last executing test programs: 17m0.829069361s ago: executing program 32 (id=1596): ioctl$vim2m_VIDIOC_EXPBUF(0xffffffffffffffff, 0xc0405610, &(0x7f00000011c0)={0x0, 0x6, 0xdb3, 0x0, 0xffffffffffffffff}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x3, &(0x7f0000000000)=[{0x0, 0x0, 0x9}, {0x7c, 0x0, 0xf7}, {0x6, 0x0, 0x0, 0x7fffffff}]}) r1 = open(0x0, 0x109400, 0x80) ioctl$BTRFS_IOC_DEV_INFO(0xffffffffffffffff, 0xd000941e, &(0x7f0000000180)={0x0, "7feb448544b672254429113a5e1bde66"}) r3 = add_key$keyring(&(0x7f00000000c0), &(0x7f00000002c0)={'syz', 0x3}, 0x0, 0x0, 0xffffffffffffffff) syz_open_dev$evdev(&(0x7f0000001180), 0x9, 0x2ab00) ioctl$TIOCGSID(r1, 0x5429, &(0x7f0000002700)=0x0) sched_setaffinity(r4, 0x8, &(0x7f0000002740)=0x8000) request_key(&(0x7f0000000100)='asymmetric\x00', &(0x7f0000000140)={'syz', 0x1}, &(0x7f0000000180)='keyring\x00', r3) mremap(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0x2000, 0x7, &(0x7f0000ffd000/0x2000)=nil) keyctl$restrict_keyring(0xa, r3, &(0x7f0000000300)='asymmetric\x00', &(0x7f0000000000)='id:cb2e') ioctl$BTRFS_IOC_RESIZE(r0, 0x50009403, &(0x7f0000000040)={{}, {@val={r2}, @max}}) r5 = socket$nl_rdma(0x10, 0x3, 0x14) syz_mount_image$fuse(0x0, &(0x7f0000002280)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000080)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount_setattr(r7, &(0x7f0000000080)='./file0\x00', 0x9000, &(0x7f00000000c0)={0x0, 0x74, 0x100000}, 0x20) ioctl$SNDRV_TIMER_IOCTL_CREATE(0xffffffffffffffff, 0xc02054a5, &(0x7f0000001200)={0x10001, r5, 'id1\x00'}) sendmmsg$inet6(r8, &(0x7f00000038c0)=[{{&(0x7f0000001280)={0xa, 0x4e25, 0x200, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x52}, 0x1c, &(0x7f00000026c0)=[{&(0x7f00000012c0)="4ab65d59137030481ff76a2df863c482afb4be0b97cc492221a6bac3dd00350218aaa2ff3c2a2330d5ee76d62c31e69d803ab863ee643be540c1929922f5f58f12d312309e14cc43d03c6b72daf8d12ba162f6c03653e32ba07a97a019ce4ae4191987769b9a2e6bee4d9c89f9a62abda0afcc94253e775c60410bc2a867374cda5970e6ee2898e0481ec1d40cb9a4a2239b89340ae5add68223592b110c4aca7703f06bc58708333e6dcb23f90b4c54a6001bb52f95370462851bc90afed0bd3a241de7b4eedd72eea482dbff8bcb7220c72a34c6ada65ba4e16aa43ab53b4c96144875e98b293541aa5869059b76cdc2fb875fc43d8799ca228d304629ae2561f1bc8a943e061aa7da251801407424ff6c45f6617cbe1153cac92c4603e37ccec72287134ae24db6aa8ec631f7bc52944b6fd8213ed2e10935a0c501c5f7537463b481cce1362ce8c43cc1bddd0a969d4b90a26d823f2cc0c19247e2066986f7ec9f97249c3336a1e8592a9db5f8adbcf88202382c3945a8d28e26dfc04e5bb341c4772b567628fe2857e54ba968993998d878e2130bc0bffc44473e098d064e62ab52808bef976f4b2b1a47e52b23bdc0cd4c6ed977f6db745665df25ff05667f22810df64eeb844ecaa10dc070f60163355746cfcc43db49ae324e25f7df647973fb0d37c82a0529f9ca434e4828e5629eb9f7ba8475e72c2688e5e5c0c81a851eacacb40f0c885904956240afbacfe2a08b75824edb1870736eea5e264fcaf9a25e29193b6b04cd31d071cdbc5f473ffcd48ee82058bff720ccc8714e79b2c273164807b95e17ec85bc876fce49e031d34629b8c6b7556eb7b2f468d1554cfaa4a3139dca5f232bee8baaa689183ab6f837636dbe54dc5bab372ad3b711575ef8bf2d5b5c0f341ea9ba57c65dcf966ba5b2db663bb6e991c27ada40397a6d4cc9768dae56dbfc2b6f1f400f342f684422e1a664b7901106eb45e891ca443d453668e69c44654477fe500b09e29fb4331347bf8552af2c8f107308450d4b50724a2480deb014619d1dbbebf3c81a7bedad7ee1ba0d4b4d5e550bd68d18bf2cd5cd6340ffeec2e2b24f2094313a67c9363b4d41e4b97292a4220f9333fdeadfedc9557952f43d809b4b73fab6d14617f52d690ccf75df4d6f726c86ad1a537490b5e55fb81d6103176126673e3e117439213754cfa18380a51dcbe63694303b9cbc678530d36e917b86b9f2698cd0c292f10520d2af1e29ed58358f8e2357e05d3d0b8146bb75ff6a21dd2ee7264c5cc73719fd003d6644d4e4aa7f4f19d2334aec72931293247b26527f57e5d7d6c5fdef36f9ccdb179d8f725125aa952c1c08db467dd99a58786a3089fae13e863cc0486e9520e2ed38d29ddd115a6595e178aa3f9d36ad51d884755b1d70df47e328eb2c378c9e7011a6e55cc479f9167c26402e0ad0517c9778789cf101b1d67ffa223b3db8f6ca3739182f459436a0e6ebb7494490d03ec05c4530d0042aff4e154510254596d0862fcd9999f19535c08bf13aa0d5f97a09473ab5baced6ffb51349ac9fe42d058e29a0470b2707599793e5ceec63db29dc853b800c95f06412dc2732e9d40cecde05e9701818b957ca65f11a1e5b3db4ec5abeca034bee6b97dc31ccf3a29f7a6d2036e94e7d60d80fcfdd7f21b75e5553c9916c194e99f9040691162b5ac9e89232d847e8293a24d169a103d4c32bfe428c1a1df8aec3d0e2143f3fb43c2e77b324a25b5cb2f296e5348075caf22f160ce18cf5a36f29fc01872b85a6d9ec97e29afe509c56eb4c93ac9f78da8e689b9b80c5266cf9a9625b9e07e692c160638383bd612ebb46ef1bb56208d8821d3b41358a24392733ebd3fa3377cf973ffcced1d04d75dd507a729839c5eed55af86ea4eab98c610b10236e09d2f5ae2046d85f531143d38d02d583768aac8ea610b7de4a3578468ed18fd3e027b3a6d66ecdff94cfb30a7fd051dc31a184de118c872a78e326e95fd04cf7cefde9943b8b245ec745771d9f62fb4cc191841104a392cf469d288d8ed5123107324ec23bdffa719577a2ad7ed496c06e1646fec95a6319ebcab074f9fdb7c26fc2d584e255ec9ac2a9ab1c06a32e1f1fc1866fb22de1d401d14282ff4f5e1d4e7e76075873ebf08c0c44bd425c46edf9bf9739fd68bd341a5636742db04a83e39844b5a6052a0dd2ebd00225c56a37e485bf2c19d9cdb30cb8426d4282af6423f829ba6f560ddf139c7e9fbd15637e39d1ad7de81881432cedbe552433a35dc471528d456b9e5401af3386788737639c13a2472bb7bf50fb4412f4a90dfcf7beb442a358de4ad00e8fc9afe675bd471c25b783e496cb122f65d3dd0acde596ec56e61baf98bb55c411d5bc1f1f5b3e326ed2e30e45d35f1481134d1c547545f96175b21693cd331652c52fe62568f7fff3952aec186436f1a20d931190b0bef358ea52eba85f4d8a03e369ccc362a8dc8e1e1338ceb0ab64c5f599879d7f60eb126426ea204e18be504ea35b0f1e3c9c7035d45cac3c7c5ca55bddb64662d80424196122909a957c027f7198fe1aec86b75c70b4e992452bcb9993d207d9aa7799c2eea3ccfd6f0f696b350328b730d9eeea58d17b389ad4b70ba79bbe9c8f04dfaa9a14cbb38094c943a9a2b8e043d59e00ba29e0ec647a6da8dce8d3263f4a2ed503aaae3a7db229ff58e4c5c25f00963660de9a14d5f448b7fd9bba6ff0beecbcf780b2679b60a54223587c651f5cda2c40131e3da60f5173e0cd428d6510281df32ae6a426705855a14ff1d7eccfa5ef1cc3ce7117688f98540176f8491fb3996c98b917f905a5ac8c63636ce25f7736fcdf72d2d831b0ed423a19bb30a6c622599e5d2d77f0dbe294fc82ea40f1702468c97def94b6e6dddc786d40266eeb3270b4571dd2f3ff53d9b24d07d0ee4b23e3bc85a986602d77796e4fc18aae5b3b3ec5a18354eed7e79f360027f86bfd08751c85a1ff4152ec6b84624506ae4ff542cbbc6cc4a719744d03e2ac964e9c19a802d200cdd6ca3d705aec3cc3dc1a54a6c053eebe4f4b6fcea1520a0ac50a5beedc78624736f59642db9429e6572951a6b6eb7a277172e77412ff38a9c16c69a41001f694881efa6757fcd92a90ae6871acb2733e5542d7eb6804a62979b36f48aae937a06a834dffae4ce996a0114948fa0d9e7fa6313f7fc9bebd156ed7367e0264cc475fd983b75a49f959384693e6949bc897e9066d0c629657ee9f79aa309f71bc41f90429ffe971c8e4a267223afc96b006e77b16c402e165401904161e88188d0e740092656a620bfa28d99e0e8b1cd3338a4396443dd0f89e18cc6e740c754ce819e4706e3db660120bcf24f3966a9d5f4f8ff5477aa39ee176e32451ee0839c96a02f62b9466bab0bb68fd3b399d687cd0563bd56f74d9c27b398b088f52991a89e9de41d67afc81a388f8ffbbdae871b0a12a9a6a93c403d442812321ef864fdf7c198233af8e3d886c077e70c3818a5eccc89d203840afc8916891529817eeabfe1ebfbe8e43f1584eb619f6e567e9c96adc31c471abe92dd77227e30ee292c75d2edb3a38ae7c012acfb6306aff2ceda1fddb33c06855336487a705d241d7e85de73a4ff0fb6817bc6cd41744972c9a4ea678f1c05d978a9284e6086dad199680cf173bfb2a84f3b370afd8a01292b3218df6c8d7446a725fd67d815ef404e47786d15df9019e653b260dd139ed3cc4fc786cf128f652832f38ed7085ff53452d6c6eb4bac90dcda854d8a80cdb2dc8bddca9799b37a9fbdf4bb9c1e323c8a948d0a92530fe871eb77750a913a688f171891542fd73687facfd14845dd929c49c0daffcaf997253c9854de08eb32d6854c91d65df46dcd9a1150951709158559b3d228a5cfc1cc91c3728e5415766391accbf12c99809fbb33d9391592d9ddf60acb7c5ee5703127e7d29135d365305afd241da73e270e96bcfdfb826ff874be80954d80deaf9049cd6335978109719c0484f3ef61a741b860417be4ee402afe74d55c5da57fea9d3da7ff3a7ed544ad60098d6f910995c29327313a4e7716b37d9e83fc2307db005466a194af5de0b5184e867b5e8a0170f6cc67f8e7be641edfb61deb90c99baa66a3584218ce6cf5cf26e4f19fae311e3c7ddf1351a502d5a23460b84965f839aeed6d59416ae0c408c0e7a1dcf17548d2b84c6f6fcbf6c62dfc7cba3107f38a3a0937e22bc29b8b9e387539b910f56771b735619571d305f805d8420900144d6dd4ea7b9ec62af9071ac97631f77555525c77a7e5be150185ca23a0e4b3c91f4b2f96e7acbde3f0afb164b8af12c4594a29f1899ac15d01f3205f068b06addf0e93fa33ab15d5314852a8d18bcb38a6c2d29cc7166bc95387f07dd82e772c3d2a0fbfd2538ae6c8c1812c670c384d51bfabe8ed63ab5b179b13ad1857512c32be062de12d1d41368120ca9a71764e238ad4b3d5a22de3bf38cd4d9621dff5c84e3830a17ba1535e766ec223c51962b3e8c73a2313a22679e732d697a9eed978292a07d03c8ce71bb51eb1e50ef09bf59177035ca99fb269211ea077bbc34527a9bfdbeb432c0bbe5cfd1efc2f693af719111197d750257242898411da85eb8ab50c48031461fdb0c08f9f9bbc98ce090909e32cb8296aa803a97dd95eb3e2fcda6cfdb21064d53d92d9f9fae77cbe98f08375648a38f7b4cbaf8c5e4fc44f6cae1822dcbc7146a9a3c97e53645890cf2f93bb0349306f990360f87893586d0c295126a24d89fd662f891d1768be325006632552ac3180f1843de001e74d60353450d1bc42a3f6483ba8badb3f55e7e930a9989de991dbc1dbdeb1a94a11c00b96b06c34df23c9e8442cbcbf3d73986619ba2d2ef196afd833c2bc7793afb6906bd801a908585f867374a267a13fa17c9f5a544657533054aa390ad4ecea00f05c430ba2aa8a54dab7b799ff01bd443bf401a8b3a9a73aeb746ad8afc5bb0391aa61532a664455e499378b13c00ba41808941fa9a82747afe53147d901b4c26cf66663248798ed6378eb5b4acad3fcc5a516cc5d7e072af32a0f943b02eaf6e8a22875912715b495fd40d9356f453bc113e389b84e9f774eaf8c0b776388a5fea41a1f49c9743976a3dcd73a7018bdcf68a1090c60628b8330433a01cb31dd7d8fad4ac200902220b2e8e68f24aba6aa5f25da7c8dafa5f9688abf45d1ed24e68d3add33b3bed3142474a04d7472b882ee238782a0a87741e8b204db3659a0b265d98c80b9e85f61695039c8bfd101764c44c56554537fea9a108cf9c8dd725f72cd3b7163a899c18574c38c5b3b0d8bc51018bdc09e498d97f54dcbcef785827424b314650d05b15a469e9dc9287efc68d49466cc9cce3d277fdf2502a983cd3200745c269f32fcbea71646d99daa53e3f9c30cc449f21e821963071e000ba67571020f8989c587e0390bb3943dd21ff9b3c05cf15c88071f7152a3cb5acff0cd5be6ae2a4c5047ce3f17c8102191af088736c763342c3d2011a635ee5305882c5653197135901e5d2a4e118e79dace00f501c4faf844fdc03f473653740854c2720296edd45959c2e6ee239e72bc548a383e26741357d6751cfd43a5e18ee1e404d5c50cae0e96cb05c96d9968b9b7258b2c38b23ae9e3af49621116101635c71e0118195aabab9354fbcc5fb0b6a3091b5b15133f7a6590472e0d9e1b36a44c3154f7d18a768dba44b47b3f575daf3c9153b4bb04d5397416be224d7fc8dad46a8d9ccf2c2331a1c9e7705", 0x1000}, {&(0x7f00000022c0)="3178656cbbf66f3ed35c98c0330da8e06a6efac7d971914a9d61c0864c4524bffb81e34abb6c47539e2c8e8c17ea7df7c715cde26a14731213e9a9522bf6f62d884ecf59ec561ec45790618197cd29e88156bbbce60509795187b6c7109db28baa", 0x61}, {&(0x7f0000002340)="110ac38ca2df15540fc75627cf6769638eabf8e323ea974b67b9f352c485c3a51366512f8d5de6e41bc3471507ea97207aaad9a0bb35c476d5c53a0e", 0x3c}, {&(0x7f0000002380)="1363788214ee9f51794af76e63954605d2cc8e46b9cdc95d886ccccca655b918a8eb7cf440436529addb984a733edd65f1ed3e6439eea4084928056ae24c7c3b3f59048dc6f4fbf2fead4d019c378c9221dad1a763e99bddf6e034ee6152f99dfe1e03f16cd523ec3a05dd6f398e05307ba74492879620945e73e4e565326bfad6d0bd096acaf23d7d75c49d4b0247b3299b8cc75cf707166a1f9ed94485105b3aab36f8468910dcf97cc432ca4d8f9491c3e086eaaec9f5ce1b727367271d8787008627f29ae7b828a8115819e2bb0f83", 0xd1}, {&(0x7f0000002480)="428f329a4f98ede956c30b6c3878562b6ada3915d30014b8002783efa549d86ace127ed967e734dd379d7b570e53bc6daca2d698235c051ebcd4dd5f6927bc7a68e793816960e7a34e73e563548150de23bcc13dc2bfad5119ce76e387863011916f", 0x62}, {&(0x7f0000002500)="94065d9317c1c0cc3323bccc8bbd7843a741f3892299d98b0a3aeefa765091cc9539e973f5ea501e45886fe2587fbcef58e1974ad2320a1f93c8beaaa125e0b13611479fca44b781ae9feaec8c08016e40274e292847ba77ef7826e40f153af172eb9e", 0x63}, {&(0x7f0000002580)="82fedae8df5f9d63ea3a421c2c878a2ee9282c6e691362", 0x17}, {&(0x7f00000025c0)="43be256443b3fc4f88321f5946478a29dcc452ddd621e460f891d1c5545a6e046dccd0539bc605cbef1c02016f1ebeb23916e5b06b90eed64dec683e54838b40c9f742404ef7dcdcfb689dc25f74007035111d5e8d58373d145d35bf33599da9c10e90c8ab5f1a7173eb481c47fce89131b70f72b6dc49f1007a34010d530da47bb3ff159e911bf7edd7609eee55966326db1c657eaee13b760cc3770250334d08e24f6bb7f4ad3c038c4edd99c7c9dbc3039c7ebafabc1dac8b413cabb50829bb2588ed04ebdbf69c88090110cbd2bb498185857d2f35a5bf13d8d89094522973aa", 0xe2}], 0x8, &(0x7f00000039c0)=ANY=[@ANYBLOB="10000000290000003e00000049c500002c00000029000000360000008902000000000000040101c204000007ff06082c1dda3f364f628e04010000000000000029000000390000000800018100000000fe8000000000000000000000000000aa5c000000290000003600000073080000000000000740000000000e09fa070100000000000000000000010100000000000007000000000000000b00000000000000f2ffffffffffffff00000000000032a7b6d3b56e372ba1eecc848c7bc21022489030654cb212062f2563d3f63ddf9d01bbe17bcfffb2a7ee0cadcab4eb6ae9c87e9a6eb83bd5e9785b78e7c66fb1c4"], 0xa8}}], 0x1, 0x20000000) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000002f40)=ANY=[@ANYBLOB="c80000001100a9055c26af0fe6f3739edf250700", @ANYRES32=0x0, @ANYBLOB="0d500000080001001400350073797a6b616c6c65723000000000000008000400fbdc7bff080013"], 0xc8}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$RDMA_NLDEV_CMD_SYS_GET(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=ANY=[@ANYBLOB="40000000061401"], 0x40}}, 0x0) 5m55.497002954s ago: executing program 2 (id=4987): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x1, 0x100008, 0x4, 0x8, 0x1, 0xffffffffffffffff, 0x400000}, 0x50) syz_usb_connect(0x5, 0x0, 0x0, 0x0) sendto$inet6(0xffffffffffffffff, &(0x7f0000847fff), 0x0, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) readv(0xffffffffffffffff, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/112, 0xfdef}], 0x1) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) sendmsg$inet(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{&(0x7f0000000080)="5c00000011006bec9e3be35c6e17aa31076b876c0d000000ba090000160af3653c001ac00400020208000200030001002c000000eab556a705251e618294ff0051f60a84c9f4d4938037e786a6d0000300000000000000ffffc6c953", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0xca352c92cb699c71, 0xffffffffffffffff, 0xd0a55000) unshare(0x2c020400) msgget$private(0x0, 0x0) syz_emit_ethernet(0x56, &(0x7f0000000180)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "39a59f", 0x20, 0x2b, 0x0, @remote, @local, {[@routing={0x3a, 0x0, 0x2, 0x1}], {0x0, 0x0, 0x18, 0x0, @wg=@data}}}}}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000780)={{r1}, &(0x7f0000000100), 0x0}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001e000100000055096dd9000007000000", @ANYRES32, @ANYBLOB="000000000a0002"], 0x28}}, 0x0) 5m52.214440187s ago: executing program 2 (id=4994): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={0x0}}, 0x0) r3 = socket$netlink(0x10, 0x3, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x34, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r5, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x4}}]}, 0x34}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$unix(0x1, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newqdisc={0x78, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0x4c, 0x2, {{0x8001, 0x3151, 0x401, 0x6, 0xaa3c}, 0x3, 0x1, 0x6, 0x6, 0x7, 0x13, 0x11, 0xc, 0x6, 0x7f, {0x3, 0x407c, 0x7, 0x1, 0x2b52, 0x2}}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x400dc}, 0x20000000) 5m52.035002942s ago: executing program 2 (id=4995): r0 = syz_open_dev$ttys(0xc, 0x2, 0x0) ioctl$KIOCSOUND(r0, 0x4b2f, 0x90e) r1 = syz_open_dev$mouse(&(0x7f0000000000), 0x6e, 0xa2003) ioctl$TIOCSISO7816(r1, 0xc0285443, &(0x7f0000000040)={0x8, 0x8, 0x0, 0x9, 0x4}) ioctl$TIOCGPGRP(r1, 0x540f, &(0x7f00000001c0)=0x0) r3 = geteuid() statx(0xffffffffffffffff, &(0x7f0000000200)='./file0\x00', 0x4000, 0x100, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat$random(0xffffff9c, &(0x7f0000000340), 0x0, 0x0) r6 = socket$pppoe(0x18, 0x1, 0x0) r7 = openat$apparmor_thread_exec(0xffffff9c, &(0x7f0000000380), 0x2, 0x0) r8 = eventfd(0xbf2) sendmmsg$unix(r1, &(0x7f0000000440)=[{{&(0x7f0000000080)=@file={0x1, './file0\x00'}, 0x6e, &(0x7f0000000180)=[{&(0x7f0000000100)="0e456baa918f0c450248511e23647c5a53ed95588c7bf3263790", 0x1a}, {&(0x7f0000000140)="a6b9e2305d51316cc4a626404511cd2df94be93e4f4d7310ef009a78e2af4eceb0449c55774456908b9be4e0cebf", 0x2e}], 0x2, &(0x7f00000003c0)=[@cred={{0x18, 0x1, 0x2, {r2, r3, r4}}}, @rights={{0x20, 0x1, 0x1, [r1, r1, r1, r0, r0]}}, @rights={{0x34, 0x1, 0x1, [r5, r6, r0, r0, r0, r1, r0, r7, 0xffffffffffffffff, r8]}}], 0x6c, 0x890}}], 0x1, 0x20048094) accept4(r1, &(0x7f0000000480)=@ax25={{}, [@bcast, @default, @bcast, @null, @null, @rose, @rose, @null]}, &(0x7f0000000500)=0x80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r9 = ioctl$TIOCGPTPEER(r1, 0x5441, 0x2) ioctl$TIOCGDEV(r9, 0x80045432, &(0x7f0000000540)) ioctl$FS_IOC_SETFLAGS(r9, 0x40046602, &(0x7f0000000580)=0x10000000) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x3000, 0x0, &(0x7f0000ff8000/0x3000)=nil) r10 = syz_open_dev$tty1(0xc, 0x4, 0x3) ioctl$TIOCL_SETVESABLANK(r10, 0x541c, &(0x7f00000005c0)) ioctl$DRM_IOCTL_MODE_GETCRTC(r1, 0xc06864a1, &(0x7f0000000640)={&(0x7f0000000600)=[0x0, 0x0], 0x2, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x3, &(0x7f00000006c0)=[0x0, 0x0, 0x0]}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r1, 0xc04064a0, &(0x7f0000000840)={&(0x7f0000000740)=[0x0, 0x0], &(0x7f0000000780)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000007c0)=[0x0], &(0x7f0000000800)=[0x0, 0x0, 0x0, 0x0], 0x2, 0x7, 0x1, 0x4}) ioctl$DRM_IOCTL_MODE_GETENCODER(r1, 0xc01464a6, &(0x7f0000000880)={0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc00c64b5, &(0x7f0000000900)={&(0x7f00000008c0)=[0x0, 0x0, 0x0], 0x3}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r1, 0xc01864c6, &(0x7f0000000980)={&(0x7f0000000940)=[r11, r12, r13, r14, r15], 0x5, 0x800}) r16 = openat$ttyprintk(0xffffff9c, &(0x7f00000009c0), 0x408000, 0x0) ioctl$TIOCSBRK(r16, 0x5427) r17 = syz_open_dev$loop(&(0x7f0000000a00), 0x85d3, 0x20000) ioctl$LOOP_SET_BLOCK_SIZE(r17, 0x4c09, 0xffffffff) 5m51.939689333s ago: executing program 2 (id=4996): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r1, 0x29, 0x2, &(0x7f0000000000)=0x7, 0x4) setsockopt$inet6_int(r1, 0x29, 0x42, &(0x7f0000000040)=0xf2b, 0x4) getsockopt$inet6_buf(r1, 0x29, 0x6, &(0x7f0000001500)=""/17, &(0x7f0000000180)=0x11) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000880)={{r2}, &(0x7f0000000800), &(0x7f0000000840)=r3}, 0x20) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) ioctl$SNDRV_TIMER_IOCTL_TRIGGER(0xffffffffffffffff, 0x54a6) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r4, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r4, 0x0, 0xca, &(0x7f0000003d80)={0x0, 0x0, 0x3, 0x0, @vifc_lcl_addr=@local, @local}, 0x10) r5 = socket$inet_icmp_raw(0x2, 0x3, 0x1) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_ADD_VIF(r6, 0x0, 0xca, &(0x7f00000000c0)={0x8, 0x4, 0xfd, 0x0, @vifc_lcl_addr=@initdev={0xac, 0x1e, 0x1, 0x0}, @broadcast}, 0x10) setsockopt$inet_mreq(r5, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) syz_emit_ethernet(0x2a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff08004500001c00000000fb02907800000000e000030000009078006400d0"], 0x0) setsockopt$MRT_ADD_MFC_PROXY(r6, 0x0, 0xd2, &(0x7f0000000200)={@empty, @multicast2=0xe0000300, 0x0, "028a3f6c58b274e6d8451697efe42811ee1df06e9264f7d866b1970548fc3c7b", 0xb2, 0xfffffff7, 0x4, 0x40000006}, 0x3c) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') syz_open_dev$evdev(&(0x7f0000000080), 0x0, 0x121241) r8 = syz_open_procfs(0x0, &(0x7f0000000040)='loginuid\x00') ioctl$FS_IOC_ADD_ENCRYPTION_KEY(r8, 0x541b, 0x0) 5m51.645369919s ago: executing program 2 (id=4997): msgctl$IPC_RMID(0x0, 0x0) sendmsg$NL80211_CMD_GET_REG(0xffffffffffffffff, 0x0, 0x10) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000018105e04da0700000000000109022400010000000009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x14, 0x0, 0x0, &(0x7f0000000000)={0x0, 0x22, 0x1e, {[@global=@item_012={0x2, 0x1, 0x9, "2313"}, @global=@item_012={0x2, 0x1, 0x0, '\x00\x00'}, @local=@item_4={0x3, 0x2, 0x0, "53743ff6"}, @local=@item_012={0x2, 0x2, 0x2, "9000"}, @local=@item_012={0x0, 0x2, 0x3}, @main=@item_4={0x3, 0x0, 0x8}, @global=@item_4={0x3, 0x1, 0x5, "a90da1f6"}, @local=@item_4={0x3, 0x2, 0x0, "00000400"}]}}, 0x0}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) sched_setscheduler(0x0, 0x2, 0x0) r2 = socket$inet6(0xa, 0x3, 0xff) connect$inet6(r2, &(0x7f0000000200)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x41, &(0x7f0000000000)=0x659f, 0x4) write$binfmt_script(r2, &(0x7f00000000c0), 0x28) recvmmsg(r2, &(0x7f0000006640), 0x400000000000343, 0x40002000, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) ioctl$TIOCL_SETSEL(0xffffffffffffffff, 0x541c, &(0x7f0000000100)={0x2, {0x2, 0x13d, 0x0, 0xd6e}}) r3 = syz_open_dev$evdev(&(0x7f00000000c0), 0x40, 0xa0000) ioctl$EVIOCGKEYCODE_V2(r3, 0x80284504, &(0x7f0000000100)=""/101) 5m51.454152964s ago: executing program 2 (id=5000): syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xca03, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x3, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x8, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x81, 0x0, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000001140)={0x1c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000001540)={0x1c, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_mr_vif\x00') pread64(r3, &(0x7f00000002c0)=""/78, 0x34, 0x3) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000058000000060a010400000000000000000100000008000b4000000000300004802c00018008000100636d7000200002800c00038005000100ac000000080001400100000f08000240000000030900010073797a30"], 0xcc}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000003f00)={0x44, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000100)=ANY=[@ANYRES64=r2], 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket(0x1, 0x2, 0x0) syz_usb_control_io(r1, &(0x7f0000000500)={0x18, &(0x7f0000000180)={0x40, 0xc, 0x20, {0x20, 0xd, "81515d7cf6051939fc3cdc8c8d03b17a65ae3d37f12af5b017aae9389e53"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2409}}, &(0x7f0000000580)={0x0, 0xf, 0x13d, {0x5, 0xf, 0x13d, 0x6, [@generic={0xde, 0x10, 0x4, "51cbb6e5325f285820566182833df6c3f698c00a8212f17c6cb63933ba731c7efbcc0fa608e2e49372171b6d5b6224b2aa41e513dbc7b10dad325861ba6722f2380e2378e189987cb979aa5443bc4be6a795a8e9a0ecb4a7bfd6d51268d1366bca431f54a5f2551998459ba7a908171bb1e1edc0b13d902cbab4b1e36fc284fc9c6ae84ee06de253684180a0cc6eb4b75f2775e919a59e035f364afc640c103146fcbe00bc895c651561fc5f41ca76293de88239d75cbba4943c81a96f003aaaf0bdf0c7bf8dd4dc90ead220c26d4614daf6d4d219d75ca67074c5"}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x1, 0xf00, 0x3, [0xff000f]}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0x8, 0x9, 0x8001}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0xc, "b2fa2710b23cc6475e227468751cfeac"}, @generic={0x2c, 0x10, 0xb, "27dcc86e3fa3129bef6a97a39b8865cc5c60f2ef3e7ac92d440ad8034a44f19a2cf0358dc42ab30dea"}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x4, 0x4, 0x0, "8df8a270", "98589736"}}, &(0x7f00000004c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x80, 0x2, 0x3, 0xd, 0x88, 0x3}}}, &(0x7f0000000b40)={0x44, &(0x7f0000000700)={0x20, 0x7, 0x4c, "8f13b85ae7d110321b1fd11a0df338349798cb33e7a39276219e50642a43e6feee10e1b118b9c59d2dc0a4708855c9337e267d8716eeb5e827150f63b8256a2c7cf68c07a41ac22953216732"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000007c0)={0x0, 0x8, 0x1}, &(0x7f0000000800)={0x20, 0x0, 0x4, {0x3}}, &(0x7f0000000840)={0x20, 0x0, 0x8, {0xc0, 0x41, [0xf0ff]}}, &(0x7f0000000880)={0x40, 0x7, 0x2, 0x7fff}, &(0x7f00000008c0)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000900)={0x40, 0xb, 0x2, "9b20"}, &(0x7f0000000940)={0x40, 0xf, 0x2, 0x4}, &(0x7f0000000980)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, &(0x7f00000009c0)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000000a00)={0x40, 0x19, 0x2, 'ng'}, &(0x7f0000000a40)={0x40, 0x1a, 0x2, 0x9}, &(0x7f0000000a80)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000000ac0)={0x40, 0x1e, 0x1, 0x2}, &(0x7f0000000b00)={0x40, 0x21, 0x1, 0x9}}) bind$unix(r4, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000dc0)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x1}}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "27893ce60adde72a", "be07f2c0d0f47c2909b3f965b11848ce", "5239bf4d", "10fc405425abce7b"}, 0x28) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000080)={0xf0f02a, 0x17}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) r6 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r6, 0x0, 0x18, &(0x7f0000000080)=0x200, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff0b7a0204be040202fe056402040c5c0009", 0x1f, 0x0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r9, @ANYBLOB="0c00028006"], 0x24}}, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0xc, @mcast2, 0x9}, 0x1c) 5m51.137378346s ago: executing program 33 (id=5000): syz_open_dev$sndpcmp(&(0x7f0000000000), 0x0, 0x0) r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x46d, 0xca03, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x3, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x8, 0x1, {0x22, 0x7}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0x81, 0x0, 0x1}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_usb_connect$lan78xx(0x5, 0x3f, &(0x7f0000000dc0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x424, 0x7850, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d}}]}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000001140)={0x1c, &(0x7f0000000040)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000001540)={0x1c, &(0x7f0000000400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_mr_vif\x00') pread64(r3, &(0x7f00000002c0)=""/78, 0x34, 0x3) sendmsg$NFT_BATCH(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a05000000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a310000000058000000060a010400000000000000000100000008000b4000000000300004802c00018008000100636d7000200002800c00038005000100ac000000080001400100000f08000240000000030900010073797a30"], 0xcc}}, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000000)={0x34, &(0x7f0000000180)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r1, 0x0, &(0x7f0000003f00)={0x44, &(0x7f0000003b00)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$lan78xx(r1, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000100)=ANY=[@ANYRES64=r2], 0x0, 0x0, 0x0, 0x0, 0x0}) r4 = socket(0x1, 0x2, 0x0) syz_usb_control_io(r1, &(0x7f0000000500)={0x18, &(0x7f0000000180)={0x40, 0xc, 0x20, {0x20, 0xd, "81515d7cf6051939fc3cdc8c8d03b17a65ae3d37f12af5b017aae9389e53"}}, &(0x7f0000000240)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x2409}}, &(0x7f0000000580)={0x0, 0xf, 0x13d, {0x5, 0xf, 0x13d, 0x6, [@generic={0xde, 0x10, 0x4, "51cbb6e5325f285820566182833df6c3f698c00a8212f17c6cb63933ba731c7efbcc0fa608e2e49372171b6d5b6224b2aa41e513dbc7b10dad325861ba6722f2380e2378e189987cb979aa5443bc4be6a795a8e9a0ecb4a7bfd6d51268d1366bca431f54a5f2551998459ba7a908171bb1e1edc0b13d902cbab4b1e36fc284fc9c6ae84ee06de253684180a0cc6eb4b75f2775e919a59e035f364afc640c103146fcbe00bc895c651561fc5f41ca76293de88239d75cbba4943c81a96f003aaaf0bdf0c7bf8dd4dc90ead220c26d4614daf6d4d219d75ca67074c5"}, @ssp_cap={0x10, 0x10, 0xa, 0x7, 0x1, 0x1, 0xf00, 0x3, [0xff000f]}, @ext_cap={0x7, 0x10, 0x2, 0xc, 0x8, 0x9, 0x8001}, @ptm_cap={0x3}, @ss_container_id={0x14, 0x10, 0x4, 0xc, "b2fa2710b23cc6475e227468751cfeac"}, @generic={0x2c, 0x10, 0xb, "27dcc86e3fa3129bef6a97a39b8865cc5c60f2ef3e7ac92d440ad8034a44f19a2cf0358dc42ab30dea"}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x5, 0x4, 0x4, 0x0, "8df8a270", "98589736"}}, &(0x7f00000004c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x80, 0x2, 0x3, 0xd, 0x88, 0x3}}}, &(0x7f0000000b40)={0x44, &(0x7f0000000700)={0x20, 0x7, 0x4c, "8f13b85ae7d110321b1fd11a0df338349798cb33e7a39276219e50642a43e6feee10e1b118b9c59d2dc0a4708855c9337e267d8716eeb5e827150f63b8256a2c7cf68c07a41ac22953216732"}, &(0x7f0000000780)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000007c0)={0x0, 0x8, 0x1}, &(0x7f0000000800)={0x20, 0x0, 0x4, {0x3}}, &(0x7f0000000840)={0x20, 0x0, 0x8, {0xc0, 0x41, [0xf0ff]}}, &(0x7f0000000880)={0x40, 0x7, 0x2, 0x7fff}, &(0x7f00000008c0)={0x40, 0x9, 0x1, 0x6}, &(0x7f0000000900)={0x40, 0xb, 0x2, "9b20"}, &(0x7f0000000940)={0x40, 0xf, 0x2, 0x4}, &(0x7f0000000980)={0x40, 0x13, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x36}}, &(0x7f00000009c0)={0x40, 0x17, 0x6, @multicast}, &(0x7f0000000a00)={0x40, 0x19, 0x2, 'ng'}, &(0x7f0000000a40)={0x40, 0x1a, 0x2, 0x9}, &(0x7f0000000a80)={0x40, 0x1c, 0x1, 0x9}, &(0x7f0000000ac0)={0x40, 0x1e, 0x1, 0x2}, &(0x7f0000000b00)={0x40, 0x21, 0x1, 0x9}}) bind$unix(r4, &(0x7f00000001c0)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000dc0)=[{{&(0x7f0000000380)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x1}}], 0x1, 0x0) setsockopt$inet6_tcp_TLS_TX(r4, 0x6, 0x1, &(0x7f0000000080)=@gcm_128={{0x304}, "27893ce60adde72a", "be07f2c0d0f47c2909b3f965b11848ce", "5239bf4d", "10fc405425abce7b"}, 0x28) r5 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r5, 0xc008561c, &(0x7f0000000080)={0xf0f02a, 0x17}) syz_usb_control_io$lan78xx(r1, 0x0, 0x0) r6 = socket(0xa, 0x2, 0x0) setsockopt$inet_int(r6, 0x0, 0x18, &(0x7f0000000080)=0x200, 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f0000000080)="7800000018002507b9409b14ffff0b7a0204be040202fe056402040c5c0009", 0x1f, 0x0, 0x0, 0x0) r7 = socket$nl_route(0x10, 0x3, 0x0) r8 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="2400000070000100000000000000000007000000", @ANYRES32=r9, @ANYBLOB="0c00028006"], 0x24}}, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x0, 0xc, @mcast2, 0x9}, 0x1c) 2m47.570439374s ago: executing program 6 (id=5756): bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x1, 0x17, &(0x7f00000007c0)=ANY=[@ANYBLOB="1828a40f00000700981bec69a4e9938f00181100", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000005000000bf092000000000006609010000000000060000000b000000180100002020702500000000002020207b9af8ff00000000ad9100000000000037010000f8ffffffb702000008000000b70300000500000056000000060000002c93000000000000b5030000000000008500000076000000b70000000000000095"], &(0x7f0000000780)='syzkaller\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 2m47.11755042s ago: executing program 6 (id=5759): socket$inet_udp(0x2, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) add_key$user(0x0, 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)={0x1c, 0x2, 0x3, 0x301, 0x0, 0x0, {0x0, 0x0, 0x7}, [@NFQA_CFG_CMD={0x8, 0x1, {0x4}}]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x800) r1 = add_key(0x0, &(0x7f0000000240)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffe) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioprio_set$pid(0x3, 0x0, 0x4007) write$uinput_user_dev(0xffffffffffffffff, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) syz_open_dev$vim2m(&(0x7f0000000040), 0x40005, 0x2) keyctl$link(0x8, 0x0, 0x0) keyctl$search(0xa, 0x0, 0x0, &(0x7f0000000040)={'syz', 0x1}, r1) socket$inet6(0xa, 0x2, 0x0) socket$qrtr(0x2a, 0x2, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000180)={0x0}, 0x1, 0x0, 0x0, 0x4010800}, 0x400c4) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mlock2(&(0x7f000000e000/0x1000)=nil, 0x1000, 0x0) openat$mixer(0xffffffffffffff9c, &(0x7f00000016c0), 0x121040, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) setpriority(0x2, 0x0, 0x1) r4 = syz_open_dev$video4linux(&(0x7f0000000000), 0x401, 0x0) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r4, 0xc0305602, &(0x7f00000005c0)={0x0, 0x9, 0x201d}) r5 = syz_open_dev$vivid(&(0x7f0000000040), 0x1, 0x2) ioctl$VIDIOC_SUBDEV_ENUM_MBUS_CODE(r5, 0xc0305602, &(0x7f0000000100)={0x0, 0xb23, 0x3001, 0x1}) 2m44.929603508s ago: executing program 6 (id=5764): r0 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r0, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000380)=ANY=[@ANYBLOB="050000"], 0x48}}, 0x0) sendmsg$can_bcm(r0, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000280)=ANY=[@ANYBLOB="050000000300"/16, @ANYRES64=r0], 0x48}}, 0x0) 2m44.826470603s ago: executing program 6 (id=5765): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x2, 0x7, &(0x7f0000000180)) r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f0000000100)) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r3 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) r5 = syz_open_dev$tty1(0xc, 0x4, 0x2) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x8, 0x10008) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r6, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r7 = dup3(r6, r5, 0x0) r8 = syz_io_uring_setup(0x10d, &(0x7f0000000300)={0x0, 0x40000, 0x80, 0xfffffffc, 0x238}, &(0x7f0000000380)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x5, r7, 0x0}) io_uring_enter(r8, 0x3f70, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000003c0)=@newtfilter={0x64, 0x2c, 0xf25, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r4, {0x0, 0xd}, {}, {0x8, 0xe}}, [@filter_kind_options=@f_flower={{0xb}, {0x34, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @local}, @TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x6}, @TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0xff, 0xffffff00, 0xff, 0xffffffff]}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r11 = dup3(r1, r0, 0x0) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f00000001c0)={0x64, 0x0, &(0x7f0000000440)=[@increfs_done={0x40106308, 0x2}, @increfs={0x40046304, 0x1}, @acquire={0x40046305, 0x3}, @register_looper, @dead_binder_done, @release={0x40046306, 0x3}, @request_death={0x400c630e, 0x2}, @increfs_done={0x40106308, 0x3}, @enter_looper], 0x0, 0x0, 0x0}) poll(&(0x7f0000000280)=[{r0, 0x8470}], 0x1, 0x219bb0a8) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000004a40)={0x10, 0x0, &(0x7f0000000200)=[@request_death], 0x0, 0x0, 0x0}) r12 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x50, 0x10, 0x403, 0xfffffffc, 0x25dfdbfb, {0x0, 0x0, 0x0, 0x0, 0x4100}, [@IFLA_LINKINFO={0x30, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x20, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MEMBERSHIP_INTVL={0xc, 0x1f, 0x5}, @IFLA_BR_NF_CALL_IPTABLES={0x5}, @IFLA_BR_MCAST_QUERIER={0x5, 0x19, 0x1}]}}}]}, 0x50}, 0x1, 0x300000000000000, 0x0, 0x4004}, 0xc000) 2m41.44473488s ago: executing program 6 (id=5774): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000380)=ANY=[@ANYBLOB="12010000000000408c0d220000000000000109022400010000000009040000010300000009210000000122050009058103715b1bde86a598baeb4531519b0d220a8a33ef51e6ae97fad44ef18a38fc8d238cdf1d8a6aca3b128b2e8d24a3d210ba331e4e17056e491e728ce21be0aa1b76767c8847ccfe8d7006430ac46545a9a5b2fcd7aef4d704ec931fd78b88c7daef1eb653d26b3df1ba848aa65f22a58fd41dc8a677093ad0f008dda4ceb09470982bd5dafe5b41003cd85302f7bb513804b8e4a1e18dfa0b6b050c03f8c34ff022122d3f79b1b4c54160c3817301a664be44fc917e5582818047f3ae7cb05db4824e348eb9064ac3cf0582eaa3f99dd65e3e4b8375f86f0041cd188e388ed0bbec34edc186f3a6db94833eecfcd574a1bbaeb8a7211ed5d70874234b69867fa0d23c18907ec611e41b943f43edab1e3d9e4a9ae12ac32ce688bd3a8c1d4b95803dd4fcd4a57089ba260140417724aa7fcf3f179b129297dc9ed1ba0bfb1e1387a2ba7a9dd598832d42e11bbe54c3f2e7baca82ff030498800d27481ef5095aff62328da5a6acbcea034548d980195ea892b6ad121b477c17dc69f167a7039bdf21adf4e5a6f656f8824b"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000740)={0x2c, &(0x7f0000000980)=ANY=[@ANYBLOB="00000001000000090090"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$evdev(&(0x7f0000000040), 0x4, 0x40) memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)) (async) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000040)) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = dup(r3) socket$inet6(0xa, 0x2, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r5, 0x1) close(0x3) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000200)={0x0, 0x10, &(0x7f00000001c0)=[@in={0x2, 0x4e21, @rand_addr=0x64010100}]}, &(0x7f0000000140)=0x10) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x4e23, 0xc80000, @dev={0xfe, 0x80, '\x00', 0x37}, 0x5}}}, &(0x7f0000000040)=0x84) (async) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r5, 0x84, 0x7a, &(0x7f0000000340)={r6, @in6={{0xa, 0x4e23, 0xc80000, @dev={0xfe, 0x80, '\x00', 0x37}, 0x5}}}, &(0x7f0000000040)=0x84) syz_open_dev$dri(&(0x7f0000000180), 0x1, 0x0) r7 = socket$inet_udp(0x2, 0x2, 0x0) fsopen(&(0x7f0000000280)='gfs2meta\x00', 0x0) (async) r8 = fsopen(&(0x7f0000000280)='gfs2meta\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) (async) fsconfig$FSCONFIG_CMD_CREATE(r8, 0x6, 0x0, 0x0, 0x0) fsmount(r4, 0x0, 0x18) fchdir(r8) (async) fchdir(r8) setsockopt$SO_TIMESTAMPING(r7, 0x1, 0x41, &(0x7f0000000040)=0x63a2, 0x4) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @local}, 0x10) (async) connect$inet(r7, &(0x7f0000000480)={0x2, 0x0, @local}, 0x10) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x0) (async) sendmmsg(r7, &(0x7f0000007fc0), 0x800001d, 0x0) recvfrom$inet(r7, 0x0, 0x0, 0x2043, 0x0, 0x0) r9 = memfd_create(&(0x7f0000000700)='\xf3e\t\x9f\x918\xc0y\x01c\x1fnux\x00sV\ad\xb0l \xfd\xd7\x8e\x7f\x89\xb8\xc5;~\x04\x03~K\xfbP\x84=\xfa\x81\f\x1et\x10\x0e\xcf^9Mf8)\x91\xcel\xe7}\"?e\x8c\x10\x03\x12]\x81>\xb3\x88Oo\x16X\xffB\xb1\r4\xc0c=tz\x19\\rH\xc7\x87$\x13\xa3\x02Eplu\xb1\x82\xfa>vw\xb9+\xc4\xed\xb8\x82\xe0y\x88h\xb3I\xdam\x1d\xae\x9af\x14\xeck\x05\x11u\x90E\x1eFX\rx\xe7\f\xed\xda\xf7\x10\x0f=\xf2\xe7\x8aN\xae\x1dS\xfc\xe4\xb5$\xc8m\xe0F\xd6\xc8\xcac\xee\xbaJ\x19\x8cH\xd4\xf2\x9b\x11@\xa8\xe4\xccm\xb8\xads.\x10<\x86\xfe\x15\x8e\xf5\xde\x13\xf3\xa8H\xf7\xb2\xce\xdd\x91\x89\xfc\xe0\x97_\xec\xbdA\xeb\xe4\x12\xf3\x02\xeegg\x914\x05*\"\xd1\x9c-{4\xd7\xae{a\xeb\xdbg\xad|r\x9d|\\G\xf1\xd5\x7f>\xb0\xe9\xe7\xaf\xccOe\xf7\x9e$I\xe0k\v\xac\x9cW=;\xb9|f\xc4\xf4p#\x1d\xd2`\xdb*\x0f\x01\x14 \xc5\xc9\xf1\x14\x00\xe2\xeb\xe6|\x9f\x91\xee6\xd7\xdb\xecp\xd2H$~\x14\xd4\x03\xb4\x18\xb6y\xe3\x17x0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r7, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0xfe, 0x1, 0x0, r6, 0x0}]) syz_emit_ethernet(0x0, 0x0, 0x0) 2m19.913351533s ago: executing program 34 (id=5788): r0 = syz_usb_connect(0x5, 0x24, &(0x7f0000001280)={{0x12, 0x1, 0x300, 0x0, 0x1f, 0x66, 0x8, 0x58f, 0x6610, 0x4805, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x4, 0x95, 0x70, 0x81, [{{0x9, 0x4, 0x0, 0x81, 0x0, 0xff, 0xff, 0xff, 0x2}}]}}]}}, &(0x7f0000001700)={0xffffffa0, 0x0, 0x0, 0x0, 0x23}) r1 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2003) socket$pppl2tp(0x18, 0x1, 0x1) r2 = syz_open_dev$usbmon(&(0x7f0000000300), 0x7, 0x0) read$usbmon(r2, 0x0, 0x0) r3 = socket$inet(0x2, 0x1, 0x0) getsockopt$MRT(r3, 0x0, 0xcf, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000004c0)=@newsa={0x128, 0x10, 0x7, 0x0, 0x0, {{@in6=@mcast2, @in=@multicast2, 0x4e20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x0, 0x2, 0x0, 0x10000000}, {0x0, 0x200000, 0x7}, {0x40000, 0xfffffffd, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}, @lifetime_val={0x24, 0x9, {0xb4, 0x8000000000000001, 0xb4, 0x5}}]}, 0x128}}, 0x0) socket$key(0xf, 0x3, 0x2) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000000c0)=@newsa={0x100, 0x1a, 0x7, 0x0, 0x0, {{@in6=@dev={0xfe, 0x80, '\x00', 0x1b}, @in=@multicast2, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xee00}, {@in6=@mcast1, 0x0, 0x2b}, @in6=@private0, {0x0, 0x9, 0x2, 0xfeffff7f00000000}, {0x0, 0x4, 0x7, 0xfffffffffffffffd}, {0x40000, 0x0, 0xae8}, 0x0, 0x0, 0xa, 0x2, 0x0, 0x70}, [@coaddr={0x14, 0xe, @in6=@remote}]}, 0x100}}, 0x0) ioctl$MON_IOCG_STATS(r2, 0x80089203, &(0x7f0000000600)) ioctl$MON_IOCH_MFLUSH(r2, 0x9208, 0x40) syz_open_dev$usbfs(&(0x7f0000000000), 0x205, 0x44680) ioctl$I2C_RDWR(r1, 0x707, &(0x7f0000000a40)={&(0x7f0000000240)=[{0x3, 0xe200, 0xffffffffffffff4c, &(0x7f0000000180)="5e244b7635e72ca8dbe2797be434c4ee277510249b90e56c14fa26f4d110c8255affd5b30ae0c74f45609c45d79414af617bcedb0b42039e23cd6372cc9734acadf9d93c754cc69ef08e"}, {0x80, 0x0, 0x9e, &(0x7f00000000c0)="658c4865ee2257ea9a23d0a37f26f2858e61b2eb5482c12c9f9c8ae2284985b6d9398391e8e0d436648e08e2b747da0a7f51c561e6a48b272136d23deaba12cd8442f196b3b787538a106f6488183bf0b421f0fed911652376d52cdbd50131aa3fcd56a55518fd016cd0cede229eb53ba55955b68f050ee33e30bb219fa74d513fffe4dddc230842fced29ab52dee036bf27df49873bc08515642b9e3586"}], 0x2}) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000200)={0x1c, &(0x7f0000000000)=ANY=[], 0x0, 0x0}) ioprio_set$pid(0x2, 0x0, 0x0) pipe(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r7, 0x1, &(0x7f0000000300)=[&(0x7f0000000080)={0x0, 0x0, 0xfe, 0x1, 0x0, r6, 0x0}]) syz_emit_ethernet(0x0, 0x0, 0x0) 2m19.245407683s ago: executing program 4 (id=5836): r0 = socket(0x1, 0x1, 0x0) r1 = epoll_create(0x10001) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000000)={0xb0000000}) syz_usb_connect(0x5, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x201, 0x24, 0xc4, 0xf0, 0x20, 0x7c4, 0xa109, 0xbaa6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0xc, 0x0, 0xbf, [{{0x9, 0x4, 0xa5, 0x2, 0x0, 0x2e, 0x55, 0xbe, 0x0, [@uac_control={{0xa, 0x24, 0x1, 0x9, 0x1}}]}}]}}]}}, &(0x7f00000001c0)={0x0, 0x0, 0x2, &(0x7f0000000180)=ANY=[@ANYBLOB="cc3301b600"], 0x0, [{0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="000322ab7757c32e6ed5bce6a95b813784b3fd522d3afad120bbda4dae21c3809bbbf8ffda789a1842aae25d09eb9e8fc21d742645ee2a66c57d34e2818e174843926d07c5fcb5a2684d3aa882320c6a8cf847bfb9111e6d315f"]}, {0x0, &(0x7f0000000040)=@string={0x0, 0x3, "fc1e7c5fed7a79cc2145c62080356b984d60011c50"}}]}) 2m17.71517262s ago: executing program 4 (id=5842): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'vlan1\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) sendto$packet(r0, &(0x7f0000000780)="3f030300031b12000000000789e9aaa911d7c2ff070088a800038100642c", 0x1e, 0x0, &(0x7f00000000c0)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @random="ff9900000300"}, 0x14) 2m17.565939505s ago: executing program 4 (id=5843): r0 = socket$packet(0x11, 0x2, 0x300) socket(0x1d, 0x6, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) sendto$inet6(r3, &(0x7f0000847fff)='X', 0x1, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x3, 0x5, 0xf, 0x0, 0x2, 0x8, 0x8, 0xb31a, 0x3}, 0x0) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r4, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) process_vm_readv(0x0, 0x0, 0x0, &(0x7f0000000900)=[{0x0}], 0x1, 0x0) setsockopt$inet6_tcp_TCP_MD5SIG(r4, 0x6, 0xe, 0x0, 0x0) connect$inet6(r4, &(0x7f0000000100)={0xa, 0x0, 0x0, @loopback}, 0x1c) r5 = socket$nl_route(0x10, 0x3, 0x0) r6 = dup(r5) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x34, 0x10, 0x401, 0xfffffffc, 0x80, {0x0, 0x0, 0x0, 0x0, 0x40800, 0x240}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}, 0x1, 0x0, 0x0, 0x4001}, 0x0) setsockopt$inet6_tcp_TCP_ULP(r4, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r4, 0x11a, 0x1, &(0x7f00000001c0)=@gcm_256={{0x304}, "6ae04425ace3f60c", "acba84f0a6711f234db5aaa13f382ad796bd667c9e00000009873931d2873103", "0f9dafb4", "ec3fff9afd96e6c0"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r4, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4) ioctl$int_in(r4, 0x5421, 0x0) writev(r4, &(0x7f0000000080)=[{&(0x7f00000002c0)="ec", 0xfdef}], 0x1) close(r4) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, 0xffffffffffffffff, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_emit_ethernet(0x46, &(0x7f0000000440)=ANY=[@ANYBLOB="aaaaaaaaaaaaffffffffffff86dd60f91e2e00107300fc040000000000000000000000000000ff02000000000000000000000000000100"], 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) bind$tipc(0xffffffffffffffff, 0x0, 0xfffffffffffffd8b) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x891b, &(0x7f0000002280)={'lo\x00', {0x2, 0x4e21, @loopback}}) 2m15.939414921s ago: executing program 4 (id=5844): r0 = syz_open_dev$vim2m(&(0x7f0000000040), 0x80000005, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000080)={0x7, 0x1, 0x1, "9adf66552fb8af2b9f10f35681de96a590d25f2744e043cc1e70c317fd815cee", 0x32314d4e}) r1 = socket$nl_audit(0x10, 0x3, 0x9) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, &(0x7f00000000c0)=0x1) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="010000000000000000004400000008000300", @ANYRES32=r4, @ANYBLOB="08002600851600000a00180000000000000000001c005a8018000180140003"], 0x4c}}, 0x0) r5 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x800, 0x0) r6 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_GET(r9, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000340)={0x2c, r10, 0x1, 0x70bd26, 0x25dfdbfd, {}, [@HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'xfrm0\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x80}, 0x4040000) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) r11 = socket(0x10, 0x3, 0x0) r12 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f0000000d80)=ANY=[@ANYBLOB="bf16000000000000b7070000060000005070000000000000480000000000e1ff95000000000000002ba7e1d30cb599e83f24b8a4efc02d459d9e32a3aa81d36bb3019c13bd23212fb56f040026fb41f2db3b1639b7bbc9af171b856de734cfe3cafafefc40056bdc17487960007102fa9ea41da123741c66be166992b2dcd72fa0fca047d41886d0d4d94f2f4e345c652fbc1626cca2a2ad35806150ae0209e62f51ee988e6e06c8cedf3ceb9fc404000000c588b277beee1cbf9b0a4def42d410f6accd3637110bec4e90a6341965c39e9ebab0e39622200e011ea661c45a3449abe802f5ab3e3101c0932ed4148d3b3e22278d00031e5388ee5c867de2c6211d6ececb0cd2b6d357b8000018ef4aafad197acc7dc1e955c685ceff7f000000000000491b8bc4748eda186872000007ce468ee23fd2f73902ebcfcf49822775985bf31b405b433a8acd715f5888b2007f00000000000000000100fb0000000000000000ff03000000000000b56780260ed652290f58fa64533500ebffffff00ca1276445432997f0000000000000008e75a89faff01210cce39bf405f1e846c12423a163b33e680846f26dc7add65873d9f87463ad6f7c2f3ee1a39244960b318778f2a047f6d0800000000000000e7a6520602a80d608df4d433623c850af895abba72bf14f6fbd7fbad2a436804eeae1de6d2c740cf0c0b74edbcb2d4b7746fa4bc5e32bd378af7c9136adf32ec7bf48cabecead649f96ea24c32872c490637c34360cb5d46ce680eeb80127eb23f9902519a693b85c6552051385e7e87a2db762cbb253fbd76b9117c1a11d18aa21a0c5f0c28999a639c0376678be35ffe99ff799a11d9b219c00c369a12bf8685b862d2000000bda1bae489bcef5ae59136aaacc59608f4d4e6067338b521eaf2e2465da053cfd5e95394e5520545364361d2c1465c5461a7c4174e5cd9c7976c9aa6342c5621dbc2dccedb5ab74e0b119252a23352fca272212d0c0104000014593d65d3f5e1e9b294669bcd2df061a4d6a835e40e7302f53f90da24cb256b34e95bca9c512f737486ecd037ce40d0a706a5b05e72f8c218366e321f9109ae4cf44b3b0104154a93394f42b4ab6125e0ba8b1a1d8c473852910b3cb7e8dc795ac01bad9a6b438b9db5f5c926940a3ac36daf2a9dc9d868ec11f51e08bc67a3d598039d328b4677229e8b587e8a00f1733adabd5d2837c084c164cf30010969c79a09ac7a9bffff5bc7e420baa9000cd49f77782205d3f6f4b6aa751f49a6b76e3d23635f1d33b906707563b8ec92dec767cc09fe9936acb43382bfc81c823ba32f25738d863cf20181208e23ce19966e729a7b4eefa68554fa4ccadac05c8eac1b52dd528b124285a16da468e3fcb3d9a24e9d670500956702fe9be5d8207d426450ca622e8e0197270cbb947231baf36e0567c0f5de639c99bb71ca0e60d2decb185cddd74d4f00000000000000000000006ed429a657a8203f6542e9dd19d7a70431aefcb9f1b673512e25503c603f19fa4c39ee9b08aadd2c7555543837770a812207bc2be9c86f94282b325e3097438594670099106f0defa59616d3d18a4c8c04a45c204edfc4cefbd94c4c034dcbc90975b097ece2484b5287105335791eb3061ac500a6728677c72b5b76c18186d6f1a5c74aaddd22dc002fd4bd1bc3409e8d7144689c89f7a5e95fce153d4e9bf0fe0aaa3dfaa443c5081606fda5059146ef94586f5d1658ef0389734108a3af432c730175a7c6e3bb997ed39a0da78527b212001e573492190000"], &(0x7f0000000140)='GPL\x00'}, 0x48) setsockopt$sock_attach_bpf(r11, 0x1, 0x32, &(0x7f00000047c0)=r12, 0x4) getsockopt$sock_buf(r11, 0x1, 0x1a, 0x0, &(0x7f0000000240)) r13 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x41000, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000500)=[{0x5, 0x5, 0xd, 0xb}], 0x10, 0x7}, 0x94) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x40, 0x0, @fd=r5, 0x1, &(0x7f00000004c0), 0x0, 0xc}) ioctl$RTC_WKALM_RD(r13, 0x80287010, &(0x7f0000000280)) io_uring_enter(r6, 0x847ba, 0x0, 0xe, 0x0, 0x0) r14 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_udp_encap(r14, 0x11, 0x68, &(0x7f0000000040)=0x2, 0x4) setsockopt$inet_udp_encap(r14, 0x11, 0x64, &(0x7f0000000080)=0x2, 0x4) 2m15.443287721s ago: executing program 4 (id=5846): syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000140)={0xa, 0x4e22, 0x0, @empty}, 0x1c) listen(r0, 0x0) syz_emit_ethernet(0x4a, &(0x7f00000004c0)=ANY=[@ANYBLOB="aaaaaaaaaaaa00000000000086dd600a843500140600fe8000000000000000000000000000bbfe8000000000000000000000000000aa00004e22", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB='P\x00\x00\x00\x00\x00\x00\x00'], 0x0) syz_emit_ethernet(0x4a, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaabb86dd6056040000140600fe8000000000000000000000000000aafe8000000000000000000000000000aa00004e22c44829ec99e3307977f5326481ca8f9c9bfa0e77368501808fcc516a6b0c0eb86643ef247440f32d26ae8f496e410d50cfec36d1dde2faf66a638bd248a4c0952112d367188cd6efaf31fde3250817980b7e1243e1f29a709cb7a8c921abc6d821dcd195bd500f24c5d9970710a062841350", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50c2000090780004"], 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r1, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x10, 0x1, 0x24, 0x3}}], 0x10}, 0x40) r2 = userfaultfd(0x80001) mmap(&(0x7f00007ae000/0x3000)=nil, 0x3000, 0xfffffffffffffffe, 0x80010, r2, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x0, 0x0, 0x2, 0x0) openat$uinput(0xffffffffffffff9c, 0x0, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x1fa11, 0xffffffff}, 0x0) socket$nl_generic(0x10, 0x3, 0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0xc000}, 0x0) ioctl$DRM_IOCTL_PRIME_HANDLE_TO_FD(0xffffffffffffffff, 0xc00c642d, &(0x7f00000000c0)={0x0, 0x80000, 0xffffffffffffffff}) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r6, 0xc04064a0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000380)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r6, 0xc05064a7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000300)=[0x0, 0x0], &(0x7f0000000100), 0x0, 0x2, 0x0, 0x0, r7}) ioctl$DRM_IOCTL_MODE_SETPROPERTY(r6, 0xc01064ab, &(0x7f0000000440)={0x1, r8, r7}) ioctl$DRM_IOCTL_MODE_OBJ_SETPROPERTY(r5, 0xc01464ba, &(0x7f0000000140)={0x3cb, r8}) write$UHID_CREATE(0xffffffffffffffff, &(0x7f0000000240)={0x0, {'syz0\x00', 'syz1\x00', 'syz1\x00', &(0x7f0000000100)=""/4, 0x4, 0x0, 0x2, 0x7, 0x3, 0x10f39eb7}}, 0x11c) syz_open_dev$vcsa(0x0, 0xfffffffe, 0x5cf182) 2m14.15488185s ago: executing program 4 (id=5848): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x1ff, 0x101301) syz_emit_ethernet(0x1fe, 0x0, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfc, 0x0}, 0x2}, 0x1c) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) move_mount(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00', 0x800, 0x0, 0x103, 0x1}, 0x20) sendmsg$inet6(r5, &(0x7f0000000100)={&(0x7f0000000040)={0xa, 0x4e24, 0x1, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@hopopts_2292={{0x5c, 0x29, 0xb, {0x0, 0x8, '\x00', [@calipso={0x7, 0x40, {0xb1bbf2d6b755cdf8, 0xe, 0x0, 0x3, [0x7f, 0x0, 0x0, 0x1, 0x6, 0x200, 0x5]}}]}}}], 0x5c}, 0x0) accept4(r5, &(0x7f0000000300)=@caif, &(0x7f0000000140)=0x80, 0xc0000) openat$vim2m(0xffffff9c, &(0x7f0000000b00), 0x2, 0x0) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES8=r2], 0x1c}, 0x1, 0x0, 0x0, 0x48}, 0x80) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f0000000200)={0x2, 0x3, 0x0, 0x1000, 0x0, 0xfffffffe, 0x0}) 1m59.03399344s ago: executing program 35 (id=5848): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x201, 0x2) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x1000002, 0x11012, r0, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x3) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) r1 = syz_open_dev$usbfs(&(0x7f0000000100), 0x1ff, 0x101301) syz_emit_ethernet(0x1fe, 0x0, 0x0) setsockopt$inet6_udp_int(0xffffffffffffffff, 0x11, 0x65, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x0, 0x0, @initdev={0xfe, 0x88, '\x00', 0xfc, 0x0}, 0x2}, 0x1c) r2 = syz_genetlink_get_family_id$batadv(&(0x7f0000000240), 0xffffffffffffffff) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) move_mount(0xffffffffffffffff, &(0x7f0000000400)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r5, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00', 0x800, 0x0, 0x103, 0x1}, 0x20) sendmsg$inet6(r5, &(0x7f0000000100)={&(0x7f0000000040)={0xa, 0x4e24, 0x1, @loopback}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@hopopts_2292={{0x5c, 0x29, 0xb, {0x0, 0x8, '\x00', [@calipso={0x7, 0x40, {0xb1bbf2d6b755cdf8, 0xe, 0x0, 0x3, [0x7f, 0x0, 0x0, 0x1, 0x6, 0x200, 0x5]}}]}}}], 0x5c}, 0x0) accept4(r5, &(0x7f0000000300)=@caif, &(0x7f0000000140)=0x80, 0xc0000) openat$vim2m(0xffffff9c, &(0x7f0000000b00), 0x2, 0x0) sendmsg$BATADV_CMD_GET_MESH(0xffffffffffffffff, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000000)=ANY=[@ANYRES8=r2], 0x1c}, 0x1, 0x0, 0x0, 0x48}, 0x80) ioctl$USBDEVFS_CONTROL(r1, 0xc0105500, &(0x7f0000000200)={0x2, 0x3, 0x0, 0x1000, 0x0, 0xfffffffe, 0x0}) 1m58.478966023s ago: executing program 3 (id=5912): mkdir(&(0x7f0000000300)='./file0\x00', 0xfffffffffffffffe) r0 = inotify_init1(0x80000) inotify_add_watch(r0, &(0x7f0000000080)='.\x00', 0x2000775) socket(0xf, 0x5, 0x200b) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETVNETLE(r3, 0x400454dc, 0x0) mlock(&(0x7f0000fff000/0x1000)=nil, 0x1000) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x6, 0x0, 0x0, 0x0, 0x400000b49, 0x6, 0x1, 0x0, 0x6}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x33, &(0x7f0000000000)={0x0, &(0x7f0000000140)}, 0x10) bpf$PROG_LOAD(0x5, 0x0, 0x0) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) add_key$fscrypt_v1(&(0x7f0000000040), &(0x7f0000000080)={'fscrypt:', @desc2}, &(0x7f00000000c0)={0x0, "f1a1173fb9462d3589e67197f90be6e423ceb0ab4912f9f6a31854ec98e950cfed21fcad7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x52ba, 0xffffffffffffffff) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r4 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000340)='./file0\x00', &(0x7f00000004c0), 0x0, &(0x7f00000000c0)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}) write$FUSE_NOTIFY_STORE(r4, &(0x7f0000000200)=ANY=[@ANYBLOB="2a0000000400000000000000000000000100000000000000ffffffff0000000002000000000000000000ec6f5e5644fdffbf7476d995725b672b82067c3675f9d0fd9b107888d2fd265749898c130ed9a2fbf2cc777809cc16bc071d0d89e0b13dce49487466b252c680febfca61d6f382648e256ef1"], 0x2a) r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000080)='/sys/kernel/profiling', 0xa0042, 0x11) r6 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x5) ioctl$SG_IO(r6, 0x2285, 0x0) writev(r6, &(0x7f0000000400)=[{&(0x7f0000000080)="aefdda9d240300005a90f57f07703aeff0f64ebbee07962c22772e11b44e65d76641cb010052f436dd2a", 0x2a}, {&(0x7f0000000040)="aa1d484ea0fb0000f7fc08fcd111fbdf23ea32db0e8f21d5bc27bd49eb067a0689fff2a41c", 0x25}], 0x2) ioctl$sock_inet_tcp_SIOCOUTQNSD(r5, 0x894b, &(0x7f0000000140)) write$tcp_mem(r5, &(0x7f0000000400)={0x6, 0x2d, 0x2, 0x3a, 0x0, 0x2c}, 0x48) openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) 1m56.018384495s ago: executing program 3 (id=5918): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) (async) bind$inet6(0xffffffffffffffff, 0x0, 0x0) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x9, 0x3, 0x2, 0x7, 0x400, 0xffffffff}, 0x0) (async) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) (async) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) setsockopt$inet6_IPV6_ADDRFORM(r3, 0x3a, 0x1, &(0x7f0000000100), 0x4) (async) syz_emit_ethernet(0x1ae, &(0x7f0000000480)=ANY=[@ANYBLOB="0180c2000000aaaaaaaaaabb86dd6007000001783a00fe8000000000000000000000000000aaff02000002000000000000000000000101009078020000006001000000030000ff02000000000000000000000000000100000000000000000000000000000001320004a966000000730e04070530080000000000000000000000000000000000ff010000000000000000000000000001fc02000000000000000000000000000120010000000000000000000000000001ff010000000000000000000000000001fc000000000000000000000000000001fc0200000000000000000000000000000000f728680000002e0000000000000005020003000000001d00013164000000210a020d0000000000000000000000000000ffff7f00000100000000000000000000ffffe0000002fc000000000000000000000000000001fc020000000000000000000000000000000000000000000000000000000000006c000931680000002f080000000000000738000000020c03ff03fb31000000000000021500000000000008000000000000007b0900000000000006000000000000000500000000000000040106000100"], 0x0) (async) syz_open_dev$dri(0x0, 0x1ff, 0x0) r4 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r4, &(0x7f0000000440)={0x28, 0x0, 0x2710, @host}, 0x10) (async) listen(r4, 0x0) r5 = socket$vsock_stream(0x28, 0x1, 0x0) connect$vsock_stream(r5, &(0x7f0000000080)={0x28, 0x0, 0x2710}, 0x10) (async) accept4(r4, 0x0, 0x0, 0x0) (async) sendmmsg(r5, 0x0, 0x0, 0x4008) syz_open_dev$dri(0x0, 0x1ff, 0x0) (async) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19) (async) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000005c00)={&(0x7f0000000000)=@newtaction={0x44, 0x30, 0x9, 0x0, 0x0, {}, [{0x30, 0x1, [@m_bpf={0x2c, 0x1, 0x0, 0x0, {{0x8}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x44}}, 0x0) (async) r6 = socket$kcm(0x10, 0x2, 0x0) write$cgroup_subtree(r6, &(0x7f0000000000)=ANY=[@ANYBLOB="563f00001a00599c6d0e000091d028ef80"], 0xfe33) (async) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000008, 0x12, r0, 0x0) 1m55.387179782s ago: executing program 3 (id=5919): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x281, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00220f000000040b2100000095f5758483"], 0x0}, 0x0) r3 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) r4 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r4, 0x81044804, &(0x7f0000000400)={0x1}) ioctl$HIDIOCGUSAGES(r3, 0xd01c4813, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) r5 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'dummy0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r8, {0x0, 0xfff1}, {0x7, 0xffff}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_USC={0x10, 0x3, {0x1ff, 0x1, 0x8004}}}}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) sendmsg$nl_route_sched(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000004c0)=@newqdisc={0x838, 0x28, 0x4ee4e6a52ff56541, 0x4004, 0xfffffdfc, {0x0, 0x0, 0x0, r8, {0x3, 0xe}, {}, {0x2, 0xfff1}}, [@qdisc_kind_options=@q_tbf={{0x8}, {0x80c, 0x2, [@TCA_TBF_PTAB={0x404, 0x3, [0x16cc89b4, 0x200, 0x0, 0x8, 0x80000000, 0x4, 0x2, 0xffff6576, 0xd6a6, 0x9, 0x6, 0x9, 0x8, 0x1d, 0x3, 0x81, 0x7, 0x8, 0x8, 0x3f, 0x7, 0xfffffff7, 0x7fffffff, 0x1, 0x10001, 0xfffffff6, 0x5, 0x0, 0x80000001, 0x2, 0x1, 0x7, 0xb, 0x7, 0x0, 0x9bc100, 0x7, 0x999, 0x6, 0xd8, 0xfe, 0x3, 0x8c1, 0xffff, 0x1, 0x9fc, 0x7fffffff, 0x2, 0x8, 0x4, 0x10000, 0x200, 0xe, 0x1, 0x0, 0x40, 0x7, 0xa5d8, 0x4, 0x6, 0x7000000, 0x3, 0x9, 0x4, 0x9, 0x0, 0x6, 0x9, 0x4, 0x80, 0x8, 0x10001, 0x6, 0x8, 0x200, 0x0, 0x7, 0x9, 0xffffffff, 0x100, 0x5, 0xff6, 0x35, 0x53, 0x7fffffff, 0x80000000, 0x200, 0x480000, 0x4, 0xfff, 0x6fd, 0x4, 0x3d4a3d97, 0x0, 0x56, 0x7, 0x392a, 0x2, 0x2, 0x7, 0xe6, 0x7, 0x6, 0x8, 0xffff1362, 0x7, 0xe47a, 0x6, 0x6, 0x5, 0x9000000, 0x3, 0xc7, 0x708, 0x3, 0x0, 0x10, 0x9, 0x2, 0xd0, 0x1000, 0xf4, 0x432, 0x1ff, 0x401, 0x5, 0x97b2, 0xffffffff, 0x1, 0x7, 0x6fa0, 0x1, 0xdc, 0x10001, 0x9, 0x6, 0x1cd7, 0x6, 0xfffffffd, 0x1, 0x1, 0x9, 0xc, 0x1, 0x10, 0x747, 0x2, 0xffffff25, 0x7, 0x2, 0x97, 0x3, 0x7de8, 0x2, 0x6, 0x5, 0x3, 0x10000, 0x0, 0xf, 0x101, 0x2, 0x200, 0x4, 0x1, 0x3, 0x4, 0x4, 0x1c000000, 0x9, 0x200, 0x3, 0xc, 0xb, 0x9, 0x8000, 0x101, 0x8, 0x0, 0x2, 0x7, 0x6ac, 0x5, 0x1, 0x1, 0x101, 0x1, 0x65, 0xfffffff6, 0xfffffffd, 0x9, 0x401, 0x0, 0x3, 0x3744, 0x28, 0x2, 0x7, 0xfff, 0x0, 0x563d, 0x7, 0x8, 0x800, 0xb5, 0x40000008, 0x6, 0x4f, 0x7fff, 0x100, 0x2, 0x4, 0x3, 0x7, 0x3, 0x8, 0x8, 0xff, 0x0, 0x1, 0x2, 0x3, 0x4, 0x5, 0x4, 0x0, 0x8, 0xd, 0xe, 0x2, 0x4, 0x6, 0x4, 0x1, 0x401, 0x2, 0x5, 0xfff, 0x96b4, 0x2, 0x92ed36b9, 0x8000, 0x40, 0x4, 0x9, 0x9, 0x0, 0x0, 0xf4, 0x5, 0x0, 0x7, 0x7, 0x2, 0x9f14, 0x2]}, @TCA_TBF_RTAB={0x404, 0x2, [0x3, 0x0, 0x5, 0x401, 0x0, 0x9, 0x18, 0x1, 0x80, 0x7000000, 0x5, 0x8, 0x9, 0x8, 0xd8c, 0x10f8000, 0x1, 0x4, 0x6, 0xf, 0x7ff, 0x1, 0x88d, 0x8, 0xfffffff9, 0x7, 0x6, 0x7f, 0x4, 0xc824, 0x4, 0xe3, 0x6, 0x0, 0xe, 0x7, 0xe, 0x101, 0x12, 0x0, 0x7, 0x8, 0x6, 0x4, 0x3, 0x7ff, 0xe55, 0x5, 0x4b19, 0x8, 0x8, 0xc5c, 0x9, 0x3, 0x5, 0x8001, 0xfffffff8, 0x9, 0x5, 0x9, 0x2, 0x8, 0xfffffffa, 0xfffffff7, 0x1, 0x6a41, 0xffffffff, 0xf, 0x4, 0x3ff, 0x7f, 0x3, 0x81, 0x10, 0x3, 0x400, 0x9, 0x7ff, 0x5, 0x40, 0x2, 0x2e, 0x0, 0x1, 0x5, 0xcf9, 0x2, 0x0, 0x4, 0x4, 0x4, 0x4, 0x3, 0x7ff, 0x5, 0xfffffffc, 0x3, 0x2, 0x6, 0xa5, 0xfffff000, 0x2, 0x6, 0x1, 0x8, 0x80000000, 0x800, 0x9, 0x6, 0x1, 0x0, 0x80, 0x3, 0xfffffffd, 0xfff, 0x4, 0x7, 0x2, 0x7, 0x1, 0x89c, 0x9fae562, 0x6, 0x5, 0xff, 0x7, 0x401, 0x1, 0x6, 0x9, 0x7, 0x3ff, 0x800, 0x2, 0x3, 0x6, 0xc71, 0x81, 0x80000000, 0x3ff, 0x8, 0x7, 0x2, 0x7, 0x200, 0x1, 0x7, 0x8000, 0xe265, 0x7fffffff, 0x0, 0x0, 0x2e, 0xc, 0x7, 0x8, 0xc88f, 0x2, 0xffffffff, 0x6, 0x5, 0x8000, 0xe, 0xfffffff9, 0x6, 0x8, 0x990, 0x800, 0x5, 0x7, 0x1, 0xfffffffa, 0xb, 0x9, 0x2, 0x7ff, 0x8000, 0x5, 0x1, 0x10000, 0xd41b, 0x128b5072, 0xf, 0x4, 0xf918, 0x7f, 0x3, 0x8, 0x2, 0x0, 0x0, 0xff, 0xb, 0x4, 0x96a3, 0x1, 0x8001, 0x7, 0x4, 0x1, 0x9, 0x6, 0x1, 0x3, 0x5, 0x631, 0x8001, 0x3, 0x10001, 0x44c, 0x5827, 0xa99, 0x3, 0x400, 0x0, 0x8, 0x7, 0x10000000, 0x3, 0x3, 0x0, 0x1d99, 0x3, 0x4, 0x0, 0xb78b, 0x1, 0x3, 0x10000000, 0x7, 0x8, 0x4, 0x9, 0x7, 0x4, 0x5, 0x7, 0x0, 0xfffffff9, 0xffff, 0x81, 0x9, 0x6, 0x3, 0x19f2, 0x3, 0x40000e, 0x4259, 0x7, 0x3, 0x7e, 0x58783dd6, 0xed2, 0x5, 0x5, 0x9]}]}}]}, 0x838}, 0x1, 0x0, 0x0, 0x20008091}, 0x4000000) ioctl$KVM_CAP_EXIT_HYPERCALL(r5, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) r9 = socket$alg(0x26, 0x5, 0x0) bind$alg(r9, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) r10 = accept4(r9, 0x0, 0x0, 0x800) fstat(r5, &(0x7f0000000340)) r11 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r10, &(0x7f0000000300)={0x4}) ioctl$KVM_SET_GSI_ROUTING(r5, 0x4008ae6a, &(0x7f0000000000)={0x1, 0x0, [{0x0, 0x4, 0x0, 0x0, @msi={0x0, 0xc0000000, 0x6, 0x6}}]}) ioctl$KVM_IRQ_LINE_STATUS(r5, 0xc008ae67, &(0x7f0000000140)={0x0, 0x401}) openat$procfs(0xffffff9c, &(0x7f00000000c0)='/proc/schedstat\x00', 0x0, 0x0) r12 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r12, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) 1m51.623664208s ago: executing program 5 (id=5933): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x4}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x54, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x28, 0x1, 0x0, 0x1, @fib={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FIB_DREG={0x8, 0x1, 0x1, 0x0, 0x11}, @NFTA_FIB_FLAGS={0x8, 0x3, 0x1, 0x0, 0x5}, @NFTA_FIB_RESULT={0x8, 0x2, 0x1, 0x0, 0x3}]}}}]}]}], {0x14}}, 0xbc}}, 0x0) 1m51.554119257s ago: executing program 5 (id=5934): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0xa9dec26}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x64, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x3c, 0x4, 0x0, 0x1, [{0x38, 0x1, 0x0, 0x1, @synproxy={{0xd}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_SYNPROXY_WSCALE={0x5}, @NFTA_SYNPROXY_MSS={0x6, 0x1, 0x1, 0x0, 0x6}, @NFTA_SYNPROXY_WSCALE={0x5, 0x2, 0x2}, @NFTA_SYNPROXY_WSCALE={0x5}]}}}]}]}], {0x14}}, 0xcc}}, 0x20004000) ioctl$SNDRV_CTL_IOCTL_CARD_INFO(0xffffffffffffffff, 0x81785501, &(0x7f00000002c0)=""/4096) 1m51.441847494s ago: executing program 5 (id=5935): sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x2e9, 0x0) r0 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r0, 0x11b, 0x2, &(0x7f0000000000)=0x200000, 0x4) setsockopt$XDP_TX_RING(r0, 0x11b, 0x3, &(0x7f0000000040)=0x100, 0x4) getsockopt$XDP_STATISTICS(r0, 0x11b, 0x7, &(0x7f0000000080), &(0x7f00000000c0)=0x30) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x35, 0x0, 0x0) 1m50.895616758s ago: executing program 5 (id=5936): openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) (async) openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r2 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x129a02, 0x0) sendfile(r2, 0xffffffffffffffff, 0x0, 0x8) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) (async) setsockopt(r3, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) (async) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000000)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendto$inet6(r3, &(0x7f0000000040)='l', 0x1, 0x0, &(0x7f0000000100)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r3, &(0x7f00000000c0)='5', 0x1, 0x20000000, 0x0, 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x6000) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x1) preadv(r1, 0x0, 0x0, 0x1, 0x5) (async) preadv(r1, 0x0, 0x0, 0x1, 0x5) set_mempolicy_home_node(&(0x7f0000146000/0x1000)=nil, 0x1000, 0x4000000, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x0) write$vga_arbiter(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000540)={'wlan0\x00'}) r5 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) (async) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev}, 0x2}}, 0x2e) unshare(0x22020600) socket$pppl2tp(0x18, 0x1, 0x1) (async) r7 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r7, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x4e22, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x2, 0xfffffffe}}, 0x2e) 1m50.166371355s ago: executing program 5 (id=5938): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=@ipv4_newrule={0x24, 0x20, 0x301, 0x0, 0x1, {0x2, 0x0, 0x20, 0x4, 0x0, 0x0, 0x0, 0x6}, [@FRA_SRC={0x8, 0x2, @remote}]}, 0x24}}, 0x4008040) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmmsg$inet(r0, &(0x7f0000005200)=[{{0x0, 0x4b, &(0x7f0000000000), 0x1}, 0xfd7f}], 0x1, 0x0) 1m48.351506799s ago: executing program 5 (id=5940): socket$kcm(0x2, 0xa, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') preadv(r0, &(0x7f0000000780)=[{&(0x7f0000000440)=""/140, 0x8c}], 0x1, 0xf, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0x5) stat64(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f0000000000)=""/149, &(0x7f00000000c0)=0x210) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006c61737400000000040002800800034000000105"], 0xe4}}, 0x20050800) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x2, 0xffffffff}}, 0x10) bind$tipc(r5, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10) sendmsg$tipc(r5, &(0x7f0000000180)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x2, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc4040}, 0x4048804) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x0) r10 = openat$cgroup_subtree(r9, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r10, &(0x7f00000001c0)={[{0x2b, 'cpu'}]}, 0x5) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20305}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}}, 0x0) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0xb, 0x181301) openat$vim2m(0xffffff9c, &(0x7f0000000b00), 0x2, 0x0) 1m47.368789408s ago: executing program 3 (id=5944): r0 = socket$packet(0x11, 0x3, 0x300) r1 = pidfd_getfd(0xffffffffffffffff, r0, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001300)={0x1, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="850000002f000000840000000000000095000000000000008560fc2b2062f611fc2f864ef177d634e46e8dcfe61b4fb9f600344d592fee49e176fe6ad28fbcb1f9259bfc63e9030971917e30b6f42e8f9dd6ab0ce07312a135cd363aa7e5bcef8fd0e8c7d2082584156c52ebfd69e8e13b7a8b477abc86468e11b6242133ce882f05e16b91c37b3437347f6058b4489c759783b9d4dfb55d0085a26e41201a6d8c8ced33e10048e756a40538b32bf653fa3c831a4e60599ed7a0f999d18de9984522a7cdb6fc30015633a0132c9578b7da5bd7280a5f7e28fd858ba712020b23ef8a2785b6c146c48b48ca7e232d0489661396e9303b38aa5d26d06e2e676795fd2733f95da570bab301000000ffffffff2a2792a630d8fcdc", @ANYRESHEX=r0, @ANYBLOB="0f0f5c25216b47606b4568be6fb76588f05ccd09988a957482bb7dd3d481c4edbe770d98504ac42c84b4ab18be189a12a2b928908cf43fa25d897a43023660c4c6f47681cca24334f64b373e729307a956c9a6968f375dc005645001548de614f4113774db2cefdd60348d61b847617c34f253f10ac88f5644df4a16537405a1039e4401b154bdd6b8270c1eb8ed198ecf5f45deea6f060c0a622019dbe3cbacc9a80c61318c85571d55eca20026f2ea7ba91860ae5ab675e298ec2a66dfc92e6d55ad9a00e05887af036766fa5e90eb69426e41eac0d6bca76c6f9042f6cd304b4abceeb420d963291baf63b7f78b7acdf5cd795348a0eabd3a7196584144431df58557b776f71dccd69a1defa6f7427749a3d89e531d7941f41bdcdc48414bd24436fc959ebe40b31b517d0a1429a8f7947ca0e67fab0afda4f8751af868ce33e684b8a8d3e579bd5f22211a3c427f59430a854c1a12128a9fcc5fb5235ba03a6172afd88b8600fd2b8b4f05d4a7f93d989ff92d4219f9d8d9960552e63dd9911032e74de340814d415541c5116b88d0f38a94e1e3c5e26e1f186e759114818227a80e9fa796a76742b280af07f959f66f334472e72e56b02d4e5c3e156fd9e7fb88ae984770daa4972bc6bb30bd1f436c5406243ff9531370be43e5bf7a676c6f2624d7862da27f832a9091386eeb8fa26fc06f9e333b9da22d309123633afe60408bcf56d87fa2adacc463fe4c554e4bf97c906e1e6d0a87f75bcc3e57eae81e2a6028b04a7acdd6caacd6c2247a6a3781583efbd64183f8aab59a8c051903d0f85e6d7229c371c0797fd809ac76c995d4321add875f1f73054251af67518eb5682bf1937a7e58f25e3c171aab4cfc076b0a3a6dff08bb7afe60d0c9c166714b30ef44f26f9ead83f1551decf8e092baa0bedc8c859d0bc884587825d6317c477557372518bb2ea55e8b017c3a6a4a28be3745fd679b0bb843060e951bed6b2ee30e7162c48f8a3e8f07a39f92a4cc3aec9277279eb4baeeae7f3ac0d1c0be886d055ae215b27b208e7731ff4e49c6b24e1193dd923704a09c06745de438939c03a14cf4f551908a442e57840edfe317c0efe585cbbb178fd713a32c2cbaabfbe6f95ce9f5ce7071edf1ba5c2ac02d56601420fe6cf2e73c660ca2a3f26fc526253578185eff5d325b61ad2506d30ed14a4ba60d5de7fde356d2c11d4dc96c4eec8ca811fa5335b991f5e949f1de9b328e067e0e0cbc7373ce3a8558667d90330400a9f8aeb2230df80974fa72b9faedeb166ff0fd6c42a5f80c4d85bb2cc717724992c10642fc2ee99f95baa42f7486ccc1714a37a25bfa0414ae5c1c75ccbcd896c3cbfd64c7970748dbb58e58850b2811518b5b9c682143e1ede17924b4fe223a75b7a9ebf610307390a548a2b4491d4fe920c584d1948e04084580d0706fc0edb82985fa7ab6204b0d6db7dba7c7e176887b4ba67fdfe68343c75ef5da6bc55936565f705242559343604c7026ff010b39553d093e2fb5d3b134c39730537a379b4ea0ec7511cdf844118f821135e795d3ac53fca28a62ed85115f04344f5c19a27f8c0094aaa7bad00d729b1566cb7dfac67e04db2c145d334034d9fdc692b6b7c989d9923d1fa5fda9d2d0b5128b43fc803a31abcdc392957a14768af24b588999b36f2dbb25d116fafc85c19b498c26192025b602703b4efd0b33e5ddb2be54ecc98f95ba371c2e5aa9197d37c71204c2d4b9dfc5f7d8129c1bffa3b5fa6d03c129081f5a7660cee6c10bde55bdfec6fb54b4b47b69a89967d7c5e929a0547402dbf32a2f1f8f8042b0caf92fa706eb20c491b3bdbd2ee1285a22098ad652d84c0ad5e40ee68923d56b2a30c6fe3c80d50b1a5e01c1905315200af994055ced4f07b829cda6e6d2007e8a497e650d142e86a58c121741552949231e15d6348ac9fee386e7b9ba7293f0421bf43e429f6e3aa48f6cbd4ae6fdc81d96fb5f2767f095ef76c81ecfb95e01612f5ddbb3b523bb7016f84ac249ef1898f7db48045b5a7f9763072f70b79b4e2347d53ef166e681b152848ee6ee63c468d3ae28f29e216d56df47f75a843fdca76574e330cc61a83c0264f4bc7495d8394d8138700ab275f8c7d7ce6cd2855615ed8fcc6a5d002e6bae1866c4e68a138823509f4fbfcd3e51e29d1afe623e964c4bb6ea129faba437ee2f43ceec9db87c87d1c56ad2e8848c28ba0698e37080df2d329b27de33e873f627efd46a9cfa2028520173f429c0012a8e7452369cb7d45317e3ee7db2d3d94cb7d1af2b52d1eff90a6c1d369a29005bad5d24ae0d04f0eaff8c5eafd56f7dc36c6afc81d088caaee14e7599ffde8de6e5ff01ab336eef1c9806997da5f9d31f2c9bcf037df532b5aa94770155103182e4f08fd3d8712acdde701bb0ae572222c6f4b48217a08272a4eee171f3e6165cfa3e5ef461fed9ce9f2c23b81d264883f4a42b9ab819d96ef82b9afa563b3a7a2209f16547658e4cd8c534f044e420c68a6964e7e6fbe00839e85503116f5b27d3e97cbee20fd4246cddc569e0f2f45453d869fb6e717c29fd743ffe683a3af1254b722895b735b44ee3c92ca7a2645120921935ff702495289f9fe9073c08cd6d88bebb2ca8d875e551c86f49de747d93370db90d62a1fef46b57f158a5fd096c4652f1dc1dca1ea110573efb2bdcbe18db3f4d092f0d7bc15264aabaab538ba9f68dd2ecfbb991ac1ece4ba4193d8ea8765316cb3d678321f5f3e8855d22a1c6126ecf81073fb11ab8a9a687fa9d43992646b81dfb903fa312fbe5ae92dd09db806647725abc77b1e78e4fab9776821a44255cbc7e95d52ec694134e0d9c11a1c35e899c19483749abe0beb6c65233c4e452e17edf5c6994dd208f70dc4727f5fb2100350943b5462b4e3c85c3c2dfb6bad8df834be3834d5f7ce6d637d23c4cae5da8d715d7f10d2e41a0a7a53d9ee6e1bf0701cf04b7ecbfee7ca29f693b208c659e8b145db36293fd9f1773ea2134316f48ceb4cb2914351195ad9bc1129792994b5059ad57e8060b039590932c4d3a33f0a958a49be30be340c2875497c4b1bfafcee95d4016e93198932da27b7b7e602acc0d230c922012f80ba544cc02fbacf0cda0907e661072a6bc5eaad972753ec0a07001491d38ef43d088564aa1bed453bc0de690cb01c1d0542b564974d80237d03c089dc527808d2e387e5c821bef58caac9b2ddbc744390c212dc8ad71c6db7fcecff3ccc1ac36cfe748362353b82b53a8ac3bdab08dcfe692fe0e1caa7d38a0b77ce8a4289c42229b1fbc1e15ae39de5c1982af70189a0d1fbac6e1774815c2b184cf1ca82897dce21f60a7d846066d8f1bdd7c21b03260c266f3a584734b9a6c1d969bb7970f0f729bbd0ab0f05257a3d93806da9ef288a2ef15eb008d07bdcd82abcc2705733ecf82b977c063c9a7df0cf37fad388ae226d9742adee6be1ff27e85dfb5d239d59bfb0f04393a8cd2a582095d5a8f5bd78023d80310b4b9526e9e85eabe01cb4cb9681720c5671ade6b8ea25a7576eb6fac466f26e00cde83ca88a7e330ac7b7ba8b7ff3f01aaef3289ceb5bb937224a66cc626d2d631bb95322fbd22cfb0ca972fc3f4db1b4148e2be7fe9ab756734316d2ae25c690bd527e3e7504dd5953c62c39cd98f83f2ef935d2e2ecf327747da991d390043716bb873314749438366a7a9315c893f01e52f0ae8ce7bfc67df5e2e15e344fab9c4e6caf9afbb9cb1200ea8e95cefc684a955de2264c2eaf31cd2d1525277e390739d3a26269783c175295adf3bc348a9651d95be90d90ec8ad187b6d689a37c86598ac96f9b26d29da2a4b62fa018f7c71d37da5e018dd55e9adbfbc2f40738208419ece973e6ff03df69893ba6a9c5c051300c6878bf5c1975be0e6b55154b51173820772ae3db53972c3430a20e590dac7e00a9f9014c93fa91e23327ea02c77fc569661d5ce8c7ecaeb38c9217ec7ff5c26b196ce95756c294108356a19dce2b9e4079d229bb937bd87b7cca131bdc8e30e73b2510fa5e967b80d10b191bac32c9cfaf3554fc0a68058f5a054f09b3c1753a10d0f8d7d9087d572dfce501a80b4fffeb48f283236c6a6653936fd250d6d9305d35f486c97b30db606066cff2560d2c6c78c5e2c16b7f28d7067261d6fcfb7bdd696af1dce94e420c0b30c5e6b17a165da3802a5a58f37db1541e13e35f4b48a121b62a08a9d903f077f75db17ddf0144198b0ec645b487dc7e031c5daac1ad7d572dc6178e0e6ad7ebbf8a41ad396ab92af9169ff67dd995e75b51d5cf08076861fe6c898604c386ee806a3b0cc4666ea54624d9edaa52d276cb82dff1c7f60f3bb652963feedc33bdad6381a6efbab9c55d060c126915829fbd133ba4d48866112988629e403f6ddadad0f40926cb556e3fd8b21911fb84d125c81ed4dfb51b687c8736612467fc87786ac316f4711c4dcbf5814bf4ac94efa0f98fd3f34e8aa2af75d64a3f189c2a342d24df054e352a8f584ce5b4fe64589f85c93828e0095f904a606b0d52c8eb3d891d5e301ff061a1a16c578c641a9ffb4f18e76ff70e0d79fe204d3a51b200ffba624ffed6345afcc83af3287ec2ece041e31f50054d62b8cccbf36ae9af5ab71a46315d2406f5834528bd2bf2170c7655ec1af912685a0783e827bd54633953d1ab509877929f349c1f2e3c24639fd6578772d72277ec7aa4cfa5d97d56e9beec16f9deb179f63aba220fb91a82dd836dc4c1a348337921667bba10c46aa7eb0e3a73d54ba359fc8d2f9ed280e17c33d87d6209d0b466bac3d3440b55136ed3ed47d44e35c278413463d514b10a1463e85095821dedf59522c8156c8803367d7f152e246d10b45e42f1aeb5bbd2af3600ab65b640735614edeec86685f97d743bb892f7d8255e4b9aa265fa575807f4f15a929850e0e9497aa9e9beba50ffa1a35a58d75b4ff0809d6a8aa39de511d350813b704c1c38d1b6437bce98df39bcd297e03bbc7e13458a283b1c41e021bc8e0731ad2a9d71f7603e66ff37fd47c26d17563146c5e88461dceb957eb8714d3730f699399958b94d35e8323cac5aed97c566842b4bf2fb40ea843db5eb69f61c96d8a75c08a7cc4248306a91063257d50afe2c6c732c8fb16cf993a6abc5f9b0dd427b3dada1c676032452596f71d67ee541d868760a9b84a17da6dddbeef1b3df0fda5d6188cae77452b1586ea777f58f30504bd33afba145212aef27c059b913e9a68a8e4a3cc0d131de2396bd803a09c2211bbea33ec70700c3eb571f4583108848033091e5720bd6cde6eed062c8184f13a49eaceecac69e96439a01f921875da7620dff7656d7a9a34fb8194f083f8679b5769b812e9bf86a22f16ebf860ac0d0350c1e5db5f5258dd52d2dbad9dc37519d8c4f1353c7badb09c7f896eb44874d3f443fe6a4af173d478fb82baf872fccdd849610f4306e5705298cacd0a7256bd18df4bfb734556ded0092743c4de40cae419bece4ff6422819d7c9833f0040094c67aa077e92a4e06e00f97951165ba1dcce23dd5a44f58c5f945c95de1bc744054f0af5b3a8aeafdc78adb08adbdc14443ac42fcf73d7d3425f2053cb7327883b504a1776b65f5959702ce842cf93549e48ad75c5fb3c2bf9fca85fdac13a2e5726977021b0265d75a3b0c8d676ece1a7b81d649572087d7fb52b8c35daa5cf19a33dfb6d02326998a17710e4fabcab8165c3268059d5585eefe19ea6de5d6fd0b9b897ff7028e63a065aa7818f298f59"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, r1}, 0x94) setsockopt$sock_attach_bpf(r0, 0x1, 0x32, &(0x7f0000000040)=r2, 0x4) r3 = fsopen(&(0x7f0000000000)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r3, 0x1, &(0x7f0000000040)='source', &(0x7f0000005fc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\n\x8c0xffffffffffffffff, 0xffffffffffffffff}) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)={0x2c, r7, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x4000000}, @NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x2c}}, 0x0) connect$unix(r5, &(0x7f00000002c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r8 = syz_open_dev$video(&(0x7f0000000000), 0x101, 0xab02) ioctl$VIDIOC_S_INPUT(r8, 0xc0045627, 0x0) ioctl$VIDIOC_S_CROP(r8, 0x4014563c, &(0x7f0000000040)={0x9, {0xf8001004, 0x9, 0x6, 0x80b}}) sendmsg$BATADV_CMD_SET_VLAN(0xffffffffffffffff, &(0x7f0000000400)={&(0x7f0000000340), 0xc, &(0x7f00000003c0)={&(0x7f0000000380)={0x28, 0x0, 0x4, 0x70bd2c, 0x25dfdbff, {}, [@BATADV_ATTR_THROUGHPUT_OVERRIDE={0x8, 0x3b, 0xfffffffa}, @BATADV_ATTR_ORIG_ADDRESS={0xa, 0x9, @local}]}, 0x28}, 0x1, 0x0, 0x0, 0x4000}, 0x844) r9 = openat$uhid(0xffffffffffffff9c, &(0x7f0000001900), 0x802, 0x0) r10 = openat$full(0xffffff9c, &(0x7f00000001c0), 0x40, 0x0) ioctl$KVM_IRQ_LINE_STATUS(r10, 0xc008ae67, &(0x7f0000000240)={0xfffffffe, 0xfc000000}) socket$nl_generic(0x10, 0x3, 0x10) writev(r9, &(0x7f0000000200)=[{0x0, 0x59}], 0x1) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) 1m46.392556175s ago: executing program 3 (id=5948): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000004, 0xfa11, 0x1ff}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0xfffffffffffffd69, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a3200000000140000001100"], 0x7c}}, 0x4000d) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={0x0}, 0x1, 0x0, 0x0, 0x850}, 0x50) ioctl$FBIOPAN_DISPLAY(r2, 0x4606, &(0x7f0000000200)={0x190, 0x640, 0x3c0, 0x280, 0x16, 0xc0e2, 0x18, 0x0, {0x5, 0x2008001}, {0x4, 0x7}, {0xed87, 0x2000}, {0x29, 0x10001}, 0x1, 0x80, 0x7e, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x6, 0x8, 0x80d, 0x7fff, 0x0, 0x1, 0x3, 0x5}) inotify_init1(0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r5, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x20, &(0x7f00000003c0)=[@in={0x2, 0x4e23, @multicast1}, @in={0x2, 0x4ea1, @local}]}, &(0x7f0000000340)=0xc) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r5, 0x84, 0x6d, &(0x7f0000000900), &(0x7f0000000000)=0xfe47) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) setsockopt$inet_int(r4, 0x0, 0xf, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000300)=@abs={0x0, 0x0, 0x3}, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x0, 0x2000, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r7, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4c, 0x3, 0x6, 0x0, 0x3}, 0x0) 1m45.474103904s ago: executing program 3 (id=5949): openat$ptmx(0xffffffffffffff9c, 0x0, 0x464541, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r2, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000002140)={0x50, 0x0, r3, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x50) read$FUSE(r2, &(0x7f000000b040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r2, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r4}, 0x10) mremap(&(0x7f00002fc000/0x2000)=nil, 0x2000, 0x800000, 0x0, &(0x7f0000022000/0x800000)=nil) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) r5 = open_tree(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x800) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f00000021c0)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_CONTROL(r7, 0x8008551c, &(0x7f0000000180)={0x1, 0x18, 0x20, 0x1, 0x0, 0x0, 0x0}) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.freeze\x00', 0x275a, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r8, 0x0) mbind(&(0x7f0000000000/0x1000)=nil, 0x3000, 0x2, &(0x7f0000000300)=0x2, 0x7797, 0x3) 1m33.302863958s ago: executing program 36 (id=5940): socket$kcm(0x2, 0xa, 0x2) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) r0 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') preadv(r0, &(0x7f0000000780)=[{&(0x7f0000000440)=""/140, 0x8c}], 0x1, 0xf, 0x0) r1 = socket$can_raw(0x1d, 0x3, 0x1) r2 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000000)=0x5) stat64(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)) r4 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$IP_VS_SO_GET_SERVICES(r4, 0x0, 0x482, &(0x7f0000000000)=""/149, &(0x7f00000000c0)=0x210) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000040900010073797a30000000009c000000090a010400000000000000000700000308000a40000000000900020073797a30000000000900010073797a3000000000080005400000000d58001280200001800e000100636f6e6e6c696d69740000000c0002800800014000000008200001800e000100636f6e6e6c696d69740000000c000280080001400000000014000180090001006c61737400000000040002800800034000000105"], 0xe4}}, 0x20050800) r5 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r5, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bind$tipc(r5, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x2, 0xffffffff}}, 0x10) bind$tipc(r5, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42, 0x1}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000100)={0x42, 0x2, 0x2}, 0x10) sendmsg$tipc(r5, &(0x7f0000000180)={&(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x2, {0x43, 0x2, 0x4}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0xc4040}, 0x4048804) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000001c0)={'wlan0\x00', 0x0}) r7 = socket$netlink(0x10, 0x3, 0x0) r8 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r8, 0x6, 0x0, 0x0, 0x0) r9 = fsmount(r8, 0x0, 0x0) r10 = openat$cgroup_subtree(r9, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r10, &(0x7f0000000300)=ANY=[@ANYBLOB='-cpu'], 0x5) write$cgroup_subtree(r10, &(0x7f00000001c0)={[{0x2b, 'cpu'}]}, 0x5) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001140)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x503, 0x70bd2c, 0x0, {0x0, 0x0, 0x0, 0x0, 0x20305}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x4}}}, @IFLA_LINK={0x8, 0x5, r6}]}, 0x3c}}, 0x0) setsockopt$CAN_RAW_JOIN_FILTERS(r1, 0x65, 0x6, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000180), 0xb, 0x181301) openat$vim2m(0xffffff9c, &(0x7f0000000b00), 0x2, 0x0) 1m30.222106778s ago: executing program 37 (id=5949): openat$ptmx(0xffffffffffffff9c, 0x0, 0x464541, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) read$FUSE(r2, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000002140)={0x50, 0x0, r3, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x50) read$FUSE(r2, &(0x7f000000b040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r2, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r4}, 0x10) mremap(&(0x7f00002fc000/0x2000)=nil, 0x2000, 0x800000, 0x0, &(0x7f0000022000/0x800000)=nil) ioctl$LOOP_SET_FD(0xffffffffffffffff, 0x4c00, r2) r5 = open_tree(0xffffffffffffffff, &(0x7f0000000000)='./file0\x00', 0x800) ioctl$sock_inet6_tcp_SIOCOUTQ(r5, 0x5411, &(0x7f00000021c0)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r7 = syz_open_dev$usbfs(&(0x7f0000003f00), 0x1ff, 0xa401) ioctl$USBDEVFS_CONTROL(r7, 0x8008551c, &(0x7f0000000180)={0x1, 0x18, 0x20, 0x1, 0x0, 0x0, 0x0}) ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='cgroup.freeze\x00', 0x275a, 0x0) syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x200000b, 0x12, r8, 0x0) mbind(&(0x7f0000000000/0x1000)=nil, 0x3000, 0x2, &(0x7f0000000300)=0x2, 0x7797, 0x3) 9.727171208s ago: executing program 7 (id=6216): syz_genetlink_get_family_id$nl80211(&(0x7f0000000980), 0xffffffffffffffff) syz_usb_connect(0x0, 0x36, &(0x7f0000000180)={{0x12, 0x1, 0x0, 0xc8, 0x54, 0x9b, 0x40, 0x2c7c, 0x30e, 0x8128, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0xff, 0x18, 0xd4, 0x0, [], [{{0x9, 0x5, 0x6, 0x2, 0x3ff}}, {{0x9, 0x5, 0x82, 0x2, 0x8}}]}}]}}]}}, 0x0) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) r0 = syz_io_uring_setup(0x5455, &(0x7f0000000400)={0x0, 0x9e03, 0x1, 0x2, 0x23de}, &(0x7f0000000040)=0x0, &(0x7f0000000000)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000700)=ANY=[@ANYBLOB="4c00000002060108000034e40000000000000000050001000600000005000400000000000900020073797a3100000000050005000a00000012000300686173683a6e65742c706f7274"], 0x4c}}, 0x2) sendmsg$IPSET_CMD_ADD(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=ANY=[@ANYBLOB="540000000906010200000c0000000000020000000900020073797a310000000005000100070000002c0007801800018014000240fe8000000000000000000000000000bb060004404e1f00000500070088"], 0x54}, 0x1, 0x0, 0x0, 0x10000082}, 0x80) sendmsg$IPSET_CMD_DESTROY(r3, &(0x7f0000000780)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x1}, 0x8000) userfaultfd(0x1) syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502) r4 = syz_io_uring_setup(0xc6e1, &(0x7f0000000380)={0x0, 0x5882, 0x10000, 0x3, 0x1000000}, &(0x7f00000000c0)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4004, @fd_index=0x3, 0x0, 0x0}) io_uring_enter(r4, 0x3516, 0x0, 0x0, 0x0, 0x0) io_uring_enter(r0, 0x47f6, 0x30, 0x0, 0x0, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r7, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e22, @private=0xa010101}]}, &(0x7f0000000180)=0x10) setsockopt$inet_sctp6_SCTP_I_WANT_MAPPED_V4_ADDR(r7, 0x84, 0xc, &(0x7f00000000c0), 0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) getsockopt$inet_sctp6_SCTP_GET_PEER_ADDRS(r7, 0x84, 0x6c, 0x0, &(0x7f0000000340)) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r7, 0x84, 0x6d, &(0x7f0000000040), &(0x7f0000000240)=0x8) r8 = syz_open_procfs(0x0, &(0x7f0000000200)='task\x00') r9 = socket$inet6(0xa, 0x800000000000002, 0x0) connect$inet6(r9, &(0x7f0000000100)={0xa, 0x4e25, 0x2, @ipv4={'\x00', '\xff\xff', @local}, 0x2}, 0x1c) getsockopt$sock_buf(r9, 0x1, 0x1c, 0x0, &(0x7f00000000c0)) lseek(r8, 0xfffffffffffffffe, 0x2) setsockopt$inet6_tcp_int(r8, 0x6, 0x8, 0xfffffffffffffffe, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newlink={0x38, 0x12, 0xff05, 0x0, 0x0, {0x0, 0x0, 0x4a00}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}]}, 0x38}}, 0x0) 7.388819288s ago: executing program 1 (id=6224): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f00000001c0), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000003c0)={'netdevsim0\x00', 0x0}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000140)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="01000000000000000000340000000c00018008000100", @ANYRES32=r3, @ANYBLOB="080011"], 0x28}, 0x1, 0x0, 0x0, 0x40000c5}, 0x0) 7.207967744s ago: executing program 1 (id=6227): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000840)=@base={0x1, 0x100008, 0x4, 0x8, 0x1, 0xffffffffffffffff, 0x400000}, 0x50) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) syz_usb_connect(0x5, 0x0, 0x0, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bind$inet6(r2, &(0x7f0000000300)={0xa, 0x4e23, 0x0, @empty, 0x5}, 0x1c) sendto$inet6(r2, &(0x7f0000847fff)='X', 0x34000, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) readv(r2, &(0x7f00000001c0)=[{&(0x7f0000000140)=""/112, 0xfdef}], 0x1) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) r3 = socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000011c0)=[{0x0}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x7, 0xca352c92cb699c71, 0xffffffffffffffff, 0xd0a55000) unshare(0x2c020400) r4 = msgget$private(0x0, 0x0) msgrcv(r4, &(0x7f0000001080)={0x0, ""/1}, 0x2000, 0x2, 0x3000) syz_emit_ethernet(0x56, &(0x7f0000000180)={@local, @empty, @void, {@ipv6={0x86dd, @udp={0x0, 0x6, "39a59f", 0x20, 0x2b, 0x0, @remote, @local, {[@routing={0x3a, 0x0, 0x2, 0x1}], {0x0, 0x0, 0x18, 0x0, @wg=@data}}}}}}, 0x0) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000000780)={{r1}, &(0x7f0000000100), 0x0}, 0x1c) sendmsg$nl_route(r0, &(0x7f00000018c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="280000001e000100000055096dd9000007000000", @ANYRES32, @ANYBLOB="000000000a0002"], 0x28}}, 0x0) 6.60677883s ago: executing program 7 (id=6230): r0 = socket(0x10, 0x3, 0x9) sendfile(r0, 0xffffffffffffffff, 0x0, 0x7fffffffffffffff) 6.47528355s ago: executing program 0 (id=6231): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x0) connect$inet(0xffffffffffffffff, 0x0, 0x0) r0 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000100)=0x4) pwritev(r0, &(0x7f0000000040), 0x2, 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c00000019000100000000000000000002"], 0x2c}}, 0x0) sendto$inet6(r2, &(0x7f0000000000)='s', 0x10a73, 0x800, 0x0, 0x4b6ae4f95a5de35b) r3 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000c80)={'lo\x00'}) r4 = getpid() r5 = syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) ioctl$vim2m_VIDIOC_S_FMT(r5, 0xc0cc5605, &(0x7f00000000c0)={0x1, @pix_mp={0x0, 0x0, 0x34324142}}) process_vm_readv(r4, &(0x7f0000000040)=[{&(0x7f0000006180)=""/152, 0x98}], 0x1, &(0x7f0000008640)=[{0x0}], 0x1, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x2, 0x0, &(0x7f0000000140)={0x0, 0x0}) write(r6, &(0x7f0000000000)="fa", 0xfffffdef) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=@gettaction={0x50, 0x32, 0x800, 0x70bd26, 0x25dfdbfc, {}, [@action_gd=@TCA_ACT_TAB={0x20, 0x1, [{0xc, 0x15, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0x10, 0x10, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'gact\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8}, @action_gd=@TCA_ACT_TAB={0x4}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x1c3e}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0xfbaa}]}, 0x50}}, 0x0) openat$sequencer2(0xffffff9c, &(0x7f00000000c0), 0x410542, 0x0) io_setup(0x7, &(0x7f0000004200)=0x0) r8 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x81, 0x0) r9 = ioctl$KVM_CREATE_VM(r8, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) r10 = eventfd(0x5) r11 = eventfd(0x3) ioctl$KVM_IRQFD(r9, 0x4020ae76, &(0x7f0000000280)={r11, 0x4, 0x2, r10}) io_submit(r7, 0x1, &(0x7f0000000b40)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x3, r11, &(0x7f00000002c0)="a94f42243ed44d80", 0x8, 0x9}]) fstat(r3, &(0x7f00000001c0)) 6.456897083s ago: executing program 7 (id=6232): ioctl$UI_DEV_SETUP(0xffffffffffffffff, 0x405c5503, &(0x7f0000000200)={{0x9, 0x4, 0x3, 0x8}, 'syz1\x00', 0x43}) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1, 0x400) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000300)={0x4000001, 0xffffb1c4}) lstat(&(0x7f0000000100)='./file0\x00', &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0, 0x0}) fsetxattr$security_capability(r0, &(0x7f0000000080), &(0x7f00000001c0)=@v3={0x3000000, [{0xfff, 0x7}, {0x40, 0x4}], r1}, 0x18, 0x1) ioctl$DRM_IOCTL_WAIT_VBLANK(r0, 0xc018643a, &(0x7f0000000040)={0x4000000, 0x400000}) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r0, 0xc02064b2, &(0x7f0000000000)={0x8, 0x5, 0x10}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_ACCT_GET(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x14, 0x1, 0x7, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}}, 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x4004000) socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000003005740ed0b0011c3ec000000010902120001000000000904"], 0x0) syz_usb_control_io(r6, 0x0, &(0x7f00000010c0)={0x84, &(0x7f00000000c0)=ANY=[@ANYBLOB="00000100000008"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$printer(r6, 0x0, 0x0) syz_usb_control_io$uac1(r6, 0x0, &(0x7f0000000540)={0x24, &(0x7f0000000200)=ANY=[@ANYBLOB="200549000000ed7fa240610d12a37ea7e85ef781875f247abef3501c4f6927ebb9f1f81049bc46b6ab45ad5e7d1273b47f0c21de729bc1f272ba3e94700b5f1c2dab6375c458de"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$BATADV_CMD_SET_MESH(r3, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000780)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="010028bd7040010000000f00000005002e000000000008000300", @ANYRES32=r5, @ANYBLOB="08003100960a0000050030"], 0x34}}, 0x18) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x0) syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x800) socket$inet6(0xa, 0x800000000000002, 0x0) socket(0x1, 0x1, 0x0) fsopen(&(0x7f0000000000)='nfs\x00', 0x0) socket$netlink(0x10, 0x3, 0x0) pipe2$watch_queue(&(0x7f0000000040), 0x80) mprotect(&(0x7f0000000000/0x2000)=nil, 0x2000, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) prctl$PR_SET_IO_FLUSHER(0x43, 0x10080000001) 5.426829538s ago: executing program 9 (id=6234): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r0, &(0x7f0000000180)={0xa, 0x4001, 0xd000000, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='blkio.throttle.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_script(r1, &(0x7f0000000100), 0xfffffd9d) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000080000000000000000100a44000000090a010400000000000000000300000208000a40000000000900020073797a32000000000900010073797a3000000000080005400000001c0807000000000000000000001000010000000000000000000784030a"], 0x6c}, 0x1, 0x0, 0x0, 0x40005}, 0x0) r3 = socket$kcm(0x10, 0x2, 0x4) close(r3) socket$kcm(0x10, 0x2, 0x0) sendmsg$inet(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000180)="5c00000013006bcc9e3be35c6e17aa31076b876c1d0000007ea60864160af36514000cc008001b0007000200060001c00200bc24eab556a705251e618294ff4051f60a84c9f4d4938037e786a6d000106b062e585e4a85dc9b1335d1", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) sendfile(r0, r1, 0x0, 0x8000002b) 5.225388626s ago: executing program 0 (id=6235): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=@newsa={0x16c, 0x10, 0x713, 0x0, 0x25dfdbfc, {{@in=@rand_addr=0x64010101, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x0, 0x4e21, 0x2, 0x2, 0x0, 0x0, 0x1d}, {@in6=@private1, 0xfe, 0x32}, @in6=@empty, {0x0, 0x0, 0xfffffffffffffffd, 0x8, 0x1, 0x9, 0x7fffffff, 0x543}, {0x4, 0x7fffffffffffffff}, {0x2}, 0x70bd2c, 0x3500, 0xa, 0x4, 0x0, 0x50}, [@encap={0x1c, 0x4, {0x7, 0x4e24, 0x4e20, @in6=@dev={0xfe, 0x80, '\x00', 0x2d}}}, @algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "210466d38547aa140db9a200000000c538c7cb7a"}}]}, 0x16c}, 0x1, 0x0, 0x0, 0x880}, 0x0) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0x4}, 0x8) sendto$inet6(r0, &(0x7f0000000580)="81", 0x1, 0x4040040, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) getsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, &(0x7f0000000100)={0x8, 0x8000, 0x0, 0x7f}, &(0x7f0000000140)=0x10) syz_usb_connect(0x0, 0x48, &(0x7f0000000000)=ANY=[@ANYBLOB="120100004e4aa92082051600578e01020301090236000200000000090400f50003ed02000905030000000000000904"], 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) 4.474948032s ago: executing program 9 (id=6236): r0 = socket(0xa, 0x3, 0x3a) syz_emit_ethernet(0x5e, &(0x7f0000000340)={@multicast, @remote, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0x28, 0x3a, 0xff, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev={0xfe, 0x80, '\x00', 0x38}, @dev}}}}}}, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$SO_VM_SOCKETS_BUFFER_MIN_SIZE(r1, 0x28, 0x1, &(0x7f0000000380)=0xffffffff00000041, 0x8) connect$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2711, @my=0x0}, 0x10) r2 = syz_open_dev$ttys(0xc, 0x2, 0x1) ioctl$TCFLSH(r2, 0x540b, 0x2) r3 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000002240), 0x2, 0x0) fcntl$setstatus(r3, 0x4, 0x40c00) readv(r3, &(0x7f0000002880)=[{&(0x7f0000002600)=""/255, 0xff}], 0x1) unshare(0x2040400) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000c, 0x204031, 0xffffffffffffffff, 0xffffd000) r4 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r4, &(0x7f0000000080)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @multicast2}, 0x2, 0xfffffffd}}, 0x2e) r5 = openat$apparmor_thread_exec(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000140)={'vcan0\x00', 0x0}) bind$can_j1939(r7, &(0x7f0000000100)={0x1d, r8, 0xfffffffffffffffc, {0x2, 0x1, 0x4}, 0xff}, 0x18) connect$can_j1939(r0, &(0x7f00000001c0)={0x1d, r8, 0x3, {0x0, 0x0, 0x3}, 0xfe}, 0x18) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=@bridge_delneigh={0x74, 0x1d, 0x400, 0x70bd27, 0x25dfdbf7, {0x2, 0x0, 0x0, r8, 0x2, 0x68, 0x6}, [@NDA_MASTER={0x8, 0x9, 0x20000000}, @NDA_MASTER={0x8, 0x9, 0x1}, @NDA_FLAGS_EXT={0x8}, @NDA_NH_ID={0x8}, @NDA_CACHEINFO={0x14, 0x3, {0x3ff, 0x2, 0x7, 0xc4d}}, @NDA_NH_ID={0x8, 0xd, 0x1}, @NDA_MASTER={0x8, 0x9, 0xfffffffb}, @NDA_DST_IPV6={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x13}}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4000}, 0x4) writev(r5, &(0x7f0000000500)=[{&(0x7f0000000040)="17efa1d8b5fef5bd8cb37470ec57551f2bc2b978c8f419896450f2eca7eb154d56b12daf179abfa285eb49690a584df497487e71f85f26e95181f2b5d7cf8ddec351e632cc9a7d41fd31f69a133d3626508796a50dbaebab3db9e1b1a650e6daf53098537eb373f1d25890199825d91e259c83fb4f031854c533d196f7defdd28bf2d752fa22dd67ccd988cf5ea7d20a91eb7fe4c3aba403ea87e7d7bcacbbe8f7b44a6ee15042b0bb3c1944ba01609ca4d82b86ce9d4156e95ba7c5e4de2ee5b9ae67cf3d1a865703c96d54b54f5c03e89a120f8e2da12effab7b2044", 0xdd}], 0x1) 4.408575929s ago: executing program 8 (id=6237): r0 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_fanout(r0, 0x107, 0x12, &(0x7f0000000000)={0x0, 0xb007}, 0x4) r1 = socket(0x10, 0x803, 0x0) sendto(r1, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r1, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x1c}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0xbe8}, {&(0x7f00000007c0)=""/154, 0x11}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41, 0xa6ff}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) 4.248904797s ago: executing program 8 (id=6238): unshare(0x22020400) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r0, &(0x7f0000000080)="212e18fcb5df09f264c10a3d2104372539f8dcb661c940e66f381f24c6b4fc887e54c7c8e19eaa7eb0e6954bfa51d598806707", 0x33, 0x4000, &(0x7f0000000180)={0xa, 0x4e23, 0x7, @loopback, 0x1}, 0x1c) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x282, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x14d802, 0x0) ioctl$FS_IOC_RESVSP(r1, 0x402c5839, &(0x7f00000004c0)={0x20, 0x1, 0x0, 0x400}) r2 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x1a1302) ioctl$SNDRV_SEQ_IOCTL_SUBSCRIBE_PORT(r2, 0x40505330, &(0x7f0000000100)={{0x4b, 0xd2}, {0x4, 0xff}, 0x7, 0x3}) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e24, @multicast2}, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000180)=ANY=[@ANYBLOB="ffff50ad45ffffffffaaaaaaaaaa3386dd6700000100513afffe880000000000000000000000000201ff02000000000000000000000000000189009078000000002041"], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x6, 0x8, 0x8001, 0x0, 0xb3, 0x4, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) write$UHID_CREATE2(0xffffffffffffffff, &(0x7f00000007c0)=ANY=[], 0x119) r6 = add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1028e60ab4e45b931e71645d3d636e82cfdeaadb674e1693d4a7de63820fefc4f787e272b122ebbff6884b3de82f8a3df9a2d0b67e46c349917110300b94240185146e52ac1540130161b6534e99e466173af4c775f238fae344b198915446b576be455f251e79f7ec703f937cd8530410f37000000000000", 0x8f, 0xfffffffffffffffe) r7 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r6, r7, r6}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) bpf$MAP_CREATE(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b00000008000000000000000080000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) syz_open_dev$sg(&(0x7f0000000000), 0x4, 0x8000) bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="11000000040000000400000008"], 0x48) socketpair(0x2b, 0x1, 0x0, &(0x7f0000000040)={0x0, 0x0}) 4.088168506s ago: executing program 9 (id=6239): openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) (async) r0 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x2200, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x804) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) eventfd2(0x65c, 0x80000) (async) r2 = eventfd2(0x65c, 0x80000) socket$alg(0x26, 0x5, 0x0) (async) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'pcbc(fcrypt)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) (async) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000412ff8)="3665a1ab415b7ac7", 0x8) r4 = eventfd2(0x4001, 0x800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r2, 0x7, 0x0, r4}) r5 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TIOCGETD(r5, 0x5424, &(0x7f0000000080)) (async) ioctl$TIOCGETD(r5, 0x5424, &(0x7f0000000080)) r6 = eventfd2(0x65c, 0x80000) r7 = eventfd2(0x4001, 0x800) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r6, 0x7, 0x2, r7}) (async) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000100)={r6, 0x7, 0x2, r7}) socket$nl_generic(0x10, 0x3, 0x10) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) (async) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000080)={'wlan0\x00'}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) (async) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r10, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f0000006980)=[{{&(0x7f0000000500)=@qipcrtr, 0x80, &(0x7f0000001c40)=[{&(0x7f0000000780)=""/235, 0xeb}, {&(0x7f0000000000)=""/47, 0x2f}, {&(0x7f0000000880)=""/4096, 0x1000}, {&(0x7f0000000580)=""/105, 0x69}, {&(0x7f0000001880)=""/87, 0x57}, {&(0x7f0000001900)=""/7, 0x7}, {&(0x7f0000001940)=""/14, 0xe}, {&(0x7f0000001980)=""/132, 0x84}, {&(0x7f0000001a40)=""/202, 0xca}, {&(0x7f0000001b40)=""/232, 0xe8}], 0xa, &(0x7f0000001cc0)=""/4096, 0x1000}, 0x9}, {{&(0x7f0000002cc0)=@hci, 0x80, &(0x7f0000002e40)=[{&(0x7f0000002d40)=""/220, 0xdc}], 0x1}, 0x5}, {{0x0, 0x0, &(0x7f0000003180)=[{&(0x7f0000002e80)=""/148, 0x94}, {&(0x7f0000002f40)=""/64, 0x40}, {&(0x7f0000002f80)=""/155, 0x9b}, {&(0x7f0000003040)=""/89, 0x59}, {&(0x7f00000030c0)=""/119, 0x77}, {&(0x7f0000003140)=""/35, 0x23}], 0x6, &(0x7f00000031c0)=""/152, 0x98}, 0x1}, {{0x0, 0x0, &(0x7f0000003840)=[{&(0x7f0000003280)=""/82, 0x52}, {&(0x7f0000003300)=""/5, 0x5}, {&(0x7f0000003340)=""/184, 0xb8}, {&(0x7f0000003400)=""/93, 0x5d}, {&(0x7f0000003480)=""/217, 0xd9}, {&(0x7f0000003580)=""/154, 0x9a}, {&(0x7f0000003640)=""/167, 0xa7}, {&(0x7f0000003700)=""/96, 0x60}, {&(0x7f0000003780)=""/146, 0x92}], 0x9, &(0x7f00000038c0)=""/96, 0x60}, 0x1000}, {{&(0x7f0000003940)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @link_local}, 0x80, &(0x7f0000005b00)=[{&(0x7f00000039c0)=""/247, 0xf7}, {&(0x7f0000003ac0)=""/4096, 0x1000}, {&(0x7f0000004ac0)=""/4096, 0x1000}, {&(0x7f0000005ac0)=""/53, 0x35}], 0x4, &(0x7f0000005b40)=""/107, 0x6b}, 0x8}, {{&(0x7f0000005bc0)=@rc, 0x80, &(0x7f0000006200)=[{&(0x7f0000005c40)=""/193, 0xc1}, {&(0x7f0000005d40)=""/147, 0x93}, {&(0x7f0000005e00)=""/91, 0x5b}, {&(0x7f0000005e80)=""/12, 0xc}, {&(0x7f0000005ec0)=""/153, 0x99}, {&(0x7f0000005f80)=""/198, 0xc6}, {&(0x7f0000006080)=""/167, 0xa7}, {&(0x7f0000006140)=""/171, 0xab}], 0x8, &(0x7f0000006240)=""/129, 0x81}}, {{0x0, 0x0, &(0x7f0000006580), 0x0, &(0x7f00000065c0)=""/210, 0xd2}, 0x7ff}, {{&(0x7f00000066c0)=@nfc, 0x80, &(0x7f0000006940)=[{&(0x7f0000006740)=""/217, 0xd9}, {&(0x7f0000006840)=""/120, 0x78}, {&(0x7f0000006300)}, {&(0x7f0000006300)=""/37, 0x25}], 0x4}, 0x1}], 0x8, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_procfs(0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) inotify_add_watch(0xffffffffffffffff, &(0x7f00000001c0)='./bus\x00', 0xa0000100) r11 = open(&(0x7f0000000180)='./bus\x00', 0x189a7c, 0x113) r12 = open(&(0x7f0000000200)='./bus\x00', 0x4e142, 0x0) pwritev2(r12, &(0x7f0000000040)=[{&(0x7f0000000280)="c8bb204907f17dd411b86333f6274ce63d1bc1318ef93b6fe487ca1c9367c3309a95f867491e56901811d1ab00352f2bd48178aab4631bb3a0d9d113bb32b42c3e070e2f14b1c4e74c7acef25c3079a2294aa4dddf22b79fd437670591638aeff751dd5973e802b2e546e445aa5cb0664e45e919767aac19070fad97827378de2cea1cd248ac00d446887b97e091fd7a83edd1141c1243c96f52038d21876c3b9d8912bc5bd98733bfbc8f", 0xab}, {&(0x7f0000000340)="d1236209c672e9723f8ca080c82fbdba257c5aa9d214c70d5574798fbebeaab79f4b876255c291ce341b8bb95fd1219d65f5e498e38df78c89099b09612180f19fbfa2221e5562c5a5e08b508f2e90d646a459573d957debcd75668bb5465c1c524203508cc8b20c91bce6144920a7424281425899ddd144b95b9a8d7c3b550cb3953e5a91a4800079573636dda1b7bb1c346c8718de50c4f028451edd324ca99a711f", 0xa3}, {&(0x7f0000000400)="25f3986f5a6a8e37383c0164f5b3cb0b7dac2064b56063d28fa992a0e08d9ca53f8e8ed9ebbbe536bbc6478e2c83815063923793ae3996e1d62a7523fd5bdb286a82d3692ea9d795e915c2449df17ff8f2361f008f9ac0c86654b4688e9f22e3a439f4449082a4505fd7532e96eaba42eead5a566c420374f3c6bfaefbd16d06295850f9696f94fc9c6e470ec9e30998c3d3fa365d2fa7cfb0416d7b618c6e9541a5e99511ff94c1885d7d3b8ce919d6063bfce6a4cf53c96c2d87d6f34b5b434c9c3ec849af5d96b648ef2ecf199d09d0b06dadadf06be02e2fdddc78b203fbc6e9cc5fe467570ffed9e73d", 0xec}, {&(0x7f0000000600)="395b9967758a65c735c932c236b17a6db035ff970c0dfbf12778c555632c40a7f1dd3dd1fdd340e9cae784223e80b7e45a05b81c04eb7f7cf73a53d92d36d9f4e6c3951ea7ebbd66e66cebf11c0fa42d35b37f46d76d7f4d52148b57b32a0c8eefda2e691fe3fc9b33c66300008e42cf441ba9d5f438f69f522cf144acba6bf995cca7ecda8b75c84f253a571138245a81d79570ac8315f4ad103da174800431bc9bc661661ada86e86ba5ec9818a3b5b2292c9781e506758e99e8cbfc9af725ab079c698961bdc8561d7c0b047448c96ec8d9a851a038ec645a81df44535c024945c89c676dff118392aae27fc65f2351bd7b93ea5ccb082c044929231d0b860bab2757ed03620d692af5f098c3b78917caff954bb0a39c34de6be2f2d74240a6b3edcc887ba19b7a27eb040a7596645d5a9abd9f02d33b2a280fdb72ceec0f864d", 0x142}], 0x4, 0x6000003, 0x0, 0x1b) (async) pwritev2(r12, &(0x7f0000000040)=[{&(0x7f0000000280)="c8bb204907f17dd411b86333f6274ce63d1bc1318ef93b6fe487ca1c9367c3309a95f867491e56901811d1ab00352f2bd48178aab4631bb3a0d9d113bb32b42c3e070e2f14b1c4e74c7acef25c3079a2294aa4dddf22b79fd437670591638aeff751dd5973e802b2e546e445aa5cb0664e45e919767aac19070fad97827378de2cea1cd248ac00d446887b97e091fd7a83edd1141c1243c96f52038d21876c3b9d8912bc5bd98733bfbc8f", 0xab}, {&(0x7f0000000340)="d1236209c672e9723f8ca080c82fbdba257c5aa9d214c70d5574798fbebeaab79f4b876255c291ce341b8bb95fd1219d65f5e498e38df78c89099b09612180f19fbfa2221e5562c5a5e08b508f2e90d646a459573d957debcd75668bb5465c1c524203508cc8b20c91bce6144920a7424281425899ddd144b95b9a8d7c3b550cb3953e5a91a4800079573636dda1b7bb1c346c8718de50c4f028451edd324ca99a711f", 0xa3}, {&(0x7f0000000400)="25f3986f5a6a8e37383c0164f5b3cb0b7dac2064b56063d28fa992a0e08d9ca53f8e8ed9ebbbe536bbc6478e2c83815063923793ae3996e1d62a7523fd5bdb286a82d3692ea9d795e915c2449df17ff8f2361f008f9ac0c86654b4688e9f22e3a439f4449082a4505fd7532e96eaba42eead5a566c420374f3c6bfaefbd16d06295850f9696f94fc9c6e470ec9e30998c3d3fa365d2fa7cfb0416d7b618c6e9541a5e99511ff94c1885d7d3b8ce919d6063bfce6a4cf53c96c2d87d6f34b5b434c9c3ec849af5d96b648ef2ecf199d09d0b06dadadf06be02e2fdddc78b203fbc6e9cc5fe467570ffed9e73d", 0xec}, {&(0x7f0000000600)="395b9967758a65c735c932c236b17a6db035ff970c0dfbf12778c555632c40a7f1dd3dd1fdd340e9cae784223e80b7e45a05b81c04eb7f7cf73a53d92d36d9f4e6c3951ea7ebbd66e66cebf11c0fa42d35b37f46d76d7f4d52148b57b32a0c8eefda2e691fe3fc9b33c66300008e42cf441ba9d5f438f69f522cf144acba6bf995cca7ecda8b75c84f253a571138245a81d79570ac8315f4ad103da174800431bc9bc661661ada86e86ba5ec9818a3b5b2292c9781e506758e99e8cbfc9af725ab079c698961bdc8561d7c0b047448c96ec8d9a851a038ec645a81df44535c024945c89c676dff118392aae27fc65f2351bd7b93ea5ccb082c044929231d0b860bab2757ed03620d692af5f098c3b78917caff954bb0a39c34de6be2f2d74240a6b3edcc887ba19b7a27eb040a7596645d5a9abd9f02d33b2a280fdb72ceec0f864d", 0x142}], 0x4, 0x6000003, 0x0, 0x1b) mmap(&(0x7f0000087000/0x2000)=nil, 0x2000, 0x0, 0x10, r11, 0x0) close(0x5) 3.990429577s ago: executing program 1 (id=6240): r0 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000005e00679a3601ffc4910710007e570966f4366ec9d4"], 0x1c}, 0x1, 0x0, 0x0, 0x4004}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@setlink={0x34, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x4080}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @bond={{0x9}, {0x4}}}]}, 0x34}}, 0x0) recvmmsg$unix(r0, &(0x7f0000002380)=[{{0x0, 0x0, 0x0}}], 0x1, 0x0, 0x0) fcntl$notify(r1, 0x402, 0x20) 3.683361321s ago: executing program 1 (id=6241): socket$netlink(0x10, 0x3, 0x0) socket(0x200000000000011, 0x4000000000080002, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x103201, 0x0) write$P9_RSTATu(0xffffffffffffffff, &(0x7f0000000300)=ANY=[], 0xfd85) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, &(0x7f00000001c0)={0x0, 0x1, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000040)={0xf0f05e, 0x0, '\x00', @p_u32=0x0}}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)=[{&(0x7f0000000140)="1400000016000b63d25a80dc9f14e53420b4648c", 0x14}], 0x1}, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) rseq(0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) io_uring_setup(0x771, &(0x7f0000001fc0)={0x0, 0x2f2, 0x1, 0x0, 0x20003d3, 0x0, r2}) write$P9_RLERROR(r2, &(0x7f0000000180)={0xa, 0x7, 0x2, {0x1, '\x00'}}, 0xa) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, &(0x7f0000000000)=""/188) r3 = syz_open_procfs(0x0, &(0x7f0000000100)='ns\x00') openat$vicodec1(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) open_tree(r3, &(0x7f0000000640)='\x00', 0x89901) dup(0xffffffffffffffff) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 3.577641818s ago: executing program 0 (id=6242): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$sock_SIOCSIFVLAN_SET_VLAN_NAME_TYPE_CMD(r0, 0x8983, &(0x7f0000000100)={0x6, 'rose0\x00', {0x6}, 0x6}) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000002c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001f61f8893b18abbc77d9f832c32c689"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40) r1 = syz_open_procfs(0x0, &(0x7f0000000440)='net/igmp\x00') preadv(r1, &(0x7f0000000a00)=[{&(0x7f0000000680)=""/161, 0xa1}], 0x1, 0x3d1, 0x1ff) r2 = openat$rtc(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) r3 = openat$sndseq(0xffffff9c, &(0x7f0000003340), 0x400) r4 = socket$igmp6(0xa, 0x3, 0x3a) sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x20000000, 0x0, 0x0) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}}, 0x81764109abc7f5e6, {0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 'lo\x00'}) setsockopt$MRT6_ADD_MFC(r4, 0x29, 0x22, &(0x7f0000000080)={{0xa, 0x0, 0x101, @empty}, {0xa, 0x0, 0x0, @dev}, 0x0, {[0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff]}}, 0x5c) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) r7 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) writev(r7, 0x0, 0x0) bind$inet6(r6, &(0x7f00000000c0)={0xa, 0x4e22, 0x9, @ipv4={'\x00', '\xff\xff', @remote}, 0x6}, 0x1c) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x4e20, 0x6, @local, 0x2}, 0x1c) connect$inet6(r6, &(0x7f0000000080)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @empty}, 0x106}, 0x1c) syz_emit_ethernet(0x5e, &(0x7f00000004c0)={@local, @empty, @val={@void, {0x8100, 0x0, 0x0, 0x2}}, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x23, 0x50, 0x64, 0x0, 0x7, 0x6, 0x0, @remote, @remote}, {{0x4e22, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0xf, 0xcd, 0x6071, 0x0, 0xe7, {[@fastopen={0x22, 0x7, "0f90a12d26"}, @mptcp=@remove_addr={0x1e, 0x3, 0x9}, @mss={0x2, 0x0, 0xe}, @md5sig={0x13, 0x12, "ce4c57ce5e155750acdf9849a9a9f8b5"}, @sack_perm={0x4, 0x2}]}}, {"85bdbdc1bfe553b51fd8d255038fcca655bcead4b44f2ea14e67e7459cfff364eb94d3eec3c371d3ceb7e2448155a094248ba11638d4657928dae12a29429c9548d97c6604e47dc83b3fe38506a5cae06523f3085fcac6eb06e24c1f8211936cdbe3678592fc4f9eb17afc4d5935"}}}}}}, 0x0) ioctl$SNDRV_SEQ_IOCTL_QUERY_NEXT_PORT(r3, 0xc0a45352, &(0x7f0000003380)={{0xea, 0x1}, 'port1\x00', 0x2, 0x80010, 0x5, 0x5, 0x8, 0x7, 0x3, 0x0, 0x1, 0x4}) ioctl$RTC_EPOCH_READ(r2, 0x8004700d, &(0x7f0000000040)) r8 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) pwritev(r8, &(0x7f0000000480)=[{&(0x7f0000010340)="98672395318085d8d1329c1fa586c5a7b28caf2a64efca1fd7420ff875a4aa40fe1ed37f5d6b1bfb", 0x28}, {&(0x7f00000001c0)="1885ede1", 0x4}], 0x2, 0x1083, 0x23000005) sendmsg$NFT_BATCH(r0, &(0x7f0000001940)={0x0, 0x0, &(0x7f0000001900)={&(0x7f0000000480)=ANY=[@ANYRESDEC], 0x68}, 0x1, 0x0, 0x0, 0x40091}, 0x40) 3.326804035s ago: executing program 7 (id=6243): r0 = signalfd4(0xffffffffffffffff, &(0x7f0000000980)={[0x4001ffffffffd]}, 0x8, 0x0) r1 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r1, 0x107, 0xa, &(0x7f0000000080)=0x2, 0x4) setsockopt$packet_rx_ring(r1, 0x107, 0x5, &(0x7f0000000040)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x0, 0x0, 0x27}, 0x1c) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000240)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x3, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) r3 = syz_io_uring_setup(0x186, &(0x7f0000000080)={0x0, 0x3416, 0x13100, 0x2, 0x24, 0x0, r0}, &(0x7f0000000180)=0x0, &(0x7f0000000200)=0x0) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd=r0}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) io_uring_enter(r3, 0x2def, 0x9566, 0x0, 0x0, 0x0) syz_io_uring_setup(0x4a34, &(0x7f0000003fc0)={0x0, 0x900c, 0x10, 0x0, 0x27}, 0x0, 0x0) 3.222927062s ago: executing program 7 (id=6244): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(twofish)\x00'}, 0x58) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd2c, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e24, 0x4e24}}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000340)="71e67a15cdf0311cfcf33a52a7d86bd1", 0x20) r2 = accept4$alg(r0, 0x0, 0x0, 0x80000) io_setup(0x42, &(0x7f0000000100)=0x0) io_submit(r3, 0x1, &(0x7f0000000580)=[&(0x7f0000000040)={0x1000000, 0x0, 0x700000000000000, 0x0, 0x0, r2, &(0x7f0000000180)='e', 0x1}]) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000080)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_sha256\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x800) recvmmsg(r5, &(0x7f0000009480)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, &(0x7f0000003180)=[{0x0}, {&(0x7f0000001b80)=""/10, 0xa}], 0x2}, 0x8001}], 0x2, 0x40000100, 0x0) sendmmsg$alg(r2, &(0x7f0000000980)=[{0x0, 0x0, &(0x7f0000000880)=[{&(0x7f0000000240)="c2", 0x1}], 0x1}], 0x1, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000700)={&(0x7f0000000ac0)=ANY=[@ANYBLOB="e80100001100010028bd7000fbdbdf25ff020000000000000000000000000001000004d30200cc000800180007000000080016000200000028001a00ac1414180000000000000000000000007f00000100000000000000000000000002008601e000060000000000000000000000000000000000000000000000000000000000000000004e2400004e240000020020002b000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="7f000001000000000000000000000000000004d43c000000e0000001000000000000000000000000ffffffffffffff7f05000000000000000100000001000000e2000000000000000400000000000000ffffffffffffffff5e010000000000008bffffffffffffff08000000000000000080000000000000dc0c00000000000071630000000000005b000000437effff0700000026bd7000000000000200010788000000a8000100e0000001000000000000000000000000ffffffff0000000000000000000000004e2400004e220401020020202400000026493de60fae5f188c3188ec065aa112", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0900000000000000050000000000000003000000000000000080000000000000faffffffffffffff040000000000000009000000000000002caa000000000000060000000000000006000000000000000300000000000000ef0000000000000002000000bb6b6e0001010201"], 0x1e8}, 0x1, 0x0, 0x0, 0x4000010}, 0x20008840) r7 = syz_open_dev$media(&(0x7f0000000300), 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r7, 0xc01c7c02, &(0x7f0000000140)={0x80000000, 0x0, &(0x7f00000001c0)=[{}, {{0x80000000}}]}) pipe2(&(0x7f0000000280)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4000) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, &(0x7f0000000240)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_MCAST_RATE(r11, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000640)={0x1c, r12, 0x1, 0x0, 0x0, {{0x5a}, {@val={0x8, 0x3, r13}, @void}}}, 0x1c}}, 0x0) sendmsg$NL80211_CMD_JOIN_MESH(r9, &(0x7f0000000480)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000440)={&(0x7f00000003c0)={0x44, r10, 0x200, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r13}, @void}}, [@chandef_params=[@NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0xb}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x2}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x7}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}, @NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x3c}]]}, 0x44}, 0x1, 0x0, 0x0, 0x90}, 0x4008000) ioctl$MEDIA_IOC_SETUP_LINK(r7, 0xc0347c03, &(0x7f0000000a80)={{r8, 0x0, 0x1, [0x58, 0x8aeb]}, {0x80000000, 0x0, 0x0, [0x10, 0x1]}, 0x4, [0xdc, 0xffff]}) r14 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$sock_inet_SIOCSARP(r14, 0x8955, &(0x7f0000000000)={{0x2, 0x4e23, @local}, {0x1, @broadcast}, 0x3d04b5ca67e74faa, {0x2, 0x4e24, @loopback}, 'gre0\x00'}) 3.165057208s ago: executing program 8 (id=6245): r0 = socket(0x200000000000011, 0x2, 0xd) getpgid(0x0) getpid() connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r0, 0x0, 0x0, 0x404c881) r1 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) write$dsp(r1, &(0x7f0000000200)='m', 0x1) r2 = syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x801) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r2, 0x40045532, &(0x7f0000000100)) r3 = syz_open_dev$sndpcmp(&(0x7f0000001200), 0x0, 0xa2c65) write$snddsp(r3, &(0x7f0000000200)="a3", 0x1) write(r3, &(0x7f0000000380)="ed", 0x1) ioctl$SNDCTL_DSP_GETODELAY(r1, 0x80045017, 0x0) r4 = socket$inet_tcp(0x2, 0x1, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0}, 0x0) r5 = socket(0x2000000000000021, 0x2, 0x10000000000002) connect$rxrpc(r5, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x4e20, @loopback}}, 0x24) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r6) sendmsg$TIPC_CMD_ENABLE_BEARER(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000680)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000d00000000000100000000bc5601860957a33c1c000800000000000000006574683a73797a6b616c6c657230"], 0x38}, 0x1, 0x0, 0x0, 0x20040081}, 0x0) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r0, &(0x7f0000000180)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x4}, 0xc, &(0x7f0000000100)={&(0x7f0000000080)={0x1c, r7, 0x20, 0x70bd2a, 0x25dfdbfb, {}, ["", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x40010}, 0x50000) sendmmsg(r5, &(0x7f0000000000)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=[{0xc, 0x110, 0x1}], 0xc, 0x7000000}, 0xf401}], 0x1, 0x0) sendmmsg(r5, &(0x7f0000005c00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[{0x10, 0x110, 0x1}], 0x10, 0x7000000}, 0xf401}], 0x1, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) 3.015437661s ago: executing program 9 (id=6246): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r0) r1 = socket$key(0xf, 0x3, 0x2) ioctl$VHOST_SET_FEATURES(0xffffffffffffffff, 0x4008af00, 0x0) ioctl$BTRFS_IOC_DEFAULT_SUBVOL(r1, 0x40089413, &(0x7f0000000040)) openat$tun(0xffffffffffffff9c, 0x0, 0x6e042, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x5, &(0x7f00000001c0)=[{0x4, 0x0, 0x25, 0x10000000}, {0x6, 0x8f, 0xfd, 0x1}, {0x200, 0x7c, 0xdc, 0x342e}, {0x800, 0x10, 0x7f, 0xe24}, {0x6, 0xff, 0x1, 0x1000}]}) r4 = fanotify_init(0x200, 0x0) fanotify_mark(r4, 0x1, 0x4800003e, 0xffffffffffffffff, 0x0) sendmsg(r3, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) r5 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x22000, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000340)=ANY=[@ANYBLOB="740000000001050500000000000000000a0000001000164000000200000000bc000000083c0001800c00028005000100000000002c00018063000300ff020000000000000000000000000001140004000000"], 0x74}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) read$FUSE(r5, 0x0, 0x0) capget(&(0x7f0000000140)={0x19980330}, &(0x7f0000000300)={0xffffffff, 0x7, 0x9, 0x9, 0x7f, 0x80000204}) write$RDMA_USER_CM_CMD_LISTEN(0xffffffffffffffff, 0x0, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r7 = openat$vim2m(0xffffff9c, &(0x7f0000000200), 0x2, 0x0) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000000240)={0x10001, 0x1, 0x2, "8608ba41085e351e77cebd465b38ae3ecb74783a1e8e07a9a026ad7bfb2ae176", 0x494e4f4b}) r8 = openat$sndseq(0xffffff9c, &(0x7f0000001240), 0x0) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(r8, 0xc0a45320, &(0x7f00000003c0)={{0x80, 0xfc}, 'port1\x00', 0x3eb, 0x21e2f, 0x7f, 0x1681bcd7, 0x6, 0x10000, 0x5, 0x0, 0x0, 0x4}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) gettid() 2.648918565s ago: executing program 0 (id=6247): socket$nl_route(0x10, 0x3, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000040)={0xa, 0x4722, 0x8000001, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0xf9}}, 0x10}, 0x1c) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) r1 = syz_pidfd_open(0x0, 0x0) write$P9_RGETLOCK(0xffffffffffffffff, &(0x7f0000000040)=ANY=[@ANYBLOB="1f000000370200020100000000000000040007"], 0x1f) syz_emit_ethernet(0x4a, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x18, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYRES64=r0], 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x1, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r2 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x0) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.idle_time\x00', 0x275a, 0x0) write$binfmt_misc(r3, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r2, 0x4c0a, &(0x7f00000002c0)={r3, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x1d, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad44afac11d875397bdb22d0000b420a1a93c5240f45f819ef6167d3d458dd4992861ac00", "f4bd00000000000000000000000800", [0x0, 0x2000000000001]}}) setns(r1, 0x24020000) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x561082, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_PRE_FAULT_MEMORY(0xffffffffffffffff, 0xc040aed5, &(0x7f0000000240)={0x4, 0x7000}) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000000)={0x18, 0x2, &(0x7f00000006c0)=ANY=[@ANYBLOB="39100000000000009500000000000000891a0de27b73c638d8f2f62b3ca35eeda2a09be3258225f2e1d9191b09031675beed49257869f6f9e7137f156966f4e20e986e8f438ddfd829137c4f541a93acba0a3ef0b0afc15d75f2af56298a95c0592c867d0f4f32b39f630eb3ba5a7c02d32fef938d6041aa6c85b09b82a9fa223506be883a9b5df1704f2a38d38799c39ad5c9ed4c34fbfae47a1243106816b482daf9467873bd7b3899cac8e5bfa1ecccac3bb083330a7f66"], &(0x7f0000000180)='syzkaller\x00', 0x7, 0x0, 0x0, 0x0, 0x44}, 0x94) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001680)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x40001}, 0x4040850) sendmsg$NFT_BATCH(r6, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000140)=ANY=[@ANYRESDEC=r4], 0x7c}, 0x1, 0x0, 0x0, 0x810}, 0x40800) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000280)={0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000340)=@file={0x1, './file0/file0\x00'}, 0xb5de206ec6c6ad20) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000cc0), 0x0, 0x800) ioctl$sock_SIOCGPGRP(0xffffffffffffffff, 0x8904, &(0x7f0000000400)=0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, r8, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) openat$binfmt_register(0xffffff9c, &(0x7f00000001c0), 0x1, 0x0) io_setup(0x7, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) 2.608050701s ago: executing program 7 (id=6248): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x2, 0x31, 0xffffffffffffffff, 0x0) r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x2, 0x7, 0x6, 0xd, 0x2, 0x0, 0x70bd2d, 0x25dfdbfc}, 0x10}}, 0x8000) bind$alg(r0, &(0x7f0000000200)={0x26, 'hash\x00', 0x0, 0x0, 'streebog512\x00'}, 0x58) r2 = accept4(r0, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f00000048c0)=[{{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000001d00)=""/1, 0x1}], 0x1}, 0xc}], 0x1, 0x10002, 0x0) r3 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/uevent_helper', 0xa0480, 0x80) ioctl$FBIOGET_FSCREENINFO(r3, 0x4602, &(0x7f0000000100)) r4 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYRESHEX=r1], 0x0) syz_usb_control_io$cdc_ncm(r4, 0x0, 0x0) syz_usb_control_io$uac1(r4, 0x0, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x80, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_XEN_HVM_CONFIG(r6, 0x4038ae7a, &(0x7f0000000000)={0x0, 0x40000105, 0x0, 0x0}) r7 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0xfffffffc) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000000180)={0x1, 0x0, [{0x400000f4, 0x0, 0xfffffffffffffffc}]}) syz_emit_ethernet(0x6e, &(0x7f0000000180)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaa0086dd6000000000380600fe880000000000000000000000000001fe8000000000000000000000000000aa00000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="e0000000907800001d12bb9b69de4386bf2ae6a3b321505c8fb6786e68cd1d12c52a2d43d2c8550000000000"], 0x0) r8 = openat$dsp1(0xffffffffffffff9c, 0x0, 0x0, 0x0) read$dsp(r8, 0x0, 0x0) 2.535766788s ago: executing program 8 (id=6249): mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) openat(0xffffffffffffffff, &(0x7f0000000600)='./file0\x00', 0x541081, 0x4efa58c51c82e077) r1 = fsopen(&(0x7f0000000040)='ext3\x00', 0x0) stat(&(0x7f0000000280)='./file0/../file0/../file0\x00', &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0, 0x0}) read$FUSE(r0, &(0x7f0000000680)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_mount_image$fuse(&(0x7f0000000100), &(0x7f0000000240)='./file0/../file0/../file0\x00', 0x2000000, &(0x7f0000000340)={{'fd', 0x3d, r0}, 0x2c, {'rootmode', 0x3d, 0x4000}, 0x2c, {'user_id', 0x3d, r2}, 0x2c, {'group_id', 0x3d, r3}, 0x2c, {[{@blksize={'blksize', 0x3d, 0xc00}}, {@default_permissions}, {@blksize={'blksize', 0x3d, 0x400}}], [{@appraise_type}, {@obj_role={'obj_role', 0x3d, '-\xc9(^:!'}}]}}, 0x1, 0x0, &(0x7f00000036c0)="cfd5d2986e9053b88ddc70b2fff7cf7f29d85a9164a6d91688a8a19be33dea030fbc04c788c78db0f231b6c1c34d75e1d3d846cd04c99bbd6fe8445c7ef6d4c3fbb8e35207315fa47ceb3609a693b68072a8460fee8d13c2da20051209e9d86d646ef7b1eb66f3b271c56532dc5c6b3767ff89ba39") fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f0000000080)='discard', &(0x7f0000000200)='\t', 0x1) chroot(&(0x7f0000000000)='./file0\x00') chroot(&(0x7f00000001c0)='./file0/../file0/../file0\x00') r4 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r5 = syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000080)='./file0\x00', 0x2800491, &(0x7f0000000180)={{'fd', 0x3d, r4}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x4, 0x0, 0x0) r6 = openat$autofs(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(r6, 0xc018937e, &(0x7f0000000200)={{0x1, 0x1, 0x29}, './file0\x00'}) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) write(r5, &(0x7f00000026c0)="3176c3a04c0afc2e3494777ee199f5329991eac1dd29d5b7b1b49453cac0b6fa2901457a18d7cc146479fcd3f38b57789693a4d2bde804706211a2198894567f704fad6f907286836bf8e96098939a00553c26d60bb634e32faa2fe7360bfb25a2546d883ffbf2032bc6a2b44bdca5b372a1af50790a410094520600817aea52ccbe91c05ca35e481cfcbd47aa2eacefe5b4f413b97d6988eea1d75695e97a2b54be6dddeb60c2fa74d9e628e4016964c0ed8f9ca3eaadfec96c559446bb31ae371d2fbd61c3d96df38877882e78be36090d19772e258cda3f64b84ca0bf78f5ef8db2c9651e1a82ca08390a6cae1982e5a632777ed635cce336422f371b5a4cd7689250a5cb1d2e0ae41caaf589edb1a2acc5119c28a02a5e7b73a85caa6f2469bae0abf68f77fbfac978bb6c432705e74eae55efe7ad9fadd3094f8c8067c82a958a7351e6c05e02c7b77c2f113df81b548c9773a02e8a4bf3c076108bc451c118899cb8df8f7bb13473caa4a6f43f82204b424b3ab3d65633f80258c8c7dbbd193566d1ecb2871083df1ac35b9aef64d5a76a2ec01255fa0862b0fa1cf41221c2115f4b217df24327b21ab0740b1c5043efff9934a1c03f7094c147fc9622445f33000fb9da58cabdb6b911e40645aa1f5069926c73e3983e9ec0a39e1e22f00b117b40df27104b8de65efb4aafe9faf47c833d3614e5a52a00bd022b834c08ca102ac009791382efa74ef7837654722b6a68bcbd3da3d7ab37bf1f941383168c7850b77eeffbdba351d6007a501d29c4f1e05ae069fead7f51c1150d4377662b4b859aaa6ed039af424fcce84fd3608ddc2a5501b84f10d881b675ddc16f6edff5d9a270cf621fc372a10f06bd5de3abda66c58d97413045883e8a5ba01d41c89a631a174e184f5206ec8db0405e6e61ebf34ed55d1599b39d68af19db0b3e114538dcb4447d4ee368fb43941c494e48991c167f04ad9d720ee825ab9aad71becb2ffb8b38cc87e225e09eedaf08c4f3afac0a50ba6faad1be3733fb36d3043be0ac0df0b590df568648ef508d04d7e41fcaf9a96815b123e37c48767604a867d267e4003188be8b52e4bf6c8f443a9767b3156e08427fd883ed0a2832ae72a1e8cc2b952a312c4f336638deca1c913003a67644582f5f94eff19678703faadc8e57fe75633406e78abe6f2e90281d98a2ca5ccf7652067cde796b2735263bf2de81f57230c2342c827640638e631b34f09101429a2ede926bce4c7f2a2617c357d0f53d88910aa801f481b261876cef1d8a4bc7b6fbeb58a2926cf5796bf4f9d43dd90f345fdc502fcd79ec12f65fcba9b8d80b3f90710e5a798607e5dd62d8e451fca6fab5e1103db38e19ea1ccebc001769af628eff7fe57ea866c96d21fa5a8199bcd8caf28aeb8193ceeb9ba9aba60e6d2046b09842068065e363afc7e8446aeb779cab3d633d93f05493c64898676b9b85c071f9534d9ae1558fd3a36d97766defc7d200369295d2106ddccdc20b7a399e78c36fca0fd7045600ba28a2ab44869e55a4bc46f3eb3c46626a342660cc8d135b085e07a58ce9f37b98f32dc363d4d5e3f941adcad5fde27ba752a65a9a3e3315086e6beca20b53e7a4ef9484a810f13e75d12f696b499d9c54eb08a4b2b15f3b36105c691602c529c7b3b875b835ba98f0aa2ea86f7abbc9d9f8d023293f925e44385d06a5aa3a5b80d554a54b28a76e5e53e4b0697f4465c9893c3eaadf93e72afb694ec80e2f372be469201b2eb7c7b1e1066c722fe8c537ce0deda956f7d2717d90f39a9b6ed92aaceee383c2b29e9494003e4a15812cb1f760055beaf024391e4b4c633e8a01058414c763f7d45248541f33eb87915e53c7531aa1c7275e72a3be6ec59109e47118ae6f196bee2e5819f512ff27925bd79f476da5edeeb406c7a0c33b62b24a0ad2068d44cdbf9c1a94b0eb65f87938b62f5ae1d9d2dc1863d1c59bd5fe2f90ed493a73852f69644157a1d22480d56f79d4f33afbed69209e09c12100e4b9dc46317a5fa2281493421e9a1ad94592ee46605583d287ab0c9e6c89a81396afe204cbd652199b6f559370bbd44609389e77b5c6e6a68ec3d64df1bfb2fde8aa6b7c8de00d33e86824f1d3fc5ed07a70b7a41b02f36ce2e5b3b3098398d968a853b930a24ac7b88b57afc2ad5d6d87ad6539f556a7bc8e024210a3ee79c552fa5e8e89dcb20101e4a5064a5bfedb7d29a7d0c2852b3112596252c8399ddb5250fe804e22d4b45ea0f251fc8f4002947ca48d1dbebcdc3ab19fc69b207578e28a4122c0e3b2581c8a9af1690433b48ff57993a33a7229ca8e30956de14accbb874cdc24c7d14ec899af1899635a6de56c0b5eb055b5ac24a82dd30b6778d77a818f981b8037c199420ddce4fcac5d464624106d9147edb6831df149c32604cdc02be17324b858a76ba54e4c375fa5f5115735ab2571914cb177c3ff5d5ee099f1dd8d0b396ff698cc38a77c5a2bfb9a85fe57853192be93239e344e3d126196a3376a5c90ba28267ad65ee1b1f3129531814c8a54cb895917d08f0dc95308a8e32e3b8e9aa1d064fd6095f45358f80ab7c4e8cac8869194e80fa17099230d0ab4548c39e2a05ae8d90b445834acccc41788cc8d3bcb2bac31116fe1f02adb706ea6517b01427f8fd84633c7da6a8af90e3c3983c53e9c4941c3b83db668723f91fbfea76a9d6afd1dd684b5a0cdd25d19db142f3f699876270b52d70829eb76c9de240c1f6f219b520146c81e66a069d6592fdf892525b04e48d57ca8380f0f9151f717fbd615ad529eb1a235291f7d05775a3c54fd8a34c0ce7713e70c5ed586ffa06f1eaba1fab0f3cf65d181deb5096ab28146355c60b86b42699e5a0fb576cb30d2e5d4bbd32666bdce691658f484e998c0df6342d4321943e78ac589c277364d23dd6e67f9afaa404be10f5d40465ae302744130933a4a5155a65141a3753451c8d7fc6ef9b8dae39dcf699e7dc258708e2d4e83409c8d15c8f00d147518d1b96ed80283b603e0d41d3f5db189d6a79ca723bdd081d1e8e921419fbc85589dc61535c63f80ee480d143c91e59ce661bd83d29cafc4606f9ebe537c20235b99293604f4c738697908e2170abd681a57fbe2c9fca9d23a199d673e96482baaf8191291e242af4a3fb2dab05cc7058924f4318a25a0a3dee80b93ed02e4a7cae19c210ea3c624e4d868db6e54f2cae1e5b0f625cacf492883ff37dea8fc6045a18632b908cf9f6d954f3f16fba155d98739c11ad38a3ef018b081f56de3181f655dbc78370bad7a80657a4730bb9b19ace172946eba187172a99ea9c1a94e1ed4661d716bd9fdcce2c6ac80a2ebc6a2cdb9825b968f9298ec2820b030ff41b52db501495675fe16fa6fc7bb03a246f7645c0e3a615c9a8693ed9d70470594b811353749f321cde167dc3d793aa9734940688e9bc75a289090b8a637499c99f1739ba0242c8489cfa5c8d26a204037ab2727650130a0f84ad85af80cf37a2b0f6bd2fc24488b81196de177d1c9905767e37bde512d2b8473037c6942239b590087cb5fcff523be79639dac61bf5ffd82df11db8aa61aed2f36b070045acabca805f1cf654665214b6e4c1e9d7e11d2b974810f58dfb81de84312f877250b32a6d19f34982f81dcdda1bbe5aa14ebe99079a2b2ba036ccb7bf1944d87a505429bba1c001d35686b0c40d87b1f8877b3b9d055ad52cecc92680f4b65078f576292d2a09f561669b6f856bb91360824832b4ded94648b2ba7185ae2f98c44c61a7d4488397ca25b0b45c7decfadcd884bee9b13aa7979875c1833bc838ebadd1fa79a09408a0ac11302732e8810d5c75ff26102c9efa76d2117e56db9e07e9559096596ff6885e6a4d91ff69a55bd7c51d3ab12f6baf5ca5d6a028e22168d4fe8f52ef9b1a491ae1acc8117b8fa27bf82babd0a9efb7eb9832d1821f02881e3bb97ac1615d052df83663719c77ac2c2e513a4e8bacb0e19a03be8d68bb5e6aabccbd28713f29b8f025c9b1dc3543f2a94579a032a5938d25fc5e835a8e78ebbb6ca2c9bb055802750a4e3cc02a17a6fe6274bb042cbec7f90ef0b77b6231ce8bc5440030fb5216d3a27b84f6160a8e431eacb94ba73e05559cea9d7b1ff1a2143e9890a65cc6f38a5287dd52a2948e0e0c75fb71ca737bbcc7eef668891571ca62055b985165276543edfe03c2579807fed611d64d6199d5a002b93deb810177d8ca7624b1f64a6831b86ac29bd82c58cbe6573d161c5206d37c6bc66e15b51346309e35ceadcc3acc54740075cc00198295dbc9478ffb93faa85284f0297c1b0f5565e2ecb80088929f6eb8b1069b98ee3bf111745704b2a5cc12f25baf5eed150e6a10c03578f320d1d60a754453e11a046b0d8411d1f0206d9045fe7f0982a1c23fad21f7cf64cc262949668478c3e95db082657706e56875453d15c6c3618eb181a1589300ecbff3b29153435eea230d6505bee6d3f567d3ab0c7866cdb8b0289ff2ce9f4bd32fb898e81c5ea03b2bd8c3bc469393ab396bccb5ccf2f8a7b9ae35fd45210a2c70d566a8511080ad57675020c53e2e5de638a44e7cc7cdb12528d00737a40cf95b0bbbdcae7dd9443cb793cc6d64a0cbeddfe80386d839c42d1469ff073bcd165351695693469a740d077b35cd57138dbdf82cacec239dfa933329e469f3912bcb2d80d3925caf6b412f71f4dd638a11f6e97afcb0aa6c2c2f479be799d2c142449525b85e23746c27d63dc5b02cdb5fa359c3f7635a32e334099f75569f037ec841d92ff86a67253e826c1f551d9002465e453bd174b0324eaabf1d87937f4d58ea01bcd941f524abcd3d3e623a2d14ab3d6c7defcdff2b974b8e942f77d709cf19afd0406b101322606b35965bc53821b3032761081a1cede593d9145918ade9763bf6dd73f15b1c64b262ac1d2a191d2840c8ea1f9c55f167a85b72ec11c0d96b2eba58fb1adc6dee6477354d0999e3f876cbce509207eccd5df09350ef0343cb328aa804d6364a1886346272e894f549b9e26c0500fc7958afccaaf4cc576babfbfef4842b9cd0a509674603c9312e846b7c5493c47825b74433eb27dbcbda61ac06d4ed0338028674a203ebd9a4ceb05b93de0346ca9cb60c0c637c6797a4175a49b37373c5791fc2e7054232fe171ad6c9497475768a946558c755a63291b50706426d0dae6e3fcc33749c5615097bdc6d6c382f0a3305de0d73eb3d5de67137d1b243af1920025902b5f16807675f6f9e4f59fdb1d5620d8d3d55b0916e5b0c79abe9cc037aae7809401b3e81232eb341cda0e5801cae060af5bd09da1cdfc9a41c3909cf53566d673256d179947477972116b3cb04fdd12316711029528cd0932a7e9bbde0a079a484370c286f1070ff8d90bc9fe48005db657c9f596a6bf21b02fcb26863d989650ac942b2900fea68b6c24550b5a0bc411b530d244cea5119fa2de8012fc983b1989be3b9abb26532df0eb1204c7c757bedd0f22d062806feda687743d207fbc95386fa259fd0b4466d517e070892f43cda967e0e2b97ee6915f8dfb6a5fc8942cc5177ad1c0cb1b7b0ae893ce60a27660645ee9aaa3f243a80d09446d060db9e3a4f3ad0a7aa78ab3bf526d312cf87afa1b9603059408f67f8b67f2c44417162aacd6806efb386ddee6c1c0abe29cc0f9cbf58976b34eb9c83b2c5815d59ec784522c1b517794da9621b64a10ae1fa8cdf196090933454c8023139d62b6033777eebb931ec65a441ab448b79a374799", 0x1000) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x1, 0x0, 0x0, 0x2) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone3(&(0x7f0000000300)={0x23800000, 0x0, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000500)={'team0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f00000005c0)={&(0x7f00000004c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000580)={&(0x7f0000000540)=@gettclass={0x24, 0x2a, 0x100, 0x70bd2a, 0x25dfdbfc, {0x0, 0x0, 0x0, r7, {0xd, 0xf}, {0x3, 0x1}, {0x5, 0xffe0}}, ["", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x50}, 0x40) umount2(&(0x7f0000000200)='./file0/../file0/../file0\x00', 0x0) linkat(r0, &(0x7f0000000040)='./file0\x00', r0, &(0x7f0000000080)='./file0\x00', 0x400) 2.481677951s ago: executing program 0 (id=6250): sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x10) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWCHAIN={0x38, 0x3, 0xa, 0x3, 0x0, 0xfff5, {0x2, 0x0, 0x2}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0xc, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0x60}}, 0x4000) 1.931862924s ago: executing program 0 (id=6251): ioctl$KVM_GET_ONE_REG(0xffffffffffffffff, 0x4010aeab, &(0x7f00000001c0)=@other={0x20000002fffffffc, 0x0}) ioctl$KVM_TPR_ACCESS_REPORTING(0xffffffffffffffff, 0xc028ae92, &(0x7f0000000040)={0x40, 0x7f}) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_usb_connect(0x0, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="120100007add1520450580800103000000010902120001000000000904"], 0x0) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000000)={0x101}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0x20001000000000, 0x0, 0x40, 0x2000001, 0x0, 0x2004cb, 0x0, 0x0, 0x68ff, 0x80000000005, 0x0, 0x1, 0x0, 0x7fffffffffffffff, 0x4000001000], 0x2000, 0x202}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 1.929577084s ago: executing program 1 (id=6252): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$can_j1939(0x1d, 0x2, 0x7) openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000094b24610b11342003d9d0102030109021b000100000000090400390009"], 0x0) io_setup(0x72, &(0x7f00000003c0)=0x0) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002000), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000002080)='./file0\x00', 0x0, &(0x7f0000000000)={{'fd', 0x3d, r3}, 0x2c, {'rootmode', 0x3d, 0x2000}}, 0x0, 0x0, 0x0) io_submit(r2, 0x1, &(0x7f0000000100)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0xcbee, r3, &(0x7f0000000140)="e5ed6dd8c28ce374a9991b119a575f82eeb4fe0366c48f49b5830beb2fe516e43c4065ad72d51fd2a19955be74d9c74a0764681b66812090e2f5a9cc0a678964a8bd877b7b301df8a0071a3db4745dc889d6c158b9ebc3cdc8e45af26ab43790af545d10b3a7ae7c02d062d574a028c98f5a44d44ca85bb095349418f5ffcc55ebb900eea47dd463b8e1a83eb061179d54b36399968b2ede680f1f234dc71d5f107d12c318b4c51f0820d49be9702a5bace4e3d6c9df81f6a5c86fd7c752bfe5c5641e6cb9567a94cf4f25be7d9f67bb6d746657a5c0631dade3805207c27c9a2b188215cff9fa099f3bb570caae3fdf79a0c3f4", 0xb499, 0x8}]) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f00000000c0)={'vcan0\x00', 0x0}) bind$can_j1939(r1, &(0x7f0000000340)={0x1d, r4, 0x0, {0x1, 0xf0, 0x4}, 0xfe}, 0x18) setsockopt$sock_int(r1, 0x1, 0x6, &(0x7f0000000040)=0x1, 0x4) setsockopt$SO_J1939_PROMISC(r1, 0x6b, 0x2, &(0x7f0000000200)=0x1, 0x4) sendmsg$inet(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000007c0)=[{&(0x7f0000000540)="81b641f1f3843704b6", 0x9}], 0x1}, 0x4048081) sendmsg$nl_route_sched(r0, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000480)=@newtfilter={0x24, 0x11, 0x1, 0x70bd2c, 0x25dfdbfc, {0x0, 0x0, 0x74, r4, {0xfff3, 0x10}, {0xfff1, 0x9}, {0x2, 0x8}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x48040}, 0x20000050) 1.747469743s ago: executing program 8 (id=6253): openat$udambuf(0xffffff9c, &(0x7f0000000340), 0x2) (async) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/tracing', 0x0, 0x0) getdents64(r0, &(0x7f0000000940)=""/4096, 0x1000) (async) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) (async) r2 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) socket$inet6(0xa, 0x3, 0x8) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x88, 0x2c, 0xd27, 0x70bd28, 0x6000000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xfff1}, {0x8}, {0x7, 0x8}}, [@filter_kind_options=@f_fw={{0x7}, {0x5c, 0x2, [@TCA_FW_ACT={0x58, 0x4, [@m_nat={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0xfffffc00, 0x8, 0x6, 0x200010b, 0xff}, @broadcast, @initdev={0xac, 0x1e, 0x1, 0x0}, 0xff, 0x1}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2, 0x2}}}}]}]}}]}, 0x88}, 0x1, 0x0, 0x0, 0x4}, 0x4000800) (async) syz_usb_connect$uac1(0x69a90eab3db9c902, 0xa6, &(0x7f0000000280)=ANY=[@ANYRES32=r0], &(0x7f0000000040)={0xfffffffffffffd42, 0x0, 0x0, 0x0}) (async) write$tun(r1, &(0x7f0000000380)=ANY=[@ANYBLOB="016f0800010027000000270000004600002900000000008490783fffffffac1414aa00000000", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="ba0000009078002809c40005020000cc372b7915f6ae00000081b59d6b511cf57538aa5905b1"], 0xfd6c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f00000000c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') (async) lseek(r4, 0x6, 0x0) (async) connect$inet6(0xffffffffffffffff, 0x0, 0x0) (async) r6 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000200)='attr/fscreate\x00') writev(r6, &(0x7f00000000c0)=[{&(0x7f0000000040)="dc", 0x1}], 0x8) (async) r7 = socket$inet6_udp(0xa, 0x2, 0x0) (async) r8 = openat$vimc0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_ENUM_FRAMESIZES(r8, 0xc02c564a, &(0x7f0000001b00)={0x0, 0x34325842, 0x1, @discrete={0x1, 0x100}}) setsockopt$IP6T_SO_SET_REPLACE(r7, 0x29, 0x40, &(0x7f0000000e40)=@raw={'raw\x00', 0x3c1, 0x3, 0x4b0, 0x2fc, 0x18c, 0x203, 0x0, 0x19030000, 0x3e8, 0x2e0, 0x2e0, 0x3e8, 0x2e0, 0x3, 0x0, {[{{@uncond, 0x300, 0x2d4, 0x2fc, 0x0, {}, [@common=@unspec=@bpf0={{0x230}, {0x13, [{0x1d}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0xfffffffe}, {}, {}, {}, {0xfffc, 0x0, 0x0, 0xe}, {}, {0x0, 0x0, 0x3}, {0x2}, {0xffff}, {0x0, 0x0, 0x0, 0x1}, {}, {}, {0x16}, {}, {}, {0x7}, {}, {0x0, 0x0, 0x0, 0x101}, {}, {}, {}, {}, {}, {}, {0xfffe}, {}, {}, {}, {0x0, 0xfd}, {}, {0x7a04}, {}, {}, {}, {}, {}, {}, {0x0, 0x0, 0x0, 0x800}, {}, {0xb84, 0x0, 0x0, 0xf00}, {0x0, 0x1, 0x0, 0x3}, {}, {}, {0x0, 0x0, 0x0, 0x2}, {}, {}, {}, {0x0, 0x0, 0x0, 0x2000000}, {}, {}, {}, {}, {}, {}, {}, {}, {}, {0x4, 0x0, 0x10}]}}]}, @common=@unspec=@NFQUEUE3={0x28, 'NFQUEUE\x00', 0x3, {0x0, 0x4}}}, {{@uncond, 0x0, 0xa4, 0xec}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0xb, 'syz1\x00', {0x6c8}}}}], {{'\x00', 0x0, 0xa4, 0xc8}, {0x24}}}}, 0x50c) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) r9 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(r9, &(0x7f0000000000)={0xa, 0xe26, 0x0, @empty}, 0x1c) (async) ioctl$AUTOFS_IOC_FAIL(r5, 0x9361, 0xa90b) 1.701149939s ago: executing program 9 (id=6254): syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100005dbafc40fd0b0c01162d01020301090224000100000800090400000221efb00009058d3a"], 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = syz_open_procfs$namespace(0x0, &(0x7f0000000080)='ns/user\x00') sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000200)=@newlink={0x3c, 0x10, 0x49920d862a92153b, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @vxcan={{0xa}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_NET_NS_FD={0x8, 0x1c, r1}]}, 0x3c}}, 0x0) syz_extract_tcp_res$synack(&(0x7f00000001c0)={0x41424344, 0x41424344}, 0x1, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$inet_IP_XFRM_POLICY(r3, 0x0, 0x11, &(0x7f0000000080)={{{@in6=@mcast1, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x100000000000000, 0x5}, {}, 0x0, 0x0, 0x3, 0x0, 0x2, 0x3}, {{@in=@dev, 0x0, 0x33}, 0x2, @in6=@local, 0x0, 0x4, 0x1, 0x0, 0x0, 0xfffffffe}}, 0xe4) syz_emit_ethernet(0x3e, &(0x7f0000000280)={@local, @local, @void, {@ipv4={0x800, @tcp={{0x7, 0x4, 0x2, 0x22, 0x30, 0x67, 0x0, 0x2, 0x6, 0x0, @private=0xa010100, @remote, {[@generic={0x83, 0x3, '5'}, @generic={0x44, 0x2}]}}, {{0x4e21, 0x4e23, r2, 0x41424344, 0x1, 0x0, 0x5, 0xc2, 0xe, 0x0, 0xfe}}}}}}, 0x0) syz_usb_connect$printer(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x40, 0x525, 0xa4a8, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x1, 0x2, 0x50, 0x40, [{{0x9, 0x4, 0x0, 0x1, 0x1, 0x7, 0x1, 0x2, 0x6, "", {{{0x9, 0x5, 0x1, 0x2, 0x40, 0x4, 0xc, 0x7f}}, [{{0x9, 0x5, 0x82, 0x2, 0x400, 0x6a, 0xf4, 0x9}}]}}}]}}]}}, &(0x7f0000000180)={0xa, &(0x7f0000000040)={0xa, 0x6, 0x310, 0x8, 0x9, 0xa, 0x8, 0x7}, 0x5, &(0x7f0000000080)={0x5, 0xf, 0x5}, 0x2, [{0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x1c01}}, {0x4, &(0x7f0000000140)=@lang_id={0x4, 0x3, 0x2009}}]}) 1.247191895s ago: executing program 8 (id=6255): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000024c0)=""/4105, 0x103b}, {&(0x7f0000001900)=""/110, 0x6e}, {&(0x7f00000023c0)=""/232, 0xeb}, {&(0x7f0000000200)=""/114, 0x72}], 0x4, 0x0, 0xcc11}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5c0, 0x0, 0x0) 904.055423ms ago: executing program 38 (id=6255): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_generic(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)=ANY=[@ANYBLOB="1400000042000501"], 0x14}}, 0x0) recvmmsg(r0, &(0x7f0000000a40)=[{{0x0, 0x0, &(0x7f0000000600)=[{&(0x7f00000024c0)=""/4105, 0x103b}, {&(0x7f0000001900)=""/110, 0x6e}, {&(0x7f00000023c0)=""/232, 0xeb}, {&(0x7f0000000200)=""/114, 0x72}], 0x4, 0x0, 0xcc11}}, {{0x0, 0x0, 0x0}}, {{0x0, 0x0, 0x0}}], 0x5c0, 0x0, 0x0) 52.212876ms ago: executing program 9 (id=6257): r0 = socket$unix(0x1, 0x2, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000000000105509147200ed0000000109022400010000000009040000030300000009210000000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000100)={0x18, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f00000001c0), 0x3f, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 1 (id=6258): sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x880) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, 0x0, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=ANY=[@ANYBLOB="50000000090601020000000000000000000000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff180002"], 0x50}, 0x1, 0x0, 0x0, 0x30040043}, 0x240008c4) kernel console output (not intermixed with test programs): /0x10 [ 1330.064827][T20104] ? __might_fault+0xb0/0x130 [ 1330.064855][T20104] ? rds_getsockopt+0x31d/0x500 [ 1330.064875][T20104] ? __pfx_rds_getsockopt+0x10/0x10 [ 1330.064896][T20104] do_sock_getsockopt+0x2b4/0x3d0 [ 1330.064922][T20104] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 1330.064945][T20104] ? __fget_files+0x3a0/0x420 [ 1330.064969][T20104] ? __fget_files+0x2a/0x420 [ 1330.064999][T20104] __ia32_sys_getsockopt+0x1a5/0x250 [ 1330.065031][T20104] __do_fast_syscall_32+0x1dc/0x560 [ 1330.065053][T20104] ? lockdep_hardirqs_on+0x7b/0x110 [ 1330.065071][T20104] ? do_fast_syscall_32+0x34/0x80 [ 1330.065092][T20104] ? irqentry_exit+0x10f/0x660 [ 1330.065117][T20104] do_fast_syscall_32+0x34/0x80 [ 1330.065140][T20104] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1330.065163][T20104] RIP: 0023:0xf7fc4539 [ 1330.065182][T20104] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1330.065199][T20104] RSP: 002b:00000000f54b655c EFLAGS: 00000206 ORIG_RAX: 000000000000016d [ 1330.065221][T20104] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000114 [ 1330.065235][T20104] RDX: 0000000000002713 RSI: 0000000080000580 RDI: 0000000080000400 [ 1330.065249][T20104] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1330.065261][T20104] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1330.065273][T20104] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1330.065302][T20104] [ 1330.538055][T20106] FAULT_INJECTION: forcing a failure. [ 1330.538055][T20106] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1330.606857][T20106] CPU: 1 UID: 0 PID: 20106 Comm: syz.0.5941 Tainted: G L syzkaller #0 PREEMPT(full) [ 1330.606893][T20106] Tainted: [L]=SOFTLOCKUP [ 1330.606902][T20106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1330.606915][T20106] Call Trace: [ 1330.606923][T20106] [ 1330.606933][T20106] dump_stack_lvl+0xe8/0x150 [ 1330.606964][T20106] should_fail_ex+0x414/0x560 [ 1330.607000][T20106] _copy_from_user+0x2d/0xb0 [ 1330.607025][T20106] get_compat_msghdr+0xad/0x4a0 [ 1330.607061][T20106] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1330.607087][T20106] ? rcu_is_watching+0x15/0xb0 [ 1330.607111][T20106] ? ___sys_recvmsg+0x1c4/0x510 [ 1330.607143][T20106] ___sys_recvmsg+0x17f/0x510 [ 1330.607166][T20106] ? _parse_integer_limit+0x1ae/0x1f0 [ 1330.607200][T20106] ? __pfx____sys_recvmsg+0x10/0x10 [ 1330.607222][T20106] ? kstrtoull+0x12f/0x1d0 [ 1330.607254][T20106] ? __fget_files+0x2a/0x420 [ 1330.607307][T20106] do_recvmmsg+0x36a/0x770 [ 1330.607340][T20106] ? __pfx_do_recvmmsg+0x10/0x10 [ 1330.607364][T20106] ? ksys_write+0x1cb/0x250 [ 1330.607400][T20106] ? __fget_files+0x3a0/0x420 [ 1330.607431][T20106] __sys_recvmmsg+0x19d/0x280 [ 1330.607458][T20106] ? __pfx___sys_recvmmsg+0x10/0x10 [ 1330.607482][T20106] ? __pfx_ksys_write+0x10/0x10 [ 1330.607508][T20106] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 1330.607539][T20106] __do_fast_syscall_32+0x1dc/0x560 [ 1330.607563][T20106] ? lockdep_hardirqs_on+0x7b/0x110 [ 1330.607581][T20106] ? do_fast_syscall_32+0x34/0x80 [ 1330.607603][T20106] ? irqentry_exit+0x10f/0x660 [ 1330.607634][T20106] do_fast_syscall_32+0x34/0x80 [ 1330.607656][T20106] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1330.607681][T20106] RIP: 0023:0xf7f72539 [ 1330.607698][T20106] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1330.607717][T20106] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 1330.607740][T20106] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000840 [ 1330.607756][T20106] RDX: 0000000000000414 RSI: 0000000000000000 RDI: 0000000000000000 [ 1330.607769][T20106] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1330.607786][T20106] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1330.607798][T20106] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1330.607828][T20106] [ 1331.003135][T20114] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode [ 1331.013858][T20114] macsec1: entered promiscuous mode [ 1331.022499][T20114] macsec1: entered allmulticast mode [ 1331.052029][T20114] mac80211_hwsim hwsim38 wlan0: entered allmulticast mode [ 1331.068872][T20124] netlink: 8 bytes leftover after parsing attributes in process `syz.3.5944'. [ 1331.239924][T20129] syzkaller0: entered promiscuous mode [ 1331.246694][T20129] syzkaller0: entered allmulticast mode [ 1331.274412][T20129] tipc: Started in network mode [ 1331.281042][T20129] tipc: Node identity e64e8dd23df6, cluster identity 4711 [ 1331.289395][T20129] tipc: Enabled bearer , priority 0 [ 1331.298674][T20129] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5946'. [ 1331.309720][T20129] netlink: 104 bytes leftover after parsing attributes in process `syz.7.5946'. [ 1331.319648][T20129] netlink: 104 bytes leftover after parsing attributes in process `syz.7.5946'. [ 1332.403427][ T10] tipc: Node number set to 3686305234 [ 1333.003556][ T5831] Bluetooth: hci4: command 0x0406 tx timeout [ 1333.652238][T20158] tipc: Started in network mode [ 1333.657965][T20158] tipc: Node identity bacbc0429efb, cluster identity 4711 [ 1333.666837][T20158] tipc: Enabled bearer , priority 0 [ 1333.675951][T20157] tipc: Resetting bearer [ 1335.661599][T20180] FAULT_INJECTION: forcing a failure. [ 1335.661599][T20180] name failslab, interval 1, probability 0, space 0, times 0 [ 1335.689958][T20180] CPU: 0 UID: 0 PID: 20180 Comm: syz.0.5955 Tainted: G L syzkaller #0 PREEMPT(full) [ 1335.689990][T20180] Tainted: [L]=SOFTLOCKUP [ 1335.689997][T20180] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1335.690009][T20180] Call Trace: [ 1335.690015][T20180] [ 1335.690023][T20180] dump_stack_lvl+0xe8/0x150 [ 1335.690042][T20180] should_fail_ex+0x414/0x560 [ 1335.690062][T20180] should_failslab+0xa8/0x100 [ 1335.690076][T20180] __kmalloc_noprof+0xdf/0x800 [ 1335.690087][T20180] ? kfree+0x4d/0x660 [ 1335.690106][T20180] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1335.690133][T20180] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1335.690160][T20180] ? tomoyo_domain+0xd8/0x130 [ 1335.690188][T20180] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1335.690200][T20180] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1335.690213][T20180] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1335.690224][T20180] ? __lock_acquire+0x6b6/0x2cf0 [ 1335.690237][T20180] ? get_pid_task+0x20/0x1f0 [ 1335.690255][T20180] ? get_pid_task+0x20/0x1f0 [ 1335.690282][T20180] ? __fget_files+0x2a/0x420 [ 1335.690298][T20180] ? __fget_files+0x3a0/0x420 [ 1335.690310][T20180] ? __fget_files+0x2a/0x420 [ 1335.690324][T20180] security_file_ioctl_compat+0xcb/0x2d0 [ 1335.690337][T20180] __ia32_compat_sys_ioctl+0x128/0x840 [ 1335.690349][T20180] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1335.690359][T20180] ? __fget_files+0x3a0/0x420 [ 1335.690376][T20180] ? fput+0xa0/0xd0 [ 1335.690390][T20180] ? ksys_write+0x22a/0x250 [ 1335.690401][T20180] ? __pfx_ksys_write+0x10/0x10 [ 1335.690416][T20180] __do_fast_syscall_32+0x1dc/0x560 [ 1335.690429][T20180] ? lockdep_hardirqs_on+0x7b/0x110 [ 1335.690440][T20180] ? do_fast_syscall_32+0x34/0x80 [ 1335.690450][T20180] ? irqentry_exit+0x10f/0x660 [ 1335.690463][T20180] do_fast_syscall_32+0x34/0x80 [ 1335.690474][T20180] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1335.690488][T20180] RIP: 0023:0xf7f72539 [ 1335.690498][T20180] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1335.690508][T20180] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1335.690521][T20180] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1335.690529][T20180] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1335.690535][T20180] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1335.690542][T20180] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1335.690548][T20180] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1335.690563][T20180] [ 1335.690582][T20180] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1336.349346][T20187] binder: BINDER_SET_CONTEXT_MGR already set [ 1336.355485][T20187] binder: 20184:20187 ioctl 4018620d 80000040 returned -16 [ 1338.047697][T20157] tipc: Disabling bearer [ 1338.059203][T20129] tipc: Resetting bearer [ 1338.081736][T20129] tipc: Disabling bearer [ 1338.090851][ T10] tipc: Node number set to 607174722 [ 1338.317272][T20206] FAULT_INJECTION: forcing a failure. [ 1338.317272][T20206] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1338.363713][T20206] CPU: 0 UID: 0 PID: 20206 Comm: syz.8.5959 Tainted: G L syzkaller #0 PREEMPT(full) [ 1338.363749][T20206] Tainted: [L]=SOFTLOCKUP [ 1338.363756][T20206] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1338.363767][T20206] Call Trace: [ 1338.363774][T20206] [ 1338.363783][T20206] dump_stack_lvl+0xe8/0x150 [ 1338.363812][T20206] should_fail_ex+0x414/0x560 [ 1338.363849][T20206] _copy_from_user+0x2d/0xb0 [ 1338.363874][T20206] get_compat_msghdr+0xad/0x4a0 [ 1338.363904][T20206] ? __pfx_get_compat_msghdr+0x10/0x10 [ 1338.363929][T20206] ? kstrtouint+0x6e/0xe0 [ 1338.363962][T20206] ___sys_sendmsg+0x193/0x2a0 [ 1338.363987][T20206] ? __pfx____sys_sendmsg+0x10/0x10 [ 1338.364010][T20206] ? get_pid_task+0x20/0x1f0 [ 1338.364038][T20206] ? get_pid_task+0x20/0x1f0 [ 1338.364060][T20206] ? get_pid_task+0x20/0x1f0 [ 1338.364113][T20206] ? __fget_files+0x2a/0x420 [ 1338.364136][T20206] ? __fget_files+0x3a0/0x420 [ 1338.364170][T20206] __sys_sendmsg+0x164/0x220 [ 1338.364197][T20206] ? __pfx___sys_sendmsg+0x10/0x10 [ 1338.364231][T20206] ? __pfx_ksys_write+0x10/0x10 [ 1338.364266][T20206] __do_fast_syscall_32+0x1dc/0x560 [ 1338.364288][T20206] ? lockdep_hardirqs_on+0x7b/0x110 [ 1338.364310][T20206] ? do_fast_syscall_32+0x34/0x80 [ 1338.364331][T20206] ? irqentry_exit+0x10f/0x660 [ 1338.364354][T20206] do_fast_syscall_32+0x34/0x80 [ 1338.364377][T20206] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1338.364406][T20206] RIP: 0023:0xf7fc4539 [ 1338.364422][T20206] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1338.364440][T20206] RSP: 002b:00000000f54b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1338.364460][T20206] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 1338.364473][T20206] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1338.364484][T20206] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1338.364497][T20206] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1338.364509][T20206] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1338.364533][T20206] [ 1339.023443][ T10] usb 9-1: new full-speed USB device number 2 using dummy_hcd [ 1339.182727][ T10] usb 9-1: not running at top speed; connect to a high speed hub [ 1339.192523][ T10] usb 9-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1339.202278][ T10] usb 9-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1339.217144][ T10] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1339.231120][ T10] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1339.240791][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1339.250665][ T10] usb 9-1: Product: syz [ 1339.256209][ T10] usb 9-1: Manufacturer: syz [ 1339.260935][ T10] usb 9-1: SerialNumber: syz [ 1339.408123][T20227] binder: 20224:20227 ioctl 4018620d 0 returned -22 [ 1339.419484][T20227] binder: 20224:20227 ioctl c0306201 80000080 returned -14 [ 1339.499617][ T10] usb 9-1: 0:2 : does not exist [ 1339.527907][ T10] usb 9-1: USB disconnect, device number 2 [ 1339.955940][T20227] binder: 20224:20227 ioctl d000941e 0 returned -22 [ 1340.345253][T20247] FAULT_INJECTION: forcing a failure. [ 1340.345253][T20247] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1340.361347][T20247] CPU: 0 UID: 0 PID: 20247 Comm: syz.8.5963 Tainted: G L syzkaller #0 PREEMPT(full) [ 1340.361368][T20247] Tainted: [L]=SOFTLOCKUP [ 1340.361373][T20247] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1340.361380][T20247] Call Trace: [ 1340.361385][T20247] [ 1340.361390][T20247] dump_stack_lvl+0xe8/0x150 [ 1340.361409][T20247] should_fail_ex+0x414/0x560 [ 1340.361429][T20247] _copy_from_user+0x2d/0xb0 [ 1340.361443][T20247] __sys_bpf+0x1e3/0x860 [ 1340.361459][T20247] ? __pfx___sys_bpf+0x10/0x10 [ 1340.361474][T20247] ? lock_vma_under_rcu+0x42c/0x4a0 [ 1340.361491][T20247] ? ksys_write+0x1e1/0x250 [ 1340.361503][T20247] ? __pfx_ksys_write+0x10/0x10 [ 1340.361516][T20247] __ia32_sys_bpf+0x7c/0x90 [ 1340.361529][T20247] __do_fast_syscall_32+0x1dc/0x560 [ 1340.361542][T20247] ? lockdep_hardirqs_on+0x7b/0x110 [ 1340.361552][T20247] ? do_fast_syscall_32+0x34/0x80 [ 1340.361563][T20247] ? irqentry_exit+0x10f/0x660 [ 1340.361574][T20247] do_fast_syscall_32+0x34/0x80 [ 1340.361586][T20247] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1340.361599][T20247] RIP: 0023:0xf7fc4539 [ 1340.361609][T20247] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1340.361619][T20247] RSP: 002b:00000000f54b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000165 [ 1340.361631][T20247] RAX: ffffffffffffffda RBX: 0000000000000015 RCX: 0000000080000740 [ 1340.361639][T20247] RDX: 0000000000000010 RSI: 0000000000000000 RDI: 0000000000000000 [ 1340.361645][T20247] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1340.361652][T20247] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1340.361658][T20247] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1340.361672][T20247] [ 1340.953360][T14512] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 1341.193422][T14512] usb 9-1: device descriptor read/64, error -71 [ 1341.434056][T14512] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 1341.573584][T14512] usb 9-1: device descriptor read/64, error -71 [ 1341.684322][T14512] usb usb9-port1: attempt power cycle [ 1341.864859][T20264] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5966'. [ 1341.873807][T20264] netlink: 'syz.7.5966': attribute type 18 has an invalid length. [ 1341.881605][T20264] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5966'. [ 1342.033446][T14512] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 1342.054224][T14512] usb 9-1: device descriptor read/8, error -71 [ 1342.303518][T14512] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 1342.338758][T14512] usb 9-1: device descriptor read/8, error -71 [ 1342.455376][T14512] usb usb9-port1: unable to enumerate USB device [ 1343.365856][T20277] FAULT_INJECTION: forcing a failure. [ 1343.365856][T20277] name failslab, interval 1, probability 0, space 0, times 0 [ 1343.379896][T20277] CPU: 1 UID: 0 PID: 20277 Comm: syz.0.5968 Tainted: G L syzkaller #0 PREEMPT(full) [ 1343.379915][T20277] Tainted: [L]=SOFTLOCKUP [ 1343.379919][T20277] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1343.379926][T20277] Call Trace: [ 1343.379931][T20277] [ 1343.379937][T20277] dump_stack_lvl+0xe8/0x150 [ 1343.379956][T20277] should_fail_ex+0x414/0x560 [ 1343.379975][T20277] should_failslab+0xa8/0x100 [ 1343.379989][T20277] kmem_cache_alloc_noprof+0x88/0x710 [ 1343.380005][T20277] ? __netlink_lookup+0xbd/0x8a0 [ 1343.380020][T20277] ? skb_clone+0x212/0x3a0 [ 1343.380036][T20277] skb_clone+0x212/0x3a0 [ 1343.380051][T20277] __netlink_deliver_tap+0x404/0x850 [ 1343.380070][T20277] ? netlink_deliver_tap+0x2e/0x1b0 [ 1343.380083][T20277] netlink_deliver_tap+0x19c/0x1b0 [ 1343.380096][T20277] netlink_unicast+0x7fa/0x9e0 [ 1343.380112][T20277] ? __pfx_netlink_unicast+0x10/0x10 [ 1343.380143][T20277] ? __alloc_skb+0x198/0x3a0 [ 1343.380154][T20277] ? netlink_sendmsg+0x642/0xb30 [ 1343.380166][T20277] ? skb_put+0x11b/0x210 [ 1343.380178][T20277] netlink_sendmsg+0x805/0xb30 [ 1343.380196][T20277] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1343.380216][T20277] ? __import_iovec+0x5d4/0x7f0 [ 1343.380227][T20277] ? aa_sock_msg_perm+0xf1/0x1b0 [ 1343.380242][T20277] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1343.380252][T20277] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1343.380266][T20277] __sock_sendmsg+0x21c/0x270 [ 1343.380282][T20277] ____sys_sendmsg+0x505/0x820 [ 1343.380297][T20277] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1343.380312][T20277] ? kstrtouint+0x6e/0xe0 [ 1343.380331][T20277] ___sys_sendmsg+0x21f/0x2a0 [ 1343.380345][T20277] ? __pfx____sys_sendmsg+0x10/0x10 [ 1343.380356][T20277] ? get_pid_task+0x20/0x1f0 [ 1343.380369][T20277] ? get_pid_task+0x20/0x1f0 [ 1343.380381][T20277] ? get_pid_task+0x20/0x1f0 [ 1343.380408][T20277] ? __fget_files+0x2a/0x420 [ 1343.380421][T20277] ? __fget_files+0x3a0/0x420 [ 1343.380439][T20277] __sys_sendmsg+0x164/0x220 [ 1343.380456][T20277] ? __pfx___sys_sendmsg+0x10/0x10 [ 1343.380483][T20277] ? __pfx_ksys_write+0x10/0x10 [ 1343.380509][T20277] __do_fast_syscall_32+0x1dc/0x560 [ 1343.380530][T20277] ? lockdep_hardirqs_on+0x7b/0x110 [ 1343.380546][T20277] ? do_fast_syscall_32+0x34/0x80 [ 1343.380564][T20277] ? irqentry_exit+0x10f/0x660 [ 1343.380576][T20277] do_fast_syscall_32+0x34/0x80 [ 1343.380588][T20277] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1343.380601][T20277] RIP: 0023:0xf7f72539 [ 1343.380611][T20277] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1343.380621][T20277] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1343.380634][T20277] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800002c0 [ 1343.380641][T20277] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1343.380648][T20277] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1343.380654][T20277] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1343.380660][T20277] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1343.380675][T20277] [ 1343.380697][T20277] netlink: 4 bytes leftover after parsing attributes in process `syz.0.5968'. [ 1345.192324][ T5831] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 1345.205719][ T5831] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 1345.215373][ T5831] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 1345.225983][ T5831] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 1345.234122][ T5831] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 1345.460518][T20313] chnl_net:caif_netlink_parms(): no params data found [ 1345.601623][T20313] bridge0: port 1(bridge_slave_0) entered blocking state [ 1345.610141][T20313] bridge0: port 1(bridge_slave_0) entered disabled state [ 1345.618550][T20313] bridge_slave_0: entered allmulticast mode [ 1345.627534][T20313] bridge_slave_0: entered promiscuous mode [ 1345.641689][T20313] bridge0: port 2(bridge_slave_1) entered blocking state [ 1345.650091][T20313] bridge0: port 2(bridge_slave_1) entered disabled state [ 1345.657586][T20313] bridge_slave_1: entered allmulticast mode [ 1345.665975][T20313] bridge_slave_1: entered promiscuous mode [ 1345.721253][T20313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1345.736416][T20313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1345.776157][T20313] team0: Port device team_slave_0 added [ 1345.784885][T20313] team0: Port device team_slave_1 added [ 1345.828594][T20313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1345.836030][T20313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1345.864677][T20313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1345.877365][T20313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1345.884603][T20313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1345.910715][T20313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1345.943581][T18413] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 1345.982108][T20313] hsr_slave_0: entered promiscuous mode [ 1345.989199][T20313] hsr_slave_1: entered promiscuous mode [ 1345.999807][T20313] debugfs: 'hsr0' already exists in 'hsr' [ 1346.006244][T20313] Cannot create hsr debugfs directory [ 1346.117563][T18413] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1346.142403][T18413] usb 9-1: config 129 has an invalid interface number: 135 but max is 0 [ 1346.183796][T18413] usb 9-1: config 129 has an invalid interface number: 5 but max is 0 [ 1346.192095][T18413] usb 9-1: config 129 has 2 interfaces, different from the descriptor's value: 1 [ 1346.202344][T18413] usb 9-1: config 129 has no interface number 0 [ 1346.209769][T18413] usb 9-1: config 129 has no interface number 1 [ 1346.217104][T18413] usb 9-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 1346.237798][T18413] usb 9-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30 [ 1346.250809][T18413] usb 9-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37 [ 1346.265345][T18413] usb 9-1: config 129 interface 135 has no altsetting 0 [ 1346.272325][T18413] usb 9-1: config 129 interface 5 has no altsetting 0 [ 1346.283541][T18413] usb 9-1: string descriptor 0 read error: -22 [ 1346.291888][T18413] usb 9-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00 [ 1346.306217][T18413] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1346.345318][T18413] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 1346.352575][T18413] usb 9-1: MIDIStreaming interface descriptor not found [ 1346.545526][T20313] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1346.558231][T20313] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1346.569742][T20313] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1346.591269][T20313] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1346.735055][T20313] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1346.761992][T20313] 8021q: adding VLAN 0 to HW filter on device team0 [ 1346.782213][T15575] bridge0: port 1(bridge_slave_0) entered blocking state [ 1346.789490][T15575] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1346.811884][T15575] bridge0: port 2(bridge_slave_1) entered blocking state [ 1346.819257][T15575] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1346.979321][T20313] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1347.076891][T20313] veth0_vlan: entered promiscuous mode [ 1347.105517][T20313] veth1_vlan: entered promiscuous mode [ 1347.344962][ T52] Bluetooth: hci7: command tx timeout [ 1347.658288][T20684] bond0: option primary: mode dependency failed, not supported in mode balance-rr(0) [ 1347.678110][T20313] veth0_macvtap: entered promiscuous mode [ 1347.702079][T20313] veth1_macvtap: entered promiscuous mode [ 1347.846920][T20313] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1348.117012][T20313] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1348.175861][ T50] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1348.203573][T17219] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1348.215094][ T2112] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1348.244012][ T2112] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1348.487962][ T50] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1348.521597][T20700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1348.531081][T20700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1348.542636][T20700] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1348.555582][ T50] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1348.666137][ T5831] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 1348.670328][ T195] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1348.682337][ T5831] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 1348.694119][ T5831] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 1348.701584][ T195] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1348.709746][ T5831] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 1348.719894][ T5831] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 1348.804915][T20700] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1349.407574][ T52] Bluetooth: hci7: command tx timeout [ 1349.780639][T20736] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 1349.925491][T20714] chnl_net:caif_netlink_parms(): no params data found [ 1350.606953][T20714] bridge0: port 1(bridge_slave_0) entered blocking state [ 1350.837088][ T52] Bluetooth: hci8: command tx timeout [ 1350.893813][T20714] bridge0: port 1(bridge_slave_0) entered disabled state [ 1350.924446][T20714] bridge_slave_0: entered allmulticast mode [ 1350.933461][T20714] bridge_slave_0: entered promiscuous mode [ 1350.946636][T20714] bridge0: port 2(bridge_slave_1) entered blocking state [ 1350.960020][T20714] bridge0: port 2(bridge_slave_1) entered disabled state [ 1350.982764][T20714] bridge_slave_1: entered allmulticast mode [ 1350.989896][T20714] bridge_slave_1: entered promiscuous mode [ 1351.249068][T20714] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1351.372332][T20714] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1351.483517][ T52] Bluetooth: hci7: command tx timeout [ 1351.495013][T20714] team0: Port device team_slave_0 added [ 1351.506625][T20714] team0: Port device team_slave_1 added [ 1352.158038][T20714] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1352.167435][T20714] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1352.240588][T20714] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1352.277361][T20714] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1352.295437][T20714] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1352.322223][T20714] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1352.554505][T20991] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5987'. [ 1352.582683][T20991] FAULT_INJECTION: forcing a failure. [ 1352.582683][T20991] name failslab, interval 1, probability 0, space 0, times 0 [ 1352.598886][T20991] CPU: 1 UID: 0 PID: 20991 Comm: syz.8.5987 Tainted: G L syzkaller #0 PREEMPT(full) [ 1352.598917][T20991] Tainted: [L]=SOFTLOCKUP [ 1352.598925][T20991] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1352.598937][T20991] Call Trace: [ 1352.598946][T20991] [ 1352.598955][T20991] dump_stack_lvl+0xe8/0x150 [ 1352.598985][T20991] should_fail_ex+0x414/0x560 [ 1352.599021][T20991] should_failslab+0xa8/0x100 [ 1352.599047][T20991] __kmalloc_cache_noprof+0x84/0x700 [ 1352.599067][T20991] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 1352.599096][T20991] ? sctp_add_bind_addr+0x8c/0x370 [ 1352.599127][T20991] sctp_add_bind_addr+0x8c/0x370 [ 1352.599157][T20991] sctp_copy_local_addr_list+0x30b/0x4e0 [ 1352.599187][T20991] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 1352.599214][T20991] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1352.599243][T20991] ? sctp_v6_is_any+0x64/0x80 [ 1352.599294][T20991] ? sctp_copy_one_addr+0x93/0x360 [ 1352.599323][T20991] sctp_bind_addr_copy+0xb3/0x3c0 [ 1352.599348][T20991] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1352.599373][T20991] sctp_connect_new_asoc+0x2e0/0x690 [ 1352.599395][T20991] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1352.599421][T20991] ? __local_bh_enable_ip+0xd0/0x130 [ 1352.599439][T20991] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1352.599459][T20991] ? security_sctp_bind_connect+0x7e/0x2e0 [ 1352.599483][T20991] sctp_sendmsg+0x155c/0x2840 [ 1352.599512][T20991] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1352.599534][T20991] ? aa_sk_perm+0x15f/0x920 [ 1352.599558][T20991] ? aa_sk_perm+0x7ee/0x920 [ 1352.599584][T20991] ? __pfx_aa_sk_perm+0x10/0x10 [ 1352.599608][T20991] ? sock_rps_record_flow+0x19/0x410 [ 1352.599635][T20991] ? inet_sendmsg+0x2f4/0x370 [ 1352.599663][T20991] __sock_sendmsg+0x19c/0x270 [ 1352.599695][T20991] ____sys_sendmsg+0x505/0x820 [ 1352.599722][T20991] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1352.599750][T20991] ? kstrtouint+0x6e/0xe0 [ 1352.599785][T20991] ___sys_sendmsg+0x21f/0x2a0 [ 1352.599811][T20991] ? __pfx____sys_sendmsg+0x10/0x10 [ 1352.599833][T20991] ? get_pid_task+0x20/0x1f0 [ 1352.599858][T20991] ? get_pid_task+0x20/0x1f0 [ 1352.599880][T20991] ? get_pid_task+0x20/0x1f0 [ 1352.599933][T20991] ? __fget_files+0x2a/0x420 [ 1352.599957][T20991] ? __fget_files+0x3a0/0x420 [ 1352.599992][T20991] __sys_sendmsg+0x164/0x220 [ 1352.600017][T20991] ? __pfx___sys_sendmsg+0x10/0x10 [ 1352.600049][T20991] ? __pfx_ksys_write+0x10/0x10 [ 1352.600080][T20991] __do_fast_syscall_32+0x1dc/0x560 [ 1352.600101][T20991] ? lockdep_hardirqs_on+0x7b/0x110 [ 1352.600119][T20991] ? do_fast_syscall_32+0x34/0x80 [ 1352.600140][T20991] ? irqentry_exit+0x10f/0x660 [ 1352.600163][T20991] do_fast_syscall_32+0x34/0x80 [ 1352.600184][T20991] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1352.600207][T20991] RIP: 0023:0xf7fc4539 [ 1352.600225][T20991] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1352.600242][T20991] RSP: 002b:00000000f54b655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1352.600263][T20991] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 0000000080000800 [ 1352.600276][T20991] RDX: 0000000004048043 RSI: 0000000000000000 RDI: 0000000000000000 [ 1352.600289][T20991] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1352.600300][T20991] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1352.600312][T20991] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1352.600341][T20991] [ 1353.035591][ T52] Bluetooth: hci8: command tx timeout [ 1353.057703][T18413] usb 9-1: USB disconnect, device number 7 [ 1353.110607][T20714] hsr_slave_0: entered promiscuous mode [ 1353.117593][T20714] hsr_slave_1: entered promiscuous mode [ 1353.124704][T20714] debugfs: 'hsr0' already exists in 'hsr' [ 1353.130513][T20714] Cannot create hsr debugfs directory [ 1353.286726][T21032] tipc: Enabled bearer , priority 0 [ 1353.332615][T21030] tipc: Resetting bearer [ 1353.563552][ T52] Bluetooth: hci7: command tx timeout [ 1353.663659][T18413] usb 10-1: new high-speed USB device number 2 using dummy_hcd [ 1353.844316][T18413] usb 10-1: Using ep0 maxpacket: 16 [ 1353.870748][T18413] usb 10-1: New USB device found, idVendor=0db0, idProduct=5581, bcdDevice=f9.22 [ 1353.880514][T18413] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1353.890364][T18413] usb 10-1: Product: syz [ 1353.895370][T18413] usb 10-1: Manufacturer: syz [ 1353.900092][T18413] usb 10-1: SerialNumber: syz [ 1354.584993][T21069] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1354.596456][T21069] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1355.090083][ T52] Bluetooth: hci8: command tx timeout [ 1356.542651][ T5918] io_ti 1-1:0.233: Failed to load image "edgeport/down3.bin" err -110 [ 1356.565393][ T5918] io_ti 1-1:0.233: probe with driver io_ti failed with error -110 [ 1356.606261][ T5918] usb 1-1: USB disconnect, device number 76 [ 1357.165551][ T5831] Bluetooth: hci8: command tx timeout [ 1358.118477][T21030] tipc: Disabling bearer [ 1358.151740][T21086] veth1_to_team: entered promiscuous mode [ 1358.161434][T21086] macvlan1: entered promiscuous mode [ 1358.169106][T21086] debugfs: 'hsr1' already exists in 'hsr' [ 1358.183344][T21086] Cannot create hsr debugfs directory [ 1358.189325][T21086] hsr1: entered allmulticast mode [ 1358.205242][T21086] veth1_to_team: entered allmulticast mode [ 1358.224547][T21086] macvlan1: entered allmulticast mode [ 1358.253790][T21086] veth1_vlan: entered allmulticast mode [ 1358.351851][T18413] usb 10-1: dvb_usb_v2: found a 'MSI Mega Sky 55801 DVB-T USB2.0' in warm state [ 1358.415513][T18413] usb 10-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1358.446724][T18413] dvbdev: DVB: registering new adapter (MSI Mega Sky 55801 DVB-T USB2.0) [ 1358.491928][T18413] usb 10-1: media controller created [ 1358.543164][T18413] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1359.123367][ T5912] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 1359.137307][T18413] zl10353_read_register: readreg error (reg=127, ret==-71) [ 1359.310154][ T3518] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1359.336200][ T5912] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1359.371073][ T5912] usb 9-1: config 14 has an invalid interface number: 21 but max is 0 [ 1359.447640][ T5912] usb 9-1: config 14 has no interface number 0 [ 1359.590522][T18413] dvb_usb_gl861 10-1:157.0: probe with driver dvb_usb_gl861 failed with error -5 [ 1359.609347][T18413] usb 10-1: USB disconnect, device number 2 [ 1359.636226][ T5912] usb 9-1: config 14 interface 21 altsetting 251 bulk endpoint 0xA has invalid maxpacket 32 [ 1359.931780][ T5912] usb 9-1: config 14 interface 21 has no altsetting 0 [ 1360.003967][ T5912] usb 9-1: New USB device found, idVendor=c880, idProduct=760e, bcdDevice=35.fc [ 1360.028008][ T5912] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1360.031603][T20714] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1360.047999][ T5912] usb 9-1: Product: syz [ 1360.082499][ T5912] usb 9-1: Manufacturer: syz [ 1360.100443][ T5912] usb 9-1: SerialNumber: syz [ 1360.422939][T21215] usb usb8: usbfs: process 21215 (syz.0.5998) did not claim interface 0 before use [ 1360.466130][T21151] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1360.572927][ T3518] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1360.665357][T21219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1360.730736][ T5912] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 1360.738619][T21219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1360.764876][ T5912] usb 9-1: MIDIStreaming interface descriptor not found [ 1360.828778][ T5912] usb 9-1: USB disconnect, device number 8 [ 1360.836863][T21219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1360.919147][T20714] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1360.942604][T21219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1360.999731][T21219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1361.027277][T21219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1361.040439][T21219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1361.050947][T21219] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1361.078232][T16671] udevd[16671]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:14.21/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1361.151037][ T3518] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1361.200913][ T5918] usb 10-1: new high-speed USB device number 3 using dummy_hcd [ 1361.229379][T20714] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1361.311588][ T3518] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1361.392648][ T5918] usb 10-1: New USB device found, idVendor=1604, idProduct=8001, bcdDevice=44.1f [ 1361.418085][ T5918] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1361.427589][T20714] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1361.438801][ T5918] usb 10-1: Product: syz [ 1361.447419][ T5918] usb 10-1: Manufacturer: syz [ 1361.452140][ T5918] usb 10-1: SerialNumber: syz [ 1361.494968][ T5918] usb 10-1: config 0 descriptor?? [ 1361.657594][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1361.679139][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.941633][ T30] audit: type=1326 audit(1767218172.354:3734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21317 comm="syz.8.6005" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fc4539 code=0x0 [ 1361.978841][T21324] syzkaller0: entered promiscuous mode [ 1362.002394][T21324] syzkaller0: entered allmulticast mode [ 1362.023677][ T3518] bridge_slave_1: left allmulticast mode [ 1362.035327][ T3518] bridge_slave_1: left promiscuous mode [ 1362.049908][ T3518] bridge0: port 2(bridge_slave_1) entered disabled state [ 1362.154760][ T3518] bridge_slave_0: left allmulticast mode [ 1362.172147][ T3518] bridge_slave_0: left promiscuous mode [ 1362.186518][ T3518] bridge0: port 1(bridge_slave_0) entered disabled state [ 1362.627837][T21346] FAULT_INJECTION: forcing a failure. [ 1362.627837][T21346] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1362.670023][T21346] CPU: 0 UID: 0 PID: 21346 Comm: syz.7.6006 Tainted: G L syzkaller #0 PREEMPT(full) [ 1362.670053][T21346] Tainted: [L]=SOFTLOCKUP [ 1362.670057][T21346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1362.670065][T21346] Call Trace: [ 1362.670070][T21346] [ 1362.670076][T21346] dump_stack_lvl+0xe8/0x150 [ 1362.670096][T21346] should_fail_ex+0x414/0x560 [ 1362.670116][T21346] prepare_alloc_pages+0x22b/0x650 [ 1362.670133][T21346] __alloc_frozen_pages_noprof+0x123/0x370 [ 1362.670145][T21346] ? __lock_acquire+0x6b6/0x2cf0 [ 1362.670157][T21346] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1362.670174][T21346] ? policy_nodemask+0x27c/0x720 [ 1362.670185][T21346] ? __kmalloc_cache_node_noprof+0x475/0x700 [ 1362.670195][T21346] ? __get_vm_area_node+0x13f/0x300 [ 1362.670210][T21346] ? __vmalloc_node_range_noprof+0x371/0x16a0 [ 1362.670221][T21346] alloc_pages_bulk_noprof+0x560/0x710 [ 1362.670236][T21346] ? alloc_pages_noprof+0xbe/0x190 [ 1362.670250][T21346] __kasan_populate_vmalloc+0xc1/0x1d0 [ 1362.670264][T21346] alloc_vmap_area+0xdc4/0x14e0 [ 1362.670289][T21346] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1362.670303][T21346] ? __kasan_kmalloc+0x93/0xb0 [ 1362.670317][T21346] ? __get_vm_area_node+0x13f/0x300 [ 1362.670332][T21346] ? copy_process+0x4ea/0x3950 [ 1362.670344][T21346] __get_vm_area_node+0x1f8/0x300 [ 1362.670363][T21346] __vmalloc_node_range_noprof+0x371/0x16a0 [ 1362.670374][T21346] ? copy_process+0x4ea/0x3950 [ 1362.670386][T21346] ? percpu_ref_get_many+0x19/0x140 [ 1362.670414][T21346] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1362.670427][T21346] ? memcpy_and_pad+0x48/0x80 [ 1362.670444][T21346] __vmalloc_node_noprof+0xc2/0x110 [ 1362.670454][T21346] ? copy_process+0x4ea/0x3950 [ 1362.670464][T21346] ? copy_process+0x4ea/0x3950 [ 1362.670476][T21346] dup_task_struct+0x228/0x9a0 [ 1362.670488][T21346] ? _raw_spin_unlock_irq+0x23/0x50 [ 1362.670506][T21346] copy_process+0x4ea/0x3950 [ 1362.670530][T21346] ? __pfx_copy_process+0x10/0x10 [ 1362.670545][T21346] ? mutex_init_lockep+0xf9/0x130 [ 1362.670559][T21346] vhost_task_create+0x1ce/0x320 [ 1362.670572][T21346] ? is_bpf_text_address+0x26/0x2b0 [ 1362.670590][T21346] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 1362.670613][T21346] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 1362.670638][T21346] ? __pfx_vhost_task_create+0x10/0x10 [ 1362.670677][T21346] ? __pfx_vhost_task_fn+0x10/0x10 [ 1362.670705][T21346] ? __lock_acquire+0x6b6/0x2cf0 [ 1362.670733][T21346] kvm_mmu_post_init_vm+0x14c/0x300 [ 1362.670764][T21346] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 1362.670793][T21346] ? stack_depot_save_flags+0x33/0x810 [ 1362.670848][T21346] ? look_up_lock_class+0x57/0x110 [ 1362.670885][T21346] ? register_lock_class+0x31/0x2e0 [ 1362.670904][T21346] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 1362.670941][T21346] ? __lock_acquire+0x6b6/0x2cf0 [ 1362.670961][T21346] ? __mutex_lock+0x335/0x1350 [ 1362.671011][T21346] ? do_raw_write_lock+0x120/0x260 [ 1362.671067][T21346] kvm_vcpu_ioctl+0x99a/0xed0 [ 1362.671109][T21346] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1362.671136][T21346] ? do_vfs_ioctl+0xbe8/0x1430 [ 1362.671162][T21346] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1362.671188][T21346] ? get_pid_task+0x20/0x1f0 [ 1362.671237][T21346] ? get_pid_task+0x20/0x1f0 [ 1362.671278][T21346] kvm_vcpu_compat_ioctl+0x203/0x390 [ 1362.671309][T21346] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1362.671342][T21346] ? __fget_files+0x3a0/0x420 [ 1362.671370][T21346] ? __fget_files+0x2a/0x420 [ 1362.671397][T21346] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 1362.671423][T21346] __ia32_compat_sys_ioctl+0x543/0x840 [ 1362.671446][T21346] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1362.671467][T21346] ? __fget_files+0x3a0/0x420 [ 1362.671498][T21346] ? fput+0xa0/0xd0 [ 1362.671525][T21346] ? ksys_write+0x22a/0x250 [ 1362.671548][T21346] ? __pfx_ksys_write+0x10/0x10 [ 1362.671577][T21346] __do_fast_syscall_32+0x1dc/0x560 [ 1362.671597][T21346] ? lockdep_hardirqs_on+0x7b/0x110 [ 1362.671614][T21346] ? do_fast_syscall_32+0x34/0x80 [ 1362.671632][T21346] ? irqentry_exit+0x10f/0x660 [ 1362.671660][T21346] do_fast_syscall_32+0x34/0x80 [ 1362.671682][T21346] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1362.671703][T21346] RIP: 0023:0xf709d539 [ 1362.671720][T21346] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1362.671736][T21346] RSP: 002b:00000000f548d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1362.671755][T21346] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1362.671769][T21346] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1362.671780][T21346] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1362.671790][T21346] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1362.671800][T21346] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1362.671817][T21346] [ 1363.217334][T21346] syz.7.6006: vmalloc error: size 32768, vm_struct allocation failed, mode:0xdc0(GFP_KERNEL|__GFP_ZERO), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1363.287047][T21346] CPU: 1 UID: 0 PID: 21346 Comm: syz.7.6006 Tainted: G L syzkaller #0 PREEMPT(full) [ 1363.287067][T21346] Tainted: [L]=SOFTLOCKUP [ 1363.287071][T21346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1363.287078][T21346] Call Trace: [ 1363.287083][T21346] [ 1363.287089][T21346] dump_stack_lvl+0xe8/0x150 [ 1363.287109][T21346] warn_alloc+0x214/0x310 [ 1363.287121][T21346] ? kasan_quarantine_put+0xbb/0x1f0 [ 1363.287134][T21346] ? __pfx_warn_alloc+0x10/0x10 [ 1363.287145][T21346] ? __get_vm_area_node+0x211/0x300 [ 1363.287161][T21346] ? __get_vm_area_node+0x13f/0x300 [ 1363.287177][T21346] ? copy_process+0x4ea/0x3950 [ 1363.287190][T21346] ? __get_vm_area_node+0x211/0x300 [ 1363.287208][T21346] __vmalloc_node_range_noprof+0x396/0x16a0 [ 1363.287221][T21346] ? percpu_ref_get_many+0x19/0x140 [ 1363.287247][T21346] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1363.287260][T21346] ? memcpy_and_pad+0x48/0x80 [ 1363.287278][T21346] __vmalloc_node_noprof+0xc2/0x110 [ 1363.287288][T21346] ? copy_process+0x4ea/0x3950 [ 1363.287298][T21346] ? copy_process+0x4ea/0x3950 [ 1363.287310][T21346] dup_task_struct+0x228/0x9a0 [ 1363.287322][T21346] ? _raw_spin_unlock_irq+0x23/0x50 [ 1363.287341][T21346] copy_process+0x4ea/0x3950 [ 1363.287364][T21346] ? __pfx_copy_process+0x10/0x10 [ 1363.287379][T21346] ? mutex_init_lockep+0xf9/0x130 [ 1363.287394][T21346] vhost_task_create+0x1ce/0x320 [ 1363.287407][T21346] ? is_bpf_text_address+0x26/0x2b0 [ 1363.287423][T21346] ? __pfx_kvm_nx_huge_page_recovery_worker_kill+0x10/0x10 [ 1363.287438][T21346] ? __pfx_kvm_nx_huge_page_recovery_worker+0x10/0x10 [ 1363.287452][T21346] ? __pfx_vhost_task_create+0x10/0x10 [ 1363.287469][T21346] ? __pfx_vhost_task_fn+0x10/0x10 [ 1363.287485][T21346] ? __lock_acquire+0x6b6/0x2cf0 [ 1363.287505][T21346] kvm_mmu_post_init_vm+0x14c/0x300 [ 1363.287522][T21346] kvm_arch_vcpu_ioctl_run+0xdc/0x1c90 [ 1363.287539][T21346] ? stack_depot_save_flags+0x33/0x810 [ 1363.287560][T21346] ? look_up_lock_class+0x57/0x110 [ 1363.287571][T21346] ? register_lock_class+0x31/0x2e0 [ 1363.287581][T21346] ? __pfx_kvm_arch_vcpu_ioctl_run+0x10/0x10 [ 1363.287605][T21346] ? __lock_acquire+0x6b6/0x2cf0 [ 1363.287616][T21346] ? __mutex_lock+0x335/0x1350 [ 1363.287639][T21346] ? do_raw_write_lock+0x120/0x260 [ 1363.287662][T21346] kvm_vcpu_ioctl+0x99a/0xed0 [ 1363.287680][T21346] ? __pfx_kvm_vcpu_ioctl+0x10/0x10 [ 1363.287693][T21346] ? do_vfs_ioctl+0xbe8/0x1430 [ 1363.287704][T21346] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1363.287715][T21346] ? get_pid_task+0x20/0x1f0 [ 1363.287734][T21346] ? get_pid_task+0x20/0x1f0 [ 1363.287755][T21346] kvm_vcpu_compat_ioctl+0x203/0x390 [ 1363.287771][T21346] ? __pfx_kvm_vcpu_compat_ioctl+0x10/0x10 [ 1363.287786][T21346] ? __fget_files+0x3a0/0x420 [ 1363.287799][T21346] ? __fget_files+0x2a/0x420 [ 1363.287813][T21346] ? bpf_lsm_file_ioctl_compat+0x9/0x20 [ 1363.287827][T21346] __ia32_compat_sys_ioctl+0x543/0x840 [ 1363.287839][T21346] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1363.287850][T21346] ? __fget_files+0x3a0/0x420 [ 1363.287866][T21346] ? fput+0xa0/0xd0 [ 1363.287880][T21346] ? ksys_write+0x22a/0x250 [ 1363.287891][T21346] ? __pfx_ksys_write+0x10/0x10 [ 1363.287907][T21346] __do_fast_syscall_32+0x1dc/0x560 [ 1363.287919][T21346] ? lockdep_hardirqs_on+0x7b/0x110 [ 1363.287928][T21346] ? do_fast_syscall_32+0x34/0x80 [ 1363.287939][T21346] ? irqentry_exit+0x10f/0x660 [ 1363.287951][T21346] do_fast_syscall_32+0x34/0x80 [ 1363.287963][T21346] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1363.287976][T21346] RIP: 0023:0xf709d539 [ 1363.287986][T21346] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1363.287996][T21346] RSP: 002b:00000000f548d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1363.288008][T21346] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 000000000000ae80 [ 1363.288016][T21346] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1363.288022][T21346] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1363.288029][T21346] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1363.288035][T21346] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1363.288050][T21346] [ 1363.289312][T21346] Mem-Info: [ 1363.751074][T19145] usb 10-1: USB disconnect, device number 3 [ 1363.762778][T21346] active_anon:6810 inactive_anon:0 isolated_anon:0 [ 1363.762778][T21346] active_file:22336 inactive_file:4020 isolated_file:0 [ 1363.762778][T21346] unevictable:768 dirty:248 writeback:0 [ 1363.762778][T21346] slab_reclaimable:7442 slab_unreclaimable:126230 [ 1363.762778][T21346] mapped:42884 shmem:1371 pagetables:1496 [ 1363.762778][T21346] sec_pagetables:0 bounce:0 [ 1363.762778][T21346] kernel_misc_reclaimable:0 [ 1363.762778][T21346] free:1270289 free_pcp:16704 free_cma:0 [ 1363.894293][T21346] Node 0 active_anon:27140kB inactive_anon:0kB active_file:89344kB inactive_file:15948kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:171536kB dirty:992kB writeback:0kB shmem:3948kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:15500kB pagetables:5864kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1363.993065][T21346] Node 1 active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:132kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:0kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB kernel_stack:64kB pagetables:120kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1364.024509][T21346] Node 0 DMA free:15360kB boost:0kB min:204kB low:252kB high:300kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1364.298232][T21346] lowmem_reserve[]: 0 2499 2501 2501 2501 [ 1364.304432][T21346] Node 0 DMA32 free:1197396kB boost:0kB min:34264kB low:42828kB high:51392kB reserved_highatomic:0KB free_highatomic:0KB active_anon:27940kB inactive_anon:0kB active_file:89344kB inactive_file:15948kB unevictable:1536kB writepending:992kB zspages:0kB present:3129332kB managed:2559516kB mlocked:0kB bounce:0kB free_pcp:40160kB local_pcp:20552kB free_cma:0kB [ 1364.347542][T21346] lowmem_reserve[]: 0 0 1 1 1 [ 1364.355058][T21346] Node 0 Normal free:0kB boost:0kB min:24kB low:28kB high:32kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB zspages:0kB present:1048580kB managed:1900kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1364.385229][T21346] lowmem_reserve[]: 0 0 0 0 0 [ 1364.390019][T21346] Node 1 Normal free:3865340kB boost:0kB min:55612kB low:69512kB high:83412kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:132kB unevictable:1536kB writepending:0kB zspages:0kB present:4194300kB managed:4111100kB mlocked:0kB bounce:0kB free_pcp:27200kB local_pcp:11360kB free_cma:0kB [ 1364.442871][T21346] lowmem_reserve[]: 0 0 0 0 0 [ 1364.451888][T21346] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1364.505342][T21346] Node 0 DMA32: 3933*4kB (UME) 5642*8kB (UME) 4117*16kB (UME) 644*32kB (UM) 171*64kB (UME) 108*128kB (UME) 234*256kB (UME) 93*512kB (UME) 82*1024kB (UME) 31*2048kB (UME) 188*4096kB (UM) = 1197140kB [ 1364.591199][T21346] Node 0 Normal: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 0kB [ 1364.603160][T21346] Node 1 Normal: 209*4kB (UME) 51*8kB (UME) 38*16kB (UME) 68*32kB (UME) 17*64kB (UME) 10*128kB (UME) 4*256kB (UME) 3*512kB (UM) 2*1024kB (UM) 2*2048kB (ME) 940*4096kB (M) = 3865340kB [ 1364.622280][T21346] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1364.632499][T21346] Node 0 hugepages_total=3 hugepages_free=3 hugepages_surp=0 hugepages_size=2048kB [ 1364.642885][T21346] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1364.652756][T21346] Node 1 hugepages_total=1 hugepages_free=1 hugepages_surp=0 hugepages_size=2048kB [ 1364.702723][T21346] 27723 total pagecache pages [ 1364.708069][T21346] 0 pages in swap cache [ 1364.712342][T21346] Free swap = 124996kB [ 1364.746848][T21346] Total swap = 124996kB [ 1364.752028][T21346] 2097051 pages RAM [ 1364.756446][T21346] 0 pages HighMem/MovableOnly [ 1364.763127][T21346] 425082 pages reserved [ 1364.773994][T21346] 0 pages cma reserved [ 1364.822190][ T3518] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1364.835280][ T3518] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1364.848013][ T3518] bond0 (unregistering): Released all slaves [ 1365.045493][T21389] netlink: 181284 bytes leftover after parsing attributes in process `syz.7.6011'. [ 1365.294734][ T30] audit: type=1326 audit(1767218175.714:3735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21399 comm="syz.0.6014" exe="/root/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf7f72539 code=0x0 [ 1365.436848][T21410] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6014'. [ 1365.446172][T21410] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6014'. [ 1365.458205][T21410] 8021q: VLANs not supported on ip6_vti0 [ 1365.546536][ T3518] hsr_slave_0: left promiscuous mode [ 1365.572310][ T3518] hsr_slave_1: left promiscuous mode [ 1365.596816][ T3518] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1365.625361][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1365.652321][ T3518] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1365.674206][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1365.729789][ T3518] veth1_macvtap: left promiscuous mode [ 1365.735483][ T3518] veth0_macvtap: left promiscuous mode [ 1365.738275][T21438] Cannot find set identified by id 0 to match [ 1365.741256][ T3518] veth1_vlan: left promiscuous mode [ 1365.762817][ T3518] veth0_vlan: left promiscuous mode [ 1365.965210][T21450] sg_write: data in/out 209152/12 bytes for SCSI command 0x89-- guessing data in; [ 1365.965210][T21450] program syz.8.6016 not setting count and/or reply_len properly [ 1366.324442][T14512] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 1366.504931][T14512] usb 9-1: too many endpoints for config 0 interface 0 altsetting 3: 253, using maximum allowed: 30 [ 1366.719040][T14512] usb 9-1: config 0 interface 0 altsetting 3 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1366.739199][T14512] usb 9-1: config 0 interface 0 altsetting 3 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1366.806723][T14512] usb 9-1: config 0 interface 0 altsetting 3 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1366.860543][T14512] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1366.870685][T14512] usb 9-1: New USB device found, idVendor=0b05, idProduct=183d, bcdDevice= 0.00 [ 1366.897255][T14512] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1366.930971][T14512] usb 9-1: config 0 descriptor?? [ 1367.364264][T21477] fuse: Bad value for 'fd' [ 1367.591842][ T3518] team0 (unregistering): Port device team_slave_1 removed [ 1367.692854][ T3518] team0 (unregistering): Port device team_slave_0 removed [ 1369.107015][T20714] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1369.121365][T21446] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1369.132201][T21446] bridge0: port 2(bridge_slave_1) entered disabled state [ 1369.213980][T20714] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1369.291750][T14512] usbhid 9-1:0.0: can't add hid device: -71 [ 1369.305212][T14512] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 1369.333623][T14512] usb 9-1: USB disconnect, device number 9 [ 1369.366329][T20714] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1369.502200][T21510] netlink: 44 bytes leftover after parsing attributes in process `syz.7.6027'. [ 1369.511892][T20714] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1369.659602][T21510] netlink: 24 bytes leftover after parsing attributes in process `syz.7.6027'. [ 1369.672197][T21510] bridge0: port 2(bridge_slave_1) entered disabled state [ 1369.682438][T21510] bridge0: port 2(bridge_slave_1) entered blocking state [ 1369.689633][T21510] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1369.862303][T21525] IPVS: set_ctl: invalid protocol: 92 100.1.1.0:20003 [ 1370.210713][T20714] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1370.315209][T20714] 8021q: adding VLAN 0 to HW filter on device team0 [ 1370.337539][T21206] bridge0: port 1(bridge_slave_0) entered blocking state [ 1370.344846][T21206] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1371.256115][T21206] bridge0: port 2(bridge_slave_1) entered blocking state [ 1371.263358][T21206] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1371.265549][T21556] netlink: 181392 bytes leftover after parsing attributes in process `syz.8.6034'. [ 1371.447741][T21349] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 1371.484598][ T3518] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1371.655177][T21349] usb 10-1: config index 0 descriptor too short (expected 23569, got 27) [ 1371.667522][T21349] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1371.681356][T21349] usb 10-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 1371.693043][T21349] usb 10-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 1371.702140][T21349] usb 10-1: Manufacturer: syz [ 1371.712170][T21349] usb 10-1: config 0 descriptor?? [ 1371.727615][ T6062] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 1371.808697][ T3518] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1371.834022][T21349] rc_core: IR keymap rc-hauppauge not found [ 1371.840170][T21349] Registered IR keymap rc-empty [ 1371.862238][T21349] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0 [ 1371.905853][T21349] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/rc/rc0/input91 [ 1371.919147][ T6062] usb 9-1: Using ep0 maxpacket: 8 [ 1371.940229][ T6062] usb 9-1: config index 0 descriptor too short (expected 301, got 45) [ 1371.963830][ T6062] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1371.980372][ T6062] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1371.982004][ T3518] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1371.991528][ T6062] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1372.019100][ C1] igorplugusb 10-1:0.0: Error: urb status = -32 [ 1372.028804][ T6062] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1372.052282][ T6062] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1372.063208][ T6062] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1372.128599][ T5918] usb 10-1: USB disconnect, device number 4 [ 1372.206371][ T3518] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1372.324161][ T6062] usb 9-1: usb_control_msg returned -32 [ 1372.359094][ T6062] usbtmc 9-1:16.0: can't read capabilities [ 1372.363632][ T7239] usb 1-1: new high-speed USB device number 77 using dummy_hcd [ 1372.372095][T20714] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1372.538024][ T7239] usb 1-1: Using ep0 maxpacket: 8 [ 1372.554936][ T7239] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 1372.574120][ T7239] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1372.606499][ T7239] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1372.646646][ T7239] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1372.674383][ T7239] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1372.709154][T21623] usbtmc 9-1:16.0: control status returned 0 [ 1372.720767][ T7239] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1372.742971][ T7239] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1372.750298][ T3518] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1372.864932][T20714] veth0_vlan: entered promiscuous mode [ 1372.924778][T19158] usb 9-1: USB disconnect, device number 10 [ 1372.962784][ T3518] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1372.974394][ T7239] usb 1-1: usb_control_msg returned -32 [ 1372.980026][ T7239] usbtmc 1-1:16.0: can't read capabilities [ 1373.011040][T20714] veth1_vlan: entered promiscuous mode [ 1373.104520][ T3518] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1373.151836][T20714] veth0_macvtap: entered promiscuous mode [ 1373.190526][ T3518] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1373.218461][T20714] veth1_macvtap: entered promiscuous mode [ 1373.238739][T20714] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1373.264311][T20714] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1373.293819][ T106] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 1373.302472][T15575] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1373.326403][T15575] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1373.341804][T21651] FAULT_INJECTION: forcing a failure. [ 1373.341804][T21651] name failslab, interval 1, probability 0, space 0, times 0 [ 1373.368622][T15575] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1373.378667][T21651] CPU: 0 UID: 0 PID: 21651 Comm: syz.0.6037 Tainted: G L syzkaller #0 PREEMPT(full) [ 1373.378697][T21651] Tainted: [L]=SOFTLOCKUP [ 1373.378703][T21651] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1373.378714][T21651] Call Trace: [ 1373.378721][T21651] [ 1373.378729][T21651] dump_stack_lvl+0xe8/0x150 [ 1373.378759][T21651] should_fail_ex+0x414/0x560 [ 1373.378794][T21651] should_failslab+0xa8/0x100 [ 1373.378820][T21651] __kmalloc_noprof+0xdf/0x800 [ 1373.378840][T21651] ? kfree+0x4d/0x660 [ 1373.378866][T21651] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 1373.378899][T21651] tomoyo_realpath_from_path+0xe3/0x5d0 [ 1373.378927][T21651] ? tomoyo_domain+0xd8/0x130 [ 1373.378956][T21651] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 1373.378977][T21651] tomoyo_path_number_perm+0x1e8/0x5a0 [ 1373.378999][T21651] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1373.379020][T21651] ? __lock_acquire+0x6b6/0x2cf0 [ 1373.379041][T21651] ? get_pid_task+0x20/0x1f0 [ 1373.379071][T21651] ? get_pid_task+0x20/0x1f0 [ 1373.379106][T21651] ? __fget_files+0x2a/0x420 [ 1373.379134][T21651] ? __fget_files+0x3a0/0x420 [ 1373.379156][T21651] ? __fget_files+0x2a/0x420 [ 1373.379183][T21651] security_file_ioctl_compat+0xcb/0x2d0 [ 1373.379206][T21651] __ia32_compat_sys_ioctl+0x128/0x840 [ 1373.379228][T21651] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 1373.379249][T21651] ? __fget_files+0x3a0/0x420 [ 1373.379278][T21651] ? fput+0xa0/0xd0 [ 1373.379303][T21651] ? ksys_write+0x22a/0x250 [ 1373.379324][T21651] ? __pfx_ksys_write+0x10/0x10 [ 1373.379355][T21651] __do_fast_syscall_32+0x1dc/0x560 [ 1373.379386][T21651] ? lockdep_hardirqs_on+0x7b/0x110 [ 1373.379404][T21651] ? do_fast_syscall_32+0x34/0x80 [ 1373.379424][T21651] ? irqentry_exit+0x10f/0x660 [ 1373.379447][T21651] do_fast_syscall_32+0x34/0x80 [ 1373.379468][T21651] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1373.379490][T21651] RIP: 0023:0xf7f72539 [ 1373.379506][T21651] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1373.379523][T21651] RSP: 002b:00000000f544555c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 1373.379543][T21651] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 0000000080015b12 [ 1373.379555][T21651] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1373.379567][T21651] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1373.379577][T21651] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1373.379587][T21651] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1373.379613][T21651] [ 1373.379622][T21651] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1373.408916][T15575] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1373.535940][T21651] usbtmc 1-1:16.0: control status returned 0 [ 1373.711295][ T106] usb 10-1: Using ep0 maxpacket: 16 [ 1373.721716][ T106] usb 10-1: New USB device found, idVendor=0471, idProduct=0327, bcdDevice=61.a4 [ 1373.734443][ T106] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1373.737748][ T7239] usb 1-1: USB disconnect, device number 77 [ 1373.758426][ T106] usb 10-1: config 0 descriptor?? [ 1373.807990][ T106] gspca_main: sonixj-2.14.0 probing 0471:0327 [ 1374.030326][ T3518] bridge_slave_1: left allmulticast mode [ 1374.048320][ T3518] bridge_slave_1: left promiscuous mode [ 1374.064236][ T3518] bridge0: port 2(bridge_slave_1) entered disabled state [ 1374.076159][ T3518] bridge_slave_0: left allmulticast mode [ 1374.082974][ T3518] bridge_slave_0: left promiscuous mode [ 1374.090067][ T3518] bridge0: port 1(bridge_slave_0) entered disabled state [ 1374.108063][ T3518] bridge_slave_1: left allmulticast mode [ 1374.117911][ T3518] bridge_slave_1: left promiscuous mode [ 1374.126599][ T3518] bridge0: port 2(bridge_slave_1) entered disabled state [ 1374.136708][ T3518] bridge_slave_0: left allmulticast mode [ 1374.142453][ T3518] bridge_slave_0: left promiscuous mode [ 1374.149128][ T3518] bridge0: port 1(bridge_slave_0) entered disabled state [ 1374.161615][ T3518] batman_adv: batadv0: Interface deactivated: ip6gretap1 [ 1374.472473][ T3518] batman_adv: batadv0: Removing interface: ip6gretap1 [ 1374.656684][ T3518] erspan0 (unregistering): left promiscuous mode [ 1374.711497][ T3518] gretap0 (unregistering): left promiscuous mode [ 1374.735599][T21723] netlink: 12 bytes leftover after parsing attributes in process `syz.0.6046'. [ 1375.022007][T21730] netlink: 4 bytes leftover after parsing attributes in process `syz.8.6047'. [ 1375.034958][ T106] gspca_sonixj: reg_r err -110 [ 1375.054627][ T106] sonixj 10-1:0.0: probe with driver sonixj failed with error -110 [ 1375.155099][ T3518] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1375.169522][ T3518] bond0 (unregistering): (slave dummy0): Releasing backup interface [ 1375.179585][ T3518] bond0 (unregistering): Released all slaves [ 1375.719251][ T3518] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1375.732225][ T3518] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1375.742509][ T3518] bond0 (unregistering): Released all slaves [ 1375.756001][ T3518] bond1 (unregistering): Released all slaves [ 1375.842863][T21725] netlink: 'syz.0.6046': attribute type 1 has an invalid length. [ 1375.871387][ T3518] tipc: Disabling bearer [ 1375.894267][ T3518] tipc: Left network mode [ 1376.043522][ T3518] tipc: Left network mode [ 1376.059106][T27910] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1376.101750][T27910] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1376.159221][ T24] usb 10-1: USB disconnect, device number 5 [ 1376.286131][T21767] netlink: 28 bytes leftover after parsing attributes in process `syz.8.6049'. [ 1376.318416][T21206] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1376.326758][T21206] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1376.432196][ T3518] mac80211_hwsim hwsim38 wlan0 (unregistering): left allmulticast mode [ 1376.433687][T19145] usb 1-1: new high-speed USB device number 78 using dummy_hcd [ 1376.603723][T19145] usb 1-1: Using ep0 maxpacket: 16 [ 1376.603974][ T24] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 1376.622729][T19145] usb 1-1: New USB device found, idVendor=06b9, idProduct=4061, bcdDevice= 1.88 [ 1376.641202][T19145] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1376.670106][T19145] usb 1-1: Product: syz [ 1376.675688][T19145] usb 1-1: Manufacturer: syz [ 1376.680543][T19145] usb 1-1: SerialNumber: syz [ 1376.696135][T19145] usb 1-1: config 0 descriptor?? [ 1376.743436][T19158] usb 9-1: new full-speed USB device number 11 using dummy_hcd [ 1376.765133][ T24] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1376.797013][ T24] usb 10-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 1376.807477][T21794] tipc: Started in network mode [ 1376.812383][T21794] tipc: Node identity fec700e52852, cluster identity 4711 [ 1376.823171][ T24] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1376.842494][ T24] usb 10-1: Product: syz [ 1376.856926][ T24] usb 10-1: Manufacturer: syz [ 1376.861778][ T24] usb 10-1: SerialNumber: syz [ 1376.873695][T21794] tipc: Enabled bearer , priority 0 [ 1376.885038][ T24] usb 10-1: config 0 descriptor?? [ 1376.904858][ T24] ims_pcu 10-1:0.0: Union descriptor too short (2 vs 5) [ 1376.907339][T19158] usb 9-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1376.911901][ T24] ims_pcu 10-1:0.0: probe with driver ims_pcu failed with error -22 [ 1376.967382][T19158] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1376.982221][T21755] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1377.000667][T21755] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1377.031626][T19158] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1377.046292][T19158] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1377.058894][T19145] speedtch 1-1:0.0: speedtch_bind: data interface not found! [ 1377.066982][T19145] speedtch 1-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1377.075555][T19158] usb 9-1: Product: syz [ 1377.075842][T21787] tipc: Resetting bearer [ 1377.080014][T19158] usb 9-1: Manufacturer: syz [ 1377.099629][T19158] usb 9-1: SerialNumber: syz [ 1377.222858][T21765] netlink: 4 bytes leftover after parsing attributes in process `syz.9.6050'. [ 1377.310396][T21823] netlink: 'syz.9.6050': attribute type 1 has an invalid length. [ 1377.364822][T19145] usb 1-1: USB disconnect, device number 78 [ 1377.534794][T21839] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1377.551096][T21839] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1381.050062][T21787] tipc: Disabling bearer [ 1381.079651][T21774] tipc: Enabled bearer , priority 0 [ 1381.091189][T21823] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1381.092189][T21776] syzkaller0: entered promiscuous mode [ 1381.107449][T21776] syzkaller0: entered allmulticast mode [ 1381.175132][T21837] workqueue: Failed to create a rescuer kthread for wq "bond1": -EINTR [ 1381.211373][T19145] tipc: Node number set to 3600089317 [ 1381.318136][T19145] usb 10-1: USB disconnect, device number 6 [ 1381.370001][T19158] usb 9-1: 0:2 : does not exist [ 1381.401656][ T3518] hsr_slave_0: left promiscuous mode [ 1381.404619][T19158] usb 9-1: 5:0: failed to get current value for ch 0 (-22) [ 1381.450066][T19158] usb 9-1: USB disconnect, device number 11 [ 1381.456241][ T3518] hsr_slave_1: left promiscuous mode [ 1381.457062][ T3518] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1381.493022][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1381.566169][ T3518] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1381.600373][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1381.631450][ T3518] hsr_slave_0: left promiscuous mode [ 1381.641578][ T3518] hsr_slave_1: left promiscuous mode [ 1381.650747][ T3518] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1381.661055][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1381.677465][ T3518] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1381.686316][ T3518] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1381.729384][T21913] netlink: 12 bytes leftover after parsing attributes in process `syz.1.6060'. [ 1381.747771][ T3518] veth0_macvtap: left promiscuous mode [ 1381.753624][ T3518] veth1_vlan: left promiscuous mode [ 1381.763376][T14512] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 1381.773072][ T3518] veth1_macvtap: left promiscuous mode [ 1381.786022][ T3518] veth0_macvtap: left promiscuous mode [ 1381.792146][ T3518] veth1_vlan: left promiscuous mode [ 1381.802331][ T3518] veth0_vlan: left promiscuous mode [ 1381.936812][T14512] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 1381.948466][T14512] usb 10-1: config 0 has no interface number 0 [ 1381.969886][T14512] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1381.995858][T14512] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1382.019319][T14512] usb 10-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1382.049357][T14512] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1382.079332][T14512] usb 10-1: config 0 descriptor?? [ 1383.323546][T19158] usb 2-1: new high-speed USB device number 41 using dummy_hcd [ 1383.473308][T19158] usb 2-1: Using ep0 maxpacket: 32 [ 1383.480385][T19158] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1383.495487][T19158] usb 2-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1383.520068][T19158] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1383.539116][T19158] usb 2-1: Product: syz [ 1383.549854][T19158] usb 2-1: Manufacturer: syz [ 1383.561059][T19158] usb 2-1: SerialNumber: syz [ 1383.636376][T19158] usb 2-1: config 0 descriptor?? [ 1383.729789][T19158] usb 2-1: bad CDC descriptors [ 1383.736192][T19158] usb 2-1: unsupported MDLM descriptors [ 1384.373657][T20686] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 1384.613400][T20686] usb 1-1: Using ep0 maxpacket: 32 [ 1384.750626][T20686] usb 1-1: New USB device found, idVendor=1964, idProduct=0001, bcdDevice=d4.15 [ 1384.760395][T20686] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1384.768868][T20686] usb 1-1: Product: syz [ 1384.773073][T20686] usb 1-1: Manufacturer: syz [ 1384.778502][T20686] usb 1-1: SerialNumber: syz [ 1384.805398][T20686] usb 1-1: config 0 descriptor?? [ 1385.080090][ T3518] team0 (unregistering): Port device team_slave_1 removed [ 1385.209556][T20686] RobotFuzz Open Source InterFace, OSIF 1-1:0.0: version d4.15 found at bus 001 address 079 [ 1385.210285][ T3518] team0 (unregistering): Port device team_slave_0 removed [ 1386.498284][T20686] usb 1-1: USB disconnect, device number 79 [ 1386.769474][ T30] audit: type=1326 audit(1767218197.154:3736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1386.829220][ T30] audit: type=1326 audit(1767218197.154:3737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=14 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1386.853782][ T30] audit: type=1326 audit(1767218197.154:3738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1386.946019][ T30] audit: type=1326 audit(1767218197.154:3739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1386.972520][ T30] audit: type=1326 audit(1767218197.154:3740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1387.060579][ T30] audit: type=1326 audit(1767218197.154:3741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1387.109567][ T30] audit: type=1326 audit(1767218197.154:3742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=21 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1387.176118][ T30] audit: type=1326 audit(1767218197.154:3743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1387.229935][ T30] audit: type=1326 audit(1767218197.164:3744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1387.291270][ T30] audit: type=1326 audit(1767218197.164:3745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=21957 comm="syz.0.6066" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1387.331303][ T3518] team0 (unregistering): Port device team_slave_1 removed [ 1387.426099][ T3518] team0 (unregistering): Port device team_slave_0 removed [ 1387.739249][T14512] usbhid 10-1:0.1: can't add hid device: -32 [ 1387.745492][T14512] usbhid 10-1:0.1: probe with driver usbhid failed with error -32 [ 1388.361228][T21838] tipc: Resetting bearer [ 1388.385103][T21838] tipc: Disabling bearer [ 1388.469599][T19145] usb 2-1: USB disconnect, device number 41 [ 1388.666683][T20686] usb 10-1: USB disconnect, device number 7 [ 1389.223038][T22010] netem: unknown loss type 0 [ 1389.333576][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 1389.453430][ T5918] usb 10-1: new full-speed USB device number 8 using dummy_hcd [ 1389.563431][T21677] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 1389.723937][ T5918] usb 10-1: New USB device found, idVendor=09c0, idProduct=0203, bcdDevice=d3.43 [ 1389.762595][T22027] A link change request failed with some changes committed already. Interface bond_slave_0 may have been left with an inconsistent configuration, please check. [ 1389.789576][ T5918] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1389.810814][T21677] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1389.823814][ T5918] usb 10-1: config 0 descriptor?? [ 1389.851738][ T5918] dvb-usb: found a 'Genpix SkyWalker-1 DVB-S receiver' in warm state. [ 1389.869405][T21677] usb 2-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1389.967418][T21677] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1390.169529][T21677] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1390.440251][ T5918] gp8psk: usb in 128 operation failed. [ 1390.450791][T21677] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1390.567436][T22015] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1390.579756][T22015] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1391.043438][T19158] usb 9-1: new high-speed USB device number 12 using dummy_hcd [ 1391.076376][T21677] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1391.263328][T19158] usb 9-1: Using ep0 maxpacket: 32 [ 1391.283567][T19158] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1391.300779][T19158] usb 9-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1391.311312][T19158] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1391.322066][T19158] usb 9-1: Product: syz [ 1391.328058][T19158] usb 9-1: Manufacturer: syz [ 1391.352269][T19158] usb 9-1: SerialNumber: syz [ 1391.395534][T22062] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6079'. [ 1391.408479][T19158] usb 9-1: config 0 descriptor?? [ 1391.441468][T19158] usb 9-1: bad CDC descriptors [ 1391.461386][T19158] usb 9-1: unsupported MDLM descriptors [ 1391.658609][T19158] usb 9-1: USB disconnect, device number 12 [ 1391.978611][T22081] tipc: Enabled bearer , priority 10 [ 1392.159897][ T5918] gp8psk: usb in 137 operation failed. [ 1392.165476][ T5918] dvb-usb: This USB2.0 device cannot be run on a USB1.1 port. (it lacks a hardware PID filter) [ 1392.257145][ T30] kauditd_printk_skb: 13 callbacks suppressed [ 1392.257164][ T30] audit: type=1326 audit(1767218202.644:3759): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1392.300794][ T5957] usb 2-1: USB disconnect, device number 42 [ 1392.317175][ T5918] dvb-usb: Genpix SkyWalker-1 DVB-S receiver error while loading driver (-19) [ 1392.373522][ T5918] usb 10-1: USB disconnect, device number 8 [ 1392.397569][ T30] audit: type=1326 audit(1767218202.644:3760): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=14 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1392.491538][ T30] audit: type=1326 audit(1767218202.644:3761): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1392.592885][ T30] audit: type=1326 audit(1767218202.644:3762): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1392.708112][ T30] audit: type=1326 audit(1767218202.644:3763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1392.823411][ T5918] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 1392.835766][ T30] audit: type=1326 audit(1767218202.644:3764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=21 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1392.899199][ T30] audit: type=1326 audit(1767218202.644:3765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1393.045054][ T30] audit: type=1326 audit(1767218202.644:3766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1393.067617][ T30] audit: type=1326 audit(1767218202.644:3767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1393.090472][ T30] audit: type=1326 audit(1767218202.654:3768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=22076 comm="syz.7.6080" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf709d539 code=0x7ffc0000 [ 1393.126759][ T5918] usb 10-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1393.138271][ T5918] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1393.148466][ T5918] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1393.183839][ T5918] usb 10-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1393.242687][ T5918] usb 10-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1393.251083][ T5918] usb 10-1: Manufacturer: syz [ 1393.263598][ T5918] usb 10-1: config 0 descriptor?? [ 1393.272607][ T5918] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 1393.683598][ T5918] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 1393.855349][ T5918] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1393.867256][ T5918] usb 2-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1393.878282][ T5918] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1394.018762][ T5918] usb 2-1: config 0 descriptor?? [ 1394.048472][ T5918] pwc: Askey VC010 type 2 USB webcam detected. [ 1394.442017][ T5918] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1394.541200][T22177] loop5: detected capacity change from 0 to 1407 [ 1394.811676][T22188] netlink: 'syz.1.6087': attribute type 7 has an invalid length. [ 1395.029236][T22185] tipc: Enabled bearer , priority 0 [ 1395.134136][T22178] tipc: Resetting bearer [ 1395.622703][ T5957] usb 10-1: USB disconnect, device number 9 [ 1396.291558][T22224] netlink: 44 bytes leftover after parsing attributes in process `syz.9.6096'. [ 1396.316373][T22224] netlink: 31 bytes leftover after parsing attributes in process `syz.9.6096'. [ 1396.349566][T22224] netlink: 'syz.9.6096': attribute type 6 has an invalid length. [ 1396.375288][T22224] netlink: 'syz.9.6096': attribute type 5 has an invalid length. [ 1396.391695][T22224] netlink: 31 bytes leftover after parsing attributes in process `syz.9.6096'. [ 1396.624523][ T5918] pwc: recv_control_msg error -71 req 02 val 2c00 [ 1396.649026][ T5918] pwc: recv_control_msg error -71 req 04 val 1000 [ 1396.655613][T19158] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 1396.667018][ T5918] pwc: recv_control_msg error -71 req 04 val 1300 [ 1396.706666][ T5918] pwc: recv_control_msg error -71 req 04 val 1400 [ 1396.726496][ T5918] pwc: recv_control_msg error -71 req 02 val 2000 [ 1396.739589][ T5918] pwc: recv_control_msg error -71 req 02 val 2100 [ 1396.777222][ T5918] pwc: recv_control_msg error -71 req 04 val 1500 [ 1396.790702][ T5918] pwc: recv_control_msg error -71 req 02 val 2500 [ 1396.817119][ T5918] pwc: recv_control_msg error -71 req 02 val 2400 [ 1396.833415][T19158] usb 9-1: Using ep0 maxpacket: 32 [ 1396.841496][ T5918] pwc: recv_control_msg error -71 req 02 val 2600 [ 1396.866678][T19158] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1396.884160][ T5918] pwc: recv_control_msg error -71 req 02 val 2900 [ 1396.892984][T19158] usb 9-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1396.903726][ T5918] pwc: recv_control_msg error -71 req 02 val 2800 [ 1396.910408][T19158] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1396.921039][ T5918] pwc: recv_control_msg error -71 req 04 val 1100 [ 1396.940122][T22242] program syz.1.6097 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1396.981193][T19158] usb 9-1: Product: syz [ 1396.985657][ T5918] pwc: recv_control_msg error -71 req 04 val 1200 [ 1396.997436][T19158] usb 9-1: Manufacturer: syz [ 1397.002073][T19158] usb 9-1: SerialNumber: syz [ 1397.060759][ T5918] pwc: Registered as video103. [ 1397.126234][ T5918] input: PWC snapshot button as /devices/platform/dummy_hcd.1/usb2/2-1/input/input92 [ 1397.184135][T19158] usb 9-1: config 0 descriptor?? [ 1397.209998][T19158] usb 9-1: bad CDC descriptors [ 1397.227764][T19158] usb 9-1: unsupported MDLM descriptors [ 1397.236772][ T5918] usb 2-1: USB disconnect, device number 43 [ 1401.539070][T22178] tipc: Disabling bearer [ 1401.635505][T22298] syz_tun: entered allmulticast mode [ 1401.668748][T14512] usb 9-1: USB disconnect, device number 13 [ 1401.822536][T22328] netlink: 4 bytes leftover after parsing attributes in process `syz.8.6108'. [ 1401.871350][T22299] dvmrp6: entered allmulticast mode [ 1402.993523][ T24] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 1403.173476][ T24] usb 2-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1403.324180][ T24] usb 2-1: config 27 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1403.384772][T14512] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 1403.419881][ T24] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1403.453323][ T24] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1403.573501][T14512] usb 10-1: Using ep0 maxpacket: 16 [ 1403.590434][ T24] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1403.630197][T14512] usb 10-1: config 0 has an invalid interface number: 8 but max is 0 [ 1403.655252][T14512] usb 10-1: config 0 has no interface number 0 [ 1403.725474][T14512] usb 10-1: config 0 interface 8 altsetting 0 endpoint 0x8C has an invalid bInterval 0, changing to 7 [ 1403.757860][T14512] usb 10-1: config 0 interface 8 altsetting 0 endpoint 0x8C has invalid wMaxPacketSize 0 [ 1403.768812][ T24] snd-usb-audio 2-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1403.820086][T22378] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1403.840923][T14512] usb 10-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1403.903667][T22378] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1403.915053][T14512] usb 10-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1403.947509][T14512] usb 10-1: Product: syz [ 1403.951898][T14512] usb 10-1: SerialNumber: syz [ 1404.004962][T14512] usb 10-1: config 0 descriptor?? [ 1404.159812][T14512] cm109 10-1:0.8: invalid payload size 0, expected 4 [ 1404.200820][T14512] input: CM109 USB driver as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.8/input/input93 [ 1404.227988][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: usb_submit_urb (urb_irq) failed -90 [ 1404.463492][T19158] usb 1-1: new high-speed USB device number 80 using dummy_hcd [ 1404.854313][T22462] netlink: 64 bytes leftover after parsing attributes in process `syz.7.6123'. [ 1404.903323][T19158] usb 1-1: Using ep0 maxpacket: 32 [ 1404.911850][T19158] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1404.925419][T19158] usb 1-1: New USB device found, idVendor=22b8, idProduct=6027, bcdDevice=c2.80 [ 1404.947518][T19158] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1405.013920][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.015352][T19158] usb 1-1: Product: syz [ 1405.024863][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.033343][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.040638][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.047919][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.055381][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.062668][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.070046][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.077410][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.085135][ C1] cm109 10-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1405.151634][T19145] usb 10-1: USB disconnect, device number 10 [ 1405.151791][ C1] cm109 10-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1405.259109][T19145] cm109 10-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1405.293278][T19158] usb 1-1: Manufacturer: syz [ 1405.300441][T19158] usb 1-1: SerialNumber: syz [ 1405.319236][T19158] usb 1-1: config 0 descriptor?? [ 1405.330900][T19158] usb 1-1: bad CDC descriptors [ 1405.339142][T19158] usb 1-1: unsupported MDLM descriptors [ 1405.485017][T19158] usb 2-1: USB disconnect, device number 44 [ 1405.558719][ T5918] usb 1-1: USB disconnect, device number 80 [ 1406.554685][T22519] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1406.561968][T22519] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1406.680885][T22519] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1406.688503][T22519] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1406.732532][T22519] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1406.742059][T22519] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1406.779018][T22519] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1406.807513][T22519] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1406.813805][T22519] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1406.825409][T22519] Bluetooth: hci6: Opcode 0x0406 failed: -4 [ 1406.883425][T22519] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1406.889724][T22519] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 1406.907256][T22519] Bluetooth: hci7: Opcode 0x0406 failed: -4 [ 1407.901950][T22519] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 1407.909728][T22519] Bluetooth: hci8: Opcode 0x0406 failed: -4 [ 1408.240694][T22614] tipc: Enabling of bearer rejected, failed to enable media [ 1408.352473][T22519] Bluetooth: hci8: Opcode 0x0406 failed: -4 [ 1408.616288][ T5831] Bluetooth: hci3: command 0x0406 tx timeout [ 1408.843612][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 1408.849790][ T52] Bluetooth: hci0: command 0x0c1a tx timeout [ 1408.856217][ T5831] Bluetooth: hci6: command 0x0c1a tx timeout [ 1408.943466][ T6176] Bluetooth: hci7: command 0x0c1a tx timeout [ 1409.121636][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.149919][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.243501][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.264090][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.288378][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.313126][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.345636][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.381265][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.417654][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.454056][T19158] hid-generic 0000:0000:0000.0045: unknown main item tag 0x0 [ 1409.490732][T19158] hid-generic 0000:0000:0000.0045: hidraw0: HID v0.03 Device [syz1] on syz1 [ 1409.964095][ T6176] Bluetooth: hci8: command 0x0c1a tx timeout [ 1410.405947][T19158] usb 1-1: new high-speed USB device number 81 using dummy_hcd [ 1410.575946][T19158] usb 1-1: Using ep0 maxpacket: 8 [ 1410.687599][ T6176] Bluetooth: hci3: command 0x0406 tx timeout [ 1410.698503][T19158] usb 1-1: config 0 has an invalid interface number: 52 but max is 0 [ 1410.714688][T19158] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1410.801885][T19158] usb 1-1: config 0 has no interface number 0 [ 1410.823310][T19158] usb 1-1: config 0 interface 52 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1410.854325][T19158] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1410.886907][T19158] usb 1-1: config 0 interface 52 altsetting 1 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1410.924219][ T52] Bluetooth: hci5: command 0x0406 tx timeout [ 1410.930305][ T5831] Bluetooth: hci0: command 0x0c1a tx timeout [ 1410.932413][T19158] usb 1-1: config 0 interface 52 altsetting 1 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1410.936553][ T6176] Bluetooth: hci6: command 0x0c1a tx timeout [ 1411.003500][ T5831] Bluetooth: hci7: command 0x0c1a tx timeout [ 1411.056902][T19158] usb 1-1: config 0 interface 52 has no altsetting 0 [ 1411.103539][T19158] usb 1-1: New USB device found, idVendor=06cb, idProduct=0007, bcdDevice= 8.00 [ 1411.112703][T19158] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1411.187764][T19158] usb 1-1: config 0 descriptor?? [ 1411.427237][T19158] input: USB Synaptics Device 06cb:0007 (Stick) as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.52/input/input94 [ 1411.682840][ T24] usb 1-1: USB disconnect, device number 81 [ 1411.702117][ T5185] synaptics_usb 1-1:0.52: synusb_open - usb_submit_urb failed, error: -19 [ 1412.046816][ T5831] Bluetooth: hci8: command 0x0c1a tx timeout [ 1413.000148][T22768] syz_tun: entered promiscuous mode [ 1413.005623][ T6176] Bluetooth: hci6: command 0x0c1a tx timeout [ 1413.011677][ T5831] Bluetooth: hci0: command 0x0c1a tx timeout [ 1413.084237][ T5831] Bluetooth: hci7: command 0x0c1a tx timeout [ 1413.091357][T22768] syz_tun: left promiscuous mode [ 1413.176986][T22778] netlink: 12 bytes leftover after parsing attributes in process `syz.7.6155'. [ 1413.240807][T22777] bridge3: entered promiscuous mode [ 1413.292648][T22777] bridge3: entered allmulticast mode [ 1413.323554][T22777] team0: Port device bridge3 added [ 1413.411000][T22791] netlink: 'syz.7.6157': attribute type 8 has an invalid length. [ 1414.125827][ T5831] Bluetooth: hci8: command 0x0c1a tx timeout [ 1415.814821][T14512] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 1415.823312][T19158] usb 2-1: new full-speed USB device number 45 using dummy_hcd [ 1415.974929][T14512] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1415.995513][T14512] usb 9-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1416.009111][T14512] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1416.018807][T14512] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1416.025170][T19158] usb 2-1: config 64 has an invalid interface number: 24 but max is 0 [ 1416.027083][T14512] usb 9-1: Product: syz [ 1416.039731][T14512] usb 9-1: Manufacturer: syz [ 1416.044365][T19158] usb 2-1: config 64 has an invalid descriptor of length 0, skipping remainder of the config [ 1416.044390][T19158] usb 2-1: config 64 has no interface number 0 [ 1416.055697][T14512] usb 9-1: SerialNumber: syz [ 1416.075015][T14512] cdc_mbim 9-1:1.0: skipping garbage [ 1416.083319][T19158] usb 2-1: New USB device found, idVendor=0742, idProduct=200a, bcdDevice=d2.ff [ 1416.103409][T19158] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1416.274208][T22844] raw-gadget.3 gadget.8: fail, usb_ep_enable returned -22 [ 1416.328098][T22851] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1416.344201][T22851] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1416.553001][T22880] netlink: 'syz.9.6171': attribute type 11 has an invalid length. [ 1416.572413][T22880] netlink: 190972 bytes leftover after parsing attributes in process `syz.9.6171'. [ 1416.971346][T22844] raw-gadget.3 gadget.8: fail, usb_ep_enable returned -22 [ 1416.986333][T14512] cdc_mbim 9-1:1.0: setting tx_max = 16384 [ 1417.012460][T14512] cdc_mbim 9-1:1.0: cdc-wdm0: USB WDM device [ 1417.073503][T14512] wwan wwan0: port wwan0mbim0 attached [ 1417.152276][T14512] cdc_mbim 9-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.8-1, CDC MBIM, e2:af:6b:9a:40:8a [ 1417.225866][T14512] usb 9-1: USB disconnect, device number 14 [ 1417.259954][T14512] cdc_mbim 9-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.8-1, CDC MBIM [ 1417.489407][T14512] wwan wwan0: port wwan0mbim0 disconnected [ 1418.045444][T14512] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 1418.216101][T14512] usb 9-1: config 0 has no interfaces? [ 1418.242546][T14512] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1418.260749][T14512] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1418.282793][T14512] usb 9-1: config 0 descriptor?? [ 1418.479426][T19158] usb 2-1: string descriptor 0 read error: -71 [ 1418.501979][T19158] HFC-S_USB 2-1:64.24: probe with driver HFC-S_USB failed with error -5 [ 1418.543473][T19158] usb 2-1: USB disconnect, device number 45 [ 1418.565977][T22922] program syz.8.6175 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1418.753668][T22922] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1418.776091][T22922] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1418.836276][T14512] usb 9-1: USB disconnect, device number 15 [ 1418.964562][T22978] netdevsim netdevsim1 netdevsim0: entered promiscuous mode [ 1418.990891][T22978] netdevsim netdevsim1 netdevsim0: left promiscuous mode [ 1419.665750][T22999] gtp0: entered promiscuous mode [ 1419.670816][T22999] gtp0: entered allmulticast mode [ 1420.461578][ T30] kauditd_printk_skb: 59 callbacks suppressed [ 1420.461596][ T30] audit: type=1326 audit(1767218230.864:3828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1420.821875][ T30] audit: type=1326 audit(1767218230.864:3829): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1420.847886][ T30] audit: type=1326 audit(1767218230.864:3830): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1420.875794][ T30] audit: type=1326 audit(1767218230.864:3831): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1420.899716][ T30] audit: type=1326 audit(1767218230.864:3832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1420.930370][ T30] audit: type=1326 audit(1767218230.874:3833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1421.023359][ T30] audit: type=1326 audit(1767218230.874:3834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1421.078799][ T30] audit: type=1326 audit(1767218230.874:3835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1421.101055][ T7239] usb 1-1: new high-speed USB device number 82 using dummy_hcd [ 1421.149802][ T30] audit: type=1326 audit(1767218230.874:3836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1421.213803][ T30] audit: type=1326 audit(1767218230.874:3837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=23031 comm="syz.0.6190" exe="/root/syz-executor" sig=0 arch=40000003 syscall=146 compat=1 ip=0xf7f72539 code=0x7ffc0000 [ 1421.244668][ T7239] usb 1-1: device descriptor read/64, error -71 [ 1421.373995][T19145] usb 2-1: new full-speed USB device number 46 using dummy_hcd [ 1421.493350][ T7239] usb 1-1: new high-speed USB device number 83 using dummy_hcd [ 1421.525661][T19145] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1421.535993][T19145] usb 2-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1421.546366][T19145] usb 2-1: New USB device found, idVendor=05d8, idProduct=810a, bcdDevice=92.b8 [ 1421.555514][T19145] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1421.566181][T19145] usb 2-1: config 0 descriptor?? [ 1421.579499][T19145] dvb-usb: found a 'Artec T1 USB2.0' in warm state. [ 1421.588348][T19145] dvb-usb: bulk message failed: -22 (3/0) [ 1421.598131][T19145] dvb-usb: will use the device's hardware PID filter (table count: 16). [ 1421.607245][T19145] dvbdev: DVB: registering new adapter (Artec T1 USB2.0) [ 1421.615670][T19145] usb 2-1: media controller created [ 1421.621888][T19145] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1421.630635][ T7239] usb 1-1: device descriptor read/64, error -71 [ 1421.641525][T19145] dvb-usb: bulk message failed: -22 (6/0) [ 1421.647700][T19145] dvb-usb: no frontend was attached by 'Artec T1 USB2.0' [ 1421.659238][T19145] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.1/usb2/2-1/input/input95 [ 1421.673941][T19145] dvb-usb: schedule remote query interval to 150 msecs. [ 1421.680934][T19145] dvb-usb: Artec T1 USB2.0 successfully initialized and connected. [ 1421.754592][ T7239] usb usb1-port1: attempt power cycle [ 1421.837000][T19145] dvb-usb: bulk message failed: -22 (1/0) [ 1421.847081][T19145] dvb-usb: error while querying for an remote control event. [ 1422.015028][T19145] dvb-usb: bulk message failed: -22 (1/0) [ 1422.024617][T19145] dvb-usb: error while querying for an remote control event. [ 1422.093383][ T7239] usb 1-1: new high-speed USB device number 84 using dummy_hcd [ 1422.114507][ T7239] usb 1-1: device descriptor read/8, error -71 [ 1422.183408][T19145] dvb-usb: bulk message failed: -22 (1/0) [ 1422.189279][T19145] dvb-usb: error while querying for an remote control event. [ 1422.353423][ T7239] usb 1-1: new high-speed USB device number 85 using dummy_hcd [ 1422.362352][T19145] dvb-usb: bulk message failed: -22 (1/0) [ 1422.369741][T19145] dvb-usb: error while querying for an remote control event. [ 1422.384579][ T7239] usb 1-1: device descriptor read/8, error -71 [ 1422.458965][ T5892] usb 2-1: USB disconnect, device number 46 [ 1422.498213][ T5892] dvb-usb: Artec T1 USB2.0 successfully deinitialized and disconnected. [ 1422.510000][ T7239] usb usb1-port1: unable to enumerate USB device [ 1423.091199][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1423.103482][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1423.198187][T23097] sctp: [Deprecated]: syz.8.6196 (pid 23097) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1423.198187][T23097] Use struct sctp_sack_info instead [ 1423.236446][T23102] Invalid option length (436) for dns_resolver key [ 1423.306505][T23104] tipc: Enabled bearer , priority 0 [ 1423.315091][T23104] syzkaller0: entered promiscuous mode [ 1423.320874][T23104] syzkaller0: entered allmulticast mode [ 1423.347977][T23104] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 1423.378569][T23104] tipc: Resetting bearer [ 1423.398060][T23103] tipc: Resetting bearer [ 1423.427303][T23103] tipc: Disabling bearer [ 1423.463456][ T106] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 1423.623597][ T106] usb 9-1: device descriptor read/64, error -71 [ 1423.703497][T23122] kAFS: unable to lookup cell 'Þ({^ú@' [ 1423.973313][ T106] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 1424.137042][ T106] usb 9-1: device descriptor read/64, error -71 [ 1424.265491][ T106] usb usb9-port1: attempt power cycle [ 1424.633394][ T106] usb 9-1: new high-speed USB device number 18 using dummy_hcd [ 1424.913510][ T106] usb 9-1: device descriptor read/8, error -71 [ 1425.177641][ T106] usb 9-1: new high-speed USB device number 19 using dummy_hcd [ 1425.234059][T23142] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1425.243821][T23142] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1425.253650][T23142] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1425.279331][T23142] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1425.293892][T23142] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1425.303681][T23142] Bluetooth: hci8: Opcode 0x0c1a failed: -4 [ 1425.323176][ T106] usb 9-1: device descriptor read/8, error -71 [ 1425.443593][ T106] usb usb9-port1: unable to enumerate USB device [ 1425.632235][T19145] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 1425.802700][T19145] usb 10-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 1425.826015][T19145] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1425.857767][T19145] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1425.879341][T19145] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 1425.911737][T19145] usb 10-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 1425.929370][T19145] usb 10-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 1425.947548][T19145] usb 10-1: Manufacturer: syz [ 1425.977406][T19145] usb 10-1: config 0 descriptor?? [ 1426.408760][ C0] raw-gadget.2 gadget.9: ignoring, device is not running [ 1426.421006][ C0] raw-gadget.2 gadget.9: ignoring, device is not running [ 1426.428388][T19145] usbhid 10-1:0.0: can't add hid device: -32 [ 1426.439157][T19145] usbhid 10-1:0.0: probe with driver usbhid failed with error -32 [ 1426.468945][T19145] usb 10-1: USB disconnect, device number 11 [ 1427.133439][T21677] usb 1-1: new low-speed USB device number 86 using dummy_hcd [ 1427.303321][T21677] usb 1-1: Invalid ep0 maxpacket: 64 [ 1427.329634][ T6176] Bluetooth: hci7: command 0x0c1a tx timeout [ 1427.329654][ T5831] Bluetooth: hci6: command 0x0c1a tx timeout [ 1427.329681][ T52] Bluetooth: hci8: command 0x0c1a tx timeout [ 1427.336271][ T5831] Bluetooth: hci0: command 0x0c1a tx timeout [ 1427.353365][ T5831] Bluetooth: hci5: command 0x0406 tx timeout [ 1427.354077][ T52] Bluetooth: hci3: command 0x0406 tx timeout [ 1427.443378][T21677] usb 1-1: new low-speed USB device number 87 using dummy_hcd [ 1427.533387][T19145] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 1427.613358][T21677] usb 1-1: Invalid ep0 maxpacket: 64 [ 1427.627794][T21677] usb usb1-port1: attempt power cycle [ 1427.700670][T19145] usb 10-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1427.716535][T19145] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1427.742827][T19145] usb 10-1: Product: syz [ 1427.758161][T19145] usb 10-1: Manufacturer: syz [ 1427.762987][T19145] usb 10-1: SerialNumber: syz [ 1427.789316][T19145] hub 10-1:24.0: bad descriptor, ignoring hub [ 1427.799364][T19145] hub 10-1:24.0: probe with driver hub failed with error -5 [ 1427.813353][T19158] usb 2-1: new high-speed USB device number 47 using dummy_hcd [ 1427.963437][T19158] usb 2-1: Using ep0 maxpacket: 8 [ 1427.974035][T19158] usb 2-1: no configurations [ 1427.983482][T21677] usb 1-1: new low-speed USB device number 88 using dummy_hcd [ 1427.986923][T19158] usb 2-1: can't read configurations, error -22 [ 1427.998084][T19145] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 1428.014152][T21677] usb 1-1: Invalid ep0 maxpacket: 64 [ 1428.017158][T19145] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1428.031821][T19145] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 1428.049665][T19145] usb 10-1: media controller created [ 1428.072283][T19145] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1428.140081][T19145] DVB: Unable to find symbol dib7000p_attach() [ 1428.147859][T19145] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 1428.158720][T19158] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 1428.163696][T21677] usb 1-1: new low-speed USB device number 89 using dummy_hcd [ 1428.216720][T21677] usb 1-1: Invalid ep0 maxpacket: 64 [ 1428.228988][T21677] usb usb1-port1: unable to enumerate USB device [ 1428.274225][T19145] rc_core: IR keymap rc-dib0700-rc5 not found [ 1428.280631][T19145] Registered IR keymap rc-empty [ 1428.287570][T19145] dvb-usb: could not initialize remote control. [ 1428.306149][T19145] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 1428.323400][T19158] usb 2-1: Using ep0 maxpacket: 8 [ 1428.330534][T19158] usb 2-1: no configurations [ 1428.338028][T19145] usb 10-1: USB disconnect, device number 12 [ 1428.345754][T19158] usb 2-1: can't read configurations, error -22 [ 1428.356219][T19158] usb usb2-port1: attempt power cycle [ 1428.406266][T19145] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 1428.697610][T19158] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 1428.740545][T23281] tipc: Enabled bearer , priority 0 [ 1428.745528][T19158] usb 2-1: Using ep0 maxpacket: 8 [ 1428.765173][T19145] usb 10-1: new high-speed USB device number 13 using dummy_hcd [ 1428.773755][T19158] usb 2-1: no configurations [ 1428.776510][T23281] syzkaller0: entered promiscuous mode [ 1428.778382][T19158] usb 2-1: can't read configurations, error -22 [ 1428.793551][T23281] syzkaller0: entered allmulticast mode [ 1428.844811][T23281] syzkaller0: mtu greater than device maximum [ 1428.852289][T23280] tipc: Resetting bearer [ 1428.889868][T23280] tipc: Disabling bearer [ 1428.940780][T19145] usb 10-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 1428.963468][T19158] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 1428.983348][T19145] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1428.991473][T19145] usb 10-1: Product: syz [ 1429.007333][T19158] usb 2-1: Using ep0 maxpacket: 8 [ 1429.012821][T19145] usb 10-1: Manufacturer: syz [ 1429.019446][T19158] usb 2-1: no configurations [ 1429.025242][T19145] usb 10-1: SerialNumber: syz [ 1429.033330][T19158] usb 2-1: can't read configurations, error -22 [ 1429.048079][T19158] usb usb2-port1: unable to enumerate USB device [ 1429.055155][T19145] hub 10-1:24.0: bad descriptor, ignoring hub [ 1429.061293][T19145] hub 10-1:24.0: probe with driver hub failed with error -5 [ 1429.253687][T19145] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 1429.268010][T19145] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1429.280559][T19145] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 1429.290206][T19145] usb 10-1: media controller created [ 1429.308257][T19145] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1429.378605][T19145] DVB: Unable to find symbol dib7000p_attach() [ 1429.391027][T19145] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 1429.469946][T19145] rc_core: IR keymap rc-dib0700-rc5 not found [ 1429.480796][T19145] Registered IR keymap rc-empty [ 1429.489349][T19145] dvb-usb: could not initialize remote control. [ 1429.496033][T19145] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 1429.516381][T19145] usb 10-1: USB disconnect, device number 13 [ 1429.577875][T19145] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 1429.838032][T23340] blktrace: Concurrent blktraces are not allowed on nullb0 [ 1430.623915][T23392] FAULT_INJECTION: forcing a failure. [ 1430.623915][T23392] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1430.664223][T21677] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1430.673028][T23392] CPU: 0 UID: 0 PID: 23392 Comm: syz.0.6222 Tainted: G L syzkaller #0 PREEMPT(full) [ 1430.673060][T23392] Tainted: [L]=SOFTLOCKUP [ 1430.673067][T23392] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1430.673078][T23392] Call Trace: [ 1430.673086][T23392] [ 1430.673095][T23392] dump_stack_lvl+0xe8/0x150 [ 1430.673123][T23392] should_fail_ex+0x414/0x560 [ 1430.673155][T23392] _copy_to_user+0x31/0xb0 [ 1430.673179][T23392] simple_read_from_buffer+0xe1/0x170 [ 1430.673209][T23392] proc_fail_nth_read+0x1b3/0x220 [ 1430.673230][T23392] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1430.673251][T23392] ? rw_verify_area+0x2a6/0x4d0 [ 1430.673270][T23392] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1430.673290][T23392] vfs_read+0x200/0xa30 [ 1430.673308][T23392] ? fdget_pos+0x247/0x320 [ 1430.673337][T23392] ? __pfx___mutex_lock+0x10/0x10 [ 1430.673359][T23392] ? __pfx_vfs_read+0x10/0x10 [ 1430.673380][T23392] ? __fget_files+0x2a/0x420 [ 1430.673409][T23392] ? __fget_files+0x3a0/0x420 [ 1430.673433][T23392] ? __fget_files+0x2a/0x420 [ 1430.673462][T23392] ksys_read+0x145/0x250 [ 1430.673478][T23392] ? __pfx_ksys_read+0x10/0x10 [ 1430.673505][T23392] __do_fast_syscall_32+0x1dc/0x560 [ 1430.673525][T23392] ? lockdep_hardirqs_on+0x7b/0x110 [ 1430.673541][T23392] ? do_fast_syscall_32+0x34/0x80 [ 1430.673559][T23392] ? irqentry_exit+0x10f/0x660 [ 1430.673581][T23392] do_fast_syscall_32+0x34/0x80 [ 1430.673603][T23392] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1430.673626][T23392] RIP: 0023:0xf7f72539 [ 1430.673644][T23392] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1430.673661][T23392] RSP: 002b:00000000f5445590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 1430.673681][T23392] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f5445620 [ 1430.673695][T23392] RDX: 000000000000000f RSI: 00000000f7406ff4 RDI: 0000000000000000 [ 1430.673708][T23392] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 1430.673719][T23392] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1430.673731][T23392] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1430.673761][T23392] [ 1430.973334][T21677] usb 10-1: Using ep0 maxpacket: 32 [ 1431.088926][T21677] usb 10-1: New USB device found, idVendor=0fd9, idProduct=0021, bcdDevice=29.40 [ 1431.136701][T21677] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1431.168199][T21677] usb 10-1: config 0 descriptor?? [ 1431.226922][T23409] syz_tun: entered promiscuous mode [ 1431.249121][T23409] macsec2: entered allmulticast mode [ 1431.265169][T23409] syz_tun: entered allmulticast mode [ 1431.276013][T23409] syz_tun: left allmulticast mode [ 1431.291532][T23409] syz_tun: left promiscuous mode [ 1431.404539][T14512] usb 9-1: new high-speed USB device number 20 using dummy_hcd [ 1431.431687][T21677] dvb-usb: found a 'Elgato EyeTV DTT' in warm state. [ 1431.460407][T21677] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1431.501450][T21677] dvbdev: DVB: registering new adapter (Elgato EyeTV DTT) [ 1431.521028][T21677] usb 10-1: media controller created [ 1431.545768][T21677] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1431.593789][T14512] usb 9-1: Using ep0 maxpacket: 8 [ 1431.606208][T14512] usb 9-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1431.623301][T14512] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1431.638514][T14512] usb 9-1: Product: syz [ 1431.642817][T14512] usb 9-1: Manufacturer: syz [ 1431.647921][T14512] usb 9-1: SerialNumber: syz [ 1431.679397][T14512] usb 9-1: config 0 descriptor?? [ 1431.741702][T21677] DVB: Unable to find symbol dib7000p_attach() [ 1431.759194][T21677] dvb-usb: no frontend was attached by 'Elgato EyeTV DTT' [ 1431.874072][T21677] rc_core: IR keymap rc-dib0700-rc5 not found [ 1431.885061][T21677] Registered IR keymap rc-empty [ 1431.893713][T14512] usb 9-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1431.912658][T21677] dvb-usb: could not initialize remote control. [ 1431.925600][T21677] dvb-usb: Elgato EyeTV DTT successfully initialized and connected. [ 1431.982028][T23451] netlink: 87 bytes leftover after parsing attributes in process `syz.0.6231'. [ 1432.149126][T21677] usb 10-1: USB disconnect, device number 14 [ 1432.277442][T21677] dvb-usb: Elgato EyeTV DTT successfully deinitialized and disconnected. [ 1433.032312][T23519] netlink: 'syz.9.6234': attribute type 27 has an invalid length. [ 1433.042434][T23519] netlink: 'syz.9.6234': attribute type 1 has an invalid length. [ 1433.071475][T23519] bridge0: port 1(bridge_slave_0) entered learning state [ 1433.225016][T23526] netlink: 4 bytes leftover after parsing attributes in process `syz.0.6235'. [ 1433.320365][T14512] dvb_usb_rtl28xxu 9-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1433.393874][T14512] usb 9-1: USB disconnect, device number 20 [ 1433.593410][ T5957] usb 1-1: new high-speed USB device number 90 using dummy_hcd [ 1433.753448][ T5957] usb 1-1: Using ep0 maxpacket: 32 [ 1433.765160][ T5957] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1433.784372][ T5957] usb 1-1: config 0 has 1 interface, different from the descriptor's value: 2 [ 1433.798915][ T5957] usb 1-1: config 0 interface 0 altsetting 245 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1433.820208][ T5957] usb 1-1: config 0 interface 0 has no altsetting 1 [ 1433.829804][ T5957] usb 1-1: New USB device found, idVendor=0582, idProduct=0016, bcdDevice=8e.57 [ 1433.839223][ T5957] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1433.848255][ T5957] usb 1-1: Product: syz [ 1433.852631][ T5957] usb 1-1: Manufacturer: syz [ 1433.858266][ T5957] usb 1-1: SerialNumber: syz [ 1433.866585][ T5957] usb 1-1: config 0 descriptor?? [ 1434.473012][ T5957] usb 1-1: USB disconnect, device number 90 [ 1434.560229][T22442] udevd[22442]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1435.517837][T23650] netlink: 20 bytes leftover after parsing attributes in process `syz.9.6246'. [ 1435.530283][T23650] netlink: 40 bytes leftover after parsing attributes in process `syz.9.6246'. [ 1435.739612][T23652] loop2: detected capacity change from 0 to 7 [ 1435.747314][T23652] Dev loop2: unable to read RDB block 7 [ 1435.752993][T23652] loop2: unable to read partition table [ 1435.760011][T23652] loop2: partition table beyond EOD, truncated [ 1435.767488][T23652] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1435.912727][T23657] fuse: blksize only supported for fuseblk [ 1435.920679][T23657] fuse: Bad value for 'fd' [ 1436.833342][T19145] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 1436.963541][ T106] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 1436.992648][T19145] usb 2-1: Using ep0 maxpacket: 16 [ 1437.012032][T19145] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1437.026775][ T6074] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.040154][T19145] usb 2-1: config 0 interface 0 has no altsetting 0 [ 1437.056971][T19145] usb 2-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=9d.3d [ 1437.072027][T19145] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1437.082597][T19145] usb 2-1: Product: syz [ 1437.086918][T19145] usb 2-1: Manufacturer: syz [ 1437.091825][T19145] usb 2-1: SerialNumber: syz [ 1437.096890][ T7239] usb 1-1: new high-speed USB device number 91 using dummy_hcd [ 1437.138364][T19145] usb 2-1: config 0 descriptor?? [ 1437.144961][ T106] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1437.149738][T19145] hub 2-1:0.0: bad descriptor, ignoring hub [ 1437.168098][ T106] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8D has invalid wMaxPacketSize 0 [ 1437.169082][ T6074] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.189360][ T106] usb 10-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8D has invalid maxpacket 0 [ 1437.189591][T19145] hub 2-1:0.0: probe with driver hub failed with error -5 [ 1437.212918][ T106] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1437.234719][T19145] usb 2-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1437.242201][ T106] usb 10-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=2d.16 [ 1437.254096][T27910] usb 2-1: Failed to submit usb control message: -71 [ 1437.264127][ T7239] usb 1-1: Using ep0 maxpacket: 32 [ 1437.273709][ T106] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1437.277944][ T7239] usb 1-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 1437.291147][ T106] usb 10-1: Product: syz [ 1437.295672][ T106] usb 10-1: Manufacturer: syz [ 1437.303522][ T106] usb 10-1: SerialNumber: syz [ 1437.310037][T27910] usb 2-1: unable to send the bmi data to the device: -71 [ 1437.318552][ T7239] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1437.319503][ T106] usb 10-1: config 0 descriptor?? [ 1437.350491][T27910] usb 2-1: unable to get target info from device [ 1437.355478][ T106] kvaser_usb 10-1:0.0: error -ENODEV: Cannot get usb endpoint(s) [ 1437.367012][ T7239] usb 1-1: config 0 descriptor?? [ 1437.372212][T27910] usb 2-1: could not get target info (-71) [ 1437.408243][ T7239] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 1437.425807][T27910] usb 2-1: could not probe fw (-71) [ 1437.449699][T23672] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6252'. [ 1437.453776][ T7239] input: xirlink-cit as /devices/platform/dummy_hcd.0/usb1/1-1/input/input99 [ 1437.471844][ T6074] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.637489][T23677] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1437.657021][T23677] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1437.710562][ T6074] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1437.715971][ T106] usb 10-1: USB disconnect, device number 15 [ 1437.733191][ T7239] usb 1-1: USB disconnect, device number 91 [ 1437.793992][T21677] usb 2-1: USB disconnect, device number 51 [ 1437.819166][ T6176] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1437.829946][ T6176] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1437.860463][ T6176] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1437.872032][ T6176] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1437.881418][ T6176] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1438.159755][ T6074] bridge_slave_1: left promiscuous mode [ 1438.166644][ T6074] bridge0: port 2(bridge_slave_1) entered disabled state [ 1438.177020][ T6074] bridge_slave_0: left allmulticast mode [ 1438.184662][ T6074] bridge_slave_0: left promiscuous mode [ 1438.190445][ T6074] bridge0: port 1(bridge_slave_0) entered disabled state [ 1438.444921][ T31] INFO: task kworker/1:9:26475 blocked for more than 143 seconds. [ 1438.453140][ T31] Tainted: G L syzkaller #0 [ 1438.464419][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1438.473431][ T31] task:kworker/1:9 state:D stack:15832 pid:26475 tgid:26475 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 1438.485874][ T31] Workqueue: usb_hub_wq hub_event SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 1438.492357][ T31] Call Trace: [ 1438.496317][ T31] [ 1438.499815][ T31] __schedule+0x149b/0x4fd0 [ 1438.513727][ T31] ? __pfx___schedule+0x10/0x10 [ 1438.525845][ T31] ? schedule+0x91/0x360 [ 1438.535467][ T31] schedule+0x165/0x360 [ 1438.539683][ T31] schedule_timeout+0x9a/0x270 [ 1438.554449][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1438.570195][ T31] ? do_raw_spin_lock+0x121/0x290 [ 1438.578857][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1438.584375][ T31] ? wait_for_completion+0x267/0x5d0 [ 1438.589835][ T31] wait_for_completion+0x2bf/0x5d0 [ 1438.593351][T19158] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1438.597328][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1438.653331][ T31] i2c_del_adapter+0x591/0x760 [ 1438.668447][ T31] ? lockdep_hardirqs_on+0x7b/0x110 [ 1438.704912][ T31] ? kfree+0x1c0/0x660 [ 1438.709062][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 1438.735028][ T31] ? dvb_usbv2_exit+0x949/0xb90 [ 1438.739961][ T31] dvb_usbv2_probe+0x497/0x3c20 [ 1438.745744][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 1438.751073][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1438.757411][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 1438.763089][ T31] usb_probe_interface+0x668/0xc90 [ 1438.773397][T19158] usb 10-1: Using ep0 maxpacket: 16 [ 1438.774685][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 1438.788446][ T31] really_probe+0x26d/0xad0 [ 1438.793187][ T31] __driver_probe_device+0x18c/0x320 [ 1438.801451][ T31] driver_probe_device+0x4f/0x240 [ 1438.807101][ T31] __device_attach_driver+0x279/0x430 [ 1438.812509][ T31] bus_for_each_drv+0x251/0x2e0 [ 1438.818726][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1438.824977][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1438.830390][ T31] ? lockdep_hardirqs_on+0x7b/0x110 [ 1438.836850][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1438.842710][ T31] __device_attach+0x2b8/0x430 [ 1438.848378][ T31] ? __pfx___device_attach+0x10/0x10 [ 1438.853803][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1438.858685][ T31] device_initial_probe+0xa1/0xd0 [ 1438.865155][ T31] bus_probe_device+0x12a/0x220 [ 1438.870050][ T31] ? device_add+0x726/0xb80 [ 1438.874596][ T31] device_add+0x7b6/0xb80 [ 1438.878945][ T31] usb_set_configuration+0x1a87/0x2110 [ 1438.884730][ T31] usb_generic_driver_probe+0x8d/0x150 [ 1438.890234][ T31] usb_probe_device+0x1c4/0x3c0 [ 1438.898903][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 1438.905267][ T31] really_probe+0x26d/0xad0 [ 1438.909815][ T31] __driver_probe_device+0x18c/0x320 [ 1438.915184][ T31] driver_probe_device+0x4f/0x240 [ 1438.920234][ T31] __device_attach_driver+0x279/0x430 [ 1438.925851][ T31] bus_for_each_drv+0x251/0x2e0 [ 1438.930748][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 1438.936729][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 1438.942247][ T31] ? _raw_spin_unlock_irqrestore+0x4c/0x80 [ 1438.948231][ T31] __device_attach+0x2b8/0x430 [ 1438.953039][ T31] ? __pfx___device_attach+0x10/0x10 [ 1438.958409][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1438.963390][ T31] device_initial_probe+0xa1/0xd0 [ 1438.968441][ T31] bus_probe_device+0x12a/0x220 [ 1438.973465][ T31] ? device_add+0x726/0xb80 [ 1438.978088][ T31] device_add+0x7b6/0xb80 [ 1438.982444][ T31] usb_new_device+0xa39/0x1720 [ 1438.987343][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 1438.992589][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1438.998047][ T31] hub_event+0x29b1/0x4ef0 [ 1439.003115][ T31] ? __pfx_hub_event+0x10/0x10 [ 1439.010978][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1439.016880][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1439.022636][ T31] ? process_scheduled_works+0x9ef/0x1770 [ 1439.028463][ T31] process_scheduled_works+0xad1/0x1770 [ 1439.034120][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 1439.040133][ T31] ? do_raw_spin_lock+0x121/0x290 [ 1439.045312][ T31] worker_thread+0x8a0/0xda0 [ 1439.049934][ T31] ? __kthread_parkme+0x7b/0x200 [ 1439.055278][ T31] kthread+0x711/0x8a0 [ 1439.059565][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1439.064769][ T31] ? __pfx_kthread+0x10/0x10 [ 1439.069406][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1439.074657][ T31] ? __pfx_kthread+0x10/0x10 [ 1439.079275][ T31] ret_from_fork+0x510/0xa50 [ 1439.084264][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1439.089428][ T31] ? __switch_to+0xc9e/0x1480 [ 1439.094198][ T31] ? __pfx_kthread+0x10/0x10 [ 1439.098823][ T31] ret_from_fork_asm+0x1a/0x30 [ 1439.104535][ T31] [ 1439.133309][ T31] INFO: task syz.6.5788:18048 blocked for more than 144 seconds. [ 1439.141118][ T31] Tainted: G L syzkaller #0 [ 1439.147708][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1439.203285][ T31] task:syz.6.5788 state:D stack:28152 pid:18048 tgid:18019 ppid:11021 task_flags:0x400040 flags:0x10080002 [ 1439.253313][ T31] Call Trace: [ 1439.259244][ T31] [ 1439.262193][ T31] __schedule+0x149b/0x4fd0 [ 1439.303420][ T31] ? __pfx___schedule+0x10/0x10 [ 1439.309706][ T31] ? schedule+0x91/0x360 [ 1439.333459][ T31] schedule+0x165/0x360 [ 1439.337702][ T31] schedule_preempt_disabled+0x13/0x30 [ 1439.363436][ T31] __mutex_lock+0x7e6/0x1350 [ 1439.368148][ T31] ? __mutex_lock+0x5bb/0x1350 [ 1439.372964][ T31] ? usbdev_open+0x16e/0x760 [ 1439.413371][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 1439.418513][ T31] ? bus_find_device+0x273/0x2b0 [ 1439.453347][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 1439.458738][ T31] ? __pfx_tomoyo_check_open_permission+0x10/0x10 [ 1439.493322][ T31] ? usbdev_open+0xa7/0x760 [ 1439.497962][ T31] usbdev_open+0x16e/0x760 [ 1439.502441][ T31] ? kobject_get_unless_zero+0x161/0x1f0 [ 1439.523343][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 1439.528390][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 1439.544204][ T31] chrdev_open+0x4cc/0x5e0 [ 1439.548731][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1439.564054][ T31] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 1439.570504][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 1439.593337][ T31] do_dentry_open+0x7ce/0x1420 [ 1439.598238][ T31] vfs_open+0x3b/0x340 [ 1439.602356][ T31] ? path_openat+0x33f3/0x3dd0 [ 1439.643465][ T31] path_openat+0x340e/0x3dd0 [ 1439.648198][ T31] ? __pfx_stack_trace_save+0x10/0x10 [ 1439.684209][ T31] ? kmem_cache_alloc_noprof+0x37d/0x710 [ 1439.689974][ T31] ? getname_flags+0xb8/0x540 [ 1439.729418][ T31] ? __pfx_path_openat+0x10/0x10 [ 1439.735725][ T31] ? __lock_acquire+0x6b6/0x2cf0 [ 1439.740954][ T31] do_filp_open+0x1fa/0x410 [ 1439.755188][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 1439.761905][ T31] ? _raw_spin_unlock+0x28/0x50 [ 1439.767394][ T31] ? alloc_fd+0x64c/0x6c0 [ 1439.771807][ T31] do_sys_openat2+0x121/0x200 [ 1439.778033][ T31] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1439.783694][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 1439.788934][ T31] ? rcu_is_watching+0x15/0xb0 [ 1439.793966][ T31] __ia32_compat_sys_openat+0x131/0x160 [ 1439.799601][ T31] __do_fast_syscall_32+0x1dc/0x560 [ 1439.805258][ T31] ? do_fast_syscall_32+0x34/0x80 [ 1439.810331][ T31] do_fast_syscall_32+0x34/0x80 [ 1439.815336][ T31] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1439.822652][ T31] RIP: 0023:0xf7f41539 [ 1439.826862][ T31] RSP: 002b:00000000f4fd1100 EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 1439.835457][ T31] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f4fd1150 [ 1439.843680][ T31] RDX: 0000000000044680 RSI: 0000000000000000 RDI: 00000000f73d6ff4 [ 1439.851731][ T31] RBP: 0000000000044680 R08: 0000000000000000 R09: 0000000000000000 [ 1439.859848][ T31] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1439.867907][ T31] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1439.876069][ T31] [ 1439.879271][ T31] [ 1439.879271][ T31] Showing all locks held in the system: [ 1439.887303][ T31] 1 lock held by khungtaskd/31: [ 1439.892236][ T31] #0: ffffffff8df41aa0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1439.902271][ T31] 2 locks held by dhcpcd/5495: [ 1439.907324][ T31] #0: ffff88805133c6f0 (nlk_cb_mutex-ROUTE){+.+.}-{4:4}, at: __netlink_dump_start+0xfe/0x7e0 [ 1439.917883][ T31] #1: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_dumpit+0x92/0x200 [ 1439.931289][ T31] 2 locks held by getty/5589: [ 1439.937950][ T31] #0: ffff8880334320a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1439.947911][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x449/0x1460 [ 1439.958144][ T31] 3 locks held by kworker/1:3/5892: [ 1439.963579][ T52] Bluetooth: hci1: command tx timeout [ 1439.963627][ T31] #0: ffff88813ff16948 ((wq_completion)events_power_efficient){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1439.982428][ T31] #1: ffffc900045efbc0 ((reg_check_chans).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1439.994749][ T31] #2: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: reg_check_chans_work+0xa1/0xf00 [ 1440.004470][ T31] 5 locks held by kworker/u8:19/6074: [ 1440.009869][ T31] #0: ffff88801aa9f148 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1440.020974][ T31] #1: ffffc900054dfbc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1440.032689][ T31] #2: ffffffff8f304cd0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x7a0 [ 1440.042148][ T31] #3: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: ops_undo_list+0x2a4/0x990 [ 1440.051876][ T31] #4: ffffffff8df475f8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2b1/0x6e0 [ 1440.062992][ T31] 3 locks held by kworker/u8:20/6104: [ 1440.068436][ T31] #0: ffff88813ff29948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1440.080583][ T31] #1: ffffc9000c4a7bc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1440.091691][ T31] #2: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 1440.100767][ T31] 3 locks held by kworker/0:10/7239: [ 1440.106178][ T31] #0: ffff88813ff15948 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1440.117322][ T31] #1: ffffc9000c237bc0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1440.129867][ T31] #2: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 1440.140411][ T31] 5 locks held by kworker/1:9/26475: [ 1440.145766][ T31] #0: ffff88801f2d7148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1440.157190][ T31] #1: ffffc90018a37bc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1440.169217][ T31] #2: ffff8881453dc198 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4ef0 [ 1440.178189][ T31] #3: ffff88807ac32198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 [ 1440.187504][ T31] #4: ffff888079092160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x430 [ 1440.196833][ T31] 1 lock held by syz-executor/17082: [ 1440.202143][ T31] #0: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 1440.211214][ T31] 1 lock held by syz.6.5788/18048: [ 1440.216397][ T31] #0: ffff8881453dc198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 1440.225545][ T31] 5 locks held by kworker/0:5/19158: [ 1440.231791][ T31] #0: ffff88801f2d7148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1440.243463][ T31] #1: ffffc9000e06fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1440.255455][ T31] #2: ffff8881453ec198 (&dev->mutex){....}-{4:4}, at: hub_event+0x187/0x4ef0 [ 1440.264471][ T31] #3: ffff8881453ef518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x215a/0x4ef0 [ 1440.275523][ T31] #4: ffff88814536cb68 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x2182/0x4ef0 [ 1440.285422][ T31] 1 lock held by syz-executor/20714: [ 1440.290744][ T31] #0: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 1440.299993][ T31] 3 locks held by kworker/u8:27/22550: [ 1440.305522][ T31] #0: ffff88802e7f9148 ((wq_completion)ipv6_addrconf){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x1770 [ 1440.317166][ T31] #1: ffffc90005767bc0 ((work_completion)(&(&net->ipv6.addr_chk_work)->work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x1770 [ 1440.332309][ T31] #2: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: addrconf_verify_work+0x19/0x30 [ 1440.341959][ T31] 1 lock held by syz.7.6248/23659: [ 1440.347157][ T31] #0: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 1440.356366][ T31] 2 locks held by syz-executor/23745: [ 1440.361771][ T31] #0: ffffffff8f8408d0 (&ops->srcu#2){.+.+}-{0:0}, at: rtnl_link_ops_get+0x23/0x250 [ 1440.371805][ T31] #1: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8ec/0x1c90 [ 1440.382775][ T31] 1 lock held by syz.9.6257/23784: [ 1440.388048][ T31] #0: ffffffff8f311d88 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 1440.397150][ T31] [ 1440.399543][ T31] ============================================= [ 1440.399543][ T31] [ 1440.408140][ T31] NMI backtrace for cpu 0 [ 1440.408160][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1440.408183][ T31] Tainted: [L]=SOFTLOCKUP [ 1440.408189][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1440.408199][ T31] Call Trace: [ 1440.408209][ T31] [ 1440.408217][ T31] dump_stack_lvl+0xe8/0x150 [ 1440.408248][ T31] nmi_cpu_backtrace+0x274/0x2d0 [ 1440.408272][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1440.408298][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1440.408322][ T31] sys_info+0x135/0x170 [ 1440.408340][ T31] watchdog+0xf95/0xfe0 [ 1440.408367][ T31] ? watchdog+0x20a/0xfe0 [ 1440.408394][ T31] kthread+0x711/0x8a0 [ 1440.408417][ T31] ? __pfx_watchdog+0x10/0x10 [ 1440.408437][ T31] ? __pfx_kthread+0x10/0x10 [ 1440.408460][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1440.408483][ T31] ? __pfx_kthread+0x10/0x10 [ 1440.408503][ T31] ret_from_fork+0x510/0xa50 [ 1440.408522][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1440.408536][ T31] ? __switch_to+0xc9e/0x1480 [ 1440.408562][ T31] ? __pfx_kthread+0x10/0x10 [ 1440.408582][ T31] ret_from_fork_asm+0x1a/0x30 [ 1440.408617][ T31] [ 1440.408645][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1440.537070][ C1] NMI backtrace for cpu 1 [ 1440.537092][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G L syzkaller #0 PREEMPT(full) [ 1440.537116][ C1] Tainted: [L]=SOFTLOCKUP [ 1440.537123][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1440.537134][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1440.537158][ C1] Code: 13 e3 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 73 c1 0e 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1440.537173][ C1] RSP: 0018:ffffc90000197e20 EFLAGS: 000002c2 [ 1440.537189][ C1] RAX: 000000000226dd5f RBX: ffffffff819713ee RCX: 0000000080000001 [ 1440.537202][ C1] RDX: 0000000000000001 RSI: ffffffff8d79207b RDI: ffffffff8bc083e0 [ 1440.537215][ C1] RBP: ffffc90000197f10 R08: ffff8880b87336db R09: 1ffff110170e66db [ 1440.537229][ C1] R10: dffffc0000000000 R11: ffffed10170e66dc R12: ffffffff8f822270 [ 1440.537242][ C1] R13: 1ffff110038d8b70 R14: 0000000000000001 R15: 0000000000000001 [ 1440.537254][ C1] FS: 0000000000000000(0000) GS:ffff888125f1f000(0000) knlGS:0000000000000000 [ 1440.537268][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1440.537280][ C1] CR2: 00000000f74099b4 CR3: 000000000dd3a000 CR4: 00000000003526f0 [ 1440.537295][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1440.537311][ C1] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1440.537323][ C1] Call Trace: [ 1440.537329][ C1] [ 1440.537336][ C1] default_idle+0x13/0x20 [ 1440.537356][ C1] default_idle_call+0x73/0xb0 [ 1440.537377][ C1] do_idle+0x1be/0x4d0 [ 1440.537394][ C1] ? asm_sysvec_call_function_single+0x1a/0x20 [ 1440.537415][ C1] ? __pfx_do_idle+0x10/0x10 [ 1440.537438][ C1] cpu_startup_entry+0x44/0x60 [ 1440.537456][ C1] start_secondary+0x101/0x110 [ 1440.537481][ C1] common_startup_64+0x13e/0x147 [ 1440.537510][ C1] [ 1440.728065][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1440.734933][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 1440.745623][ T31] Tainted: [L]=SOFTLOCKUP [ 1440.749936][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1440.760003][ T31] Call Trace: [ 1440.763287][ T31] [ 1440.766229][ T31] vpanic+0x1e0/0x670 [ 1440.770288][ T31] panic+0xb9/0xc0 [ 1440.773993][ T31] ? __pfx_panic+0x10/0x10 [ 1440.778399][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1440.783756][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 1440.789898][ T31] watchdog+0xfdf/0xfe0 [ 1440.794054][ T31] ? watchdog+0x20a/0xfe0 [ 1440.798402][ T31] kthread+0x711/0x8a0 [ 1440.802475][ T31] ? __pfx_watchdog+0x10/0x10 [ 1440.807159][ T31] ? __pfx_kthread+0x10/0x10 [ 1440.811752][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1440.816951][ T31] ? __pfx_kthread+0x10/0x10 [ 1440.821538][ T31] ret_from_fork+0x510/0xa50 [ 1440.826125][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1440.831235][ T31] ? __switch_to+0xc9e/0x1480 [ 1440.835923][ T31] ? __pfx_kthread+0x10/0x10 [ 1440.840511][ T31] ret_from_fork_asm+0x1a/0x30 [ 1440.845284][ T31] [ 1440.848684][ T31] Kernel Offset: disabled [ 1440.853005][ T31] Rebooting in 86400 seconds..