_panic_on_warn+0x80/0xa0 [ 983.194079][ T4203] ? l2cap_connect_cfm+0x6ff/0x10f0 [ 983.196517][ T5582] usb 2-1: can't set config #0, error -71 [ 983.199301][ T4203] end_report+0x6d/0xf0 [ 983.209287][ T4203] kasan_report+0x102/0x130 [ 983.213826][ T4203] ? l2cap_connect_cfm+0x6ff/0x10f0 [ 983.216931][ T5582] usb 2-1: USB disconnect, device number 16 [ 983.219143][ T4203] l2cap_connect_cfm+0x6ff/0x10f0 [ 983.219177][ T4203] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 983.235368][ T4203] ? l2cap_ertm_resend+0x10d0/0x10d0 [ 983.240687][ T4203] le_conn_complete_evt+0xd45/0x15c0 [ 983.246099][ T4203] ? cs_le_create_conn+0x5e0/0x5e0 [ 983.251343][ T4203] ? __mutex_trylock_common+0x155/0x260 [ 983.256931][ T4203] hci_le_meta_evt+0x285/0x3cb0 [ 983.261821][ T4203] ? hci_event_packet+0x37e/0x1370 [ 983.266976][ T4203] ? __lock_acquire+0x7d10/0x7d10 [ 983.272043][ T4203] ? hci_remote_host_features_evt+0x290/0x290 [ 983.278144][ T4203] ? __mutex_unlock_slowpath+0x1b0/0x6c0 [ 983.283900][ T4203] ? mark_lock+0x94/0x320 [ 983.288361][ T4203] ? mutex_unlock+0x10/0x10 [ 983.292909][ T4203] ? lockdep_hardirqs_on_prepare+0x409/0x770 [ 983.299059][ T4203] ? lock_chain_count+0x20/0x20 [ 983.303943][ T4203] ? __rwlock_init+0x140/0x140 [ 983.308910][ T4203] hci_event_packet+0xe4b/0x1370 [ 983.313881][ T4203] ? lockdep_hardirqs_on+0x94/0x140 [ 983.319556][ T4203] ? rcu_lock_release+0x20/0x20 [ 983.324938][ T4203] ? hci_send_to_monitor+0x9c/0x4a0 [ 983.330501][ T4203] hci_rx_work+0x255/0xa10 [ 983.334967][ T4203] process_one_work+0x85f/0x1010 [ 983.339956][ T4203] ? worker_detach_from_pool+0x240/0x240 [ 983.345793][ T4203] ? lockdep_hardirqs_off+0x70/0x100 [ 983.351222][ T4203] ? _raw_spin_lock_irq+0xb7/0xf0 [ 983.356368][ T4203] ? _raw_spin_lock_irqsave+0x100/0x100 [ 983.362034][ T4203] ? wq_worker_running+0x97/0x170 [ 983.367097][ T4203] worker_thread+0xaa6/0x1290 [ 983.371903][ T4203] kthread+0x436/0x520 [ 983.376004][ T4203] ? rcu_lock_release+0x20/0x20 [ 983.380886][ T4203] ? kthread_blkcg+0xd0/0xd0 [ 983.385594][ T4203] ret_from_fork+0x1f/0x30 [ 983.390211][ T4203] [ 983.393461][ T4203] Kernel Offset: disabled [ 983.397982][ T4203] Rebooting in 86400 seconds..