last executing test programs: 23m18.875462389s ago: executing program 32 (id=228): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, 0x0, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000600)={{0x14}, [@NFT_MSG_NEWRULE={0x48, 0x6, 0xa, 0x160b, 0x0, 0x0, {0x2, 0x0, 0x8}, [@NFTA_RULE_EXPRESSIONS={0x1c, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NAT_TYPE={0x8}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x3000000}}, 0x70}, 0x1, 0x0, 0x0, 0x40800}, 0x4040080) 22m50.655232982s ago: executing program 33 (id=363): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000001180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000006380)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000100)={0x50, 0x0, r1, {0x7, 0x1f, 0x1000001, 0x5069f481, 0xfffe, 0x7fff, 0x0, 0x0, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r0, &(0x7f00000041c0)="412e450a2a7b9586d1e6e9de257afc4fd60c8de430c0d6348b2cf1db8d070a539de9c1e91a178f9240dbcfe303566018f6c20c55d643a2ed46aaacf49ca491ee2f06184bdb548778a2c56e56f6b40b994419428bbbb9dfa5f9593511ca8ae1c088fb0ee5da72f505000000000000002c04754204f194ae6ceff4570d44496eeffe619998eafc7167d22e1c6aa73e89ad19224e35130a37cf68d5c41ccafe59b4b753a26e06c4306d31d78de6cede97c06e3ca2cc4af66b7548268efa91621ffca2655d2c8f1a9bb019b88fa729cb3d32f72c098c44898d42c42f39feb4faead93980726c236129acdf31c01f1cabb5ca3ec4e45eb5e6e59912792b4976e3f2b560c861d49b539d8e1870040a8cf190a8a767ec067a8048aac53336b44669d3d425843ae80681a7c02a5d5a3d90f355fd4a6ac277e75230d558f0df20cb323cc65e9b5a258cdd669c8a9534e4aff09a8fe89b124748c9e756c28789c2152a5142bc0bb205e339d43bb980b3f04a3c1a424a2a093966b20600a5410e0528fb35937c998eea19f01eaf2f39e16d85563a6737ddab3213ca1832f0afdf891e34a582f6a4ac81fda70ebc3fedac2fb3a492fdb40b91021e5d371d990064cd1f7c2c1a6472dec7505f9a4940057a3e57fd53aa3cd2eb914e073a19b6e925f8553e6875c093c7d19de25861fd9640f0eca4cda0467f12126daa2e0c6df7d4e4babe5a6e59e8391be7700790315b6b8a8aa74cd6d3f054aceaeda79430676b67fe25c9029e0894b413377fc4d8300d9f9338fadd07e4c80cac08113df8971a868458c47c06fff0c1c4bfd48ea583e9e76ef103d42c233b6de10b30612cdbeb6b60a6a4dbbe2da63cc2dd4fb93cac65af3c1279274f4af0e2c5b96e6068aa5b41f7548fb72b0c142351f64446db7425115b89132b5589ee642ebbde655adb2d7d1117456a6e4f2886879b42baf85e05d53e2aceea9c3830673bdc4d081675fe76b994651af9c3f16b7513834fce4654f84558a8308fa677d05bffcc893d9813bf87c5ec520cd66ad58dc06f0c47d253cd36dfec82980fc8dbdcd4b1c037c2b30bef455984f3e8ed19d69e185fe4fbdda2c2517ec9abfbb4841252e650b6bf56fdeca9a4ee3c311de3c6859ec14cc00e95323c57c02fa894d83ea17944f3112fc19a7e11335d7951ec6dd5b4f06fb9b637313a230341ea5da6a7a959e707d0cd5fca60a6649c8df8d6c17e9a49d230e5775df14e4b43aa3420bd0b8814ec7360ab1910e69fab8932f7646d7998bdc2e8ec354c52da21ed83fb7582cb9d37bb95f144974f72c7b0ae7b42945768fa8ec0dd6daba72d05809670506ef10542a2201b00906c8af64e3e13a10f180688c96549b2d3d6b04403fd571e7b132891dd4b7cf37aec25ca1e9190c17aaefbc31e059915c12c232fb7097e9fa6f35fbb265c7102db62e2264590c583ea90f1aee3f166af81430d9084eb0c760ebbb16049c9fd1fee6ce33c8ac205e3ac9c275531feadfa4054e0c027c26beb009f54aa72b864d39bb11753f77931bb960276db33021c65671e57b3708bbf979be222e8439d71f58ca87cec7a054517af398a42731b580717377a54f139e2c46813cbb03d98e49c26f4ed54d75e48573cd06145f913f4e313eeee837496dfff75aa722fd8486c45f9c959da12ae48ba4a10712120a203e2476c7b96031d8f8773f68344e6fa21831287655aabbd594e9f272eb1a7315d2d79b8bcd5e63004cd106f80b1e40a5d9e428a01bc58264f4d63c2ee9db6efa70607a642aeb883bf4b9fe009d7f09c16b05a2c9b73573e9019e161ebbdc1fc9b9cd0c5fe1b57adcba2d0f3a767ad59aafa159b3dd181f0601ff95e8af8b5410e56c81ffb8ab35b1e04af35dabf69f08572e69260b72bfd502c5a0de627fd3fee44bf1d4a261bd356056c5739398e3ff161beec1240a089625daffbc61dc5e660c274565477a0ff1797fefff04a98704802ab0674ab72d400686229608cbfd2ca20f4e62495e8b09de9d180c47375bbad72f4474b67d56104b4b466192be60f7aa668fd0a4338b856f114311842ee806d6488ab09098ed9de0e21bcc8b42a5d5713d15eca108fcc7a65d6b414a112524a6e1418644508dd957147a92d4399d13faaf01cacef40549cd11900f9aa32a8333f55796ef25d33c554a308da9797cd0ac25888311b0ac88eff0be7a36ddedcfc2b095abb4d5a6a4edbbad67b70cdf60c7ed0c5e040ced90edb3322ef684332358942ede9191b431c99b3abf8f9c50206479f0ac118c0a99df61fb9c90d846f41caa6a2448fb7e15640965e051c2af4ee72a5cc7c962bacff7019615c10e6c3054e2e5792df3aa6e2c33425552148466a88568cc79b6edebf0107b7d3d24423a665d20c3a1c0f1a6b34eb475bf875912115914cfabcf394f8a096d64e5dc95705074fe5e985497dcf052b9f748b9d4688859c0200fa43719e4722ed6c064c0efa7e07beb2a26fd724b63537fa0eb506365d5c029cd8dce7dd0a1cb9d9058c061739734af6be9e880fe7e28a211a4c368a7babd1107110ecbb384b274cc092b9511c4abde2ddd863162e2739984a9f3c0a76e3c530a27d5e385f4a3b87607b2a944e09d28239661d27719e22c0a657ea383c30859ca29cdb8fbc79bc83e995dcb361743a7e195650c37e570b768a0a1f0b118fa5be9b3c838326343ec5b376d5ee040ee29dfd868cccf9cfa4591151f519cd6e2ae1453a58aa92f90ee5be11ceb8511ab743f399be0a190eeddfd112336866831c3255ef6520d88b2581ea3767f3df01a38d9b4656f2a89c5df41443291a795da45c8a846015cd041bea0dfbe648348b10ae73ce43d9017182792cd9172eee642c549a530cc1f537f9aa70ca63792ba4a86a713ae09b917136e5bf1506ad7f367d8d2f77f47a2318facd109bba9b1327b5db9e4aeffbdcf414db761eeacc227a15cd72aa52c8ede33bdbab9de9aa1e8f470a388013d07f08777e2131bbd4856ab5c1c38d03ef407197ccf24e8b2a8db69e78f9d6623033c453541bb79f9e0be9a55588e2e54fce65fb785467064a146c4bf218068b5e3efdafaf93a98253becaef226cd79468ff1bbe0c9d43877f5cbb5844fd8957f15d3ef208aac11816585cdccf039c36b429d3d7fb634054fd0f09c8abea3746a6b7379142abde26d998ac7e39b94746c60c09f86ddbd7497849d1ef839730672449f35a3c3253666e9fc053ac1c518e44e0b84555be507f7c00fa9e4864b4bf40ac3d93f12001eb780a779e655d0633803268c094ae161a0efd652003d6ac47f9a6c28d866b56233f371627b01e0fe9361dca611a28841968d4e12cb73d49ce08fe25de4a90b2d34607202b20e71f5e1eed38e17d0a2748f548cf61735f4c9cead1cb93b11929d906d65fc60f88e6919b7b5a1014e6d408bce9c8cc832eecf9147708fe451891717d2ed99dee70773feaa97985102abd3dd05c904c28898afe060621db6564887bc4afe158fbe1d819136a1ac1dc9d8674798a93daf5255460b50c34496205834c668db4c764e76ebb6cdaf5fc44b881cc2ae87b4a7cc045143f96b1620abfd0f116e673b335beefdafa1e58d9194e010cb78956044646da5ba853ce981667f2b8e5001c2df437c9d597ccd2be7d2887f5cb7aad0539abb3f9db1c8f5cd4d7d831946ba1c1aa8737c114fec1ac9a82519f57cb48c49b7f62e9eaa89f448df33fb307cd0036c70b490ac340f7d04e14f32bfeebb08a9d5bc7bbef8f231ea09311d4c82cc55c90eb53c6c003cc98a34dd3c4ec2d8b3a655a78e16e908f368733d0a02b36fe963e2d80b5e6f7b2e3aae3013c900c76e4d56e8348bef221f8a642e692c23b12520fb68c793e789eeeceb4efb2097a4d5952d144094cd7be6edc933d257f6230e962d70ba42e1b07ad9eca0ccd60d3d9a6e06b73ccf96a8aa490ed3bd58bf4d79db65355ae145b54be004e464f4dd23fb8b1bf15e13838116083da67186513652608e37c8f847b2bcafb57bcefc7efc8c8182c7d708cce5d14695b4e618e77f8e7be81f27a05e415fd37ac21507a665b2558daee5c0b0859fedfede8c03f181ef5e0ec0da6caa3edf402dd73bcb4026c489a7cca8ab700d3e9f050006c32768a16e8a48e48ed5750b8cdb7ad1fd12d4cc8333d324d6c83905303fa7013fc02553b587544affe38f1a95e0c4c39740d63b6d387fc89b30bd5fd745cb64844b13897ccf5cca135f7d39e03ce8adcda919d86b25b52764b0a0c4f07f88df68868415de13863df84a7e8d355b09cf90e482eb4174fd01f1b371a4dc52f3c89fc3a70c71657aa5d7573ef9acf4d2b0b321c41ff2640515bb43637ba2288ca0bff2e2a3a998ad8294c52f9edfe0a4ee0a3f8ed5b4b5c43319bb9c58dd07ea3237d7bb62cb086e7ea4a81cba2cdeb28794a09c275a704963110b64720bd089e3737ee1a91e348b5e97b63e1724de1fa9f49961d653bbb47b6fa993b035cf59659bcd0306180645162568abf51127845cbe6c19b9d69657db4258fa5e8428a73eff6506bff474c2e302ad5559ac8de44c6f0baba5e2e579e7d7f9d9ebf540674432ac11d92bfc9abdc24126888b533f43bd6f293b0bc315915743114a35308a0ee2e710522137918a2b09ddbbc7a2313a2a6b85a1ad26f14dd70072651c8300ddf6de29704b716ce1bc431c66ccc96731f46359a9f6850976c96dcb5e0ee47446f50b6b3ba90d45224066e123ad3854d877c0cdd9325000ac0d6813c30cd43d3e150335601724ca3666458dc4c04f6562296982353e155d5255c9008c0b46d21a678c8fcb3aa8d6574476e0458eb0a76a6cb50f929ed218cc4654cb4f95fb3afbc2548b74acc312563375a19e55d488599488dfed4dd31b39f29ad61dad343dfca3b45b316a34e7a7bebd2b0f562a9e69848d13fc80a4fa52d0f17bd15d9e1fd39a7dcc86128d14493805d105a745673bddea68ca74ac09d95cc7412d5be2cbd0a247a81dc9e148111e22cdf3375805469226ca3538f960a6ba6aa0eeeb87c784ffb1bfc09180a61be3c7c535fc6d593c3b3f4de21b8c3eccc9021e80fb07dce0aeb3b023bd55f24356f646791ba80e5ca21ac092a069ae0a22cfefc08c23cc7aa69b570bd17cce9de15871d363f167288f99f04761caa67f12c949466493f661d39ee4280c955446ff5a9bb14f2d1ae21cdb91a5868e0c52097cf380f571935b140562922763f1b79c3709b949c57a00b08828ce9e685f6b234b5fe3c62d9feb249ce75e81f5efd556c14d5da24dc0554723fdbe52659969a39f470e82c50c4777c908628436e31177af1125d5f70ff627462247e5bc20c47ef75f369174586d43d42f7eefdd47fefa745badebca2a881ccc018ea411cc8a7a0881422bee8704bb98e6bea9fbec63441fb45d7ccfd436909b57a2b60b788e15bda3ca7663b19bd84d0879deb639f10def9a99d42a4b9a4fd7fecbf6d2e7598678307ba9a5b6f143c27cf1ca41e3c904007bb762cd5df6e63c4cf422c2ba959e53bd8e5664cf5df6a91a4bc8cebc52b22f30060fcbc5ead53d38eabd160c1da4cab8aa95c3640ffd78074aa2cbb05cb8ea90a0c95a4a1b2be1ee94f238000f1faffa069d87039f13f5f84ff368aec5a0b10020232b9fc954a6c22573ef48459e574d48a4845837e1d6ef386738ccedd093d4d5bf3a3f790c875ba7449d03397642feb71100f2c25ab2cadf0b0802544a2095a51b19cdece623b17d420b173a99c081f8e229b6de3c680d6bb39bb98b479517d77cca581b81cf856753a44ebd64cff111fb8ca37ea45d217a3fca44a083e6c35b0fed9f8f7631178d15e88f86c85f1ce68c900afdd1f7e5b8bd4ef3f58c447b77d3befc49180df7a5eb2ae8ae33b4ef573f3a425da8a60cde84d8eeae6d6399b9fbbfa0fa8d448b25c7f79b7554d0b02b0decbc74ae8560f630af596313fb33d442a410061ace0aa7a440d5e31ca8bb2cc495c4f0b672edb011b0c5f16781836df7f4af8329143d5a1a99d7b18ef9f774c4199d635848cedebac82637a03a189c65bf667503737c75b6639ac65ad424ca475285437e6f19830b36549f607ffc387c8b11a34a838159376a6335afaa045bd2bb04e279dd72436331d07dfbd72e2436b27f0df23a266fd15cf56d1a9e93aaac8901cfe49a3219ae36c5c65c75e5c708fb82cac4d6a50726509ec3a7d32d54cf584ae353a5bff75a6de77a0b240cf8a0a72817c9d37699ca89c96e0e0d96a7665ac3a7d1febca1a1d79e2cbde8025c271360e2f90048b2d9fd56f45c013e001dad4b7785be69dc01f8a954ef7a84455986fc5c9d5167d91808efdb4476ed79f99563d887cfd4e99809d9e388501dea228cbb3cf3770082dc566455251fd9c2c742963c33500618c6ec99e0bef007408a0462a081237be4c6e5db0258d4be5fc9cf63fd1ace1f4166c053b0fb84fe24917da1255cf40bbb1b45644f6a7699cf802a35a932c374b1d62013e6afca3787627469994c02f622ab877ed5491fc2a89eea60e4e1628da89e3ad600ff6442e4ebf20e47304176b6a1703c094b3cf6d7fbbddd8d8fa5a00f28b4d8f43d88487e9d4531071512f2027198714a8d1cef126775547fc74f2a35840510f325e50361be76557767560055e084f2ecaefa0dd8ca8215301a7a887d2eaddaeb1f5c3dfdbd2cc1ba5f02d4426b98c0f861c5f724405758f442560ea6cd1d953456cc4aac6642ad61c03dbaffc2364d8ec2ef9f483c70355139d1fbd9617ab3c7eedf0b8963c1cfdab769180db43c416a90d9fdf3fd0eb2f81187642b4e2a09d6462d27527fdfda31f7b262501749dcfc6c184983f9923424131d05cc811cacf5c2c87e8e6f135349e68cde0e8997bf1dde248e5124d5dca2681abdbe58d327a8edd585821f03fdd4515728f1336495ba25c9bba56a3f706d60c35cbd0b40d0ac0583a981f9af08510ed8ed0a726e5472f8995af3837fbf1e89587633d2ef944868a153919165778e963710872af12faf96c0919c638e5affa97104471ba6e178d27602f96b9546ebe52190d91be245be08742b96389080676a566d3229e593e4f56a76ae4c58113c6adc1088703b1b92dafe32a5600e14ac1e71df829dfef425911f16a2b91f693599ecabf93065c6c4f5fefca8d4ed095599113529f65d9120d5252f577af95b404979508c343df54e4d239720e7d3a861f1dcabfa69e12d655c8a026c10a4df279b139fd222e561d205ac9b45c1054f8699eca594fb23886e0de565186597766dd5e40f74a423d5708dac254f4172f1089270988fb18715813f13ee4d131b64dd517c7e77f27f804b229f5339ac2f483b14739ac33a9645044d3010bd77ed18fb117f7b11bb51c4ed683b59e28bf25a58f123dfbeb1f0f21f03d9b57d8e61d59b311037a5b757b03ca5c95e0eb73922c6918530c99de4d6733640f2b8d13bebce31d4f5e27aab201101e48cde23a0d7e87b9511949d812e3187ee5ff11bc5858c022ed7b00790eba32f9ef7e134ce5f73a01269ca971b40e62133eca9d596a768686d6390b2c74602f6dc597faec3ed9d9658102d99c9624c1a97d00d63853578afaccc7e30a77fe054ebc23eec45f608f996fd015cd6bd50a111360f0790eff6ffb1ea59d13c8e29480bd96217188f97e53a1f5d9eae0a2badb4fea52f2bb4f8cb04d0afd99e7371a978a7d7ef473f77ea6738ff84af655313a12db24cff692ec7e282245ae9a42338db814593448f7115df3dc3f4e2faa2c2fdbd68f679d6aba01a15031347bb17d8bf8f1fad0ecf365e9dcd32e69803c5c05f4b47adbf8a21af7e9fb327f267df1c914486389a9820edf0a03bde6ef388c255761e439b2f7e1f9c1c3c95bd30c502197ab37f76b52f0d0675f366e919be19329853767bba34a540fb75bcdcc9596a4cda254a660e11bed5af9d8646ac4b7d6d7aa5d7c0005879b6d08058a56c3d3a4d3d401b883153fa7f2f6a6d34dd010f6b9e7b4e457b9ff5a5802d7723abb35f9dca0afc10f6791824dbe0a7725d534e7753445b7268d90145b6438b93fc475f44d5d678d79da6c5770f3a9106f3cffbabe4b88cbe7eda9b8a495be4f6717b0fbee6fec78c86031b6d878d47e357b2089de3e6dd19a265552553d1f7da53884ef84d0eebe782791c48a9c68a28d8ea3bb70c922b01dc20b2cd05cfb276e326651398f766f5faaea54a41da597cf6b50f3d5ebc634185b99069126b8d935c6bc42c47f2109de42091ef4ade3d87cc44aeb78709255501e64f34ac2d4b2725cf7777315f8ca9424bc9d61a896a93500faa6cf5a5aee1fb888e17b47a38a667be2ffa3bae46afa88bfd8b5b6e1186d6e41b9a4e490591043372c23f36fb48d80caff74cc349adc92bb25f701738c809ccf74c47afa193795ee67bc58ea7fd85542fa7e70218490fff212163401cfde016df2f42496bae403d5391e53fe200f758bbcdead0fe72c77861889b9632a257229c35bdfe8fa78375b4f5c768b9c60cafbde1f00aff6ca1879f6472f28001f5f13d4d9d6c3a90e04d8df09873550daa8262d39efbe96a79c697fbcc9a7f27c9f6d782d5d5f6d024b291376e9cc40d902f809072e1f0f2c2ab88ce3d074e88461f5971853e7be749943ab6e25e25e8afa5042dd73407f49b50841c7782c54eece62ec2beef1f16caf1ca5989427bd2726ca0fee33e303702e9892e4382e92c3f3a03a6188f39762db81819c7e12b424be8fd964dcdbfbac00139e8c5a6200506f13f484ac34ef3d26e7cadd53cf402117419c1618205bfa5382486094bd55448f2b1aa4dbec2289189b601b1bbf5792b2a641c6f5dd19cf24abc72fc5264cf11f6b44a4929267a02cd1de1b602b9de65a6c06640aa0f76109baa90d66eeb17295b1711365b7d6835a2dd55b7fe868c59453613240643c847a5b48d27897a58dda63e579c1bba58350550e147b190f0a2c9a5ce719d627ce3302028b4b6801bbfa8cd74874ffba35817c0eca034d19210950796807125fe6065dcd47d7c870ed2db5c00cff235e4154e2d89ec2a09a87551f9b7ca25d519b5603c0c33d2cf72878199ffab567fc5e093529b89d1163587f3564ba8291d2d96cf9762e7f568e786ea90849f6312c1a10f45d61600cd45c48e6870a7d76c913f9c4497374fc04401cbd11f7710740148234fe8f041f24d0278fcfd48846e6aa49f05016fc332dc5d46b4a26574fed5c0751cebb9f7ab4cdbc1ee011d82d6ef95c52c9df8eedac3ab5cf30805f23d88d4f707601f8e6c606b58f2fe234e948d6756d430a5c4ec76a33874886c8fb484059b47a9bd198a61a1896419288a9e81d0969dec778a53e8233f0f63bd0134e5f29825e7817e7c8ccb7d9acd8f86ac9d3af78c43df3036d7934dd294f2bb12063bee52c547d27a218145befb0ca96cbfaabd39fa245b51c39f4cd4cf8db105f9dc46a7aaa8f7d06fa208120ce1ac49326179618fa2c8596c44e174eb7a141056b1d17689c10dee089c8b0867b8a757ae12251bbd68db5fba2be341275fb6ee379309f5cde9b31242b0b2bac44da74776fac141936bd96e3177161f057c820a8c22cca8cce29b158eb55aed0260253fbee70a6dd281d9fca23e0b0a38d46c76a95e1262f1cafcf0fc37b52e649a1ba1e2c0f97d10bbf4d2b5632cf340bce56736071d5885ec9b4e179100a0000000000000021e43fc21e89c6865d3ad424ef4a14efe8843ff3168c99ee395400dcc8755719d290c567c95a5e7d28ec1190ceee240084d444265cc801cd960f69b368359bbf06b8a4ec23b47c7bf9d4b16c701a1c4fb9e81abb55bf49d450b566ce03de939fc6f5c51291380086f8c995cdd4fa15a325601c4846a69f15c77f55c900270bc9ea5f406480cb0e3e89bc869fe8b7cec4fbef7e76283d50c25ab1b4d34d093a7df062990a925a9c44aa2661abd7d381a4d6cdb64821ef624dd51b72e99af914bca2f80c25b82ac6945df7c7582e6d0ce2cd073e35f1fc120a68ba210410db64592a9aa319b30f2b818c495750e1cea0610e27d52be31e52e501a3bd51b501bc51c2ec8592f679b6e55b9aa58d513fd2bebadc83ba76eb45e5676f130193e9a666b8c8132c9f5141681fbab324b555c5c890d488ac2dd00feead0a20fbd8a46391438e3193edc6fb89161cd864fca98f4f39a2893c933dcd13bc8c5d5a548d24862e8161c0fad7f33aca8c86791d620815fe3f0daddb5defd933d0c10097a7a98e67625420b6c0db7c3e17ab07ea64e6f0f53fdc670799e06a2e3a871d6be363a2639e35339361311e0f528cc433eacea4f79bf217108c7b1d657840253ffdea18bdd1f93cdee63e7a9b8dbcb4ee06162b253e09ea0641f2771bd9823dd210905e9ea495f43194bb471cdeb690e8890b03b50835d53dde1b572dd123ccc8507bb57a45e46c0efb8fb3d5596bddf9782d86dd911636eae2cf64b5829cf8893faf789be3fa22859accf688f5b5da6c29cacc96d477e23b63cc934f685b6e42e1655c9a9b94d6d78402de22b8d9776e3915391aa258e57467d770d65480ba2f6a94b0337965a8c659c42b4e90a14da4697d0c0a6d74774c94c52d8ecb694eee747bdaa6c3a6d60739db18c6446090eebba72e62ab88b0e8b88e728ba8cb133d8524eda89a2bff1c8414da3edfa6f83788331c8a7e5a8af2dd3682d4752190a3c689949abdad8350111373e7fb46151f54a10f79d91940e37efb05f9f157bddcfacf018b65a38ab614807c34a2786af4a1d48c4d1c1abd31815715f9d1b103992207fc664f12c82fd923c57d8e7cfb9f4af55182318d055c704865cf484206d60e34cf7fe9b6ce60b1772c5c7cdacb6695227d80da18ec1f98a434b1aaf9edb6d082f5663aed2bf267e559dca6b93d3ce34273846fc677f529690482df0a8f782b8ad7269f344f5f2b4d320a7ce2d2fa02284f8db634dc930c3e2b9a629245364acf35d41e9a14c88efde4e742ef1ea4b43d0caf2e70d4a617278823e6403934524debbd933e7676e441a48f630dc83cccd55d9032d6bf3dea97d1669c39fb865b0e619eeb3f5461e517000f5aee3ef2abdb87d3a76b88e140eb4644a9fbddbdc9e20972cdfacf00bffa3a1ca5f84122c2ebc54067cdaa23967eaeb7bbbfe44e5843382b834fae1f62a066688595e4ee67c7ff9858672355abf7893ebeb4bcf88a62b2237c6e6cec9aebe3f28bfc310ced3a590e88d4bd0f53289206deb9addbf6f3c02115ce4980dadfc112683ae250c2d438fd9c0f2a090dbf122a0072828db798bdb868dcd47384dd3f5eeebc0307a5b268683cd51f312e8f02b5a7746b11a97ac43287d9b9765f03c720503cfe6e0117660a4c00d67895224c4d42b032000a10d7a743054758a8f54941fd5eaf72498b678d1579b3de4e5518f90f1e3d32517d09d7f5da9d180215e66218e9dd64036819cf12638ce82712a6cc79a9ddb36e86814b797d72c2bc58b18ba439e99965f745b4fb7de2878e3186e3e7b835c746b0935f6c67e92e3770bd8d5eb4f66d8175ceb7850e418c55e574db891639aa77fc62bc45dcb734681ede8484d4d4109a9adb8c3d00", 0x2000, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)={0x20, 0x0, 0x0, {0x0, 0x9}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x24c01, 0x0) io_setup(0x202, &(0x7f0000000200)=0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x48, 0x3, 0xa, 0x101, 0x0, 0x0, {0x2}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TYPE={0x8, 0x7, 'nat\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_HOOKNUM={0x8}, @NFTA_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELTABLE={0x14, 0x2, 0xa, 0x5}], {0x14}}, 0xa4}}, 0x0) io_submit(r3, 0x20, &(0x7f0000000780)=[&(0x7f0000000440)={0xfffffffe, 0x20011004, 0x4, 0x1, 0x0, r2, &(0x7f00000000c0)='!', 0xb7f40, 0x407f0b00}]) dup3(r2, r0, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f00000000c0)={'syztnl0\x00', &(0x7f0000000040)={'ip6_vti0\x00', 0x0, 0x29, 0xfb, 0x0, 0x3, 0x2, @local, @private0, 0x20, 0x20, 0x1, 0x8}}) setsockopt$inet_IP_XFRM_POLICY(r2, 0x0, 0x11, &(0x7f0000000100)={{{@in=@loopback, @in6=@private0={0xfc, 0x0, '\x00', 0x1}, 0x4e22, 0x7079, 0x4e22, 0x0, 0xa, 0x80, 0x20, 0x32, r5, 0xee00}, {0x7, 0x0, 0x7, 0x2, 0x6, 0x6, 0x1, 0xffffffffffffff4f}, {0x9, 0x7, 0x291f162}, 0x6, 0x6e6bb9, 0x0, 0x0, 0x3}, {{@in6=@remote, 0x4d3, 0x6c}, 0xa, @in=@remote, 0x3507, 0x0, 0x3, 0x2, 0x68000, 0x3, 0x401}}, 0xe8) syz_usb_connect(0x5, 0x24, &(0x7f0000000000)=ANY=[@ANYRES16], 0x0) 22m36.965834626s ago: executing program 34 (id=356): openat$tun(0xffffffffffffff9c, 0x0, 0x22000, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, 0x0, {0x0, 0x6}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_qfg={0x8}]}, 0x2c}}, 0x24040084) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=@newqdisc={0x30, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r6, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x3f000000, 0x400dc}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) sendmsg$nl_route_sched(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x24, 0x29, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x2, 0x1}}}, 0x24}, 0x1, 0x0, 0x0, 0x400dc}, 0x40) 22m30.354768045s ago: executing program 35 (id=377): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x8202, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x200, 0x0) (async) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) fanotify_mark(0xffffffffffffffff, 0x1, 0x4800003e, 0xffffffffffffffff, 0x0) (async) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) setitimer(0x2, 0x0, 0x0) (async) r5 = syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0xffffffff, 0x400, 0x2, 0x3}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000300)=@IORING_OP_OPENAT={0x12, 0x0, 0x0, 0xffffffffffffff9c, 0x0, &(0x7f0000000480)='./file0\x00', 0x0, 0x80}) io_uring_enter(r5, 0x3516, 0x0, 0x0, 0x0, 0xfffffdcf) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f00000000c0)={&(0x7f0000000540)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x38, 0x18, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOWTABLE_HOOK={0xc, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x7}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x60}, 0x1, 0x0, 0x0, 0x20000000}, 0x8000) r9 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) (async) syz_open_procfs(0x0, &(0x7f0000000080)='mounts\x00') r10 = syz_io_uring_setup(0x88b, &(0x7f0000000200)={0x0, 0x3f81, 0x10, 0x4, 0x6fd}, &(0x7f0000000000)=0x0, &(0x7f0000000580)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r11, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) (async) io_uring_register$IORING_REGISTER_PERSONALITY(r5, 0x9, 0x0, 0x0) (async) syz_io_uring_submit(r11, r12, 0x0) (async) io_uring_enter(r10, 0x4047f6, 0x0, 0x4, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r9, 0x4020ae46, &(0x7f0000000500)={0x0, 0x1, 0xdddd0000, 0x2000, &(0x7f0000000000/0x2000)=nil}) (async) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) (async) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_HAS_DEVICE_ATTR_vm(r1, 0x4018aee3, &(0x7f0000000100)=@attr_arm64={0x0, 0x0, 0x0, &(0x7f0000000080)={0x2e9, 0x7ff}}) 22m25.348432755s ago: executing program 36 (id=388): socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000180)) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x800008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, 0x0, 0x0) openat$null(0xffffffffffffff9c, &(0x7f0000000000), 0x494002, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000000)=@bridge_dellink={0x34, 0x13, 0x5, 0x0, 0x0, {0x7, 0x0, 0x0, r3}, [@IFLA_AF_SPEC={0x14, 0x1a, 0x0, 0x1, [@AF_INET={0x10, 0x4, 0x0, 0x1, {0xc, 0x2, 0x0, 0x1, [{0x8, 0x1}]}}]}]}, 0x34}}, 0x4) r4 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x3fc, 0x0, 0x32}, 0x9c) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r5 = fsopen(&(0x7f00000003c0)='proc\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000940)=@base={0xe, 0x4, 0x4, 0x2}, 0x50) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xd, &(0x7f0000000200)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r6}, {}, {}, {0x4}, {0x6, 0x0, 0xa}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x33}}, @call={0x85, 0x0, 0x0, 0x11}]}, &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r7, 0x2000012, 0xe, 0x0, &(0x7f0000000280)="63ec33c9e9b98600000000000000", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xb}, 0x50) r8 = fsmount(r5, 0x0, 0xa) fchdir(r8) ioctl$KVM_SET_REGS(r8, 0x4090ae82, &(0x7f0000000000)={[0x1, 0x0, 0x0, 0x9, 0x7, 0x0, 0x101, 0x65, 0xb, 0x6, 0x8, 0x4, 0x3, 0x2, 0x1], 0x1000, 0x1}) chroot(&(0x7f0000000300)='.\x00') openat$sysfs(0xffffffffffffff9c, &(0x7f0000000100)='/sys/kernel/fscaps', 0x202, 0x45) 22m17.332971987s ago: executing program 37 (id=398): r0 = socket$inet_smc(0x2b, 0x1, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r0, 0x0, 0x80, &(0x7f0000000600)=@broute={'broute\x00', 0x20, 0x0, 0x90, [0x0, 0x0, 0x0, 0x0, 0x600, 0x200000000040], 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB="00000000ca32c7329458e68a330a721f000000000000000000000000000000000000000000000000000000000000000000000000ffffffff000000000000000000000000674ae874c8a3ac27c779eb0000000000000000000000000000000000000000000000000000000000000000fcffffff00"/144]}, 0x108) 22m6.111176812s ago: executing program 38 (id=408): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_GET_BTF_INFO(0xf, 0x0, 0x0) r3 = dup(0xffffffffffffffff) getpeername$packet(r3, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={0x0}, 0x18) socket$xdp(0x2c, 0x3, 0x0) socket$inet(0x2, 0x800, 0x6) bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000e00)=ANY=[@ANYBLOB="18000000030000000000000026d0000095002b000000000093adffa87d2255f674412d020000000000005ab527ee3697f1ec4436dd1164aa93cc5800075557165397000a63f6b9b3f427f6ba6b34f98125f30e697fffffffffffffffa30b273683626e0003254d570dca6b78ad833488cfe4109eaf009edd3e69613d3cd6aaa300006eee8501000000520a0000151d010000000100bf00000000cc587424363dc6ad7f3bbd424c6e6cafbe9309aba218a52001a3cd000041f0db74596fd72c002a60c1bc7dc8c38b7d2e13c50424b9dd1145d03ff45f70685c6bd9ff41c69b7de4758c1096a1dc52f29e470a000517ebc406e89dcbb7677e6528b0856e31ed9474ac24cf609068f645ce971fc0480737a55ebb0bd701f7ff21e88b3cfc22df01e4bac9d97328fa2a82b5e8741e02056d933bed759ff232cebc68b91af50479387467824262852c7939db5672d07cdbe8e14abf56497e5d56d06c759da324a39f7f51b870b2851c3f0a1aab71587a21c8f1b3369ebfcba105a6ccdd01b0f04edb256c604f068773f6ff000000000000006ffbfe5ca32142b0195531458b7d1e341c6f864f983d745f5865aad41d2915aae7602a2d6cd415e8351ebc4223f54d6bec664709ff03f1aa3dc7f1580ace9bf2afd28d7157e67fb98d121ad6eb372713255012e028cb2654d493a0b4b35faae176c89b745eda2967199cc936859a537e8e4871d4acf3e3dc10e13ef227f627a40000ad1fa253d33fa74f172d3407ae4e1e347c0cff28235a3cbb5d33b09bc30cf2880c586272c3f4d79bc36305745cb1cb385e6add14652003c7cdd3324f07d134d3ed07f1c10900000009dd872ec66ea6c718bbd1aa59114000f0be4c6f8df084c5e9734ae30aa9afdc719bf01ab03a9b1074407136b4506000f0916a39d3057d50183612b39e73aeeb6eaf14652dda68e98ef938e6515a94a71836469e2051d9b7eb85f3f2d5ae2c51944da8d7391d6d6b97419a3b7660df4c5124ca425d374b371867a79b31c6617fc3327191fbf514573f0e30d1d60be2168fe6c2f3dccd599a2cb77f124e22f87673675805494db821f39b50d938d5fd8c6b2a3a324c257b84000000b749ccd74089ed6b86f81ca3d247d8f71d290ed1b1a11f7a67125170c88c3b6a50696332226401b110da9c786eeca22debc99335583b54c13c3130978fa069af8223b38ced735c2d905f51ca85ffa4add5647489b3960127696cf2f16625c0c102000000000000009ef52134842e64171f3963841086e3797a4825d081f2d987f05c5341877386ec55d7dc958fd235d6071619a65d4b82d9c162f3556076b80550d961ca74f1ffdaccf0ea5f02e0fca8b27ff3983ab74fd3d560700a1fbb44e77e312b3b129e000302d613916c9bcf9f0000fac73adb6bfb27f88dba816020be760f7b45e001efada800000000000000fdaf4660402f7b3b79a433e08074ea2462974ab2cbd247eb1cfa2638f56daee57ed14bc74de0fd87a9ce638190f3570e0b4c80ef682df22237270955afb6008846557ee3bc09fda6dbb6542e597300eb82a184c96ffde5a30e5433d86666cb045bdd02c804c22ff2635c7bfbf5c0d586cda5e1e88a4d41dee7cc74f822278d124638fec58faeb48afe324369cc51204158bb440df2a694f4cdcaa4f65c22f000000000000000000000000000d503d79906958102000000000000000000001ffff0ef89b2a635edb2dd163e863315e84498dfb52b7f54da6398cbedaa42cc17c4563c859656a357770289a61faa95a82bf1cfb7f2fd7252e9322abe282c3344fc6738b4467893b9bf0d1c8130ae6b226900110635376413c29f7c6f7b7e29b9f4bddd5e328661f4046e01f7d7dc22174e5e627a6f608ad53a4168d4d8f7fbc71104512efe8e5d7d934aa289b4db2b870000000000000000000000000000000000000000009b777883a0f9cf4ad155110cd3ace2b322ac31bfa27847dc99c8a69a1ea5b98e525e6393ad7fd9795170e7b11e4fa990b9386910a6a1a66a70eaff01247603c2ff49d3979676bffb3049166ab84a0f061991bd57c2566c10c282352a5105b6164e3f2491e4793e590dcc71de10da96fdff40dd44a2c9882d3aa0f8a797b8fea6efcfb5046b7679f15559cdaa977504c40b2f777acb907ebf5fc14add71d0bca37405ded69b77ab4a3d7487fd50c5e22ade17556abb722d9c085b189b5fd1f30e8dc813f60400fde1f88d830b11002135e8e7262f299ed7923bfbe00ad88be179e56b41ff3792cee2fc37eee739c3e3af923e8738d93d583a9cf00b946960fc38cf85aae7cf708f9a9d166f2e352a06d99b8be476d1cc2a53a859ae4fdab2a987925d12422474ac044ffe9fe2bf9bf9bbdf36c4ca89c516647542ac45545337829fa7039d155ebda42d4c14f4ca7f8b5d5842658c62d0a03092b94fa1b19f190000000000000000000000000000009e75a32b9fafeffd890f2759b0fe3add33fa43a4c3995458f86a926ad56b23571c46728c039cd3b4bb7d69dfa27782b953a7b81cc161912b3e5716360686e126311a7e21bfa2efd0f57b90c203528c8f620d3c7b31c7abcffae382f53500f7cd5d00159e5f741d3e2d2cbd1a04b3f39b50a4683daa7d117b7f4a149c954d69d8ab001339e464c8eb5f0c63899010757c9a3b69f4920531b83f71d5a34ef9405819afee15b77c015ea755c95127ff2274bb9a8463ce4b8c08ad70596ad2b2b044e660ed144b9dce372450ea69d25da2b6deed67fac26e765aa7d5532ba1044f62db049486acde2294127cb767c23da7d8f9844d3be5b6aa83ee4ce1876af5130efe1b64ccb6bbd349bcc0e8deec8ab3bd1b35bbc8ab8a152771744baa576b9223d26b5603a7f091be1264cabaf661fe2dbe7990a61f710f923f2337818a3983d06c11a6bee7fccb78a53c56db5c18f920d2194374db665dcadf53b8d0014e682ec721d67a7ab6c817fe53c86f8900000000000000000000000000000060b7b827c56e973a2ab5bc5c558ada68c4ec3762f5957b20b919af5d53c87de056a397bdcb614c34761e2c815698e1f9f5521a385c2910850929040a4eba573e91ca21fc855358120ecd79a5d7007693ef3ff9d2b993d114443d53c53094e516f675b2a7074584714e7a2015e05e507811b4ca89c39281c9ada5f58ceb55893cca783ab09c9a19836a3a2c715b10436a5731549e364679ecd8461a68433ab52b1108831edb9654dc602183c1170d6881647f6dca15d57fb76357d815c5f1000000000000000000f49e327c0b6e511494466cec78650f0a6267"], &(0x7f00002bf000)='syzkaller\x00', 0x4, 0xb7, &(0x7f0000000040)=""/183, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000)={0x5}, 0x8, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffff88}, 0x94) r4 = socket$kcm(0x29, 0x2, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e2b, 0x2, @empty, 0x5a60}, 0x1c) ioctl$sock_kcm_SIOCKCMCLONE(r4, 0x89e2, &(0x7f0000000400)) 21m55.28872936s ago: executing program 39 (id=416): r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='blkio.bfq.group_wait_time\x00', 0x275a, 0x0) write$UHID_CREATE2(r0, &(0x7f0000000340)=ANY=[], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x88fd537e5c114b6e, 0x11, r0, 0x0) r1 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000e80)=@filter={'filter\x00', 0x42, 0x4, 0x2b0, 0xffffffff, 0x260, 0x2f8, 0x3c8, 0xffffffff, 0xffffffff, 0x3c8, 0x3c8, 0x3c8, 0xffffffff, 0x4, 0x0, {[{{@ip={@rand_addr, @local, 0x0, 0x0, 'ip6tnl0\x00', 'wlan0\x00', {}, {0xff}, 0x84, 0x2, 0x2}, 0x0, 0x70, 0xb0, 0x0, {0x100000000000000}}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x7, 0xd0, {0x9}}}}, {{@ip={@loopback, @rand_addr=0x64010101, 0xffffff00, 0xff000000, 'geneve0\x00', 'macvlan0\x00', {0xff}, {}, 0x2e, 0x0, 0x4}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x88000000}}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x3}}}, {{@ip={@private=0xa010101, @loopback, 0xff, 0xff000000, 'bond0\x00', 'dvmrp0\x00', {}, {}, 0x2f, 0x0, 0x21}, 0x0, 0x70, 0xd0}, @common=@CLUSTERIP={0x60, 'CLUSTERIP\x00', 0x0, {0x1, @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}, 0xd, 0x8, [0x8, 0x27, 0x3d, 0x16, 0x13, 0xe, 0x33, 0x2f, 0x2d, 0x32, 0x3f, 0x20, 0x28, 0x18, 0x22, 0x12], 0x0, 0x0, 0x6}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x310) 21m46.224612416s ago: executing program 40 (id=424): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) ioctl$sock_FIOSETOWN(0xffffffffffffffff, 0x8901, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000340)={0x9, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs(0x0, &(0x7f0000000100)='syscall\x00') getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000002c0)=0x14) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r1, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r1, 0xfffffffc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000040), 0xffffffffffffffff) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) connect$inet(r4, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000009c0)=@newlink={0x28, 0x10, 0xc362e63b3f31ba5f, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x100, 0x80e1}, [@IFLA_GROUP={0x8}]}, 0x28}}, 0x0) sendmmsg(r4, &(0x7f00000094c0)=[{{0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000300)="eb", 0x1}], 0x1}}, {{0x0, 0x0, 0x0}}], 0x2, 0x80) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000240)={0x28, r3, 0x7, 0x0, 0x0, {}, [@MPTCP_PM_ATTR_ADDR={0x14, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x2}, @MPTCP_PM_ADDR_ATTR_ADDR4={0x8, 0x3, @local}]}]}, 0x28}}, 0xff1f0000) ioctl$KDSETLED(0xffffffffffffffff, 0x4b32, 0x3) ioctl$VIDIOC_S_EXT_CTRLS(0xffffffffffffffff, 0xc0205648, 0x0) ioctl$VHOST_SET_LOG_FD(0xffffffffffffffff, 0x4004af07, 0x0) ioctl$VHOST_SET_VRING_KICK(0xffffffffffffffff, 0x4008af20, 0x0) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000c00), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r6, 0x4008af00, &(0x7f0000000000)=0x200000000) write$vhost_msg(r6, &(0x7f0000000540)={0x1, {&(0x7f0000000040)=""/62, 0x3e, 0x0, 0x2, 0x2}}, 0x48) write$vhost_msg_v2(r6, 0x0, 0x0) write$vhost_msg_v2(r6, 0x0, 0x0) write$vhost_msg_v2(r6, 0x0, 0x0) 21m11.611695737s ago: executing program 41 (id=476): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r3}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x2, r0, 0x2, 0x0) clock_gettime(0x6, &(0x7f0000000240)) r4 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r4, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r5}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xb, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x11, 0x4, 0x0, 0x0, 0x0, 0xfffffffe}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r6}}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000000)='/sys/power/pm_debug_messages', 0x42, 0x104) io_setup(0x20, &(0x7f0000001140)=0x0) io_submit(r8, 0x1, &(0x7f0000000300)=[&(0x7f0000002040)={0xf, 0x400000000000, 0x0, 0x1, 0x0, r7, &(0x7f0000000200), 0x0, 0x5}]) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) syz_io_uring_setup(0x10f, &(0x7f0000000300)={0x0, 0x8d2dc, 0x0, 0xffffffff}, &(0x7f00000003c0)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r11 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r11, &(0x7f0000000040)={0x1, 0x6}, 0x2) write$USERIO_CMD_REGISTER(r11, &(0x7f0000000100), 0x2) write$USERIO_CMD_SEND_INTERRUPT(r11, &(0x7f00000000c0)={0x2, 0xfa}, 0x2) syz_io_uring_submit(r9, r10, &(0x7f00000002c0)=@IORING_OP_LINKAT={0x27, 0x5c, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000280)='./file0\x00', 0xffffffffffffffff, 0x3000}) 21m9.336102909s ago: executing program 42 (id=483): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80281, 0x0) pipe(&(0x7f0000000140)) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x48) ioctl$KVM_SET_PIT2(0xffffffffffffffff, 0x4070aea0, &(0x7f0000000000)={[{0x3cd2ef60, 0xfffd, 0x1, 0xff, 0x8, 0x80, 0x8, 0xb, 0x90, 0x0, 0x7, 0x7, 0x3c5baf4e}, {0xa9, 0xd9, 0x0, 0x2, 0x7, 0x8, 0x5, 0x6, 0xb, 0x1, 0x3, 0x9, 0xf2}, {0x7fffffff, 0x4, 0xc, 0x2, 0x0, 0x2, 0x7, 0x0, 0x6, 0x4, 0x8, 0x4, 0x1}], 0x7}) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r4, 0x4048ae9b, &(0x7f0000000080)={0xd0003, 0x0, {[0x303, 0x6, 0x7, 0xffffffffefffff11, 0x3, 0x0, 0xa99, 0xb37f]}}) ioctl$KVM_RUN(r4, 0xae80, 0x0) 14m40.35599096s ago: executing program 43 (id=1819): r0 = socket$unix(0x1, 0x1, 0x0) bind$unix(r0, &(0x7f0000003000)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) r1 = syz_open_dev$video4linux(&(0x7f0000000080), 0x8, 0x88000) ioctl$VIDIOC_LOG_STATUS(r1, 0x5646, 0x0) listen(r0, 0x0) syz_usb_connect(0x0, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1adb2361000000010902"], 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) mount$9p_unix(&(0x7f0000000180)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000000)='\xe9\x1fq\x89Y\x1e\x923aK\x00', &(0x7f0000000040), 0x0, &(0x7f0000000400)) 8m44.996338981s ago: executing program 4 (id=3096): socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@remote, @in6=@empty, 0x8000, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}, {}, {0x0, 0x1000000}, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@flushpolicy={0x10, 0x1d, 0x1}, 0x10}}, 0x0) 8m40.211148933s ago: executing program 4 (id=3113): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r4 = accept4(r3, 0x0, 0x0, 0x800) sendmmsg$alg(r4, &(0x7f0000000c00)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000240)=[@assoc={0x18, 0x117, 0x4, 0x14}], 0x18, 0x20000040}], 0x1, 0x8040) sendmsg(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000340)="cd7b9d51", 0x4}], 0x1}, 0x4008001) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r4) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000000) 8m39.958741991s ago: executing program 4 (id=3114): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x8000, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) r3 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1d) ioctl$KVM_CAP_VM_TYPES(r3, 0x4068aea3, &(0x7f0000000080)={0xeb, 0x0, 0xc}) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x800000000000008a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) r5 = gettid() r6 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x80, 0x0) syz_fuse_handle_req(r6, &(0x7f00000021c0)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005468a9fe52386e52000000000000000000000000000000000000001000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000da0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000f7ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bb33ea699a80e3f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, 0x0) r7 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000340)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0xc004}, 0x4000) r9 = socket(0x10, 0x3, 0x0) readv(0xffffffffffffffff, &(0x7f0000000600)=[{&(0x7f0000000140)=""/25, 0x19}, {&(0x7f0000000240)=""/16, 0x10}, {&(0x7f0000000300)=""/82, 0x52}, {&(0x7f0000000500)=""/219, 0xdb}, {&(0x7f0000000380)=""/36, 0x24}, {&(0x7f00000003c0)=""/9, 0x9}, {&(0x7f0000000480)=""/49, 0x31}], 0x7) sendmsg$nl_route(r9, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)=ANY=[@ANYBLOB="240000006800019f000000000000000002000000000000000800010001000000040004"], 0x24}, 0x1, 0x0, 0x0, 0x24040880}, 0x800) ptrace$ARCH_SHSTK_LOCK(0x1e, r5, 0x1, 0x5003) r10 = socket$nl_generic(0x10, 0x3, 0x10) r11 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r10, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r11, @ANYBLOB="01000000000000000200010000000000000001"], 0x34}}, 0x0) sendmmsg(r9, &(0x7f0000000000), 0x4000000000001f2, 0x2000000) 8m38.526921114s ago: executing program 4 (id=3120): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getrlimit(0xf, &(0x7f0000000580)) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18020000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb703000008000000b70300000000002085000000720000"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000040)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x18) r3 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r3, &(0x7f0000000200)={0x2, 0x4e20, @empty}, 0x10) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000000c0)='freezer.state\x00', 0x275a, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f00000004c0)='contention_begin\x00'}, 0x10) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000000)=@newlink={0x40, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a8ffad, 0x6010000}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @wireguard={{0xe}, {0x4}}}, @IFLA_MTU={0x8}]}, 0x40}}, 0x0) 8m35.673422969s ago: executing program 4 (id=3123): socketpair$unix(0x1, 0x1, 0x0, 0x0) bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000380)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in=@remote, @in6=@empty, 0x8000, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xee01}, {}, {0x0, 0x1000000}, 0x0, 0x0, 0x0, 0x0, 0x1}}, 0xb8}}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r1, 0x1, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x400000bce) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$nl_xfrm(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)=@flushpolicy={0x10, 0x1d, 0x1}, 0x10}}, 0x0) 8m31.725331584s ago: executing program 4 (id=3137): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) clock_gettime(0x6, &(0x7f0000000240)) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r3}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xb, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x11, 0x4, 0x0, 0x0, 0x0, 0xfffffffe}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) io_setup(0x20, &(0x7f0000001140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0xfa}, 0x2) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_LINKAT={0x27, 0x5c, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000280)='./file0\x00', 0xffffffffffffffff, 0x3000}) 8m15.47471132s ago: executing program 44 (id=3137): sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000e8ffffff850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) clock_gettime(0x6, &(0x7f0000000240)) r2 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000540)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x3, 0x8, &(0x7f0000000740)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r2}}]}, &(0x7f0000000780)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0xa0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r2, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r3}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0xb, 0x8, &(0x7f0000000100)=@framed={{0x18, 0x0, 0x0, 0x11, 0x4, 0x0, 0x0, 0x0, 0xfffffffe}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r4}}]}, &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) io_setup(0x20, &(0x7f0000001140)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f00000000c0)={0x2, 0xfa}, 0x2) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_LINKAT={0x27, 0x5c, 0x0, 0xffffffffffffffff, 0x0, &(0x7f0000000280)='./file0\x00', 0xffffffffffffffff, 0x3000}) 5m38.296321808s ago: executing program 0 (id=3712): r0 = syz_usb_connect(0x0, 0x202, &(0x7f0000000180)=ANY=[@ANYBLOB="1201100152018b401e040740185d000000010902f00101040000030904"], 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000070000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000000000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prlimit64(r2, 0x5, &(0x7f0000000000)={0x3, 0xf}, &(0x7f0000000280)) r5 = openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendfile(0xffffffffffffffff, r5, 0x0, 0x20000023896) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000cc0)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@ip_tos_int={{0x14, 0x0, 0x1, 0x4}}], 0x18}}], 0x1, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCBRDELBR(r6, 0x89a2, &(0x7f0000000200)='bridge0\x00') bpf$MAP_CREATE(0x0, &(0x7f0000001540)=ANY=[@ANYBLOB="06000000040000000ddfffff01"], 0x50) syz_usb_control_io$hid(r0, 0x0, 0x0) 5m34.248112935s ago: executing program 0 (id=3736): socket(0x10, 0x803, 0x0) clock_nanosleep(0xb, 0x0, &(0x7f0000000000)={0x77359400}, 0xfffffffffffffffe) clock_adjtime(0x0, &(0x7f0000000040)={0x10000d4f, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x1, 0xfffffffe, 0x7, 0x2, 0x0, 0x0, 0xfffffffffffffffb, 0x1700000000000000, 0x0, 0x3, 0x0, 0x2, 0x8, 0x3, 0xfffffffd, 0x0, 0x6, 0x3}) 5m32.380592878s ago: executing program 0 (id=3743): socket$nl_generic(0x10, 0x3, 0x10) openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) accept4$vsock_stream(0xffffffffffffffff, 0x0, 0x0, 0x80000) socketpair$unix(0x1, 0x2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000600)={0x9, 0x20000008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) getsockopt$PNPIPE_IFINDEX(0xffffffffffffffff, 0x113, 0x2, &(0x7f0000000040)=0x0, &(0x7f0000000100)=0x4) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000240)={'syztnl2\x00', &(0x7f0000000180)={'ip6tnl0\x00', r1, 0x29, 0x3, 0x6, 0x5, 0x40, @remote, @ipv4={'\x00', '\xff\xff', @remote}, 0x7, 0x1, 0x81, 0x4a07}}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_open_dev$tty1(0xc, 0x4, 0x2) ioctl$KDFONTOP_GET(r4, 0x4b6a, &(0x7f0000000000)={0x1, 0x40000000, 0x0, 0xfeff200d, 0x0, 0x0}) add_key(&(0x7f0000000000)='asymmetric\x00', 0x0, 0x0, 0x0, 0xfffffffffffffffe) ioctl$SIOCGSTAMP(r2, 0x8906, &(0x7f0000000280)) r5 = socket$nl_route(0x10, 0x3, 0x0) bpf$LINK_DETACH(0x22, 0x0, 0x0) openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x0, 0x0) r6 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/power/disk', 0x121a02, 0x0) sendmsg$NL80211_CMD_GET_KEY(r6, &(0x7f0000000400)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)={0x48, 0x0, 0x400, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8}, @val={0xc, 0x99, {0x10, 0x1}}}}, [@NL80211_ATTR_KEY_CIPHER={0x8, 0x9, 0xfac01}, @NL80211_ATTR_KEY={0xc, 0x50, 0x0, 0x1, [@NL80211_KEY_IDX={0x5, 0x2, 0x2}]}, @NL80211_ATTR_MAC={0xa, 0x6, @broadcast}]}, 0x48}, 0x1, 0x0, 0x0, 0x4004810}, 0x4000044) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000009c0)=@newtaction={0x6c, 0x30, 0xffff, 0x0, 0x25dfdbfe, {}, [{0x58, 0x1, [@m_ife={0x54, 0x1, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_IFE_METALST={0xc, 0x6, [@IFE_META_TCINDEX={0x6, 0x5, @val=0x9}]}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x1, 0x9, 0x7, 0x5, 0x1}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x0, 0x3}}}}]}]}, 0x6c}}, 0x0) r7 = socket(0x2b, 0x80801, 0x1) connect$inet6(r7, &(0x7f00000005c0)={0xa, 0x4e23, 0x8, @loopback, 0x1}, 0x1c) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) unshare(0x68040200) 5m30.082626608s ago: executing program 0 (id=3752): prlimit64(0x0, 0xe, &(0x7f0000000000)={0x2, 0x7}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x0, 0x0) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000005580)=""/102392, 0x18ff8) syz_genetlink_get_family_id$nl802154(&(0x7f0000000640), 0xffffffffffffffff) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x3}, 0x50) bpf$PROG_LOAD(0x5, 0x0, 0x0) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000d40)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x16, 0x14, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000001e00000000000000200018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000000085000000820000001801000020646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000007300000095"], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @flow_dissector, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000640)={r2, 0x0, 0x4, 0x2, &(0x7f00000006c0)='\x00\x00\x00\x00', &(0x7f0000000000)=""/2, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) mq_open(0x0, 0x42, 0x0, 0x0) 5m29.673550767s ago: executing program 0 (id=3755): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000140), r0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r2, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e24, @local}, 0x10) getsockopt$ARPT_SO_GET_ENTRIES(r2, 0x0, 0x61, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r5 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_FLAGS(r5, 0x3ba0, 0x0) ioctl$IOMMU_HWPT_SET_DIRTY_TRACKING(r5, 0x3b8b, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xa3f58dc55767b1b9, 0x3, &(0x7f0000000100)=@framed, &(0x7f0000000000)='syzkaller\x00'}, 0x90) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r6, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={0x0, 0xe8}, 0x1, 0x0, 0x0, 0x20000050}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0x400000)=nil, 0x40001e, 0x18) ioctl$IOMMU_DESTROY$hwpt(0xffffffffffffffff, 0x3b80, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) r7 = openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0x8002, 0x0) write$P9_RSTATu(r7, &(0x7f0000000580)=ANY=[@ANYBLOB="300200007d00000005bf00000000000000000c000000000000000000000000000000000000000000000000000000000000001b00046e6f6465767b65766f6f7e0539c60005000037d93a8b920000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500002b595fcb14034354b9fd9ef196a51cd5157adc8103b494e11400cfc26dd7c500f04cd85f2a70f5e9930e3c5db45a5500f8f669fb716dcf315ecaf385409ac65b9408678c2c3b9e1d52c36cde7ba4a400b4b0b4f174a666a8529a451b3407dbdab2884baf050000000000000047ec21cabff20f9c1cbe36f4fd1a4cc280e8e289da649a37002c016f6465762f6eb17b2300f9daa5ee23266ecf85fea65e42d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae894806878267d5a1298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d723859dba3f93aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb4827"], 0x230) r8 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f00090581d7"], 0x0) syz_usb_control_io$hid(r8, 0x0, 0x0) syz_usb_control_io$hid(r8, &(0x7f0000000840)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00220f000000540b4550182195f51584b3"], 0x0}, 0x0) syz_usb_control_io(r8, 0x0, &(0x7f0000000980)={0x84, &(0x7f0000000340)=ANY=[@ANYBLOB="000001000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$IEEE802154_ADD_IFACE(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000000c0)=ANY=[@ANYRES32=r8, @ANYRES16=r1, @ANYBLOB="01000000000000000000220000000a0001007770616e3000000005002000000004000500200000000000050020000000000009001f"], 0x44}, 0x1, 0x0, 0x0, 0x880}, 0x44) 5m23.792278224s ago: executing program 0 (id=3787): ioctl$BLKFLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0xffffffffc7fd61dd) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb, 0x0, 0x0, 0x10, &(0x7f0000000380), 0x0, 0x0, 0xc1, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40084}, 0x4004040) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x3f, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000140)=0x200000000) read(r3, &(0x7f00000002c0)=""/237, 0xed) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f00000001c0)=0x4) r4 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(r3, 0x80047213, &(0x7f0000019300)) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000180)=0x3) 5m7.561743002s ago: executing program 45 (id=3787): ioctl$BLKFLSBUF(0xffffffffffffffff, 0x1261, &(0x7f0000000000)=0xffffffffc7fd61dd) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000540)={0xffffffffffffffff, 0xe0, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfb, 0x0, 0x0, 0x10, &(0x7f0000000380), 0x0, 0x0, 0xc1, 0x8, 0x0, 0x0}}, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x40084}, 0x4004040) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) io_uring_register$IORING_REGISTER_BUFFERS(0xffffffffffffffff, 0x3f, 0x0, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) r1 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, 0x0) r2 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, 0x0, 0x0) preadv(r2, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r3, 0x4008af00, &(0x7f0000000140)=0x200000000) read(r3, &(0x7f00000002c0)=""/237, 0xed) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f00000001c0)=0x4) r4 = syz_open_dev$ptys(0xc, 0x3, 0x0) ioctl$FAT_IOCTL_GET_VOLUME_ID(r3, 0x80047213, &(0x7f0000019300)) ioctl$TIOCSTI(r4, 0x5412, &(0x7f0000000180)=0x3) 4m51.67411731s ago: executing program 3 (id=3881): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000ab9ff0)={0x3, &(0x7f0000000140)=[{0x28, 0x8, 0x0, 0x5ae9}, {0x30, 0x7f, 0x4, 0xfdfff00d}, {0x6, 0x8, 0xfc, 0x3}]}, 0x10) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f00000007c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r4}, 0x10) mknod$loop(&(0x7f0000000080)='./file0\x00', 0x100000000000600d, 0x1) r5 = open(&(0x7f0000000040)='./file0\x00', 0x0, 0x0) readahead(r5, 0x0, 0x0) sendmmsg$inet(r1, &(0x7f0000002c40)=[{{0x0, 0x0, &(0x7f0000000e80)=[{&(0x7f0000000a80)="2a73ed35", 0x732a}], 0x1}}], 0x400000000000292, 0x0) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f00000000c0)={&(0x7f0000000180)={{@host, 0x50de}, {@any, 0x73}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c5fe68bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a433761ea754b442f821ba3d5e8f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f503bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6e0700856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316e75d0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8ba58502975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af126f83f2831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd453ca3d285b04efb38a36e0ed0e2abcb0701ae88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1007b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c05000000b87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d8703fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e47a6268625f8c3f358fb7d567cbea52e1bc289bd82535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfded3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f63de3abf2a70f185ad71ec86b8c900"}, 0x418, 0xfffffffd}) 4m49.058548121s ago: executing program 3 (id=3891): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000050000000010"], 0x48) (async, rerun: 32) r1 = syz_open_procfs(0x0, &(0x7f0000000000)='net/psched\x00') (rerun: 32) lseek(r1, 0xae7d, 0x0) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async, rerun: 64) r3 = syz_genetlink_get_family_id$mptcp(&(0x7f00000002c0), 0xffffffffffffffff) (rerun: 64) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000680)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010000000000000000000700000004000180140001800600010002000000060001000a000000080002000200d500"], 0x34}, 0x1, 0x0, 0x0, 0x80}, 0x8) (async) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r1, &(0x7f0000000480)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000000200)={&(0x7f0000000500)=ANY=[], 0x70}, 0x1, 0x0, 0x0, 0x200048d0}, 0x40000) (async) r4 = socket$inet6(0xa, 0x1, 0xe92) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'wg1\x00', 0x0}) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f00000000c0)={{{@in=@broadcast, @in6=@local, 0x4e23, 0x9, 0x4e23, 0x2, 0x2, 0x0, 0x0, 0x87, r5, 0xffffffffffffffff}, {0x81, 0x1, 0x2, 0xf5c, 0x1, 0x4, 0x4, 0x3}, {0x5, 0x1ff, 0x5, 0x2}, 0x40, 0x6e6bbf, 0x1, 0x1, 0x3}, {{@in=@empty, 0x4d4, 0xbb68acbd5c4db39e}, 0xa, @in=@private=0xa010100, 0x3500, 0x4, 0x1, 0x2, 0x200, 0x17, 0x9}}, 0xe8) (async) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000002300000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000080)='kfree\x00', r6}, 0x10) (async) open(&(0x7f00000005c0)='./bus\x00', 0x64842, 0x389b0d52417bb201) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r7}, 0x10) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r8 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r8, 0x1, 0x2c, 0x0, 0x0) setsockopt$sock_attach_bpf(r8, 0x1, 0x34, 0x0, 0x0) (async, rerun: 32) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) (rerun: 32) r9 = getpid() sched_setscheduler(r9, 0x2, &(0x7f0000000200)=0x7) r10 = syz_io_uring_setup(0x4888, &(0x7f0000000380)={0x0, 0x8aeb, 0x4000, 0x1002, 0x17}, &(0x7f0000000240)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r11, r12, &(0x7f00000004c0)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x51, 0x0, 0x880, 0x2, 0x0, 0x127, 0x0, 0x0, {0x2}}) (async, rerun: 32) io_uring_setup(0x385, &(0x7f0000000180)={0x0, 0x6549, 0x800, 0x1, 0x8d, 0x0, r10}) (rerun: 32) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r13, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r14, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r13, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 4m47.737108034s ago: executing program 3 (id=3894): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x18, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18000000000000000000000000000000850000002a000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f00000001c0)='GPL\x00'}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000400)={&(0x7f0000000580)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x9) r2 = getpid() sched_setscheduler(r2, 0x1, &(0x7f0000000180)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) removexattr(0x0, 0x0) openat$loop_ctrl(0xffffffffffffff9c, 0x0, 0x2042, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r0, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={&(0x7f0000001bc0)=@newtaction={0x88c, 0x30, 0x12f, 0x0, 0x4, {}, [{0x878, 0x1, [@m_police={0x874, 0x1, 0x0, 0x0, {{0xb}, {0x848, 0x2, 0x0, 0x1, [[@TCA_POLICE_TBF={0x3c, 0x1, {0x0, 0xffffffff, 0xffffffff, 0x0, 0x0, {0x7, 0x0, 0xfffc, 0x0, 0x0, 0x7}, {0x7, 0x2, 0x2, 0x0, 0x0, 0x7}, 0xffffff0f}}], [@TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x2, 0x80000000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x9, 0x0, 0x0, 0x0, 0xfffffffc, 0x6e, 0x0, 0x2, 0x4, 0x7, 0x0, 0x0, 0x1, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x800000, 0x0, 0xfffffffe, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa3, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffe, 0x11, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x8, 0xffffffff, 0x3, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1, 0x0, 0x4, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x2, 0x1, 0x0, 0x0, 0x0, 0xffffff35, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x40001000, 0x0, 0xb8, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffeffa, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, 0xfffffffd, 0x0, 0x41, 0x0, 0x0, 0x0, 0x0, 0x101, 0x7, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x8, 0x0, 0x0, 0x2, 0x0, 0x1, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffff1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100004, 0x0, 0xfffffffe, 0x0, 0x1000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x5, 0x5, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x3, 0x0, 0x1, 0xfffffffc]}, @TCA_POLICE_RATE={0x404, 0x2, [0x1, 0x0, 0x5, 0x0, 0x2, 0xb, 0xfffffffb, 0x0, 0x7, 0x401, 0x1, 0xffff8000, 0x90, 0x9fd, 0x2, 0xb8, 0xca2, 0x6, 0x3c, 0x7, 0x1, 0xa89c, 0x400, 0xc, 0x492217a4, 0x80000007, 0x5, 0x1, 0x1ff, 0xe5, 0x2f, 0xd, 0x3, 0xa, 0x3, 0x1, 0x9, 0x11, 0x9, 0x1, 0x402, 0x7, 0xd, 0x3, 0xc0000, 0x8, 0x8, 0xffffff40, 0x100, 0x3, 0x5, 0x7, 0xe0b2, 0xfffffffe, 0x8fb, 0x84, 0x9, 0x4, 0x9, 0x80000001, 0x6, 0x0, 0x8, 0x800, 0x9, 0x1, 0x100, 0x401, 0x8, 0x3, 0xb5, 0x10001, 0x4, 0x4, 0x7f, 0x0, 0x8, 0x2, 0x7f, 0x80000001, 0x2, 0x4004, 0x0, 0x4, 0x8000, 0x0, 0x9, 0x80, 0x7, 0xe9, 0x1, 0x0, 0x3, 0xeb22, 0xd, 0x8000, 0xfffffff7, 0x7fff, 0x3, 0x3ff, 0x400000, 0x10, 0x5, 0x3, 0x10000, 0x5, 0xffffffff, 0x0, 0x2, 0x7, 0x5, 0x6, 0x5, 0x4, 0x2, 0x81, 0x0, 0x10, 0x6, 0x7fff, 0x800, 0xfffffff4, 0x10000, 0x5, 0x8, 0xba, 0x4, 0x89, 0x2, 0x6, 0x100, 0x9, 0xffffa3e0, 0xfffffffe, 0xff, 0x1, 0x2, 0xf, 0x24b9, 0x6, 0xe01, 0x1, 0x6430, 0xd, 0x8, 0x81, 0x3, 0x7eb7, 0x3, 0xfffffffe, 0x200, 0xfffffeff, 0x9, 0xff, 0xa, 0x6, 0x7, 0x100, 0x1, 0x3, 0x100, 0xb, 0x8, 0x101, 0x6, 0x2, 0xfffffc00, 0x81, 0x81, 0x200, 0x80000001, 0x1, 0x1, 0x9, 0x9, 0x4, 0xb, 0x80, 0x0, 0x0, 0x1, 0x10005, 0x2, 0x65, 0x4, 0xfffffa0c, 0x3, 0x0, 0x4, 0x4, 0x35bc0, 0x9, 0xfffffffa, 0x7, 0x5, 0x3, 0x5, 0x9, 0x8, 0x28, 0x3, 0x5, 0x10001, 0x2, 0xf, 0x0, 0x1, 0x40000723, 0x0, 0xe, 0xe, 0x4, 0x6, 0x7, 0x200, 0xfffffbff, 0x7, 0x3, 0x8, 0x6, 0xffffffff, 0x2, 0x7f, 0x2, 0x80000001, 0x0, 0x20000009, 0x0, 0xfffffffe, 0x928, 0x5, 0x2, 0x5, 0xd1b, 0xb87, 0x3, 0x8d8d, 0x55, 0x101, 0x8, 0x64e8, 0x8, 0x82c, 0x772, 0x80a, 0xfff, 0x6, 0x3f7, 0x4, 0x8, 0x8, 0x1, 0x5d, 0x9, 0xd, 0x80]}]]}, {0x4}, {0xc, 0xb}, {0xc, 0xa}}}]}]}, 0x88c}}, 0x0) 4m46.208017447s ago: executing program 3 (id=3898): recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) pipe2$watch_queue(0x0, 0x80) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000380), r0) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000480)={&(0x7f00000003c0)={0x70, r2, 0x1, 0x0, 0x0, {0x4}, [@NLBL_UNLABEL_A_IPV4ADDR={0x5, 0x4, @broadcast}, @NLBL_UNLABEL_A_IPV4MASK={0x5, 0x5, @initdev={0xac, 0x1e, 0x0, 0x0}}, @NLBL_UNLABEL_A_IFACE={0x14, 0x6, 'hsr0\x00'}, @NLBL_UNLABEL_A_IPV6ADDR={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @local}}, @NLBL_UNLABEL_A_SECCTX={0x24, 0x7, 'system_u:object_r:var_lock_t:s0\x00'}]}, 0x70}}, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x6e, 0x0, 0x0) r3 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000000)={0x0, &(0x7f00000000c0)=[@nested_intel_vmwrite_mask={0x154, 0x38, {0x1, @control_nat=0x6002, 0x56, 0x1c29acc9}}, @cpuid={0x64, 0x18, {0x2, 0x601}}, @wr_crn={0x67, 0x20, {0x2, 0x291}}, @wrmsr={0x65, 0x20, {0xb47, 0x2}}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @nested_intel_vmwrite_mask={0x154, 0x38, {0x0, @control16=0x2, 0x8, 0x4, 0x4}}, @nested_amd_vmcb_write_mask={0x17c, 0x38, {0x0, @control_area=0x54, 0x10, 0x4, 0x5}}, @nested_vmlaunch={0x12f, 0x18, 0x1}, @wr_drn={0x68, 0x20, {0x0, 0x457995e4}}, @nested_create_vm={0x12d, 0x18, 0x2}, @nested_load_code={0x12e, 0x7f, {0x3, "c442fd356cce28420f01df66ba420066ed45df6e0348b8c6010000000000000f23d80f21f835000000400f23f8440f01df8f69a898610066baf80cb8788b4689ef66bafc0cb8d8aa0000ef2e0f01c348b8f5ffffffffffff7f0f23c80f21f8350c0010000f23f8"}}, @code={0xa, 0x6c, {"c4e1e1e5d0c4c2a5a707b8010000000f01d9b805000000b9004000000f01c166baf80cb8843fe189ef66bafc0cb800000000ef3ef4c7442400d3000000c7442402430c0000ff2c240ff4b00000000067480fc76900c4c1fd7f7a3a"}}], 0x253}) ioctl$KVM_GET_VCPU_EVENTS(r3, 0x8040ae9f, &(0x7f0000000340)=@arm64) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0xffffb9e3, 0x5}) syz_init_net_socket$ax25(0x3, 0x3, 0xf0) 4m42.490484982s ago: executing program 3 (id=3917): socket$nl_route(0x10, 0x3, 0x0) openat$selinux_commit_pending_bools(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r0 = io_uring_setup(0x68f6, &(0x7f00000002c0)={0x0, 0x48c7, 0x8, 0x0, 0x1000168}) r1 = socket$inet6_mptcp(0xa, 0x1, 0x106) r2 = socket$netlink(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05640, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x6, 0x0, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x3a) bind$netlink(r2, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) close_range(r0, 0xffffffffffffffff, 0x0) syz_io_uring_setup(0x8d2, &(0x7f00000000c0)={0x0, 0x0, 0x400, 0x0, 0x379}, 0x0, 0x0) r6 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, r0, &(0x7f0000000000)={0x90000000}) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$unix(0x1, 0x2, 0x0) r9 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f0000000100)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\x00\x00', @ANYRES16=r9, @ANYBLOB="010028bd7000fddbdf250700000008000300", @ANYRES32=r10, @ANYBLOB="0c009900ff07000070000000140004009e42f7687aa1e14a72300000000000000800050007"], 0x50}, 0x1, 0x0, 0x0, 0x91}, 0x24044884) 4m40.799296964s ago: executing program 3 (id=3921): syz_open_dev$loop(0x0, 0x2, 0x2001) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa0}, 0x1, 0x0, 0x0, 0x24000850}, 0x40) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x800, 0x0) fcntl$setstatus(r2, 0x4, 0x42000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) 4m24.620382283s ago: executing program 46 (id=3921): syz_open_dev$loop(0x0, 0x2, 0x2001) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x3c, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x10, 0x3, 0x0, 0x1, [{0xc, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0xa0}, 0x1, 0x0, 0x0, 0x24000850}, 0x40) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000000300)=""/102392, 0x18ff8) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r1, 0xaf01, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x800, 0x0) fcntl$setstatus(r2, 0x4, 0x42000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x8b}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) sched_setscheduler(0x0, 0x1, &(0x7f0000000100)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) 3m4.783261373s ago: executing program 7 (id=4276): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000000c0), 0x8480, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xe, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f0000000080)={0xc}) r1 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_GET(r1, &(0x7f0000000100)={0x0, 0xf00, &(0x7f0000000300)={&(0x7f0000000080)={0x10, 0x1401, 0x7fc32be5eb343aa7}, 0x5c}}, 0x0) 3m4.716777432s ago: executing program 7 (id=4277): socket$netlink(0x10, 0x3, 0x4) r0 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$setregs(0x1a, r0, 0x3, 0x0) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x100, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x3138, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x40, 0xb1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x1, 0x0, {0x9, 0x21, 0x101, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x3ff, 0xc}}}}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x22, 0x6, {[@main=@item_012={0x0, 0x0, 0xa}, @local=@item_4={0x3, 0x2, 0xa, "60e886de"}]}}, 0x0}, 0x0) 3m1.730463091s ago: executing program 7 (id=4286): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x1, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, &(0x7f0000000840)={0x44, &(0x7f00000005c0)={0x20, 0x10, 0x4, "7c103142"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000008c0)={0x84, &(0x7f0000000300)={0x40, 0x17, 0x4, "0300253f"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) 2m57.964792967s ago: executing program 7 (id=4297): prlimit64(0x0, 0xe, &(0x7f0000000240)={0x2, 0x7}, 0x0) r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x5, 0x4, 0x7fe2, 0x2, 0x110}, 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000000c0)={r0, 0x0, 0x0}, 0x20) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r1 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000100), 0x1, 0x0) write$khugepaged_scan(r1, &(0x7f0000000180), 0x8) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = socket$netlink(0x10, 0x3, 0xa) r5 = dup(r4) r6 = open(&(0x7f0000000040)='./file1\x00', 0x1850c2, 0x14c) ftruncate(r6, 0x200004) sendfile(r5, r6, 0x0, 0x80001d00c0d1) socket$inet_smc(0x2b, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000005580)=""/102392, 0x18ff8) r8 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_GET_SEC_DEVKEY(r8, &(0x7f0000000300)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4054}, 0x20000000) sendmsg$NL802154_CMD_SET_MAX_FRAME_RETRIES(r8, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x80}, 0x40850) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000340)='./file0/../file0\x00', &(0x7f0000000280)='./file0/file0\x00', 0x0, 0xb101e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125499, 0x0) 2m56.712025476s ago: executing program 7 (id=4298): socket$can_bcm(0x1d, 0x2, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sched_setattr(0x0, 0x0, 0x0) syz_open_procfs(0x0, &(0x7f0000000040)='smaps\x00') r2 = syz_open_procfs(0x0, &(0x7f0000000040)='maps\x00') r3 = socket$netlink(0x10, 0x3, 0x400000000000004) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f00000001c0)=0x100000, 0x4) writev(r3, &(0x7f0000000000)=[{&(0x7f0000000200)="480000001400190d7ebdeb75fd0d8c562c84d8c033ed7a80fae0090f000000000000a2bc5603ca00000f7f89000000200000004a2471083ec6811778581acb6c0101ff0000000309", 0x48}], 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0xc0686611, &(0x7f0000000180)={0x67, 0x0, 0x3f, 0x2000, &(0x7f0000ffe000/0x2000)=nil}) openat(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x4043, 0x1ff) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000020000000900010073797a300000000040000000030a09020000000000000000020000000900010073797a30000000000900030073797a3200000000140004800800014000000000080002400000000014000000110001"], 0x88}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)={{0x14}, [@NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x18, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0x4}]}}}, {0x24, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_META_SREG={0x8, 0x3, 0x1, 0x0, 0x17}]}}}]}, @NFTA_RULE_POSITION_ID={0x8, 0xa, 0x1, 0x0, 0x3}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x90}}, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_emit_ethernet(0x86, &(0x7f0000000340)=ANY=[@ANYBLOB="aaaaaaaeaaaabbbbbbbbbbbb0800450000780000000200119078000000000000000000000000006490780200000000000000000000009d42a08597d3b2f44ac89b1b52cc6728d6697d4cebc8f2f062c6f91f224a010100003410936eefeb3ea898dafab974aa96deedc95fa918dfd104fceb49dbd02a735d10a12027128db2e9bdf6f838a300b01b0e19ecdf00b206000000f2fd3b516d9d48064b99e777f03e420533d9364c4395153e40d8b53638aa4969025bdda67bffe46c6eab318865be8e222b3afebe6ad8c47f814fe005073110239a1bab7d3fbb5280f37ebb31ae9e21d11c66aee798a2ab73e78afa05d67a"], 0x0) syz_emit_ethernet(0x32, &(0x7f0000000300)={@random="e90c630faca2", @remote, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0xe000, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x0, 0x10, 0x0, @opaque="cbe66f1099d3a415"}}}}}, 0x0) r7 = fcntl$getown(r0, 0x9) ptrace$PTRACE_GETSIGMASK(0x420a, r7, 0x8, &(0x7f00000001c0)) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x1000) creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x181) syz_open_dev$tty1(0xc, 0x4, 0x1) socket$inet(0x2, 0x6, 0x8000) socket$igmp(0x2, 0x3, 0x2) 2m55.89438291s ago: executing program 7 (id=4300): socket$packet(0x11, 0x3, 0x300) (async) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x1000) sendto$packet(r0, &(0x7f0000000380)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe461dbe385f0eef3f4fd01f863151a75331d977ed27cfac542e5cd8de2f1df344b8226177f4121c81fa45edc3f36e95b84c487e2e9289f97a5e8a889400f7f2f02fcefb7b06bd2881bd8889a0f0968758348704898ce366546c3d3505586999baf19785514536a6caea20dacf4ae31e82c3120c8452ccd66bbcc66a23a77fc63547958872dd0cfa38c3f5f78e3051d46cc020d8b469bc994b9488067d0f451b31eaffcf2316d4d520fbcf8fc6307e02d1797ac570a17f2f4d79332f90c255de2816fb8f0e78b9e8d9cf7c8db44aed1c6fea41ff9c98a4b2727eae5717ee8919e43ac9bcbc820cdd1f2c50e66f6ceaf69bf11c33b365b1e56d5b", 0xffffff63, 0x4000001, &(0x7f0000000540)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYRES64], 0x10448) (async) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYRES64], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_int(r3, 0x11e, 0x1, 0x0, &(0x7f0000000000)) syz_emit_ethernet(0x132, &(0x7f0000000080)={@broadcast, @empty, @void, {@ipv4={0x800, @dccp={{0x6, 0x4, 0x2, 0x8, 0x124, 0x68, 0x0, 0x5, 0x21, 0x0, @multicast2, @multicast1, {[@ra={0x94, 0x4, 0x1}]}}, {{0x4e24, 0x4e21, 0x4, 0x1, 0x8, 0x0, 0x0, 0x9, 0x1, "1b013a", 0x9, "a5849e"}, "11b601b2d344099f8351cb7586d7242fad8c49acfc2d921ba4a16d768d437372b06784996d7ad028b9784fddd76550d0deb81b7c5b2037c989977402bb349f372af7758ace8d9ad4e21716d56c1153bf9d08fe2ef0b83662adf64a9a4e8168250c9793c6dea306a4e5c553eb5955767293714c1be2610f5cdcdb3f729be5491e25c15e2b9aa81e5fe96c3c0bfba9a1605e97881a6af35c56cf4c1a966c553b134b4c34cd3f0dc8c73cf81c4d87c313bb0aba2add7177d3b206e7cdf02bf879f01c2962f88de6ba0482d1d8a5f1534450cd0efe97d16b37c9c7f5db6cb0735e7b01e53a53287f20d25d93fae97795f224135db909768103c77cfaa96c"}}}}}, 0x0) 2m55.677804604s ago: executing program 47 (id=4300): socket$packet(0x11, 0x3, 0x300) (async) r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge0\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000002c0)={'bridge0\x00', 0x0}) setsockopt$packet_int(r0, 0x107, 0xf, &(0x7f0000000000)=0xf3f, 0x4) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f0000000040)=0x1000) sendto$packet(r0, &(0x7f0000000380)="3f031c000302140006001e0089e9aaa911d7c2290f0086dd1327c9167c643c4a1b7880610cc96655b1b141ab059b24d0fbc50df71548a3f6c5609063382a0c1511fdf9435e3ffe461dbe385f0eef3f4fd01f863151a75331d977ed27cfac542e5cd8de2f1df344b8226177f4121c81fa45edc3f36e95b84c487e2e9289f97a5e8a889400f7f2f02fcefb7b06bd2881bd8889a0f0968758348704898ce366546c3d3505586999baf19785514536a6caea20dacf4ae31e82c3120c8452ccd66bbcc66a23a77fc63547958872dd0cfa38c3f5f78e3051d46cc020d8b469bc994b9488067d0f451b31eaffcf2316d4d520fbcf8fc6307e02d1797ac570a17f2f4d79332f90c255de2816fb8f0e78b9e8d9cf7c8db44aed1c6fea41ff9c98a4b2727eae5717ee8919e43ac9bcbc820cdd1f2c50e66f6ceaf69bf11c33b365b1e56d5b", 0xffffff63, 0x4000001, &(0x7f0000000540)={0xc9, 0x0, r1, 0x1, 0x0, 0x6, @multicast}, 0x14) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYRES64], 0x10448) (async) write$cgroup_subtree(r2, &(0x7f0000000040)=ANY=[@ANYRES64], 0x10448) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x2000001, 0x12, r2, 0x0) r3 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_int(r3, 0x11e, 0x1, 0x0, &(0x7f0000000000)) syz_emit_ethernet(0x132, &(0x7f0000000080)={@broadcast, @empty, @void, {@ipv4={0x800, @dccp={{0x6, 0x4, 0x2, 0x8, 0x124, 0x68, 0x0, 0x5, 0x21, 0x0, @multicast2, @multicast1, {[@ra={0x94, 0x4, 0x1}]}}, {{0x4e24, 0x4e21, 0x4, 0x1, 0x8, 0x0, 0x0, 0x9, 0x1, "1b013a", 0x9, "a5849e"}, "11b601b2d344099f8351cb7586d7242fad8c49acfc2d921ba4a16d768d437372b06784996d7ad028b9784fddd76550d0deb81b7c5b2037c989977402bb349f372af7758ace8d9ad4e21716d56c1153bf9d08fe2ef0b83662adf64a9a4e8168250c9793c6dea306a4e5c553eb5955767293714c1be2610f5cdcdb3f729be5491e25c15e2b9aa81e5fe96c3c0bfba9a1605e97881a6af35c56cf4c1a966c553b134b4c34cd3f0dc8c73cf81c4d87c313bb0aba2add7177d3b206e7cdf02bf879f01c2962f88de6ba0482d1d8a5f1534450cd0efe97d16b37c9c7f5db6cb0735e7b01e53a53287f20d25d93fae97795f224135db909768103c77cfaa96c"}}}}}, 0x0) 2m23.792371467s ago: executing program 9 (id=4407): r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000740), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xa0000) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r0, 0x7ab, &(0x7f00000000c0)={&(0x7f0000000180)={{@host, 0x50de}, {@any, 0x73}, 0x400, "884fbe2726aa0a32f3e65f909acda971a093228292456e0332e6c11577b514f0bb8db731789d860e9589c4cbdd60b7a851a8a3c55ada2f90c5fe68bf4a5c3e32296535dc838ef00dc18a32a79118dc858628f741f107552021e5a81d38e4374a8a717a7ca9015083cfff5d16156ef9cabf4f60c0da46870a10bf520cc5abcf9e3a433761ea754b442f821ba3d5e8f6a803ccfbab9c3f507672d7c39ea9ccf81d9bc2b4649e7b44ed9fd7cb9bd389240cd41c415113d1caac4536f05c07e596d6addad2a4d27ba21a3b655753c508caedcc812ca235a7cd1686426b208bdecf8a4265ba8f6824aa60306e2d623481eed301b6dc21041fa8b6592be00bb74de1989a45a5aa32c189e9f503bb878281d0129afcfb8410cd1fa5acd080993d2d084213130a9b8d517d13251e6605a03d9b8faf507e820205a1f471af7b261419e79e09c547f7c10fd3f1ad876f59fdcc5e07d0ff4dee6e0700856616a352d648b9b5261b6263020fc3ae8eb404bc25703b3d3b83172d07ff22907d6631d226c8247c92c1826ff814590dfe8c7fc54dfb265e906f756846546316e75d0105e2a5355a210b2b7f5db61d8f90bb783b41ce368233bd08044e9283531fffe49e3d305ecfb16075a047557f57bb7baf8ba58502975ad0d60ed8de9cb8adc9f667bc6826cbea8e260e4bff28a5ec19d38d1fc019db3cfaf310e764d78619cb27fb17af126f83f2831ce8413721e71138e62cc4ad8e7974d1506b4fb581c549a3dd7b7ef44ac37201aa3bce6f37f648d781bcb4f329fd453ca3d285b04efb38a36e0ed0e2abcb0701ae88ae3edfb6d840d75340204243d0e1c1c3139823b0d5ad196430bf4566619a1a97df4376a7e9a9e9c1007b9f773c921778f2cb5165c02da1423305c502076177e4af50cb3343c10b01b78e3fe5520bdfae2b3dbe42db0f0eb55bbcb19038018d45ccdb8b0df400085a02c61b033f430fb6a7408e090c65798bc49d35e049d276fd1952d2b3dfd92a2548411e21be26216fe68fc3cf1c6625031260153708a53255b3d3d0411d5f0e8ab2102a97e539c34e9c05000000b87c5918deb59ef05e928c2c52775de467fa843cbcdabc290097eeb2ee7c58d8703fccc39a5b694c18a4cc0d6af1e61d9c69e6466bc0cbef15365109e47a6268625f8c3f358fb7d567cbea52e1bc289bd82535d9ba88e97a14834cfd8dc86b5d2f9b35425a4162e6abe8b785ef462883e716c91b8eb281d81f68f606f16fcbc5cddfded3b515818a647d86a4c17bae6ad525e95598052c49cdee821ceb45b2350dda13628db0dd266f30285241a2b147d65113b8ed3665a3451f7a56cf430ec98aeac702d9b9f776d97520a9d039e5b2fff34ac4d4e0a32e1f35c8f38e4f63de3abf2a70f185ad71ec86b8c900"}, 0x418, 0xfffffffd}) 2m23.371935888s ago: executing program 9 (id=4408): openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r0 = syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './cgroup\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=@framed={{0x18, 0x8, 0x0, 0x0, 0xffd0, 0x0, 0x0, 0x0, 0xf000000}, [@func={0x85, 0x0, 0x1, 0x0, 0x6}, @map_fd={0x18, 0x0, 0x0}, @generic={0x66, 0x8}, @initr0, @exit, @alu={0x6, 0x0, 0x3, 0xa, 0x0, 0x2}, @printk={@x, {}, {}, {}, {}, {0x5, 0x0, 0xb, 0xa}}]}, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) r4 = syz_open_dev$swradio(&(0x7f0000000080), 0x0, 0x2) read(r4, &(0x7f0000000280)=""/149, 0x95) 2m19.934572554s ago: executing program 9 (id=4413): mknod(&(0x7f0000000080)='./file0\x00', 0x8, 0xffff) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) pipe2$9p(&(0x7f0000001900)={0xffffffffffffffff, 0xffffffffffffffff}, 0x0) r2 = dup(r1) mount$9p_fd(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x4000, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r0}, 0x2c, {'wfdno', 0x3d, r2}, 0x2c, {[{@posixacl}], [], 0x6b}}) mount(&(0x7f0000000040)=@nullb, &(0x7f0000000000)='./file0\x00', &(0x7f0000000100)='mqueue\x00', 0x140000, &(0x7f0000000980)='n$\xdf\xfa\x9f\x9a4\xbf\xe8\xaa') 2m19.297272295s ago: executing program 9 (id=4419): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) r0 = socket$inet6_udplite(0xa, 0x2, 0x88) setsockopt$inet6_udp_int(r0, 0x11, 0x1, &(0x7f00000000c0)=0x6, 0x4) sendmmsg$inet6(r0, &(0x7f0000002ac0)=[{{&(0x7f00000001c0)={0xa, 0x4e22, 0x9, @mcast1, 0x4}, 0x1c, 0x0}}, {{0x0, 0x0, &(0x7f00000014c0)=[{&(0x7f0000001480)="f4", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f00000017c0)=[{&(0x7f0000001640)="94da47", 0x3}, {0x0}], 0x2, &(0x7f0000002940)=ANY=[], 0x160}}], 0x3, 0x0) r1 = syz_open_procfs(0x0, &(0x7f0000000340)='net/vlan/vlan1\x00') read$FUSE(r1, &(0x7f0000002680)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) r5 = openat$cgroup_ro(r1, 0x0, 0x275a, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0x401, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x0, 0x2000}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @geneve={{0xb}, {0x4}}}, @IFLA_NUM_TX_QUEUES={0x8, 0x1f, 0x1ff}]}, 0x3c}, 0x1, 0x0, 0x0, 0x1}, 0x20000000) write$UHID_CREATE2(r5, 0x0, 0x118) write$FUSE_ATTR(r5, &(0x7f00000001c0)={0x78, 0x0, r2, {0x9, 0xffff, 0x0, {0x2, 0x4, 0x7ff, 0x8e, 0xd5b6, 0x867, 0x2, 0x2df, 0x6, 0x1000, 0x4c, r3, r4, 0x7fff, 0x7}}}, 0x78) quotactl_fd$Q_SETINFO(r0, 0xffffffff80000601, r3, &(0x7f0000000180)={0x2590, 0xc4a4, 0x1}) mount$bind(0x0, &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000040)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x23e9c9e, 0x0) mount$bind(0x0, &(0x7f00000003c0)='./file0/file0\x00', 0x0, 0x80000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b400000000001400791048000000000069000c000000000095000000"], &(0x7f0000003ff6)='GPL\x00', 0x8, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg, 0xffffffffffffffff, 0x8, 0x0, 0xa3}, 0x21) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0\x00', 0x0, 0x28a5291, 0x0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = fcntl$dupfd(r7, 0x0, r7) ioctl$IOCTL_STOP_ACCEL_DEV(r8, 0x40096101, 0x0) accept4$unix(r8, 0x0, 0x0, 0x0) r9 = bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000400)={0x3, 0x4, 0x4, 0xa, 0x0, r5, 0xb, '\x00', 0x0, r5, 0x0, 0x1, 0x3}, 0x50) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(0xffffffffffffffff, 0xc0189378, &(0x7f0000000300)={{0x1, 0x1, 0x18, r9, {r7}}, './file0/../file0\x00'}) ioctl$AUTOFS_DEV_IOCTL_ISMOUNTPOINT(r8, 0xc018937e, &(0x7f0000000140)={{0x1, 0x1, 0x18, r10, {0x2}}, './file0/../file0\x00'}) mount$fuse(0x0, &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x20000, 0x0) 2m18.476322662s ago: executing program 9 (id=4424): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="70000000100001002cbd70002000ffffffc30000", @ANYRES32=0x0, @ANYBLOB="13019757c0200000140003006e657464657673696d300000000000000500110004dd000034001680300001802c000c80140001000000008015ffffff060000008100000014000131"], 0x70}, 0x1, 0x0, 0x0, 0x200080c5}, 0x20000010) 2m18.190224948s ago: executing program 9 (id=4428): ioctl$VIDIOC_G_AUDOUT(0xffffffffffffffff, 0x80345631, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c000700737b7352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000050002000000000008000700260909091400"], 0x78}, 0x1, 0xffffffff00000003}, 0xc0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r5, &(0x7f0000000180)}, 0x20) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x701, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x4c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x7c, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x0, 0xc}, {0xffff, 0xffff}, {0xd, 0xc}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x7, 0xa3, 0x20b, 0x7, 0x81, 0x4, 0x3ff0, 0x7}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x5, 0x12, 0x400, 0x1, 0x200, 0x0, 0x1f}}, {0x4}}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x44004}, 0x0) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb01001800000000000000440000004400000006000000040000000000000e0400000000000000000000000200000d040000006c96f1cf040000000a000000010000000000000000000004000000000400000000000008030000000000000061"], 0x0, 0x62}, 0x28) sendmsg$IPSET_CMD_LIST(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 2m18.044668776s ago: executing program 48 (id=4428): ioctl$VIDIOC_G_AUDOUT(0xffffffffffffffff, 0x80345631, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c000700737b7352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a733000050002000000000008000700260909091400"], 0x78}, 0x1, 0xffffffff00000003}, 0xc0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) bpf$MAP_DELETE_ELEM(0x3, &(0x7f00000001c0)={r5, &(0x7f0000000180)}, 0x20) sendmsg$IPSET_CMD_CREATE(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x4c, 0x2, 0x6, 0x701, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x14, 0x3, 'hash:ip,port,ip\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x4c}}, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) r7 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=@newqdisc={0x7c, 0x24, 0xf0b, 0x0, 0x25dfdbfb, {0x0, 0x0, 0x0, r8, {0x0, 0xc}, {0xffff, 0xffff}, {0xd, 0xc}}, [@qdisc_kind_options=@q_sfb={{0x8}, {0x2c, 0x2, @TCA_SFB_PARMS={0x28, 0x1, {0x0, 0x7, 0xa3, 0x20b, 0x7, 0x81, 0x4, 0x3ff0, 0x7}}}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x5, 0x12, 0x400, 0x1, 0x200, 0x0, 0x1f}}, {0x4}}]}]}, 0x7c}, 0x1, 0x0, 0x0, 0x44004}, 0x0) sendmsg$IPSET_CMD_ADD(r6, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r9 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb01001800000000000000440000004400000006000000040000000000000e0400000000000000000000000200000d040000006c96f1cf040000000a000000010000000000000000000004000000000400000000000008030000000000000061"], 0x0, 0x62}, 0x28) sendmsg$IPSET_CMD_LIST(r9, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 18.594408445s ago: executing program 2 (id=4912): ioctl$USBDEVFS_CONTROL(0xffffffffffffffff, 0xc0105500, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r0 = syz_open_procfs(0x0, 0x0) faccessat2(r0, &(0x7f0000000040)='\x00', 0x7, 0x1200) lgetxattr(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000140)=@known='security.selinux\x00', 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r1 = syz_open_dev$MSR(0x0, 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, 0x0) syz_emit_ethernet(0x5e, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000e80)={0x10, 0x16, &(0x7f0000000340)=ANY=[@ANYBLOB="61122800000000006113140000000000bf1000000000000025000200091b00003d030000000000008701000000000000bc26000000000000bf67000000000000340300000ee600f06702000014000000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x94) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r2 = syz_open_dev$midi(&(0x7f0000000000), 0x2, 0x0) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r2, 0x40045731, 0xfffffffffffffffe) r3 = openat$selinux_policy(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$inet6_udplite(0xa, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000280)={'macvtap0\x00'}) getegid() openat$sequencer2(0xffffffffffffff9c, &(0x7f00000019c0), 0x200003, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendto$packet(0xffffffffffffffff, &(0x7f0000000080)="33031600d1fd140000007ef52f55", 0xe, 0x400c8c1, 0x0, 0x0) read$FUSE(r3, 0x0, 0x0) 16.840197933s ago: executing program 2 (id=4920): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000040)={'macvtap0\x00'}) syz_emit_ethernet(0xbe, &(0x7f0000000240)=ANY=[@ANYBLOB="aaaa"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYRESDEC, @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7020000000000008500000051000000bf0900000000000055"], 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r1 = syz_open_dev$loop(&(0x7f0000000100), 0x2, 0x2001) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes_recursive\x00', 0x275a, 0x0) write$binfmt_misc(r2, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r1, 0x4c0a, &(0x7f00000002c0)={r2, 0x0, {0x2a00, 0x80011200, 0x0, 0x2, 0x0, 0x0, 0x0, 0xb, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "f4bd000000801900", [0x8, 0xffffffff9673e35d]}}) 15.390506079s ago: executing program 2 (id=4925): r0 = syz_open_dev$loop(&(0x7f0000000240), 0x7, 0x142ba3) r1 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/kernel/oops_count', 0x8a883, 0x2) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000080)={r1, 0x0, {0x0, 0x0, 0x0, 0x400000000000007, 0x4000000000000ffd, 0x0, 0x0, 0x1e, 0xc, "faf98317e5a1149989fc8dbe43ea6acc96e3a2503dc3bd3fe37d58128bbad0099cebdc25f5ab60c9e6d680f985881a7beda9d69098c8b534464c516bdd8a0f35", "32d8cc26f7061a74df2cfc06c89f3d9e234b30c50997d3bef409ff2176ff7bfe55cd4a5d83cd4a524bd3ffe70c7f3f800b2f7b6aa54cc50a1fcaed1e831fa79a", "67523760fd40f78d2cfc03d81a8ca55ba139c01802c4dae4162e43ac61b7ad33", [0x2, 0xfffffffffffffff7]}}) ioctl$LOOP_GET_STATUS(r0, 0x4c03, &(0x7f0000000280)) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r2 = userfaultfd(0x1) ioctl$UFFDIO_API(r2, 0xc018aa3f, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r4, 0x4020ae46, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r5, &(0x7f0000013000/0x18000)=nil, &(0x7f0000000000)=[@text64={0x40, 0x0}], 0x1, 0x0, &(0x7f0000000180)=[@cr4={0x1, 0x40002}], 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe7000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, &(0x7f00000003c0)="360f01f4660ff366003633c5b8941f9681ef66ed2e2ef30f01bf8000c0fe66baf80cb86e5bd581ef66bafc0c66b8000066efb9e50900000d12f3e9db048388efefbaf80cb8d8ee018aef66bafc0cb800f0ffffef0f20d835080000000f22d8b9ef0a0000b800800000ba000000000f30", 0x70}], 0x1, 0x2c, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) ioctl$KVM_RUN(r5, 0xae80, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x3a8bc000) clock_nanosleep(0x1, 0x1, &(0x7f0000000240), 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r6 = syz_open_pts(0xffffffffffffffff, 0x240000) ioctl$TIOCGSID(r6, 0x5429, &(0x7f0000000480)) r7 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1b00000000000000000000000080000000000000", @ANYRES32, @ANYBLOB="e4ff00000000000000f3ffffffffffffff0000003519d71d86032d3b4cf1515bc5b4c94b0a411d43a7fbfaed44a545b7b71ce7730909bceabca8500b45d96ad18ca9ae1d669bfc7d", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1000000004000000080000000800000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="001700"/21], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x15, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r7, @ANYBLOB="01ebb1a2c800860000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_reuseport=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = openat$binder_debug(0xffffffffffffff9c, &(0x7f0000000000)='/sys/kernel/debug/binder/failed_transaction_log\x00', 0x0, 0x0) r10 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x2402) ioctl$I2C_RDWR(r10, 0x707, &(0x7f0000000340)={&(0x7f00000003c0)}) syz_genetlink_get_family_id$ethtool(&(0x7f0000002380), 0xffffffffffffffff) ioctl$TUNSETVNETBE(r9, 0x400454de, &(0x7f0000000440)) socket$unix(0x1, 0x1, 0x0) 9.734958827s ago: executing program 2 (id=4950): openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x400, 0x0) mknodat$loop(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x1000, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x800, 0x0) bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000100)=@bpf_lsm={0x3ea, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x7d2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fcntl$setstatus(r0, 0x4, 0x42000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xc, 0x7}, 0x0) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, 0x0, 0x0) socket$inet_sctp(0x2, 0x5, 0x84) socket$nl_rdma(0x10, 0x3, 0x14) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102387, 0x18ff3) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000080)=0xf) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) syz_open_dev$usbfs(&(0x7f0000000080), 0x74, 0x101301) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x248}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r2 = getpid() sched_setaffinity(0x0, 0x1, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0xc) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0xffffe000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) connect$unix(r3, &(0x7f00000004c0)=@abs={0x0, 0x0, 0x4e24}, 0x6e) recvmmsg(r3, &(0x7f00000000c0), 0x3fffffffffffeda, 0x2, 0x0) clock_gettime(0x2, &(0x7f0000000300)) ioctl$TCFLSH(r1, 0x400455c8, 0x1) ioctl$TIOCVHANGUP(r1, 0x5437, 0x0) 6.134371598s ago: executing program 1 (id=4964): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0xd, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x94) r0 = syz_usb_connect(0x3, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) syz_open_dev$midi(&(0x7f0000000040), 0x3, 0x88c02) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000b00)={0x11, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000010000000000000000030000850000007b00000095"], &(0x7f0000000140)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f00000000c0)='sched_switch\x00', r1}, 0x10) epoll_create1(0x0) epoll_create1(0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x3}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x0, 0x0, 0x7fffffff}, 0x0, 0x0) syz_usb_disconnect(r0) r2 = syz_io_uring_setup(0x10d2, &(0x7f0000000340)={0x0, 0x6bf6, 0x100, 0x5, 0x12}, &(0x7f00000000c0)=0x0, &(0x7f0000000300)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) request_key(0x0, 0x0, &(0x7f0000000200)='&\x00', 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_POLL_REMOVE={0x7, 0x50, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r2, 0x47bc, 0x0, 0x0, 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) dup(r5) io_uring_setup(0x785a, &(0x7f0000000580)={0x0, 0xddf4, 0x400, 0xfffffdfe, 0x183}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="180100001700000000000000ff000000850000006d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000002"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000180)='./binderfs/binder0\x00', 0x2, 0x0) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) ioctl$BINDER_WRITE_READ(r6, 0xc0306201, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x2c, &(0x7f0000000040)={0x6, &(0x7f0000000000)=[{0x1, 0xfe, 0x0, 0xcd0f}, {0xc, 0x3, 0x1, 0x4}, {0x200, 0x9, 0x5, 0x8}, {0x4, 0x9, 0x4, 0x7}, {0xcc, 0x0, 0x0, 0x9}, {0x0, 0x0, 0x40, 0x2}]}) timer_create(0x0, 0x0, 0x0) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(0xffffffffffffffff, 0x84, 0x13, &(0x7f0000000300)={0x0, 0x4}, &(0x7f0000000380)=0x8) 5.934031153s ago: executing program 2 (id=4966): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f00000000c0)={0xbe, 0x0, 0x1}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d03, 0x0, 0x400009}]}) syz_usb_connect(0x2, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0xc7, 0xa6, 0x7d, 0x40, 0x13b1, 0x42, 0xec, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x36, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9a, 0x0, 0x1, 0x7e, 0xd7, 0x25, 0x92, [], [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x8, 0x0, 0x7}}]}}]}}]}}, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (async) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) (async) ioctl$KVM_CAP_ENFORCE_PV_FEATURE_CPUID(r2, 0x4068aea3, &(0x7f00000000c0)={0xbe, 0x0, 0x1}) (async) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x4b564d03, 0x0, 0x400009}]}) (async) syz_usb_connect(0x2, 0x2d, &(0x7f0000000140)={{0x12, 0x1, 0x110, 0xc7, 0xa6, 0x7d, 0x40, 0x13b1, 0x42, 0xec, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x1b, 0x1, 0x36, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x9a, 0x0, 0x1, 0x7e, 0xd7, 0x25, 0x92, [], [{{0x9, 0x5, 0x2, 0x3, 0x40, 0x8, 0x0, 0x7}}]}}]}}]}}, 0x0) (async) 4.994064708s ago: executing program 5 (id=4971): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000abc010000000a05000000130000000000010000000900010073797a3000000000d30006003407ae8929b5d5805c2cb15c6832bdf04f6f732bf6c75790a071b67033b0bb7e81aac8c9ccb093263d99fcafa58fe6c7126fc1d2ccbc1888abd4a61e1818723b358b147b8836997950921d849981687e7eb599e28bd439758eefcbda6f7906db339e68d3869e4011ddfb254a2dda9b523f928b3626f8faa75357d4f9cb925df5cde675f9e8bb05e4f8cc9a0610fb2945b1b755b94883afb3697a7535ea5f9db3ce21c1f0cc3fb343e830c6a947f512c56b1a706b86e76bc58a075f7cb0322f7fa6fb5df1718361423df5cbd47608ca000900010073797a310000000008000240000000030c000440000000000000000499000600db2b252f3c9b3b419bda841c524cb69270214a733fee6d8e10561ce9d682ad271b8a317d699b2f000178b2aca7c7058e0df489887ebdcf11c4ddf03bc9b1284f5fb568bac9b64b06c9d8c2acf08c892fb2abeb7c72bc9c8fa0c7425b5aa3df8074d8412d67fad836b6cc1c0be2fff19dbd1830e29ae4bc6aaa4f42c244e40238dc8e2a247b1792a177693b55dc155f631634db5af90000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a320000000098000000060a010400000000000000000100000008000b40000000005c000480580001800b000100746172676574000048000280300003005fad843dc5c1efe84ced18d4422d5b0b86e8441958d3d2ea41149f1e55359af069a2a5e039ccf56f068a5a0b09000100534e41540000000008000240000000020900010073797a30"], 0x2a8}, 0x1, 0x0, 0x0, 0x4}, 0x0) 4.89433013s ago: executing program 5 (id=4974): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f00000001c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=@mpls_delroute={0x30, 0x18, 0x9, 0x0, 0xfffffffd, {0x1c, 0x14, 0x0, 0x0, 0xfe, 0x2, 0x0, 0x1}, [@RTA_VIA={0x14, 0x12, {0x21, "cfbc6ac116946cf4a5b2ff7fffff"}}]}, 0x30}}, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$inet_smc(0x2b, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r2, 0x6, 0x1d, &(0x7f0000000080), &(0x7f0000000100)=0x14) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$alg(0x26, 0x5, 0x0) bind$alg(r5, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'rfc4106(gcm(aes))\x00'}, 0x58) setsockopt$ALG_SET_KEY(r5, 0x117, 0x1, &(0x7f00000009c0)="ad56b6c5820fae9d6dcd3292ea54c7be8bbdadbb1632ea5704cae881ef915d374c90c200", 0x24) r6 = accept4(r5, 0x0, 0x0, 0x800) sendmmsg$alg(r6, &(0x7f0000000c00), 0x0, 0x8040) sendmsg(r6, 0x0, 0x4008001) syz_genetlink_get_family_id$devlink(&(0x7f00000000c0), r6) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20000000) 3.73223985s ago: executing program 5 (id=4979): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nfc(&(0x7f0000000180), r0) sendmsg$NFC_CMD_VENDOR(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x24, r1, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_VENDOR_ID={0x23, 0x1d, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080) (async) sendmsg$NFC_CMD_VENDOR(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x24, r1, 0x1, 0x70bd25, 0x25dfdbfd, {}, [@NFC_ATTR_DEVICE_INDEX={0x8}, @NFC_ATTR_VENDOR_ID={0x23, 0x1d, 0x5}]}, 0x24}, 0x1, 0x0, 0x0, 0x4000}, 0x4000080) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000004c0)=ANY=[@ANYBLOB='P\x00\b\x00\x00', @ANYRES32=0x0, @ANYBLOB="0315000000200300140012800b0001006d616373656300000400028008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32=r3, @ANYBLOB="0a000100cd3d194dab020000"], 0x50}, 0x1, 0x0, 0x0, 0x2004d808}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r4, &(0x7f0000000000), 0x0, 0x404c154) (async) sendmmsg(r4, &(0x7f0000000000), 0x0, 0x404c154) 3.256716387s ago: executing program 2 (id=4980): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="9f01000083667d1040206402d14e0102030109021b000100000000090400000190f19c000905f3ed"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='binder\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000240)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[{@xino_auto}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) lstat(&(0x7f0000000000)='./file0\x00', &(0x7f00000001c0)) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, &(0x7f00000002c0)={0x14, &(0x7f00000000c0)={0x0, 0x36, 0x6, {0x6, 0x1, "33d782ea"}}, &(0x7f0000000540)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1801}}}, &(0x7f0000000500)={0x2c, &(0x7f0000000300)={0x0, 0xa, 0x3c, "75db868ec1c5f8855bbab5150f32cee6e871c4f4bb84ee4c152c67a32cb26581e57b27033eaccce12bda2d72ec86ed81dda90a4ee27d38665df09a75"}, &(0x7f0000000280)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x4c}, &(0x7f0000000480)={0xc0, 0x5, 0x3, "664dcd"}, &(0x7f00000004c0)={0x40, 0x5, 0x1, "b1"}}) syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000074ad60efc310c1ea7eff01020301090212000100000000090401020030c81e00"], 0x0) 3.154674357s ago: executing program 5 (id=4981): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) socket(0x10, 0x803, 0x0) 3.029003715s ago: executing program 1 (id=4982): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) r2 = dup(r1) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x2}}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd070010000000400080ff60ec97000fc83a00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) 2.978202109s ago: executing program 5 (id=4983): bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, &(0x7f0000000040)) socket$phonet_pipe(0x23, 0x5, 0x2) prlimit64(0x0, 0xe, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb87b9000) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x185) r4 = inotify_init() inotify_add_watch(r4, &(0x7f00000000c0)='.\x00', 0x5000009) fallocate(r3, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r3, 0x40000000000000) 2.025368997s ago: executing program 6 (id=4986): ioctl$VIDIOC_G_AUDOUT(0xffffffffffffffff, 0x80345631, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f00000001c0), r3) sendmsg$NLBL_UNLABEL_C_STATICREMOVEDEF(r2, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB='x\x00\x00\x00', @ANYRES16=r4, @ANYBLOB="01000000000000000000037400062c000700737b7352656d5f753a6f626a6563745f723a756465765f68656c7065725f657865635f743a73300005000200000000000800070026090909140006"], 0x78}, 0x1, 0xffffffff00000003}, 0xc0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_GET_NEXT_KEY(0x2, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0x0, 0x2}, 0x20) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="07000000040000000800000001"], 0x48) bpf$MAP_DELETE_ELEM(0x3, 0x0, 0x0) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r6, 0x0, 0x0) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="9feb01001800000000000000440000004400000006000000040000000000000e0400000000000000000000000200000d040000006c96f1cf040000000a000000010000000000000000000004000000000400000000000008030000000000000061"], 0x0, 0x62}, 0x28) sendmsg$IPSET_CMD_LIST(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000040)={0x1c, 0x7, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 1.92837629s ago: executing program 1 (id=4987): r0 = syz_open_dev$vbi(0x0, 0x3, 0x2) ioctl$VIDIOC_G_PARM(r0, 0xc0cc5615, &(0x7f00000000c0)={0x6, @capture={0x1000, 0x0, {0x2}, 0x6, 0x5}}) 1.926294006s ago: executing program 6 (id=4988): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) bpf$PROG_LOAD(0x5, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) flock(0xffffffffffffffff, 0x1) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r1, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) setsockopt$inet6_tcp_TCP_ULP(r1, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r1, 0x11a, 0x1, &(0x7f0000000340)=@gcm_256={{0x303}, '\x00', "ec094e071cc80f218d360356a936a7e3971a8c35c47e580400", "cf00", "fffffffffffffffd"}, 0x38) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f0000000200)=0xffffffffffffffff, 0x4) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r2 = socket(0x28, 0x5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bind$vsock_stream(r2, 0x0, 0x0) chdir(&(0x7f0000000540)='./cgroup\x00') r3 = openat(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0, 0x0) open_by_handle_at(r3, &(0x7f0000000040)=@reiserfs_2={0x8, 0x3ffff, {0xb}}, 0xfe) mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x300000a, 0x4031, 0xffffffffffffffff, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000000)={0x0, r2}, 0x8) 1.862458322s ago: executing program 8 (id=4989): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r2) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000000)) ioctl$SIOCSIFHWADDR(r2, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) close(r1) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000140)={'syzkaller0\x00', @random="371692e7f7ef"}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r3) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000200)) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random='\x00\a\x00\x00\x00\n'}) 1.861767012s ago: executing program 5 (id=4990): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=ANY=[@ANYBLOB="38000000031401002abd7000fedbdf250900020073017a31000000000800410072786500140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x3f}, 0x810) 1.796067428s ago: executing program 8 (id=4991): socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp_SCTP_MAX_BURST(0xffffffffffffffff, 0x84, 0x14, 0x0, &(0x7f0000000040)) prlimit64(0x0, 0xe, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000480)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x3, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0xb87b9000) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) setrlimit(0x7, &(0x7f0000000180)={0xffffffffffffffba, 0x5}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x185) r4 = inotify_init() inotify_add_watch(r4, &(0x7f00000000c0)='.\x00', 0x5000009) fallocate(r3, 0x0, 0x1000000, 0x3) mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r3, 0x0) 1.716396395s ago: executing program 1 (id=4992): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) openat$kvm(0xffffffffffffff9c, 0x0, 0x8082, 0x0) r0 = socket$pppl2tp(0x18, 0x1, 0x1) (async) r1 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r1, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) (async) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) socket$inet_mptcp(0x2, 0x1, 0x106) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) (async) syz_emit_ethernet(0x6a, &(0x7f00000000c0)=ANY=[@ANYBLOB="0180c200000e1704b45adbde08004500005c0000000000019078ac1e0001ac1414aa05009078e00000e0400000000000000000070000e0000001ac14142583030007030044249f037f00008900000000ac1414bbfffffffd0000000000000000ac1414000000000000009c38c17c690b3c"], 0x0) (async) bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[], 0x50) (async) socket(0x1000000010, 0x80002, 0x0) (async) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x400, 0x0, 0xb2}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x9a, 0xfffffffe}, 0x9c) (async) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000001a80)=ANY=[@ANYBLOB="b700000017000000bfa30000000000000703000028feffff620af0fff8ffffff61a4f0ff00000000a4040000000002000f030000000000003404000001ed0a0014040000170000801c400000000000007b0a00fe000000002c04000000000000c6000000000000009500000000000000023bc065b7a379d17cf9333379fc9e84af69912435f1b6a693002e7f3be361917adef6ee1c8a2b4f8ef1e50b91f32050e436fe275daf51efd601b6482a0800000098efefb202ee010400006e7a1de4a21f379dbf01de00b1b564fef3bef70548aed0d600c095199fe3ff3128e599b0eaebbdbd7359a48f5b0afc646cb7798b3e6440c2fbdb00a3e35208b0bbf12cd8dff0c710e4000000000000009fbe4b61a615c6c57a2b649dc74a1a610643b08d9ec21ead2ed51b104d4d91af25b8123deda8a3658d42ecbf1dbf6d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31a76e42f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0800000000000000d5f728d236619074d6ebdf098bc908f50ae728a40f9411fe7226a4040bef29b66e3858d051c096e37c4f46010400000000c3da29faf75ddd1aa96960bca97af13382cb881cc1f62c0f8f8f0e8d76b86f9c45636614786f5a2cb77230a874640dcbe0b20bb77c022d0cab080078fce8c5c81b7037181fc2f18f781aaa6e2957d7e39cc1baddcb7ec6667e699f24e41697ee7ea23e4b29a8b6cc9a1f5a7b3caae05f13792292cb949b3aab06b1e042ff2164d80c605532b18ab1c156b97e5889685a96949e4cb40df77b8bb84b0e733a63784ccc214d930cbb7e090d030000003acec439c163fcd7071b53ac29df826f8ae6d6e18c1eacf5bf870768d5217e9bb5a05d9e22ce67f1231bd236486727d970acc546087acbf30f2f8165b47ba56dfadd14b306e98931481747292c6fe6e188750cf4f87cce2aa7d67c7133a9f05954cde298a35ea6d715ba80aee63300000000000000000000000000000000000040000000000000000386000000b854adb4f8080064e8407c6bdb37114c80fbaa4a0ec5aaf4b0ac6f2128668279eb6fc144344e2d461c9a1be8fa0061ea9d55ee4716bea8e1cebf9ed39325ab4c5530dd6ee9fffc00000000000000d7c5af73c683625aaad5eda5004a76c9f8975ed4c5e4eb3e77e9885769754932609f19e2f615a01cb6d17fbf5cb539403cb0572534f054d5514ad8269b2bdf2ca4958a62a6e744f9a4c1e646e1dd2ca19583f0f8b0dc53debd7d44f334e6ed7445a9580f970e483b307c4b3c018bc194b23d37e6a2e52d8288e5aab6fec586d52386e8c07a88c88e8faec5f1b16b2014f6952ce7d6be12c6bdb9651ca6fc907061be311d1354e6295698594a73136237bee068d3819400e43544830a3f74b7942f22336953978a5b2032da4238cc61162c04c1297395b73e18c9387615a2bc87d9e2445f3d323d3fac347932a4bac694c55fe9d145906d410f58f1951405d10504efe402cae085afef5dbd617e87ddbd23834a50d7eb8e327fb5db12cbd6a9efe8e671c4f251fe3bf440cabdfe3400a670d14b9b3cd8d86e492997a0168c022ef3536bd1dc731f4f9f8cb6c3857fb8aaaa95024f8da775f72950212b84fc6133ae14d1429cd4905dabb52e43af7e65acf97b4951fa1e967d16a5ed642efc855a4a46b85cd079934ad3188276efae9387eaa2c910fb8de24b5d4fded86c3811ccd00520150b16000080122965558074956da5e4c3bbefcb64aa8be4456ed2caf0f467b6bbf3aa4371f5e76ab3f60afea80bb066aafb7517f787b090f419a20278a3c779e03afd9a6af6fd518e5dce030f88ec5a5cb7601a161da0f8089322d84ac523040d13e1f1300c2c6555bce60d95dd3288e53435713f03add23f14c8db5555c62de4f626483632a2ab547f88dd6efec73a0271a19ca3aa860aa4dcaeeb9bd91a0cb429efae2a5fcc08b3a572969bbe91c921ac1476027772c87d1767e31a3446cd57fafea83e495a6a1d1a4ebf83434986091dd66ffe3ffed0c39552a312e2db596d9c828c02f6fc13c8ddbb50bfd7dd8aa2f35f259fc83e007f00a292dd3b856faa4b7e66e1b64505f65900839df71a97d4d05d37f7ecf8ed9a22da26ae674bba16c204f6b2f8f74fc56b7126d7c11ece6e88ec41192aaee75415c58d264a2b6adae02c821b62428902aad499825ab85a348638384cd12e61dbde5c47056f0a20b4e2a2328d5db5cfe56557a129e6be231acf5f57995c60d9fca5f63a0dfd18054717120bda466d04774b530500d8b022719ca77a4e0a66b4708f791d849a5e2aaa0074a9560ede2600df5a5c41392fe9460080fcb1e65233fb8dbeec4c86dbcf6a0673e38d2d3615e5bfbde44afe0fa7564231fff7e7f1f3ad68492dd2ccb1decb15b5d7d3e37e8b7d28921c4b9280979521173f322df408d9818b6cc400098abb869921911480a876fbba698801937e8b4264eb6f5137bd9b075f1488d22230592a79000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002f316aa0886c174b73decb46c1c85edf50d8fcbac5ff76b365611666da86a8e65b308706bd7c000000000000003f7cd4d5cb9076b81b7741ec03877afb5237ea1694addebc14c3ae49f88c462aa2050acf2d9a97d3be29a5614d1eba2c98cf0236401e02d7c445e50f76419ab4f78f67a09e63dd4faa2e7b59399f055f2fa278783fefb0a5ef0b41e14a6fe6ba306206670b84894e901a523fcbadfeff535f2514bc834e876810d9a6a78e70a9e22860c36a724770b4185de44db6bf21fef32a8d5b36d9014f38fee012365f963b2a85e7d8075c333475b9be0bdd37220e316f2297743dd4731614a50c16c6a41744c3d24eab511317f97b7b4a1c2ec33fedc46e9bf0fa640eebd3d58f0ebdb7cb8ccffd08000000e843591d2618e2d2cdc7081c8fafffe9c350a5c554a387de4ee7aac6478d99de7dd82bef044a6d33c789d566c90c46ad581aa22f910547a77d55e26bf19f1d4661550b177ef53933a305e69b8a95119d2a673bdae05779208409e6cf5bda599d625054776151b2cd1fcde238bdc527594a6c17aa9728af7a3830e7092b01b119ea4e7e7f0e21527d622cc29c9f0c8720195368f8a9d3374337ab4d130619d93c5ef37e7ddd0b2da147e6e513455b88753452de959a6cbfa1ffbc7ad5d8c3b48017fd31dcf72f337b639253f44cb27a12174bc4c191e21015d0c431a71906eb9c6a14c8a060459ef26787ce3d1cbfd5cc459f0048b5d06f6cbd3e9b34c89f3fb2f951ae81d7fcc8bc0000000000000000000000000000000000000000009231feef3117197c7963c2ba910969f776c8b2ea3970f358107945d9e74e9bdfa58e68b65a9201bc4b73b431df5aa29f363917f90e3fa1eaf553db1c761dd9b634a9c4d7c21d24fe6d953ed9438cad0f8dfe03e5e2f73019352f1fb682a5a6ebbf24ebc49e3d7058e696eb3f4b642f36c9006c0067e24a64aa8c53dd824a4ee271e35ed9eed636338f1835fc957729d63dc1bfc7b772cbe536c2d3aff27c22f9a2f876512616a5bdaf22a16e19d1b5f52abb40b433983d0cf50234de659c1a397ce901000000caae1bcfdce33dae6adc260321702f239c25ab181390e7dc8c1e5b1cf3b4fef1cd5c44a89b5e5d8314e02f4673ded90bce9a4025b0232eec970f7aa17f175a14e8dc0700bac0006b98a8283eee5665f3aede28228e0468dbcf8b776fe4c629d3af183a7cba5adf77f23d31f9d5a183c0da4e95f75b1496a97a46a06e4e1f5a8438d49dbd493ba2482c398ab724577fd742bf44cdd8489086e61aa3cb1d3ab3dac8183102fe6fc8a038e3868a0592811446867969f0fb3f547e83c4ca35aac023f09f15bb0acb3cdc6efd9b0e9df56af7fda01280a3"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10}, 0x94) (async) bind$inet6(r4, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) (async) sendto$inet6(r4, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x0, 0x12, r5, 0x0) (async) ioctl$KVM_RUN(r5, 0xae80, 0x0) (async) shutdown(r4, 0x2) (async) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$VFAT_IOCTL_READDIR_BOTH(r6, 0x82307201, &(0x7f0000000640)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) unshare(0x42000000) 1.601805653s ago: executing program 6 (id=4993): r0 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002}) r1 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r1, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r2 = dup3(r1, r0, 0x0) r3 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r3, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r3, 0x4018620d, &(0x7f0000000040)={0x73622a85, 0x10a}) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000340)=[@acquire], 0x0, 0x0, 0x0}) ioctl$BINDER_WRITE_READ(r0, 0xc0306201, &(0x7f0000001040)={0x4c, 0x0, &(0x7f0000000ec0)=[@transaction_sg={0x40486311, {0x1, 0x0, 0x0, 0x0, 0x41, 0x0, 0x0, 0x0, 0xf0, 0x0, 0x0}, 0x1000}], 0x0, 0x0, 0x0}) socket(0x10, 0x803, 0x0) 1.566037273s ago: executing program 6 (id=4994): mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, 0x0) mount(0x0, 0x0, &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) r0 = socket$phonet(0x23, 0x2, 0x1) ioctl$SIOCPNADDRESOURCE(r0, 0x89e0, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x10) bpf$BPF_GET_MAP_INFO(0xf, 0x0, 0x0) connect$can_j1939(r1, &(0x7f0000000100)={0x1d, 0x0, 0x3, {0x1, 0x0, 0x4}, 0xff}, 0x18) chdir(0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = fsopen(0x0, 0x0) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x18, &(0x7f0000000300)=ANY=[@ANYBLOB="1800fffe000000000000000000000000b7080000000000007b8af8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b70500000800000085000000a7000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000b000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x19}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd}, 0x50) fsmount(r3, 0x0, 0xc) r6 = openat$selinux_relabel(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0) write$selinux_access(r6, 0x0, 0x0) 724.576715ms ago: executing program 8 (id=4995): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x1d) ioctl$KVM_CAP_VM_TYPES(r0, 0x4068aea3, &(0x7f0000000080)={0xeb, 0x0, 0xc}) prlimit64(0x0, 0xe, &(0x7f00000004c0)={0x7, 0x800000000000008a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) mount$fuse(0x0, 0x0, 0x0, 0x80, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f00000021c0)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000052b0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005468a9fe52386e52000000000000000000000000000000000000001000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000da0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000f7ffffffffffffff00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000001d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000bb33ea699a80e3f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, 0x0) shmget$private(0x0, 0x4000, 0x800, &(0x7f0000007000/0x4000)=nil) r2 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x4000) r4 = socket(0x10, 0x3, 0x0) readv(0xffffffffffffffff, &(0x7f0000000600)=[{0x0}, {0x0}, {0x0}, {&(0x7f0000000500)=""/219, 0xdb}, {&(0x7f0000000380)=""/36, 0x24}, {&(0x7f00000003c0)=""/9, 0x9}, {&(0x7f0000000480)=""/49, 0x31}], 0x7) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24040880}, 0x800) ptrace$ARCH_SHSTK_LOCK(0x1e, 0x0, 0x1, 0x5003) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_ENABLE_BEARER(r5, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000280)=ANY=[@ANYBLOB="1c000000", @ANYRES16=r6, @ANYBLOB="01000000000000000200010000000000000001"], 0x34}}, 0x0) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0x2000000) 530.559906ms ago: executing program 1 (id=4996): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket(0x10, 0x3, 0x0) sendmmsg$sock(0xffffffffffffffff, 0x0, 0x0, 0x0) syz_init_net_socket$llc(0x1a, 0x801, 0x0) r2 = openat$vicodec1(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) r3 = syz_open_dev$media(&(0x7f0000000040), 0x7ffffffe, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(r3, 0x80047c05, &(0x7f0000000100)=0xffffffffffffffff) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205648, &(0x7f0000000000)={0xf010000, 0x0, 0x0, r4, 0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x4c, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x20, 0x4, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @meta={{0x9}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_META_KEY={0x8, 0x2, 0x1, 0x0, 0xd}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x74}, 0x1, 0x0, 0x0, 0x4008091}, 0x24000000) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x4) r6 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r6, &(0x7f0000002700)=""/102392, 0x18ff8) bind$bt_hci(0xffffffffffffffff, 0x0, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(r7, 0x89f3, &(0x7f0000000380)={'ip6gre0\x00', &(0x7f0000000280)={'ip6gre0\x00', 0x0, 0x4, 0x37, 0x4, 0x0, 0x48, @rand_addr=' \x01\x00', @ipv4={'\x00', '\xff\xff', @private=0xa010102}, 0x7800, 0x700, 0x8, 0x7c8}}) sendmsg$nl_route_sched(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x24}}, 0x0) getsockname$packet(r1, &(0x7f0000000080)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700"/20, @ANYRES32=r8, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r8, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, 0xffffffffffffffff, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x600, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x8000) 505.225177ms ago: executing program 8 (id=4997): sendmsg$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="8b3b9d9939912eb368bef0bd8c7aa2f517a4a90a19873b01aa6ac1a6b3cf5ee3412a34df919c469ec5c2620a2c24", 0x2e}], 0x1}, 0x4048000) (async) sendmsg$inet(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000100)="8b3b9d9939912eb368bef0bd8c7aa2f517a4a90a19873b01aa6ac1a6b3cf5ee3412a34df919c469ec5c2620a2c24", 0x2e}], 0x1}, 0x4048000) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x44}, 0x1, 0x0, 0x0, 0x80}, 0x0) clock_gettime(0xfffffffffffffffb, 0x0) socket$inet_udp(0x2, 0x2, 0x0) (async) r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000b80)=@security={'security\x00', 0x64, 0x4, 0x2c8, 0x100000c, 0x0, 0xe0, 0x178, 0xffffffff, 0xffffffff, 0x230, 0x230, 0x230, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x98, 0xe0, 0x0, {0x0, 0x1000000000000}, [@common=@inet=@dscp={{0x28}, {0x10, 0x1}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz1\x00', {0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x42}}}, {{@ip={@multicast2, @private=0xa010101, 0xff000000, 0xff, 'veth0_macvtap\x00', 'vcan0\x00', {0xff}, {0xff}, 0x21}, 0x0, 0x90, 0xb8, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x2, 0x7}, {0x2, 0x0, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) (async) setsockopt$IPT_SO_SET_REPLACE(r0, 0x0, 0x40, &(0x7f0000000b80)=@security={'security\x00', 0x64, 0x4, 0x2c8, 0x100000c, 0x0, 0xe0, 0x178, 0xffffffff, 0xffffffff, 0x230, 0x230, 0x230, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x0, 0x98, 0xe0, 0x0, {0x0, 0x1000000000000}, [@common=@inet=@dscp={{0x28}, {0x10, 0x1}}]}, @common=@unspec=@IDLETIMER={0x48, 'IDLETIMER\x00', 0x0, {0x6, 'syz1\x00', {0x2}}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@CONNSECMARK={0x28, 'CONNSECMARK\x00', 0x0, {0x42}}}, {{@ip={@multicast2, @private=0xa010101, 0xff000000, 0xff, 'veth0_macvtap\x00', 'vcan0\x00', {0xff}, {0xff}, 0x21}, 0x0, 0x90, 0xb8, 0x0, {}, [@common=@socket0={{0x20}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{0xffffffffffffffff, 0x2, 0x7}, {0x2, 0x0, 0x1}}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x328) r1 = socket(0xa, 0x2, 0x0) connect$inet6(r1, &(0x7f0000000140)={0xa, 0x4e20, 0xf0fc, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x2}, 0x1c) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @raw_data="dea233684c996156af0d4bd8e3300217e750b8c97b7123d48003e7e1d3be5f710c41a1db6719881876e9bcc6e2f73c67cc6b675eb43188b5b7f9f898868de9a9c5d536d418ba283121a73a5aba55a87d2a2525295f4492bbde02ad8bc8e88779f2de06f38e99172df4d45b6f13c813dee4230c204a93172922b778fef7a1f89ce876bb89d44cd705bbb28db4869dfac20d928950507acd92c02d17f51b0a627539f6e0a0bdb92004bc6252cd35e8cd100962db9a83ad63a4e7e1ca17c1b6aac63fefa9bebe429d00"}) prlimit64(0x0, 0xb, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xb, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) (async) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x1) (async) sendmsg$IPSET_CMD_CREATE(r1, 0x0, 0x1) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) (async) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', &(0x7f00000004c0), 0x0, 0x0) lseek(0xffffffffffffffff, 0x101, 0x1) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(0xffffffffffffffff, 0x0, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsopen(0x0, 0x1) (async) r3 = fsopen(0x0, 0x1) socket$inet6_sctp(0xa, 0x1, 0x84) (async) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setrlimit(0xe, &(0x7f0000000040)={0xffffffffffffffff, 0x2a12}) open(0x0, 0x108842, 0x0) setsockopt$inet_sctp6_SCTP_EVENTS(r4, 0x84, 0xb, &(0x7f0000000180)={0xff, 0x0, 0x8, 0x5, 0xfd, 0x0, 0x0, 0x0, 0x20, 0x0, 0x0, 0x2, 0x0, 0x93}, 0xe) sendto$inet6(r4, &(0x7f0000000300)="8b", 0x1, 0x41, &(0x7f0000000000)={0xa, 0xffff, 0x0, @private1}, 0x1c) shutdown(r1, 0x0) close_range(r3, 0xffffffffffffffff, 0x0) 466.075799ms ago: executing program 6 (id=4998): mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file0\x00', 0x21) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=r0, @ANYBLOB=',group_id=', @ANYRESDEC=r0]) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x300, &(0x7f0000000340)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) 334.434129ms ago: executing program 8 (id=4999): r0 = socket$inet_icmp_raw(0x2, 0x3, 0x1) socket$nl_rdma(0x10, 0x3, 0x14) r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0) read$FUSE(r1, &(0x7f00000021c0)={0x2020}, 0x2020) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x3, @pix={0x434c, 0x8, 0x584e4f53, 0x4, 0xc, 0x7, 0x0, 0x40000005, 0x1, 0x7, 0x2, 0x7}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r3, &(0x7f0000000180)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r4 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, 0x0, 0x0) sendmsg$tipc(r5, &(0x7f0000000540)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x0, {{0x42}, 0x2}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x40000}, 0x10) setsockopt$inet_mreq(r0, 0x0, 0x23, &(0x7f0000000000)={@multicast1=0xe0000300, @local}, 0x8) r6 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r6, 0x0, 0xc8, &(0x7f0000003d40), 0x4) syz_emit_ethernet(0x2a, &(0x7f0000000040)={@multicast, @remote, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0x0, 0x0, 0x0, 0x2, 0x0, @empty, @multicast1=0xe0000300}, @info_reply={0x10, 0x0, 0x0, 0x3, 0xe}}}}}, 0x0) r7 = socket(0x10, 0x3, 0x0) write(r7, &(0x7f0000000000)="240000001a005f0214f9f407000904001f000000fe0000000000000008000f00fd000000", 0x24) 265.757793ms ago: executing program 8 (id=5000): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = request_key(&(0x7f0000000240)='pkcs7_test\x00', &(0x7f0000019300)={'syz', 0x0}, &(0x7f0000019340)='/dev/cpu/#/msr\x00', 0xfffffffffffffffa) add_key$keyring(&(0x7f0000000040), &(0x7f0000000200)={'syz', 0x0}, 0x0, 0x0, r0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000000300)=""/102392, 0x18ff8) r2 = socket$inet_udp(0x2, 0x2, 0x0) r3 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r3, 0x0, 0x40, &(0x7f00000003c0)=@filter={'filter\x00', 0x42, 0x4, 0x298, 0xffffffff, 0x168, 0x98, 0x98, 0xffffffff, 0xffffffff, 0x200, 0x200, 0x200, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x3e020000, 0x70, 0x98, 0x0, {0x88000000}}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x4}}}, {{@uncond, 0x0, 0x70, 0xd0, 0x0, {0x122}}, @common=@SET={0x60, 'SET\x00', 0x0, {{0x0, [0x0, 0x0, 0x0, 0x0, 0x0, 0x4]}, {0x0, [0x0, 0x0, 0x0, 0x1]}}}}, {{@ip={@rand_addr=0x64010101, @empty, 0xffffffff, 0xffffffff, 'batadv_slave_1\x00', 'veth1_to_batadv\x00', {0xff}, {}, 0x4, 0x2, 0x47}, 0x0, 0x70, 0x98}, @REJECT={0x28, 'REJECT\x00', 0x0, {0x6}}}], {{'\x00', 0x0, 0x70, 0x98, 0x300}, {0x28}}}}, 0x2f8) bind$inet(r2, &(0x7f0000000100)={0x2, 0x0, @local}, 0x10) setsockopt$sock_int(r2, 0x1, 0x6, 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) keyctl$instantiate(0xc, r0, &(0x7f0000019380)=@encrypted_load={'load ', 'ecryptfs', 0x20, 'trusted:', '/dev/cpu/#/msr\x00', 0x20, 0x4, 0x20, [0x65, 0x33, 0x34, 0x64, 0x30]}, 0x41, r0) sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000840)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x7, 0x0, 0x0, 0x0, 0x2}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@rand_addr=' \x01\x00', 0x2, 0x32}, 0xa, @in6=@private1, 0x0, 0x4}]}]}, 0xfc}}, 0x0) connect$inet(r2, &(0x7f0000000280)={0x2, 0x0, @broadcast}, 0x10) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB], 0x0) syz_usb_connect(0x6, 0x348, &(0x7f0000000480)={{0x12, 0x1, 0x310, 0x30, 0x1, 0x94, 0x10, 0x471, 0x7600, 0x39e0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x336, 0x2, 0x2, 0x40, 0x70, 0x9, [{{0x9, 0x4, 0x68, 0x9, 0x0, 0x25, 0x92, 0x14, 0x3, [@cdc_ecm={{0x6, 0x24, 0x6, 0x0, 0x0, "a0"}, {0x5, 0x24, 0x0, 0x5}, {0xd, 0x24, 0xf, 0x1, 0x6, 0x9, 0xfff7, 0x2}, [@mbim_extended={0x8, 0x24, 0x1c, 0x4, 0x40, 0x81}]}]}}, {{0x9, 0x4, 0x31, 0x8, 0x9, 0x25, 0xdc, 0x9e, 0x81, [], [{{0x9, 0x5, 0x1, 0x1, 0x8, 0x3, 0x28, 0x7, [@generic={0x51, 0xd, "45813e93386dd757fa22d569a427d7c99e68cb6bd0ac9081db96b36fc191a1d0f51064e4b367cea7920635d0197d85f7dd741880bb74bcf1e21aee8631bb3e6ef856ba54f705359e03fc9e3c74a766"}]}}, {{0x9, 0x5, 0x1, 0x1, 0x400, 0x9, 0x57, 0x5, [@generic={0xbc, 0xd, "b4b145beeb8cd431d5c807d04062b439d67ca55c7183df9adf75690cb71f87571afb1f33754bf88e1cb0b02c5895f8204d5ca8f01e0d8c9a4c82fe337dbe400c19e37c4b2ab53d4dc662178cdb70850b0e5a8501745ad5071332a9c26fabf9d9fa4145e986f08e358f22f39cdf14e4f8a212e228ab03f5e715988c40689cdfcbe32f33e9903f7424f714a1f0fccdc2a070cef7a82e6499a198578cdb3502a603c4b38ed06a13f6e517a84457d84dcb7ba23f67883b9548e8131e"}]}}, {{0x9, 0x5, 0xf, 0x4, 0xf8d90a5107ad9ff1, 0x5, 0xae, 0x8, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x41, 0xa9d3}]}}, {{0x9, 0x5, 0x7, 0x10, 0x10, 0x9, 0xc, 0x1}}, {{0x9, 0x5, 0x0, 0x10, 0x3ff, 0x7, 0x0, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0xe}, @generic={0x1a, 0x5, "a36797edb75102fe2d0ab49e89949261a8f5170d3521cb0d"}]}}, {{0x9, 0x5, 0xa, 0x3, 0x3ff, 0x7, 0x2, 0x6, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x1}]}}, {{0x9, 0x5, 0x3, 0x0, 0x10, 0x9, 0xff, 0xc, [@generic={0xec, 0x6, "1abafc1ffbfc08ee93e04917aac815a33faf41b01b68b7f7ed50e0623a79b8280ed418b285c690ddeee8ec598ac86c64db34f9e862a6b615200b384d02c5091e7223449158cdc94d32fbacfded8e5aa94e9bf5550157ce6eda5e1830c8da8754e4783b675c70f789b73fa54e05a06762897bf903e56ba02480fc3016d24bd073a98e46cfe6f0a0afada6440731ad3fb2a0c1ba9e0b46816f61667cec19212afca91ec1a63e7648af5f73a7f9a2f1277ea4897c377e247408cbb4ad36948d3cc72c87f2b06e74e91fc35cda2a2e4b6831e157cef37e0801490f67845ac740d8d27d57c446bedc71222243"}]}}, {{0x9, 0x5, 0x8, 0x1, 0x20, 0x4, 0x4, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x0, 0x7, 0x4dd1}]}}, {{0x9, 0x5, 0xe, 0x8, 0x40, 0x19, 0x4, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x3, 0x5, 0x9}, @generic={0x6d, 0x24, "cb92314ca9dd04df5c5aad2ac8aba74b0cf9ec522ce31957982fdca26bc61543226658247631b942bd0da0a69d8de2503b6e1a684482dc8bf2f3e1cd08718a2a61974f7533353f1644c0d024968446a0bcdc411db6c9439f6f2e47fd5d5e051b2575a5b5eeaae63600c6fc"}]}}]}}]}}]}}, 0x0) syz_usb_ep_write$ath9k_ep1(r5, 0x82, 0xfffffffffffffea8, &(0x7f00000000c0)=ANY=[]) 218.912887ms ago: executing program 6 (id=5001): socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000180)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_REMAIN_ON_CHANNEL(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f00000003c0)={0x1c, r1, 0x1, 0x0, 0x25dfdbfc, {{0x2}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x0) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000400)=@base={0xe, 0x4, 0x4, 0x3}, 0x48) r5 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000002c0)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x50) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x8000}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) syz_open_dev$dri(&(0x7f0000000200), 0xaab8, 0x109100) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = openat$userio(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) write$USERIO_CMD_SET_PORT_TYPE(r6, &(0x7f0000000140)={0x1, 0x3}, 0x2) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0xb, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8, 0x0, 0x0, 0x70}, {{0x18, 0x1, 0x1, 0xb0ff, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x3}, {0x95, 0x0, 0x0, 0x700}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0x9, 0xfe00}, {0x6, 0x0, 0xb, 0x9}, {0x3, 0x3, 0x6, 0xa, 0xa, 0xfff0, 0x50}, {0x7, 0x1, 0xb, 0x6, 0x8}, {0x7, 0x0, 0x0, 0x8}, {}, {}, {0x7, 0x0, 0x5, 0x0}, {0x18, 0x2, 0x2, 0x0, r5}, {}, {0x46, 0x8, 0xfff0, 0x76}}], {{0x5, 0x1, 0x4, 0x8}, {0x6, 0x0, 0x5, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0xa0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0xf00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 0s ago: executing program 1 (id=5002): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000100)=@newqdisc={0x3c, 0x24, 0x400, 0x20000000, 0x0, {0x0, 0x0, 0x0, 0x0, {0x4}, {0x0, 0xffff}, {0x0, 0xa}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_WASH={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x20000000}, 0x4) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027", @ANYRES32=0x0, @ANYBLOB="0000000000008000280012800a00010076786c616e"], 0x50}}, 0x20008844) r1 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi3\x00', 0x2000, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f0000000080)={'c6xdigio\x00', [0x401, 0x181, 0x2, 0xa, 0x14000000, 0x0, 0xfffffffc, 0x2, 0xffd, 0x7ffe, 0x3, 0x723, 0x400, 0x2, 0x13, 0x100, 0xffffffa7, 0x9, 0x34d, 0x1, 0x3fd, 0x4000009, 0x200, 0xe2df, 0x9, 0x1, 0x4, 0x40000, 0x7, 0xf58, 0x6]}) ioctl$COMEDI_INSN(r1, 0x8028640c, &(0x7f0000000000)={0x4000000, 0x92, 0x0, 0x1, 0x80000000}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000900)={'bridge0\x00', @remote}) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6(0xa, 0x2, 0x3a) r5 = openat$dlm_control(0xffffffffffffff9c, &(0x7f0000000140), 0x10400, 0x0) bind$inet6(r5, &(0x7f0000000000)={0xa, 0x0, 0x2f4, @mcast2}, 0x1c) sendmsg$NFT_MSG_GETOBJ_RESET(r4, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000380)=ANY=[@ANYBLOB="20ad6500150a010816000000000000000d000002090002007300000000000000"], 0x20}, 0x1, 0x0, 0x0, 0x40090}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x1b, 0xc, &(0x7f0000000440)=ANY=[@ANYRES32=r3, @ANYBLOB], 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) syz_emit_vhci(&(0x7f0000000180)=ANY=[@ANYBLOB], 0x47) bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x11, 0xc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) ioctl$KVM_CAP_SPLIT_IRQCHIP(r7, 0x4068aea3, &(0x7f0000000680)) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r8, 0x4008ae89, &(0x7f0000000280)={0x1, 0x0, [{0x6e0}]}) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x404080, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x89a1, &(0x7f0000000900)={'bridge0\x00', @broadcast}) kernel console output (not intermixed with test programs): [ 1547.312867][T23096] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1547.331782][T23096] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1547.389807][T23096] team0: Port device team_slave_0 added [ 1547.399043][T23096] team0: Port device team_slave_1 added [ 1547.434733][T23096] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1547.442011][T23096] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1547.479605][T23096] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1547.494518][T23096] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1547.501838][ T5927] usb 7-1: Using ep0 maxpacket: 8 [ 1547.507243][T23096] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1547.536115][T23096] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1547.548413][ T5927] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1547.559317][T16167] Bluetooth: hci5: command tx timeout [ 1547.564972][ T5927] usb 7-1: New USB device found, idVendor=0e8d, idProduct=2000, bcdDevice=21.c6 [ 1547.574017][ T5927] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1547.582058][T23172] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4326'. [ 1548.056319][ T5955] usb 6-1: new high-speed USB device number 102 using dummy_hcd [ 1548.145831][ T5927] usb 7-1: config 0 descriptor?? [ 1548.201447][T23096] hsr_slave_0: entered promiscuous mode [ 1548.220783][T23096] hsr_slave_1: entered promiscuous mode [ 1548.260023][ T5955] usb 6-1: Using ep0 maxpacket: 16 [ 1548.270500][T23176] netlink: 'syz.1.4328': attribute type 1 has an invalid length. [ 1548.281815][ T5955] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1548.302718][ T5955] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1548.326945][ T5955] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1548.345590][ T5955] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1548.364466][ T5955] usb 6-1: Product: syz [ 1548.375235][ T5955] usb 6-1: Manufacturer: syz [ 1548.386013][ T5955] usb 6-1: SerialNumber: syz [ 1548.427811][ T5955] usb 6-1: config 0 descriptor?? [ 1548.429969][T23185] netlink: 68 bytes leftover after parsing attributes in process `syz.2.4330'. [ 1548.466969][ T5955] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1548.512171][ T5955] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1548.670917][T19696] usb 7-1: USB disconnect, device number 63 [ 1548.751559][ T5899] usb 2-1: new high-speed USB device number 18 using dummy_hcd [ 1548.826591][ T10] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1548.909551][T23165] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1548.922085][ T5899] usb 2-1: config 0 has an invalid interface number: 168 but max is 0 [ 1548.922245][T23165] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1548.945731][ T5899] usb 2-1: config 0 has no interface number 0 [ 1548.951887][ T5899] usb 2-1: New USB device found, idVendor=05ab, idProduct=0060, bcdDevice=11.06 [ 1548.973962][ T5899] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1548.978690][T23096] netdevsim netdevsim9 netdevsim0: renamed from eth0 [ 1548.986098][ T5899] usb 2-1: config 0 descriptor?? [ 1548.998120][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 1548.999809][T23096] netdevsim netdevsim9 netdevsim1: renamed from eth1 [ 1549.014921][ T10] usb 3-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 1549.015513][T23096] netdevsim netdevsim9 netdevsim2: renamed from eth2 [ 1549.024872][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1549.042656][ T10] usb 3-1: config 0 descriptor?? [ 1549.043741][T23096] netdevsim netdevsim9 netdevsim3: renamed from eth3 [ 1549.059180][ T10] gspca_main: sq930x-2.14.0 probing 041e:403c [ 1549.128473][T23096] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1549.148575][T23096] 8021q: adding VLAN 0 to HW filter on device team0 [ 1549.160643][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1549.167808][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1549.178970][ T5955] em28xx 6-1:0.0: unknown em28xx chip ID (117) [ 1549.189814][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1549.196966][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1549.319794][T16167] Bluetooth: hci2: adv larger than maximum supported [ 1549.319851][T16167] Bluetooth: hci2: Unknown advertising packet type: 0x7f [ 1549.404956][T23165] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1549.654843][T23208] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4333'. [ 1549.663999][T23208] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4333'. [ 1549.788599][T16167] Bluetooth: hci5: command tx timeout [ 1550.048169][T23165] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1550.103411][ T5955] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1550.128000][ T5955] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1550.149273][ T5955] em28xx 6-1:0.0: No AC97 audio processor [ 1550.181360][ T5955] usb 6-1: USB disconnect, device number 102 [ 1550.205186][ T10] gspca_sq930x: ucbus_write failed -71 [ 1550.220017][ T10] sq930x 3-1:0.0: probe with driver sq930x failed with error -71 [ 1550.224028][ T5955] em28xx 6-1:0.0: Disconnecting em28xx [ 1550.275851][ T5955] em28xx 6-1:0.0: Freeing device [ 1550.293808][ T10] usb 3-1: USB disconnect, device number 19 [ 1550.416358][T23096] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1550.766388][ T5899] usb 2-1: string descriptor 0 read error: -71 [ 1550.798397][ T5899] usb-storage 2-1:0.168: USB Mass Storage device detected [ 1550.817374][ T5899] usb-storage 2-1:0.168: Quirks match for vid 05ab pid 0060: 2 [ 1551.887461][ T5899] usb 2-1: USB disconnect, device number 18 [ 1552.587016][T23096] veth0_vlan: entered promiscuous mode [ 1552.642291][T23096] veth1_vlan: entered promiscuous mode [ 1553.080933][T23096] veth0_macvtap: entered promiscuous mode [ 1553.412965][T23096] veth1_macvtap: entered promiscuous mode [ 1553.966601][T23096] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1553.994525][T23096] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1554.012670][T17095] netdevsim netdevsim9 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1554.037087][T17095] netdevsim netdevsim9 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1554.090641][T17095] netdevsim netdevsim9 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1554.112128][T17095] netdevsim netdevsim9 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1554.511155][T23268] veth0_macvtap: left allmulticast mode [ 1555.099412][T17095] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1555.113859][T23275] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4349'. [ 1555.122914][T23276] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4350'. [ 1555.141658][ T1139] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1555.160827][T17095] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1555.185398][ T1139] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1555.199275][T17095] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1555.208980][T17095] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1555.313707][ T30] audit: type=1400 audit(1764199480.255:1324): avc: denied { ioctl } for pid=23277 comm="syz.5.4351" path="socket:[97051]" dev="sockfs" ino=97051 ioctlcmd=0x5411 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1555.313865][T17095] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1555.354479][T17095] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1555.904527][T23292] netlink: 16 bytes leftover after parsing attributes in process `syz.9.4301'. [ 1555.931412][T23292] netlink: 20 bytes leftover after parsing attributes in process `syz.9.4301'. [ 1556.309836][T22567] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1556.618470][T23299] tipc: Started in network mode [ 1556.628951][T23299] tipc: Node identity 2a, cluster identity 4711 [ 1556.679853][T23299] tipc: Node number set to 42 [ 1556.707475][T22567] usb 3-1: device descriptor read/64, error -71 [ 1556.923154][T23307] netlink: 40 bytes leftover after parsing attributes in process `syz.6.4360'. [ 1556.983942][T22567] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1557.105745][ T7860] IPVS: starting estimator thread 0... [ 1557.134902][ T5955] usb 6-1: new full-speed USB device number 103 using dummy_hcd [ 1557.170020][T22567] usb 3-1: device descriptor read/64, error -71 [ 1557.233908][T23314] netlink: 20 bytes leftover after parsing attributes in process `syz.9.4361'. [ 1557.304227][T23312] IPVS: using max 43 ests per chain, 103200 per kthread [ 1557.320026][T22567] usb usb3-port1: attempt power cycle [ 1557.432704][ T5955] usb 6-1: device descriptor read/64, error -71 [ 1557.710288][ T7860] usb 2-1: new low-speed USB device number 19 using dummy_hcd [ 1557.742356][ T5955] usb 6-1: new full-speed USB device number 104 using dummy_hcd [ 1557.874380][T22567] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1557.882251][ T5955] usb 6-1: device descriptor read/64, error -71 [ 1557.914027][ T7860] usb 2-1: device descriptor read/64, error -71 [ 1557.935862][T22567] usb 3-1: device descriptor read/8, error -71 [ 1558.085172][ T5955] usb usb6-port1: attempt power cycle [ 1558.234146][T22567] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1558.278845][T22567] usb 3-1: device descriptor read/8, error -71 [ 1558.404505][T22567] usb usb3-port1: unable to enumerate USB device [ 1558.458885][ T5955] usb 6-1: new full-speed USB device number 105 using dummy_hcd [ 1558.501802][ T5955] usb 6-1: device descriptor read/8, error -71 [ 1558.533443][ T7860] usb 2-1: new low-speed USB device number 20 using dummy_hcd [ 1558.562166][T23325] lo speed is unknown, defaulting to 1000 [ 1558.683639][ T7860] usb 2-1: device descriptor read/64, error -71 [ 1558.790450][ T5955] usb 6-1: new full-speed USB device number 106 using dummy_hcd [ 1558.815818][ T7860] usb usb2-port1: attempt power cycle [ 1558.952173][ T5955] usb 6-1: device descriptor read/8, error -71 [ 1559.101898][ T5955] usb usb6-port1: unable to enumerate USB device [ 1559.627787][ T7860] usb 2-1: new low-speed USB device number 21 using dummy_hcd [ 1559.678147][ T7860] usb 2-1: device descriptor read/8, error -71 [ 1560.298772][ T7860] usb 2-1: new low-speed USB device number 22 using dummy_hcd [ 1560.576380][ T7860] usb 2-1: device not accepting address 22, error -71 [ 1560.724195][ T7860] usb usb2-port1: unable to enumerate USB device [ 1560.750516][ T30] audit: type=1400 audit(1764199485.344:1325): avc: denied { load_policy } for pid=23347 comm="syz.6.4371" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:security_t tclass=security permissive=1 [ 1560.805243][T23348] SELinux: ebitmap: truncated map [ 1560.812356][T23361] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4376'. [ 1560.819202][T23357] vlan2: entered allmulticast mode [ 1560.829970][T23348] SELinux: failed to load policy [ 1560.842202][T23364] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4375'. [ 1560.862335][T23357] dummy0: entered allmulticast mode [ 1561.116174][T23357] vlan2: entered allmulticast mode [ 1561.202899][T23371] netlink: 12 bytes leftover after parsing attributes in process `syz.9.4377'. [ 1561.840665][T23375] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4378'. [ 1563.398126][ T5926] usb 6-1: new high-speed USB device number 107 using dummy_hcd [ 1563.640295][ T5926] usb 6-1: Using ep0 maxpacket: 32 [ 1563.652704][ T5926] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 1563.671668][ T5926] usb 6-1: config 0 has no interface number 0 [ 1564.171659][ T5926] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1564.192959][ T5926] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1564.201134][ T5926] usb 6-1: Product: syz [ 1564.205318][ T5926] usb 6-1: Manufacturer: syz [ 1564.209934][ T5926] usb 6-1: SerialNumber: syz [ 1564.217685][ T5926] usb 6-1: config 0 descriptor?? [ 1564.234791][ T5926] smsc95xx v2.0.0 [ 1564.639129][T23406] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4387'. [ 1564.760924][ T5926] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1564.946770][ T5926] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1565.073234][T23408] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4388'. [ 1565.367289][T19696] usb 7-1: new high-speed USB device number 64 using dummy_hcd [ 1565.418919][T23416] netlink: 'syz.9.4390': attribute type 27 has an invalid length. [ 1565.454192][ T5926] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 1565.467933][ T5926] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 1565.472704][T23419] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=71 sclass=netlink_route_socket pid=23419 comm=syz.9.4390 [ 1565.490523][ T5926] usb 6-1: USB disconnect, device number 107 [ 1565.696146][T19696] usb 7-1: Using ep0 maxpacket: 16 [ 1565.735017][T19696] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1566.209565][T19696] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1566.237251][T19696] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1566.239888][T23416] bridge0: port 2(bridge_slave_1) entered disabled state [ 1566.253130][T19696] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1566.253955][T23416] bridge0: port 1(bridge_slave_0) entered disabled state [ 1566.261405][T19696] usb 7-1: Product: syz [ 1566.328698][T19696] usb 7-1: Manufacturer: syz [ 1566.333344][T19696] usb 7-1: SerialNumber: syz [ 1566.432499][T19696] usb 7-1: config 0 descriptor?? [ 1566.443900][T19696] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1566.464511][T19696] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1566.598687][T23416] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1566.647667][ T8552] usb 6-1: new high-speed USB device number 108 using dummy_hcd [ 1566.667196][T23416] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1566.726670][ T5955] usb 3-1: new high-speed USB device number 24 using dummy_hcd [ 1566.875612][T23410] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1566.898023][ T8552] usb 6-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1566.907296][ T5955] usb 3-1: Using ep0 maxpacket: 32 [ 1566.913299][ T8552] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1566.919034][T23410] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1566.936660][ T5955] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1566.967643][ T5955] usb 3-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 1566.984132][ T8552] usb 6-1: config 0 descriptor?? [ 1567.014587][ T8552] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1567.022924][ T5955] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1567.072959][T12451] netdevsim netdevsim9 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1567.087775][ T5955] usb 3-1: config 0 descriptor?? [ 1567.110558][T12451] netdevsim netdevsim9 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1567.148114][ T5955] dvb-usb: found a 'TeVii S662' in warm state. [ 1567.191005][T19696] em28xx 7-1:0.0: chip ID is em28178 [ 1567.204671][ T5955] dw2102: su3000_power_ctrl: 1, initialized 0 [ 1567.210969][T12451] netdevsim netdevsim9 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1567.225943][ T5955] dvb-usb: bulk message failed: -22 (2/0) [ 1567.233424][T12451] netdevsim netdevsim9 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1567.257999][ T5955] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1567.270484][ T5955] dvbdev: DVB: registering new adapter (TeVii S662) [ 1567.277182][ T5955] usb 3-1: media controller created [ 1567.318099][ T5955] dvb-usb: bulk message failed: -22 (6/0) [ 1567.383518][ T5955] dw2102: i2c transfer failed. [ 1567.406453][ T5955] dvb-usb: bulk message failed: -22 (6/0) [ 1567.412686][ T5955] dw2102: i2c transfer failed. [ 1567.434558][T22567] usb 7-1: USB disconnect, device number 64 [ 1567.441335][T22567] em28xx 7-1:0.0: Disconnecting em28xx [ 1567.464322][ T5955] dvb-usb: bulk message failed: -22 (6/0) [ 1567.483420][ T5955] dw2102: i2c transfer failed. [ 1567.493890][T22567] em28xx 7-1:0.0: Freeing device [ 1567.506217][T23433] can0: slcan on ttyS3. [ 1567.519662][ T5955] dvb-usb: bulk message failed: -22 (6/0) [ 1567.543060][ T5955] dw2102: i2c transfer failed. [ 1567.582568][ T5955] dvb-usb: bulk message failed: -22 (6/0) [ 1567.607120][ T5955] dw2102: i2c transfer failed. [ 1567.615536][ T5955] dvb-usb: bulk message failed: -22 (6/0) [ 1567.625326][ T5955] dw2102: i2c transfer failed. [ 1567.642468][ T5955] dvb-usb: MAC address: 02:02:02:02:02:02 [ 1567.672749][T23425] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1567.687242][T23425] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1567.726024][ T8552] gspca_cpia1: usb_control_msg 01, error -71 [ 1567.766944][ T8552] cpia1 6-1:0.0: only firmware version 1 is supported (got: 0) [ 1567.781379][ T5955] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1567.793589][T23439] bond0: entered promiscuous mode [ 1567.817663][ T8552] usb 6-1: USB disconnect, device number 108 [ 1567.820257][T23439] bond_slave_0: entered promiscuous mode [ 1567.957464][T23439] bond_slave_1: entered promiscuous mode [ 1567.964401][ T5955] dvb-usb: bulk message failed: -22 (3/0) [ 1567.971374][ T5955] dw2102: command 0x0e transfer failed. [ 1567.971441][T23439] bond0: left promiscuous mode [ 1567.983060][T23439] bond_slave_0: left promiscuous mode [ 1567.983527][ T5955] dvb-usb: bulk message failed: -22 (3/0) [ 1567.995044][ T5955] dw2102: command 0x0e transfer failed. [ 1567.995288][T23439] bond_slave_1: left promiscuous mode [ 1568.440525][ T30] audit: type=1400 audit(1764199492.191:1326): avc: denied { setopt } for pid=23440 comm="syz.1.4398" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 1569.624664][ T5955] dvb-usb: bulk message failed: -22 (3/0) [ 1569.651842][ T5955] dw2102: command 0x0e transfer failed. [ 1569.768058][ T5955] dvb-usb: bulk message failed: -22 (3/0) [ 1569.778535][ T5955] dw2102: command 0x0e transfer failed. [ 1569.784738][ T5955] dvb-usb: bulk message failed: -22 (1/0) [ 1570.807394][T23433] can0 (unregistered): slcan off ttyS3. [ 1570.922938][ T5955] dw2102: command 0x51 transfer failed. [ 1570.966645][ T5955] dvb-usb: bulk message failed: -22 (5/0) [ 1570.996308][ T5955] dw2102: i2c probe for address 0x68 failed. [ 1571.285816][ T5955] dvb-usb: bulk message failed: -22 (5/0) [ 1571.326514][ T5955] dw2102: i2c probe for address 0x69 failed. [ 1571.392782][ T5955] dvb-usb: bulk message failed: -22 (5/0) [ 1571.427874][ T5955] dw2102: i2c probe for address 0x6a failed. [ 1571.454201][ T5955] dw2102: probing for demodulator failed. Is the external power switched on? [ 1571.482605][ T5955] dvb-usb: no frontend was attached by 'TeVii S662' [ 1571.554793][ T5926] usb 6-1: new high-speed USB device number 109 using dummy_hcd [ 1571.896756][T22567] usb 2-1: new high-speed USB device number 23 using dummy_hcd [ 1571.922394][ T5955] rc_core: IR keymap rc-tt-1500 not found [ 1571.950160][ T5926] usb 6-1: Using ep0 maxpacket: 16 [ 1571.977926][T23465] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4406'. [ 1571.994798][ T5955] Registered IR keymap rc-empty [ 1572.014832][ T5926] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 23, changing to 8 [ 1572.036585][ T5955] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 1572.164212][ T5926] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1572.620158][ T5955] input: TeVii S662 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input96 [ 1572.644066][T22567] usb 2-1: Using ep0 maxpacket: 32 [ 1572.673819][T22567] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1572.684979][ T5926] usb 6-1: New USB device found, idVendor=0079, idProduct=1803, bcdDevice= 0.00 [ 1572.694643][ T5955] dvb-usb: schedule remote query interval to 250 msecs. [ 1572.705233][T22567] usb 2-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 1572.715994][ T5955] dw2102: su3000_power_ctrl: 0, initialized 1 [ 1572.722849][ T5926] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.741460][ T5955] dvb-usb: TeVii S662 successfully initialized and connected. [ 1572.749132][T22567] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1572.774320][ T5926] usb 6-1: config 0 descriptor?? [ 1572.791196][ T5955] usb 3-1: USB disconnect, device number 24 [ 1572.796427][T22567] usb 2-1: config 0 descriptor?? [ 1572.938145][T22567] dvb-usb: found a 'TeVii S662' in warm state. [ 1572.987568][T22567] dw2102: su3000_power_ctrl: 1, initialized 0 [ 1573.001497][T22567] dvb-usb: bulk message failed: -22 (2/0) [ 1573.034936][ T5955] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 1573.066814][T22567] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1573.121211][T22567] dvbdev: DVB: registering new adapter (TeVii S662) [ 1573.146635][T22567] usb 2-1: media controller created [ 1573.178874][T22567] dvb-usb: bulk message failed: -22 (6/0) [ 1573.197424][T22567] dw2102: i2c transfer failed. [ 1573.221918][ T30] audit: type=1400 audit(1764199496.999:1327): avc: denied { remount } for pid=23461 comm="syz.5.4404" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:ramfs_t tclass=filesystem permissive=1 [ 1573.309567][T22567] dvb-usb: bulk message failed: -22 (6/0) [ 1573.344452][T22567] dw2102: i2c transfer failed. [ 1573.364656][T22567] dvb-usb: bulk message failed: -22 (6/0) [ 1573.370514][T22567] dw2102: i2c transfer failed. [ 1573.375815][T22567] dvb-usb: bulk message failed: -22 (6/0) [ 1573.381669][T22567] dw2102: i2c transfer failed. [ 1573.386844][T22567] dvb-usb: bulk message failed: -22 (6/0) [ 1573.392705][T22567] dw2102: i2c transfer failed. [ 1573.397740][T22567] dvb-usb: bulk message failed: -22 (6/0) [ 1573.403550][T22567] dw2102: i2c transfer failed. [ 1573.408936][T22567] dvb-usb: MAC address: 02:02:02:02:02:02 [ 1573.532010][T22567] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1573.589956][T22567] dvb-usb: bulk message failed: -22 (3/0) [ 1573.596952][T22567] dw2102: command 0x0e transfer failed. [ 1573.603164][T22567] dvb-usb: bulk message failed: -22 (3/0) [ 1573.609168][T22567] dw2102: command 0x0e transfer failed. [ 1573.686644][ T5926] usbhid 6-1:0.0: can't add hid device: -71 [ 1573.694307][ T5926] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1573.733433][ T5926] usb 6-1: USB disconnect, device number 109 [ 1574.731697][T23489] FAULT_INJECTION: forcing a failure. [ 1574.731697][T23489] name failslab, interval 1, probability 0, space 0, times 0 [ 1574.744353][T23489] CPU: 0 UID: 0 PID: 23489 Comm: syz.1.4412 Not tainted syzkaller #0 PREEMPT(full) [ 1574.744369][T23489] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1574.744376][T23489] Call Trace: [ 1574.744381][T23489] [ 1574.744386][T23489] dump_stack_lvl+0x16c/0x1f0 [ 1574.744403][T23489] should_fail_ex+0x512/0x640 [ 1574.744419][T23489] ? kmem_cache_alloc_noprof+0x62/0x6e0 [ 1574.744438][T23489] should_failslab+0xc2/0x120 [ 1574.744453][T23489] kmem_cache_alloc_noprof+0x75/0x6e0 [ 1574.744468][T23489] ? taskstats_exit+0x654/0xbe0 [ 1574.744485][T23489] ? taskstats_exit+0x654/0xbe0 [ 1574.744497][T23489] ? acct_update_integrals+0x2ce/0x4a0 [ 1574.744511][T23489] taskstats_exit+0x654/0xbe0 [ 1574.744525][T23489] ? __pfx_taskstats_exit+0x10/0x10 [ 1574.744540][T23489] ? exit_signals+0x38e/0xb40 [ 1574.744557][T23489] do_exit+0x5dc/0x2bf0 [ 1574.744573][T23489] ? __pfx___might_resched+0x10/0x10 [ 1574.744590][T23489] ? __pfx_do_exit+0x10/0x10 [ 1574.744605][T23489] ? do_raw_spin_lock+0x12c/0x2b0 [ 1574.744618][T23489] ? find_held_lock+0x2b/0x80 [ 1574.744633][T23489] do_group_exit+0xd3/0x2a0 [ 1574.744650][T23489] get_signal+0x2671/0x26d0 [ 1574.744668][T23489] ? __pfx_get_signal+0x10/0x10 [ 1574.744685][T23489] arch_do_signal_or_restart+0x8f/0x7c0 [ 1574.744701][T23489] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1574.744718][T23489] ? ksys_write+0x1ac/0x250 [ 1574.744728][T23489] ? __pfx_ksys_write+0x10/0x10 [ 1574.744741][T23489] exit_to_user_mode_loop+0x85/0x130 [ 1574.744754][T23489] do_syscall_64+0x426/0xfa0 [ 1574.744766][T23489] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1574.744778][T23489] RIP: 0033:0x7f00c098f749 [ 1574.744789][T23489] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1574.744799][T23489] RSP: 002b:00007f00c177d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1574.744810][T23489] RAX: fffffffffffffffc RBX: 00007f00c0be5fa0 RCX: 00007f00c098f749 [ 1574.744817][T23489] RDX: 0000000000000050 RSI: 0000200000000640 RDI: 000000000000000a [ 1574.744824][T23489] RBP: 00007f00c177d090 R08: 0000000000000000 R09: 0000000000000000 [ 1574.744830][T23489] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1574.744836][T23489] R13: 00007f00c0be6038 R14: 00007f00c0be5fa0 R15: 00007fffc4c0ea38 [ 1574.744850][T23489] [ 1574.974630][T22567] dvb-usb: bulk message failed: -22 (3/0) [ 1575.191325][T22567] dw2102: command 0x0e transfer failed. [ 1575.197058][T22567] dvb-usb: bulk message failed: -22 (3/0) [ 1575.203270][T22567] dw2102: command 0x0e transfer failed. [ 1575.568657][T22567] dvb-usb: bulk message failed: -22 (1/0) [ 1575.586172][T23490] netlink: 'syz.6.4411': attribute type 10 has an invalid length. [ 1575.623787][T22567] dw2102: command 0x51 transfer failed. [ 1575.660964][T23490] bond0: (slave bond_slave_0): Releasing backup interface [ 1575.678982][T22567] dvb-usb: bulk message failed: -22 (5/0) [ 1575.738260][T22567] dw2102: i2c probe for address 0x68 failed. [ 1575.791766][T22567] dvb-usb: bulk message failed: -22 (5/0) [ 1575.817547][T22567] dw2102: i2c probe for address 0x69 failed. [ 1575.839624][T22567] dvb-usb: bulk message failed: -22 (5/0) [ 1575.862268][T22567] dw2102: i2c probe for address 0x6a failed. [ 1575.883644][T23505] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4416'. [ 1575.894657][T22567] dw2102: probing for demodulator failed. Is the external power switched on? [ 1575.913999][T22567] dvb-usb: no frontend was attached by 'TeVii S662' [ 1576.100216][T22567] rc_core: IR keymap rc-tt-1500 not found [ 1576.142427][T22567] Registered IR keymap rc-empty [ 1576.160158][ T30] audit: type=1400 audit(1764199506.738:1328): avc: denied { getopt } for pid=23514 comm="syz.2.4420" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1 [ 1576.239498][ T30] audit: type=1400 audit(1764199506.794:1329): avc: denied { accept } for pid=23512 comm="syz.9.4419" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 1576.259917][T22567] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0 [ 1576.288897][T22567] input: TeVii S662 as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc0/input97 [ 1576.318283][T22567] dvb-usb: schedule remote query interval to 250 msecs. [ 1576.376848][T22567] dw2102: su3000_power_ctrl: 0, initialized 1 [ 1576.382968][T22567] dvb-usb: TeVii S662 successfully initialized and connected. [ 1576.462227][T22567] usb 2-1: USB disconnect, device number 23 [ 1576.553292][T22567] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 1576.891619][T22567] usb 2-1: new high-speed USB device number 24 using dummy_hcd [ 1576.932390][T23515] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 1576.944762][T23515] block device autoloading is deprecated and will be removed. [ 1576.983305][T23541] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4427'. [ 1577.038935][T22567] usb 2-1: device descriptor read/64, error -71 [ 1577.318560][T22567] usb 2-1: new high-speed USB device number 25 using dummy_hcd [ 1578.674943][T22567] usb 2-1: device descriptor read/64, error -71 [ 1578.760666][T23555] netlink: 'syz.5.4430': attribute type 8 has an invalid length. [ 1578.795147][T22567] usb usb2-port1: attempt power cycle [ 1579.017203][T17097] bridge_slave_1: left allmulticast mode [ 1579.023306][T17097] bridge_slave_1: left promiscuous mode [ 1579.055711][T17097] bridge0: port 2(bridge_slave_1) entered disabled state [ 1579.120114][T17097] bridge_slave_0: left allmulticast mode [ 1579.169864][T17097] bridge_slave_0: left promiscuous mode [ 1579.172308][T23566] FAULT_INJECTION: forcing a failure. [ 1579.172308][T23566] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1579.175606][T17097] bridge0: port 1(bridge_slave_0) entered disabled state [ 1579.214908][T23566] CPU: 0 UID: 0 PID: 23566 Comm: syz.1.4435 Not tainted syzkaller #0 PREEMPT(full) [ 1579.214933][T23566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1579.214944][T23566] Call Trace: [ 1579.214950][T23566] [ 1579.214958][T23566] dump_stack_lvl+0x16c/0x1f0 [ 1579.214980][T23566] should_fail_ex+0x512/0x640 [ 1579.215003][T23566] _copy_from_iter+0x29f/0x1720 [ 1579.215026][T23566] ? __alloc_skb+0x200/0x380 [ 1579.215047][T23566] ? __pfx__copy_from_iter+0x10/0x10 [ 1579.215065][T23566] ? netlink_autobind.isra.0+0x158/0x370 [ 1579.215099][T23566] netlink_sendmsg+0x820/0xdd0 [ 1579.215128][T23566] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1579.215158][T23566] ____sys_sendmsg+0xa98/0xc70 [ 1579.215175][T23566] ? copy_msghdr_from_user+0x10a/0x160 [ 1579.215195][T23566] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1579.215219][T23566] ___sys_sendmsg+0x134/0x1d0 [ 1579.215243][T23566] ? __pfx____sys_sendmsg+0x10/0x10 [ 1579.215263][T23566] ? __lock_acquire+0x622/0x1c90 [ 1579.215304][T23566] __sys_sendmsg+0x16d/0x220 [ 1579.215327][T23566] ? __pfx___sys_sendmsg+0x10/0x10 [ 1579.215364][T23566] do_syscall_64+0xcd/0xfa0 [ 1579.215382][T23566] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1579.215408][T23566] RIP: 0033:0x7f00c098f749 [ 1579.215424][T23566] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1579.215441][T23566] RSP: 002b:00007f00c177d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1579.215459][T23566] RAX: ffffffffffffffda RBX: 00007f00c0be5fa0 RCX: 00007f00c098f749 [ 1579.215471][T23566] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1579.215481][T23566] RBP: 00007f00c177d090 R08: 0000000000000000 R09: 0000000000000000 [ 1579.215491][T23566] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1579.215500][T23566] R13: 00007f00c0be6038 R14: 00007f00c0be5fa0 R15: 00007fffc4c0ea38 [ 1579.215521][T23566] [ 1579.514760][T23572] xt_CONNSECMARK: invalid mode: 66 [ 1579.520183][ T5844] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1579.551659][ T5844] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1579.562217][ T5844] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1579.575474][ T5844] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1579.584263][ T5844] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1580.260843][T23584] xt_hashlimit: max too large, truncated to 1048576 [ 1580.282122][T23584] xt_limit: Overflow, try lower: 0/0 [ 1580.738996][ T5899] usb 2-1: new high-speed USB device number 27 using dummy_hcd [ 1580.930297][ T5899] usb 2-1: Using ep0 maxpacket: 8 [ 1580.940828][ T5899] usb 2-1: config 2 interface 0 altsetting 8 endpoint 0x9 has invalid wMaxPacketSize 0 [ 1580.961621][ T5899] usb 2-1: config 2 interface 0 has no altsetting 0 [ 1580.993613][ T5899] usb 2-1: New USB device found, idVendor=04e2, idProduct=141a, bcdDevice=ca.10 [ 1581.003358][ T5899] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1581.020716][ T5899] usb 2-1: Product: syz [ 1581.025288][ T5899] usb 2-1: Manufacturer: syz [ 1581.034294][ T5899] usb 2-1: SerialNumber: syz [ 1581.053628][T17097] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1581.063559][T17097] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1581.074448][T17097] bond0 (unregistering): Released all slaves [ 1581.088352][T23565] faux_driver regulatory: loading /lib/firmware/regulatory.db failed with error -12 [ 1581.101066][T23565] faux_driver regulatory: Direct firmware load for regulatory.db failed with error -12 [ 1581.111287][T23565] faux_driver regulatory: Falling back to sysfs fallback for: regulatory.db [ 1581.167904][T23569] lo speed is unknown, defaulting to 1000 [ 1581.283667][T23586] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1581.304124][T23586] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1581.338041][ T5899] usb 2-1: USB disconnect, device number 27 [ 1581.642917][T23614] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4446'. [ 1581.736820][T23616] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4449'. [ 1581.812588][T17097] hsr_slave_0: left promiscuous mode [ 1581.827426][T17097] hsr_slave_1: left promiscuous mode [ 1581.839738][T16167] Bluetooth: hci5: command tx timeout [ 1581.851369][T17097] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1581.869053][T17097] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1582.569207][T23623] No control pipe specified [ 1582.786420][T22567] usb 6-1: new high-speed USB device number 110 using dummy_hcd [ 1582.798756][T16167] Bluetooth: hci4: command 0x0406 tx timeout [ 1583.242335][T22567] usb 6-1: Using ep0 maxpacket: 32 [ 1583.260469][T22567] usb 6-1: config 0 has an invalid interface number: 2 but max is 0 [ 1583.435771][T22567] usb 6-1: config 0 has no interface number 0 [ 1583.441950][T22567] usb 6-1: config 0 interface 2 altsetting 2 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1583.453711][T22567] usb 6-1: config 0 interface 2 has no altsetting 0 [ 1583.477537][T22567] usb 6-1: New USB device found, idVendor=086a, idProduct=0003, bcdDevice=f0.3f [ 1583.487841][T22567] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1583.498638][T22567] usb 6-1: Product: syz [ 1583.502836][T22567] usb 6-1: Manufacturer: syz [ 1583.507659][T22567] usb 6-1: SerialNumber: syz [ 1583.515083][T22567] usb 6-1: config 0 descriptor?? [ 1583.713367][T17097] team0 (unregistering): Port device team_slave_1 removed [ 1583.741911][ T5899] usb 7-1: new high-speed USB device number 65 using dummy_hcd [ 1583.765443][T17097] team0 (unregistering): Port device team_slave_0 removed [ 1583.876063][T22567] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1583.940416][ T5899] usb 7-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 1583.950484][ T5899] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1583.959948][ T5899] usb 7-1: Product: syz [ 1583.964122][ T5899] usb 7-1: Manufacturer: syz [ 1583.968782][ T5899] usb 7-1: SerialNumber: syz [ 1583.978473][ T5899] usb 7-1: config 0 descriptor?? [ 1584.062734][ T5844] Bluetooth: hci5: command tx timeout [ 1584.258702][T23569] chnl_net:caif_netlink_parms(): no params data found [ 1584.509479][T22567] usb 6-1: USB disconnect, device number 110 [ 1584.634398][T23569] bridge0: port 1(bridge_slave_0) entered blocking state [ 1584.849151][T23569] bridge0: port 1(bridge_slave_0) entered disabled state [ 1584.969178][T23569] bridge_slave_0: entered allmulticast mode [ 1584.984367][T23569] bridge_slave_0: entered promiscuous mode [ 1585.090142][T23634] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1585.106716][T23634] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1585.115264][T23569] bridge0: port 2(bridge_slave_1) entered blocking state [ 1585.125633][T23569] bridge0: port 2(bridge_slave_1) entered disabled state [ 1585.146212][T23569] bridge_slave_1: entered allmulticast mode [ 1585.158782][T23569] bridge_slave_1: entered promiscuous mode [ 1585.669537][T23569] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1585.671815][ T5899] mos7840 7-1:0.0: required endpoints missing [ 1585.683970][T23569] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1585.701929][ T5899] usb 7-1: USB disconnect, device number 65 [ 1585.816266][T23569] team0: Port device team_slave_0 added [ 1585.826417][T23569] team0: Port device team_slave_1 added [ 1585.850325][T23569] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1585.857286][T23569] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1586.307728][T23665] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4461'. [ 1586.536059][ T5844] Bluetooth: hci5: command tx timeout [ 1586.554167][T23569] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1586.567830][T23569] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1586.575591][T23569] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1586.620288][T23569] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1586.672362][T23569] hsr_slave_0: entered promiscuous mode [ 1586.678871][T23569] hsr_slave_1: entered promiscuous mode [ 1587.029131][T23676] siw: device registration error -23 [ 1587.561640][T23569] netdevsim netdevsim8 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1587.574691][T23569] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1587.585592][T23569] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1587.764070][ T5927] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1588.074681][T23569] netdevsim netdevsim8 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1588.086384][T23569] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1588.097132][T23569] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1588.114364][ T5927] usb 3-1: Using ep0 maxpacket: 16 [ 1588.142626][ T5927] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1588.307299][ T5955] usb 7-1: new high-speed USB device number 66 using dummy_hcd [ 1588.458551][ T5927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1588.472462][ T5927] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1588.482114][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.490357][ T5927] usb 3-1: Product: syz [ 1588.494549][ T5927] usb 3-1: Manufacturer: syz [ 1588.499446][ T5927] usb 3-1: SerialNumber: syz [ 1588.506484][ T5927] usb 3-1: config 0 descriptor?? [ 1588.513745][T23569] netdevsim netdevsim8 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1588.525463][ T5927] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1588.541999][ T5927] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 1588.557452][T23569] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1588.583495][T23569] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1588.603363][T23693] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4470'. [ 1588.681187][ T5844] Bluetooth: hci5: command tx timeout [ 1588.783035][T23698] netlink: 32 bytes leftover after parsing attributes in process `syz.1.4471'. [ 1588.938358][T23569] netdevsim netdevsim8 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1589.080130][ T5955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1589.091409][T23569] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1589.121688][ T5955] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1589.140768][T23569] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 1] type 2 family 0 port 256 - 0 [ 1589.175317][ T5955] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1589.204428][ T5955] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1589.214134][ T5955] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1589.235325][ T5955] usb 7-1: config 0 descriptor?? [ 1589.319929][T23675] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1589.370717][T23701] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1589.625210][ T5927] em28xx 3-1:0.0: chip ID is em28178 [ 1589.766759][T23569] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1589.784453][T23707] syzkaller0: entered allmulticast mode [ 1589.800760][ T5955] plantronics 0003:047F:FFFF.0026: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.6-1/input0 [ 1589.815937][T23569] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1590.889217][ T5955] usb 3-1: USB disconnect, device number 25 [ 1591.108286][ T5955] em28xx 3-1:0.0: Disconnecting em28xx [ 1591.129874][ T5955] em28xx 3-1:0.0: Freeing device [ 1591.129916][T23569] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1591.198115][T23569] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1591.452489][ T5955] usb 7-1: USB disconnect, device number 66 [ 1592.676372][T23730] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4477'. [ 1592.685379][T23730] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4477'. [ 1592.775274][T23569] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1593.428870][T23569] 8021q: adding VLAN 0 to HW filter on device team0 [ 1593.541821][ T12] bridge0: port 1(bridge_slave_0) entered blocking state [ 1593.548972][ T12] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1593.559763][ T12] bridge0: port 2(bridge_slave_1) entered blocking state [ 1593.566897][ T12] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1593.580712][T23741] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4479'. [ 1593.589787][T23741] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4479'. [ 1595.052253][T23754] affs: No valid root block on device nullb0 [ 1596.535451][T23760] bridge0: port 2(bridge_slave_1) entered disabled state [ 1596.542857][T23760] bridge0: port 1(bridge_slave_0) entered disabled state [ 1597.596244][T23787] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4491'. [ 1597.613062][T23787] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4491'. [ 1597.641903][T23760] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1597.665026][T23760] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1597.941811][T17106] netdevsim netdevsim6 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1597.984745][T17106] netdevsim netdevsim6 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1598.017134][T17106] netdevsim netdevsim6 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1598.059174][T17106] netdevsim netdevsim6 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1598.427093][T23569] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1598.482808][T23796] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4494'. [ 1598.491864][T23796] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4494'. [ 1598.502335][T23796] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4494'. [ 1600.990833][T23569] veth0_vlan: entered promiscuous mode [ 1601.042452][T23569] veth1_vlan: entered promiscuous mode [ 1601.129535][T23569] veth0_macvtap: entered promiscuous mode [ 1601.152337][T23569] veth1_macvtap: entered promiscuous mode [ 1601.463027][T23569] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1601.506382][T23569] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1601.566229][T17106] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.205607][T17106] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.227629][T17106] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.246310][T17106] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1602.463576][ T30] audit: type=1400 audit(1764199531.320:1330): avc: denied { write } for pid=23834 comm="syz.1.4502" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1602.830671][T23847] bond0: entered promiscuous mode [ 1602.837280][T23847] bond_slave_0: entered promiscuous mode [ 1602.843133][T23847] bond_slave_1: entered promiscuous mode [ 1602.850739][T23847] batadv0: entered promiscuous mode [ 1602.873551][T23844] mkiss: ax0: crc mode is auto. [ 1602.883613][T17097] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1602.910821][T17097] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1602.923465][T23844] FAULT_INJECTION: forcing a failure. [ 1602.923465][T23844] name failslab, interval 1, probability 0, space 0, times 0 [ 1602.941849][T23844] CPU: 0 UID: 0 PID: 23844 Comm: syz.1.4504 Not tainted syzkaller #0 PREEMPT(full) [ 1602.941878][T23844] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1602.941888][T23844] Call Trace: [ 1602.941894][T23844] [ 1602.941902][T23844] dump_stack_lvl+0x16c/0x1f0 [ 1602.941922][T23844] should_fail_ex+0x512/0x640 [ 1602.941941][T23844] ? __kmalloc_noprof+0xca/0x880 [ 1602.941964][T23844] should_failslab+0xc2/0x120 [ 1602.941984][T23844] __kmalloc_noprof+0xdd/0x880 [ 1602.942007][T23844] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 1602.942031][T23844] ? genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 1602.942050][T23844] genl_family_rcv_msg_attrs_parse.constprop.0+0xc8/0x290 [ 1602.942073][T23844] genl_family_rcv_msg_doit+0xbf/0x2f0 [ 1602.942093][T23844] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1602.942124][T23844] ? bpf_lsm_capable+0x9/0x10 [ 1602.942142][T23844] ? security_capable+0x7e/0x260 [ 1602.942168][T23844] ? ns_capable+0xd7/0x110 [ 1602.942189][T23844] genl_rcv_msg+0x55c/0x800 [ 1602.942216][T23844] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1602.942236][T23844] ? __pfx_ovs_vport_cmd_del+0x10/0x10 [ 1602.942271][T23844] netlink_rcv_skb+0x158/0x420 [ 1602.942296][T23844] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1602.942315][T23844] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1602.942349][T23844] ? netlink_deliver_tap+0x1ae/0xd30 [ 1602.942375][T23844] genl_rcv+0x28/0x40 [ 1602.942389][T23844] netlink_unicast+0x5aa/0x870 [ 1602.942417][T23844] ? __pfx_netlink_unicast+0x10/0x10 [ 1602.942451][T23844] netlink_sendmsg+0x8c8/0xdd0 [ 1602.942480][T23844] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1602.942515][T23844] ____sys_sendmsg+0xa98/0xc70 [ 1602.942534][T23844] ? copy_msghdr_from_user+0x10a/0x160 [ 1602.942557][T23844] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1602.942586][T23844] ___sys_sendmsg+0x134/0x1d0 [ 1602.942612][T23844] ? __pfx____sys_sendmsg+0x10/0x10 [ 1602.942631][T23844] ? __lock_acquire+0x622/0x1c90 [ 1602.942676][T23844] __sys_sendmsg+0x16d/0x220 [ 1602.942701][T23844] ? __pfx___sys_sendmsg+0x10/0x10 [ 1602.942739][T23844] do_syscall_64+0xcd/0xfa0 [ 1602.942760][T23844] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1602.942779][T23844] RIP: 0033:0x7f00c098f749 [ 1602.942794][T23844] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1602.942811][T23844] RSP: 002b:00007f00c177d038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1602.942829][T23844] RAX: ffffffffffffffda RBX: 00007f00c0be5fa0 RCX: 00007f00c098f749 [ 1602.942841][T23844] RDX: 000000000000c000 RSI: 0000200000000000 RDI: 0000000000000003 [ 1602.942850][T23844] RBP: 00007f00c177d090 R08: 0000000000000000 R09: 0000000000000000 [ 1602.942859][T23844] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1602.942869][T23844] R13: 00007f00c0be6038 R14: 00007f00c0be5fa0 R15: 00007fffc4c0ea38 [ 1602.942894][T23844] [ 1603.277011][T17106] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1603.299067][T17106] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1604.387520][T23878] netlink: 'syz.5.4511': attribute type 4 has an invalid length. [ 1605.450670][T23895] siw: device registration error -23 [ 1605.893319][T19694] usb 2-1: new high-speed USB device number 28 using dummy_hcd [ 1606.121239][T19694] usb 2-1: New USB device found, idVendor=0bda, idProduct=8150, bcdDevice= 0.00 [ 1606.635800][T19694] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1606.651034][T19694] usb 2-1: Product: syz [ 1606.655433][T19694] usb 2-1: Manufacturer: syz [ 1606.662340][T19694] usb 2-1: SerialNumber: syz [ 1607.463560][T23893] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1607.575032][T23893] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1607.697345][T19694] (unnamed net_device) (uninitialized): Assigned a random MAC address: 36:1b:89:1a:ad:90 [ 1607.724113][T19694] rtl8150 2-1:1.0: eth17: rtl8150 is detected [ 1607.740201][T19694] usb 2-1: USB disconnect, device number 28 [ 1607.904333][T23783] usb 7-1: new high-speed USB device number 67 using dummy_hcd [ 1607.914027][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.943190][ T30] audit: type=1400 audit(1764199536.484:1331): avc: denied { lock } for pid=23917 comm="syz.5.4524" path="socket:[100797]" dev="sockfs" ino=100797 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rawip_socket permissive=1 [ 1607.957721][T23921] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4524'. [ 1608.169941][T23783] usb 7-1: Using ep0 maxpacket: 32 [ 1608.176506][T23783] usb 7-1: config 0 has an invalid interface number: 184 but max is 0 [ 1608.185908][T23783] usb 7-1: config 0 has no interface number 0 [ 1608.215185][T23783] usb 7-1: config 0 interface 184 has no altsetting 0 [ 1608.224481][T23783] usb 7-1: New USB device found, idVendor=0424, idProduct=7500, bcdDevice=69.ee [ 1608.233697][T23783] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1608.268729][T23783] usb 7-1: Product: syz [ 1608.272894][T23783] usb 7-1: Manufacturer: syz [ 1608.287498][T23783] usb 7-1: SerialNumber: syz [ 1608.299501][T23783] usb 7-1: config 0 descriptor?? [ 1608.342167][T23783] smsc75xx v1.0.0 [ 1609.218701][T23783] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000040: -32 [ 1609.219518][T23933] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1609.270734][T23933] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1609.279076][T23783] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1609.403322][T23933] bridge0: port 3(gretap0) entered blocking state [ 1609.410441][T23933] bridge0: port 3(gretap0) entered disabled state [ 1609.417176][T23933] gretap0: entered allmulticast mode [ 1609.423534][T23933] gretap0: entered promiscuous mode [ 1609.428970][T23933] bridge0: port 3(gretap0) entered blocking state [ 1609.435429][T23933] bridge0: port 3(gretap0) entered forwarding state [ 1609.514060][T23939] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1609.861559][T23783] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000014: -61 [ 1609.939717][T23783] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): Failed to read PMT_CTL: -61 [ 1609.954506][T23783] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): device not ready in smsc75xx_reset [ 1609.966395][T23783] smsc75xx 7-1:0.184 (unnamed net_device) (uninitialized): smsc75xx_reset error -61 [ 1609.977926][T23783] smsc75xx 7-1:0.184: probe with driver smsc75xx failed with error -61 [ 1611.220890][T23961] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4535'. [ 1611.358896][T23789] usb 7-1: USB disconnect, device number 67 [ 1611.541453][T23967] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1611.564806][T23967] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1611.804855][T19694] usb 2-1: new high-speed USB device number 29 using dummy_hcd [ 1612.039965][T19694] usb 2-1: Using ep0 maxpacket: 32 [ 1612.053636][T19694] usb 2-1: New USB device found, idVendor=041e, idProduct=403c, bcdDevice=cc.d7 [ 1612.063492][T19694] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1612.082191][T19694] usb 2-1: config 0 descriptor?? [ 1612.088979][T23979] syzkaller1: entered promiscuous mode [ 1612.097364][T19694] gspca_main: sq930x-2.14.0 probing 041e:403c [ 1612.102296][T23979] syzkaller1: entered allmulticast mode [ 1612.235769][T23992] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1612.250572][T23992] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1612.274276][T23994] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4549'. [ 1612.441880][T23783] usb 7-1: new high-speed USB device number 68 using dummy_hcd [ 1612.478310][T23789] usb 6-1: new high-speed USB device number 111 using dummy_hcd [ 1612.569539][T23998] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4550'. [ 1612.640331][T23789] usb 6-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1612.651093][T23789] usb 6-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1612.663428][T23789] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1612.683899][T23789] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1612.745551][T23783] usb 7-1: Using ep0 maxpacket: 16 [ 1612.752481][T23783] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 1612.758103][T24000] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1612.760969][T23783] usb 7-1: config 0 has no interface number 0 [ 1612.776823][T23783] usb 7-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1612.786404][T23783] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1612.794637][T23783] usb 7-1: Product: syz [ 1612.798967][T23783] usb 7-1: Manufacturer: syz [ 1612.803642][T23783] usb 7-1: SerialNumber: syz [ 1612.813328][T23783] usb 7-1: config 0 descriptor?? [ 1612.822540][T23783] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1613.270203][ T5927] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1613.519927][T19694] gspca_sq930x: ucbus_write failed -71 [ 1613.526025][T19694] sq930x 2-1:0.0: probe with driver sq930x failed with error -71 [ 1613.535876][T19694] usb 2-1: USB disconnect, device number 29 [ 1613.718446][ T5927] usb 3-1: Using ep0 maxpacket: 32 [ 1613.752802][ T5927] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 1613.761232][ T5927] usb 3-1: config 0 has no interface number 0 [ 1613.844399][T23789] gspca_stv0680: usb_control_msg error 0, request = 0x88, error = -32 [ 1613.878664][T23789] stv0680 6-1:4.0: STV(e): camera ping failed!! [ 1613.896569][T23789] stv0680 6-1:4.0: last error: 0, command = 0x0 [ 1613.972430][ T5927] usb 3-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1613.996822][ T5927] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1614.018556][ T5927] usb 3-1: Product: syz [ 1614.035101][ T5927] usb 3-1: Manufacturer: syz [ 1614.069492][ T5927] usb 3-1: SerialNumber: syz [ 1614.083783][ T5927] usb 3-1: config 0 descriptor?? [ 1614.127221][ T5927] smsc95xx v2.0.0 [ 1614.127411][T19694] usb 6-1: USB disconnect, device number 111 [ 1614.569993][T24032] xt_SECMARK: only valid in 'mangle' or 'security' table, not 'raw' [ 1614.616952][T23783] gspca_spca1528: reg_w err -110 [ 1614.970653][T23783] spca1528 7-1:0.1: probe with driver spca1528 failed with error -110 [ 1615.397067][T23790] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1615.578863][T23790] usb 6-1: Using ep0 maxpacket: 16 [ 1615.624856][T23790] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1615.675907][T23790] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1615.725974][T23790] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1615.736645][T23790] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.745341][T23790] usb 6-1: Product: syz [ 1615.750261][T23790] usb 6-1: Manufacturer: syz [ 1615.755150][T23790] usb 6-1: SerialNumber: syz [ 1616.755489][T24053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1616.765076][ T30] audit: type=1400 audit(1764199544.724:1332): avc: denied { append } for pid=24050 comm="syz.8.4566" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1616.893956][T24053] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1616.908010][T23790] usb 6-1: config 0 descriptor?? [ 1616.950057][T23790] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1616.971011][T23790] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1616.975117][T19694] usb 7-1: USB disconnect, device number 68 [ 1617.441824][T24039] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1617.450561][T24039] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1617.477430][ T5927] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -71 [ 1617.488668][ T5927] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1617.498277][ T5927] smsc95xx 3-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1617.513941][ T5927] smsc95xx 3-1:0.67: probe with driver smsc95xx failed with error -71 [ 1617.539041][ T5927] usb 3-1: USB disconnect, device number 26 [ 1617.788392][T24039] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1617.829785][T24039] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1617.884062][T23790] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1617.907661][T23790] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1617.930572][T23790] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 1617.937631][T23790] em28xx 6-1:0.0: No AC97 audio processor [ 1617.989237][T23790] usb 6-1: USB disconnect, device number 112 [ 1618.019954][T23790] em28xx 6-1:0.0: Disconnecting em28xx [ 1618.042688][T23790] em28xx 6-1:0.0: Freeing device [ 1618.283812][T24064] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4569'. [ 1618.657504][T24073] bridge0: port 2(bridge_slave_1) entered disabled state [ 1618.664904][T24073] bridge0: port 1(bridge_slave_0) entered disabled state [ 1620.578358][T24089] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4576'. [ 1620.836236][T24092] SELinux: Context system_u:object_r:hwdata_t:s0 is not valid (left unmapped). [ 1620.850280][ T30] audit: type=1400 audit(1764199548.560:1333): avc: denied { relabelto } for pid=24091 comm="syz.8.4578" name="12" dev="tmpfs" ino=75 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 trawcon="system_u:object_r:hwdata_t:s0" [ 1620.875997][ C0] vkms_vblank_simulate: vblank timer overrun [ 1620.899617][ T30] audit: type=1400 audit(1764199548.560:1334): avc: denied { associate } for pid=24091 comm="syz.8.4578" name="12" dev="tmpfs" ino=75 scontext=system_u:object_r:unlabeled_t tcontext=system_u:object_r:tmpfs_t tclass=filesystem permissive=1 srawcon="system_u:object_r:hwdata_t:s0" [ 1620.926229][ C0] vkms_vblank_simulate: vblank timer overrun [ 1621.712943][T24106] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1622.062976][T24117] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4584'. [ 1622.075778][T24117] openvswitch: netlink: Flow key attr not present in new flow. [ 1623.393512][T23790] usb 2-1: new high-speed USB device number 30 using dummy_hcd [ 1623.819458][T23790] usb 2-1: config index 0 descriptor too short (expected 45, got 36) [ 1623.835605][T23790] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1623.881853][T23790] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1623.918842][T23790] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1623.973375][T23790] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1624.011951][T23790] usb 2-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1624.050474][T23790] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1624.091257][T23790] usb 2-1: config 0 descriptor?? [ 1624.115042][T24130] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1624.446904][T24140] siw: device registration error -23 [ 1624.795341][T23790] plantronics 0003:047F:FFFF.0027: reserved main item tag 0xd [ 1624.807865][T23790] plantronics 0003:047F:FFFF.0027: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.1-1/input0 [ 1625.276029][T24150] siw: device registration error -23 [ 1625.713001][T24153] FAULT_INJECTION: forcing a failure. [ 1625.713001][T24153] name failslab, interval 1, probability 0, space 0, times 0 [ 1625.730394][T24153] CPU: 1 UID: 0 PID: 24153 Comm: syz.5.4593 Not tainted syzkaller #0 PREEMPT(full) [ 1625.730420][T24153] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1625.730431][T24153] Call Trace: [ 1625.730436][T24153] [ 1625.730442][T24153] dump_stack_lvl+0x16c/0x1f0 [ 1625.730464][T24153] should_fail_ex+0x512/0x640 [ 1625.730482][T24153] ? fs_reclaim_acquire+0xae/0x150 [ 1625.730500][T24153] should_failslab+0xc2/0x120 [ 1625.730516][T24153] __kmalloc_noprof+0xdd/0x880 [ 1625.730536][T24153] ? tomoyo_encode2+0x100/0x3e0 [ 1625.730554][T24153] ? tomoyo_encode2+0x100/0x3e0 [ 1625.730567][T24153] tomoyo_encode2+0x100/0x3e0 [ 1625.730584][T24153] tomoyo_encode+0x29/0x50 [ 1625.730600][T24153] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1625.730623][T24153] tomoyo_path_number_perm+0x245/0x580 [ 1625.730636][T24153] ? tomoyo_path_number_perm+0x237/0x580 [ 1625.730651][T24153] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1625.730666][T24153] ? find_held_lock+0x2b/0x80 [ 1625.730703][T24153] ? find_held_lock+0x2b/0x80 [ 1625.730719][T24153] ? hook_file_ioctl_common+0x145/0x410 [ 1625.730743][T24153] ? __fget_files+0x20e/0x3c0 [ 1625.730761][T24153] security_file_ioctl+0x9b/0x240 [ 1625.730779][T24153] __x64_sys_ioctl+0xb7/0x210 [ 1625.730800][T24153] do_syscall_64+0xcd/0xfa0 [ 1625.730815][T24153] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1625.730829][T24153] RIP: 0033:0x7fa442b8f749 [ 1625.730842][T24153] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1625.730855][T24153] RSP: 002b:00007fa4439f8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1625.730871][T24153] RAX: ffffffffffffffda RBX: 00007fa442de5fa0 RCX: 00007fa442b8f749 [ 1625.730880][T24153] RDX: 00002000000010c0 RSI: 0000000000003ba0 RDI: 0000000000000003 [ 1625.730889][T24153] RBP: 00007fa4439f8090 R08: 0000000000000000 R09: 0000000000000000 [ 1625.730898][T24153] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1625.730906][T24153] R13: 00007fa442de6038 R14: 00007fa442de5fa0 R15: 00007ffdb569bd98 [ 1625.730928][T24153] [ 1625.730941][T24153] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1625.960485][ T10] usb 2-1: USB disconnect, device number 30 [ 1626.161984][T24157] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4595'. [ 1626.217869][T24157] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4595'. [ 1626.231690][T24157] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4595'. [ 1626.248400][T24157] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4595'. [ 1626.801118][T24177] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4600'. [ 1627.262820][T24175] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4601'. [ 1627.314617][T23790] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1627.487952][T23790] usb 6-1: Using ep0 maxpacket: 32 [ 1627.527384][T23790] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 1627.547504][T23790] usb 6-1: config 0 has no interface number 0 [ 1627.852592][T23790] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1627.862007][T23790] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1627.870192][T23790] usb 6-1: Product: syz [ 1627.874595][T23790] usb 6-1: Manufacturer: syz [ 1627.879291][T23790] usb 6-1: SerialNumber: syz [ 1627.901699][T23790] usb 6-1: config 0 descriptor?? [ 1627.974623][T23790] smsc95xx v2.0.0 [ 1629.077584][T23790] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -61 [ 1629.089286][T23790] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1629.755279][T23790] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000108: -71 [ 1629.786732][T23790] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 1630.250827][T23790] usb 6-1: USB disconnect, device number 113 [ 1630.314395][T24212] netlink: 32 bytes leftover after parsing attributes in process `syz.8.4613'. [ 1630.353482][T19694] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1630.372652][T24214] netlink: 156 bytes leftover after parsing attributes in process `syz.8.4614'. [ 1630.535585][T19694] usb 3-1: Using ep0 maxpacket: 32 [ 1630.665405][T19694] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1630.831994][T19694] usb 3-1: New USB device found, idVendor=9022, idProduct=d662, bcdDevice=b3.0e [ 1630.874832][T19694] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1630.902530][T24226] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4617'. [ 1630.911629][T24226] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4617'. [ 1630.941194][T19694] usb 3-1: config 0 descriptor?? [ 1631.259472][ T10] IPVS: starting estimator thread 0... [ 1631.282517][T19694] dvb-usb: found a 'TeVii S662' in warm state. [ 1631.295249][T24230] mac80211_hwsim hwsim54 wlan1: entered allmulticast mode [ 1631.302718][T19694] dw2102: su3000_power_ctrl: 1, initialized 0 [ 1631.313288][T19694] dvb-usb: bulk message failed: -22 (2/0) [ 1631.325631][T24230] netlink: 'syz.5.4619': attribute type 10 has an invalid length. [ 1631.344734][T19694] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1631.354129][T24230] mac80211_hwsim hwsim54 wlan1: left allmulticast mode [ 1631.362295][T24233] IPVS: using max 42 ests per chain, 100800 per kthread [ 1631.376618][T19694] dvbdev: DVB: registering new adapter (TeVii S662) [ 1631.387371][T19694] usb 3-1: media controller created [ 1631.394497][T19694] dvb-usb: bulk message failed: -22 (6/0) [ 1631.400357][T19694] dw2102: i2c transfer failed. [ 1631.405469][T19694] dvb-usb: bulk message failed: -22 (6/0) [ 1631.411826][T19694] dw2102: i2c transfer failed. [ 1631.416687][T19694] dvb-usb: bulk message failed: -22 (6/0) [ 1631.423449][T19694] dw2102: i2c transfer failed. [ 1631.428228][T19694] dvb-usb: bulk message failed: -22 (6/0) [ 1631.434427][T19694] dw2102: i2c transfer failed. [ 1631.439465][T19694] dvb-usb: bulk message failed: -22 (6/0) [ 1631.445659][T19694] dw2102: i2c transfer failed. [ 1631.450487][T19694] dvb-usb: bulk message failed: -22 (6/0) [ 1631.456613][T19694] dw2102: i2c transfer failed. [ 1631.461404][T19694] dvb-usb: MAC address: 02:02:02:02:02:02 [ 1631.480990][T19694] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1631.517805][T19694] dvb-usb: bulk message failed: -22 (3/0) [ 1631.523799][T19694] dw2102: command 0x0e transfer failed. [ 1631.537135][T19694] dvb-usb: bulk message failed: -22 (3/0) [ 1631.544069][T19694] dw2102: command 0x0e transfer failed. [ 1631.762808][T24243] __nla_validate_parse: 1 callbacks suppressed [ 1631.762821][T24243] netlink: 40 bytes leftover after parsing attributes in process `syz.1.4624'. [ 1631.778782][T24243] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1631.786024][T24243] IPv6: NLM_F_CREATE should be set when creating new route [ 1631.793280][T24243] IPv6: NLM_F_CREATE should be set when creating new route [ 1631.837044][T24208] A link change request failed with some changes committed already. Interface bond0 may have been left with an inconsistent configuration, please check. [ 1632.059602][T19694] dvb-usb: bulk message failed: -22 (3/0) [ 1632.089473][T19694] dw2102: command 0x0e transfer failed. [ 1632.106237][T19694] dvb-usb: bulk message failed: -22 (3/0) [ 1632.111971][T19694] dw2102: command 0x0e transfer failed. [ 1632.117585][T19694] dvb-usb: bulk message failed: -22 (1/0) [ 1632.123324][T19694] dw2102: command 0x51 transfer failed. [ 1632.131695][T19694] dvb-usb: bulk message failed: -22 (5/0) [ 1632.263594][T19694] dw2102: i2c probe for address 0x68 failed. [ 1632.277225][T19694] dvb-usb: bulk message failed: -22 (5/0) [ 1632.322780][T19694] dw2102: i2c probe for address 0x69 failed. [ 1632.338055][T19694] dvb-usb: bulk message failed: -22 (5/0) [ 1632.348558][T19694] dw2102: i2c probe for address 0x6a failed. [ 1632.461519][T19694] dw2102: probing for demodulator failed. Is the external power switched on? [ 1632.501910][T23789] usb 2-1: new high-speed USB device number 31 using dummy_hcd [ 1632.523527][T24208] dvb-usb: bulk message failed: -22 (6/0) [ 1632.537066][T19694] dvb-usb: no frontend was attached by 'TeVii S662' [ 1632.608649][T19694] rc_core: IR keymap rc-tt-1500 not found [ 1632.616226][T19694] Registered IR keymap rc-empty [ 1632.629631][T19694] rc rc0: TeVii S662 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 1632.651545][T24208] dw2102: i2c transfer failed. [ 1632.677032][T19694] input: TeVii S662 as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input102 [ 1632.726634][T19694] dvb-usb: schedule remote query interval to 250 msecs. [ 1632.741931][T19694] dw2102: su3000_power_ctrl: 0, initialized 1 [ 1632.748638][T19694] dvb-usb: TeVii S662 successfully initialized and connected. [ 1632.750877][T23789] usb 2-1: Using ep0 maxpacket: 16 [ 1632.760316][T19694] usb 3-1: USB disconnect, device number 27 [ 1632.777206][T24263] A link change request failed with some changes committed already. Interface netdevsim0 may have been left with an inconsistent configuration, please check. [ 1632.804473][T23789] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1632.839764][T23789] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1632.849243][T19694] dvb-usb: TeVii S662 successfully deinitialized and disconnected. [ 1632.917340][T23789] usb 2-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1632.928607][T23789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1633.008773][T23789] usb 2-1: Product: syz [ 1633.051150][T23789] usb 2-1: Manufacturer: syz [ 1633.080928][T23789] usb 2-1: SerialNumber: syz [ 1633.160402][T23789] usb 2-1: config 0 descriptor?? [ 1633.241170][T23789] em28xx 2-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1633.271375][T23789] em28xx 2-1:0.0: Audio interface 0 found (Vendor Class) [ 1633.402833][T24268] FAULT_INJECTION: forcing a failure. [ 1633.402833][T24268] name failslab, interval 1, probability 0, space 0, times 0 [ 1633.415639][T24268] CPU: 0 UID: 0 PID: 24268 Comm: syz.6.4631 Not tainted syzkaller #0 PREEMPT(full) [ 1633.415658][T24268] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1633.415665][T24268] Call Trace: [ 1633.415669][T24268] [ 1633.415674][T24268] dump_stack_lvl+0x16c/0x1f0 [ 1633.415691][T24268] should_fail_ex+0x512/0x640 [ 1633.415708][T24268] ? fs_reclaim_acquire+0xae/0x150 [ 1633.415740][T24268] should_failslab+0xc2/0x120 [ 1633.415761][T24268] __kmalloc_noprof+0xdd/0x880 [ 1633.415784][T24268] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1633.415802][T24268] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1633.415814][T24268] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1633.415828][T24268] ? tomoyo_profile+0x47/0x60 [ 1633.415844][T24268] tomoyo_path_number_perm+0x245/0x580 [ 1633.415860][T24268] ? tomoyo_path_number_perm+0x237/0x580 [ 1633.415879][T24268] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1633.415896][T24268] ? find_held_lock+0x2b/0x80 [ 1633.415935][T24268] ? find_held_lock+0x2b/0x80 [ 1633.415948][T24268] ? hook_file_ioctl_common+0x145/0x410 [ 1633.415969][T24268] ? __fget_files+0x20e/0x3c0 [ 1633.415983][T24268] security_file_ioctl+0x9b/0x240 [ 1633.416002][T24268] __x64_sys_ioctl+0xb7/0x210 [ 1633.416029][T24268] do_syscall_64+0xcd/0xfa0 [ 1633.416047][T24268] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1633.416068][T24268] RIP: 0033:0x7ff13878f749 [ 1633.416079][T24268] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1633.416090][T24268] RSP: 002b:00007ff139659038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1633.416102][T24268] RAX: ffffffffffffffda RBX: 00007ff1389e5fa0 RCX: 00007ff13878f749 [ 1633.416109][T24268] RDX: 0000000000000000 RSI: 00000000800448d4 RDI: 0000000000000005 [ 1633.416115][T24268] RBP: 00007ff139659090 R08: 0000000000000000 R09: 0000000000000000 [ 1633.416121][T24268] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1633.416127][T24268] R13: 00007ff1389e6038 R14: 00007ff1389e5fa0 R15: 00007ffe1ab52408 [ 1633.416147][T24268] [ 1633.416165][T24268] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1633.467564][T24269] gfs2: error -5 reading superblock [ 1634.512291][T23789] em28xx 2-1:0.0: unknown em28xx chip ID (117) [ 1634.576810][T24276] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1634.585829][T24276] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1634.640347][T24284] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1634.749904][T23789] em28xx 2-1:0.0: Config register raw data: 0xfffffffb [ 1634.777726][T23789] em28xx 2-1:0.0: AC97 chip type couldn't be determined [ 1634.798940][T23789] em28xx 2-1:0.0: No AC97 audio processor [ 1634.856950][T23789] usb 2-1: USB disconnect, device number 31 [ 1634.870825][T23789] em28xx 2-1:0.0: Disconnecting em28xx [ 1634.900803][T23789] em28xx 2-1:0.0: Freeing device [ 1635.570159][T24296] bond0: option ad_user_port_key: mode dependency failed, not supported in mode balance-rr(0) [ 1635.633721][T24302] netlink: 68 bytes leftover after parsing attributes in process `syz.1.4640'. [ 1636.000756][T24321] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4646'. [ 1636.129897][T24326] fuse: Bad value for 'user_id' [ 1636.134909][ T30] audit: type=1400 audit(1764199562.852:1335): avc: denied { mounton } for pid=24315 comm="syz.6.4644" path="/69/file0" dev="tmpfs" ino=381 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1636.159094][T24326] fuse: Bad value for 'user_id' [ 1636.303803][T24327] lo speed is unknown, defaulting to 1000 [ 1636.563645][T24328] lo speed is unknown, defaulting to 1000 [ 1637.884550][T24354] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4654'. [ 1637.922015][T19694] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1637.935423][T24356] batadv_slave_0: entered promiscuous mode [ 1637.941841][T24356] batadv_slave_0: left promiscuous mode [ 1638.105822][T19694] usb 3-1: Using ep0 maxpacket: 16 [ 1639.008032][T19694] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1639.032527][T19694] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1639.046841][T24370] SET target dimension over the limit! [ 1639.112153][T19694] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1639.130119][T19694] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1639.142144][T19694] usb 3-1: Product: syz [ 1639.146329][T19694] usb 3-1: Manufacturer: syz [ 1639.162217][T19694] usb 3-1: SerialNumber: syz [ 1639.179835][T19694] usb 3-1: config 0 descriptor?? [ 1639.253433][T24371] overlayfs: failed to resolve 'lowerdir=./file0': -2 [ 1639.271929][T24371] overlay: Bad value for 'uuid' [ 1639.275278][T19694] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1639.293897][T24373] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4662'. [ 1639.303539][T19694] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 1639.331622][T24373] lo speed is unknown, defaulting to 1000 [ 1639.425226][T24380] delete_channel: no stack [ 1639.726966][T24385] netlink: 'syz.1.4666': attribute type 4 has an invalid length. [ 1640.458029][T19694] em28xx 3-1:0.0: chip ID is em28178 [ 1641.284648][T23789] usb 3-1: USB disconnect, device number 28 [ 1641.299784][T23789] em28xx 3-1:0.0: Disconnecting em28xx [ 1641.315768][T23789] em28xx 3-1:0.0: Freeing device [ 1641.767510][T24430] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4675'. [ 1642.779826][T24444] mac80211_hwsim hwsim66 wlan1: entered allmulticast mode [ 1642.933880][T24443] netlink: 'syz.1.4680': attribute type 10 has an invalid length. [ 1642.949732][T24443] mac80211_hwsim hwsim66 wlan1: left allmulticast mode [ 1643.014478][T24446] random: crng reseeded on system resumption [ 1643.026459][T24446] Restarting kernel threads ... [ 1643.031701][T24446] Done restarting kernel threads. [ 1643.038898][T24446] netlink: 'syz.2.4681': attribute type 10 has an invalid length. [ 1643.557641][T19694] usb 7-1: new high-speed USB device number 69 using dummy_hcd [ 1643.888806][T24459] netlink: 84 bytes leftover after parsing attributes in process `syz.5.4684'. [ 1643.922977][T19694] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1643.948441][T19694] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1643.969880][T19694] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1643.999778][T24469] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1644.142923][T24473] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4689'. [ 1644.152153][T24473] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4689'. [ 1644.216268][T24474] overlayfs: workdir and upperdir must be separate subtrees [ 1644.217726][T19694] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1644.247511][T24472] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4689'. [ 1644.356205][T24453] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1644.414854][T19694] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1644.535871][T24481] No control pipe specified [ 1644.827756][T19694] usb 7-1: USB disconnect, device number 69 [ 1645.404038][T24502] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4695'. [ 1645.506655][T24506] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4698'. [ 1645.596851][T24509] ip6erspan0: entered promiscuous mode [ 1645.661206][T24507] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4691'. [ 1645.897087][T23013] usb 6-1: new full-speed USB device number 114 using dummy_hcd [ 1646.095472][T23013] usb 6-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1646.111096][T23013] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1646.143268][T23013] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1646.155161][T23013] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1646.166226][T23013] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1646.193131][T24511] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1646.925666][T24528] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1647.348789][T24530] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1647.403696][T24530] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1647.580894][T23013] aiptek 6-1:17.0: Aiptek using 400 ms programming speed [ 1647.674576][T23013] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:17.0/input/input103 [ 1647.717829][T23013] usb 6-1: USB disconnect, device number 114 [ 1647.717860][ C1] aiptek 6-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1648.287140][T24545] tipc: Started in network mode [ 1648.302900][T24545] tipc: Node identity 2a, cluster identity 4711 [ 1648.323902][T24545] tipc: Node number set to 42 [ 1648.551831][T24535] netlink: 'syz.1.4706': attribute type 11 has an invalid length. [ 1648.895187][T24563] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4716'. [ 1648.905911][T24563] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 1648.912182][T19694] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1649.083306][T19694] usb 6-1: Using ep0 maxpacket: 8 [ 1649.161197][T19694] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1649.419780][T19694] usb 6-1: config 179 has no interface number 0 [ 1649.432596][T19694] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1649.455917][T19694] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1649.481831][T19694] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1649.504668][T19694] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1649.516279][T19694] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1649.529701][T19694] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1649.553362][T19694] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1649.590528][T24552] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1649.784191][ T30] audit: type=1400 audit(1764199575.621:1336): avc: denied { mounton } for pid=24572 comm="syz.2.4718" path="/136/file0" dev="tmpfs" ino=720 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=fifo_file permissive=1 [ 1650.045972][T19694] usb 2-1: new high-speed USB device number 32 using dummy_hcd [ 1650.065651][T24589] gfs2: error -5 reading superblock [ 1650.409838][T19694] usb 2-1: Using ep0 maxpacket: 32 [ 1650.424321][T19694] usb 2-1: config 0 has an invalid interface number: 67 but max is 0 [ 1650.776251][T19694] usb 2-1: config 0 has no interface number 0 [ 1650.786460][T19694] usb 2-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 1650.796243][T19694] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1650.804329][T19694] usb 2-1: Product: syz [ 1650.808725][T19694] usb 2-1: Manufacturer: syz [ 1650.813337][T19694] usb 2-1: SerialNumber: syz [ 1650.825101][T19694] usb 2-1: config 0 descriptor?? [ 1650.835184][T19694] smsc95xx v2.0.0 [ 1651.679167][ T5899] usb 6-1: USB disconnect, device number 115 [ 1651.679199][ C0] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1651.693458][ C0] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1651.747501][T19694] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 1651.766925][T19694] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 1651.787644][ T10] usb 7-1: new high-speed USB device number 70 using dummy_hcd [ 1651.795569][T19694] smsc95xx 2-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000014: -71 [ 1651.809465][T19694] smsc95xx 2-1:0.67: probe with driver smsc95xx failed with error -71 [ 1651.824137][T19694] usb 2-1: USB disconnect, device number 32 [ 1651.949276][ T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x6 has invalid maxpacket 1023 [ 1651.959981][ T10] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBA, changing to 0x8A [ 1651.974046][ T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8A has invalid maxpacket 121 [ 1651.986098][ T10] usb 7-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 1651.995341][ T10] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1652.004041][ T10] usb 7-1: Product: syz [ 1652.008198][ T10] usb 7-1: Manufacturer: syz [ 1652.012831][ T10] usb 7-1: SerialNumber: syz [ 1652.018781][ T10] usb 7-1: config 0 descriptor?? [ 1652.024326][T24611] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 1652.031494][T24611] raw-gadget.3 gadget.6: fail, usb_ep_enable returned -22 [ 1652.040139][ T10] usb 7-1: ucan: probing device on interface #0 [ 1652.261462][ T10] usb 7-1: ucan: device protocol version 590312707 is not supported [ 1652.269689][ T10] usb 7-1: ucan: probe failed; try to update the device firmware [ 1652.352857][T24626] snd_dummy snd_dummy.0: control 0:0:0:syz0:0 is already present [ 1652.768095][T24641] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4742'. [ 1652.777213][T24641] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4742'. [ 1653.902555][T24652] batadv_slave_0: entered promiscuous mode [ 1653.909865][T24652] batadv_slave_0: left promiscuous mode [ 1653.917081][T24655] netlink: 'syz.2.4746': attribute type 21 has an invalid length. [ 1653.932239][T17096] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 1653.942617][T17096] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 1653.952405][T17096] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 1653.978951][T17096] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 1654.182717][ T10] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1654.733266][T23783] usb 7-1: USB disconnect, device number 70 [ 1655.123145][ T5899] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1655.165933][ T10] usb 6-1: Using ep0 maxpacket: 32 [ 1655.178719][T24674] netlink: 'syz.6.4754': attribute type 21 has an invalid length. [ 1655.179663][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1655.197782][T24674] netlink: 128 bytes leftover after parsing attributes in process `syz.6.4754'. [ 1655.206894][T24674] netlink: 'syz.6.4754': attribute type 6 has an invalid length. [ 1655.214630][T24674] netlink: 3 bytes leftover after parsing attributes in process `syz.6.4754'. [ 1655.340022][T24673] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4755'. [ 1655.349867][ T10] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1655.375449][ T5899] usb 3-1: Using ep0 maxpacket: 16 [ 1655.381710][ T10] usb 6-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 1655.412363][ T10] usb 6-1: New USB device strings: Mfr=32, Product=0, SerialNumber=0 [ 1655.438326][ T10] usb 6-1: Manufacturer: syz [ 1655.449590][ T5899] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1655.466408][ T10] usb 6-1: config 0 descriptor?? [ 1655.477665][ T5899] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1655.509457][ T5899] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1655.536017][ T5899] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1655.546332][ T5899] usb 3-1: Product: syz [ 1655.551246][ T5899] usb 3-1: Manufacturer: syz [ 1655.556686][ T5899] usb 3-1: SerialNumber: syz [ 1655.571111][ T5899] usb 3-1: config 0 descriptor?? [ 1655.583132][ T5899] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1655.592706][ T5899] em28xx 3-1:0.0: Audio interface 0 found (Vendor Class) [ 1655.708205][T23789] usb 2-1: new full-speed USB device number 33 using dummy_hcd [ 1655.883412][T23789] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1655.893648][T23789] usb 2-1: New USB device found, idVendor=0e20, idProduct=0101, bcdDevice= 0.5a [ 1655.902703][T23789] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1655.913849][T23789] usb 2-1: config 0 descriptor?? [ 1655.922005][T23789] pegasus_notetaker 2-1:0.0: Invalid number of endpoints [ 1655.929389][T23789] pegasus_notetaker 2-1:0.0: probe with driver pegasus_notetaker failed with error -22 [ 1655.945736][ T10] ft260 0003:0403:6030.0028: unknown main item tag 0x7 [ 1656.074012][T24657] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1656.257414][T23789] usb 2-1: USB disconnect, device number 33 [ 1656.322181][T24653] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2565 sclass=netlink_route_socket pid=24653 comm=syz.5.4748 [ 1656.360985][T24653] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2574 sclass=netlink_route_socket pid=24653 comm=syz.5.4748 [ 1656.374062][T24653] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=2584 sclass=netlink_route_socket pid=24653 comm=syz.5.4748 [ 1656.426460][T24653] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1656.440038][T24653] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1656.453201][ T10] ft260 0003:0403:6030.0028: failed to retrieve chip version [ 1656.454814][T24688] netlink: 'syz.6.4760': attribute type 39 has an invalid length. [ 1656.464097][ T10] ft260 0003:0403:6030.0028: probe with driver ft260 failed with error -71 [ 1656.490207][ T10] usb 6-1: USB disconnect, device number 116 [ 1656.577527][ T5899] em28xx 3-1:0.0: unknown em28xx chip ID (117) [ 1656.804722][T24657] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1656.814870][T24657] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1656.823865][ T5899] em28xx 3-1:0.0: Config register raw data: 0xfffffffb [ 1656.831135][ T5899] em28xx 3-1:0.0: AC97 chip type couldn't be determined [ 1656.838467][ T5899] em28xx 3-1:0.0: No AC97 audio processor [ 1656.847783][ T5899] usb 3-1: USB disconnect, device number 29 [ 1656.855751][ T5899] em28xx 3-1:0.0: Disconnecting em28xx [ 1656.863583][ T5899] em28xx 3-1:0.0: Freeing device [ 1657.218487][T23789] usb 2-1: new full-speed USB device number 34 using dummy_hcd [ 1657.466191][T23789] usb 2-1: config 0 has an invalid interface number: 133 but max is 0 [ 1657.476810][T23789] usb 2-1: config 0 has no interface number 0 [ 1657.489987][T23789] usb 2-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1657.738302][T23789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1657.747709][T23789] usb 2-1: Product: syz [ 1657.751976][T23789] usb 2-1: Manufacturer: syz [ 1657.756896][T23789] usb 2-1: SerialNumber: syz [ 1657.766473][T23789] usb 2-1: config 0 descriptor?? [ 1658.200466][T23789] keyspan 2-1:0.133: Keyspan 1 port adapter converter detected [ 1658.210874][T23789] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 81 [ 1658.219471][T23789] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 1 [ 1658.229920][T23789] keyspan 2-1:0.133: found no endpoint descriptor for endpoint 2 [ 1658.241232][T23789] usb 2-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1658.396221][T24720] netlink: 4 bytes leftover after parsing attributes in process `syz.2.4770'. [ 1658.417254][T24720] bridge0: port 1(bridge_slave_0) entered disabled state [ 1658.476390][T24724] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4771'. [ 1658.519792][T24720] bridge_slave_0 (unregistering): left allmulticast mode [ 1658.527674][T24720] bridge_slave_0 (unregistering): left promiscuous mode [ 1658.535213][T24720] bridge0: port 1(bridge_slave_0) entered disabled state [ 1658.548550][T24724] gretap0: left allmulticast mode [ 1658.553728][T24724] gretap0: left promiscuous mode [ 1658.562355][T24724] bridge0: port 3(gretap0) entered disabled state [ 1658.572006][T24724] bridge_slave_1: left allmulticast mode [ 1658.577837][T24724] bridge_slave_1: left promiscuous mode [ 1658.583698][T24724] bridge0: port 2(bridge_slave_1) entered disabled state [ 1658.592916][T23789] usb 6-1: new full-speed USB device number 117 using dummy_hcd [ 1658.607321][T24724] bridge_slave_0: left allmulticast mode [ 1658.613110][T24724] bridge_slave_0: left promiscuous mode [ 1658.618797][T24724] bridge0: port 1(bridge_slave_0) entered disabled state [ 1658.659107][T24696] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1658.720430][T24728] netlink: 16 bytes leftover after parsing attributes in process `syz.6.4772'. [ 1658.745633][T24728] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4772'. [ 1658.784498][T23789] usb 6-1: config 0 has an invalid interface number: 46 but max is 0 [ 1659.081587][T24696] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1659.084204][T23789] usb 6-1: config 0 has no interface number 0 [ 1659.102043][T23013] usb 2-1: USB disconnect, device number 34 [ 1659.115249][T23013] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1659.838304][T23789] usb 6-1: config 0 interface 46 altsetting 0 endpoint 0x2 has invalid maxpacket 512, setting to 64 [ 1659.890877][T23013] keyspan 2-1:0.133: device disconnected [ 1659.918620][T23789] usb 6-1: New USB device found, idVendor=045a, idProduct=5210, bcdDevice= 1.01 [ 1659.954385][T23789] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1659.967608][T23789] usb 6-1: Product: syz [ 1659.971793][T23789] usb 6-1: Manufacturer: syz [ 1659.978256][T23789] usb 6-1: SerialNumber: syz [ 1659.986887][T23789] usb 6-1: config 0 descriptor?? [ 1659.993362][T24718] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1660.003538][T23789] ums-karma 6-1:0.46: USB Mass Storage device detected [ 1660.018271][T24739] A link change request failed with some changes committed already. Interface dummy0 may have been left with an inconsistent configuration, please check. [ 1660.075672][T23789] ums-karma 6-1:0.46: probe with driver ums-karma failed with error -5 [ 1660.180042][ T5899] usb 7-1: new high-speed USB device number 71 using dummy_hcd [ 1660.276085][T24718] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4769'. [ 1660.350960][ T5899] usb 7-1: Using ep0 maxpacket: 16 [ 1660.356605][T24746] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1660.373004][T24746] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1660.381002][ T5899] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1660.413224][ T5899] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1660.646950][ T5899] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1660.656553][ T5899] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1660.664955][ T5899] usb 7-1: Product: syz [ 1660.669184][ T5899] usb 7-1: Manufacturer: syz [ 1660.673939][ T5899] usb 7-1: SerialNumber: syz [ 1660.681136][ T5899] usb 7-1: config 0 descriptor?? [ 1660.700932][ T5899] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1660.739706][ T5899] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1661.136167][T24718] team0 (unregistering): Port device team_slave_0 removed [ 1661.144706][T24718] team0 (unregistering): Port device team_slave_1 removed [ 1661.153862][T24718] team0 (unregistering): Port device bond0 removed [ 1661.171756][T24757] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4779'. [ 1661.223888][T24737] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 1661.223951][ T5927] usb 6-1: USB disconnect, device number 117 [ 1661.448194][ T5899] em28xx 7-1:0.0: unknown em28xx chip ID (117) [ 1661.812338][T24737] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.824538][T24737] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1661.833350][ T5899] em28xx 7-1:0.0: Config register raw data: 0xfffffffb [ 1661.843602][ T5899] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 1661.851445][ T5899] em28xx 7-1:0.0: No AC97 audio processor [ 1661.872628][ T5899] usb 7-1: USB disconnect, device number 71 [ 1661.893540][ T5899] em28xx 7-1:0.0: Disconnecting em28xx [ 1661.906067][ T5899] em28xx 7-1:0.0: Freeing device [ 1661.962136][T24772] netlink: 388 bytes leftover after parsing attributes in process `syz.1.4781'. [ 1664.648475][T23783] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 1664.659167][T23789] usb 7-1: new full-speed USB device number 72 using dummy_hcd [ 1664.808803][T23783] usb 6-1: Using ep0 maxpacket: 32 [ 1664.808846][T23789] usb 7-1: device descriptor read/64, error -71 [ 1664.817366][T23783] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0080, bcdDevice=67.fe [ 1664.830062][T23783] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1664.838231][T23783] usb 6-1: Product: syz [ 1664.842583][T23783] usb 6-1: Manufacturer: syz [ 1664.847285][T23783] usb 6-1: SerialNumber: syz [ 1664.863277][T23783] usb 6-1: config 0 descriptor?? [ 1664.894490][ T5844] Bluetooth: hci3: command 0x0406 tx timeout [ 1665.086759][T23789] usb 7-1: new full-speed USB device number 73 using dummy_hcd [ 1665.112248][T23783] snd-usb-6fire 6-1:0.0: unable to receive device firmware state. [ 1665.126459][T23783] snd-usb-6fire 6-1:0.0: probe with driver snd-usb-6fire failed with error -71 [ 1665.147675][T23783] usb 6-1: USB disconnect, device number 118 [ 1665.172395][T24796] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4789'. [ 1665.185395][T24796] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4789'. [ 1665.247601][T23789] usb 7-1: device descriptor read/64, error -71 [ 1665.403506][T23789] usb usb7-port1: attempt power cycle [ 1666.200675][T24808] siw: device registration error -23 [ 1666.386765][T23789] usb 7-1: new full-speed USB device number 74 using dummy_hcd [ 1666.627696][T23789] usb 7-1: device descriptor read/8, error -71 [ 1666.844127][ T5927] usb 3-1: new full-speed USB device number 30 using dummy_hcd [ 1666.915656][T23789] usb 7-1: new full-speed USB device number 75 using dummy_hcd [ 1666.945723][T23789] usb 7-1: device descriptor read/8, error -71 [ 1667.045314][ T5927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1667.057317][ T5927] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1667.069511][T23789] usb usb7-port1: unable to enumerate USB device [ 1667.098405][ T5927] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 1667.201102][ T5927] usb 3-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 1667.216053][ T5927] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1667.276592][ T5927] usb 3-1: config 0 descriptor?? [ 1667.289022][T24820] netlink: 48 bytes leftover after parsing attributes in process `syz.6.4799'. [ 1667.828402][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1667.872760][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1667.932662][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1667.960456][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1667.972092][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1667.981439][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1668.010949][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1668.019531][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1668.029028][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1668.037749][ T5927] hid-multitouch 0003:0457:07DA.0029: unknown main item tag 0x0 [ 1668.149429][ T5927] hid-multitouch 0003:0457:07DA.0029: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.2-1/input0 [ 1668.449440][T24833] FAULT_INJECTION: forcing a failure. [ 1668.449440][T24833] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1668.462609][T24833] CPU: 1 UID: 0 PID: 24833 Comm: syz.6.4804 Not tainted syzkaller #0 PREEMPT(full) [ 1668.462632][T24833] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1668.462642][T24833] Call Trace: [ 1668.462649][T24833] [ 1668.462654][T24833] dump_stack_lvl+0x16c/0x1f0 [ 1668.462670][T24833] should_fail_ex+0x512/0x640 [ 1668.462686][T24833] _copy_from_user+0x2e/0xd0 [ 1668.462701][T24833] copy_msghdr_from_user+0x98/0x160 [ 1668.462717][T24833] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1668.462734][T24833] ? __lock_acquire+0x622/0x1c90 [ 1668.462747][T24833] ___sys_recvmsg+0xdb/0x1a0 [ 1668.462761][T24833] ? __pfx____sys_recvmsg+0x10/0x10 [ 1668.462791][T24833] __sys_recvmsg+0x16a/0x220 [ 1668.462806][T24833] ? __pfx___sys_recvmsg+0x10/0x10 [ 1668.462829][T24833] do_syscall_64+0xcd/0xfa0 [ 1668.462841][T24833] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1668.462852][T24833] RIP: 0033:0x7ff13878f749 [ 1668.462862][T24833] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1668.462873][T24833] RSP: 002b:00007ff139659038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1668.462884][T24833] RAX: ffffffffffffffda RBX: 00007ff1389e5fa0 RCX: 00007ff13878f749 [ 1668.462891][T24833] RDX: 0000000000000102 RSI: 00002000000008c0 RDI: 0000000000000004 [ 1668.462897][T24833] RBP: 00007ff139659090 R08: 0000000000000000 R09: 0000000000000000 [ 1668.462903][T24833] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1668.462909][T24833] R13: 00007ff1389e6038 R14: 00007ff1389e5fa0 R15: 00007ffe1ab52408 [ 1668.462923][T24833] [ 1668.664034][T24836] input: syz1 as /devices/virtual/input/input104 [ 1669.830811][T23790] usb 3-1: USB disconnect, device number 30 [ 1669.864670][T24848] siw: device registration error -23 [ 1670.088051][T24853] binder: BINDER_SET_CONTEXT_MGR already set [ 1670.094304][T24853] binder: 24852:24853 ioctl 4018620d 200000000040 returned -16 [ 1672.350219][T24874] gfs2: error -5 reading superblock [ 1672.384663][T24881] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4817'. [ 1672.854270][T24895] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(3) [ 1672.860910][T24895] vhci_hcd vhci_hcd.0: devid(0) speed(1) speed_str(low-speed) [ 1672.960600][T24895] vhci_hcd vhci_hcd.0: Device attached [ 1673.016825][T24897] vhci_hcd: connection closed [ 1673.211833][T23013] usb 35-1: new low-speed USB device number 2 using vhci_hcd [ 1673.511258][T24910] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4825'. [ 1673.525391][ T1295] ieee802154 phy1 wpan1: encryption failed: -22 [ 1674.034605][ T12] vhci_hcd: stop threads [ 1674.046075][ T12] vhci_hcd: release socket [ 1674.053742][ T12] vhci_hcd: disconnect device [ 1674.096907][T24914] netlink: 68 bytes leftover after parsing attributes in process `syz.5.4826'. [ 1674.164552][T24916] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4827'. [ 1674.421863][T24922] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4823'. [ 1675.526588][T24940] RDS: rds_bind could not find a transport for fe80::bb, load rds_tcp or rds_rdma? [ 1675.997443][T24949] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4836'. [ 1676.670147][ T30] audit: type=1400 audit(1764199600.774:1337): avc: denied { create } for pid=24966 comm="syz.8.4840" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=atmsvc_socket permissive=1 [ 1676.691130][ T30] audit: type=1400 audit(1764199600.774:1338): avc: denied { getopt } for pid=24966 comm="syz.8.4840" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1677.610209][T24978] overlayfs: failed to resolve './file1': -2 [ 1679.080846][T23013] vhci_hcd: vhci_device speed not set [ 1680.737869][T19694] usb 7-1: new high-speed USB device number 76 using dummy_hcd [ 1680.792892][T25009] netlink: 56 bytes leftover after parsing attributes in process `syz.1.4851'. [ 1680.965567][T19694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1681.037218][T19694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1681.070838][T19694] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1681.347573][T25018] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4853'. [ 1681.760540][T19694] usb 7-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1681.831897][T19694] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1681.867270][T19694] usb 7-1: config 0 descriptor?? [ 1681.969570][T19694] usb 7-1: can't set config #0, error -71 [ 1681.981804][T19694] usb 7-1: USB disconnect, device number 76 [ 1682.359801][T25029] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4856'. [ 1682.386346][T25029] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4856'. [ 1683.497803][T23789] usb 2-1: new high-speed USB device number 35 using dummy_hcd [ 1683.688478][T23789] usb 2-1: Using ep0 maxpacket: 32 [ 1683.957201][T23789] usb 2-1: unable to get BOS descriptor or descriptor too short [ 1683.972397][T25042] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4854'. [ 1683.981585][T25042] netlink: 12 bytes leftover after parsing attributes in process `syz.2.4854'. [ 1683.997852][T23789] usb 2-1: New USB device found, idVendor=2770, idProduct=905c, bcdDevice=8f.0e [ 1684.007789][T23789] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1684.017181][T23789] usb 2-1: Product: syz [ 1684.021563][T23789] usb 2-1: Manufacturer: syz [ 1684.026188][T23789] usb 2-1: SerialNumber: syz [ 1684.094666][ T10] usb 6-1: new full-speed USB device number 119 using dummy_hcd [ 1684.320239][T23789] gspca_main: sq905c-2.14.0 probing 2770:905c [ 1684.331549][ T10] usb 6-1: config 17 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1684.332965][T23789] gspca_sq905c: sq905c_command: usb_control_msg failed (-71) [ 1684.351509][T23789] sq905c 2-1:64.0: Get version command failed [ 1684.357632][T23789] sq905c 2-1:64.0: probe with driver sq905c failed with error -71 [ 1684.357873][ T10] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1684.379505][T23789] usb 2-1: USB disconnect, device number 35 [ 1684.394045][ T10] usb 6-1: config 17 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1684.406136][ T10] usb 6-1: New USB device found, idVendor=0458, idProduct=5003, bcdDevice= 0.00 [ 1684.415207][ T10] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1684.445597][T25043] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1684.573684][ T30] audit: type=1400 audit(1764199608.163:1339): avc: denied { add_name } for pid=25046 comm="syz.6.4861" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=dir permissive=1 [ 1684.607520][T25048] o2cb: This node has not been configured. [ 1684.614588][T25048] o2cb: Cluster check failed. Fix errors before retrying. [ 1684.623144][T25048] (syz.6.4861,25048,0):user_dlm_register:674 ERROR: status = -22 [ 1684.631608][T25048] (syz.6.4861,25048,0):dlmfs_mkdir:437 ERROR: Error -22 could not register domain "file1" [ 1684.643048][ T30] audit: type=1400 audit(1764199608.191:1340): avc: denied { create } for pid=25046 comm="syz.6.4861" name="file1" scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:unlabeled_t tclass=dir permissive=1 [ 1684.668866][ T30] audit: type=1400 audit(1764199608.191:1341): avc: denied { associate } for pid=25046 comm="syz.6.4861" name="file1" scontext=root:object_r:unlabeled_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1 [ 1685.040381][T25053] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4862'. [ 1685.422893][ T10] aiptek 6-1:17.0: Aiptek using 400 ms programming speed [ 1685.484852][T25072] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1685.699978][ T10] input: Aiptek as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:17.0/input/input105 [ 1685.797155][ T10] usb 6-1: USB disconnect, device number 119 [ 1685.803216][ C0] aiptek 6-1:17.0: aiptek_irq - usb_submit_urb failed with result -19 [ 1686.133137][T25083] netlink: 20 bytes leftover after parsing attributes in process `syz.1.4867'. [ 1686.318327][T19694] usb 7-1: new high-speed USB device number 77 using dummy_hcd [ 1686.467990][T19694] usb 7-1: device descriptor read/64, error -71 [ 1686.541585][T25085] batman_adv: batadv0: Adding interface: gretap1 [ 1686.547993][T25085] batman_adv: batadv0: Interface activated: gretap1 [ 1686.564420][ T30] audit: type=1400 audit(1764199609.997:1342): avc: denied { map } for pid=25084 comm="syz.8.4873" path="socket:[106088]" dev="sockfs" ino=106088 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 1686.776845][T19694] usb 7-1: new high-speed USB device number 78 using dummy_hcd [ 1686.917282][T19694] usb 7-1: device descriptor read/64, error -71 [ 1687.036293][T19694] usb usb7-port1: attempt power cycle [ 1687.631445][T19694] usb 7-1: new high-speed USB device number 79 using dummy_hcd [ 1687.666202][T19694] usb 7-1: device descriptor read/8, error -71 [ 1687.945678][T19694] usb 7-1: new high-speed USB device number 80 using dummy_hcd [ 1688.115346][T19694] usb 7-1: device descriptor read/8, error -71 [ 1688.254409][T19694] usb usb7-port1: unable to enumerate USB device [ 1688.260779][T25106] FAULT_INJECTION: forcing a failure. [ 1688.260779][T25106] name failslab, interval 1, probability 0, space 0, times 0 [ 1688.298710][T25106] CPU: 1 UID: 0 PID: 25106 Comm: syz.5.4880 Not tainted syzkaller #0 PREEMPT(full) [ 1688.298726][T25106] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1688.298736][T25106] Call Trace: [ 1688.298741][T25106] [ 1688.298747][T25106] dump_stack_lvl+0x16c/0x1f0 [ 1688.298764][T25106] should_fail_ex+0x512/0x640 [ 1688.298783][T25106] ? __kmalloc_noprof+0xca/0x880 [ 1688.298801][T25106] should_failslab+0xc2/0x120 [ 1688.298815][T25106] __kmalloc_noprof+0xdd/0x880 [ 1688.298830][T25106] ? iovec_from_user+0x108/0x140 [ 1688.298848][T25106] ? iovec_from_user+0x108/0x140 [ 1688.298862][T25106] iovec_from_user+0x108/0x140 [ 1688.298877][T25106] __import_iovec+0x88/0x650 [ 1688.298889][T25106] ? __might_fault+0xe3/0x190 [ 1688.298906][T25106] ? __might_fault+0x13b/0x190 [ 1688.298927][T25106] import_iovec+0x109/0x140 [ 1688.298942][T25106] copy_msghdr_from_user+0xf9/0x160 [ 1688.298959][T25106] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1688.298977][T25106] ? __lock_acquire+0x622/0x1c90 [ 1688.298990][T25106] ___sys_recvmsg+0xdb/0x1a0 [ 1688.299004][T25106] ? __pfx____sys_recvmsg+0x10/0x10 [ 1688.299030][T25106] __sys_recvmsg+0x16a/0x220 [ 1688.299045][T25106] ? __pfx___sys_recvmsg+0x10/0x10 [ 1688.299069][T25106] do_syscall_64+0xcd/0xfa0 [ 1688.299082][T25106] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1688.299094][T25106] RIP: 0033:0x7fa442b8f749 [ 1688.299104][T25106] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1688.299115][T25106] RSP: 002b:00007fa4439d7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002f [ 1688.299126][T25106] RAX: ffffffffffffffda RBX: 00007fa442de6090 RCX: 00007fa442b8f749 [ 1688.299133][T25106] RDX: 0000000000000102 RSI: 00002000000008c0 RDI: 0000000000000004 [ 1688.299139][T25106] RBP: 00007fa4439d7090 R08: 0000000000000000 R09: 0000000000000000 [ 1688.299146][T25106] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1688.299152][T25106] R13: 00007fa442de6128 R14: 00007fa442de6090 R15: 00007ffdb569bd98 [ 1688.299166][T25106] [ 1689.065981][T25121] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4884'. [ 1689.583167][T25135] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4883'. [ 1690.288162][ T5926] usb 7-1: new high-speed USB device number 81 using dummy_hcd [ 1690.420761][T25141] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4888'. [ 1690.907467][ T5926] usb 7-1: config 4 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.978758][ T5926] usb 7-1: New USB device found, idVendor=041e, idProduct=4007, bcdDevice=5d.18 [ 1690.993107][ T5926] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1691.162332][ T5926] gspca_main: stv0680-2.14.0 probing 041e:4007 [ 1692.553326][ T5926] stv0680 7-1:4.0: STV(e): camera ping failed!! [ 1693.065132][ T5926] gspca_stv0680: usb_control_msg error 0, request = 0x80, error = -71 [ 1693.083704][ T5926] stv0680 7-1:4.0: last error: 190, command = 0xde [ 1693.153111][ T5926] usb 7-1: USB disconnect, device number 81 [ 1693.198671][T25169] netlink: 56 bytes leftover after parsing attributes in process `syz.6.4897'. [ 1694.263454][T25154] netlink: 20 bytes leftover after parsing attributes in process `syz.2.4893'. [ 1694.471193][T25182] syzkaller0: entered allmulticast mode [ 1694.647372][T25190] netlink: 68 bytes leftover after parsing attributes in process `syz.5.4905'. [ 1695.195070][T25198] netlink: 'syz.1.4904': attribute type 4 has an invalid length. [ 1695.220983][T25198] netlink: 'syz.1.4904': attribute type 4 has an invalid length. [ 1695.501804][T25200] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4903'. [ 1696.235616][T25209] loop6: detected capacity change from 0 to 524287999 [ 1698.580884][T25235] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4919'. [ 1698.909144][T25241] loop2: detected capacity change from 0 to 7 [ 1698.917257][T23130] Dev loop2: unable to read RDB block 7 [ 1698.935686][T23130] loop2: unable to read partition table [ 1698.944358][T23130] loop2: partition table beyond EOD, truncated [ 1698.958662][T25241] Dev loop2: unable to read RDB block 7 [ 1698.964844][T25241] loop2: unable to read partition table [ 1698.981866][T25241] loop2: partition table beyond EOD, truncated [ 1698.988559][T25241] loop_reread_partitions: partition scan of loop2 (被x ) failed (rc=-5) [ 1699.033837][T25247] netlink: 5 bytes leftover after parsing attributes in process `syz.8.4923'. [ 1699.043182][T25247] openvswitch: netlink: Tunnel attr 15060 out of range max 16 [ 1699.055498][ T5182] Dev loop2: unable to read RDB block 7 [ 1699.061161][ T5182] loop2: unable to read partition table [ 1699.075074][ T5182] loop2: partition table beyond EOD, truncated [ 1699.752863][T25253] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4924'. [ 1699.765106][T25253] bridge0: port 1(macsec1) entered blocking state [ 1699.771621][T25253] bridge0: port 1(macsec1) entered disabled state [ 1699.778235][T25253] macsec1: entered allmulticast mode [ 1699.788343][T25253] macsec1: left allmulticast mode [ 1700.646445][T25283] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4934'. [ 1701.287126][T25294] sp0: Synchronizing with TNC [ 1701.361215][T25296] sch_tbf: burst 6 is lower than device ip6gre0 mtu (1448) ! [ 1701.881098][T25305] x_tables: ip_tables: rpfilter match: used from hooks OUTPUT, but only valid from PREROUTING [ 1702.040361][T25300] lo speed is unknown, defaulting to 1000 [ 1702.993739][T25318] lo speed is unknown, defaulting to 1000 [ 1703.381238][T25321] loop4: detected capacity change from 0 to 524287936 [ 1703.469866][T25329] siw: device registration error -23 [ 1704.535110][T19694] usb 2-1: new full-speed USB device number 36 using dummy_hcd [ 1704.794971][T19694] usb 2-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1704.818156][T19694] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1704.914467][T25342] loop7: detected capacity change from 0 to 7 [ 1704.957120][ C0] blk_print_req_error: 10 callbacks suppressed [ 1704.957139][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1704.972521][ C0] buffer_io_error: 11 callbacks suppressed [ 1704.972535][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.013253][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.022456][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.040449][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.049648][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.058820][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.067964][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.077332][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.086512][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.109304][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.118613][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.128992][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.138189][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.146263][T25342] ldm_validate_partition_table(): Disk read failed. [ 1705.197696][ C0] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.206921][ C0] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.214873][T19694] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1705.214962][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.233745][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.249453][ C1] I/O error, dev loop7, sector 0 op 0x0:(READ) flags 0x0 phys_seg 1 prio class 1 [ 1705.258614][ C1] Buffer I/O error on dev loop7, logical block 0, async page read [ 1705.267177][T25342] Dev loop7: unable to read RDB block 0 [ 1705.281812][T25342] loop7: unable to read partition table [ 1705.287752][T25342] loop7: partition table beyond EOD, truncated [ 1705.293917][T25342] loop_reread_partitions: partition scan of loop7 (Cj̖P=ý?}X %֐ȵ4FLQk݊5) failed (rc=-5) [ 1705.337471][T19694] usb 2-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 1705.358316][T19694] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1705.384324][T19694] usb 2-1: Product: syz [ 1705.388533][T19694] usb 2-1: Manufacturer: syz [ 1705.413424][T19694] usb 2-1: SerialNumber: syz [ 1705.442620][T19694] usb 2-1: config 0 descriptor?? [ 1705.465073][T19694] streamzap 2-1:0.0: streamzap_probe: endpoint Max Packet Size is 0!?! [ 1705.918065][T25354] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4951'. [ 1705.927241][T25354] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4951'. [ 1706.973060][T25364] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4954'. [ 1707.681963][T25366] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4955'. [ 1707.799558][T25369] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4957'. [ 1707.810434][T25369] netlink: 12 bytes leftover after parsing attributes in process `syz.8.4957'. [ 1707.832225][T23013] usb 2-1: USB disconnect, device number 36 [ 1708.102562][T25376] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4958'. [ 1708.170257][T25376] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4958'. [ 1708.567684][T25391] overlayfs: failed to clone lowerpath [ 1708.620054][T25393] overlayfs: failed to clone lowerpath [ 1708.763054][T16167] Bluetooth: hci6: command 0x1003 tx timeout [ 1708.774147][ T5844] Bluetooth: hci6: Opcode 0x1003 failed: -110 [ 1709.442300][ T10] usb 2-1: new high-speed USB device number 37 using dummy_hcd [ 1710.042266][ T10] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1710.054133][ T10] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1710.090970][ T10] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1710.100838][ T10] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1710.110771][T25415] netlink: 56 bytes leftover after parsing attributes in process `syz.5.4969'. [ 1710.133085][T25399] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1710.144316][ T10] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 1710.300187][T25421] netlink: 20 bytes leftover after parsing attributes in process `syz.5.4971'. [ 1710.312105][T25421] x_tables: (null)_tables: SNAT target: only valid in nat table, not syz0 [ 1710.340136][ T5926] usb 3-1: new full-speed USB device number 31 using dummy_hcd [ 1710.467265][ T10] usb 2-1: USB disconnect, device number 37 [ 1711.101527][ T5926] usb 3-1: config 54 has an invalid interface number: 154 but max is 0 [ 1711.118098][ T5926] usb 3-1: config 54 has no interface number 0 [ 1711.146857][ T5926] usb 3-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice= 0.ec [ 1711.156966][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1711.165878][ T5926] usb 3-1: Product: syz [ 1711.170250][ T5926] usb 3-1: Manufacturer: syz [ 1711.175787][ T5926] usb 3-1: SerialNumber: syz [ 1711.315564][T25434] xt_CONNSECMARK: invalid mode: 66 [ 1711.643563][T25443] x_tables: ip_tables: DNAT target: used from hooks POSTROUTING, but only usable from PREROUTING/OUTPUT [ 1711.963813][T25446] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4979'. [ 1711.976412][T25447] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4979'. [ 1712.006534][ T5926] usb 3-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 1712.022106][T15412] usb 3-1: Failed to submit usb control message: -71 [ 1712.037414][T15412] usb 3-1: unable to send the bmi data to the device: -71 [ 1712.056278][T15412] usb 3-1: unable to get target info from device [ 1712.057390][ T5926] usb 3-1: USB disconnect, device number 31 [ 1712.081893][T15412] usb 3-1: could not get target info (-71) [ 1712.092433][T15412] usb 3-1: could not probe fw (-71) [ 1713.286587][T25469] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4986'. [ 1713.444704][ T5926] usb 3-1: new high-speed USB device number 32 using dummy_hcd [ 1713.444886][T25477] lo speed is unknown, defaulting to 1000 [ 1713.542303][T25477] lo speed is unknown, defaulting to 1000 [ 1713.551069][T25477] lo speed is unknown, defaulting to 1000 [ 1714.106699][ T5844] Bluetooth: hci5: command 0x0406 tx timeout [ 1714.199623][ T5926] usb 3-1: Using ep0 maxpacket: 16 [ 1714.649275][ T5926] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1714.702270][ T5926] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1714.804948][T25477] infiniband sz1: set down [ 1714.810008][T23783] lo speed is unknown, defaulting to 1000 [ 1714.829516][T25477] infiniband sz1: added lo [ 1714.833112][T25497] xt_CONNSECMARK: invalid mode: 66 [ 1714.843480][T25499] xt_CONNSECMARK: invalid mode: 66 [ 1714.854766][T25497] 9pnet_virtio: no channels available for device syz [ 1714.861782][T25499] 9pnet_virtio: no channels available for device syz [ 1714.884716][T25477] sz1: rxe_create_cq: returned err = -12 [ 1715.012916][T25477] infiniband sz1: Couldn't create ib_mad CQ [ 1715.039085][T25477] infiniband sz1: Couldn't open port 1 [ 1715.051358][T25495] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4996'. [ 1715.070754][ T5926] usb 3-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1715.099512][T25504] ipt_REJECT: ECHOREPLY no longer supported. [ 1715.121025][ T5926] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1715.129546][ T5926] usb 3-1: Product: syz [ 1715.133712][ T5926] usb 3-1: Manufacturer: syz [ 1715.138274][ T5926] usb 3-1: SerialNumber: syz [ 1715.220949][T25477] RDS/IB: sz1: added [ 1715.225019][T25477] smc: adding ib device sz1 with port count 1 [ 1715.243362][ T5926] usb 3-1: config 0 descriptor?? [ 1715.281198][T25506] netlink: 48 bytes leftover after parsing attributes in process `syz.1.5002'. [ 1715.301799][T25506] comedi comedi3: c6xdigio: I/O port conflict (0x401,3) [ 1715.308804][T25506] ------------[ cut here ]------------ [ 1715.309754][T25477] smc: ib device sz1 port 1 has no pnetid [ 1715.315203][T25506] kernfs: can not remove 'bind', no directory [ 1715.649421][T25506] WARNING: CPU: 0 PID: 25506 at fs/kernfs/dir.c:1706 kernfs_remove_by_name_ns+0xff/0x110 [ 1715.659375][T25506] Modules linked in: [ 1715.664113][T25506] CPU: 0 UID: 0 PID: 25506 Comm: syz.1.5002 Not tainted syzkaller #0 PREEMPT(full) [ 1715.673491][T25506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1715.683751][T25506] RIP: 0010:kernfs_remove_by_name_ns+0xff/0x110 [ 1715.690439][T25506] Code: 48 89 df 31 db e8 61 a2 ff ff 48 89 ef e8 59 74 32 ff eb b1 e8 f2 55 57 ff 90 48 c7 c7 c0 b9 a3 8b 4c 89 e6 e8 42 89 15 ff 90 <0f> 0b 90 90 eb b4 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 [ 1715.710404][T25506] RSP: 0018:ffffc9000fcbf930 EFLAGS: 00010282 [ 1715.716486][T25506] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90011938000 [ 1715.724690][T25506] RDX: 0000000000080000 RSI: ffffffff817b1ce5 RDI: 0000000000000001 [ 1715.726399][ T5926] em28xx 3-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1715.733187][T25506] RBP: ffffffff8f274700 R08: 0000000000000001 R09: 0000000000000000 [ 1715.750444][T25506] R10: 0000000000000001 R11: 0000000000070bc0 R12: ffffffff8c1e6fc0 [ 1715.758418][T25506] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88814c9a5000 [ 1715.766459][T25506] FS: 00007f00c177d6c0(0000) GS:ffff888124a05000(0000) knlGS:0000000000000000 [ 1715.775509][T25506] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1715.782100][T25506] CR2: 00007f00c175bf98 CR3: 000000005b9ec000 CR4: 00000000003526f0 [ 1715.790057][T25506] DR0: ffffffffffffffff DR1: 00000000000001f8 DR2: 0000000000000083 [ 1715.798063][T25506] DR3: ffffffffefffff15 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1715.806045][T25506] Call Trace: [ 1715.809303][T25506] [ 1715.812213][T25506] driver_remove_file+0x4a/0x60 [ 1715.817116][T25506] bus_remove_driver+0x224/0x2c0 [ 1715.822240][T25506] driver_unregister+0x76/0xb0 [ 1715.827257][T25506] comedi_device_detach_locked+0x12f/0xa50 [ 1715.833085][T25506] comedi_device_detach+0x67/0xb0 [ 1715.838206][T25506] comedi_device_attach+0x43d/0x900 [ 1715.843420][T25506] do_devconfig_ioctl+0x1b1/0x710 [ 1715.848493][T25506] ? __mutex_lock+0x1c5/0x1060 [ 1715.853255][T25506] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 1715.859078][T25506] ? find_held_lock+0x2b/0x80 [ 1715.863743][T25506] comedi_unlocked_ioctl+0x165d/0x2f00 [ 1715.869368][T25506] ? futex_wake+0x1ad/0x530 [ 1715.873874][T25506] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1715.879731][T25506] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1715.885636][T25506] ? do_vfs_ioctl+0x128/0x14f0 [ 1715.890470][T25506] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1715.895485][T25506] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1715.902357][T25506] ? hook_file_ioctl_common+0x145/0x410 [ 1715.907896][T25506] ? selinux_file_ioctl+0x180/0x270 [ 1715.913097][T25506] ? selinux_file_ioctl+0xb4/0x270 [ 1715.918192][T25506] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1715.924005][T25506] __x64_sys_ioctl+0x18e/0x210 [ 1715.928767][T25506] do_syscall_64+0xcd/0xfa0 [ 1715.933475][T25506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1715.939546][T25506] RIP: 0033:0x7f00c098f749 [ 1715.944052][T25506] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1715.963752][T25506] RSP: 002b:00007f00c177d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1715.972181][T25506] RAX: ffffffffffffffda RBX: 00007f00c0be5fa0 RCX: 00007f00c098f749 [ 1715.980258][T25506] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000004 [ 1715.988267][T25506] RBP: 00007f00c0a13f91 R08: 0000000000000000 R09: 0000000000000000 [ 1715.996250][T25506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1716.004199][T25506] R13: 00007f00c0be6038 R14: 00007f00c0be5fa0 R15: 00007fffc4c0ea38 [ 1716.012225][T25506] [ 1716.015227][T25506] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 1716.022479][T25506] CPU: 0 UID: 0 PID: 25506 Comm: syz.1.5002 Not tainted syzkaller #0 PREEMPT(full) [ 1716.031823][T25506] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 1716.041853][T25506] Call Trace: [ 1716.045112][T25506] [ 1716.048018][T25506] dump_stack_lvl+0x3d/0x1f0 [ 1716.052584][T25506] vpanic+0x640/0x6f0 [ 1716.056549][T25506] ? kernfs_remove_by_name_ns+0xff/0x110 [ 1716.062172][T25506] panic+0xca/0xd0 [ 1716.065885][T25506] ? __pfx_panic+0x10/0x10 [ 1716.070295][T25506] check_panic_on_warn+0xab/0xb0 [ 1716.075228][T25506] __warn+0xf6/0x3c0 [ 1716.079130][T25506] ? preempt_schedule_notrace+0x62/0xe0 [ 1716.084656][T25506] ? kernfs_remove_by_name_ns+0xff/0x110 [ 1716.090269][T25506] report_bug+0x3c3/0x580 [ 1716.094578][T25506] ? kernfs_remove_by_name_ns+0xff/0x110 [ 1716.100198][T25506] handle_bug+0x184/0x210 [ 1716.104507][T25506] exc_invalid_op+0x17/0x50 [ 1716.108987][T25506] asm_exc_invalid_op+0x1a/0x20 [ 1716.113810][T25506] RIP: 0010:kernfs_remove_by_name_ns+0xff/0x110 [ 1716.120031][T25506] Code: 48 89 df 31 db e8 61 a2 ff ff 48 89 ef e8 59 74 32 ff eb b1 e8 f2 55 57 ff 90 48 c7 c7 c0 b9 a3 8b 4c 89 e6 e8 42 89 15 ff 90 <0f> 0b 90 90 eb b4 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 [ 1716.139617][T25506] RSP: 0018:ffffc9000fcbf930 EFLAGS: 00010282 [ 1716.145662][T25506] RAX: 0000000000000000 RBX: 0000000000000000 RCX: ffffc90011938000 [ 1716.153608][T25506] RDX: 0000000000080000 RSI: ffffffff817b1ce5 RDI: 0000000000000001 [ 1716.161568][T25506] RBP: ffffffff8f274700 R08: 0000000000000001 R09: 0000000000000000 [ 1716.169518][T25506] R10: 0000000000000001 R11: 0000000000070bc0 R12: ffffffff8c1e6fc0 [ 1716.177475][T25506] R13: 0000000000000000 R14: 0000000000000000 R15: ffff88814c9a5000 [ 1716.186055][T25506] ? __warn_printk+0x1a5/0x350 [ 1716.190818][T25506] driver_remove_file+0x4a/0x60 [ 1716.195649][T25506] bus_remove_driver+0x224/0x2c0 [ 1716.200570][T25506] driver_unregister+0x76/0xb0 [ 1716.205330][T25506] comedi_device_detach_locked+0x12f/0xa50 [ 1716.211127][T25506] comedi_device_detach+0x67/0xb0 [ 1716.216134][T25506] comedi_device_attach+0x43d/0x900 [ 1716.221314][T25506] do_devconfig_ioctl+0x1b1/0x710 [ 1716.226361][T25506] ? __mutex_lock+0x1c5/0x1060 [ 1716.231134][T25506] ? __pfx_do_devconfig_ioctl+0x10/0x10 [ 1716.236701][T25506] ? find_held_lock+0x2b/0x80 [ 1716.241373][T25506] comedi_unlocked_ioctl+0x165d/0x2f00 [ 1716.246831][T25506] ? futex_wake+0x1ad/0x530 [ 1716.251336][T25506] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1716.257148][T25506] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1716.263066][T25506] ? do_vfs_ioctl+0x128/0x14f0 [ 1716.267848][T25506] ? __pfx_do_vfs_ioctl+0x10/0x10 [ 1716.272870][T25506] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1716.279708][T25506] ? hook_file_ioctl_common+0x145/0x410 [ 1716.285285][T25506] ? selinux_file_ioctl+0x180/0x270 [ 1716.290481][T25506] ? selinux_file_ioctl+0xb4/0x270 [ 1716.295582][T25506] ? __pfx_comedi_unlocked_ioctl+0x10/0x10 [ 1716.301373][T25506] __x64_sys_ioctl+0x18e/0x210 [ 1716.306163][T25506] do_syscall_64+0xcd/0xfa0 [ 1716.310651][T25506] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1716.316526][T25506] RIP: 0033:0x7f00c098f749 [ 1716.320930][T25506] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1716.340518][T25506] RSP: 002b:00007f00c177d038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1716.348912][T25506] RAX: ffffffffffffffda RBX: 00007f00c0be5fa0 RCX: 00007f00c098f749 [ 1716.356860][T25506] RDX: 0000200000000080 RSI: 0000000040946400 RDI: 0000000000000004 [ 1716.364824][T25506] RBP: 00007f00c0a13f91 R08: 0000000000000000 R09: 0000000000000000 [ 1716.372779][T25506] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1716.380757][T25506] R13: 00007f00c0be6038 R14: 00007f00c0be5fa0 R15: 00007fffc4c0ea38 [ 1716.388773][T25506] [ 1716.392096][T25506] Kernel Offset: disabled [ 1716.396414][T25506] Rebooting in 86400 seconds..