last executing test programs: 6m54.675589927s ago: executing program 2 (id=143): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000001c0)=ANY=[@ANYBLOB="3c00000010004b0400000000000000007a000000", @ANYRES32=0x0, @ANYBLOB="00000000081062455f6964676500000c000280040018fcff6971dc3c0000006a1f104d005050a2623c853a89afdb373bfc6fe2401e423432f15d40def33133f1a0f1"], 0x3c}, 0x1, 0x0, 0x0, 0x34041043}, 0x4004000) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000180)=@newqdisc={0x24, 0x24, 0x1, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) r1 = socket$inet_sctp(0x2, 0x4, 0x84) getsockopt$inet_opts(r1, 0x0, 0x4, &(0x7f0000000040)=""/19, &(0x7f00000000c0)=0x13) 6m53.892234884s ago: executing program 2 (id=148): socket$nl_generic(0x10, 0x3, 0x10) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) (async) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x140, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) (async) sched_setattr(0x0, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) r2 = syz_open_procfs(0x0, &(0x7f0000019240)='net/netstat\x00') pread64(r2, 0x0, 0x0, 0x200) (async) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r3, 0x8983, &(0x7f00000001c0)={0x0, 'vlan1\x00', {0x1}, 0x7f}) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) (async) read$FUSE(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) (async) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000002600)={0x0, 0x3, "5a77bd318786aeb879ca62cdab2a02fa560186d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f68530c2b80000000b76cba37ff3111d6847e0c7f719e169a596e5fc008daefba68f6222103472bc55704cdb72b4b996ed82ccb1eaae27969d008ba7d34171113d806726615380fe65a6a0a72e19c2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0ae4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe3635b2ee97c143f28def4b73905ca14d90d1f600"}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r5, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x9, 0x2, 0x180, 0x4, 0x10, 0xf1, 0x50, 0x7fffffffffffe, 0x5, 0x6, 0x9, 0x8000000000000000, 0xf4a, 0x0, 0xbdb], 0xffff1001, 0x4000}) (async) ioctl$VIDIOC_SUBDEV_ENUM_FRAME_SIZE(0xffffffffffffffff, 0xc040564a, &(0x7f0000000200)={0x0, 0x0, 0x300f, 0x2, 0x0, 0x0, 0x0, 0x1}) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) ioctl$KVM_RUN(r6, 0xae80, 0x0) (async) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) (async) ioctl$F2FS_IOC_COMMIT_ATOMIC_WRITE(r0, 0xf502, 0x0) (async) socket$nl_generic(0x10, 0x3, 0x10) 6m53.592461915s ago: executing program 2 (id=150): syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYRES64=0x0], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x45}) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x200002, 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x4) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)={@my=0x1}) tee(r0, r1, 0x3, 0x8) syz_usb_connect(0x3, 0x24, &(0x7f0000000080)=ANY=[@ANYRES64=0x0], &(0x7f0000000380)={0x0, 0x0, 0x0, 0x0, 0x45}) (async) socket$inet6_sctp(0xa, 0x1, 0x84) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.net/syz1\x00', 0x200002, 0x0) (async) syz_open_dev$char_usb(0xc, 0xb4, 0x4) (async) openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) (async) ioctl$VHOST_VSOCK_SET_GUEST_CID(r2, 0x4008af60, &(0x7f0000000040)={@my=0x1}) (async) tee(r0, r1, 0x3, 0x8) (async) 6m50.415937306s ago: executing program 2 (id=165): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000800)=@ipv4_newroute={0x38, 0x18, 0x1, 0x0, 0x0, {0x2, 0x0, 0x0, 0x0, 0xfc, 0x0, 0xfd, 0x9}, [@RTA_ENCAP_TYPE={0x6, 0x15, 0x2}, @RTA_ENCAP={0x14, 0x16, 0x0, 0x1, @LWTUNNEL_IP_OPTS={0x10, 0x8, 0x0, 0x1, @LWTUNNEL_IP_OPTS_ERSPAN={0xc, 0x3, 0x0, 0x1, @LWTUNNEL_IP_OPT_ERSPAN_HWID={0x5, 0x4, 0xf}}}}]}, 0x38}}, 0xa890) (fail_nth: 8) 6m49.783535848s ago: executing program 2 (id=168): r0 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_SET_LIMITS(0xffffffffffffffff, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x5040100}, 0xc, &(0x7f0000000280)={&(0x7f0000000440)=ANY=[@ANYBLOB="ec000000", @ANYRES16=r0, @ANYBLOB="000828bd70003478f0fddbdf250500002008000300030000005400068008000300ac1414aa050002000000000014000400fe800000000000000500020007000000060005004e2400001400040000000000000000000008000300050000000500050020000000240001800800030000000000060005004e210000080006000100000008000300ac1414aa24000180060005004e2000000800060000000000060005004e210000060005004e20000005000500060000001400018008000300ffffffff05000200000000000800030003000000000000000000004ca61ae3c3ce78422e0ace1e6b077e1313238a3f4803f68de77a1d77be28a4fa8b60a083e997c52df3ccc927ddd9b08e2362994a250aa4e0716c1fa76997280cfe756fda88678a7b5c5a14010e993ed67a0bc42f94c91f84d9d44870ad79b04fe326d62c83cf470da632ba742eadc44188c4553c1bd9907fbc0fd0e7ae9641785ea8d81fb49b3376da3d13d17133"], 0xec}, 0x1, 0x0, 0x0, 0x8054}, 0x4000000) socket$nl_route(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x1000000, 0x50, 0xffffffffffffffff, 0x0) socket(0x2b, 0x3, 0x1000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) ioctl$sock_FIOGETOWN(r1, 0x8903, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x100000001, 0xfffffe0000000001, 0xfa11, 0x65aa}, 0x0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x2) execveat(0xffffffffffffff9c, &(0x7f0000000280)='./file2\x00', 0x0, 0x0, 0x0) syz_io_uring_setup(0x4952, &(0x7f0000000300)={0x0, 0xe3d6, 0x8, 0x1, 0x141}, 0x0, &(0x7f0000000380), &(0x7f0000000000)) symlink(&(0x7f0000002040)='./file0/file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa/file0\x00', 0x0) rename(0x0, 0x0) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, 0x0) setns(r4, 0x24020000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)={0x4c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x4c}}, 0x0) landlock_create_ruleset(0x0, 0x0, 0x0) umount2(&(0x7f0000000040)='.\x00', 0x2) pipe2$watch_queue(0x0, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(0xffffffffffffffff, 0x5760, 0x14) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x4}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, 0x0) 6m48.782133173s ago: executing program 2 (id=172): socket$nl_route(0x10, 0x3, 0x0) add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) flock(0xffffffffffffffff, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000080)=0x3ff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_REG_LIST(r5, 0xc008aeb0, 0x0) write$dsp(r2, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) syz_open_dev$hiddev(&(0x7f0000000140), 0x2cc0, 0x18000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x24040810) r7 = socket$key(0xf, 0x3, 0x2) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000380)={{0x2, 0x4e21, @multicast2}, {0x6, @random="19a874654ae3"}, 0x6a, {0x2, 0x4e21, @local}, 'dummy0\x00'}) sendmsg$key(r7, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(r7, 0x0, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, &(0x7f00000025c0)={0x1, @vbi={0x8, 0x449, 0x47524247, 0x0, [0x4, 0x3], [0x40, 0x2], 0x13a}}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x1, 0x50) io_setup(0x4fe, &(0x7f00000009c0)) 6m33.349032749s ago: executing program 32 (id=172): socket$nl_route(0x10, 0x3, 0x0) add_key$keyring(0x0, &(0x7f0000000140)={'syz', 0x1}, 0x0, 0x0, 0xfffffffffffffffd) socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) flock(0xffffffffffffffff, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x6, 0xfa11, 0xffffffff}, 0x0) r2 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000040), 0xa0201, 0x0) ioctl$SNDCTL_DSP_SPEED(r2, 0xc0045002, &(0x7f0000000080)=0x3ff) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_REG_LIST(r5, 0xc008aeb0, 0x0) write$dsp(r2, &(0x7f00000012c0)="a52876830a602214f6b4e928d758f38a5a7cb4b31c4c09289e9ebb6286784ca3", 0x4000) syz_open_dev$hiddev(&(0x7f0000000140), 0x2cc0, 0x18000) bpf$PROG_LOAD(0x5, 0x0, 0x0) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, 0x0, 0x24040810) r7 = socket$key(0xf, 0x3, 0x2) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$sock_inet_SIOCSARP(r8, 0x8955, &(0x7f0000000380)={{0x2, 0x4e21, @multicast2}, {0x6, @random="19a874654ae3"}, 0x6a, {0x2, 0x4e21, @local}, 'dummy0\x00'}) sendmsg$key(r7, &(0x7f0000000800)={0x0, 0x0, 0x0}, 0x0) sendmsg$key(r7, 0x0, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0cc5605, &(0x7f00000025c0)={0x1, @vbi={0x8, 0x449, 0x47524247, 0x0, [0x4, 0x3], [0x40, 0x2], 0x13a}}) openat$sysfs(0xffffffffffffff9c, &(0x7f0000000140)='/sys/power/wakeup_count', 0x1, 0x50) io_setup(0x4fe, &(0x7f00000009c0)) 2m52.963640758s ago: executing program 1 (id=1221): r0 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000000c0)={0x1, @pix_mp={0xa, 0x3, 0x3132564e, 0x1, 0x3, [{0x6}, {0xe, 0x3987}, {0x6, 0x2000101}, {0x7, 0x9}, {0x3, 0x4}, {0x1, 0x5c1}, {0x3ff, 0x1}, {0x8001, 0x2}], 0x5, 0x7, 0x4, 0x1, 0x6}}) syz_usb_connect(0x0, 0x3f, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001d31ad240f0031d5842bb0102030109022d0001000000000904c50003ff0107000905050208000003010904"], 0x0) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000040)='syz1\x00', 0x200002, 0x0) openat$cgroup_ro(r1, &(0x7f0000000080)='blkio.throttle.io_serviced\x00', 0x0, 0x0) syz_usb_connect$uac1(0x0, 0xf2, &(0x7f0000000100)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0xff, 0x582, 0xb, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xe0, 0x3, 0x1, 0x7, 0x50, 0xa, "", {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x3, 0x2f}, [@input_terminal={0xc, 0x24, 0x2, 0x3, 0x100, 0x2, 0xb, 0x200, 0x4, 0x1}, @input_terminal={0xc, 0x24, 0x2, 0x6, 0x203, 0x6, 0xff, 0x1000, 0x4, 0xa}, @processing_unit={0x8, 0x24, 0x7, 0x1, 0x2, 0x2, "9c"}, @mixer_unit={0x5, 0x24, 0x4, 0x2, 0x4}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_continuous={0xb, 0x24, 0x2, 0x1, 0x9, 0x3, 0x2e, 0xe, "33ab", '9'}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x0, 0x3, 0x9, 0x6, "", "cf"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xfbff, 0x8, 0x7, 0x9}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0xb47, 0x7f, 0x3, 0x1}]}, {{0x9, 0x5, 0x1, 0x9, 0x8, 0x3, 0xc, 0x6f, {0x7, 0x25, 0x1, 0x4, 0x1, 0x6}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_ext={0x9, 0x24, 0x2, 0x1, 0x5, 0x5, 0xc, 0x3e, 0x6}, @format_type_i_continuous={0x9, 0x24, 0x2, 0x1, 0x9b, 0x4, 0x0, 0x3, "", "f6"}, @format_type_ii_discrete={0xc, 0x24, 0x2, 0x2, 0xb62, 0xf2eb, 0x1, "5f5deb"}, @format_type_ii_ext={0xa, 0x24, 0x2, 0x2, 0x57, 0x1, 0xf, 0x1}, @format_type_i_discrete={0xb, 0x24, 0x2, 0x1, 0x8, 0x1, 0xfd, 0x2, "d3429f"}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x5, 0x4, 0xc, {0x7, 0x25, 0x1, 0xc, 0xf7, 0x3}}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f0000000200)={0xfffffffffffffe4d, 0x6, 0x250, 0x4, 0x8, 0x40, 0x10, 0x2}, 0x19, &(0x7f0000000240)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x2, "ad65d91c56701e036df715e1c931deeb"}]}, 0x3, [{0xf5, &(0x7f0000000280)=@string={0xf5, 0x3, "1a16efd27dd74e892d4b74f13e6796aec95e9b4736f54dda50fb94f33b2e9e1660ecac81aa9de85e104db2c8bf8f66debcf92d5c6fdaa7b2a48db65eff9df62788eb55c1e80f897ea9397787219454f6fde10a3ce7915d9e970807674d730f74005e75efad23251150557ce34ebaad1736ed5580d11263e9d82c299da6e387f9d8610e39f42f8cc1d3e04281131105da82ae05a9b57146eb4a9cd02e0e922aa1a6c8ef1771dec4807d875a3e3b5fc04357e0d767eb19fb3b77bb1019420b0300ae81da79d5f791f85706eefecc4f6489d9e991f89e93722bda95b672264a2c1db7d345ccd035912af16c1907d5fe0fae1113e5"}}, {0x4, &(0x7f0000000380)=@lang_id={0x4, 0x3, 0x809}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x3c0a}}]}) 2m52.319024832s ago: executing program 1 (id=1227): openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x10200, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000001c0)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TIOCSSOFTCAR(r2, 0x541a, &(0x7f0000000080)=0x3) sendmsg$inet(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001640)=[{&(0x7f0000000340)="5c00000013006bcd9e3fe3dc4e48aa31086b8703140000001f03000000330000040014000d000a000d0000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x4040844) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) r3 = memfd_create(&(0x7f0000000000)='\x103q}2\x9a\xce\xaf\x03\xdfy[\xd9\xffR8\xf4\x1c\bi\xe4^\xd5\xfd\xa9\r\xac7A\x94\xa0\x00\x00\x00\x90+\xd6\x05\r\x84\x87\x1c\b\xdb\xe2\x00\x00A\x90m\xb6&\xd0\x9d\x00\x00\xc5\xb8,\f\xd4s\xb2\x99/\xc0\x9a\xf2O\xdb\x00\x00\x00\x00\x00\x00\r\x1b\xd3\xff<\x83z\x80\x8fQ|\xf5d\x10\x10\xd7\x01M\x7fML\x18\'\x1a<\xfee7{l\x16}\xa0I\x7f\xb5)l\xbb\x02\xfa\xb7\xb6\xa0]\xda8\xe0~\x1c \x91\t\x8b\xbd\x1f\xb3834d1i\x9b\x94\xa6\\\x0e\xe2\xfa\xe5!\xd3\xcf\xfc\xce\xba\xe2\x9f\x05xgL5\x14Y+\xb3\x1axi)<\xf7\x98\xc1\xba\xf4|\xe7|\xc4\xd7\x03\x00\x00\x00\x04D\x15E^7%8\x94y\x98\xf0l\xa0\'Q%\xd4\xda\xee\x81}\xcc\xfd\xa2\xe3M~x\x96\xe3]\xd70\xa2\x17\xca\xde\x1b\xaa\xe0l\xfc\x85\x8fc\x1c{|e\x8bs\xb0\x85E\xce;p)\xf8\xa6\xaa&QC4V\x81\x04\xcf\xd2\x81\xdc\xdf\xd7<\x9f\x93\x8bX\xd4\xea\xb2\xff\b\x92\xc7\x00\xef\xff\x00\x93\x1f\x92\xa7dcY\x9c\x9e9O-\xfcF\xbb\xbd{:IR\xea\xd8$\xe2\xa0\xc2\x8b\x1a\xead\xb8\xe1:6\x15M\x1d\xdak\x8c\x909\xd8\xb3\x02\xe0\x04\x9c\xc2\x06|\xf0\x0f\xa6Y&r\x9b\xc7\x1d\xe7jDf\x87@\x8fg\x15RJwe\xe2\xdcunu\xff`\xa40\xce\xffB%\xe4k\xff\x8d\x06\x0e\x89\xd9DC\x9fF\x9c[M=\xe0^\xa8\xed)\xe8Z\xe8\x99&\x87\x04\xa4\t\xaa\xd8\xd6\xd5pG\xcb\xc4\x8b\xf7\xb8#\xcb\xd8|\xa5\xa6S\x8b\x8cv\xb7)\x02k\xf3L\x03\xbb\xfa\xe1\\\xf1\x8cUj\xd5\xa5\x88GL\xe7_\xfd\x17C=G\x0f\xe9u\x1d\xfeg\xfex\xcd\xaa\xad\x906\xd0sy\xc6T\x93\xae\xd5r\xc8G\xc5\xfdS\xff\x04:`\x1e\xe3;l\xcd&\xd4\xf4\x8eum\x04\x00~\xfa\x05\xd7\xe7X\xc7/\xae5\x93wwT\x13\xbd,\xd6\x16\x84\xcd\xd1\xd8\xe1P_\xbf0\xd8\x8d%Yh\xb5\xb4\"\xf5\x93\xdeh\xce\xa5\xe8\xc8\xec\x88\x89\xf07{\x95\xc9\xd0\xee\xe1\x1d\x80\xcc]-\xc2\xa1\x02ELhI\xd9\xf5\xcfk\x8a&i\xc1\xff9T\x8e\xe2rY\xa3\xd2H9\xfe\x0e\x1e\xac\x0f\xc3\xbd{\xd9\xcc\xbe\xa9\x93\xe0\xa4W\x1cn>\xc1\xf1\x9e\"\x93\x19\x19\x1a\xcc\x7fy\xd2~\x05\x99\xe6\x00o\xca\xe0\xc6\xd4\xf5\xa0\xc8P\xd6;\xf3\xc6~E\xacI\xd4\xe9\xa1|>\x91.K\x81\xa9+\xcf\xff\xcb\xfa\x0f\xe7n\x83H\x12\xac\x80\x16\xf8\x87Q\x97Az\n`\xb6\xe13A\xec\x8d(\\D\xec\xa6\t1\xa0h\xfc\x1f\xdd1@-4\xb4:\xf8\xd5wP \x84m\xe2\xd9\xfcb\xa0\xc3\xc9\xe7W\x86\xd7$\xa4ml\xee\x97[\xb7\xfa', 0x2) r4 = socket$packet(0x11, 0x2, 0x300) setsockopt$SO_ATTACH_FILTER(r4, 0x1, 0x1a, &(0x7f0000002280)={0x2, &(0x7f0000000280)=[{0x20, 0x2, 0x81, 0xfffff034}, {0x6, 0xba, 0x2, 0x541d}]}, 0x10) syz_emit_ethernet(0x22, &(0x7f00000002c0)=ANY=[@ANYBLOB="0180c200005dc8d6e8dee1fe5689afd001000000000000080045b20014006800002221907864010100ac14faaa"], 0x0) ftruncate(r3, 0x80079a0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0xb, 0x2012, r3, 0x0) modify_ldt$write(0x1, &(0x7f0000000000)={0x4, 0x20000000, 0x400, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x10) lseek(r3, 0x0, 0x4) socket$nl_route(0x10, 0x3, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) setsockopt$IPT_SO_SET_REPLACE(r6, 0x0, 0x40, &(0x7f0000004a40)=@filter={'filter\x00', 0x42, 0x4, 0x298, 0xffffffff, 0x1208, 0x0, 0x0, 0xffffffff, 0xffffffff, 0x12d8, 0x12d8, 0x12d8, 0xffffffff, 0x5, 0x0, {[{{@ip={@multicast2, @rand_addr=0x64010102, 0x0, 0x0, 'netpci0\x00', 'nr0\x00'}, 0x74000002, 0x70, 0x98, 0x1ba, {0x46010000, 0x2c000000000000}}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}, {{@ip={@private, @multicast2, 0xff, 0x0, 'netpci0\x00', 'team_slave_1\x00', {}, {0xff}}, 0x287, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x7}}}, {{@uncond, 0x0, 0x70, 0xd0}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x1, [0x6, 0x0, 0x0, 0x5, 0x5, 0x4], 0x0, 0x3}, {0x3, [0x1, 0x4, 0x1, 0x9, 0x4, 0x5], 0x7, 0x7}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x2f8) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000680)={'bridge0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(0xffffffffffffffff, 0xc018937e, &(0x7f0000000300)={{0x1, 0x1, 0x18, r3, {0x4}}, './file0\x00'}) ioctl$KDGKBSENT(r7, 0x4b48, &(0x7f00000003c0)={0x7f, "b41edc20fcdf3e9f764c4959349fc6ecef52cb61e455b0082002e4c82d696da5f24075b9061ba279f032062c5c6f0bfd767da5bd9a913c53d05be786f702af81d7af92a465f3fe849119c6758f97a997a53824dc75d6fa7be56803b6a5c7d75b499e0a31f706254a5a2a136d8d269847c2a53a1d6aab5c4835a166ed6791fc87b888942236fc9a06a416ec46d4aae14b884a7603603ac161433357dbed5020f24ad9838285feef8ebfedbe0160b6963df7934386548a5c9a0f390953823675121aa60c849b650bd431707ef2c6e9536b1adaff19c17767f64296b414f2730d7b21abb96fa0e6b30105e64a6856dabceae1d319f2035ddcdddc66551fe294e82fc356d4b648fc86987f14939045fc5ff37470d51bbdbb2af8608ac783197895bd9f7b76a39c3f0d181e711550a9f3aa6d6178ef6bef01aec8170cec38187aa0b573ca416b4d42fcaa1817dd5c385d9a297871e9578655326475cb42b4b00323b4f0e2d56489df8ad1c42d8b6154d110029bf43e8aada55f258a6be457ff82ed4bb672c1a9a48a3cdf0ba7b0b334c7a646de4fd268e4eb5af294059b2245546620906f057fafc85408e92de305ed13b6b75f7e3249c936e32fc6b64c0bb294e925cd58addc0154a0239dad18138a065bde7222c61f23bf4da8e2390cd18fb04a553aefe50855305f00"}) socket$nl_route(0x10, 0x3, 0x0) r8 = socket(0x200000000000011, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000000)={'bridge0\x00'}) r9 = syz_usb_connect(0x3, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000014da2108ab12a390eb1e000000010902240001b30000040904410017ff5d810009050f1f01040000000905830300b3"], 0x0) syz_usb_ep_write$ath9k_ep2(r9, 0x83, 0x8, &(0x7f0000000600)=ANY=[@ANYRESOCT=r9]) 2m48.028622092s ago: executing program 1 (id=1243): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000700)=ANY=[@ANYBLOB="300000001000010800"/20, @ANYRES32=0x0, @ANYBLOB="000900006440000008001b00000000000500100004"], 0x30}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@newqdisc={0x30, 0x10, 0x1, 0x70bd25, 0x25dfdbfc, {0x6, 0x0, 0x8100, 0x0, {0x1, 0x10}, {0x3}, {0xe, 0x10}}, [@TCA_RATE={0x6, 0x5, {0xfc}}, @TCA_STAB={0x4}]}, 0x30}, 0x1, 0x0, 0x0, 0xc800}, 0x0) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r1, 0x29, 0x40, &(0x7f0000000780)=@nat={'nat\x00', 0x1b, 0x5, 0x668, 0x0, 0x450, 0xffffffff, 0x1f8, 0x0, 0x598, 0x598, 0xffffffff, 0x598, 0x598, 0x5, 0x0, {[{{@ipv6={@private0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x1d}}, [0xffffff00, 0xffffff00, 0x0, 0xff000000], [0xff, 0xffffffff, 0xffffffff, 0xff], 'macvlan1\x00', 'ipvlan0\x00', {0xff}, {}, 0x36, 0x6, 0x5, 0x40}, 0x0, 0x1b0, 0x1f8, 0x0, {}, [@common=@dst={{0x48}, {0xc, 0x2, 0x1, [0x9, 0x1, 0x1, 0x8000, 0x28, 0x800, 0x4, 0x6, 0x0, 0x81, 0x7ff, 0x2, 0xd92, 0x0, 0x7, 0x4], 0x6}}, @common=@unspec=@conntrack2={{0xc0}, {{@ipv6=@dev={0xfe, 0x80, '\x00', 0xc}, [0xff000000, 0xff, 0x0, 0xff], @ipv6=@dev={0xfe, 0x80, '\x00', 0x3e}, [0xff000000, 0xff, 0x0, 0xff000000], @ipv4=@broadcast, [0xff000000, 0xffffff00, 0xffffff00, 0xff000000], @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, [0xff, 0x0, 0xffffffff, 0xff], 0x100, 0x3ff, 0x0, 0x4e23, 0x4e24, 0x4e24, 0x4e21, 0x2, 0x3}, 0x40, 0x400}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x5, @ipv6=@mcast2, @ipv4=@multicast2, @port=0x4e24, @icmp_id=0x64}}}, {{@ipv6={@empty, @private2={0xfc, 0x2, '\x00', 0x1}, [0x0, 0xff, 0xff000000, 0xff], [0xff000000, 0xff, 0xff000000, 0xff], 'vcan0\x00', 'dummy0\x00', {}, {0xff}, 0x6, 0xf9, 0x1, 0x5}, 0x0, 0xa8, 0xf0}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x2, @ipv4=@initdev={0xac, 0x1e, 0x0, 0x0}, @ipv6=@ipv4={'\x00', '\xff\xff', @private=0xa010101}, @port=0x4e22, @icmp_id=0x66}}}, {{@uncond, 0x0, 0x120, 0x168, 0x0, {}, [@common=@hbh={{0x48}, {0xf, 0x4, 0x1, [0xd8d, 0x1, 0x0, 0x38fd, 0x9114, 0x0, 0x5, 0x2, 0x3, 0x80, 0x8, 0x2, 0x6, 0x6, 0xfabe, 0x7], 0x3}}, @common=@ah={{0x30}, {[0x4d5, 0x4d4], 0xfffffffc, 0x8, 0x7}}]}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @ipv6=@private0, @port=0x4e24, @gre_key=0xd}}}, {{@uncond, 0x0, 0x100, 0x148, 0x0, {}, [@common=@frag={{0x30}, {[0xb, 0x4], 0x5ecd8cf4, 0x19, 0x3}}, @common=@inet=@length={{0x28}, {0x9, 0xb, 0x1}}]}, @NETMAP={0x48, 'NETMAP\x00', 0x0, {0x15, @ipv4=@dev={0xac, 0x14, 0x14, 0x40}, @ipv6=@remote, @gre_key=0x7, @port=0x4e20}}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x6c8) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ffd000/0x2000)=nil, &(0x7f0000ffc000/0x1000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x1000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f000052e000/0x2000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffd000/0x2000)=nil, 0x0}, 0x68) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet(0xa, 0x801, 0x84) connect$inet(r3, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r3, 0x8) r4 = accept4(r3, 0x0, 0x0, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x4004) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=@updpolicy={0xb8, 0x14, 0x1, 0x0, 0x0, {{@in=@multicast2, @in=@empty, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x80, 0x29}, {0x0, 0xffffffffffffffff, 0x9, 0x0, 0x0, 0x2, 0x100000000}, {0x0, 0x0, 0x0, 0xffffffffffffffff}, 0x7}}, 0xb8}}, 0x10) sendto$inet6(r4, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r4, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f0000001400)={0x0, 0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r4, 0x84, 0x7c, &(0x7f00000005c0)={0x0, 0x2, 0x9}, 0x8) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000000)='dctcp', 0x5) setsockopt$inet6_tcp_int(r7, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r7, &(0x7f0000001b00)="a6", 0x1, 0x20000045, 0x0, 0x0) r8 = openat$tun(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) ioctl$TUNSETIFF(r8, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r9 = socket(0x400000000010, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000380)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x170bd2a, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe5, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0xfffd}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000001300)=@newtfilter={0x78, 0x2c, 0xd27, 0x70bd25, 0x2, {0x0, 0x0, 0x0, r10, {0x0, 0x7}, {}, {0x8, 0x10}}, [@filter_kind_options=@f_fw={{0x7}, {0x44, 0x2, [@TCA_FW_POLICE={0x40, 0x2, [@TCA_POLICE_TBF={0x3c, 0x1, {0xffffffff, 0x0, 0x3, 0x0, 0x8, {0x5, 0x2, 0x0, 0xa, 0xccc}, {0x5, 0x1, 0x0, 0x6, 0x2, 0x4}, 0x1, 0x0, 0x800000}}]}]}}, @TCA_RATE={0x6, 0x5, {0x1}}]}, 0x78}}, 0x0) sendmsg$nl_route(r2, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001800010000000000000000000a000000000000000000000008000400", @ANYRES32=r2, @ANYBLOB="06001500070000000c00168008000100", @ANYRES8=r2], 0x38}}, 0x10) 2m47.718383479s ago: executing program 1 (id=1245): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000002040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000080)=@newlink={0x44, 0x10, 0x503, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @bridge={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_MLD_VERSION={0x5, 0x2c, 0x1}, @IFLA_BR_NF_CALL_IPTABLES={0x5}]}}}]}, 0x44}}, 0x0) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) ioctl$EVIOCGBITSW(r3, 0x80404525, &(0x7f0000000880)=""/220) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000440)={'batadv0\x00', 0x0}) fstat(r3, &(0x7f0000000500)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r3, &(0x7f0000000840)={&(0x7f0000000240)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000800)={&(0x7f0000000680)=@getpolicy={0x170, 0x15, 0xac1c77a6713aeedc, 0x70bd29, 0x25dfdbfb, {{@in=@multicast1, @in=@initdev={0xac, 0x1e, 0x0, 0x0}, 0x4e20, 0x0, 0x4e22, 0x6, 0x2, 0xa0, 0x0, 0xd3, 0x0, 0xee01}, 0x6e6bbe, 0x2}, [@user_kmaddress={0x2c, 0x13, {@in6=@empty, @in6=@ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x34}}, 0x0, 0x2}}, @sec_ctx={0xc, 0x8, {0x8, 0x8, 0x0, 0xfb}}, @policy_type={0xa}, @lifetime_val={0x24, 0x9, {0x5, 0x9, 0x7, 0x912}}, @policy={0xac, 0x7, {{@in=@multicast2, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e20, 0x1, 0x4e24, 0x0, 0xa, 0xa0, 0x0, 0x5c, r4, r5}, {0x1, 0x1, 0x3ff, 0x40, 0x200, 0x3, 0x4, 0x837}, {0x100000001, 0x7e9, 0x7, 0x5}, 0x10000, 0x6e6bbe, 0x2, 0x1}}, @lastused={0xc, 0xf, 0xd}]}, 0x170}}, 0x24044810) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000340)=@ipv6_newrule={0x30, 0x1a, 0x1, 0x0, 0x0, {0x81}, [@FRA_DST={0x14, 0x1, @private2}]}, 0x30}}, 0x0) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = fsopen(&(0x7f0000000200)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r8, 0x1, &(0x7f0000000040)='source', &(0x7f0000001bc0)='//\xf2/\x06\b/\xdf/o\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b\\/\\\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce/\\\xb4L\xf2_\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6h\xd1\x1d\xac\xaa\xfb\xc7Y\xcd\xc5n\xeb\xab\xf70\x99\xef\x8b0x0]}, &(0x7f0000000040)=0x8) getsockopt$inet_sctp_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x2, &(0x7f0000000100)}, &(0x7f0000000300)=0x10) r11 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r11, 0x84, 0x1d, &(0x7f0000000000)={0x1, [0x0]}, &(0x7f00000001c0)=0x8) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r11, 0x84, 0x85, &(0x7f0000000380)={r12, 0x88, "0200000000000000703fcd09bdf0b493d4323725cdcff2eae49f89843a5318d5ba093aa761132b512e8c4eb4eb76aa3f3069d1d5a64a2c75a2d59986feff48dc51b23de50b4c052630642b3348c700b558041310b18d364b87808f6ec3b597fae6ac116b5bc6c564f98676e592103c268225b716a73e48c8c8f8ec21e15e7a5d6743243dfde8a664"}, &(0x7f0000000500)=0x90) getsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r7, 0x84, 0x84, &(0x7f0000000280)={r10, @in6={{0xa, 0x4e21, 0x1641, @private2, 0xfffffff9}}, 0xfff, 0x9}, &(0x7f0000000200)=0x90) socket$kcm(0x10, 0x2, 0x0) 2m46.835384181s ago: executing program 1 (id=1248): r0 = syz_usb_connect$cdc_ncm(0x0, 0x6e, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000020000402505a1a440000102030109025c0002010000000904000001020d0000052406000105240000000d240f0100000000000000000006241a0000000905810300020000000904010000020d00000904010102f2e1d507090582030002800000090503"], 0x0) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0xa1300) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r1, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000300), 0x20042) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r1, 0x40605346, &(0x7f0000000600)={0x0, 0x0, {0x1, 0x2, 0x0, 0x2, 0x100000}, 0x1009}) r3 = open(&(0x7f0000000000)='./file0\x00', 0x402, 0x44) connect$inet6(r3, &(0x7f0000000080)={0xa, 0x4e22, 0x1000, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x1}, 0x1c) ioctl$UI_DEV_SETUP(r3, 0x405c5503, &(0x7f00000003c0)={{0x8, 0x0, 0x2, 0x6}, 'syz0\x00', 0x17}) write$sndseq(r2, &(0x7f0000000140)=[{0x1f, 0x0, 0x0, 0xfd, @tick, {}, {}, @raw32}], 0x1c) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, 0x0, 0x0) r5 = accept4(r4, 0x0, 0x0, 0x800) sendmmsg$alg(r5, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x40) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f0000000340)={0x44, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x20, 0x80, 0x1c, {0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x10, 0x50}}, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r0, 0x0, 0x0) 2m45.931389434s ago: executing program 1 (id=1253): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000002c0)="36c1fefc4a84cb34adfedaf4", 0xc}], 0x1, &(0x7f0000000b40)=ANY=[@ANYBLOB="14000000000000002900000034000000040000000000000014000000000000002900000034000000fdffffff0000000028010000000000002900000004000000042100000000000007100000000102099f000800000000000000fe72f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989e567e4774de1f52d188e0b0888c5801409e12e5f0b6bdcf72f2ec7008a15fa88b025e0ad0740000000010e7a01800500000000000000090000000000000004000000000000000600000000000000040000000000000000040000000000000b0000000000000005020a7e05020bf4c910fc0200000000000000000000000000009311e80ee304ecb784ec4655260cecea14e4980000000000140000000000000029000000340000000000000000000000480100000000000029000000360000005e25000000000000ff2350d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c34b0001000001000108000000000000000007100000000002070600ff7f00000000000008c6c8a110995d439fbfac9716a99c357bcb2d59a850490739734f6b321d19b3754df39cc2dc26cf263cbebbddb9a7f17b6771f74c46623f9e38bd23e6f0a2fd3a9a017f66738394aca44d1a9f0b35d9df0a964360ab0900a5e6fcac1cd41c91c97f6826ff706c41edc4e00205bbb53218ed58a1122d993b55a1b9a870a17e7869e3fc704b388202add651f628963a90fea5d8196d5e0373fd13584ae57b4f1c03d4f67005cdb5938591d5ea712014e358ea0808807873fd7290c6d4f0339e64c7e86ab309f93fd8071800000003040307000000000000000000008000000000000001042bdb86d1001400000000000000290000000b0000000000000200000000180000000000000029000000390000000000000000000000380000000000000029000000390000003a04027000000000ff010000000000000000000000000001ff020000000000000000000000000001"], 0x320}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) capget(&(0x7f0000000080)={0x19980330}, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r5 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x40000000, 0x100000}, 0x0, &(0x7f0000000040)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a9}, 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1, r5}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a0000000000000700000000080017004e224e24050016000000000008000d00050000000c0014"], 0x4c}, 0x1, 0x0, 0x0, 0x4040016}, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/81, 0x0, 0x41000}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r4, 0x4008af22, &(0x7f00000003c0)={0x1, r5}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) 2m45.462916791s ago: executing program 33 (id=1253): sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000740)=[{{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f00000002c0)="36c1fefc4a84cb34adfedaf4", 0xc}], 0x1, &(0x7f0000000b40)=ANY=[@ANYBLOB="14000000000000002900000034000000040000000000000014000000000000002900000034000000fdffffff0000000028010000000000002900000004000000042100000000000007100000000102099f000800000000000000fe72f4a4a3142ee1e12b9826287997a6b33d89f3d60da1641d9fe3896c3c1b6c130ef4f01be8f5836d417874540898619050b14420ab124b11de36afb16ef4fc1cf3f4e4fa0e647cd1b07b068d3894180b6aa7527a4a8252f6836a0d67a7782c675a838ea989e567e4774de1f52d188e0b0888c5801409e12e5f0b6bdcf72f2ec7008a15fa88b025e0ad0740000000010e7a01800500000000000000090000000000000004000000000000000600000000000000040000000000000000040000000000000b0000000000000005020a7e05020bf4c910fc0200000000000000000000000000009311e80ee304ecb784ec4655260cecea14e4980000000000140000000000000029000000340000000000000000000000480100000000000029000000360000005e25000000000000ff2350d650847249ad288702ebd0d654b985e8908defb7ec6c5ff115c58e128b9e3a21c34b0001000001000108000000000000000007100000000002070600ff7f00000000000008c6c8a110995d439fbfac9716a99c357bcb2d59a850490739734f6b321d19b3754df39cc2dc26cf263cbebbddb9a7f17b6771f74c46623f9e38bd23e6f0a2fd3a9a017f66738394aca44d1a9f0b35d9df0a964360ab0900a5e6fcac1cd41c91c97f6826ff706c41edc4e00205bbb53218ed58a1122d993b55a1b9a870a17e7869e3fc704b388202add651f628963a90fea5d8196d5e0373fd13584ae57b4f1c03d4f67005cdb5938591d5ea712014e358ea0808807873fd7290c6d4f0339e64c7e86ab309f93fd8071800000003040307000000000000000000008000000000000001042bdb86d1001400000000000000290000000b0000000000000200000000180000000000000029000000390000000000000000000000380000000000000029000000390000003a04027000000000ff010000000000000000000000000001ff020000000000000000000000000001"], 0x320}}], 0x1, 0x810) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r3 = accept4(r2, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) capget(&(0x7f0000000080)={0x19980330}, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) socket$nl_audit(0x10, 0x3, 0x9) r5 = eventfd(0xfffffff9) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) pselect6(0x40, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x800, 0x40000000, 0x100000}, 0x0, &(0x7f0000000040)={0x1f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6a9}, 0x0, 0x0) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, &(0x7f0000000040)={0x1, r5}) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000540)=ANY=[@ANYBLOB="4c0000002000010000000000000000000a0000000000000700000000080017004e224e24050016000000000008000d00050000000c0014"], 0x4c}, 0x1, 0x0, 0x0, 0x4040016}, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/81, 0x0, 0x41000}) ioctl$VHOST_SET_MEM_TABLE(r4, 0x4008af03, &(0x7f0000000680)) ioctl$VHOST_SET_VRING_ERR(r4, 0x4008af22, &(0x7f00000003c0)={0x1, r5}) ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f0000000000)=0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x3000, 0x2000, &(0x7f0000003000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@text32={0x20, &(0x7f00000000c0)="650f340f3566b842000f00d8b805000000b9a00000000f01c13e0f070fde460b0f0130670f01c2f2360f217a0f07", 0x2e}], 0x1, 0x11, 0x0, 0x0) pwritev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000001880)="ea7c5828b87d70214008724bcae1ce6577c01031b19698ecb8a7f5183947918ce2cc9dc778dbfff9e28e1a6df7d8f95c3e45768a6786d6325bc0fe4ed394c8ed0edcbb9f917074251a7f5b6b24c52516a68f181592262dfd12b5af7386658c5fb6c36d86d5084624a302a155c0463b6c36e9fc88338b0f66e2713728a21d19d9a33da93d419df63d8a87fa100381ec74de8b7409f4977d3cd7a9f2fb03cec91c4277b39b2c9f227a9b74926a11960d085e2aaf98673d2a67fa95b8d9dcc72ca6181f6b9b2d1c402267e6cfef5599e1520077d9bc472fb5a5db42b1befd498ec7b8d519b12f065323b15280a2540bc7a4ffe508fc12f93707064caf4111e893142f9867b432b1e6258caa2ae081b8b646c25de7f5366a21f9dd257b84546cd316e17b79d22c4bcaf70e8a96d1e502b53c581c75482d1d63f0d5f3fb5bdbb714583f0798e0c4d6c9d99513e91a68a26612053290f15f5a2e06acfa229356e37b4d57697224e9561c0430a67fcb5dea72acc91e60751a5b07eb603548a646f082ce213347b4ee908bd95cc56775330aa09d4f19f48a8cb5d7f6346d82bab8ff019309684bd01eb4d90febe2269cd2a1100130c242a2995ce38638a3bbc9008ac0e820a1e0b9a9511af47aa7f3e30a69589985423f3b4ea98152433bf1aa53a0981f783f11c4cc50f70fe63b2043b74b9cb7da59caedadc1fa1f662831a353969893d4f93b919cda52a1ce2200a0a7895abb293c29d6d197cce98a4df8fc90c582014742a00b4bd09f1fcc5ff5753320d2b5593e657c0fb87a4cfa323ce59111eea806a6e020fb0c4fdd601087811e33e793975b5e9e936c16d243bdea757e0ee4508f5d5b496ed07b6f0f1f46ed752448f30d679b23ba8142d4ab25beb913ee77547866e5d9501a55e9797ba3407f3f4cc11398bdaf3ac4c2e79a5b133a09fcf8ae790bb985fa01daf2758fd8a77fde15a822227dddf64bb2ebc49a56ad025e01c6c59e4818abdf808789d9f87c103cf7f7d21d2a1345b9b7fd66b1cf96002343fbd62f8080d945e70bd93d4bf42b401477abed49065b4a8ccfb9d93724118168de2e8df4f78ccf3b9593f993423a619ef6bd8392a2cfc6424d3687fcdc67d33073db95d856f312b934d05a3c4e967217837920fee73b00757b617d1ef3bfc2e88a8a72f0948263db2c9e7bd491f059b6ee8d0ea3f2193314562910529869b248172bfe0f914f7a91a27c6e9e6c2e3455a7ae765392b48fc959958aa39a5a483b2a6e873ac76f8579515e42f7a3bbc82bcf71edaf12f7b40a2adc74d67ef793988cc8ac788185049e57fb84757bdc700ffde10afc19df290787ed98222f8afb2b6d11944666331350e2914466b398750acae526146373b2cbe1bdd1803e6c920a182a1ad118a3d09313c2ce2703a0a1c09215cab90c35b03b1c795cf704f42dd31ddff6be67bb355977b2e07609c5228299a170308e54705674384fc294cdfa4abf989d3c3bf3eabbbcf52a6a0646bf6db5b61ad027007464fd6fc10490ee2e9190c28ae5cb3733105cb782c0d53e5c79c3e455609d557d824154d01e282788ec8ae7c8a03fcd6cd4e37829b0f921c46d715454d5e1281c641cf0756a2f31b0369ce94e819e6254af95b88bffd7bb2cfe9469d303497fead174839b2789b5aa703176510eab1f46916b3b63f6f5b2df262fe7274a0cee9bd6e115e5f9f48ac1c09e5b3c546ae95b9916a633869854d3ee39d4acb800e876e7fc084ffd79a20fca8331caff657ec89b445c6012ff7eb9531eb1e8c90cdc66b82d6fd608310099503a9dcf50b40d10a3b1ab520477e20ad5f6405cd4b5b36d201e12088d7868c6e94737ea88db6ed5f7df4d31cbd2d0c4f21cdcc3b181f5aae7216dc4c06b2989bb44e5369ba96ce87f3e3abbb530d103a53d7e0b914115c302c935eea7d256a73aa851d84dec6d9112163be8135889c67fa90e796a6f050fba0a6a740618cd513748072daac9f3e25034772cc400a14834afbde835bc9fd7cf1113d67ebe99a3b78907596886ad5a1670ef572c18e26c98fe40194428de339cba7b8efc5fa7faf7512ef6b89a877f3e534fb4512729df686e14aece08fab3b42ea14acde0e18ffe5dc00e74288661c7463e00f3b942cddf3b71e1dcf71989f378b933df099316451cca296a4e117bbeb3b1e552e5a10f9731449ae830de14989049ce818f720e77e78a86c307c80450b26278bc25ee7390ce6d4c4dfc8d39b6b4b1ce6f3865dbdd1d37aedb555288bea9ef95c8600dea1cd10e9e42d15aa804f99a31bfaa5ea52185333d734c766e3bb4a9abf86cf4d840dc188167a25cc3054b65fd7ce053d38518474ab55e59c1ccaf34d57b4cd73b07ed63d754ab3d57dfc0f67bbdb22e33d9f63aa2b36cf0af338794d4acbd1b13669bde67f7bd032f9c6b400e8054a0cff77fc6e0591195b21715e42c881e23156b4ba504d7e1b6eb9c2ec9b9e382d85f7c52bd964d305da9496dbaa022880ddf236730c458f31258d64ae2668aa863b3fe558c7f8cfb3dabf42edcaf2891e9b9462c44153658eae85cd499abd9dca762adf26d9904d28b772b3fc3d066d56261474c944387ac7eb00059025ff25e34b8f7c2986db1ccc4297e1315c3ceeef1b8f98e0500bbb8bb0ab52d80f8c6c8fa5d24b9a05f5350e2fd59af4b9fa9a2b4339b61e208f227ba968d4dbd36246133de2078c6a15dd57754a3537c31d04da545f062dbf9cbaa0840e23974f441a4d5937fec23ff81c193bd951a7bacac8eb6d4705702cbe3c930f27869753ba6026455bbb7742c53644f1646d7545467091a207905f831505f214fbd818aea4455705b5e727850cdcac40620135b8dba85cb0c0f393af252ec082cba5c43385fbc2cc5682bc1994b064e29c8c5a20e7e6d15fbb13e6fd1a86b2fda666fbcd80fd08be00a7423fcafbdd8283bac88ead203bc10d1c1a13ca2fe853fa6cc8991b0476561be085b086b0d0e45f73e59f519342c13f368a37464cb55b8a13846f4cd610536d5c4b8704fcd347abe6712d3de67d7918e6954898f31647a8ea37ecc2e1bb02b1b26e7a60fbb2b0a48efc5795c12d5c4ac8dc4149dea0f2e085422ec69352882622711b74e1e32c7ead2cf3c554e8ff1648e8b66d0dc6997b6304b3b560a33d75aa49476175a386ca721156ea79bdba432d439dbceb0285561abd5d134badd9f38c04fae8fa920edfff15705371c907848c14acdfb0b22a4c7168e1840e8b8a50349dcee5f429b3cb34e30f0f67acf93604792b8574f36ea9409d422621f3c0c7b781fc8e23d1d46f04a9b44f633e5f72cb079fbde66a9745705666c6dab6238628e57ee6cffa8cfad616dac1abe2789c9efccb4fc7e65e490d9a4e49e7ce72a6980e72f70a17649e67de86f86b61a4b6219daefc939b5904e5712ecaf85c98484fc02585b1aa990b95173e4a2907cf877af696e528e6b2b634a4fb7d791cacc8644fa76e062148d411e18f0da5aed22116828cd700a28e8f46bca950550acb4ab05eddeb6b2dac24702cff4de0a3ece393cac879ed2f0c5b9645839cfdb79fb1df87596b14504cba9dddda51edaffcd0214b91b5898ea022774e699aa0caf0f646cc0cb8e8fc8b8be43c23aa7f6bd29fd0615c0b78f3514a52989d7f35ad08a4bd473e61da6657cc2e85d3b2b7d3fb51174a96f27038ddbc87a35e09a668e436aa40146c6a26dca87b39220f139b772719d80aadb752c622bf09acd6846838fb48a8817ba4aa72eaa32e82251b3789969d8518f9aa07cdcb9a355f73f119725c086168aaca262f13cd742e5f06c969a462638a557e15a4f5d43e3242c08f23b00d2b8d57c60d3636abd4068ec03a4be3429b95e41351ab5c58812e552df90c3e6c9d8779aa484e74f073ea9fcdce13b1dff8e7c101b2c6865c5cefe108e3559f520e2bc42c9dc39b57fddb44ca49f2689e10c1381c0740d20cbca46da475c62f513cb08398a5fd5d4f6b13ce839fe149df0d291a8f7267fe90a7e1845dace17cd927c2d1aeffbdc36bb983172ceff025e84b0419645fcc72897b992f5081c78756122391947f08ccd20806cfc2bded705b472fc52e84734e016cbd309aadebbbb4e8bdfed77b1e0b15ce0904838d9e4d64643df66f0353c377e554b428dc0f31189a134cdb8e66d2755e84c2b2409c3d63a81f5f05616baf6a243b09153a4f8289e15a5a4ffb007b0cbeffde25391bb2acd86b453e245643c0fa1dfe5d42e0e3f1c592a00b77f0133adf7989c6c2bf3ddc0b8a2b14f35d33f62f4ee2fc56166372058e997b9abe6bad8aa718f8d87ad095e8f354aaef540840437b5451771266a8358ed75954db52b38bca4a1c8696dca1de03b12627254409f8bb68c94eeaa1a8bcf894482b96e81b9ff5c2383a907537a191aff0bb5b5418ef5670cecca1cfbd41b61879b11a5a5053cd86cf5d61f8c2f7d7ad2034a1801b3b92a79ac3b4343c680008b1ba10577a35173cac6d4dbc1d00e436f238b57093b34d4ea19c225b84a2d6086cc6cf72595b980c88142d268bbf9c8375a93afe75c3583b3b9687368d78147985d209e6d89c335e948c51696a948f01ad062dcf84a99584466e24646b2e441fefb10ef962432f2925d6d98e790acf4ca7d9339a589a537aa3392ec79f34a6544144072ab8248e45ac560a78c70c5afcbf10909299dfcd67981c88780c1340c951e115ffec56d23b9ead6a55024e199238f4b133e3e1e0e84318b5037a3947ae09749c25c7e4887936ecf0ba9a807dfa471ea1f3350b70feb58dc9e2836365ce4db456a341e43410cac1253fe08e79c21fca932716f4c171fc957cb325737b70532d81f0eb2f0a16478c0d934165728f7b29a8a0ff6bc964e99dea26d3efd28336b00c112a26da7a2ea1c21a9688cc3a68293958edf27ae89e5f9b8348af4121028e760cf68c931af92906d27dad4d330df9201b5395ccce0c803806422883667ccb11438d9dbe1901d4ab98d89914b313338486deb6f748053517e2188c479adb1eabb8e8ed5d05bb3f66826fae83bbc5bce3615ee32d937ffbe8846a1156aaf7bf9b9d4189bdf290b3df254077688eeda824d6ea0a452f7e7f915c1a94ee250a3907ec035d7ba7bb0256811f04646ca156b8925506c774df4d4072c02929e985057a5f7ddc1469c7306e6fdb86b810ada1cc96f6bd389597dd27dd656f55c316fb2d56b2d13eddf893722e813934a19778719be99697c365222db64039f9caab1201c430e53df1af8a0321c8759fc33e8204150080979936d0717f6c4c9145fb828389acbb894a4600485e8b105c7165a40e814889343deead6d434a8da60eed1e50aa507ac2793b4a4c5517265f859f223bb4f6cadc6fb53430304baea18189e2b5ddd266c38f5c325ba391a50fcd34060d217c4118889c4275e40a8428099ddfa3cc0d8241c22fc1554318e922f3b1257f2046d70df460c5283a539487583ffca1972a19237b06480e0a56d9e185fe4dc3607666d81ed0d9d9f5c5c568a5a0a87160b6d35c73dae9c6177f2b25d90a2598042f4b43bc765fa86a831c401a01c391a8fdc8f8c742f2322a1b8ef18ec7d82f013893c981f6bd96ec57d8e73e1633ae3970721fcea055ecc836ce3", 0xf91}], 0x1, 0x1, 0x2) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000180)=[@text64={0x40, 0x0}], 0x1, 0x18, 0x0, 0x0) 9.955717469s ago: executing program 3 (id=1922): r0 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, &(0x7f0000000040)) (async) ioctl$BTRFS_IOC_QUOTA_RESCAN_STATUS(r0, 0x8040942d, &(0x7f0000000040)) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) ioctl$KVM_CHECK_EXTENSION(r1, 0xae03, 0x2) readv(r0, &(0x7f00000015c0)=[{&(0x7f0000000200)=""/4082, 0xff2}, {&(0x7f00000013c0)=""/113, 0x71}], 0x2) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder1\x00', 0x0, 0x0) (async) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000140)='./binderfs/binder1\x00', 0x0, 0x0) openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$BINDER_GET_EXTENDED_ERROR(r2, 0xc018620b, &(0x7f000001ed80)) r3 = syz_io_uring_setup(0x7408, &(0x7f00000000c0)={0x0, 0x99b8, 0x80, 0x1, 0x9b}, &(0x7f0000000180), &(0x7f00000001c0), &(0x7f0000001200)) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r3, 0x18, &(0x7f0000001240)={0x9, r0, 0x0, {0x0, 0x2}, 0x9}, 0x1) (async) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r3, 0x18, &(0x7f0000001240)={0x9, r0, 0x0, {0x0, 0x2}, 0x9}, 0x1) 9.905892501s ago: executing program 3 (id=1923): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f00000002c0)=ANY=[@ANYBLOB="12010000d0918108ac051582588f0000000109022d00010000000009040000030b08000009058d67c8002a000009050502000000000009058b6e", @ANYRESOCT], 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x400000000010, 0x3, 0x0) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000240)=@generic={0x21, "1aee2c4f6843c6782466293e62d4f664c2efa8906f0d97822ac0d88ecdd9d47e182b3b523c6243022c1be9fd662325c023ac48a28ae996c41561bb7e9903c408613b4d29da0b9d5af499caa7759c17c667af8acea6dc52148f1233494efd8f08aaab6382d5e33471a107ec47df5b5312764e134c68842fd1a2078151812e"}, 0x80, &(0x7f00000009c0)=[{&(0x7f00000002c0)="f973085a6ea39ea1b25a1c6b351e11245900557d1c8e9f86bae5e5c64e50ef25afb0295d0c303850b4bff4d088bf9df67e013836e2882dad3f7698b52997f7efa9eb96f09be1c3019445927c6b2fe32d38ae2bcad2ac0d85ebd42914fb18b7d0670f8b3be16755ead6a6fb713fa618ce2cf424ea7cc84b04016b9a2afbfaf68803f1c1acb74fef", 0x87}, {&(0x7f0000000380)="82f294054d05973abfac6a6f31050418457d017c5fd68b034cf51b9f6a6d71daa5c776bca90037bc7c3d88b151fbf856f69ebd05e750f13f02af646b284953b6640a08c827c6f2ff4ad8e84077f9f03f94792aa17c4743cba3f355bb9c5b04b91ed70d253db68e17cdd561fab504479f723388dda974e2a9fb1bcda474c08d6222179b19e902009ea3cb3e42408bab6c1f29cb62d05805063967de38327e", 0x9e}, {&(0x7f0000000480)="4ce09043b6aa2ae5946f67306c7f73ed469dfcfc5e1f4d8123a4a8a7b9be82f67f89605cd9bbf7254c156b00437f753a248daf68c5ebdc4a6346d336a6502e98eae72777956d1ebeeb855fae46b3ccb9fb3d593651b95ee00afe0816b3c6e7f3cb3b18fb5198643daa6b9cafde584957dd72ba27cef6604f5df59f0bee60bca63d75a9d812eb699c2d665b7179b22027cf748ac63bcc212703d44cb083e962eee9b5d212523c162b42377ebd0bc624bf9425f6f4772e36c6c2fd4f69b65cc435f93c1a490cb75162251e15942b29de8d9d", 0xd1}, {&(0x7f0000000780)="8ff2f15bd0017ce4b36b6bc4335634254cffcc40c0312f5ff35991272b79d76712dc0c3cfdc0d70ce8004884e6917bed9ffee1584df7f06c7bccac71daf78bf3c68b8d5e56357654784bdbc700bceb1049c6a47d53c5ac29f83aed3ae9968fe8", 0x60}, {&(0x7f0000000800)="5193f0b40db29d9ce06f429ed3c2c6405967f1e559f08c35f5e63ad64c2746967cca1bbeaf6206a79c42badb4fb453f294c2932cb5552a5f9c1d633207a53c2f54d98c2f9e4323eac6c20c56e7607d212b210a0325f7c289d1a2552d7a3f2176a47e95bc46471fae9167768d58f22ff10ba3cc2050b1ee838ce9e4ac5a1544fec3e291272cfaaa4817539972fb8bb2ede331312f556ecea24236759bf0d51003477ec489820505cea6045a9939974c6f2ee3815378dc0a620982383e84178b017ba52b", 0xc3}, {&(0x7f0000000900)="a9be9b2ff3a19d5a1226e5243d37d1fd2894c1ae880dc2316aa2d5ad08944c7135eb837eff354282dd5863c051eb7b9b17be0e4fdd6560f3f2c2c04af73a6cb75b5d05d6037f91e8f4f08e90d5313fb91fbdc5acd212f7d8c800a837a0236309d25e82d5767d8df7512b2beb324c2a2fd6f4ed3a3eb7396f02d515396a3be574d721df257dbf0bc39c617c69458d721eb85d0e5372751cd23cc88571f540aa75255a73b8c9cdc2e75edf622add4302f913d9", 0xb2}, {&(0x7f00000000c0)}], 0x7}}, {{&(0x7f0000000a40)=@alg={0x26, 'rng\x00', 0x0, 0x0, 'drbg_nopr_hmac_sha256\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000004c00)}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dcc960678c7b3e71e48befa166d4a5247325fa881fc7857a8caadde6a2ac9cdcc4ead01267dbb4c639d6d8a80f9637e0c2a3f9623478134b943d5fba4f7e0ceed66c93cc8b", 0xe6}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75bd48aa86d41dfdf52e74b442782f530da1263fd0f699776e9459", 0xec}, {&(0x7f0000000580)="8f966bd94d169820f6b844307d323b8c13deaeff91", 0x15}], 0x4, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x9a9}}, @mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}], 0x78}}, {{&(0x7f0000000d80)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @local}, 0x2, 0x3, 0x1, 0x3}}, 0x80, &(0x7f0000000f00)=[{&(0x7f0000000e00)="abc662f2a7dc713d226b612e712df36db5547daf508fb74a679224eba0fe5f05c53081ff6ebac83c264c6deeec6d4546fe7d00337f488ecee46577d71b39e2", 0x3f}, {&(0x7f0000000ec0)="6e20cbe6a4a132117801a95e6fd3ec5771da8352900bb19979b10fe02dd6f981361f62316da7b3f7abc9fbae1ea2", 0x2e}], 0x2, &(0x7f0000000f40)=[@timestamping={{0x14, 0x1, 0x25, 0x5}}], 0x18}}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000640)="f3f4c60f4caeeeb0b0c17aa4", 0xc}], 0x1}}], 0x4, 0x20000044) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) (async) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0xc1842, 0x0) (async) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$DVB_DEMUX_DMX_EXPBUF(r2, 0xc00c6f3e, &(0x7f0000000680)={0x7, 0x0, r3}) signalfd(r4, &(0x7f00000006c0)={[0x7fffffff]}, 0x8) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) (async) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) (async) recvmsg(r6, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r7, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r8, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r9, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 9.056042233s ago: executing program 3 (id=1926): r0 = syz_open_dev$video4linux(&(0x7f0000000180), 0x10001, 0x8000) ioctl$VIDIOC_G_STD(r0, 0x80085617, 0x0) mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil) r1 = ioctl$KVM_CREATE_GUEST_MEMFD(0xffffffffffffffff, 0xc040aed4, &(0x7f0000000000)={0x3, 0x8}) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x700000c, 0x11, 0xffffffffffffffff, 0x180000000) syz_open_dev$usbfs(&(0x7f0000000100), 0x205, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000004c0)=ANY=[@ANYRES32=0x0, @ANYBLOB], 0xb8}}, 0x2c000010) r2 = syz_open_dev$usbmon(&(0x7f0000000080), 0x0, 0x0) r3 = syz_open_dev$usbfs(&(0x7f0000000000), 0x20000007d, 0x0) r4 = dup3(r2, r3, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, 0x0, &(0x7f00000001c0)='GPL\x00', 0xf}, 0x94) ioctl$MON_IOCG_STATS(r4, 0xc0109207, &(0x7f00000001c0)) ioctl$KVM_SET_USER_MEMORY_REGION2(0xffffffffffffffff, 0x40a0ae49, &(0x7f0000000140)={0x1fd, 0x5, 0x0, 0x1000, &(0x7f000055e000/0x1000)=nil, 0x0, r1}) r5 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="540000001200010300000000fefffdff000903004e250100000000000000000001000000fdffffff000000000400"/56, @ANYRES32=0x0, @ANYBLOB="0100000000000000fefffff0000000000800030088000000a1b70f7a15f032d24434e1971f65b0dd0b8013aeaf55f16738f62ebe43c2292c61b6eeab3a99f2a5e092a995e027695102395c5f90eccf8951f0dc054ddb93938c026044bb0fad2e5c94724bd59a67ab108837e33e7ad49f042bee3dc847a314e86c3d6170bd7b7b129a5f3a33a77ef49b8c"], 0x54}, 0x1, 0x0, 0x0, 0x40011}, 0x40000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)) syz_usb_connect(0x2, 0x2d, &(0x7f0000000240)=ANY=[@ANYBLOB="120100000c9768405e0483020b9901e4020109021b000100000000090400fb0160291d00090509a9143c"], 0x0) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000200)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x2, 0x7, 0xfffffe0001000001, 0xfa11, 0xffffffff}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r8 = syz_open_dev$sg(&(0x7f00000004c0), 0x0, 0x20c02) writev(r8, &(0x7f0000000000), 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) 6.471218219s ago: executing program 4 (id=1937): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x2832, 0x2, 0x3}, 0x18, 0x1) r1 = syz_open_procfs(0x0, &(0x7f0000000100)='environ\x00') landlock_restrict_self(r0, 0xf) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)=ANY=[@ANYRES32=r2], 0x7c}}, 0x8040) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000ac4010000060a0b040000000000000000020000004c000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c5920800024000000002140001800b0001006c6f6f6b75700000040002800900010073797a30000000000900020073797a3200000000f70007404884b24b02a8a7758a688958ed60ecfd057e10926ba77e5596b13e43cd4488e4aa68a75f7236ec205b6e4cac2a0d86c336bf07dbe861f4f57bcef92dcf818d532d4475b5daa4dadc1690f228e860bba5a0b5d9bde86862e8f7fc08f0debd4974c6fae7d737a0007ec948ac4d8714ebff6b25648fb910e0d6d07f023cf5fa4051627b9c5b69e265538f9ba683bf172a5ff815afa543c12e550a1bcc9287080c7c12cc89d216c56febb0b06134672ea6b0077c846396169475f271319988f49ec94f2996e5d0e1cb151fb223e556f10fb681d068e055eb34e5f8fc7a524ffe5f4632a6c74ad0fe0b1542497d76a5a4416c47805e001c0005800800014000000008080002"], 0x1ec}, 0x1, 0x0, 0x0, 0x4000840}, 0x0) r3 = landlock_create_ruleset(&(0x7f0000000140)={0x1000, 0x2}, 0x18, 0x1) landlock_restrict_self(r3, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=@newlink={0x44, 0x10, 0x437, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x101, 0x101}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @ip6erspan={{0xe}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_COLLECT_METADATA={0x3e}, @IFLA_GRE_LINK={0x8}]}}}]}, 0x44}}, 0x10) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x1) ioctl$KVM_SET_SREGS2(r7, 0x4140aecd, &(0x7f0000000140)={{0xe566c797b7515b9, 0xffff1000, 0x10, 0x9, 0x7f, 0x7, 0x81, 0xff, 0xe, 0x84, 0x0, 0xb}, {0xd000, 0xd000, 0x10, 0x3, 0xf, 0x7, 0x6, 0x6, 0x1, 0x4, 0x2, 0x5}, {0xf000, 0xe000, 0x4, 0x4, 0x10, 0x81, 0x4, 0x13, 0x5, 0x4, 0x92, 0x80}, {0x200000, 0xeeef0000, 0x9, 0x7, 0x1, 0x40, 0x2, 0x0, 0xfd, 0x29, 0x9, 0x9}, {0xeeee8000, 0xdddd0000, 0xf, 0x9, 0x5, 0x2, 0x7, 0xf5, 0x2, 0x6e, 0x2, 0x8}, {0x4000, 0xdddd1000, 0xe, 0x2, 0x1, 0x5, 0x5, 0x5, 0x1, 0xe, 0x6, 0xa}, {0x10000, 0x10000, 0x4, 0x8, 0xcd, 0x5, 0x5, 0x26, 0x8, 0x6, 0xff, 0x6}, {0xe000, 0x4000, 0x5, 0xe, 0x13, 0x0, 0x3, 0x4, 0x7f, 0x1, 0x0, 0x8}, {0x100000, 0x5}, {0xe000, 0xa7e}, 0x5000b, 0x0, 0xb000, 0x21, 0x7, 0xa800, 0x8000900, 0x1, [0x800000006, 0x7f, 0x3, 0x3]}) r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) move_mount(r8, &(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 6.356751436s ago: executing program 4 (id=1938): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xb, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000ffffff1fb703000001000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0xff5, &(0x7f00000003c0)=""/4085}, 0x94) (async) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x1, 0xb, &(0x7f0000001580)=ANY=[@ANYBLOB="18000000010000000000000008000000180500002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb7020000ffffff1fb703000001000000850000006900000095"], &(0x7f0000000000)='syzkaller\x00', 0x8, 0xff5, &(0x7f00000003c0)=""/4085}, 0x94) r1 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) socket$netlink(0x10, 0x3, 0x0) (async) r3 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)=@bridge_setlink={0x38, 0x13, 0xa2f, 0x70bd2b, 0x25dfdbfc, {0x7, 0x0, 0x68, r2, 0x940, 0x27025}, [@IFLA_LINKINFO={0x18, 0x1a, 0x0, 0x1, @vlan={{0x9}, {0x8, 0x4, 0x0, 0x1, [@IFLA_VLAN_INGRESS_QOS={0x4}]}}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40048d4}, 0x40000) ioctl$DVB_DEMUX_DMX_EXPBUF(0xffffffffffffffff, 0xc00c6f3e, &(0x7f0000000380)={0x3, 0x0, r0}) r5 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000001400)={0x0, 0x10000, 0x10}, 0xc) r6 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000001440)={0x2, 0x4, 0x8, 0x1, 0x80, 0x1, 0x7, '\x00', 0x0, r0, 0x4, 0x5, 0x2}, 0x50) pipe(&(0x7f00000002c0)) (async) pipe(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) fcntl$setpipe(r8, 0x8, 0x80000000) r9 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) r10 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r10, 0x1, &(0x7f0000000380)={0x300a, r9}, 0x0) symlinkat(&(0x7f00000000c0)='./file0\x00', r9, &(0x7f0000000200)='./file0\x00') (async) symlinkat(&(0x7f00000000c0)='./file0\x00', r9, &(0x7f0000000200)='./file0\x00') bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001540)={{}, &(0x7f00000014c0), &(0x7f0000001500)='%pi6 \x00'}, 0x20) (async) bpf$MAP_UPDATE_CONST_STR(0x2, &(0x7f0000001540)={{0xffffffffffffffff, 0xffffffffffffffff}, &(0x7f00000014c0), &(0x7f0000001500)='%pi6 \x00'}, 0x20) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) (async) openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r12 = openat$cgroup_ro(r7, &(0x7f0000000140)='memory.current\x00', 0x0, 0x0) syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) (async) r13 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r13, 0x100000000) r14 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x802) writev(r14, &(0x7f00000000c0)=[{&(0x7f0000000080)="aefdda9d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76641cb010852f426072a", 0x2a}], 0x1) (async) writev(r14, &(0x7f00000000c0)=[{&(0x7f0000000080)="aefdda9d240303005a90f57f07703aeff0f64eb9ee07962c220a2e11b44e65d76641cb010852f426072a", 0x2a}], 0x1) read(r14, &(0x7f0000000240)=""/28, 0xffd2) preadv2(r12, &(0x7f0000000280)=[{&(0x7f00000008c0)=""/211, 0xd3}], 0x1, 0x0, 0x0, 0x0) r15 = syz_open_procfs(0x0, &(0x7f0000000000)='net/raw\x00') preadv(r15, &(0x7f00000026c0)=[{&(0x7f0000000240)=""/4088, 0xff8}], 0x1, 0x15f, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) (async) r16 = syz_open_dev$tty1(0xc, 0x4, 0x1) dup(r16) (async) r17 = dup(r16) write$UHID_INPUT(r17, &(0x7f0000002100)={0xc, {"a2e3ad21ed9b52f91b5d370987f70e06d038e7ff7fc6e5539b3247298b089b0708356d090890e0878f0e1ac6e7049b3350959bfc9a240d2567f3988f7ef319520100ffe8d178708c523c921b1b9b31070d074b0936cd3b78130daa61d8e809ea882f5802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb056d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498be0800000000000000f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6efcffac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c300003e9639e1f59c0ec126c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b8247068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76e0e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c198045651cf4778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9e1ed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c01607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acabdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d73cddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c5409711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff17705037eefcff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e24919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b4b3f0432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf5cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f00080000000000000000b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d53588a0f9455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc15251432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f0da8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d6641d2b84fbf10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7899484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eef05ebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ea4cd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f031755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c7e36bb2f01f00e9cf96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb24ee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) r18 = bpf$MAP_CREATE(0x0, &(0x7f0000001600)=@base={0x6, 0x5, 0x9, 0x8, 0x21040, 0xffffffffffffffff, 0x7, '\x00', 0x0, r0, 0x1, 0x5, 0x1}, 0x50) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000001700)={0x18, 0x11, &(0x7f0000000040)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2606, 0x0, 0x0, 0x0, 0x9}, [@printk={@i}, @btf_id={0x18, 0x5, 0x3, 0x0, 0x3}, @generic={0x0, 0x9, 0x4, 0x70, 0x7f}, @ldst={0x1, 0x1, 0x1, 0x8, 0xa, 0xfffffffffffffffe, 0x4}, @map_idx_val={0x18, 0x8, 0x6, 0x0, 0xb, 0x0, 0x0, 0x0, 0x8}]}, &(0x7f0000000100)='GPL\x00', 0xffffffff, 0xcf, &(0x7f0000000280)=""/207, 0x40f00, 0x22, '\x00', r2, 0x0, r4, 0x8, &(0x7f00000013c0)={0x0, 0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x1, &(0x7f0000001680)=[r5, r6, r8, 0x1, r9, r11, r12, r15, r17, r18], &(0x7f00000016c0)=[{0x0, 0x4, 0x10, 0x3}], 0x10, 0x7}, 0x94) 6.238005886s ago: executing program 4 (id=1939): writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000000200)="1303", 0x2}], 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffa000/0x4000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0x3, 0x20002f7}) (async) r0 = io_uring_setup(0x899, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0x3, 0x20002f7}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1c, 0x3, &(0x7f0000000000)=@framed={{0xdb, 0xa, 0xa, 0xfe00, 0xa0, 0x71, 0x10, 0x1d}}, 0x0, 0xb, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) ioctl$SNDRV_TIMER_IOCTL_START(r0, 0x54a0) 6.156482863s ago: executing program 4 (id=1940): timer_create(0x0, &(0x7f0000000240)={0x0, 0x21, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0xfd8b, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x77359400}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb320a000) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0xa080, 0x0) ioctl$BTRFS_IOC_INO_PATHS(r0, 0xc0389423, &(0x7f0000000500)={0x100000001, 0x28, [0x2, 0x4, 0x7, 0x80], &(0x7f00000004c0)=[0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8b18, &(0x7f0000000000)={'veth1_to_batadv\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x1, 0x5, &(0x7f00000007c0)=ANY=[@ANYBLOB="bf16000000000000b70700000200f0ff4070000000000000480000000000e1ff95000000000000002ba7e1d30cb599e83f040000f300000000bd01212fb56f040026fbfefc41056bd8174b79ed317142fa9ea4158123751c5c652fbc1626cca2a2ad75806150ae0209e62f51ee988e6e06c8206ac6879fc404004900c788b277be1cb79b0a4dcf23d410f6accd3641110bec4e90a634199e07f8f6eb968f200e011ea665c45a3449abe802f5ab3e89cf6cfdffffffb8580218ce740068720000074e8b1715807ea0ca469e468eea3fd2f73902ebcfcf49822775985bf313405b367e81c700000040000000000200000000005335000000143ea70c2ab40c7cb70cc8943a6d60d7c4900282e147d08e0af4b29df814f5691db43a5c00000004000000000089faff01210cce39bf405f1e846c12423a164a330100846f26ad03dd65873d9f87463ad6f7c2e8ee1a39244960b318778f2a047f6d5bc24fef5d7d6155102b1ced1e8019e63c850af895abba14f6fbd7fb5e2a431ab914040000000000010092c9f4609646b6c5c29647d2f950a959cf9938d6dfcb8ed2cbdc2ba9d580609e31c3fa90812a533ce206e7e57a79d6fce424c2204dd418c005479ecab19bdfb15a32a4fd67ce446adb431d07db79240acaf091231b986e77d05d988d6efdffdf48dca02113a38300cabf2b5543ffc166955709009e000000000061629d1822f720ec23812770d72c700a44e113d17088fdd00600000f7889b8c7044f56ff030000000000006cd4970400cac6f45a6922ded2e29514af463f747c08f4010586903500000000000000000000be34cf0f9d640dd782ac0cbc46903243d0d0f4bc7f253d0500000032daaf281c450e64c33aac8ff7e7d1c94c4505a9839688b008c370494f6734b771546d9552d3bb2da0d000000000000000009125c97f0400f5e1671bc5eb7739daa7820a91cb0e732df2ae1d39c747e00a4fbfe8942fa859cd28bdaa1509309926c77fbcb15ec58b42b400005a6b649dd5f13cd776e6c7c4b5c4b0de20e033b378553ead4c8cc530b62c36364e6505992209bdbc6203da7a3797246a6adef071102f0aa2c40095ddd05176f5cb8bd99e1ba0f9568f3e3876bba7bf973334e7919a080000000000000004fb996ad919f7e9672ce107000000ad882f2aead166c94500be902ee7dabc768eb9ec13f334aae90981ecaf5f744f22f2e45afe2c9e8632276cffe5f1fc215c0797d0244cf1ce269d10525745caaa3f77d1b80116cb9a38400242010000000100000091a0116f4693133138583da5e10b434697b0443b7b4ddfb3ace29e16e5a881336aad0974269a1025f2a9a135c0508af1aec2926627b43bba1229a7466bdca64f514b7911458da083e8681916d408d753226a83ae2434ccd3fc508216aea86833030f569d61dc998620fcf4eeb92e7bc511df63c53b82514493b8f3c74f44ba184d40e87612024da1a1ebe316923865f037c01d71b5de81121046d84b18acb5cbea7eecad9b6dd46ed83515cd9f140e5f00019be25b5910a3193e90be231a05fd82e6003969c3f081ff1d0eb50a04d14644234828cbb5aaa0ece702abdd425fa25ae04a2315c89064df633700000000d9e5953ea67310993d01000000000000003ac753358791b1490273ca535e05b11d815237743a5b79ad45de2a3c91257f02c2f30f5513662809073710937ed0055b238f466e1442f8ec7a5b394228035039ceeb452dca75f9ff5332b4c4777a58a0aa9a821667c68549e9da89ad4274ce2d3d7619936768a84a1465fff4eedba55955434f132ab7b8840558b3f918d675a79907a72a8252cd3fbaea5d3006a03507838231a335ae759ed25534f2e90a7def4b3d4af7fd47ab1a701e4b7a7dfc1d12775ed0a31bc7b5855880aa767e68196c7aa5ac115724b6cb8fcebb67719eccd87b06b38566cf61ad2f307a79d2ce9801837bf0bd3af0271de700eef2795d28cb0017000000000000000000e052d93194121b774d21a0317d0346078400004652c769fd3d3e661a2fb5ff0f000002ab2ac4eb3f19c042163e0bdb88b82de384a8055e8b1e24294b0546cce481ff5618b7b9585dbb64d66debf219fa479abf22f3d64fe82e466ea6f27859946e72f80bb1c9cfcde57b79625e2979fe689a5a246cbbdf6ad488f43f46b2536f175f46dfb27d5229467270246ab53616c46edf34c559d3de0c59ca3305e66825715e5e4cd5b54c1b05c09f04337a76a30373baac3ecec91fd546eb7c32dbecb18a308a0004be94dfab28c2a51dc856df0000000000c12254f041804f7f7074356789b1d4dd55f3e045a48241a4ce04d06acb2cf11eab759ba78da5da0f26126d4cf2c73e5f94030000040000000000000000c301985d603403592486204054be3fdda91f9e315886941928e5a8bc1a00e69a98c0a8f7192f6ee93cc4124cf4e7610915efc08c834a44e1d685d6835a40b5bc615949cbcd98d0e68d7eef5d32d5fcc7923d7544fa492aa38717481455e86dcd7816ad8940bd1995369d89ae6eadeb9117e8b94ab422c8d62f858875dccdbc89572231ef5d6df6a9c55f8df763c7c64da7cc017e1e3f5cd4cb9fe6d19b11d4d38239d318016e622b9683b7e46be64dc097982e23462392a0cd05afb2e060fd42ef00dfbd057311aab94f307d10c7a1af0d8e5a0fcb547475d13c0000000000000000f1cc97103d714d1abb901f866d9d629b4fb185f45790517c4a0f5c6a5024e3359e8d83e3f6edf9e2afb5ab59c7b2b45cfb0a3c1303a98e4ed531ac11cca1cd744b431de74c7cd6533adaa8ec749061b2959d53da626aa189781dc1be4d5c81aebc0cada819895b377d6cf0a7878ba99864ae84464744c605646caf2e06b13eba7ba10acf77d91b2297e9573abb0a4da534d735a223626402b308daf7835780fa6f4e410000000000fb00000000000000000000b14952139bd4bdbccc5e334c49584655c4fce8c5bb7c54664aef6d780100358aa54b4b49926c4be9ee4659153d9fa95d07cc4efdab2c5f4503148d0255d0b748366dafe042d78479c21d832e1431ed6d646d13e8e7230300920a5642bbed1dee9b46b6f02e572024ccf3c8edd82660e5d74c22e46af480c300000000000000000000000000000000000044ff72f96f084f4b6cdcb1b4a9d8e9f99f1b85497d0c3df704c8a0034c09caeeb0e34799b755649883539258a7b33dcef15d8fd1953ebaaa3cff81a0de7a05a440f20f6b273ceb8678f10378b670be7504dabd1471355d853292775d0366891f0bcf0a6087ed4f1f25ef52394db3e9d8318bbb9baff3db95bfd68a08ded502cc08a485c804e4fd107a7ca2a64ca081c6b2f7b895cdf98b763ebab9451c65eced6f5f97a541210806d885762ac3150225036c7eccd7a05593abd963f9a02df58085115e54f675e6a08d25b5722cabf989b4bbc562e073b81bae61f05c5e1f90e021340b60cc5fb8fdb09b6d20b0d87a6ed800000000000000000000000000000000006cc6f64f583a26a78f7f417f66c0af32f5194ddfce51e5aff28f621bb2fd2a5ab719823488d6e869b08d3d4ac7950c60144cf77437e29895a23282e3c65e015d1c334832a90ee77d93596e3f12e9ca8c67c7f3c9b66c9cb03edec184ad1d9544c7a3be250e471dca00000078544d79c0efe4094e561eeb26ee4c81106d03c004bc1589ef6e13648999c8735e2634e89aaa90c571fa3c07238697b1db783c52715055445e96995fe3273b0346b03fc742c06aa3947e0d9cf0c99b5e245ede85893112deea8bd3355a32ec15e1242f170a51f28cea4105541e96a52da4984d26bd29cb0623f00c6b0a4c00ad406d729babc9d1550a683c349017a340444000000000000000000000920ca49f7cc8194aaebdcae5a62bb7587b57f41f1c2034911f23e6bd0291b3319f03a0a15dea685a8ab75b3c60391afa5483231305402b52a8f98638009c142751518f73a847ca583e855d70c6a4a53f61ad753d5e740db44afd32b019d9e8b41361c2c1b9a8a1"], &(0x7f0000000140)='GPL\x00'}, 0x94) syz_usb_connect(0x2, 0x47, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000a3233910daa658744d2d010203010902350001080010000904df0003080662ff09050c02200006060309050710003e8fad67020102070824"], 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000001340)=@raw={'raw\x00', 0x8, 0x3, 0x500, 0x340, 0x11, 0x148, 0x340, 0x0, 0x468, 0x2a8, 0x2a8, 0x468, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x2f8, 0x340, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'ip_vti0\x00', {0x0, 0x0, 0x3f, 0x0, 0x88000000, 0x3, 0x7}}}, @common=@unspec=@bpf1={{0x230}, @fd={0x2, 0x0, r2}}]}, @unspec=@CT0={0x48, 'CT\x00', 0x0, {0x11, 0x0, 0x0, 0x0, '\x00', {0x7}}}}, {{@uncond, 0x0, 0xe8, 0x128, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@osf={{0x50}, {'syz0\x00', 0x0, 0xd, 0x0, 0x2}}]}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x5, 0x3, {0xff}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x560) r3 = open(&(0x7f0000000280)='.\x00', 0x0, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r3, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x1, 0xfffe}) fremovexattr(r3, &(0x7f0000000000)=@known='system.posix_acl_default\x00') socket$inet6_tcp(0xa, 0x1, 0x0) connect$unix(0xffffffffffffffff, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$USBDEVFS_DISCONNECT_CLAIM(0xffffffffffffffff, 0x8108551b, &(0x7f0000000380)={0x0, 0x0, "5a77bd318786aeb879ca62cdab2a0000000086d85b25a5665a3247e500f61681905db88235f8a5447dd2a2ed6e91626f068881e50f6853772b21a100efb76cba37ff3111d6847e8b9398a646717af75fc008daefba68e6222103472bc55704cdb72b4b996ed831f3b802549db3a8ffff7d34171113d806726615380fe65a6a0a72e1ac2b60bd6276fd8bb6363d10f70da60fd53ded22c87eb2be010e4a62fb73c33424b437bb192c9d06ea6ed04983fe5c5ca033dfce0a82575ef14eee686be0fc58e384f93a13f4e8bbf599394baea3a9ca1864f0a35d6cc38fca32ad6b39905a9727d2001457df7be7e1aefe363590d1f600"}) ioctl$FE_SET_TONE(r3, 0x6f42, &(0x7f00000001c0)=0x1) ioctl$USBDEVFS_CLEAR_HALT(0xffffffffffffffff, 0xc0105502, 0x0) setsockopt$inet_sctp6_SCTP_DELAYED_SACK(0xffffffffffffffff, 0x84, 0x10, &(0x7f0000000200)=@assoc_value, 0x8) ioctl$TCSETA(r3, 0x5406, &(0x7f0000000180)={0x8, 0x9, 0x7, 0x7, 0xd, "98bc04bb684418c4"}) 5.915261139s ago: executing program 3 (id=1941): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket(0x2, 0x80805, 0x0) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r2, 0x84, 0x1a, &(0x7f0000000080), &(0x7f0000000100)=0x8) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000400)={[0x2, 0xffffffffffff8000, 0xb, 0x0, 0xd802, 0x5, 0xff, 0xfffffffffffffff8, 0xffffffffd3d32f95, 0xd, 0x7fffffff, 0x80000001, 0x5, 0x1, 0x5, 0x97], 0xc000, 0x82}) (async) r3 = syz_open_dev$radio(&(0x7f0000000940), 0xffffffffffffffff, 0x2) ioctl$VIDIOC_QUERYMENU(r3, 0xc02c5625, &(0x7f0000000040)={0x98f904, 0x2, @value=0x5}) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x3, 0x0, 0xfffffe0000000001, 0xfa0f, 0xffffffff}, 0x0) (async) r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x8801) fstatfs(r4, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000240)={&(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0], &(0x7f0000000200)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x40000000000002b3, 0x6, 0x1, 0x7}) ioctl$DRM_IOCTL_MODE_RMFB(r4, 0xc00464af, &(0x7f0000000380)=r5) (async) socket$igmp(0x2, 0x3, 0x2) r6 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r6, 0xc08c5332, &(0x7f00000002c0)={0x9, 0x0, 0x0, 'queue0\x00', 0x2}) (async) r7 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000080), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TIMER(r7, 0x40605346, &(0x7f0000000180)={0x0, 0x0, {0x3, 0x2, 0xd3f, 0x2, 0x6}, 0x8}) (async) r8 = openat$ttyS3(0xffffffffffffff9c, 0x0, 0x48000, 0x0) setsockopt$IP_VS_SO_SET_FLUSH(r0, 0x0, 0x485, 0x0, 0x0) (async) ioctl$TIOCMGET(r8, 0x5415, &(0x7f0000000280)) (async) connect$tipc(0xffffffffffffffff, 0x0, 0x0) (async) ioctl$sock_SIOCETHTOOL(0xffffffffffffffff, 0x8946, &(0x7f0000000100)={'bond0\x00', &(0x7f00000001c0)=@ethtool_perm_addr={0x4b}}) (async) connect$rds(0xffffffffffffffff, 0x0, 0x0) (async) r9 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r9, 0xae60) 5.6689658s ago: executing program 6 (id=1943): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x20040, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r4, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r4, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(r4, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback, 0x2}, 0x1c) sendmmsg$inet6(r4, &(0x7f0000000200)=[{{&(0x7f0000000580)={0xa, 0x4e23, 0x1, @loopback}, 0x1c, &(0x7f00000006c0)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x8020) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r4, 0x84, 0x77, &(0x7f0000000000)={0x0, 0x3}, 0x8) quotactl_fd$Q_GETNEXTQUOTA(0xffffffffffffffff, 0xffffffff80000900, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x7a, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, &(0x7f0000000540)) ioctl$KVM_RUN(r5, 0xae80, 0x0) sendmsg$NL80211_CMD_SET_NOACK_MAP(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40005}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000003, 0x20000000ec072, 0xffffffffffffffff, 0x0) r6 = socket$rxrpc(0x21, 0x2, 0x2) bind$rxrpc(r6, &(0x7f0000000100)=@in4={0x21, 0x1, 0x2, 0x10, {0x2, 0x0, @empty}}, 0x24) 5.395535732s ago: executing program 0 (id=1944): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) (async) r1 = syz_usb_connect(0x1, 0x24, &(0x7f0000000200)=ANY=[], 0x0) (async) r2 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000640)=ANY=[@ANYBLOB="1201000000000040341d0a0000000000000109022400010000000009040000010300000009210000000122030009058103"], 0x0) syz_usb_control_io$hid(r2, 0x0, 0x0) (async) syz_usb_control_io(r2, &(0x7f00000008c0)={0x2c, &(0x7f0000000100)={0x20, 0x8, 0x4, {0x4, 0x5, "301b"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) (async) syz_usb_control_io(r1, 0x0, 0x0) (async) syz_usb_control_io$uac1(r1, 0x0, &(0x7f00000004c0)={0x44, &(0x7f0000000000)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$uac1(r1, 0x0, 0x0) (async) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000840)={0x44, &(0x7f00000000c0)=ANY=[@ANYBLOB="40121c001a88e5aabf0000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r1, 0x0, 0x0) (async) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) (async) syz_usb_control_io$rtl8150(r1, 0x0, 0x0) (async) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) (async) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket(0x400000000010, 0x3, 0x0) (async) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000bc0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0x2}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x0, 0x3}}}]}, 0x38}}, 0x0) r7 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_int(r7, 0x107, 0xa, &(0x7f00000000c0)=0x2, 0x4) (async) setsockopt$packet_tx_ring(r7, 0x107, 0xd, &(0x7f0000000100)=@req3={0x10000, 0x100000001, 0x10000, 0x1}, 0x1c) (async) r8 = socket$kcm(0x10, 0x2, 0x4) sendmsg$kcm(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000180)="39000000140081ae10003c000500018311001f9f660fcf066505acb612f691f3bd3508abca1be6eeb89c44ebb37358582bdbb7d553b4e92155", 0x39}], 0x1}, 0x0) (async) sendmsg$nl_route_sched(r4, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x84, 0x2c, 0xd27, 0x30bd29, 0x25dfdc00, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {}, {0x8, 0xf}}, [@filter_kind_options=@f_matchall={{0xd}, {0x50, 0x2, [@TCA_MATCHALL_ACT={0x4c, 0x2, [@m_gact={0x48, 0x1, 0x0, 0x0, {{0x9}, {0x1c, 0x2, 0x0, 0x1, [@TCA_GACT_PARMS={0x18, 0x2, {0x9, 0x400, 0x20000008, 0x6, 0x7}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x3}}}}]}]}}]}, 0x84}, 0x1, 0x0, 0x0, 0x20000010}, 0x20000000) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000280)=@newtfilter={0x40, 0x2c, 0xd27, 0x70bd24, 0x25dfdbfc, {0x0, 0x0, 0x0, r9, {0x4}, {}, {0x6, 0xffff}}, [@filter_kind_options=@f_matchall={{0xd}, {0x4}}, @TCA_CHAIN={0x8, 0xb, 0x2}]}, 0x40}, 0x1, 0x0, 0x0, 0xc858}, 0x80) (async) sendmsg$nl_route_sched(r3, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000002c0)=@gettfilter={0x24, 0x2e, 0x205, 0x70bd2c, 0x25dfdafd, {0x0, 0x0, 0x0, r9, {0xc, 0xc}, {0x0, 0xfff1}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000801}, 0x4041080) 5.39504448s ago: executing program 5 (id=1945): socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) pipe(&(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) write(r3, &(0x7f0000000340), 0x11000) read$FUSE(r2, &(0x7f0000000540)={0x2020}, 0x2020) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000040)={0x38, 0x0, 0x1, 0x401, 0x0, 0xa9, 0x8000000000000000, 0x8, 0x7, 0x8000003}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc1002}]}) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = shmget$private(0x0, 0x800000, 0x880, &(0x7f0000173000/0x800000)=nil) r6 = syz_io_uring_setup(0x3bd7, &(0x7f0000000180)={0x0, 0xcc19, 0x1, 0x6, 0x30e, 0x0, r4}, &(0x7f0000000100), &(0x7f0000000200), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r6, 0xc, 0x0, 0x0) io_uring_enter(r6, 0x2e6f, 0x8555, 0x2, 0x0, 0x0) r7 = socket$inet6(0xa, 0x3, 0xfffffffe) socket(0x2d, 0x2, 0x0) ioctl$sock_inet6_SIOCSIFDSTADDR(r7, 0x8918, &(0x7f0000000080)={@private2, 0x29}) shmctl$IPC_RMID(r5, 0x0) ioctl$VHOST_SET_VRING_BASE(0xffffffffffffffff, 0xaf01, 0x0) io_uring_register$IORING_REGISTER_FILES(0xffffffffffffffff, 0x20, &(0x7f0000000000), 0x0) syz_open_procfs(0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r8 = openat$cuse(0xffffffffffffff9c, &(0x7f0000002580), 0x2, 0x0) read$FUSE(r8, &(0x7f0000004640)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_LSEEK(r8, &(0x7f0000002d40)={0x18, 0x0, r9, {0xffffffffffffffff}}, 0x18) epoll_create1(0x0) lseek(0xffffffffffffffff, 0xa3d2, 0x0) 4.891995108s ago: executing program 0 (id=1946): r0 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r0, 0x10e, 0xc, &(0x7f0000000040)={0x5}, 0x10) sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB="300000001a00010100000000fbdbdf250a0000000304000500cf"], 0x30}, 0x1, 0x0, 0x0, 0x48030}, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r1 = socket(0x400000000010, 0x3, 0x0) syz_usb_connect(0x1, 0x3d, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320000980070705ab0b78"], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) writev(r2, &(0x7f0000000480)=[{&(0x7f0000000040)="90e7bc", 0x3}, {0x0}, {&(0x7f00000000c0)="4af011a9248e03bb2373087ae4012f0f8fb522a49b8701eecb8d02bd1ee4a379b59abe2494c93e0546e8a4a30f7f5df0998931164144077f2e88c8907363", 0x3e}, {0x0}], 0x4) sendmmsg$sock(0xffffffffffffffff, &(0x7f0000003b40)=[{{&(0x7f0000000a40)=@alg={0x26, 'hash\x00', 0x0, 0x0, 'blake2b-512\x00'}, 0x80, &(0x7f0000000600)=[{&(0x7f0000004c00)}, {&(0x7f0000000ac0)="3eb85e3024a2953147f5444738e1388e15fef01893884c2eeb5c559f4a030ee6b08fca1e38ee56dac9cbbea3d6d43e34d9daf81d45289d2bc841e2c4c7072582b15ce7ff3e22b0f19d8a2643280daeb9791b2d0f9b216a0fda4f30804b739da3cce1691d6d88ff52d3e43b26d935d69e99673e98e92fe2fd18e63d4d5699814d9843367774e155678592d0eec07073e851f50827bde418748aa0741684fe603e34dcc960678c7b3e71e48befa166d4a5247325fa881fc7857a8caadde6", 0xbd}, {&(0x7f0000000bc0)="61275006ed747229311198ab94c7e6699587b0d033c2f17d1ccbd45cba520b6888fbad95d4d6ae3cc7172b392f90693e992e52408ba7f1874d1767303d6acb170f216f71908f53a3be1833a25eb1fb2ba3913dcc1de30c5c7e914b13514dea44fb2b964aaa280d5a85512fede48830ca6ea5cd18ff95c871d91454240f370e0c8e2629e58605c4b29017a160709ec76547c92a21d0ec5589e228922b105d0b8b29256620c44d2118334025dedd46db5194f22b349264de22068d3d4db627db4fa827907e5bc02b69c36e94f8149f12116f75bd48aa86d41dfdf52e74b442782f530da1263fd0f699776e9459e33fe5", 0xef}], 0x3, &(0x7f0000000cc0)=[@mark={{0x14, 0x1, 0x24, 0x4}}, @timestamping={{0x14, 0x1, 0x25, 0x101}}, @txtime={{0x18, 0x1, 0x3d, 0x2}}, @txtime={{0x18, 0x1, 0x3d, 0x80}}], 0x60}}, {{&(0x7f0000000d80)=@pppol2tp={0x18, 0x1, {0x0, r1, {0x2, 0x4e23, @local}, 0x2, 0x3, 0x1, 0x3}}, 0x80, 0x0, 0x0, &(0x7f0000000f40)=[@timestamping={{0x14, 0x1, 0x25, 0x5}}], 0x18}}, {{0x0, 0x0, &(0x7f0000003a40)=[{&(0x7f0000000640)="f3f4c60f4caeeeb0b0c17aa4", 0xc}], 0x1}}], 0x3, 0x20000044) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000200)={'vlan1\x00'}) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x100, 0x0) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, 0x0, 0x0) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000004c0)="2c385a7af3be", 0x6) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3", 0x8}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r7 = socket$inet6(0xa, 0x400000000001, 0x0) r8 = openat$tcp_congestion(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) write$tcp_congestion(r8, &(0x7f0000000140)='lp\x00', 0x3) getsockopt$inet_int(r7, 0x0, 0x13, 0x0, &(0x7f0000000040)) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000001380)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000dc0)=ANY=[@ANYBLOB, @ANYRES16=r6, @ANYBLOB="01000000000000e14f003b000000", @ANYRES32=r9, @ANYBLOB="d50633008000009effffffffffff080211000001"], 0x6f4}}, 0x0) setsockopt$inet_sctp6_SCTP_NODELAY(r0, 0x84, 0x3, &(0x7f0000000000)=0x2, 0x4) r10 = inotify_init1(0x80000) inotify_add_watch(r10, &(0x7f0000000200)='./cgroup\x00', 0x4000002) ioctl$SIOCGSTAMPNS(r0, 0x8907, &(0x7f00000000c0)) 3.275014331s ago: executing program 6 (id=1947): r0 = socket(0x10, 0x803, 0x0) getsockname$packet(r0, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000000c0)=0x14) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="4800000010003704000000000500000000000000", @ANYRES32=r1, @ANYBLOB="c3040580000000002800128008000100677265001c00028005000a000000000008000700ac1414aa0500130001"], 0x48}, 0x1, 0x0, 0x0, 0x4000000}, 0x48000) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000480)=ANY=[@ANYBLOB="50000000100001002abd7000fcdbdf2500000000", @ANYRES32=r2, @ANYBLOB="0000000080000000140003007465616d30000000000000000000000008000400d400000014001680100001800c000900"], 0x50}}, 0x20000010) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x0, 0x0) bind$vsock_stream(r3, &(0x7f0000000040)={0x28, 0x0, 0xffffffff, @hyper}, 0x10) 3.099811249s ago: executing program 3 (id=1948): syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) (async) r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000000000207d1e5a2d00000000000109022400010000000009040000010300000009210000000122080009058103"], 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYRES16=r0], 0x7c}, 0x1, 0x0, 0x0, 0x8851}, 0x0) (async) sendmsg$NFT_BATCH(r1, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYRES16=r0], 0x7c}, 0x1, 0x0, 0x0, 0x8851}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000000105000300060000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x2000c0c2) (async) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000540)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a80000000060a0b0400000000000000000200fffe540004802800018007000100637400001c0002800800014000000002080002400000000105000300060000002800018007000100637400001c0002800800024000000011080004400000000c05000300010000000900010073797a30000000000900020073797a32"], 0xa8}, 0x1, 0x0, 0x0, 0x840}, 0x2000c0c2) syz_usb_control_io$hid(r0, 0x0, 0x0) (async) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000140)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="002208000000a20100c3"], 0x0}, 0x0) r2 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0xd2101, 0x0) ioctl$TIOCSPTLCK(r2, 0x40045431, &(0x7f0000000040)=0xc00004) ioctl$TIOCGPTPEER(r2, 0x5441, 0x2) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_int(r3, 0x29, 0x1a, &(0x7f0000000100)=0x8001, 0x4) bind$inet6(r3, &(0x7f00000000c0)={0xa, 0x4e23, 0xa, @empty, 0x9}, 0x1c) sendmmsg$inet6(r3, &(0x7f0000000480)=[{{&(0x7f0000000040)={0xa, 0x4e23, 0xb, @loopback, 0x1}, 0x1c, &(0x7f0000000380)=[{&(0x7f0000000140)='2', 0x1}], 0x1}}], 0x1, 0x0) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r4, 0x84, 0x7, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e23, 0x100002, @ipv4={'\x00', '\xff\xff', @local}, 0xffff}, 0x1c) (async) bind$inet6(r5, &(0x7f0000000140)={0xa, 0x4e23, 0x100002, @ipv4={'\x00', '\xff\xff', @local}, 0xffff}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000000680)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0xab, @loopback, 0x8}, 0x1c, &(0x7f0000000780)=[{&(0x7f0000000900)='2', 0x1}], 0x1}}], 0x1, 0x20000014) shutdown(r5, 0x1) r6 = syz_open_dev$dvb_dvr(&(0x7f0000000240), 0x0, 0x13f) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r7 = accept$inet(r6, &(0x7f00000002c0)={0x2, 0x0, @empty}, &(0x7f0000000300)=0x10) setsockopt$IP_VS_SO_SET_ADDDEST(r7, 0x0, 0x487, &(0x7f00000003c0)={{0x67, @empty, 0x4e21, 0x1, 'sh\x00', 0x20, 0x4, 0x56}, {@remote, 0x4e20, 0x4, 0x7, 0x1000, 0xfffffffa}}, 0x44) pselect6(0x40, &(0x7f0000000100)={0x3f, 0x0, 0x1000, 0x0, 0x131c, 0x0, 0x0, 0x8}, 0x0, 0x0, 0x0, 0x0) r8 = syz_io_uring_setup(0x76b0, &(0x7f0000000140)={0x0, 0x5769, 0x3f4669eb517dfbe3, 0x3, 0x37d}, &(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000280)) socket$packet(0x11, 0x3, 0x300) io_uring_register$IORING_UNREGISTER_IOWQ_AFF(r8, 0x12, 0x0, 0x0) syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x80800) (async) r9 = syz_open_dev$hiddev(&(0x7f0000000080), 0x0, 0x80800) ioctl$HIDIOCGCOLLECTIONINFO(r9, 0xc0104811, 0x0) (async) ioctl$HIDIOCGCOLLECTIONINFO(r9, 0xc0104811, 0x0) 2.975244712s ago: executing program 4 (id=1949): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r5 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_G_FMT(r5, 0xc0d05604, &(0x7f00000001c0)={0x5, @win={{0x5, 0x2, 0x1, 0x7fff}, 0x8, 0x40, 0x0, 0xfff, 0x0, 0x8}}) (async, rerun: 32) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x20, 0xffffffff}, 0x0) (async, rerun: 32) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) (async) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) (async, rerun: 32) add_key(&(0x7f0000000280)='rxrpc\x00', 0x0, &(0x7f00000000c0)="010000000600275eaea4ca5826d8f50ee7f9ff0000006bb57ae0fffc5aadff07000088d18ee9cb1a75d14ff5cf5ad0ca816f40a8333c3532a19673b6dab6301fd45fb0393b6c91a6449faf9de0d0f990dbac85a3b278a5463e299aabc5b97b20e57a6bcb82dfe970afdaab4a", 0x6c, 0xffffffffffffffff) (rerun: 32) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x138, 0x10, 0x1, 0xfffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private1={0xfc, 0x1, '\x00', 0x1}, 0x1, 0x714, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x192, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0xfffffffffffffffe}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3505, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x138}, 0x1, 0x0, 0x0, 0x8801}, 0x0) (async) r7 = syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f00020000000905050200de7e001009058b1e20"], 0x0) syz_usb_control_io$uac1(r7, 0x0, &(0x7f0000000540)={0x44, &(0x7f00000005c0)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async, rerun: 32) r8 = openat2(0xffffffffffffffff, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200)={0x0, 0x82, 0x9}, 0x18) (rerun: 32) ioctl$SNDCTL_SYNTH_ID(r8, 0xc08c5114, &(0x7f00000002c0)={"e5c471ee395784846345a23ed58b0957ba9ce69597b3b54e4706d0fa305e", 0x5, 0x2, 0x401, 0x3, 0xfffffc2a, 0x5, 0x2, 0x1, [0xc, 0x80, 0x1, 0x0, 0x5, 0x6, 0x5, 0x9, 0xffffffff, 0x6, 0x881d, 0x0, 0x6, 0x8, 0x0, 0x6, 0x6, 0x2, 0x3]}) r9 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$FS_IOC_GETVERSION(r9, 0x5b24, 0x0) (async, rerun: 32) sendmsg$nl_route(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000000140)=@newlink={0x50, 0x10, 0x503, 0xfffffffc, 0x0, {0x0, 0x0, 0x0, 0x0, 0x21111, 0x8831}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @macsec={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_MACSEC_CIPHER_SUITE={0xc, 0x4, 0x80c20001000004}, @IFLA_MACSEC_WINDOW={0x8, 0x5, 0x7ffffffe}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x48890}, 0x0) (async, rerun: 32) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x4, &(0x7f0000006680)) (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) (async, rerun: 32) r10 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) (rerun: 32) fsync(r10) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) migrate_pages(0x0, 0x5, 0x0, &(0x7f0000000080)=0x272) (async) socket$inet_udp(0x2, 0x2, 0x0) 2.738617528s ago: executing program 6 (id=1950): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$read(0xb, r2, &(0x7f0000002300)=""/4108, 0x100c) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xd, 0x3}, 0x0) setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, 0x0, 0x0) r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r6, 0x8933, &(0x7f0000000100)={'batadv0\x00', 0x0}) r8 = syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r6, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x1c, r8, 0x303, 0x70bd28, 0x0, {0xa}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r7}]}, 0x1c}}, 0x0) sendmsg$BATADV_CMD_GET_MCAST_FLAGS(r5, &(0x7f00000002c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000240)={&(0x7f0000000300)=ANY=[@ANYBLOB="24000000a041f6c9bf69b567427cca6305cc22045d5ca3782ee385ea937f311bdeb9bd9730c8e9304caf6e5626", @ANYRES16=r8, @ANYBLOB="010026bd7000fbdbdf250e00000005002e000000000005002f0000000000"], 0x24}, 0x1, 0x0, 0x0, 0x40}, 0x20048040) r9 = openat$mice(0xffffffffffffff9c, &(0x7f0000001580), 0x40580) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r10 = add_key$fscrypt_v1(&(0x7f0000002e40), &(0x7f0000002e80)={'fscrypt:', @desc4}, &(0x7f0000002ec0)={0x0, "ea3d44c1153597ed27b8123fae53940b4ead6634607d5d6a4e20bacc9458a97062e2819310bd0b759212f0d12845896e21c15479910adfa38266dabe453348ed", 0x1d}, 0x48, 0xfffffffffffffffd) keyctl$KEYCTL_WATCH_KEY(0x20, r10, r9, 0x74) fchdir(r5) close(r5) open(&(0x7f00000001c0)='./file0\x00', 0x80ff, 0x84) 2.473532544s ago: executing program 5 (id=1951): bind$inet6(0xffffffffffffffff, &(0x7f0000000500)={0xa, 0x4e20, 0xffffffff, @empty, 0x4}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000100)={@local, @multicast, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x1, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x4e24, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x1, "65a252e7cb7a5918c004a9971a46afced2c32642b1ec9fe34818d8ccd82041b7", "c930713c550e74ee13c2638ac75b2a9666efd31a34fce4498df8105d8bd8ed283a220c3a9becd8a70d3607ea8270d351", "ae12e16b560f2f8ac4ca3e745ce285f12f6e8719e7f1e7f286a68f76", {"980aa8fb8f80d69f1fb587086447e93e", "55e824bb69e833bd36300b088233545a"}}}}}}}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) (async) r0 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file1\x00', 0x8042, 0x0) (async) r1 = socket$kcm(0x29, 0x2, 0x0) write$cgroup_pressure(r1, &(0x7f0000000140)={'full'}, 0xfffffdef) setsockopt$sock_attach_bpf(r1, 0x1, 0x31, &(0x7f0000000800), 0x4) (async) fcntl$setlease(r0, 0x400, 0x0) (async) fcntl$getflags(r0, 0x401) (async) ioctl$FE_SET_FRONTEND(r0, 0x40246f4c, &(0x7f0000000000)={0x4, 0x1, @qpsk={0xfc2, 0x15}}) (async) readv(0xffffffffffffffff, &(0x7f0000001640)=[{0x0}, {&(0x7f00000001c0)=""/6, 0x6}], 0x2) 2.219896819s ago: executing program 0 (id=1952): ioctl$XFS_IOC_DIOINFO(0xffffffffffffffff, 0x800c581e, &(0x7f0000000400)) (async) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x4, 0x0, 0x806, 0x5, 0xffffffff}, 0x0) socket$kcm(0x10, 0x400000002, 0x0) r4 = openat$kvm(0x0, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_VM(r4, 0xae01, 0x1) (async) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB], &(0x7f0000003ff6)='GPL\x00', 0x9}, 0x94) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x40000c0) (async) r5 = openat$binfmt_register(0xffffffffffffff9c, &(0x7f00000026c0), 0x1, 0x0) writev(r5, 0x0, 0x0) (async) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f00000000c0)="b8001800000f23d00f21f8353000000e0f23f83e0fae8d001000000fd8e866baf80cb84a8cce8cef66bafc0cec26640f23dbc7442400b30d45d5c744240204000000c7442406000000000f011c2466baf80cb8dc759680ef66bafc0c66b8134266ef66ba4300ec0f0f49e4b70fbaa70a0000000d", 0x74}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text32={0x20, 0x0, 0x9}], 0x1, 0x1, 0x0, 0x0) (async) r6 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000340)=ANY=[@ANYBLOB="120100001ddf8208c007121522300000000109021b0001000000010904010001faf40d00090582239f"], 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x800000000000) (async) syz_usb_disconnect(r6) ioctl$BTRFS_IOC_BALANCE_PROGRESS(r7, 0x84009422, 0x0) (async) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)) (async) sendmsg$nl_route(r0, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=@ipv6_newrule={0x74, 0x20, 0x1, 0x70bd2b, 0x25dfdbfe, {0xa, 0x14, 0x30, 0x0, 0x29, 0x0, 0x0, 0x7, 0x10000}, [@FIB_RULE_POLICY=@FRA_PROTOCOL={0x5, 0x15, 0x1}, @FRA_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @local}}, @FRA_DST={0x14, 0x1, @private2={0xfc, 0x2, '\x00', 0x1}}, @FRA_SRC={0x14, 0x2, @empty}, @FRA_DST={0x14, 0x1, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010102}}]}, 0x74}, 0x1, 0x0, 0x0, 0x4}, 0x8044) (async) r8 = socket$nl_generic(0x10, 0x3, 0x10) (async) pipe(&(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) write(r9, &(0x7f0000000340), 0x11000) (async) sendmsg$inet6(r9, &(0x7f0000000380)={&(0x7f0000000000)={0xa, 0x4e22, 0x0, @mcast2, 0xe7}, 0x1c, &(0x7f00000001c0)=[{&(0x7f0000000100)="25f45ecfb98141ff13954349de1c6c327f75844dd2c20e62dd68001582432565e74ead6b5336f0bb104ccdf15ff40766dc2acc7feff0c8e9422cc981186fd3dd467bd539fc641d23cae1c7492d72a05ff9a41bf7c2654ae2c1580f9fa45bd183b6955b44e0c76deffcde2d9bfd51d9ef11b59e4f36457edc03e3f535772d399062a9", 0x82}], 0x1, &(0x7f0000000240)=[@hopopts_2292={{0xc8, 0x29, 0x36, {0x0, 0x15, '\x00', [@padn={0x1, 0x9, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}, @generic={0x8b, 0xa1, "513ad749a6523b46cec77634cf4152ed6f6c70b753f4929b2f6b3549c969d8e772728eaebc0445cedb4b26dddfb2b1a896167628d1df7a1e61b18efbe01ea939bb3a0c96c8613b156b186821fcdca7cc8a8f7ebd44fdd592ce354ad1beea03f856e7ecbc70a7fcf3ad4a2f80c2c38fe5e84bf0d1b2290d265db270692508612e7157030ed6a2a16015b9e2cb7538fec09341abcb4b60d86ef850e9fc0a6f6fcd4b"}]}}}, @rthdrdstopts={{0x30, 0x29, 0x37, {0x87, 0x2, '\x00', [@hao={0xc9, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}}]}}}, @dstopts_2292={{0x20, 0x29, 0x4, {0x32, 0x0, '\x00', [@padn={0x1, 0x4, [0x0, 0x0, 0x0, 0x0]}]}}}, @hopopts_2292={{0x20, 0x29, 0x36, {0x3b, 0x0, '\x00', [@ra={0x5, 0x2, 0xbd}]}}}], 0x138}, 0x40) (async) ioctl$sock_SIOCBRDELBR(r8, 0x89a2, &(0x7f0000000200)='bridge0\x00') (async) ioctl$SNDCTL_DSP_CHANNELS(r9, 0xc0045006, &(0x7f00000003c0)=0x10001) 1.816912737s ago: executing program 6 (id=1953): r0 = socket(0x40000000015, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)={0x14, 0x37, 0x1, 0x70bd25, 0x25dfdbfe, {0x3}}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) mremap(&(0x7f0000000000/0x9000)=nil, 0x600002, 0x600002, 0x7, &(0x7f0000a00000/0x600000)=nil) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) io_uring_setup(0x1698, &(0x7f0000000080)={0x0, 0xf7ff}) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x3000003, 0x204031, 0xffffffffffffffff, 0xb80a7000) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x4e21, 0x7, @ipv4={'\x00', '\xff\xff', @private=0xa010100}, 0xff}, 0x1c) getsockopt$sock_buf(r0, 0x1, 0x1c, 0x0, &(0x7f0000000000)) socket$nl_route(0x10, 0x3, 0x0) 1.755844582s ago: executing program 5 (id=1954): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x80102, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224"], 0x0) (async) r2 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r2, &(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2d}}, 0x10) (async) setsockopt$sock_int(r2, 0x1, 0x3c, &(0x7f00000000c0)=0x1, 0x4) (async) sendto$inet(r2, 0x0, 0x0, 0xc806, &(0x7f0000000180)={0x2, 0x4e21, @multicast1}, 0x10) (async) sendto$inet(r2, &(0x7f0000000100)='J', 0xfdbe, 0x4004084, 0x0, 0x11000a00) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff9000/0x4000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) (async) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) (async) r3 = io_uring_setup(0x1b7b, &(0x7f0000000040)={0x0, 0xc89f, 0xc000, 0xa, 0x20002f7}) (async) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x1, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0x8, 0xffff}, {0xe, 0x10}}}, 0x24}}, 0x0) (async) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x3, &(0x7f0000000000)=0x6, 0x4) (async) r4 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(r4, 0x84, 0x14, &(0x7f0000000000)=@assoc_value, &(0x7f0000000040)=0x8) (async) io_uring_enter(r3, 0x2219, 0x7721, 0x16, 0x0, 0x0) (async) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) (async) r5 = eventfd2(0xe5c, 0x80000) (async) r6 = eventfd2(0x804, 0x80801) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000240)={r6, 0x7, 0x2, r5}) (async) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) r8 = eventfd2(0xe5c, 0x80000) (async) r9 = syz_open_dev$sndpcmc(&(0x7f0000000180), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r9, 0xc2604110, &(0x7f00000001c0)={0x0, [[0xffffffff, 0x0, 0x1, 0x8, 0x0, 0x6804, 0x0, 0xffffffff], [0x800004, 0x100001], [0x91, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x1000]], '\x00', [{0xfffffffc, 0xfffffffe}, {}, {}, {0x9, 0x4}, {}, {}, {}, {}, {}, {0x0, 0x4}, {0x200}], '\x00', 0x301}) (async) ioctl$KVM_IRQFD(r1, 0x4020ae76, &(0x7f0000000000)={r8, 0x6, 0x2, r5}) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000840)={0x0, 0x0, @pic={0x9, 0xc0, 0x5, 0x8, 0x7f, 0x0, 0x1, 0x9, 0x1, 0x41, 0x3, 0x58, 0x7, 0x40, 0x9, 0x7}}) ioctl$KVM_SET_REGS(r7, 0x4090ae82, &(0x7f00000002c0)={[0xcb, 0xd, 0x2000000000004, 0x6d, 0x2, 0x4000000001002, 0x80000ef, 0x7f, 0x7fffffffffffb, 0x8d, 0xfffffffffffffffe, 0x3, 0xfffffffffffffffe, 0x5, 0x7, 0xbdf], 0x200000, 0x67a64fa265da9e51}) (async) ioctl$KVM_RUN(r7, 0xae80, 0x0) 1.527355607s ago: executing program 4 (id=1955): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x1000, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$dri(&(0x7f0000000240), 0x0, 0x28900) ioctl$DRM_IOCTL_MODE_GETPROPERTY(r2, 0xc04064aa, &(0x7f0000000280)={0x0, 0x0}) syz_usb_connect(0x4, 0x5f, &(0x7f0000000300)=ANY=[@ANYRES8, @ANYRES16], 0x0) r3 = socket$kcm(0xa, 0x2, 0x0) sendmsg$sock(r3, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x4e22, 0x0, @private2={0xfc, 0x2, '\x00', 0x1}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$sock_SIOCETHTOOL(r4, 0x8946, &(0x7f0000000200)={'bond0\x00', &(0x7f0000000640)=@ethtool_per_queue_op={0x4b, 0x1d, [0x4, 0x8, 0xfffffff1, 0x8, 0x0, 0x1, 0x3e7, 0x5, 0x9, 0x6, 0x5, 0x6, 0x7ff, 0x4, 0x4, 0x3ff, 0x4, 0x8, 0x2, 0x4, 0x9, 0x4, 0x8, 0x1, 0xfffffa0c, 0x7, 0x8, 0x9be, 0x3, 0x3ff, 0x6, 0x14dc, 0x147, 0x9, 0x1, 0x3, 0x1, 0x0, 0x9, 0x6, 0x7, 0x5, 0x4, 0x4, 0x8, 0x80000000, 0x9, 0x100, 0x5, 0x19dd, 0x7, 0x3ff, 0x588, 0x6, 0xf667, 0xfffffffc, 0x7, 0x8, 0x7f, 0x6, 0xc8, 0x6, 0x0, 0xc3, 0x4, 0x10, 0xffffffa8, 0x1, 0x9, 0x1, 0x1, 0x83, 0xe39, 0xcf, 0x10, 0x401, 0x7, 0x7, 0x2a, 0x71c9, 0x1, 0x321, 0xfffffeff, 0x7f, 0x66, 0x1c24, 0xff, 0x9, 0x4, 0x2, 0x3, 0xff, 0x100, 0x126, 0x6, 0x8, 0x40000000, 0xc, 0x4, 0x8, 0xffffffc0, 0x4, 0x10001, 0x5, 0x74a000, 0x4e27, 0x3ff, 0x0, 0x8356, 0x0, 0x100006, 0x9b7, 0x1, 0x80000001, 0x7f, 0xea, 0x6, 0x80000000, 0xff, 0x7, 0x4da8e6f3, 0x5, 0x10001, 0x8, 0x69e4, 0x80000001, 0xfffffff4, 0x100]}}) connect$inet6(0xffffffffffffffff, &(0x7f0000000480)={0xa, 0xfffe, 0x3, @mcast1, 0x5}, 0x1c) dup2(0xffffffffffffffff, 0xffffffffffffffff) setsockopt$MRT6_ADD_MFC(0xffffffffffffffff, 0x29, 0xcc, &(0x7f0000000140)={{0xa, 0x4e21, 0x10, @private2={0xfc, 0x2, '\x00', 0x1}, 0x2}, {0xa, 0x4e24, 0xadad, @mcast2, 0x8}, 0x1, {[0x9, 0xfffffefc, 0x8, 0x2, 0xfffffff7, 0x3, 0x9, 0x4]}}, 0x5c) r5 = fsopen(&(0x7f0000000280)='hfs\x00', 0x1) fsconfig$FSCONFIG_SET_PATH_EMPTY(r5, 0x4, &(0x7f0000000400)='uid', &(0x7f0000000440)='./file0\x00', 0xffffffffffffff9c) setsockopt$ARPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x60, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r6, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4) connect$inet6(r6, &(0x7f0000000100)={0xa, 0x0, 0x0, @empty}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r6, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ifreq(r7, 0x8990, &(0x7f0000000100)={'bond0\x00', @ifru_names='veth0_to_hsr\x00'}) r8 = socket$inet6(0x10, 0x2, 0x4) sendto$inet6(r8, &(0x7f0000000080)="4c00000012001f15b9409b849ac00a00a5784002000000000000030038c88cc055c5ac27a6c5b068d0bf46d323452536005ad94a461cdbfee9bdb942352359a351d1ec0cffc8792cd8000080", 0x4c, 0x20000000, 0x0, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000000)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x401, 0x0, 0x0, {0x1, 0x0, 0x8003}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x200}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x5, 0x0, 0x0, {0x1, 0x0, 0x5}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz1\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0xa0}}, 0x0) 1.490396161s ago: executing program 5 (id=1956): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0xe8, 0x0, 0x0) bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="0300000004000000", @ANYBLOB='\x00'/13], 0x50) ioctl$KVM_RUN(r2, 0xae80, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r5 = gettid() timer_create(0x7, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r5}, &(0x7f0000bbdffc)=0x0) timer_settime(r6, 0x1, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x3938700}}, 0x0) open(&(0x7f0000000100)='./file0\x00', 0x4800, 0x1a1) r7 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x3}, 0x10, 0x0) landlock_restrict_self(r7, 0xc) r8 = add_key$user(&(0x7f0000000200), &(0x7f0000000440), &(0x7f00000000c0), 0x14b, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000000)={r8, r8, r8}, &(0x7f0000000100)=""/83, 0x53, &(0x7f0000000340)={&(0x7f0000000300)={'sha3-224\x00'}}) openat$dir(0xffffffffffffff9c, 0x0, 0x3d7982, 0x10) r9 = landlock_create_ruleset(&(0x7f0000000040)={0x4905, 0x3}, 0x18, 0x0) landlock_restrict_self(r9, 0xb) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000240)="8f0978d21b640fc79ca50000c0fe470f06430f01c2440f20c0ac0a0000e39d9d0f22c066460f38809bf77f00000f214a0fc73d0d0000003e653666400fc7775f400f01c4", 0x44}], 0x1, 0x10, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000640)={0x6, 0x0, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x6, 0x0, 0x0, 0x41000, 0x40, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) ioctl$KVM_RUN(r2, 0xae80, 0x0) syz_open_dev$tty20(0xc, 0x4, 0x1) 1.18813763s ago: executing program 0 (id=1957): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000040)={[0x4, 0x2, 0x80, 0x5, 0x4, 0x7f, 0x4232, 0x3, 0x81, 0x9c1, 0x8001, 0x5, 0x7, 0x4db6, 0x0, 0xfffffdffff7ffffd], 0xdddd1000, 0x80300}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_DELOBJ={0x2c, 0x14, 0xa, 0x401, 0x0, 0x0, {0x2, 0x0, 0x3}, [@NFTA_OBJ_TABLE={0xfffffdc9, 0x1, 'syz0\x00'}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_DELCHAIN={0x3c, 0x5, 0xa, 0x201, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_CHAIN_COUNTERS={0x28, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x7fff}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x4}]}]}, @NFT_MSG_NEWRULE={0x20, 0x6, 0xa, 0x3, 0x0, 0x0, {0x0, 0x0, 0x4}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0xb0}, 0x1, 0x0, 0x0, 0x8000}, 0x40081) ioctl$KVM_SET_IRQCHIP(r1, 0x8208ae63, &(0x7f0000000380)={0x1, 0x0, @pic={0x40, 0x4, 0xa, 0x8, 0x9, 0x3, 0x6, 0x7f, 0x8, 0x8, 0xf8, 0x6, 0x0, 0x5, 0x1, 0x2}}) ioctl$KVM_SET_MP_STATE(r2, 0x4004ae99, &(0x7f0000000180)=0x3) inotify_add_watch(r0, &(0x7f0000000100)='./file0\x00', 0x282) ioctl$KVM_SET_VCPU_EVENTS(r2, 0x4400ae8f, &(0x7f0000000140)=@x86={0x40, 0x1, 0xc, 0x0, 0x1, 0x0, 0x12, 0x0, 0x0, 0x80, 0x9, 0x0, 0x0, 0x0, 0xffffffb8, 0x0, 0x3, 0xff}) r3 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000100), 0x68083, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) ioctl$SW_SYNC_IOC_CREATE_FENCE(r3, 0xc0285700, &(0x7f0000000180)={0x8000, "43a5d33fc396096b1e0d3edb763adb3ec8615fff1adbea1dbdd5f71c08279d05"}) r4 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r4, 0x1, 0xf, &(0x7f0000000180)=0x800001, 0x4) bind$inet6(r4, &(0x7f0000000140)={0xa, 0x4e22, 0x7fff, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) ioctl$KVM_RUN(r2, 0xae80, 0x0) 583.57277ms ago: executing program 0 (id=1958): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000080)=@ipv6_newrule={0x2c, 0x20, 0x2d2c6d60ea1da725, 0x70bd26, 0x25dfdbfd, {0xa, 0x0, 0x0, 0xcd, 0xff, 0x0, 0x0, 0x1, 0x10002}, [@FIB_RULE_POLICY=@FRA_PRIORITY={0x8}, @FIB_RULE_POLICY=@FRA_FWMARK={0x8, 0xa, 0xfb}]}, 0x2c}, 0x1, 0x0, 0x0, 0x4000080}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) (async) prctl$PR_MCE_KILL(0x21, 0x0, 0x1) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'bridge0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xc15}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x1c, 0x10}}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) (async) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=@newlink={0x50, 0x10, 0xffffffffffffffff, 0x70bd27, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, 0xc15}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @vlan={{0x9}, {0x18, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x1}, @IFLA_VLAN_FLAGS={0xc, 0x2, {0x1c, 0x10}}]}}}, @IFLA_LINK={0x8, 0x5, r2}]}, 0x50}, 0x1, 0x0, 0x0, 0x28001}, 0x8000) 526.638117ms ago: executing program 0 (id=1959): r0 = memfd_create(&(0x7f0000000500)=',\xea\x00:\x9e\xa5\x86\xd62\xd2O%l\x85d\xb3F\x95\xc9\xc8#\xa0\xf3\xf7eI\x82o\xc6\xde\xda7\x1b\xeat\xc6J\xb7^\xd1\xad\x7f\xd7=O48\xce\x98\xa3\x01\xc3\xfd\x83\x1e\x17\x1b\xf8\xf2\xf6\xbf\xd6\bU \xda\x98\xe5\xf8W\xefP4t\xa2\xb5\xbd\x97\xe8\x12\x0f\x8dO\xb9\xd1r!Aid\xa2\x9f\x89\v&\xf2\xc0\x180\xd3{[\n\x80\xb0)\x95\xaeIruey\xbb\xd9\xb5q\xd5\xf3^\xdb(\xdb\xc2\xc2\xf5\x98IWa\x8c\xb0?\xbb|Olv\v\xab\a[g\x94\x91lJ\xc8}\xba\xefR\xben\x18\xc5\r\xd9\xf3\xa4\xb1\xf3\xa1\xa0\x87\x00`%\n\xfbK\xc4j\x96\x90\xc9\xb5s\xfc\xd9\xcc\x8dPg\xb6\xbc\xfb\r:b\x1b\xd9x+/\xfb\xadD\xcb\xcf\xeb\xd7\x94I6\xfa\xdb\xbb\x13%\xadP\xbb\x1a\xfc\xd7\xad\xbb\xd1\xbd\xa0\xcd;_F\x8c(\xe1\xb2\xed\x02\x9a\xde\xa9\xf6\x16\xc4{\xd7oRz\xb7\xb7\'.!\x7fz\xf0\x91\r\xb3ZpM{\xc4\xcam\xd7#{\xe9\xef\x13/n^\xeb\xb8\xb3\xc2X]\xda\xf9\x97\xbc~\xd17,~\x89U\xe6]\xce_\xc3\xe6;\xdc\xe9\x1b\xcf\x9e1\x93\xfb~\xf5)\x80pH\x1f\xa8\x96\x82\xdf', 0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f00000004c0)={'bond0\x00', 0x0}) r3 = syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) ioctl$VIDIOC_S_CROP(r3, 0x4014563c, &(0x7f0000000100)={0x9, {0x4, 0x9, 0x400, 0xb}}) sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB="1388000023b201002400128009000100626f6e6400000000140002800800070081000000080003"], 0x44}, 0x1, 0x0, 0x0, 0x404c8e0}, 0xc094) r4 = socket$inet6(0xa, 0x80002, 0x0) sendmsg$sock(r4, &(0x7f0000000040)={&(0x7f00000007c0)=@tipc=@name={0x1e, 0x2, 0x3, {{0x40, 0x3}, 0x8}}, 0xfffffeb1, 0x0, 0x0, &(0x7f0000000840)}, 0x4404c010) r5 = openat$autofs(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r6 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000180)=ANY=[@ANYBLOB="1201fb0019030320d812010079de01ec020109021b0001000003000904000001785ecc00090585020004"], 0x0) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) syz_usb_disconnect(r6) timer_settime(0x0, 0x1, &(0x7f0000000740)={{}, {0x77359400}}, &(0x7f0000000780)) close(r7) r8 = socket$inet6_udplite(0xa, 0x2, 0x88) getsockopt$inet6_int(r8, 0x29, 0x46, 0x0, &(0x7f0000000040)) setsockopt$inet6_udp_encap(r8, 0x11, 0x64, &(0x7f0000000000)=0x2, 0x4) r9 = socket$inet6(0xa, 0xdd1781b23ce2ec01, 0x16) capset(&(0x7f0000a31000)={0x20080522}, &(0x7f0000000080)={0x0, 0x1, 0x0, 0x0, 0x1, 0x3}) sendmmsg(r9, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="080100000000000029000000", @ANYRES64=r9], 0x108}}], 0x1, 0xc040) ioctl$AUTOFS_DEV_IOCTL_VERSION(r5, 0xc0189371, &(0x7f0000000100)={{0x1, 0x1, 0x18, 0xffffffffffffffff}, './file0\x00'}) getsockopt$sock_cred(r10, 0x1, 0x11, &(0x7f00000001c0)={0x0}, &(0x7f0000000240)=0xc) syz_open_procfs(r11, &(0x7f00000002c0)='net/ip_vs_stats\x00') prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x1, &(0x7f0000006680)) ioctl$BTRFS_IOC_QUOTA_CTL(r10, 0xc0109428, &(0x7f0000000440)={0x1, 0xd}) mmap(&(0x7f0000109000/0x2000)=nil, 0x2000, 0x0, 0x50, 0xffffffffffffffff, 0xbf8e000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) preadv(r0, 0x0, 0x0, 0xc, 0x203) preadv(r3, &(0x7f0000000700)=[{&(0x7f0000000300)=""/74, 0x4a}, {&(0x7f0000000380)=""/55, 0x37}, {&(0x7f00000003c0)=""/97, 0x61}, {&(0x7f0000000640)=""/130, 0x82}], 0x4, 0x4, 0x0) 397.236059ms ago: executing program 5 (id=1960): r0 = landlock_create_ruleset(&(0x7f0000000080)={0x2832, 0x0, 0x2}, 0x18, 0x0) landlock_restrict_self(r0, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000040)={0x0, 0x0, 0x2}, 0x18, 0x3) landlock_restrict_self(r1, 0x0) syz_mount_image$fuse(0x0, &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x9801) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r3, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r3, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r3, 0x7ab, &(0x7f00000000c0)={&(0x7f0000000bc0)={{@my=0x0, 0x50de}, {@any, 0x800000}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c5fe68bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a433761ea75776763139fadd55c46daf5338870951822f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f503bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6e0700856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316e75d0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8ba58502975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af126f83f2831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd453ca3d285b04efb38a36e0ed0e2abcb0701ae88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1d97b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c769a7dafb87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d8703fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e4f67a6268625f8c3f358fb7d567cbea52e1bc289bd8effda4e362a729e8cd3064970b972535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfded3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f4fe1b3212a70f185ad71ec86b8c900"}, 0x418}) syz_emit_ethernet(0x82, &(0x7f0000000300)={@local, @local, @void, {@ipv6={0x86dd, @gre_packet={0x6, 0x6, "078ffd", 0x4c, 0x2f, 0x1, @local, @mcast2, {[@fragment={0x87, 0x0, 0x40, 0x0, 0x0, 0x10, 0x66}], {{0x0, 0x0, 0x1, 0x1, 0x0, 0x1, 0x0, 0x1, 0x880b, 0x0, 0x2}, {0x0, 0x0, 0x1, 0x1}, {0x1, 0x0, 0x1, 0x1}, {0x8, 0x88be, 0x4, {{0xe, 0x1, 0x2, 0x0, 0x0, 0x1, 0x0, 0x4}, 0x1, {0x4}}}, {0x8, 0x22eb, 0x4, {{0x3, 0x2, 0x0, 0x1, 0x0, 0x0, 0x4, 0x38}, 0x2, {0x101, 0x64, 0x0, 0x10, 0x1, 0x0, 0x3, 0x0, 0x1}}}, {0x8, 0x6558, 0x2}}}}}}}, 0x0) move_mount(r2, &(0x7f0000000000)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) 243.874603ms ago: executing program 5 (id=1961): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000407f04ffff000000000001090224000100000000090400000903000000012229000905810300"/54], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000400)={[0x71, 0xffffffffffff8000, 0xb, 0x1c, 0x4, 0x5, 0xff, 0x1, 0xffffffffd3d32f95, 0xd, 0x7fffffff, 0x80000001, 0x5, 0x1, 0x5, 0x97], 0xc000, 0x82}) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000080), 0x41, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$IPT_SO_SET_ADD_COUNTERS(r2, 0x0, 0x41, 0x0, 0x74) write$binfmt_aout(r1, &(0x7f00000001c0)=ANY=[], 0xff2e) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0xfe, "0062ba7d82000000160000000000f738096304"}) r3 = syz_open_pts(r1, 0x80) r4 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000100)='/proc/locks\x00', 0x0, 0x0) pread64(r4, &(0x7f0000001440)=""/126, 0x7e, 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = dup3(r3, r1, 0x80000) r6 = fsopen(&(0x7f0000000040)='sysfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r6, 0x0, 0x0) fspick(r7, &(0x7f0000000340)='.\x00', 0x0) read(r5, &(0x7f00000000c0)=""/226, 0xe2) syz_usb_control_io$hid(r0, &(0x7f0000000040)={0x24, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x0, 0x22, 0x371, {0x9}}}, &(0x7f0000000080)={0xffffffffffffffeb, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) 205.537813ms ago: executing program 6 (id=1962): syz_emit_ethernet(0x52, &(0x7f0000000240)={@local, @broadcast, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, '\x00\x00)', 0x1c, 0x6, 0xfe, @private1={0xfc, 0x1, '\x00', 0xbf}, @local, {[], {{0x1, 0x4001, 0x41424344, 0x41424344, 0x0, 0x0, 0x7, 0x2, 0x2, 0x0, 0x0, {[@fastopen={0x22, 0x2}, @mss={0x2, 0x4, 0x3}]}}}}}}}}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000100)='cpuacct.usage_sys\x00', 0x275a, 0x0) fcntl$lock(r0, 0x6, &(0x7f0000000000)={0x0, 0x0, 0x8}) fcntl$lock(r0, 0x26, &(0x7f0000000080)={0x1, 0x0, 0x2007, 0x1fd}) fcntl$lock(r0, 0x7, &(0x7f0000000280)={0x2, 0x0, 0x2f, 0x520ea3af}) r1 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_BEARER_ENABLE(r0, &(0x7f0000000800)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000007c0)={&(0x7f00000002c0)={0x4f0, r1, 0x200, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_MEDIA={0x40, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x200000}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffffd}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff}]}]}, @TIPC_NLA_MEDIA={0x54, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_WIN={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}]}, @TIPC_NLA_PUBL={0x2c, 0x3, 0x0, 0x1, [@TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0x1}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xb8}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xa}, @TIPC_NLA_PUBL_LOWER={0x8, 0x2, 0x4}, @TIPC_NLA_PUBL_UPPER={0x8, 0x3, 0xd}]}, @TIPC_NLA_SOCK={0x5c, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_REF={0x8, 0x2, 0x7ff}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x3}, @TIPC_NLA_SOCK_CON={0x3c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8, 0x1, 0xe1e}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0xb}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x100}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x1000}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x2e3c}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}]}, @TIPC_NLA_NODE={0xe0, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "867cb30114ecc82506e8dd355cd92e083b56b478ec60d315184aaf7e80"}}, @TIPC_NLA_NODE_ID={0x49, 0x3, "2a8af6b0c280668557577dd193095d59f6c852174c815c6d0140ba9996a8aedb6710959e60e190caa97e4acb54320f00d7068d308d82916ab2feccf85f3343f404b68d4c3f"}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0xd}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY={0x3c, 0x4, {'gcm(aes)\x00', 0x14, "2af11a7b7ba6326d5723b3751bbf7c60519d258c"}}]}, @TIPC_NLA_NODE={0x7c, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x12b0}, @TIPC_NLA_NODE_KEY={0x42, 0x4, {'gcm(aes)\x00', 0x1a, "6166b16eb9807c8fef1b3234c45a1bab10925fad2818da9f4d38"}}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x7fff}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1e}, @TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x8}]}, @TIPC_NLA_LINK={0x8c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x3}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x19}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7ff}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x4}]}]}, @TIPC_NLA_MEDIA={0x30, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x1}]}, @TIPC_NLA_MEDIA_NAME={0x7, 0x1, 'ib\x00'}]}, @TIPC_NLA_NODE={0x64, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ID={0x5f, 0x3, "a30ff59e2c4f21999d6ae17de0f6b237e8b7b29c8889ad0cf25a36c103a9b949df5f792e19d2c426fd4af6baf7e6415125415562d752bf143f0dcf5ffab6a40070fbc0f0ebc255ad88b56e83a2d214694bdc69dc3361e9dc07f078"}]}, @TIPC_NLA_NODE={0x144, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_KEY={0x4b, 0x4, {'gcm(aes)\x00', 0x23, "921908ebe4d469177c9eed11fd6b4e6081ffb3e90c5b37c02f2565e6348c2005eb736c"}}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x1}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0xdd, 0x3, "e55807149fd0491e62bafa28303c90547b22c610031f7d87e71afa4926a790734762cb48852075bf279de993bb83716d65d3d647e439e2a36ff21b981f58cf18594bf7ffeab0f1b9831e51397669244e9d7263297aba233c714becc01a04a911905dae6756db4214265a356dfcf5800de47416c9f518e4b27ac7876d01682f5bcd6dbefa1ef58e6b6fe9b209e9b687252d5e7fc3f8f2f26e65484c717fb3c246c55e7f280bcd4ef87153f3135ade63817d03f0ad3dcf8da21a6a5997e094cc29736631bd055a1347aa958932664114ef5dd39f200064ad8864"}]}]}, 0x4f0}, 0x1, 0x0, 0x0, 0x40001}, 0x44801) 64.41551ms ago: executing program 6 (id=1963): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x6, &(0x7f0000001200)={0x0, @in6={{0xa, 0x4e21, 0x10001, @loopback, 0x3}}}, &(0x7f00000012c0)=0x84) getsockopt$inet_sctp6_SCTP_STATUS(0xffffffffffffffff, 0x84, 0xe, &(0x7f0000001300)={0x0, 0x3ff, 0x5, 0x7, 0x3, 0x5d, 0x4, 0x3, {r2, @in={{0x2, 0x5, @local}}, 0x7fffffff, 0x3, 0xf, 0x7fbc, 0x6}}, &(0x7f00000013c0)=0xb0) r3 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_ERR_FILTER(r3, 0x65, 0x7, &(0x7f0000000200)=0xd, 0x4) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000180)={'vcan0\x00', 0x0}) sendmsg$can_raw(r3, &(0x7f00000004c0)={&(0x7f0000000140)={0x1d, r4}, 0x10, &(0x7f0000000080)={&(0x7f0000000000)=@can={{0x0, 0x0, 0x0, 0x1}, 0xfe, 0x1, 0x4, 0x0, "36e932c486d275cc"}, 0x10}, 0x1, 0x0, 0x0, 0x84844}, 0x0) r5 = add_key(&(0x7f0000000000)='big_key\x00', &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0xfe3a, 0xfffffffffffffffe) keyctl$read(0xb, r5, &(0x7f0000002300)=""/4108, 0x100c) r6 = epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r7, &(0x7f0000000200)={0x10}) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f00000002c0), r8) sendmsg$ETHTOOL_MSG_TSINFO_GET(r8, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="14000000", @ANYRES16=r9, @ANYBLOB="01002dbd7000fedbdf2531"], 0x2c}, 0x1, 0x0, 0x0, 0x2004c890}, 0x2000c800) r10 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) ioctl$VIDIOC_S_SELECTION(r10, 0xc040565f, &(0x7f0000000040)={0x9, 0x101, 0x0, {0x1, 0x2, 0x10e, 0x8005}}) r11 = open(0x0, 0x64842, 0x389b0d52417bb201) mbind(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2005, 0x0, 0x7d, 0x6) pwritev2(r11, &(0x7f0000000240), 0x0, 0x7000, 0x0, 0x3) r12 = syz_open_procfs(0xffffffffffffffff, &(0x7f00000000c0)='numa_maps\x00') r13 = fsopen(&(0x7f0000000040)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r13, 0x1, &(0x7f0000000140)='source\x00\xb5\x838\x8d\xbd\xdf\xfe\x9a\xf2RM\xb6\xe0\xf9\xac\xa2\x06\x1cD\xe7C\xa5<\xd1=\x93\xf7\xf7Sn\xcb\xd5\xa7\xc9@D\x81\xff\xaar\xc8\xa9\x13\b\x9a\x8bF\v\x8a\x93F\x00\x00\x00\x00\x00\x00\x00\x00\x00', &(0x7f00000001c0)='.\n#)|.\x02\xd8\b\xb2f\xcd\x04\xb9\xc7\x9d\xb2a\r\xd7\xef\xc5\x112s\x88\x06\x13o\xd6w\xbf\xfa\xd5?\xa3\'\xca%\xd0\x8fKAq\x89f\xbb\x9dC\xd6\xea\xa8\xc2z\xbfe\xadSb3L)Hy\xfao\b\xa4\xb6\xff\xff\xff\xff\xff\xff\xff\xf7\xc7\xa4\xdcY\x9aM\x90\xa4\x05\xa8\xec\xf3\xa4h\x11\x19\x87E$\n://\xf3\x96\xaf\x1c8\b\x84x\'+\xd5\xd4?[e\x19\xa3\\J\xe9\x8a\xb9\xe495/\x00d\xd2\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf0\xb7\x1e\xf7Ys#m\xd40\xceP\xdc\x15FI>\x01\xfa\x15\x93\x9a&\xb4):\xc7?\x8d\x8e\x02\xc6\xf61\xbd\xbcBq\xba\xc6\x8e\x89\x15UTaf\xfc\x89\xab\x19\xd7\x82\x16\x94m\x0e\xb7$\x8c\xd76K\xdc\xd1;\\QPh@$\x06F\x81\xc9\xf8\xf8H\xb2\x85\xa8Cl\xa6\xcd\xb5\xf0\xd0\x1f\'\xc30]\xad7\x1eZA7\x89\xf5\x81b\r\xc1\x7f[\x84y\xac\x12\xaa\xa2-t\x16>V\xfc\xbf\xdb\xe4\x9a\x9eE^\x90oe\xc0\xd9\xc68\x0f\xd4\xcdKC\xadp\xba\xaa\xab\'\x1cRO\x89\x17i\x88\"\x8dQI\xed\x1d\xe1v\xe6&\xd3\x14\xe92\xca\x9dBe\\\x8f\xff\x9b\xc7Sd!\xf8(Z\xd42\xa2\xcdjjBP\xae3\xbd\xec\x8a\x8f:\xeb1\x1cK\xf2\x04s\b\xcb\xa9\x17\x8529\xd7`\v\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\xf1\xa4C\x81\xc8iy\xc4\xf7\x7f\x90\xf80\x18jT\xd45\xde\b\x88\xc9Xw\xe9\xf4\xa4\x94Q\x03s/\xac\xd4\xb7o\x99\xf5\xdb\xf9\x99,+\b\x17\xe4\xf4r}\xda\xf5\x12\x16\xb6g\x00\'(\x02[\xef\x03\x90W% \xe6b\xa2\\\x86\xac\xdax\x997AOJ=\x1f\x00\xe1/\n\xael\x15\xcfR\v\x0e\xbc!\xe8\x1cV-`\xf0$\xa6a \x93PV\x8dm@\x9c', 0x0) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) preadv(r12, &(0x7f0000000040)=[{&(0x7f0000000180)=""/4096, 0x1000}], 0x1, 0x0, 0x0) 0s ago: executing program 3 (id=1964): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x10, &(0x7f00000002c0)=[@in={0x2, 0x0, @local}]}, &(0x7f0000000240)=0x10) setsockopt(r1, 0x84, 0x82, &(0x7f0000000000)="000007008d9d0000", 0x8) r4 = syz_genetlink_get_family_id$fou(&(0x7f0000000040), 0xffffffffffffffff) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x8000, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$F2FS_IOC_START_VOLATILE_WRITE(r6, 0xf503, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000000)=[@textreal={0x8, &(0x7f0000000080)="3e3e0f78545a0fc77400f367d8f6dbbbcb7ba89e9e0f07660f38802422b9cef6baf80c66b8e450178366efbafc0cec0f01cf", 0x32}], 0x1, 0x41, 0x0, 0x0) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000fd9000/0x18000)=nil, &(0x7f00000000c0)=[@text32={0x20, 0x0}], 0x1, 0xa, 0x0, 0x0) ioctl$KVM_SET_NESTED_STATE(r7, 0x4080aebf, &(0x7f0000003680)=@vmx={0x0, 0x0, 0x2080, {}, {'\x00', "00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008bc584c800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001f6f38740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000fbffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a4900"}}) ioctl$KVM_SMI(r7, 0xaeb7) ioctl$KVM_RUN(r7, 0xae80, 0x0) sendmsg$FOU_CMD_GET(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r4, @ANYBLOB="0100000000000400000003000000080006007f00000104000500"], 0x20}}, 0x20040010) r8 = socket$inet_sctp(0x2, 0x1, 0x84) getsockopt$inet_sctp_SCTP_AUTOCLOSE(r8, 0x84, 0x4, 0x0, &(0x7f0000000180)=0xffffffffffffffa3) setsockopt$inet_sctp_SCTP_DEFAULT_PRINFO(r8, 0x84, 0x72, &(0x7f00000001c0)={r3, 0x7, 0x20}, 0xc) r9 = syz_open_dev$sg(&(0x7f0000000000), 0xffff0000, 0x2842) ioctl$SCSI_IOCTL_SEND_COMMAND(r9, 0x1, &(0x7f00000005c0)={0x0, 0x4, 0xffffffa8}) syz_usb_connect(0x0, 0x24, &(0x7f0000000500)=ANY=[@ANYBLOB="12010000f1d566201e043c40d7cc000000010902120001000000000904"], 0x0) kernel console output (not intermixed with test programs): .257806][ T30] audit: type=1326 audit(1775377040.702:3593): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11747 comm="syz.6.1454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 428.283964][ T30] audit: type=1326 audit(1775377040.702:3594): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11747 comm="syz.6.1454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 428.323774][ T30] audit: type=1326 audit(1775377040.702:3595): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11747 comm="syz.6.1454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 428.349302][ T30] audit: type=1326 audit(1775377040.702:3596): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11747 comm="syz.6.1454" exe="/root/syz-executor" sig=0 arch=c000003e syscall=294 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 428.497810][ T10] usb 4-1: new high-speed USB device number 108 using dummy_hcd [ 428.634273][ T10] usb 4-1: device descriptor read/64, error -71 [ 428.750229][ T5909] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 428.759744][ T10] usb usb4-port1: attempt power cycle [ 428.804817][T11773] loop2: detected capacity change from 0 to 7 [ 428.828877][T11773] Dev loop2: unable to read RDB block 7 [ 428.842214][T11773] loop2: unable to read partition table [ 428.902506][T11773] loop2: partition table beyond EOD, truncated [ 428.938511][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 428.953446][T11773] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 428.974603][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 428.995439][ T5909] usb 6-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 429.013015][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 429.046698][T11778] QAT: failed to copy from user. [ 429.081504][ T5909] usb 6-1: config 0 descriptor?? [ 429.134418][ T10] usb 4-1: new high-speed USB device number 109 using dummy_hcd [ 429.165445][ T10] usb 4-1: device descriptor read/8, error -71 [ 429.564402][ T10] usb 4-1: new high-speed USB device number 110 using dummy_hcd [ 429.585184][ T10] usb 4-1: device descriptor read/8, error -71 [ 429.664013][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 429.716989][ T10] usb usb4-port1: unable to enumerate USB device [ 430.409637][T11792] netlink: 104 bytes leftover after parsing attributes in process `syz.4.1465'. [ 430.994197][ T5922] usb 5-1: new high-speed USB device number 87 using dummy_hcd [ 431.177058][ T5922] usb 5-1: Using ep0 maxpacket: 32 [ 431.192866][ T5922] usb 5-1: config 0 has an invalid interface number: 67 but max is 0 [ 431.204367][ T5922] usb 5-1: config 0 has no interface number 0 [ 431.219246][ T5922] usb 5-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 431.232470][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 431.249835][ T5922] usb 5-1: Product: syz [ 431.258954][ T5922] usb 5-1: Manufacturer: syz [ 431.268737][ T5922] usb 5-1: SerialNumber: syz [ 431.292139][ T5922] usb 5-1: config 0 descriptor?? [ 431.410367][T11810] FAULT_INJECTION: forcing a failure. [ 431.410367][T11810] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 431.451398][T11810] CPU: 1 UID: 0 PID: 11810 Comm: syz.0.1471 Tainted: G L syzkaller #0 PREEMPT(full) [ 431.451432][T11810] Tainted: [L]=SOFTLOCKUP [ 431.451440][T11810] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 431.451451][T11810] Call Trace: [ 431.451460][T11810] [ 431.451468][T11810] dump_stack_lvl+0xe8/0x150 [ 431.451500][T11810] should_fail_ex+0x412/0x560 [ 431.451535][T11810] _copy_from_user+0x2d/0xb0 [ 431.451560][T11810] ___sys_sendmsg+0x1c6/0x360 [ 431.451590][T11810] ? __pfx____sys_sendmsg+0x10/0x10 [ 431.451662][T11810] __sys_sendmmsg+0x27c/0x4e0 [ 431.451694][T11810] ? __pfx___sys_sendmmsg+0x10/0x10 [ 431.451717][T11810] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 431.451768][T11810] ? ksys_write+0x242/0x270 [ 431.451793][T11810] ? __pfx_ksys_write+0x10/0x10 [ 431.451823][T11810] __x64_sys_sendmmsg+0xa0/0xc0 [ 431.451852][T11810] do_syscall_64+0x14d/0xf80 [ 431.451887][T11810] ? trace_irq_disable+0x3b/0x150 [ 431.451903][T11810] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.451922][T11810] ? clear_bhb_loop+0x40/0x90 [ 431.451947][T11810] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 431.451966][T11810] RIP: 0033:0x7f0c9ab9c819 [ 431.451987][T11810] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 431.452003][T11810] RSP: 002b:00007f0c9b9d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 431.452025][T11810] RAX: ffffffffffffffda RBX: 00007f0c9ae15fa0 RCX: 00007f0c9ab9c819 [ 431.452039][T11810] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 431.452051][T11810] RBP: 00007f0c9b9d1090 R08: 0000000000000000 R09: 0000000000000000 [ 431.452064][T11810] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 431.452074][T11810] R13: 00007f0c9ae16038 R14: 00007f0c9ae15fa0 R15: 00007f0c9af3fa48 [ 431.452106][T11810] [ 431.671720][ T5922] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 431.836051][ T5922] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 431.924213][ T5922] smsc95xx 5-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 431.963905][ T5922] smsc95xx 5-1:0.67: probe with driver smsc95xx failed with error -71 [ 432.000394][ T5922] usb 5-1: USB disconnect, device number 87 [ 432.529541][T11837] bridge0: port 3(erspan0) entered blocking state [ 432.544564][T11837] bridge0: port 3(erspan0) entered disabled state [ 432.583414][T11837] erspan0: entered allmulticast mode [ 432.621074][T11837] erspan0: entered promiscuous mode [ 432.640053][T11840] netlink: 'syz.3.1480': attribute type 33 has an invalid length. [ 432.645205][T11837] bridge0: port 3(erspan0) entered blocking state [ 432.655359][T11837] bridge0: port 3(erspan0) entered forwarding state [ 432.663890][T11840] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1480'. [ 432.751133][ T5909] usbhid 6-1:0.0: can't add hid device: -71 [ 432.758272][ T5909] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 432.823481][T11838] erspan0: left allmulticast mode [ 432.829909][ T5909] usb 6-1: USB disconnect, device number 58 [ 432.851841][T11838] erspan0: left promiscuous mode [ 432.881979][T11838] bridge0: port 3(erspan0) entered disabled state [ 432.986423][T11844] syz_tun: entered allmulticast mode [ 433.028226][T11836] syz_tun: left allmulticast mode [ 433.049174][T11854] IPVS: set_ctl: invalid protocol: 44 224.0.0.1:20001 [ 433.078704][T11856] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1487'. [ 433.108903][T11857] FAULT_INJECTION: forcing a failure. [ 433.108903][T11857] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 433.168466][T11857] CPU: 0 UID: 0 PID: 11857 Comm: syz.0.1486 Tainted: G L syzkaller #0 PREEMPT(full) [ 433.168500][T11857] Tainted: [L]=SOFTLOCKUP [ 433.168507][T11857] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 433.168518][T11857] Call Trace: [ 433.168538][T11857] [ 433.168547][T11857] dump_stack_lvl+0xe8/0x150 [ 433.168581][T11857] should_fail_ex+0x412/0x560 [ 433.168626][T11857] _copy_from_user+0x2d/0xb0 [ 433.168652][T11857] ___sys_sendmsg+0x1c6/0x360 [ 433.168685][T11857] ? __pfx____sys_sendmsg+0x10/0x10 [ 433.168761][T11857] __sys_sendmmsg+0x27c/0x4e0 [ 433.168793][T11857] ? __pfx___sys_sendmmsg+0x10/0x10 [ 433.168816][T11857] ? __mutex_unlock_slowpath+0x1bd/0x7d0 [ 433.168867][T11857] ? ksys_write+0x242/0x270 [ 433.168893][T11857] ? __pfx_ksys_write+0x10/0x10 [ 433.168922][T11857] __x64_sys_sendmmsg+0xa0/0xc0 [ 433.168949][T11857] do_syscall_64+0x14d/0xf80 [ 433.168974][T11857] ? trace_irq_disable+0x3b/0x150 [ 433.168991][T11857] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.169011][T11857] ? clear_bhb_loop+0x40/0x90 [ 433.169032][T11857] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 433.169050][T11857] RIP: 0033:0x7f0c9ab9c819 [ 433.169070][T11857] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 433.169087][T11857] RSP: 002b:00007f0c9b9d1028 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 433.169109][T11857] RAX: ffffffffffffffda RBX: 00007f0c9ae15fa0 RCX: 00007f0c9ab9c819 [ 433.169123][T11857] RDX: 0000000004000190 RSI: 0000200000000180 RDI: 0000000000000003 [ 433.169137][T11857] RBP: 00007f0c9b9d1090 R08: 0000000000000000 R09: 0000000000000000 [ 433.169149][T11857] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 433.169160][T11857] R13: 00007f0c9ae16038 R14: 00007f0c9ae15fa0 R15: 00007f0c9af3fa48 [ 433.169192][T11857] [ 433.514940][T11851] misc userio: No port type given on /dev/userio [ 433.544679][T11851] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1484'. [ 433.553827][T11851] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1484'. [ 433.669218][T11872] netlink: 104 bytes leftover after parsing attributes in process `syz.0.1491'. [ 434.059886][T11887] pimreg: entered allmulticast mode [ 434.113649][T11887] pimreg: left allmulticast mode [ 434.164088][ T5922] usb 5-1: new full-speed USB device number 88 using dummy_hcd [ 434.377057][ T5922] usb 5-1: unable to read config index 0 descriptor/start: -71 [ 434.392098][ T5922] usb 5-1: can't read configurations, error -71 [ 434.536332][T11904] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=1728497071 (13827976568 ns) > initial count (134217856 ns). Using initial count to start timer. [ 434.605223][ T5909] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 434.754100][ T5909] usb 6-1: device descriptor read/64, error -71 [ 434.884154][ T10] usb 4-1: new high-speed USB device number 111 using dummy_hcd [ 435.004918][ T5909] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 435.064763][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 435.074086][ T10] usb 4-1: config 0 has an invalid interface number: 1 but max is 0 [ 435.086531][ T10] usb 4-1: config 0 has no interface number 0 [ 435.119415][ T10] usb 4-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=93.d8 [ 435.130224][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 435.177609][ T5909] usb 6-1: device descriptor read/64, error -71 [ 435.184828][ T10] usb 4-1: Product: syz [ 435.189045][ T10] usb 4-1: Manufacturer: syz [ 435.193716][ T10] usb 4-1: SerialNumber: syz [ 435.288362][ T5909] usb usb6-port1: attempt power cycle [ 435.309873][ T10] usb 4-1: config 0 descriptor?? [ 435.342926][ T10] usb 4-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 435.369365][ T10] usb 4-1: selecting invalid altsetting 1 [ 435.420546][ T10] usb 4-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 435.468067][ T10] usb 4-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 435.520571][ T10] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 435.531869][ T10] usb 4-1: media controller created [ 435.620744][ T10] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 435.654085][ T5909] usb 6-1: new high-speed USB device number 61 using dummy_hcd [ 435.727286][ T5909] usb 6-1: device descriptor read/8, error -71 [ 436.018093][ T5909] usb 6-1: new high-speed USB device number 62 using dummy_hcd [ 436.044673][ T5909] usb 6-1: device descriptor read/8, error -71 [ 436.179159][ T5909] usb usb6-port1: unable to enumerate USB device [ 436.645214][ T5909] usb 5-1: new high-speed USB device number 90 using dummy_hcd [ 436.664273][T11907] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 436.686715][ T10] usb 4-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 436.703820][T11931] trusted_key: encrypted_key: master key parameter 'جyIjDg(Z0[>e!0n"k7ckzP3z' is invalid [ 436.715801][ T10] zl10353_read_register: readreg error (reg=127, ret==-32) [ 437.674421][ T5909] usb 5-1: new full-speed USB device number 91 using dummy_hcd [ 438.085287][ T5909] usb 5-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 438.113664][ T5909] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 438.125760][ T5909] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 438.196107][ T10] usb 4-1: USB disconnect, device number 111 [ 438.204257][ T5909] usb 5-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 438.223951][ T5909] usb 5-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 438.232405][ T5909] usb 5-1: Manufacturer: syz [ 438.254235][ T5909] usb 5-1: SerialNumber: syz [ 438.540279][ T5909] yealink 5-1:36.0: invalid payload size 0, expected 16 [ 438.552352][ T5909] input: Yealink usb-p1k as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:36.0/input/input42 [ 438.567933][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.576186][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.583372][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.590320][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.597273][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.604286][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.611658][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.618727][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 438.625891][ C0] yealink 5-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 438.687245][ T5909] usb 5-1: USB disconnect, device number 91 [ 439.124173][ T5909] usb 5-1: new high-speed USB device number 92 using dummy_hcd [ 439.365752][ T5909] usb 5-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 439.397120][ T5909] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 439.452181][ T5909] usb 5-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 439.485929][ T5909] usb 5-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 439.506195][ T5909] usb 5-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 439.530798][ T5909] usb 5-1: Manufacturer: syz [ 439.546499][ T5909] usb 5-1: SerialNumber: syz [ 439.792468][ T5909] yealink 5-1:36.0: invalid payload size 0, expected 16 [ 439.801742][ T5909] input: Yealink usb-p1k as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:36.0/input/input43 [ 439.930331][T11970] syzkaller1: entered promiscuous mode [ 439.947433][T11970] syzkaller1: entered allmulticast mode [ 440.219752][T11944] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.229365][T11944] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 440.444389][ T10] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 440.724122][ T10] usb 6-1: Using ep0 maxpacket: 16 [ 440.739914][ T10] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 440.769509][ T10] usb 6-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 440.785939][ T10] usb 6-1: config 0 interface 0 has no altsetting 0 [ 440.792762][ T10] usb 6-1: New USB device found, idVendor=1e71, idProduct=2009, bcdDevice= 0.00 [ 440.802057][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 440.816129][ T10] usb 6-1: config 0 descriptor?? [ 440.904256][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 440.910711][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 441.002811][T11976] usb usb8: usbfs: interface 0 claimed by hub while 'syz.3.1522' sets config #2 [ 441.235649][ T10] hid_parser_main: 28 callbacks suppressed [ 441.235666][ T10] nzxt-smart2 0003:1E71:2009.0017: unknown main item tag 0x0 [ 441.250483][ T10] nzxt-smart2 0003:1E71:2009.0017: unknown main item tag 0x0 [ 441.258109][ T10] nzxt-smart2 0003:1E71:2009.0017: unknown main item tag 0x0 [ 441.259463][ T29] usb 5-1: USB disconnect, device number 92 [ 441.266029][ C0] yealink 5-1:36.0: urb_ctl_callback - urb status -71 [ 441.279070][ C0] yealink 5-1:36.0: urb_ctl_callback - usb_submit_urb failed -19 [ 441.294409][ T10] nzxt-smart2 0003:1E71:2009.0017: unknown main item tag 0x0 [ 441.307247][ T10] nzxt-smart2 0003:1E71:2009.0017: unknown main item tag 0x0 [ 441.321754][ T10] nzxt-smart2 0003:1E71:2009.0017: hidraw0: USB HID v0.05 Device [HID 1e71:2009] on usb-dummy_hcd.5-1/input0 [ 441.500778][T11982] ptrace attach of "./syz-executor exec"[6814] was attempted by "./syz-executor exec"[11982] [ 442.087385][ T29] usb 4-1: new high-speed USB device number 112 using dummy_hcd [ 442.294264][ T29] usb 4-1: Using ep0 maxpacket: 8 [ 442.305321][ T29] usb 4-1: config 179 has an invalid interface number: 65 but max is 0 [ 442.328847][ T29] usb 4-1: config 179 has no interface number 0 [ 442.362967][ T29] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 442.388557][ T29] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 442.400692][ T29] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 48, changing to 9 [ 442.442029][ T29] usb 4-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 442.491787][ T29] usb 4-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 442.510641][ T29] usb 4-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 442.551208][ T29] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.566370][ T5922] usb 6-1: reset high-speed USB device number 63 using dummy_hcd [ 442.640621][T11985] raw-gadget.0 gadget.3: fail, usb_ep_enable returned -22 [ 443.027360][T12014] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1528'. [ 443.137799][ T9] usb 4-1: USB disconnect, device number 112 [ 443.137833][ C1] xpad 4-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 443.152553][ T30] kauditd_printk_skb: 86 callbacks suppressed [ 443.152599][ T30] audit: type=1326 audit(1775377055.802:3683): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.152805][ C1] dummy_hcd dummy_hcd.3: timer fired with no URBs pending? [ 443.240014][ T30] audit: type=1326 audit(1775377055.822:3684): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.303197][ T30] audit: type=1326 audit(1775377055.822:3685): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.375387][ T30] audit: type=1326 audit(1775377055.822:3686): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.440346][ T30] audit: type=1326 audit(1775377055.822:3687): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=85 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.523815][ T30] audit: type=1326 audit(1775377055.822:3688): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.624109][ T30] audit: type=1326 audit(1775377055.822:3689): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.680851][ T30] audit: type=1326 audit(1775377055.852:3690): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.747168][ T30] audit: type=1326 audit(1775377055.852:3691): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.806768][ T30] audit: type=1326 audit(1775377055.852:3692): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12013 comm="syz.0.1528" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f0c9ab9c819 code=0x7ffc0000 [ 443.998540][T12036] netlink: 14 bytes leftover after parsing attributes in process `syz.5.1529'. [ 444.030629][ T10] usb 6-1: USB disconnect, device number 63 [ 444.131264][T12038] IPVS: sync thread started: state = MASTER, mcast_ifn = sit0, syncid = 4, id = 0 [ 444.734675][ T29] usb 5-1: new full-speed USB device number 93 using dummy_hcd [ 444.874484][ T29] usb 5-1: device descriptor read/64, error -71 [ 445.161742][ T29] usb 5-1: new full-speed USB device number 94 using dummy_hcd [ 445.334878][ T29] usb 5-1: device descriptor read/64, error -71 [ 445.448111][ T29] usb usb5-port1: attempt power cycle [ 445.795016][ T29] usb 5-1: new full-speed USB device number 95 using dummy_hcd [ 445.835873][ T29] usb 5-1: device descriptor read/8, error -71 [ 445.904122][ T5938] usb 6-1: new high-speed USB device number 64 using dummy_hcd [ 446.076782][ T5938] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 446.086052][ T5938] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 446.094295][ T29] usb 5-1: new full-speed USB device number 96 using dummy_hcd [ 446.111108][ T5938] usb 6-1: config 0 descriptor?? [ 446.128706][ T5938] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 446.137992][ T29] usb 5-1: device descriptor read/8, error -71 [ 446.255603][ T29] usb usb5-port1: unable to enumerate USB device [ 446.526742][ T5938] cpia1 6-1:0.0: unexpected state after lo power cmd: 00 [ 446.745109][ T797] usb 4-1: new high-speed USB device number 113 using dummy_hcd [ 446.917973][ T797] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 446.930425][ T797] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x7 has invalid maxpacket 0 [ 446.944275][ T797] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x89 has invalid wMaxPacketSize 0 [ 446.954564][ T797] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x89 has invalid maxpacket 0 [ 446.985142][ T797] usb 4-1: New USB device found, idVendor=2040, idProduct=4900, bcdDevice=4d.8b [ 446.995534][ T797] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 447.017492][ T797] usb 4-1: config 0 descriptor?? [ 447.228338][ T797] hdpvr 4-1:0.0: unexpected answer of status request, len -71 [ 447.239296][ T797] hdpvr 4-1:0.0: device init failed [ 447.251256][T12102] vivid-001: disconnect [ 447.255055][ T797] hdpvr 4-1:0.0: probe with driver hdpvr failed with error -12 [ 447.286549][ T797] usb 4-1: USB disconnect, device number 113 [ 447.296419][ T5938] gspca_cpia1: usb_control_msg 05, error -71 [ 447.304964][ T5938] cpia1 6-1:0.0: unexpected systemstate: 00 [ 447.335900][ T5938] usb 6-1: USB disconnect, device number 64 [ 447.437489][T12104] sit0: entered promiscuous mode [ 447.450298][T12104] sit0: left allmulticast mode [ 447.466574][T12104] netlink: 'syz.4.1545': attribute type 1 has an invalid length. [ 447.489123][T12105] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1545'. [ 447.501006][T12105] netlink: 24 bytes leftover after parsing attributes in process `syz.4.1545'. [ 447.501026][T12104] netlink: 9 bytes leftover after parsing attributes in process `syz.4.1545'. [ 447.858902][T12112] netlink: 'syz.3.1547': attribute type 1 has an invalid length. [ 447.955775][T12113] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1547'. [ 447.986057][T12113] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1547'. [ 448.075838][T12119] vivid-007: kernel_thread() failed [ 449.000274][T12138] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1551'. [ 449.812787][T12098] vivid-001: reconnect [ 450.264107][ T5938] usb 5-1: new high-speed USB device number 97 using dummy_hcd [ 450.405124][ T5938] usb 5-1: device descriptor read/64, error -71 [ 450.640232][T12177] netlink: 212408 bytes leftover after parsing attributes in process `syz.5.1562'. [ 450.714971][ T5938] usb 5-1: new high-speed USB device number 98 using dummy_hcd [ 450.956196][ T5938] usb 5-1: device descriptor read/64, error -71 [ 451.020636][T12187] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 451.029697][ T5922] usb 6-1: new low-speed USB device number 65 using dummy_hcd [ 451.055357][T12187] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 451.094431][ T5938] usb usb5-port1: attempt power cycle [ 451.165566][ T5922] usb 6-1: device descriptor read/64, error -71 [ 451.407771][ T5922] usb 6-1: new low-speed USB device number 66 using dummy_hcd [ 451.445145][ T5938] usb 5-1: new high-speed USB device number 99 using dummy_hcd [ 451.489374][ T5938] usb 5-1: device descriptor read/8, error -71 [ 451.544240][ T5922] usb 6-1: device descriptor read/64, error -71 [ 451.796882][ T5922] usb usb6-port1: attempt power cycle [ 451.824230][ T5938] usb 5-1: new high-speed USB device number 100 using dummy_hcd [ 451.855869][ T5938] usb 5-1: device descriptor read/8, error -71 [ 451.974385][ T5938] usb usb5-port1: unable to enumerate USB device [ 452.174497][ T5922] usb 6-1: new low-speed USB device number 67 using dummy_hcd [ 452.195798][ T5922] usb 6-1: device descriptor read/8, error -71 [ 452.434102][ T5922] usb 6-1: new low-speed USB device number 68 using dummy_hcd [ 452.467401][ T5922] usb 6-1: device descriptor read/8, error -71 [ 452.551486][T12201] xt_hashlimit: size too large, truncated to 1048576 [ 452.596471][ T5922] usb usb6-port1: unable to enumerate USB device [ 452.878196][T12212] netlink: 28 bytes leftover after parsing attributes in process `syz.0.1570'. [ 452.996309][T12215] netlink: 20 bytes leftover after parsing attributes in process `syz.3.1571'. [ 453.133213][T12220] loop4: detected capacity change from 0 to 7 [ 453.152645][ C0] blk_print_req_error: 28 callbacks suppressed [ 453.152666][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.168791][ C0] buffer_io_error: 28 callbacks suppressed [ 453.168811][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.186145][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.195892][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.204687][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.214669][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.223643][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.233300][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.242434][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.252193][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.261358][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.271272][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.279741][ C0] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.289573][ C0] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.297907][T12220] ldm_validate_partition_table(): Disk read failed. [ 453.307100][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.316757][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.325605][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.335339][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.344173][ C1] I/O error, dev loop4, sector 0 op 0x0:(READ) flags 0x800000 phys_seg 1 prio class 2 [ 453.354095][ C1] Buffer I/O error on dev loop4, logical block 0, async page read [ 453.365299][T12220] Dev loop4: unable to read RDB block 0 [ 453.377747][T12220] loop4: unable to read partition table [ 453.386341][T12220] loop4: partition table beyond EOD, truncated [ 453.392742][T12220] loop_reread_partitions: partition scan of loop4 (Sj̖P=ý?}X %`ր5) failed (rc=-5) [ 453.434117][ T5922] usb 5-1: new high-speed USB device number 101 using dummy_hcd [ 453.520679][T12221] C: renamed from team_slave_0 (while UP) [ 453.533076][T12221] netlink: 'syz.3.1574': attribute type 1 has an invalid length. [ 453.541599][T12221] netlink: 152 bytes leftover after parsing attributes in process `syz.3.1574'. [ 453.551062][T12221] A link change request failed with some changes committed already. Interface C may have been left with an inconsistent configuration, please check. [ 453.584180][ T5922] usb 5-1: Using ep0 maxpacket: 16 [ 453.593029][ T5922] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 453.610686][ T5922] usb 5-1: config 0 interface 0 altsetting 2 endpoint 0x81 has invalid wMaxPacketSize 0 [ 453.629801][ T5922] usb 5-1: config 0 interface 0 has no altsetting 0 [ 453.656425][ T5922] usb 5-1: New USB device found, idVendor=056a, idProduct=0331, bcdDevice= 0.00 [ 453.669892][ T5922] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 453.682844][ T5922] usb 5-1: config 0 descriptor?? [ 454.215067][ T30] kauditd_printk_skb: 9 callbacks suppressed [ 454.215087][ T30] audit: type=1326 audit(1775377066.862:3702): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.410365][ T30] audit: type=1326 audit(1775377066.902:3703): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=318 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.499259][ T30] audit: type=1326 audit(1775377066.902:3704): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.562196][ T30] audit: type=1326 audit(1775377066.902:3705): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.586293][ T5938] usb 6-1: new high-speed USB device number 69 using dummy_hcd [ 454.634082][ T30] audit: type=1326 audit(1775377066.902:3706): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=157 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.726896][ T30] audit: type=1326 audit(1775377066.902:3707): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.751063][ T5938] usb 6-1: Using ep0 maxpacket: 16 [ 454.762679][ T5938] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 454.787664][ T5938] usb 6-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=7b.55 [ 454.797720][ T5938] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 454.819039][ T5938] usb 6-1: Product: syz [ 454.823275][ T5938] usb 6-1: Manufacturer: syz [ 454.838522][ T5938] usb 6-1: SerialNumber: syz [ 454.848684][ T30] audit: type=1326 audit(1775377066.902:3708): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.890281][ T5938] usb 6-1: config 0 descriptor?? [ 454.900227][ T30] audit: type=1326 audit(1775377066.902:3709): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=314 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 454.955793][ T5938] usb 6-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 454.965989][ T30] audit: type=1326 audit(1775377066.902:3710): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 455.050458][ T30] audit: type=1326 audit(1775377066.902:3711): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12223 comm="syz.5.1575" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 455.274298][ T5938] usb 4-1: new high-speed USB device number 114 using dummy_hcd [ 455.438785][ T5938] usb 4-1: Using ep0 maxpacket: 32 [ 455.445966][ T5938] usb 4-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC4, changing to 0x84 [ 455.462350][ T5938] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x84 has an invalid bInterval 0, changing to 7 [ 455.483084][ T5938] usb 4-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=51.16 [ 455.496197][ T5938] usb 4-1: New USB device strings: Mfr=154, Product=2, SerialNumber=3 [ 455.507519][ T5938] usb 4-1: Product: syz [ 455.514518][ T5938] usb 4-1: Manufacturer: syz [ 455.523337][ T5938] usb 4-1: SerialNumber: syz [ 455.536764][ T5938] usb 4-1: config 0 descriptor?? [ 455.569461][ T5938] usb 4-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 455.757192][T12239] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 455.766586][T12239] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 455.783418][T10263] usb 4-1: Failed to submit usb control message: -71 [ 455.794245][ T29] usb 4-1: USB disconnect, device number 114 [ 455.802765][T10263] usb 4-1: unable to send the bmi data to the device: -71 [ 455.816315][T10263] usb 4-1: unable to get target info from device [ 455.839764][T10263] usb 4-1: could not get target info (-71) [ 455.853519][T10263] usb 4-1: could not probe fw (-71) [ 456.015081][T11092] usb 6-1: Failed to submit usb control message: -110 [ 456.022442][T11092] usb 6-1: unable to send the bmi data to the device: -110 [ 456.046763][T11092] usb 6-1: unable to get target info from device [ 456.057175][T11092] usb 6-1: could not get target info (-110) [ 456.068948][T11092] usb 6-1: could not probe fw (-110) [ 456.338060][T12259] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 456.812795][ T5909] usb 6-1: USB disconnect, device number 69 [ 457.125394][ T797] usb 4-1: new high-speed USB device number 115 using dummy_hcd [ 457.289811][ T797] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 457.319764][ T797] usb 4-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 457.370509][ T797] usb 4-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 457.411048][ T797] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 457.804112][ T797] usb 4-1: SerialNumber: syz [ 458.106746][ T797] usb 4-1: 0:2 : does not exist [ 458.434707][ T797] usb 4-1: USB disconnect, device number 115 [ 458.473544][ T6000] udevd[6000]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 458.736475][ T5922] usbhid 5-1:0.0: can't add hid device: -32 [ 458.742650][ T5922] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 459.026452][T12292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.043368][T12293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.063141][T12292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.075654][T12293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.086831][T12292] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 459.099070][T12292] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 459.439627][ T29] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 459.604362][ T29] usb 6-1: Using ep0 maxpacket: 16 [ 459.613065][ T29] usb 6-1: config 98 contains an unexpected descriptor of type 0x1, skipping [ 459.639334][ T29] usb 6-1: config 98 has an invalid interface number: 40 but max is 1 [ 459.676513][ T29] usb 6-1: config 98 has no interface number 1 [ 459.682800][ T29] usb 6-1: config 98 interface 0 altsetting 6 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 459.746973][ T29] usb 6-1: config 98 interface 0 altsetting 6 has an endpoint descriptor with address 0xAA, changing to 0x8A [ 459.799488][ T29] usb 6-1: config 98 interface 0 altsetting 6 endpoint 0x8A has an invalid bInterval 151, changing to 7 [ 459.803826][T12305] bond5: option packets_per_slave: invalid value (18446744073709551615) [ 459.825989][ T29] usb 6-1: config 98 interface 0 altsetting 6 endpoint 0x8A has invalid maxpacket 24596, setting to 1024 [ 459.855176][ T29] usb 6-1: config 98 interface 0 altsetting 6 bulk endpoint 0x8 has invalid maxpacket 32 [ 459.865356][ T29] usb 6-1: config 98 interface 0 altsetting 6 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 459.879250][ T29] usb 6-1: config 98 interface 40 altsetting 13 has a duplicate endpoint with address 0x5, skipping [ 459.893817][ T29] usb 6-1: config 98 interface 40 altsetting 13 has a duplicate endpoint with address 0x8, skipping [ 459.904793][ T29] usb 6-1: config 98 interface 40 altsetting 13 bulk endpoint 0xD has invalid maxpacket 1024 [ 459.915136][ T29] usb 6-1: config 98 interface 40 altsetting 13 endpoint 0x7 has invalid maxpacket 512, setting to 64 [ 459.926207][ T29] usb 6-1: config 98 interface 40 altsetting 13 has a duplicate endpoint with address 0xA, skipping [ 459.937627][ T29] usb 6-1: config 98 interface 40 altsetting 13 endpoint 0xB has invalid maxpacket 512, setting to 64 [ 459.948969][ T29] usb 6-1: config 98 interface 40 altsetting 13 has a duplicate endpoint with address 0x8, skipping [ 459.960134][ T29] usb 6-1: config 98 interface 40 altsetting 13 has an invalid descriptor for endpoint zero, skipping [ 459.971689][ T29] usb 6-1: config 98 interface 0 has no altsetting 0 [ 459.978865][T12305] bond5: option packets_per_slave: allowed values 0 - 65535 [ 459.986306][ T29] usb 6-1: config 98 interface 40 has no altsetting 0 [ 459.995922][ T29] usb 6-1: New USB device found, idVendor=0b05, idProduct=17d0, bcdDevice=bd.f1 [ 460.015795][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 460.026433][T12305] bond5 (unregistering): Released all slaves [ 460.036719][ T29] usb 6-1: Product: syz [ 460.040945][ T29] usb 6-1: Manufacturer: syz [ 460.054182][ T29] usb 6-1: SerialNumber: syz [ 460.074850][T12287] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 460.248620][ T5909] usb 5-1: USB disconnect, device number 101 [ 460.447680][ T29] usb 6-1: USB disconnect, device number 70 [ 460.545154][T12321] loop3: detected capacity change from 0 to 7 [ 460.564651][T12321] Dev loop3: unable to read RDB block 7 [ 460.570686][T12321] loop3: unable to read partition table [ 460.606439][T12321] loop3: partition table beyond EOD, truncated [ 460.612738][T12321] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 460.716697][ T5909] usb 4-1: new high-speed USB device number 116 using dummy_hcd [ 460.874826][ T5909] usb 4-1: Using ep0 maxpacket: 16 [ 460.882142][ T5909] usb 4-1: config 7 has an invalid descriptor of length 0, skipping remainder of the config [ 460.892760][ T5909] usb 4-1: config 7 interface 0 altsetting 5 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 460.919568][ T5909] usb 4-1: config 7 interface 0 altsetting 5 endpoint 0x81 has invalid wMaxPacketSize 0 [ 460.931191][ T5909] usb 4-1: config 7 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 460.956462][ T5909] usb 4-1: config 7 interface 0 has no altsetting 0 [ 460.963530][ T5909] usb 4-1: New USB device found, idVendor=0458, idProduct=5010, bcdDevice= 0.00 [ 461.004060][ T5909] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 461.384571][ T5922] usb 5-1: new high-speed USB device number 102 using dummy_hcd [ 461.491738][T12340] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 461.501060][T12340] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 461.550128][ T5922] usb 5-1: New USB device found, idVendor=0424, idProduct=7850, bcdDevice= 0.00 [ 461.559747][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 461.567996][ T5922] usb 5-1: Product: syz [ 461.572522][ T5922] usb 5-1: Manufacturer: syz [ 461.577726][ T5922] usb 5-1: SerialNumber: syz [ 461.992738][ T5922] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00000098. ret = -EPIPE [ 462.005129][ T5922] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to sync IRQ enable register: -EPIPE [ 462.091963][T12342] syzkaller0: entered promiscuous mode [ 462.514253][ T29] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 462.674128][ T29] usb 6-1: Using ep0 maxpacket: 32 [ 462.681175][ T29] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 462.689551][ T29] usb 6-1: config 0 has no interface number 0 [ 462.698258][ T29] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 462.707581][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 462.715889][ T29] usb 6-1: Product: syz [ 462.721253][ T29] usb 6-1: Manufacturer: syz [ 462.726154][ T29] usb 6-1: SerialNumber: syz [ 462.733510][ T29] usb 6-1: config 0 descriptor?? [ 463.146731][ T29] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 463.158137][ T29] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 463.478954][ T5909] usbhid 4-1:7.0: can't add hid device: -71 [ 463.485461][ T5909] usbhid 4-1:7.0: probe with driver usbhid failed with error -71 [ 463.511486][ T5909] usb 4-1: USB disconnect, device number 116 [ 463.642644][T12351] can: request_module (can-proto-5) failed. [ 464.230562][ T5922] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to read register index 0x00001000. ret = -EPROTO [ 464.259931][ T5922] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Failed to write register index 0x0000011c. ret = -EPROTO [ 464.279257][ T5922] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Registers INIT FAILED.... [ 464.292155][ T5922] lan78xx 5-1:1.0 (unnamed net_device) (uninitialized): Bind routine FAILED [ 464.326614][ T5922] lan78xx 5-1:1.0: probe with driver lan78xx failed with error -71 [ 464.364983][ T5922] usb 5-1: USB disconnect, device number 102 [ 464.378043][ T29] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -32 [ 464.404864][ T29] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -32 [ 464.583268][T12375] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1613'. [ 464.597424][T12375] --map-set only usable from mangle table [ 465.055846][ T5922] usb 5-1: new high-speed USB device number 103 using dummy_hcd [ 465.094285][ T5909] usb 4-1: new full-speed USB device number 117 using dummy_hcd [ 465.230721][ T5922] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 465.244468][ T5922] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 465.256924][ T5922] usb 5-1: New USB device found, idVendor=0fc5, idProduct=b080, bcdDevice= 0.00 [ 465.288993][ T5909] usb 4-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 465.300382][ T5922] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.314385][ T5909] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 465.330148][ T5922] usb 5-1: config 0 descriptor?? [ 465.350088][ T5922] usbhid 5-1:0.0: can't add hid device: -22 [ 465.358689][ T5909] usb 4-1: config 0 descriptor?? [ 465.365747][ T5922] usbhid 5-1:0.0: probe with driver usbhid failed with error -22 [ 465.437989][ T5938] usb 6-1: USB disconnect, device number 71 [ 465.523230][T12389] netlink: 'syz.6.1618': attribute type 1 has an invalid length. [ 465.643192][T12389] bond1: entered promiscuous mode [ 465.659383][T12389] 8021q: adding VLAN 0 to HW filter on device bond1 [ 465.677163][ T5909] udl 4-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 465.727940][T12393] bond1: (slave bridge1): making interface the new active one [ 465.754155][T12393] bridge1: entered promiscuous mode [ 465.774925][T12393] bond1: (slave bridge1): Enslaving as an active interface with an up link [ 465.783838][T12380] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1614'. [ 465.890183][ T5909] [drm:udl_init] *ERROR* Selecting channel failed [ 465.950871][ T5909] [drm] Initialized udl 0.0.1 for 4-1:0.0 on minor 2 [ 465.962907][ T5909] [drm] Initialized udl on minor 2 [ 465.974126][ T5909] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 465.987116][ T5909] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 465.998170][ T5922] udl 4-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 466.025868][ T5909] usb 4-1: USB disconnect, device number 117 [ 466.032586][ T5922] udl 4-1:0.0: [drm] Cannot find any crtc or sizes [ 466.121140][T12378] netlink: 'syz.4.1615': attribute type 10 has an invalid length. [ 466.129406][T12378] dummy0: left allmulticast mode [ 466.138735][T12378] dummy0: entered allmulticast mode [ 466.145460][T12378] team0: Failed to send options change via netlink (err -105) [ 466.153354][T12378] team0: Port device dummy0 added [ 466.166729][ T981] usb 5-1: USB disconnect, device number 103 [ 466.741936][T12416] netlink: 15830 bytes leftover after parsing attributes in process `syz.3.1624'. [ 466.817757][T12416] netlink: 15859 bytes leftover after parsing attributes in process `syz.3.1624'. [ 467.034226][ T30] kauditd_printk_skb: 79 callbacks suppressed [ 467.051825][ T30] audit: type=1326 audit(1775377079.682:3791): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.079343][ T30] audit: type=1326 audit(1775377079.682:3792): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=154 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.105229][ T30] audit: type=1326 audit(1775377079.682:3793): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.153035][ T30] audit: type=1326 audit(1775377079.682:3794): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.176108][ T981] usb 5-1: new high-speed USB device number 104 using dummy_hcd [ 467.265560][ T30] audit: type=1326 audit(1775377079.682:3795): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.384348][ T981] usb 5-1: unable to get BOS descriptor or descriptor too short [ 467.394196][ T981] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 467.480958][ T30] audit: type=1326 audit(1775377079.682:3796): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=41 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.554665][ T981] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 467.579999][ T981] usb 5-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 467.599320][ T30] audit: type=1326 audit(1775377079.682:3797): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.652208][ T981] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 467.728225][ T981] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.740204][ T30] audit: type=1326 audit(1775377079.682:3798): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.767327][ T981] usb 5-1: Product: syz [ 467.771566][ T981] usb 5-1: Manufacturer: syz [ 467.786201][ T981] usb 5-1: SerialNumber: syz [ 467.804308][ T30] audit: type=1326 audit(1775377079.692:3799): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 467.845612][ T30] audit: type=1326 audit(1775377079.692:3800): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12417 comm="syz.6.1626" exe="/root/syz-executor" sig=0 arch=c000003e syscall=430 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 468.157675][T12420] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 468.201317][T12420] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 468.283624][ T981] cdc_ncm 5-1:1.0: CDC Union missing and no IAD found [ 468.290806][ T981] cdc_ncm 5-1:1.0: bind() failure [ 468.304114][ T981] usb 5-1: USB disconnect, device number 104 [ 468.651579][T12440] netlink: 16 bytes leftover after parsing attributes in process `syz.6.1630'. [ 469.560920][T12447] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 469.568730][T12447] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 469.610513][T12447] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 469.659097][T12447] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 469.679378][T12447] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 469.724210][T12447] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 469.754212][T12447] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 469.822827][T12459] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_cmd_wq": -EINTR [ 470.032996][T12468] tipc: Enabled bearer , priority 0 [ 470.108634][T12470] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1639'. [ 470.118671][T12465] syzkaller0: entered promiscuous mode [ 470.121672][T12478] netlink: 'syz.4.1636': attribute type 9 has an invalid length. [ 470.135402][T12474] netlink: 'syz.4.1636': attribute type 9 has an invalid length. [ 470.145112][T12465] syzkaller0: entered allmulticast mode [ 470.161397][T12473] netlink: 'syz.4.1636': attribute type 4 has an invalid length. [ 470.175991][ T797] hid-generic 0000:0000:0000.0018: unknown main item tag 0x0 [ 470.190209][ T797] hid-generic 0000:0000:0000.0018: hidraw0: HID v0.00 Device [syz1] on syz0 [ 470.249936][T12470] 8021q: adding VLAN 0 to HW filter on device bond2 [ 470.323832][T12483] bond2: entered promiscuous mode [ 470.340637][T12483] bond2: entered allmulticast mode [ 470.401666][T12483] 8021q: adding VLAN 0 to HW filter on device bond2 [ 470.413662][T12483] team0: Port device bond2 added [ 470.415739][T12482] fido_id[12482]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 470.440104][T12465] tipc: Resetting bearer [ 470.491275][T12465] tipc: Disabling bearer [ 470.712529][T12487] ip6gretap1: entered promiscuous mode [ 470.736729][T12487] ip6gretap1: entered allmulticast mode [ 470.771833][T12487] bond2: (slave ip6gretap1): Enslaving as an active interface with an up link [ 471.375893][ T51] Bluetooth: hci2: command 0x0406 tx timeout [ 471.624692][ T51] Bluetooth: hci5: command 0x0406 tx timeout [ 471.625789][ T5826] Bluetooth: hci3: command 0x0406 tx timeout [ 471.704086][ T5826] Bluetooth: hci1: command 0x0c1a tx timeout [ 471.704262][ T51] Bluetooth: hci0: command 0x0c1a tx timeout [ 471.804106][ T981] usb 5-1: new full-speed USB device number 105 using dummy_hcd [ 471.961099][T12512] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 472.150022][ T981] usb 5-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 472.158299][T12512] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 472.341526][ T981] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.438803][ T981] usb 5-1: Product: syz [ 472.444281][ T981] usb 5-1: Manufacturer: syz [ 472.448936][ T981] usb 5-1: SerialNumber: syz [ 472.556534][ T981] usb 5-1: config 0 descriptor?? [ 472.584091][ T5922] usb 4-1: new high-speed USB device number 118 using dummy_hcd [ 472.734239][ T5922] usb 4-1: Using ep0 maxpacket: 32 [ 472.742495][ T5922] usb 4-1: unable to get BOS descriptor or descriptor too short [ 472.759132][ T5922] usb 4-1: config 1 has an invalid interface number: 255 but max is 2 [ 472.774104][ T5922] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 472.785802][ T5922] usb 4-1: config 1 has no interface number 2 [ 472.785951][ T981] usb 5-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 472.792024][ T5922] usb 4-1: config 1 interface 255 has no altsetting 0 [ 472.824045][ T5922] usb 4-1: config 1 interface 1 has no altsetting 0 [ 472.837104][ T5922] usb 4-1: New USB device found, idVendor=0582, idProduct=0009, bcdDevice= 0.40 [ 472.854056][ T5922] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 472.862883][ T5922] usb 4-1: Product: syz [ 472.873737][T12519] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1651'. [ 472.873938][ T5922] usb 4-1: Manufacturer: syz [ 472.889135][ T5922] usb 4-1: SerialNumber: syz [ 472.889530][T12519] netlink: 212368 bytes leftover after parsing attributes in process `syz.5.1651'. [ 472.907213][T12519] trusted_key: syz.5.1651 sent an empty control message without MSG_MORE. [ 473.238163][ T5922] usb 4-1: USB disconnect, device number 118 [ 473.297600][ T6000] udevd[6000]: error opening ATTR{/sys/devices/platform/dummy_hcd.3/usb4/4-1/4-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 473.794593][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 473.796434][T12507] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 473.813145][T12507] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 473.842515][ T981] dvb_usb_rtl28xxu 5-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 473.899736][ T981] usb 5-1: USB disconnect, device number 105 [ 474.325003][ T30] kauditd_printk_skb: 31 callbacks suppressed [ 474.325023][ T30] audit: type=1326 audit(1775377086.972:3832): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.3.1656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 474.378515][ T30] audit: type=1326 audit(1775377086.972:3833): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.3.1656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=28 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 474.537018][ T30] audit: type=1326 audit(1775377086.972:3834): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.3.1656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 474.611017][ T30] audit: type=1326 audit(1775377086.972:3835): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12534 comm="syz.3.1656" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 474.664145][ T981] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 474.845378][ T981] usb 6-1: config index 0 descriptor too short (expected 23569, got 27) [ 474.859663][ T981] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 474.910545][ T981] usb 6-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 474.921555][ T981] usb 6-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 474.949406][ T981] usb 6-1: Manufacturer: syz [ 474.967460][ T981] usb 6-1: config 0 descriptor?? [ 475.114383][ T981] rc_core: IR keymap rc-hauppauge not found [ 475.120359][ T981] Registered IR keymap rc-empty [ 475.127795][ T981] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0 [ 475.141085][ T981] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.0/rc/rc0/input46 [ 475.215066][ C1] igorplugusb 6-1:0.0: Error: urb status = -32 [ 475.616696][T12562] netlink: 'syz.0.1650': attribute type 13 has an invalid length. [ 475.861782][ T51] Bluetooth: hci1: command 0x0c1a tx timeout [ 477.066792][ T5922] usb 6-1: USB disconnect, device number 72 [ 477.496097][T12592] program syz.4.1670 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 477.561215][T12590] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=3070988179 (3070988179 ns) > initial count (1876204212 ns). Using initial count to start timer. [ 478.045764][ T5922] usb 5-1: new high-speed USB device number 106 using dummy_hcd [ 478.216142][ T5922] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 478.228756][ T5922] usb 5-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 478.257048][ T5922] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 478.297523][ T5922] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 478.336190][ T5922] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 478.349672][ T5922] usb 5-1: Product: syz [ 478.356906][ T5922] usb 5-1: Manufacturer: syz [ 478.362001][ T5922] usb 5-1: SerialNumber: syz [ 478.373450][ T5922] hub 5-1:1.0: bad descriptor, ignoring hub [ 478.379938][ T5922] hub 5-1:1.0: probe with driver hub failed with error -5 [ 478.586660][ T5922] usblp 5-1:1.0: usblp0: USB Unidirectional printer dev 106 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 478.744856][ T981] usb 4-1: new high-speed USB device number 119 using dummy_hcd [ 478.926901][ T981] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 478.953433][ T981] usb 4-1: config 0 interface 0 altsetting 4 endpoint 0x81 has invalid wMaxPacketSize 0 [ 478.987984][ T981] usb 4-1: config 0 interface 0 has no altsetting 0 [ 479.008371][ T981] usb 4-1: New USB device found, idVendor=0463, idProduct=1215, bcdDevice= 0.00 [ 479.033862][ T981] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 479.053291][ T981] usb 4-1: config 0 descriptor?? [ 479.074652][ T5938] usb 5-1: USB disconnect, device number 106 [ 479.085869][ T5938] usblp0: removed [ 479.172640][T12628] random: crng reseeded on system resumption [ 479.577977][T12631] dvb_demux: dvb_demux_feed_del: feed not in list (type=0 state=0 pid=ffff) [ 479.994583][ T24] usb 5-1: new high-speed USB device number 107 using dummy_hcd [ 480.157078][ T24] usb 5-1: config 1 has an invalid interface number: 188 but max is 0 [ 480.176655][ T24] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 480.199620][ T24] usb 5-1: config 1 has no interface number 0 [ 480.214216][ T24] usb 5-1: config 1 interface 188 altsetting 209 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 480.249186][ T24] usb 5-1: config 1 interface 188 has no altsetting 0 [ 480.270664][ T24] usb 5-1: New USB device found, idVendor=2040, idProduct=7210, bcdDevice=5b.6b [ 480.308809][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 480.331097][ T24] usb 5-1: Product: syz [ 480.341182][ T24] usb 5-1: Manufacturer: syz [ 480.352113][ T24] usb 5-1: SerialNumber: syz [ 480.586617][T12634] dummy0: left allmulticast mode [ 480.789952][T12634] team0: Port device dummy0 removed [ 480.834742][T12634] bond0: (slave bond_slave_0): Releasing backup interface [ 480.863627][T12634] bond0: (slave bond_slave_1): Releasing backup interface [ 480.898428][T12634] team0: Port device team_slave_0 removed [ 480.912335][T12634] team0: Port device team_slave_1 removed [ 480.927768][T12634] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 480.950347][T12634] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 481.089047][ T24] usb 5-1: unknown interface protocol 0xc1, assuming v1 [ 481.115069][ T24] usb 5-1: 188:0 : does not exist [ 481.429506][ T24] usb 5-1: USB disconnect, device number 107 [ 482.319795][T12687] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1697'. [ 482.347115][T12687] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1697'. [ 482.388453][T12687] bond2 (unregistering): Released all slaves [ 482.499185][T12691] loop2: detected capacity change from 0 to 39 [ 482.541347][T12691] Dev loop2: unable to read RDB block 8 [ 482.552087][T12691] loop2: unable to read partition table [ 482.558976][T12691] loop_reread_partitions: partition scan of loop2 () failed (rc=-5) [ 483.034361][T12705] netlink: 'syz.5.1701': attribute type 9 has an invalid length. [ 483.349952][T12714] binder: BC_ATTEMPT_ACQUIRE not supported [ 483.376228][T12714] binder: 12712:12714 ioctl c0306201 200000000540 returned -22 [ 483.855627][T12728] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 483.883592][T12728] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 483.899633][T12729] openvswitch: netlink: nsh attribute has 4 unknown bytes. [ 483.907301][T12729] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 484.268755][T12733] netlink: 40 bytes leftover after parsing attributes in process `syz.6.1710'. [ 484.345211][ T24] usb 5-1: new high-speed USB device number 108 using dummy_hcd [ 484.518601][ T24] usb 5-1: config 0 has an invalid interface number: 8 but max is 0 [ 484.533132][ T24] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 484.572079][ T24] usb 5-1: config 0 has no interface number 0 [ 484.593366][ T981] usbhid 4-1:0.0: can't add hid device: -32 [ 484.610481][ T981] usbhid 4-1:0.0: probe with driver usbhid failed with error -32 [ 484.620375][ T24] usb 5-1: New USB device found, idVendor=112a, idProduct=0001, bcdDevice=9e.7f [ 484.636134][ T24] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 484.671739][ T24] usb 5-1: Product: syz [ 484.680029][ T24] usb 5-1: Manufacturer: syz [ 484.704473][T12737] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 484.757677][ T24] usb 5-1: SerialNumber: syz [ 484.773876][ T24] usb 5-1: config 0 descriptor?? [ 484.962964][ T24] redrat3 5-1:0.8: Couldn't find all endpoints [ 485.488182][T12744] netlink: 32 bytes leftover after parsing attributes in process `syz.5.1713'. [ 486.116928][ T5922] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 486.229251][T12751] netlink: 12 bytes leftover after parsing attributes in process `syz.6.1716'. [ 486.277601][ T5922] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 486.299769][T12751] 8021q: adding VLAN 0 to HW filter on device bond3 [ 486.324859][ T5922] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 486.433121][ T5922] usb 6-1: config 0 has no interface number 0 [ 486.477414][ T5922] usb 6-1: New USB device found, idVendor=04d8, idProduct=0083, bcdDevice=83.9c [ 486.517703][ T5922] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 486.567787][ T5922] usb 6-1: Product: syz [ 486.598430][ T5922] usb 6-1: Manufacturer: syz [ 486.617152][ T5922] usb 6-1: SerialNumber: syz [ 486.639051][ T5922] usb 6-1: config 0 descriptor?? [ 486.663555][ T5922] ims_pcu 6-1:0.41: Missing CDC union descriptor [ 486.670340][ T5922] ims_pcu 6-1:0.41: probe with driver ims_pcu failed with error -22 [ 486.827292][ T24] usb 5-1: USB disconnect, device number 108 [ 486.866122][T12747] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 486.886740][T12747] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 486.971075][T12747] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 487.067986][ T5922] usb 6-1: USB disconnect, device number 73 [ 487.365118][T12767] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 487.443441][T12767] netlink: 388 bytes leftover after parsing attributes in process `syz.6.1719'. [ 487.685253][ T5909] usb 5-1: new high-speed USB device number 109 using dummy_hcd [ 487.824326][ T5909] usb 5-1: device descriptor read/64, error -71 [ 488.085220][ T5909] usb 5-1: new high-speed USB device number 110 using dummy_hcd [ 488.266982][ T5909] usb 5-1: device descriptor read/64, error -71 [ 488.385687][ T5909] usb usb5-port1: attempt power cycle [ 488.976365][T12795] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 488.987614][T12795] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 489.084161][ T9] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 489.214656][ T5909] usb 5-1: new high-speed USB device number 111 using dummy_hcd [ 489.234335][ T9] usb 6-1: Using ep0 maxpacket: 16 [ 489.240014][ T5909] usb 5-1: device descriptor read/8, error -71 [ 489.255556][ T9] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 489.274790][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 489.290609][ T9] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 489.300223][ T9] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 489.314726][ T9] usb 6-1: Product: syz [ 489.314753][ T9] usb 6-1: Manufacturer: syz [ 489.314770][ T9] usb 6-1: SerialNumber: syz [ 489.326629][ T9] usb 6-1: config 0 descriptor?? [ 489.342946][ T9] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 489.342995][ T9] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 489.494189][ T5909] usb 5-1: new high-speed USB device number 112 using dummy_hcd [ 489.515080][ T5909] usb 5-1: device descriptor read/8, error -71 [ 489.625612][ T5909] usb usb5-port1: unable to enumerate USB device [ 489.976122][ T9] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 489.976979][ T9] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 489.983669][ T9] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 489.983693][ T9] em28xx 6-1:0.0: No AC97 audio processor [ 490.789982][T12833] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1739'. [ 491.472789][T12843] netlink: 184 bytes leftover after parsing attributes in process `syz.6.1742'. [ 491.666381][T12843] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1742'. [ 492.188492][ T24] usb 6-1: USB disconnect, device number 74 [ 492.195788][ T24] em28xx 6-1:0.0: Disconnecting em28xx [ 492.202656][ T24] em28xx 6-1:0.0: Freeing device [ 492.614195][ T24] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 492.710718][T12853] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(9) [ 492.717979][T12853] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 492.739501][T12853] vhci_hcd vhci_hcd.0: Device attached [ 492.783186][T12860] binder: 12859:12860 ioctl c0306201 200000000040 returned -14 [ 492.793156][ T24] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 492.793915][T12860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 492.806519][ T24] usb 6-1: config 1 interface 0 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 492.824435][ T24] usb 6-1: config 1 interface 2 has no altsetting 0 [ 492.826965][ T24] usb 6-1: New USB device found, idVendor=0582, idProduct=007d, bcdDevice= 0.40 [ 492.842102][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 492.842122][ T24] usb 6-1: Product: syz [ 492.842132][ T24] usb 6-1: Manufacturer: syz [ 492.842142][ T24] usb 6-1: SerialNumber: syz [ 492.859178][ T24] snd-ua101 6-1:1.1: invalid num_altsetting [ 492.859228][ T24] snd-ua101 6-1:1.0: invalid format type [ 492.859267][ T24] usb 6-1: selecting invalid altsetting 0 [ 492.859506][T12860] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 492.874187][ T24] usb 6-1: selecting invalid altsetting 0 [ 492.934488][ T24] usbtest 6-1:1.2: probe with driver usbtest failed with error -22 [ 492.946184][ T24] usb 6-1: selecting invalid altsetting 0 [ 492.946217][ T24] snd-usb-audio 6-1:1.2: probe with driver snd-usb-audio failed with error -22 [ 492.946489][ T24] usb 6-1: selecting invalid altsetting 0 [ 492.967858][ T24] snd-ua101 6-1:1.2: probe with driver snd-ua101 failed with error -22 [ 493.007595][T12861] bridge0: port 2(bridge_slave_1) entered disabled state [ 493.008278][T12861] bridge0: port 1(bridge_slave_0) entered disabled state [ 493.064189][ T29] usb 42-1: SetAddress Request (2) to port 0 [ 493.064304][ T29] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 493.081227][ T24] usb 6-1: USB disconnect, device number 75 [ 493.252240][T12856] vhci_hcd: connection reset by peer [ 493.264596][ T49] vhci_hcd vhci_hcd.4: stop threads [ 493.287911][ T49] vhci_hcd vhci_hcd.4: release socket [ 493.296908][ T49] vhci_hcd vhci_hcd.4: disconnect device [ 493.579115][T12875] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1752'. [ 493.590250][T12874] netlink: 68 bytes leftover after parsing attributes in process `syz.4.1752'. [ 493.981535][T12895] bond2: left allmulticast mode [ 493.991885][T12895] ip6gretap1: left allmulticast mode [ 494.013245][T12899] IPVS: set_ctl: invalid protocol: 0 172.20.20.187:20004 [ 494.027807][T12899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 494.036973][T12899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.046719][ T981] usb 5-1: new high-speed USB device number 113 using dummy_hcd [ 494.247376][ T981] usb 5-1: device descriptor read/64, error -71 [ 494.381817][T12899] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 494.392202][T12899] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 494.574093][ T981] usb 5-1: new high-speed USB device number 114 using dummy_hcd [ 494.876674][T12909] syzkaller0: entered promiscuous mode [ 494.882401][T12909] syzkaller0: entered allmulticast mode [ 494.898157][ T981] usb 5-1: device descriptor read/64, error -71 [ 495.044760][ T981] usb usb5-port1: attempt power cycle [ 495.228128][ T30] audit: type=1326 audit(1775377107.882:3836): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12913 comm="syz.3.1760" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 495.263613][T12915] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 495.305424][T12915] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 495.329332][ T30] audit: type=1326 audit(1775377107.912:3837): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12913 comm="syz.3.1760" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 495.353030][ T30] audit: type=1326 audit(1775377107.912:3838): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12913 comm="syz.3.1760" exe="/root/syz-executor" sig=0 arch=c000003e syscall=20 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 495.377870][ T30] audit: type=1326 audit(1775377107.912:3839): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12913 comm="syz.3.1760" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 495.402164][ T30] audit: type=1326 audit(1775377107.912:3840): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12913 comm="syz.3.1760" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fb3d959c819 code=0x7ffc0000 [ 495.427712][ T30] audit: type=1326 audit(1775377107.932:3841): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12910 comm="syz.6.1761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 495.450878][ T981] usb 5-1: new high-speed USB device number 115 using dummy_hcd [ 495.524797][ T981] usb 5-1: device descriptor read/8, error -71 [ 495.557828][ T30] audit: type=1326 audit(1775377107.932:3842): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12910 comm="syz.6.1761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 495.598056][ T30] audit: type=1326 audit(1775377107.932:3843): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12910 comm="syz.6.1761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 495.737132][T12927] netlink: 56 bytes leftover after parsing attributes in process `syz.6.1763'. [ 495.746278][ T30] audit: type=1326 audit(1775377107.932:3844): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12910 comm="syz.6.1761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 495.769534][ T981] usb 5-1: new high-speed USB device number 116 using dummy_hcd [ 495.796251][ T981] usb 5-1: device descriptor read/8, error -71 [ 495.814652][ T30] audit: type=1326 audit(1775377107.932:3845): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12910 comm="syz.6.1761" exe="/root/syz-executor" sig=0 arch=c000003e syscall=163 compat=0 ip=0x7fc113b9c819 code=0x7ffc0000 [ 495.905139][ T981] usb usb5-port1: unable to enumerate USB device [ 495.914191][ T5909] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 495.964457][T12930] netlink: 44 bytes leftover after parsing attributes in process `syz.6.1765'. [ 495.994346][T12931] netlink: 44 bytes leftover after parsing attributes in process `syz.6.1765'. [ 496.065815][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 496.077054][ T5909] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 496.095041][ T5909] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 496.127292][ T5909] usb 6-1: New USB device found, idVendor=1038, idProduct=1410, bcdDevice= 0.00 [ 496.152430][ T5909] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 496.187370][ T5909] usb 6-1: config 0 descriptor?? [ 496.454083][T12935] binder: 12934:12935 ioctl c0306201 200000000180 returned -22 [ 496.611975][ T5909] steelseries 0003:1038:1410.0019: unknown main item tag 0x1 [ 496.632786][ T5909] steelseries 0003:1038:1410.0019: item 0 2 0 9 parsing failed [ 496.641808][ T5909] steelseries 0003:1038:1410.0019: parse failed [ 496.650249][ T5909] steelseries 0003:1038:1410.0019: probe with driver steelseries failed with error -22 [ 496.814118][ T981] usb 6-1: USB disconnect, device number 76 [ 497.749811][T12972] netlink: 8 bytes leftover after parsing attributes in process `syz.4.1777'. [ 497.769480][T12972] bridge0: trying to set multicast startup query interval below minimum, setting to 100 (1000ms) [ 497.781730][T12972] bridge0: entered allmulticast mode [ 498.066560][T12982] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 498.120457][T12983] vimc link validate: Scaler:src:16x16 (0x33424752, 12, 0, 4, 0) RGB/YUV Capture:snk:640x480 (0x33424752, 8, 0, 0, 0) [ 498.174166][ T29] usb 42-1: device descriptor read/8, error -110 [ 498.192491][T12982] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 498.589648][ T29] usb usb42-port1: attempt power cycle [ 499.255532][ T29] usb usb42-port1: unable to enumerate USB device [ 499.304428][T12996] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 499.311011][T12996] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 499.322695][T12996] vhci_hcd vhci_hcd.0: Device attached [ 499.375840][T13003] vhci_hcd: connection closed [ 499.376250][ T49] vhci_hcd vhci_hcd.3: stop threads [ 499.386997][ T49] vhci_hcd vhci_hcd.3: release socket [ 499.395860][ T49] vhci_hcd vhci_hcd.3: disconnect device [ 499.654164][ T9] usb 5-1: new full-speed USB device number 117 using dummy_hcd [ 499.806467][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 499.818870][ T9] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 499.829806][ T9] usb 5-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 499.839734][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 499.851288][ T9] usb 5-1: config 0 descriptor?? [ 499.874227][ T9] hub 5-1:0.0: USB hub found [ 500.005002][T13019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.018728][T13019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.037840][T13019] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 500.052390][T13019] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 500.074424][ T9] hub 5-1:0.0: 1 port detected [ 501.375084][ T9] hub 5-1:0.0: hub_hub_status failed (err = -32) [ 501.392240][ T9] hub 5-1:0.0: config failed, can't get hub status (err -32) [ 501.442261][ T9] usbhid 5-1:0.0: can't add hid device: -32 [ 501.472920][ T9] usbhid 5-1:0.0: probe with driver usbhid failed with error -32 [ 502.340957][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 502.347605][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.701278][ T29] usb 5-1: USB disconnect, device number 117 [ 502.867707][T13059] ipip0: entered promiscuous mode [ 502.872972][T13061] netlink: 12 bytes leftover after parsing attributes in process `syz.4.1804'. [ 502.881741][ T30] kauditd_printk_skb: 7 callbacks suppressed [ 502.881762][ T30] audit: type=1800 audit(1775377115.522:3853): pid=13063 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.1805" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 502.933306][T13059] ipip0: entered allmulticast mode [ 503.211993][T13077] hub 1-0:1.0: USB hub found [ 503.222305][T13077] hub 1-0:1.0: 1 port detected [ 503.304152][ T24] usb 5-1: new high-speed USB device number 118 using dummy_hcd [ 503.352418][T13081] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.382149][T13081] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.464754][ T24] usb 5-1: device descriptor read/64, error -71 [ 503.676186][T13081] bond2: entered promiscuous mode [ 503.682168][T13081] 8021q: adding VLAN 0 to HW filter on device bond2 [ 503.734181][ T24] usb 5-1: new high-speed USB device number 119 using dummy_hcd [ 503.886246][ T24] usb 5-1: device descriptor read/64, error -71 [ 503.984354][ T29] usb 1-1: new high-speed USB device number 63 using dummy_hcd [ 503.998530][ T24] usb usb5-port1: attempt power cycle [ 504.174648][ T29] usb 1-1: Using ep0 maxpacket: 8 [ 504.184451][ T29] usb 1-1: config 1 interface 0 altsetting 13 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 504.203097][ T29] usb 1-1: config 1 interface 0 has no altsetting 0 [ 504.223377][ T29] usb 1-1: string descriptor 0 read error: -22 [ 504.230803][ T29] usb 1-1: New USB device found, idVendor=054c, idProduct=0268, bcdDevice= 0.40 [ 504.262815][ T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 504.364111][ T24] usb 5-1: new high-speed USB device number 120 using dummy_hcd [ 504.394791][ T24] usb 5-1: device descriptor read/8, error -71 [ 504.654480][ T24] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 504.677817][T13097] netlink: 84 bytes leftover after parsing attributes in process `syz.6.1815'. [ 504.690845][ T24] usb 5-1: device descriptor read/8, error -71 [ 504.705904][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.754265][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.761615][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.787139][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.794904][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.802062][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.809738][ T24] usb usb5-port1: unable to enumerate USB device [ 504.817082][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.884333][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.892114][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.901615][ T29] sony 0003:054C:0268.001A: unknown main item tag 0x0 [ 504.979190][ T29] sony 0003:054C:0268.001A: hiddev0,hidraw0: USB HID v80.01 Device [HID 054c:0268] on usb-dummy_hcd.0-1/input0 [ 505.063087][ T29] sony 0003:054C:0268.001A: failed to claim input [ 505.230465][T13107] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1817'. [ 505.584228][ T29] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 505.744177][ T29] usb 6-1: Using ep0 maxpacket: 32 [ 505.751670][ T29] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x82 has invalid wMaxPacketSize 0 [ 505.762152][ T29] usb 6-1: config 0 interface 0 altsetting 2 bulk endpoint 0x82 has invalid maxpacket 0 [ 505.772486][ T29] usb 6-1: config 0 interface 0 has no altsetting 0 [ 505.782737][ T29] usb 6-1: New USB device found, idVendor=16d0, idProduct=10b8, bcdDevice=de.8e [ 505.792104][ T29] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 505.800880][ T29] usb 6-1: Product: syz [ 505.805188][ T29] usb 6-1: Manufacturer: syz [ 505.809948][ T29] usb 6-1: SerialNumber: syz [ 505.817368][ T29] usb 6-1: config 0 descriptor?? [ 506.029126][ T29] gs_usb 6-1:0.0: Configuring for 154 interfaces [ 506.141067][ T30] audit: type=1326 audit(1775377118.792:3854): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13113 comm="syz.4.1819" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f7cf8b9c819 code=0x0 [ 506.349842][ T29] gs_usb 6-1:0.0: Couldn't get bit timing const for channel 0 (-EPROTO) [ 506.360132][ T29] gs_usb 6-1:0.0: probe with driver gs_usb failed with error -71 [ 506.397773][ T29] usb 6-1: USB disconnect, device number 77 [ 506.544164][ T24] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 506.649587][ T29] usb 1-1: USB disconnect, device number 63 [ 506.744187][ T24] usb 5-1: device descriptor read/64, error -71 [ 506.979201][T13143] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1827'. [ 506.994095][ T24] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 507.141356][ T24] usb 5-1: device descriptor read/64, error -71 [ 507.264553][ T24] usb usb5-port1: attempt power cycle [ 507.290939][T13131] netlink: 'syz.5.1824': attribute type 29 has an invalid length. [ 507.300082][T13131] netlink: 'syz.5.1824': attribute type 29 has an invalid length. [ 507.310209][T13131] netlink: 500 bytes leftover after parsing attributes in process `syz.5.1824'. [ 507.364410][ T981] usb 1-1: new full-speed USB device number 64 using dummy_hcd [ 507.385507][T13156] netlink: 'syz.5.1831': attribute type 1 has an invalid length. [ 507.411830][T13156] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1831'. [ 507.529000][ T981] usb 1-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 507.551691][ T981] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x82 has invalid maxpacket 512, setting to 64 [ 507.605065][ T24] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 507.616701][ T981] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 512, setting to 64 [ 507.647866][ T981] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 507.658651][ T24] usb 5-1: device descriptor read/8, error -71 [ 507.667751][ T981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 507.684210][ T981] usb 1-1: Product: syz [ 507.688624][ T981] usb 1-1: Manufacturer: syz [ 507.693290][ T981] usb 1-1: SerialNumber: syz [ 507.889034][ T9] hid-generic 009C:0008:0003.001B: hidraw0: HID v0.05 Device [syz1] on syz0 [ 507.912264][T13145] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 507.914138][ T24] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 507.930523][T13145] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 507.958102][ T24] usb 5-1: device descriptor read/8, error -71 [ 508.084552][ T24] usb usb5-port1: unable to enumerate USB device [ 508.138865][T13172] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 508.144213][ T5938] usb 6-1: new high-speed USB device number 78 using dummy_hcd [ 508.148225][T13172] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 508.308478][ T5938] usb 6-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.40 [ 508.318184][ T5938] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 508.326468][ T5938] usb 6-1: Product: syz [ 508.331127][ T5938] usb 6-1: Manufacturer: syz [ 508.336660][ T5938] usb 6-1: SerialNumber: syz [ 508.570446][T13145] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 508.578835][T13145] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22 [ 508.787644][ T981] cdc_ncm 1-1:1.0: MAC-Address: 42:42:42:42:42:42 [ 508.794612][ T981] cdc_ncm 1-1:1.0: dwNtbInMaxSize=16 is too small. Using 2048 [ 508.802339][ T981] cdc_ncm 1-1:1.0: setting rx_max = 2048 [ 508.988339][ T981] cdc_ncm 1-1:1.0: setting tx_max = 88 [ 509.008380][ T981] cdc_ncm 1-1:1.0 usb0: register 'cdc_ncm' at usb-dummy_hcd.0-1, CDC NCM (NO ZLP), 42:42:42:42:42:42 [ 509.027729][ T981] usb 1-1: USB disconnect, device number 64 [ 509.036794][ T981] cdc_ncm 1-1:1.0 usb0: unregister 'cdc_ncm' usb-dummy_hcd.0-1, CDC NCM (NO ZLP) [ 509.180836][ T5938] rtl8150 6-1:1.0: eth9: rtl8150 is detected [ 509.390737][ T9] usb 6-1: USB disconnect, device number 78 [ 509.826994][ T30] audit: type=1804 audit(1775377122.352:3855): pid=13191 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.1840" name="bus" dev="ramfs" ino=54192 res=1 errno=0 [ 510.858469][ T30] audit: type=1326 audit(1775377123.502:3856): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13194 comm="syz.5.1842" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x0 [ 510.914151][ T5909] usb 5-1: new high-speed USB device number 126 using dummy_hcd [ 511.109797][ T5909] usb 5-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xA3, changing to 0x83 [ 511.150177][ T5909] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 511.175351][ T5909] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0 [ 511.226753][ T5909] usb 5-1: New USB device found, idVendor=2040, idProduct=1605, bcdDevice= a.94 [ 511.302568][ T5909] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 511.393514][ T5909] usb 5-1: config 0 descriptor?? [ 511.435128][ T5909] em28xx 5-1:0.0: error: skipping audio endpoint 0x83, because it uses bulk transfers ! [ 512.788574][T13203] syz.6.1844 (13203): drop_caches: 2 [ 512.811074][ T981] usb 5-1: USB disconnect, device number 126 [ 513.284242][ T10] usb 1-1: new high-speed USB device number 65 using dummy_hcd [ 513.318120][T13253] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 513.362018][T13255] syzkaller1: entered promiscuous mode [ 513.395407][T13255] syzkaller1: entered allmulticast mode [ 513.745119][ T10] usb 1-1: device descriptor read/64, error -71 [ 514.037150][ T10] usb 1-1: new high-speed USB device number 66 using dummy_hcd [ 514.224160][ T10] usb 1-1: Using ep0 maxpacket: 8 [ 514.232104][ T10] usb 1-1: config index 0 descriptor too short (expected 301, got 45) [ 514.245223][ T10] usb 1-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 514.268055][ T10] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 514.278465][ T10] usb 1-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 514.321914][ T10] usb 1-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 514.362975][ T10] usb 1-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 514.383234][ T10] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 514.498773][T13279] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 514.526021][T13279] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 514.618474][ T10] usb 1-1: usb_control_msg returned -32 [ 514.625754][ T10] usbtmc 1-1:16.0: can't read capabilities [ 515.132978][T13291] netlink: 'syz.3.1864': attribute type 1 has an invalid length. [ 515.274489][T13293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.307700][T13293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.335887][T13293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 515.351849][T13293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 515.470722][T13305] tc_dump_action: action bad kind [ 515.581633][T13305] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 515.642991][T13310] netlink: 64 bytes leftover after parsing attributes in process `syz.5.1868'. [ 516.500849][T13312] netlink: 60 bytes leftover after parsing attributes in process `syz.6.1869'. [ 517.392066][T13319] netlink: 28 bytes leftover after parsing attributes in process `syz.4.1872'. [ 519.095295][ T5909] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 519.234184][ T5909] usb 5-1: device descriptor read/64, error -71 [ 519.474307][ T5909] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 519.604282][ T5909] usb 5-1: device descriptor read/64, error -71 [ 519.624259][ T5938] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 519.715226][ T5909] usb usb5-port1: attempt power cycle [ 519.776063][ T5938] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 519.784832][ T5938] usb 6-1: config 0 has no interface number 0 [ 519.791123][ T5938] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 519.802945][ T5938] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 519.813289][ T5938] usb 6-1: config 0 interface 1 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 519.827074][ T5938] usb 6-1: New USB device found, idVendor=28bd, idProduct=0042, bcdDevice= 0.00 [ 519.836833][ T5938] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 519.848634][ T5938] usb 6-1: config 0 descriptor?? [ 520.016564][T13264] usbtmc 1-1:16.0: usb_control_msg returned -110 [ 520.064825][ T5909] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 520.102421][ T5909] usb 5-1: device descriptor read/8, error -71 [ 520.158184][ T10] usb 1-1: USB disconnect, device number 66 [ 520.228110][T13337] input: syz1 as /devices/virtual/input/input47 [ 520.250879][T13337] netlink: 16 bytes leftover after parsing attributes in process `syz.0.1879'. [ 520.272620][T13339] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 520.281525][T13337] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1879'. [ 520.291680][T13339] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 520.354352][ T5909] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 520.381318][ T5909] usb 5-1: device descriptor read/8, error -71 [ 520.425557][T13343] ip6gre2: entered allmulticast mode [ 520.481850][ T5938] input: HID 28bd:0042 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:0.1/0003:28BD:0042.001C/input/input48 [ 520.494604][ T5909] usb usb5-port1: unable to enumerate USB device [ 520.548275][ T5938] uclogic 0003:28BD:0042.001C: input,hidraw0: USB HID v0.00 Keypad [HID 28bd:0042] on usb-dummy_hcd.5-1/input1 [ 520.686234][ T5909] usb 6-1: USB disconnect, device number 79 [ 521.712261][T13363] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 521.745402][T13363] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 521.999033][T13365] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 522.444071][ T5938] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 522.604073][ T5909] usb 1-1: new high-speed USB device number 67 using dummy_hcd [ 522.638297][ T5938] usb 6-1: Using ep0 maxpacket: 16 [ 522.660845][ T5938] usb 6-1: too many endpoints for config 0 interface 0 altsetting 64: 129, using maximum allowed: 30 [ 522.698010][ T5938] usb 6-1: config 0 interface 0 altsetting 64 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 522.795774][ T5909] usb 1-1: Using ep0 maxpacket: 8 [ 522.828690][ T5909] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 522.848139][ T5909] usb 1-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 522.861991][ T5938] usb 6-1: config 0 interface 0 altsetting 64 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 522.907185][ T5909] usb 1-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.01 [ 522.930624][ T5909] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 522.939312][ T5938] usb 6-1: config 0 interface 0 has no altsetting 0 [ 522.947322][T13379] netlink: 'syz.6.1889': attribute type 1 has an invalid length. [ 522.959963][ T5909] usb 1-1: Product: syz [ 522.970852][ T5909] usb 1-1: Manufacturer: syz [ 522.990585][ T5938] usb 6-1: New USB device found, idVendor=046d, idProduct=c52b, bcdDevice= 0.00 [ 523.002288][ T5909] usb 1-1: SerialNumber: syz [ 523.016700][ T5938] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 523.024695][ T5909] usb 1-1: config 0 descriptor?? [ 523.052967][ T5938] usb 6-1: config 0 descriptor?? [ 523.089773][ T5909] radioshark 1-1:0.0: Invalid radioSHARK device [ 523.102145][T13379] bond4: entered promiscuous mode [ 523.170980][ T5909] radioshark 1-1:0.0: probe with driver radioshark failed with error -22 [ 523.180906][T13379] 8021q: adding VLAN 0 to HW filter on device bond4 [ 523.206733][ T5909] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 523.288218][ T5909] usb 1-1: USB disconnect, device number 67 [ 523.349220][T13382] bond4: (slave bridge2): making interface the new active one [ 523.435301][T13382] bridge2: entered promiscuous mode [ 523.442145][T13382] bond4: (slave bridge2): Enslaving as an active interface with an up link [ 523.742915][T13388] netdevsim netdevsim6: Direct firmware load for . [ 523.742915][T13388] failed with error -2 [ 523.756044][T13388] netdevsim netdevsim6: Falling back to sysfs fallback for: . [ 523.756044][T13388] [ 523.772975][T13389] lo: left allmulticast mode [ 523.795153][T13389] tunl0: left allmulticast mode [ 523.837880][T13389] gre0: left allmulticast mode [ 523.843619][T13389] gretap0: left allmulticast mode [ 523.863437][T13389] erspan0: left allmulticast mode [ 523.892961][T13389] ip_vti0: left allmulticast mode [ 523.938708][T13389] ip6_vti0: left allmulticast mode [ 523.945085][T13389] ip6tnl0: left allmulticast mode [ 523.951751][T13389] ip6gre0: left allmulticast mode [ 523.958490][T13389] ip6gretap0: left allmulticast mode [ 523.964245][T13389] vcan0: left allmulticast mode [ 523.969651][T13389] bond0: left allmulticast mode [ 523.976428][T13389] team0: left allmulticast mode [ 523.981742][T13389] nlmon0: left allmulticast mode [ 523.987401][T13389] caif0: left allmulticast mode [ 524.000615][T13389] batadv0: left allmulticast mode [ 524.223738][T13389] vxcan0: left allmulticast mode [ 524.243523][T13389] vxcan1: left allmulticast mode [ 524.275826][T13389] veth0: left allmulticast mode [ 524.312298][T13389] veth1: left allmulticast mode [ 524.349632][T13389] wg0: left allmulticast mode [ 524.380589][T13389] wg1: left allmulticast mode [ 524.406878][T13389] wg2: left allmulticast mode [ 524.412125][T13389] veth0_to_bridge: left allmulticast mode [ 524.422147][T13389] bridge_slave_0: left allmulticast mode [ 524.435883][T13389] veth1_to_bridge: left allmulticast mode [ 524.477369][T13389] bridge_slave_1: left allmulticast mode [ 524.545515][T13389] veth0_to_bond: left allmulticast mode [ 524.552296][ T5938] usbhid 6-1:0.0: can't add hid device: -71 [ 524.589794][ T5938] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 524.652677][ T5938] usb 6-1: USB disconnect, device number 80 [ 524.698504][T13389] bond_slave_0: left allmulticast mode [ 524.727721][T13389] veth1_to_bond: left allmulticast mode [ 524.733585][T13389] bond_slave_1: left allmulticast mode [ 524.752904][T13389] veth0_to_team: left allmulticast mode [ 524.765791][T13389] team_slave_0: left allmulticast mode [ 524.772080][T13389] veth1_to_team: left allmulticast mode [ 524.778810][T13389] team_slave_1: left allmulticast mode [ 524.816461][T13389] veth1_to_batadv: left allmulticast mode [ 524.822634][T13389] batadv_slave_1: left allmulticast mode [ 524.835115][T13389] xfrm0: left allmulticast mode [ 524.841210][T13389] veth0_to_hsr: left allmulticast mode [ 524.847496][T13389] veth1_to_hsr: left allmulticast mode [ 524.856084][T13389] hsr0: left allmulticast mode [ 524.860992][T13389] hsr_slave_0: left allmulticast mode [ 524.867117][T13389] hsr_slave_1: left allmulticast mode [ 524.872898][T13389] veth1_virt_wifi: left allmulticast mode [ 524.880038][T13389] veth0_virt_wifi: left allmulticast mode [ 524.886628][T13389] virt_wifi0: left allmulticast mode [ 524.915761][T13389] veth1_vlan: left allmulticast mode [ 524.921436][T13389] vlan0: left allmulticast mode [ 524.932106][T13389] vlan1: left allmulticast mode [ 524.937684][T13389] macvlan0: left allmulticast mode [ 524.943533][T13389] macvlan1: left allmulticast mode [ 524.951167][T13389] ipvlan0: left allmulticast mode [ 524.957422][T13389] ipvlan1: left allmulticast mode [ 524.962472][T13389] veth0_vlan: left allmulticast mode [ 524.968811][T13389] veth1_macvtap: left allmulticast mode [ 524.975154][T13389] veth0_macvtap: left allmulticast mode [ 524.981230][T13389] macvtap0: left allmulticast mode [ 524.986916][T13389] macsec0: left allmulticast mode [ 524.992248][T13389] geneve0: left allmulticast mode [ 524.997952][T13389] netdevsim netdevsim4 netdevsim0: left allmulticast mode [ 525.005589][T13389] netdevsim netdevsim4 netdevsim1: left allmulticast mode [ 525.012949][T13389] netdevsim netdevsim4 netdevsim2: left allmulticast mode [ 525.044500][T13389] netdevsim netdevsim4 netdevsim3: left allmulticast mode [ 525.052238][T13389] mac80211_hwsim hwsim5 wlan0: left allmulticast mode [ 525.062843][T13389] mac80211_hwsim hwsim7 wlan1: left allmulticast mode [ 525.092303][T13389] mac80211_hwsim hwsim12 wlan2: left allmulticast mode [ 525.122992][T13389] ip6tnl1: left allmulticast mode [ 525.129890][T13389] macsec1: left allmulticast mode [ 525.137258][T13389] @: left allmulticast mode [ 525.141970][T13389] mac80211_hwsim hwsim15 wlan3: left allmulticast mode [ 525.172168][T13389] bond1: left allmulticast mode [ 525.174079][ T10] usb 1-1: new high-speed USB device number 68 using dummy_hcd [ 525.230337][T13389] mac80211_hwsim hwsim16 wlan4: left allmulticast mode [ 525.239997][T13389] vlan2: left allmulticast mode [ 525.252396][T13389] geneve1: left allmulticast mode [ 525.270094][T13389] bond3: left allmulticast mode [ 525.282659][T13389] bond4: left allmulticast mode [ 525.316474][T13389] bridge0: left allmulticast mode [ 525.364478][ T10] usb 1-1: Using ep0 maxpacket: 16 [ 525.372016][ T10] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 525.389814][ T5938] usb 6-1: new low-speed USB device number 81 using dummy_hcd [ 525.424539][ T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 525.453051][T13409] tipc: Enabled bearer , priority 0 [ 525.479822][T13414] syzkaller0: entered promiscuous mode [ 525.508741][T13414] syzkaller0: entered allmulticast mode [ 525.519663][ T10] usb 1-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice=7a.5a [ 525.539019][T13419] tipc: Resetting bearer [ 525.569262][ T10] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.651170][ T10] usb 1-1: Product: syz [ 525.683125][ T10] usb 1-1: Manufacturer: syz [ 525.683137][ T5938] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 525.683162][ T5938] usb 6-1: config 0 has no interface number 0 [ 525.710167][ T5938] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 525.710497][ T10] usb 1-1: SerialNumber: syz [ 525.743828][ T5938] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 525.755952][T13404] tipc: Resetting bearer [ 525.756769][ T10] usb 1-1: config 0 descriptor?? [ 525.778424][ T5938] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 525.800983][ T5938] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.817366][ T10] input: syz syz as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input49 [ 525.832436][ T5938] usb 6-1: config 0 descriptor?? [ 525.859583][T13417] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 525.877777][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.886800][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.896495][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.904273][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.912028][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.919807][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.927726][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.935274][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.942863][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.950445][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.958322][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.965910][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.973623][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 525.982286][ T5938] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 525.993036][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.000618][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.008158][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.015984][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.023228][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.030494][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.037870][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.045278][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.052696][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.060259][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.068186][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.075925][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.083276][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.090687][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.098813][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.106498][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.113833][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.121309][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.121515][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.129175][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.136812][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.141720][T13411] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 526.144285][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.170855][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.174497][T13411] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 526.178390][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.195940][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.203678][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.211045][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.218675][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.226394][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.233879][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.241367][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.248700][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.256313][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.263989][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.271687][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.279163][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.286682][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.294089][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.301706][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.309331][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.317148][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.324714][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.332369][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.340293][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.347871][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.355365][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.362879][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.370591][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.378434][ C1] usb 1-1: pegasus_irq - nonzero urb status received: -71 [ 526.384496][ T5909] usb 1-1: USB disconnect, device number 68 [ 526.385664][ C1] usb 1-1: pegasus_irq - usb_submit_urb failed with result -19 [ 526.399728][ T5179] usb 1-1: control msg error: -71 [ 526.416727][ T5938] usb 6-1: USB disconnect, device number 81 [ 526.430309][T13404] tipc: Disabling bearer [ 526.612788][ T24] tipc: Node number set to 804723841 [ 527.474976][ T5909] usb 1-1: new high-speed USB device number 69 using dummy_hcd [ 527.646070][ T5909] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 527.676842][ T5909] usb 1-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 527.694755][ T5909] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 527.704806][ T5909] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 527.713102][ T5909] usb 1-1: Product: syz [ 527.720133][ T5909] usb 1-1: Manufacturer: syz [ 527.725053][ T5909] usb 1-1: SerialNumber: syz [ 527.946040][T13444] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 527.963079][T13444] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 528.089746][ T5909] cdc_ether 1-1:1.0: probe with driver cdc_ether failed with error -22 [ 528.123165][ T5909] usb 1-1: USB disconnect, device number 69 [ 528.302969][T13444] program syz.0.1906 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 528.320942][T13444] input: syz1 as /devices/virtual/input/input50 [ 528.524171][ T5909] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 528.698529][ T5938] usb 1-1: new high-speed USB device number 70 using dummy_hcd [ 528.714501][ T5909] usb 5-1: Using ep0 maxpacket: 16 [ 528.721710][ T5909] usb 5-1: config 0 has an invalid interface number: 34 but max is 0 [ 528.734622][ T5909] usb 5-1: config 0 has no interface number 0 [ 528.814261][ T5909] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0xA has invalid maxpacket 1023 [ 528.831849][ T5909] usb 5-1: config 0 interface 34 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 80 [ 528.845624][ T5909] usb 5-1: New USB device found, idVendor=0b95, idProduct=772a, bcdDevice=82.73 [ 528.855382][ T5909] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 528.863516][ T5909] usb 5-1: Product: syz [ 528.870122][ T5909] usb 5-1: Manufacturer: syz [ 528.880287][ T5938] usb 1-1: device descriptor read/64, error -71 [ 528.887103][ T5909] usb 5-1: SerialNumber: syz [ 528.901734][ T5909] usb 5-1: config 0 descriptor?? [ 528.908130][T13461] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 528.916512][T13461] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22 [ 529.124103][ T5938] usb 1-1: new high-speed USB device number 71 using dummy_hcd [ 529.162573][ T5909] asix 5-1:0.34: probe with driver asix failed with error -71 [ 529.194850][ T5909] usb 5-1: USB disconnect, device number 5 [ 529.263609][T13473] loop3: detected capacity change from 0 to 7 [ 529.272043][T13473] Dev loop3: unable to read RDB block 7 [ 529.280182][ T5938] usb 1-1: device descriptor read/64, error -71 [ 529.290225][T13473] loop3: unable to read partition table [ 529.296394][T13473] loop3: partition table beyond EOD, truncated [ 529.302964][T13473] loop_reread_partitions: partition scan of loop3 (被x ) failed (rc=-5) [ 529.406038][ T5938] usb usb1-port1: attempt power cycle [ 529.730266][T13484] netlink: 'syz.4.1917': attribute type 33 has an invalid length. [ 529.741384][T13484] netlink: 152 bytes leftover after parsing attributes in process `syz.4.1917'. [ 529.751138][ T5938] usb 1-1: new high-speed USB device number 72 using dummy_hcd [ 529.796740][ T5938] usb 1-1: device descriptor read/8, error -71 [ 529.874424][T13487] syzkaller0: entered promiscuous mode [ 529.892249][T13487] syzkaller0: entered allmulticast mode [ 529.918810][T13487] netlink: 8 bytes leftover after parsing attributes in process `syz.6.1918'. [ 529.949586][T13487] erspan0: entered promiscuous mode [ 530.048176][T13489] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 530.058302][T13489] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 530.074145][ T5938] usb 1-1: new high-speed USB device number 73 using dummy_hcd [ 530.075825][ T10] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 530.104924][ T5938] usb 1-1: device descriptor read/8, error -71 [ 530.254189][ T10] usb 5-1: Using ep0 maxpacket: 16 [ 530.342239][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 145, changing to 11 [ 530.358731][ T5938] usb usb1-port1: unable to enumerate USB device [ 530.359334][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 42783, setting to 1024 [ 530.391896][ T10] usb 5-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 530.526417][ T10] usb 5-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 530.536743][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 530.553726][ T10] usb 5-1: config 0 descriptor?? [ 530.560448][T13486] raw-gadget.0 gadget.4: fail, usb_ep_enable returned -22 [ 531.306945][ T5938] usb 1-1: new high-speed USB device number 74 using dummy_hcd [ 531.489580][T13504] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 531.504191][ T5938] usb 1-1: Using ep0 maxpacket: 8 [ 531.504336][ T10] input: HID 045e:07da as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:0.0/0003:045E:07DA.001D/input/input51 [ 531.540545][ T5938] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 531.561741][ T5938] usb 1-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 531.577114][ T5938] usb 1-1: New USB device found, idVendor=05ac, idProduct=8215, bcdDevice=8f.58 [ 531.589621][ T5938] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 531.598997][T13504] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 531.617463][ T10] microsoft 0003:045E:07DA.001D: input,hidraw0: USB HID v0.00 Device [HID 045e:07da] on usb-dummy_hcd.4-1/input0 [ 531.636878][ T5938] usb 1-1: config 0 descriptor?? [ 531.876992][ T10] usb 1-1: USB disconnect, device number 74 [ 532.512549][T13522] binder: 13521:13522 ioctl c0306201 2000000004c0 returned -22 [ 532.750502][ T10] usb 5-1: USB disconnect, device number 6 [ 532.768417][ T5909] usb 1-1: new full-speed USB device number 75 using dummy_hcd [ 532.956850][ T5909] usb 1-1: unable to get BOS descriptor or descriptor too short [ 532.969831][ T5909] usb 1-1: not running at top speed; connect to a high speed hub [ 532.980724][ T5909] usb 1-1: config 251 has an invalid descriptor of length 0, skipping remainder of the config [ 532.999266][ T5909] usb 1-1: New USB device found, idVendor=1199, idProduct=9003, bcdDevice=d7.00 [ 533.009079][ T5909] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 533.018012][ T5909] usb 1-1: Product: syz [ 533.035055][ T5909] usb 1-1: Manufacturer: syz [ 533.042561][ T5909] usb 1-1: SerialNumber: syz [ 533.184091][ T10] usb 5-1: new full-speed USB device number 7 using dummy_hcd [ 533.260379][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1928'. [ 533.274540][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1928'. [ 533.339023][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 533.352881][ T10] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 533.514581][ T10] usb 5-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 533.525372][ T10] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 533.547747][ T10] usb 5-1: config 0 descriptor?? [ 533.597802][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1928'. [ 533.623006][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1928'. [ 533.843774][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1928'. [ 533.869178][T13522] netlink: 12 bytes leftover after parsing attributes in process `syz.0.1928'. [ 533.907075][ T5909] qmi_wwan 1-1:251.0: probe with driver qmi_wwan failed with error -22 [ 533.931842][ T5909] usb 1-1: USB disconnect, device number 75 [ 534.042465][ T10] hid_parser_main: 4020 callbacks suppressed [ 534.042492][ T10] isku 0003:1E7D:319C.001E: unknown main item tag 0x0 [ 534.056253][ T9] usb 6-1: new high-speed USB device number 82 using dummy_hcd [ 534.066537][ T10] isku 0003:1E7D:319C.001E: unknown main item tag 0x0 [ 534.074617][ T10] isku 0003:1E7D:319C.001E: unknown main item tag 0x0 [ 534.081568][ T10] isku 0003:1E7D:319C.001E: unknown main item tag 0x0 [ 534.091058][ T10] isku 0003:1E7D:319C.001E: unknown main item tag 0x0 [ 534.098320][ T10] isku 0003:1E7D:319C.001E: unknown main item tag 0x0 [ 534.105839][ T10] isku 0003:1E7D:319C.001E: item fetching failed at offset 6/7 [ 534.119673][ T10] isku 0003:1E7D:319C.001E: parse failed [ 534.132833][ T10] isku 0003:1E7D:319C.001E: probe with driver isku failed with error -22 [ 534.224138][ T9] usb 6-1: Using ep0 maxpacket: 32 [ 534.231365][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 534.242729][ T9] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 534.252903][ T9] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 534.262470][ T9] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 534.276939][ T10] usb 5-1: USB disconnect, device number 7 [ 534.298147][ T9] usb 6-1: config 0 descriptor?? [ 534.723199][ T9] ft260 0003:0403:6030.001F: item fetching failed at offset 0/2 [ 534.733487][ T9] ft260 0003:0403:6030.001F: failed to parse HID [ 534.741527][ T9] ft260 0003:0403:6030.001F: probe with driver ft260 failed with error -22 [ 534.832269][T13548] netlink: 56 bytes leftover after parsing attributes in process `syz.4.1937'. [ 534.864347][ T5909] usb 1-1: new high-speed USB device number 76 using dummy_hcd [ 534.923171][ T9] usb 6-1: USB disconnect, device number 82 [ 535.027702][ T5909] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 535.039686][ T5909] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 535.050889][ T5909] usb 1-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 535.061254][ T5909] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 535.071388][ T5909] usb 1-1: SerialNumber: syz [ 535.209372][T13556] xt_hashlimit: max too large, truncated to 1048576 [ 535.299005][ T5909] usb 1-1: cannot find UAC_HEADER [ 535.476388][ T24] usb 5-1: new full-speed USB device number 8 using dummy_hcd [ 535.511342][ T5909] snd-usb-audio 1-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 535.581915][ T5909] usb 1-1: USB disconnect, device number 76 [ 535.768932][ T6000] udevd[6000]: error opening ATTR{/sys/devices/platform/dummy_hcd.0/usb1/1-1/1-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 535.896484][ T5938] usb 6-1: new full-speed USB device number 83 using dummy_hcd [ 535.952835][T13571] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 535.983733][T13571] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 536.265372][ T29] usb 1-1: new low-speed USB device number 77 using dummy_hcd [ 536.370082][ T30] audit: type=1326 audit(1775377148.962:3857): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 536.499335][ T30] audit: type=1326 audit(1775377148.972:3858): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=293 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 536.614066][ T30] audit: type=1326 audit(1775377148.972:3859): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 536.747022][ T30] audit: type=1326 audit(1775377148.972:3860): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 536.810480][ T30] audit: type=1326 audit(1775377148.972:3861): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 537.080783][ T30] audit: type=1326 audit(1775377148.972:3862): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=29 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 537.264731][ T29] usb 1-1: device descriptor read/64, error -71 [ 537.275836][ T30] audit: type=1326 audit(1775377148.972:3863): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 537.423315][ T30] audit: type=1326 audit(1775377148.972:3864): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=425 compat=0 ip=0x7fde8819c819 code=0x7ffc0000 [ 537.493078][ T30] audit: type=1326 audit(1775377148.972:3865): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fde8819c582 code=0x7ffc0000 [ 537.534128][ T29] usb 1-1: new low-speed USB device number 78 using dummy_hcd [ 537.604095][ T30] audit: type=1326 audit(1775377148.972:3866): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=13577 comm="syz.5.1945" exe="/root/syz-executor" sig=0 arch=c000003e syscall=9 compat=0 ip=0x7fde8819c582 code=0x7ffc0000 [ 537.739577][ T29] usb 1-1: config 0 has an invalid interface number: 55 but max is 0 [ 537.773701][ T29] usb 1-1: config 0 has no interface number 0 [ 537.790774][ T29] usb 1-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 537.830235][ T29] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 537.939205][ T29] usb 1-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 538.029833][ T29] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 538.044644][ T29] usb 1-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 538.058696][ T29] usb 1-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 538.098709][ T29] usb 1-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 538.110686][ T29] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 538.137584][ T29] usb 1-1: config 0 descriptor?? [ 538.144716][T13585] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 538.152065][T13585] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 538.201129][ T29] ldusb 1-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 538.290034][T13590] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.306372][T13589] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 538.322721][T13590] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.346264][T13589] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 538.472470][T13591] A link change request failed with some changes committed already. Interface gretap0 may have been left with an inconsistent configuration, please check. [ 538.515934][ T29] usb 1-1: USB disconnect, device number 78 [ 538.530336][ T29] ldusb 1-1:0.55: LD USB Device #0 now disconnected [ 540.006291][T13627] bond0: (slave veth0_to_hsr): Enslaving as an active interface with an up link [ 541.092118][ T24] usb 1-1: new high-speed USB device number 79 using dummy_hcd [ 541.285026][ T24] usb 1-1: Using ep0 maxpacket: 32 [ 541.324150][ T24] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024 [ 541.342490][ T24] usb 1-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 541.353990][ T24] usb 1-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 541.368450][ T24] usb 1-1: Product: syz [ 541.373353][ T24] usb 1-1: Manufacturer: syz [ 541.378845][ T24] usb 1-1: SerialNumber: syz [ 541.398686][T13650] program syz.3.1964 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 541.412063][T13650] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 541.412506][ T24] usb 1-1: config 0 descriptor?? [ 541.426831][ T5888] usb 6-1: new high-speed USB device number 84 using dummy_hcd [ 541.438505][T13638] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 541.441807][T13650] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 541.617539][ T5888] usb 6-1: config 0 has an invalid descriptor of length 1, skipping remainder of the config [ 541.628573][ T5888] usb 6-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 541.642728][ T5888] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 541.661603][ T5909] usb 1-1: USB disconnect, device number 79 [ 541.677825][ T5888] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 541.779715][T13653] libceph: resolve '. [ 541.779715][T13653] #)|.fǝa2sow?'%ЏKAqfCzeSb3L)HyoǤYMhE$ [ 541.779715][T13653] ' (ret=-3): failed [ 541.844594][ T5888] usb 6-1: config 0 descriptor?? [ 541.856754][ T5888] usbhid 6-1:0.0: couldn't find an input interrupt endpoint [ 541.893877][T13657] ================================================================== [ 541.902438][T13657] BUG: KASAN: vmalloc-out-of-bounds in tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 541.911095][T13657] Write of size 4096 at addr ffffc900055f1040 by task vivid-000-vid-c/13657 [ 541.920065][T13657] [ 541.922443][T13657] CPU: 1 UID: 0 PID: 13657 Comm: vivid-000-vid-c Tainted: G L syzkaller #0 PREEMPT(full) [ 541.922474][T13657] Tainted: [L]=SOFTLOCKUP [ 541.922481][T13657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 541.922493][T13657] Call Trace: [ 541.922503][T13657] [ 541.922512][T13657] dump_stack_lvl+0xe8/0x150 [ 541.922544][T13657] print_report+0xba/0x230 [ 541.922566][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 541.922592][T13657] kasan_report+0x117/0x150 [ 541.922618][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 541.922647][T13657] kasan_check_range+0x264/0x2c0 [ 541.922682][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 541.922708][T13657] __asan_memcpy+0x40/0x70 [ 541.922728][T13657] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 541.922785][T13657] vivid_thread_vid_cap_tick+0x1021/0x5fd0 [ 541.922810][T13657] ? __lock_acquire+0x6b5/0x2cf0 [ 541.922848][T13657] ? __lock_acquire+0x6b5/0x2cf0 [ 541.922873][T13657] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 541.922897][T13657] ? lockdep_hardirqs_on+0x7a/0x110 [ 541.922923][T13657] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 541.922957][T13657] vivid_thread_vid_cap+0x909/0x1190 [ 541.922987][T13657] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 541.923011][T13657] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 541.923034][T13657] ? __kthread_parkme+0x7a/0x1f0 [ 541.923065][T13657] kthread+0x388/0x470 [ 541.923092][T13657] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 541.923111][T13657] ? __pfx_kthread+0x10/0x10 [ 541.923131][T13657] ret_from_fork+0x51e/0xb90 [ 541.923157][T13657] ? __pfx_ret_from_fork+0x10/0x10 [ 541.923180][T13657] ? __switch_to+0xc7d/0x1450 [ 541.923203][T13657] ? __pfx_kthread+0x10/0x10 [ 541.923222][T13657] ret_from_fork_asm+0x1a/0x30 [ 541.923254][T13657] [ 541.923262][T13657] [ 542.105065][T13657] The buggy address belongs to a 1-page vmalloc region starting at 0xffffc900055f1000 allocated at vb2_vmalloc_alloc+0xef/0x360 [ 542.118664][T13657] The buggy address belongs to the physical page: [ 542.125086][T13657] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x2000000f8 pfn:0x293df [ 542.134980][T13657] flags: 0xfff00000000000(node=0|zone=1|lastcpupid=0x7ff) [ 542.142445][T13657] raw: 00fff00000000000 0000000000000000 dead000000000122 0000000000000000 [ 542.151118][T13657] raw: 00000002000000f8 0000000000000000 00000001ffffffff 0000000000000000 [ 542.159711][T13657] page dumped because: kasan: bad access detected [ 542.166297][T13657] page_owner tracks the page as allocated [ 542.172797][T13657] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x2dc2(GFP_KERNEL|__GFP_HIGHMEM|__GFP_ZERO|__GFP_NOWARN), pid 13638, tgid 13637 (syz.0.1959), ts 541882684696, free_ts 541882664417 [ 542.194797][T13657] post_alloc_hook+0x231/0x280 [ 542.199762][T13657] get_page_from_freelist+0x24dc/0x2580 [ 542.206540][T13657] __alloc_frozen_pages_noprof+0x18d/0x380 [ 542.215061][T13657] alloc_pages_bulk_noprof+0x558/0x700 [ 542.222425][T13657] alloc_pages_bulk_mempolicy_noprof+0x34e/0x1680 [ 542.230452][T13657] __vmalloc_node_range_noprof+0xa32/0x1730 [ 542.240644][T13657] vmalloc_user_noprof+0xad/0xe0 [ 542.247363][T13657] vb2_vmalloc_alloc+0xef/0x360 [ 542.252603][T13657] __vb2_queue_alloc+0x9c5/0x15a0 [ 542.258262][T13657] vb2_core_reqbufs+0xc1f/0x1410 [ 542.263906][T13657] __vb2_init_fileio+0x318/0xff0 [ 542.270009][T13657] __vb2_perform_fileio+0x282/0x1620 [ 542.276283][T13657] vb2_fop_read+0x273/0x360 [ 542.282941][T13657] v4l2_read+0x19c/0x2c0 [ 542.287488][T13657] vfs_readv+0x587/0x840 [ 542.291843][T13657] __x64_sys_preadv+0x19f/0x2a0 [ 542.297084][T13657] page last free pid 13638 tgid 13637 stack trace: [ 542.304326][T13657] __free_frozen_pages+0xc2b/0xdb0 [ 542.310075][T13657] __kasan_populate_vmalloc+0x1b2/0x1d0 [ 542.316013][T13657] alloc_vmap_area+0xd73/0x14b0 [ 542.322472][T13657] __get_vm_area_node+0x1f8/0x300 [ 542.327910][T13657] __vmalloc_node_range_noprof+0x372/0x1730 [ 542.334417][T13657] vmalloc_user_noprof+0xad/0xe0 [ 542.339907][T13657] vb2_vmalloc_alloc+0xef/0x360 [ 542.344953][T13657] __vb2_queue_alloc+0x9c5/0x15a0 [ 542.350096][T13657] vb2_core_reqbufs+0xc1f/0x1410 [ 542.355398][T13657] __vb2_init_fileio+0x318/0xff0 [ 542.360934][T13657] __vb2_perform_fileio+0x282/0x1620 [ 542.367591][T13657] vb2_fop_read+0x273/0x360 [ 542.372667][T13657] v4l2_read+0x19c/0x2c0 [ 542.377133][T13657] vfs_readv+0x587/0x840 [ 542.381690][T13657] __x64_sys_preadv+0x19f/0x2a0 [ 542.387098][T13657] do_syscall_64+0x14d/0xf80 [ 542.391850][T13657] [ 542.394194][T13657] Memory state around the buggy address: [ 542.400046][T13657] ffffc900055f1f00: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 542.408271][T13657] ffffc900055f1f80: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 [ 542.416466][T13657] >ffffc900055f2000: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 542.424935][T13657] ^ [ 542.429128][T13657] ffffc900055f2080: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 542.437277][T13657] ffffc900055f2100: f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 f8 [ 542.445424][T13657] ================================================================== [ 542.546282][T13657] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 542.553719][T13657] CPU: 1 UID: 0 PID: 13657 Comm: vivid-000-vid-c Tainted: G L syzkaller #0 PREEMPT(full) [ 542.565370][T13657] Tainted: [L]=SOFTLOCKUP [ 542.569829][T13657] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 03/18/2026 [ 542.580282][T13657] Call Trace: [ 542.583838][T13657] [ 542.586877][T13657] vpanic+0x56c/0xa60 [ 542.590895][T13657] ? __pfx_vpanic+0x10/0x10 [ 542.595441][T13657] ? __pfx___schedule+0x10/0x10 [ 542.600488][T13657] panic+0xc5/0xd0 [ 542.604322][T13657] ? __pfx_panic+0x10/0x10 [ 542.608886][T13657] ? preempt_schedule_common+0x82/0xd0 [ 542.614459][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 542.620138][T13657] check_panic_on_warn+0x89/0xb0 [ 542.625118][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 542.631078][T13657] end_report+0x73/0x180 [ 542.635329][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 542.641315][T13657] kasan_report+0x128/0x150 [ 542.645911][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 542.651646][T13657] kasan_check_range+0x264/0x2c0 [ 542.656626][T13657] ? tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 542.662388][T13657] __asan_memcpy+0x40/0x70 [ 542.666839][T13657] tpg_fill_plane_buffer+0x1b9b/0x5ec0 [ 542.672331][T13657] vivid_thread_vid_cap_tick+0x1021/0x5fd0 [ 542.678152][T13657] ? __lock_acquire+0x6b5/0x2cf0 [ 542.683316][T13657] ? __lock_acquire+0x6b5/0x2cf0 [ 542.688286][T13657] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 542.694112][T13657] ? lockdep_hardirqs_on+0x7a/0x110 [ 542.699326][T13657] ? __pfx_vivid_thread_vid_cap_tick+0x10/0x10 [ 542.705485][T13657] vivid_thread_vid_cap+0x909/0x1190 [ 542.710790][T13657] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 542.716684][T13657] ? _raw_spin_unlock_irqrestore+0x30/0x80 [ 542.722487][T13657] ? __kthread_parkme+0x7a/0x1f0 [ 542.727641][T13657] kthread+0x388/0x470 [ 542.731819][T13657] ? __pfx_vivid_thread_vid_cap+0x10/0x10 [ 542.737970][T13657] ? __pfx_kthread+0x10/0x10 [ 542.742567][T13657] ret_from_fork+0x51e/0xb90 [ 542.747275][T13657] ? __pfx_ret_from_fork+0x10/0x10 [ 542.752406][T13657] ? __switch_to+0xc7d/0x1450 [ 542.757091][T13657] ? __pfx_kthread+0x10/0x10 [ 542.761946][T13657] ret_from_fork_asm+0x1a/0x30 [ 542.766842][T13657] [ 542.770086][T13657] Kernel Offset: disabled [ 542.774693][T13657] Rebooting in 86400 seconds..