last executing test programs: 11m15.921821075s ago: executing program 0 (id=4981): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000027"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000010000000181100", @ANYRES32=r0], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040), 0x4) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={0xffffffffffffffff, 0x401, 0x9}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x8000, 0x40, 0x84f, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x65, 0x0, 0x7, 0x29, 0x0, @broadcast, @loopback, {[@ssrr={0x89, 0x2b, 0x21, [@empty, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x36}, @private=0xa010101, @multicast2, @multicast1, @loopback, @multicast2, @private=0xa010101, @private=0xa010100]}, @ssrr={0x89, 0x1f, 0xd8, [@loopback, @dev={0xac, 0x14, 0x14, 0x30}, @loopback, @broadcast, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback]}, @timestamp_prespec={0x44, 0x24, 0x24, 0x3, 0x8, [{@multicast2, 0x3}, {@rand_addr=0x64010100, 0xc}, {@multicast1, 0xdddc}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}]}, @timestamp={0x44, 0xc, 0x19, 0x0, 0x7, [0xbba5, 0xfffff237]}]}}}}}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x840, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x4, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x7ffc}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_getparam(0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, 0x0, 0x2, 0x4002) r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) eventfd(0xfffffff9) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180), 0x6cc0, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r3, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r3, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r3, 0x6, 0x1, &(0x7f0000000140)=@gcm_128={{0x304}, "60000100", "9de66ebc3914c06f0f109088d190e700", '\x00', "f8dde5bf3eba23db"}, 0x28) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, 0x0) r4 = socket$nl_sock_diag(0x10, 0x3, 0x4) sendmsg$TCPDIAG_GETSOCK(r4, 0x0, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) 11m15.510031237s ago: executing program 0 (id=4982): socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) socket$xdp(0x2c, 0x3, 0x0) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x1000000000021, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r2, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0x6}, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) setsockopt$inet6_mreq(0xffffffffffffffff, 0x29, 0x1b, 0x0, 0x0) openat$sndseq(0xffffffffffffff9c, 0x0, 0xe0c81) r3 = socket$key(0xf, 0x3, 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={0x0}}, 0x0) sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x500, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="020100030e000000fcffffff0400000005000600000000000a00000000000000fc01ff80000000000000000000000000000000000000000005000500000000000a0000002efcb098950a0ec00000000000000000000000aa0000000000000000020013"], 0x70}}, 0x0) sendmmsg(r3, &(0x7f0000000180), 0x400008a, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) r5 = dup(r4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r5, 0x84, 0x64, &(0x7f0000000100)=[@in6={0xa, 0x4e24, 0x6, @loopback, 0x3}, @in6={0xa, 0x4e22, 0x7fffffff, @empty, 0x3}, @in={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x16}}, @in6={0xa, 0x4e20, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x8001}], 0x64) sendmsg$inet6(r4, &(0x7f0000000800)={&(0x7f0000000080)={0xa, 0x4e24, 0x8, @loopback, 0x4}, 0x1c, &(0x7f0000000380)=[{&(0x7f00000000c0)="88", 0x1}], 0x1}, 0x4048043) r6 = dup(r4) setsockopt$SO_BINDTODEVICE(r6, 0x1, 0x19, &(0x7f0000000000)='ip6gretap0\x00', 0x10) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r6, 0x84, 0x9, &(0x7f00000004c0)={0x0, @in={{0x2, 0x4e1f, @empty}}, 0x8003, 0xbffc, 0xe652, 0x2, 0x4, 0x8, 0xff}, 0x9c) setsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(r5, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0xce20, 0x800006, @empty, 0x2d}}, 0x7, 0x1, 0xf06, 0x3, 0xb4, 0x7f, 0x9}, 0x9c) write$P9_RSETATTR(0xffffffffffffffff, 0x0, 0x0) socket(0x1e, 0x80004, 0x0) openat$tcp_congestion(0xffffffffffffff9c, 0x0, 0x1, 0x0) socket$packet(0x11, 0x3, 0x300) 11m13.693287703s ago: executing program 0 (id=4987): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000027"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0x14, &(0x7f0000000280)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000001000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff}, 0x94) bpf$BPF_MAP_CONST_STR_FREEZE(0x16, &(0x7f0000000040), 0x4) ioctl$F2FS_IOC_MOVE_RANGE(0xffffffffffffffff, 0xc020f509, &(0x7f0000000080)={0xffffffffffffffff, 0x401, 0x9}) ioctl$sock_ipv4_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, &(0x7f00000003c0)={'sit0\x00', &(0x7f0000000300)={'syztnl0\x00', 0x0, 0x8000, 0x40, 0x84f, 0x0, {{0x24, 0x4, 0x0, 0x0, 0x90, 0x65, 0x0, 0x7, 0x29, 0x0, @broadcast, @loopback, {[@ssrr={0x89, 0x2b, 0x21, [@empty, @rand_addr=0x64010102, @dev={0xac, 0x14, 0x14, 0x36}, @private=0xa010101, @multicast2, @multicast1, @loopback, @multicast2, @private=0xa010101, @private=0xa010100]}, @ssrr={0x89, 0x1f, 0xd8, [@loopback, @dev={0xac, 0x14, 0x14, 0x30}, @loopback, @broadcast, @multicast1, @initdev={0xac, 0x1e, 0x1, 0x0}, @loopback]}, @timestamp_prespec={0x44, 0x24, 0x24, 0x3, 0x8, [{@multicast2, 0x3}, {@rand_addr=0x64010100, 0xc}, {@multicast1, 0xdddc}, {@initdev={0xac, 0x1e, 0x1, 0x0}, 0x1}]}, @timestamp={0x44, 0xc, 0x19, 0x0, 0x7, [0xbba5, 0xfffff237]}]}}}}}) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x1, 0x4, &(0x7f0000006680)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x8, 0x7ffc}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_getparam(0x0, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r1, &(0x7f0000002700)=""/102392, 0x18ff8) ptrace$ARCH_ENABLE_TAGGED_ADDR(0x1e, 0x0, 0x2, 0x4002) eventfd(0xfffffff9) openat$selinux_enforce(0xffffffffffffff9c, &(0x7f0000000180), 0x6cc0, 0x0) r2 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r2, 0x6, 0x19, &(0x7f00000001c0)=0x1, 0x4) bind$inet(r2, &(0x7f0000000100)={0x2, 0x4e24, @loopback}, 0x10) sendmmsg$inet(r2, &(0x7f0000004980)=[{{&(0x7f0000000000)={0x2, 0x4e24, @loopback}, 0x10, &(0x7f0000000040)=[{&(0x7f0000000340)="b9cd14c222ee", 0x4b}], 0x1}}], 0x1, 0x20008000) setsockopt$inet_tcp_TLS_TX(r2, 0x6, 0x1, &(0x7f0000000140)=@gcm_128={{0x304}, "60000100", "9de66ebc3914c06f0f109088d190e700", '\x00', "f8dde5bf3eba23db"}, 0x28) openat$binder_debug(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$TCPDIAG_GETSOCK(0xffffffffffffffff, 0x0, 0x8000) socket$nl_generic(0x10, 0x3, 0x10) 11m10.945544365s ago: executing program 0 (id=4996): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, 0x0}, 0x0) sendmsg$NFT_BATCH(r0, 0x0, 0x0) prlimit64(0x0, 0x0, 0x0, 0x0) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040ac054382408b0b00000109022400010000002009040000fd0301000009210000000122010009058103"], 0x0) syz_usb_control_io$hid(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f00000003c0)={0x24, 0x0, 0x0, &(0x7f0000000a80)=ANY=[@ANYBLOB="002281"], 0x0}, 0x0) r2 = syz_open_dev$hiddev(&(0x7f00000000c0), 0x0, 0x0) ioctl$HIDIOCSREPORT(r2, 0x81044804, &(0x7f0000000400)={0x1, 0x2, 0x85}) syz_usb_control_io(r1, 0x0, 0x0) syz_open_dev$MSR(0x0, 0x0, 0x0) keyctl$read(0x2, 0x0, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(r3, 0x4001af84, 0x0) ioctl$VHOST_SET_OWNER(r3, 0xaf01, 0x0) fcntl$notify(0xffffffffffffffff, 0x402, 0x5) r4 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) write$UHID_CREATE2(r4, &(0x7f00000007c0)=ANY=[@ANYBLOB="0b00000073797a31000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a30000037b35f0a000089b4c45a10000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000073797a3100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0x119) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) 11m6.571784258s ago: executing program 0 (id=5005): r0 = socket$kcm(0xa, 0x922000000003, 0x11) setsockopt$sock_attach_bpf(r0, 0x29, 0x24, &(0x7f00000000c0), 0x4) sendmsg$kcm(r0, &(0x7f0000000000)={&(0x7f00000007c0)=@l2tp6={0xa, 0x0, 0x0, @mcast1, 0x9}, 0x80, &(0x7f0000000080)=[{&(0x7f0000000780)="f4000900062b3b25fe80000000090000dc8b850f238466cc00007a000000ad6e911b51818462", 0x26}], 0x1}, 0x0) 11m6.528814047s ago: executing program 0 (id=5006): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) (async) prctl$PR_GET_KEEPCAPS(0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) (async) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0xa, 0x0, 0x0) (async) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x60001, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000240)=0x0) setresuid(0xee00, r6, r6) ioctl$SNAPSHOT_CREATE_IMAGE(r5, 0x40043311, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001000390400"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000300012800b000100697036746e6c0000200002801400030020"], 0x50}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) (async) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000680)=0x8) (async) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x9) (async) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000080)=0x7f) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000200)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6gre0\x00', 0x0, 0x2f, 0xfd, 0x6, 0x8c6, 0xb, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x40, 0x2, 0x2}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r8, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x81, 0x80000100008b}, 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x9) getpid() (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_usb_connect(0x4, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0x72, 0x34, 0x4c, 0x10, 0x2294, 0x425b, 0xdec6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x2, 0x0, 0xfe, [{{0x9, 0x4, 0x0, 0xf1, 0x0, 0xea, 0x8e, 0x84, 0x9}}]}}]}}, 0x0) 10m50.297808783s ago: executing program 32 (id=5006): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) (async) prctl$PR_GET_KEEPCAPS(0x7) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) (async) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0xa, 0x0, 0x0) (async) r5 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000100), 0x60001, 0x0) ioctl$NS_GET_OWNER_UID(0xffffffffffffffff, 0xb704, &(0x7f0000000240)=0x0) setresuid(0xee00, r6, r6) ioctl$SNAPSHOT_CREATE_IMAGE(r5, 0x40043311, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000000)=ANY=[@ANYBLOB="500000001000390400"/20, @ANYRES32=r3, @ANYBLOB="0000000000000000300012800b000100697036746e6c0000200002801400030020"], 0x50}}, 0x0) bpf$TOKEN_CREATE(0x24, &(0x7f0000000040), 0x8) (async) r7 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000680)=0x8) (async) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000000)=0x9) (async) ioctl$TIOCSTI(r7, 0x5412, &(0x7f0000000080)=0x7f) (async) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000200)={'ip6tnl0\x00', &(0x7f0000000080)={'ip6gre0\x00', 0x0, 0x2f, 0xfd, 0x6, 0x8c6, 0xb, @mcast2, @private2={0xfc, 0x2, '\x00', 0x1}, 0x1, 0x40, 0x2, 0x2}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x11, 0x5, &(0x7f0000000000)=ANY=[@ANYBLOB], 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, '\x00', r8, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x81, 0x80000100008b}, 0x0) (async) openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x400, 0x0) syz_open_dev$ttys(0xc, 0x2, 0x0) (async) ioctl$TIOCSETD(0xffffffffffffffff, 0x5423, &(0x7f0000000080)=0x9) getpid() (async) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) (async) read$msr(0xffffffffffffffff, &(0x7f0000019680)=""/102392, 0x18ff8) (async) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) (async) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) (async) syz_usb_connect(0x4, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0x72, 0x34, 0x4c, 0x10, 0x2294, 0x425b, 0xdec6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x2, 0x0, 0xfe, [{{0x9, 0x4, 0x0, 0xf1, 0x0, 0xea, 0x8e, 0x84, 0x9}}]}}]}}, 0x0) 45.615145327s ago: executing program 1 (id=6662): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x5, [{0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x33) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r2, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)=@o_path={&(0x7f0000000680)='./file0\x00', 0x0, 0x0, r4}, 0x18) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000007c0)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x7, [@func={0xa, 0x0, 0x0, 0xc, 0x4}, @ptr={0x5, 0x0, 0x0, 0x2, 0x4}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x3, 0x7fff}}]}, {0x0, [0x2e, 0x2e, 0x30, 0x0, 0x2e]}}, &(0x7f0000000780)=""/41, 0x4f, 0x29, 0x7fff, 0x8}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x1d, 0x4, 0x80000, 0xf, 0x4008, r6, 0x2, '\x00', r3, r7, 0x0, 0x2, 0x3}, 0x50) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) ioctl$COMEDI_BUFCONFIG(r4, 0x8020640d, &(0x7f0000000600)={0x7, 0x3, 0xd8, 0x3536}) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000006dc6c6c6fdd45d9567b59822e76673c3508910b36114014c45719628e51ed583b52748989a6a8739111a05b595f5633c6a1be8383a94dadb0a6500c706fb3665819a2b8737fa9e47e4defb1bacacbb7a7f2fec446bd111c1487b61846e11e81d56a2b1cd13f413864b53fa44aa03a11a7d03e4e991ed1028c3334e266ea377a488a7a5e301a976f47c07395b7836b49a8c60fb4fe294b110839ac1c76c89f10a2dafa1588efc53210372063fbfa7e9077a6c937e0f8be57c4644b6358c54d4cc303d250c50852d160ba31968738f36356d18750ee5b59a25272823de208e4f9457c1e8fe53deb7224a2f690b03b4051761f4271e05f501bee61d8e38"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000c40)={r9, 0xe0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x7) ptrace$getregs(0xe, 0x0, 0x2, &(0x7f0000000980)=""/206) 44.315578606s ago: executing program 1 (id=6669): r0 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r0, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r0, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @empty, 0xffffffff}, 0x1c) r1 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000180)=0x80000004, 0x4) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @empty}, 0xffffffff}, 0x1c) syz_emit_ethernet(0xbe, &(0x7f0000000000)={@local, @link_local, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0xb0, 0x0, 0x0, 0x0, 0x11, 0x0, @empty, @empty}, {0x0, 0x4e20, 0x9c, 0x0, @wg=@initiation={0x1, 0x0, "7b4b143b7461fd777b1c012bd14efb9f49fcdb8f080c26a04883ad5c8c82b8af", "584cbf2649a50f2dbc43efa8698dfa871c51852e4451b57d037ad3c045942824251d7d17b5191584cdd4fbe40a27424d", "bcfd56f1373669caaa2f19935e6996c7096ffe4f3a4745a8f762b964", {"9a3bfbc1f39cb307b3472eb9cdb042d2", "643fcbb2c5a57df67d544af6e8dafe09"}}}}}}}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000008095"], 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0xfffffe01}, 0x94) setsockopt$inet6_udp_encap(r0, 0x11, 0x64, &(0x7f00000000c0)=0x2, 0x4) r2 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x7}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r2, 0x5, 0xb68, 0x300, &(0x7f0000000000)='%', 0x0, 0xd01, 0x9c000000, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) 43.585213653s ago: executing program 1 (id=6670): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0xc008ae88, &(0x7f0000000040)={0x10000000000000cf, 0x17a, [{}]}) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000200), 0x200a80, 0x0) ioctl$VT_SETMODE(r5, 0x5602, &(0x7f0000000300)={0xf, 0x1, 0xe2e, 0xd0, 0x82}) socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) pwritev2(r6, 0x0, 0x0, 0x7000, 0x8, 0x2) r7 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r7, 0x7a0, &(0x7f0000000140)={@local}) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) 42.093161262s ago: executing program 4 (id=6676): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) (async) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) (async) sendmsg$NL80211_CMD_TDLS_OPER(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x24000000}, 0x890) (async, rerun: 32) r0 = socket$igmp(0x2, 0x3, 0x2) (rerun: 32) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000000100), 0x4) (async) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x10, 0x0, @vifc_lcl_addr=@multicast2, @remote}, 0x10) (async) setsockopt$MRT_ADD_MFC_PROXY(r0, 0x0, 0xd2, &(0x7f0000000280)={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, "614af285791a63abd0f993af8077b5cd01e03d64a831683fdc3fd440829c82ae"}, 0x3c) (async) setsockopt$inet_mreq(r0, 0x0, 0x4, &(0x7f0000000000)={@remote, @rand_addr=0x64010101}, 0x8) (async, rerun: 32) r1 = socket$inet(0x2, 0x4000000000000001, 0x0) (rerun: 32) setsockopt$inet_tcp_int(r1, 0x6, 0x80000000000002, &(0x7f00000010c0)=0xb8, 0x4) (async) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) (async) sendfile(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000002080)=0x64, 0x21c) sendto$inet(r1, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e22, @remote}, 0x10) (async) setsockopt$MRT_FLUSH(r0, 0x0, 0xd4, &(0x7f0000000040)=0x6, 0x4) (async) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000280)='net/ip_mr_cache\x00') preadv(r2, &(0x7f00000000c0)=[{&(0x7f0000000080)=""/20, 0x14}], 0x1, 0x10000009, 0xffffffff) 40.743541465s ago: executing program 4 (id=6678): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x3, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xffffffffffffff01, 0x88}, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) syz_usb_control_io$lan78xx(0xffffffffffffffff, 0x0, 0x0) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r2, 0x84, 0x76, &(0x7f0000444ff8)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r2, 0x84, 0x75, &(0x7f0000000000)={0x0, 0x9}, 0x8) setsockopt$inet_sctp_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000280)=[@in6={0xa, 0x4e23, 0x0, @loopback}], 0x1c) sendmmsg$inet6(r2, &(0x7f0000000480)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x80020}, 0x1c, &(0x7f0000000500)=[{&(0x7f00000034c0)='\x00', 0x1}], 0x1}}], 0x1, 0x34000811) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r2, 0x84, 0x77, &(0x7f0000000640)=ANY=[@ANYBLOB="12e01b398adda16e"], 0x1000f) r3 = dup(r1) socket(0xb, 0x80000, 0xd) sendmsg$NFULNL_MSG_CONFIG(r3, 0x0, 0x80) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) bpf$BPF_GET_BTF_INFO(0xf, &(0x7f00000004c0)={0xffffffffffffffff, 0x20, &(0x7f00000001c0)={&(0x7f0000000300)=""/196, 0xc4, 0x0, 0x0}}, 0x10) r5 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$uinput_user_dev(r5, &(0x7f0000000080)={'syz0\x00', {}, 0x0, [0x80000000, 0x3, 0x3fc, 0x8, 0xfffffffd, 0x0, 0x4000004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x4, 0x0, 0x0, 0x40, 0x0, 0xf5b1, 0xffffffff, 0x10000000, 0x99, 0x20000000, 0x20, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x4, 0x0, 0x4, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0xfffffffe, 0x0, 0x0, 0x1], [0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xedc0, 0x0, 0x5ee, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa0000000, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0xfffffffc, 0x2, 0x0, 0x2000079, 0x400, 0x0, 0x0, 0x10000, 0x40000, 0x7, 0xc0800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x81, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4771, 0x0, 0x0, 0x3], [0x0, 0x7f, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x2, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x4000, 0x6, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0xf, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0xfffffffc, 0x4], [0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0xfffffffd, 0x8, 0x0, 0x0, 0x0, 0x3, 0xfffffffc, 0x4, 0x800, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x0, 0x3, 0x0, 0x800, 0x0, 0x10, 0x5, 0xfffffffd, 0x0, 0x0, 0x0, 0x8001, 0x80, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8ec4, 0x0, 0x8000000, 0x4, 0x0, 0x0, 0x0, 0xffffe]}, 0x45c) ioctl$UI_SET_EVBIT(r5, 0x40045564, 0x5) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) ioctl$FS_IOC_GETFSUUID(r6, 0x80111500, 0x0) ioctl$UI_SET_SWBIT(r5, 0x4004556d, 0x0) ioctl$UI_DEV_CREATE(r5, 0x5501) close_range(r5, r6, 0x0) 40.287591339s ago: executing program 3 (id=6681): socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f0000000040)='contention_end\x00'}, 0x10) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r0 = syz_usb_connect$printer(0x0, 0x36, &(0x7f00000001c0)=ANY=[@ANYBLOB="1201000000030020f003176c400000000001090224725100000000090400001207010300090501020000000000090582020002"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_disconnect(0xffffffffffffffff) getsockopt$IP6T_SO_GET_INFO(0xffffffffffffffff, 0x29, 0x40, &(0x7f00000003c0)={'mangle\x00', 0x0, [0x3, 0x1, 0x4, 0x400]}, &(0x7f0000000440)=0x54) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) 40.264478113s ago: executing program 1 (id=6682): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000032680)=""/102400, 0x19000) r1 = fsopen(&(0x7f0000000100)='cifs\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r1, 0x1, &(0x7f0000000040)='source', &(0x7f0000000380)='//\xf2b\x06\b\xba\xdfXo\xdc\xea\x95\x9a\x82\x10\x97W\x8f7\x98\x9b/Q9\xf9\rmD\x94)U\xdb\x15X.I\n}\xf3\x9d\xe4_\x05\x9cqf4I^#b?9\xde\xafu\'\x83L\xe0\x97\xe1n_\xa4%\xb1\x97\x93\xafv\xce\x14\\//\x00\x00\xa7\xfb\xf4\x84\x1fA\xeas^\xef\xa2\x85\xa3!\xfb\x93\xd7R\xab2\x1eW\xe9h\x9b\xf7ul\xf9D\xd4\x82X5\x13\xaa\x87\xf9\xba\xa9m\x14\x14R_\x9a\\>4\xce\x8e_#\xf8D\xb1\xdep\x01\xcc:\xa6\xc5n\xeb\xab\xf70\x99\xef\x8b0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) msgctl$MSG_STAT(0x0, 0xb, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$kvm(0xffffff9c, &(0x7f0000000100), 0x41, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000006c0)=ANY=[@ANYBLOB="840000001000010029bd", @ANYRES32=0x0, @ANYBLOB="4db20200201a0100140003006e6574646576696d30000000000000480016804400018040000c8014000104ff0300ff88a8000014000100390e00003f0000000d000000810000001400010006000000af0600000700000088a8000005001100060000000000000000000000337289ae8504346600e663960b2466b8aeb6d543ca7b0ab342095dd8aa80a9436ac2f322cd6bb964e3248157af44c58b53fb284ad18ee521b78b0b06ef2dad61583deb42535f695fa951acd31c264302f8cf225703e15e75fdce5a1ff4e570ebb45af53eccb1516d8def50533b5f61b1961d6e411e810b50479cbc89d6eb23e675fab18f5bc89bdf67e63c3a34a9b8d2f3463364440011f94697a1268132e3156cb0b86d0f71cd3e098d4e882411b6763ef758914a129ed919881e570d9c2c4d45de1caa2435dd1ab7a763a6f01bdb1e36727c8c58cd23ad23fc2062ffb4739414d48a51a88f347f23e25f86997fba7ff58b9bf71852fbd447671c42bd634bfa3596779eda8fee1fb15795043e407170dfb2505fadfdc458a14fd5bc0590426fa7934d1ff54cbbb906eafd578be843cecda14de96ee5424b"], 0x84}, 0x1, 0x0, 0x0, 0xc1}, 0x0) ioctl$KVM_CREATE_PIT2(r5, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) syz_open_dev$swradio(&(0x7f0000000240), 0x0, 0x2) ioctl$KVM_SET_PIT(r5, 0x8048ae66, &(0x7f0000000080)={[{0x5, 0x0, 0x1, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x35}, {0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x7}, {0x0, 0x4, 0x9, 0x0, 0x0, 0x0, 0x8, 0x10, 0x2, 0x0, 0x0, 0xff}]}) r7 = msgget$private(0x0, 0x4a0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x840}, 0x0) msgctl$IPC_STAT(r7, 0x2, 0x0) 39.125208128s ago: executing program 1 (id=6684): r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000d40)=@multiplanar_fd={0xfffffffc, 0x0, 0x4, 0x400, 0x0, {0x0, 0x2710}, {0x3, 0x1, 0xff, 0x9, 0xc, 0x3, "b87568bb"}, 0x1, 0x4, {&(0x7f0000000680)=[{0x8, 0x7, {}, 0x6}, {0xfffffffc, 0x281, {}, 0x1}]}, 0x5, 0x0, r0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, 0x0) mount(0x0, 0x0, &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) socket$inet_icmp_raw(0x2, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = fsopen(0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) fsmount(r2, 0x0, 0xc) openat$selinux_relabel(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000500), 0x42, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) 38.521130079s ago: executing program 1 (id=6686): socket$nl_crypto(0x10, 0x3, 0x15) mq_getsetattr(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) prlimit64(0x0, 0xc, &(0x7f0000000200)={0x5, 0x5}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x10) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e402010902"], 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00'}) r5 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r5, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x800, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) membarrier(0x2, 0x0) 37.090253379s ago: executing program 5 (id=6690): r0 = inotify_init1(0x0) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_sctp6_SCTP_ASSOCINFO(r1, 0x84, 0x1, 0x0, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_ADD_COUNTERS(r2, 0x29, 0x41, 0x0, 0x0) inotify_add_watch(r0, &(0x7f0000000400)='.\x00', 0xa4000021) syz_open_dev$vim2m(&(0x7f0000000480), 0xfffffffffffffffe, 0x2) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f00000001c0)=0x5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f00000004c0)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) r7 = signalfd(r5, &(0x7f0000000100)={[0x9]}, 0x8) ioctl$SNDRV_CTL_IOCTL_ELEM_INFO(r7, 0xc1105511, &(0x7f0000000680)={{0x8, 0x3, 0x5, 0xdea4, '\x00', 0x1}, 0x0, 0x3, 0x5, r3, 0x1, 0xffffffc0, 'syz1\x00', &(0x7f0000000140)=['pcrypt(authencesn(streebog256-generic,xchacha12-generic))\x00'], 0x2d}) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r6, 0x6, 0x23, 0x0, &(0x7f00000001c0)) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYRES32=0x1, @ANYBLOB='\x00'/15, @ANYRES32=0x0, @ANYRES32, @ANYBLOB], 0x50) r8 = socket$alg(0x26, 0x5, 0x0) bind$alg(r8, &(0x7f0000000080)={0x26, 'aead\x00', 0x0, 0x0, 'pcrypt(authencesn(streebog256-generic,xchacha12-generic))\x00'}, 0x58) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1af8ff00000000bfa10000000000000701"], 0x0, 0xbf44, 0x0, 0x0, 0x0, 0x40, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r9, 0x2000000, 0xe, 0x0, &(0x7f0000000580)="63eced8e46aa7ce5a833c9f7b942", 0x0, 0x7ffd, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 37.015770654s ago: executing program 4 (id=6691): openat$nullb(0xffffffffffffff9c, 0x0, 0x4000000044182, 0x0) r0 = syz_open_dev$vim2m(&(0x7f0000000140), 0x3, 0x2) ioctl$vim2m_VIDIOC_DQBUF(r0, 0xc0585611, &(0x7f0000000d40)=@multiplanar_fd={0xfffffffc, 0x0, 0x4, 0x400, 0x0, {0x0, 0x2710}, {0x3, 0x1, 0xff, 0x9, 0xc, 0x3, "b87568bb"}, 0x1, 0x4, {&(0x7f0000000680)=[{0x8, 0x7, {}, 0x6}, {0xfffffffc, 0x281, {}, 0x1}]}, 0x5, 0x0, r0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, 0x0) mount$fuse(0x0, 0x0, 0x0, 0xfc5cd7921c2c19c4, 0x0) mount(0x0, 0x0, &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) socket$inet_icmp_raw(0x2, 0x3, 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) r2 = fsopen(0x0, 0x0) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="02000000040000000800000001"], 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) fsmount(r2, 0x0, 0xc) openat$selinux_relabel(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000500), 0x42, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) 37.015085841s ago: executing program 3 (id=6692): prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f00006e3000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x7f9, &(0x7f0000000040)={0x0, 0xc8df, 0xfc00, 0xa, 0x20002f7}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000093c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=@deltfilter={0x24, 0x2d, 0x300, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {0x1}, {0xfff1, 0xffff}, {0xe, 0x5}}}, 0x24}, 0x1, 0x0, 0x0, 0x40005}, 0x20040000) io_uring_enter(r0, 0x2219, 0x771b, 0x24, 0x0, 0xffffffffffffff4c) r1 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r1, 0x4b67, 0x0) creat(0x0, 0xc2) io_setup(0x7f, &(0x7f0000000100)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a0103"], 0x7c}}, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) ioctl$sock_bt_bnep_BNEPGETCONNLIST(0xffffffffffffffff, 0x800442d2, &(0x7f0000000240)={0x0, 0x0}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc(&(0x7f00000009c0), 0xffffffffffffffff) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x20000080) sendto(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() fsopen(&(0x7f0000000280)='cifs\x00', 0x0) sendmsg$TIPC_CMD_GET_LINKS(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)={0x24, r4, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {}, {0x8, 0x11, 0x1}}}, 0x24}}, 0x8000) 35.992416217s ago: executing program 4 (id=6694): capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000001080)={0x200000, 0x200000}) syz_init_net_socket$nfc_raw(0x27, 0x3, 0x0) r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) setsockopt$inet6_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000000)=[@sack_perm], 0x1) r1 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000040)='blkio.bfq.io_service_time\x00', 0x0, 0x0) socket(0x2c, 0xa, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000004bc311ec8500000075000000a70000000800000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='percpu_alloc_percpu\x00', r2}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r4 = socket(0x400000000010, 0x3, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r6, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0x10}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000001300)=@newtfilter={0x30, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r6, {0x0, 0xffe0}, {}, {0xa}}, [@filter_kind_options=@f_u32={{0x8}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) syz_io_uring_setup(0x111, &(0x7f0000000340)={0x0, 0x1c62, 0x2, 0x7}, 0x0, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, 0x0) r7 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r7, &(0x7f0000002700)=""/102392, 0x18ff8) r8 = gettid() rt_sigqueueinfo(r8, 0x21, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x154) r9 = accept4$rose(0xffffffffffffffff, 0x0, &(0x7f0000000300), 0x80800) ioctl$sock_kcm_SIOCKCMCLONE(0xffffffffffffffff, 0x89e2, &(0x7f0000001480)={r9}) prlimit64(0x0, 0xe, 0x0, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f00000001c0)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000180)={&(0x7f0000000140)={0x30, 0x0, 0x400, 0x70bd29, 0x25dfdbfd, {{}, {@void, @val={0xc, 0x99, {0x5d, 0x2e}}}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0x8}]}, 0x30}, 0x1, 0x0, 0x0, 0x20004000}, 0x40008) 35.507089704s ago: executing program 5 (id=6695): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000240)={0x44, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x44}}, 0x0) syz_80211_inject_frame(&(0x7f00000002c0)=@device_b, &(0x7f0000000300)=@mgmt_frame=@probe_response={{{}, {}, @device_b, @device_a, @from_mac}, 0x0, @default, 0x1, @val={0x0, 0x6, @default_ap_ssid}, @val={0x1, 0x5, [{0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x18}, {0x24}]}, @void, @void, @void, @void, @void, @void}, 0x33) nanosleep(&(0x7f0000000340)={0x0, 0x2faf080}, &(0x7f0000000380)) syz_80211_inject_frame(&(0x7f00000003c0)=@device_b, &(0x7f0000000400)=@mgmt_frame=@auth={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x1}}, 0x0, 0x2, 0x0, @void}, 0x1e) nanosleep(&(0x7f0000000440)={0x0, 0x2faf080}, &(0x7f0000000480)) r2 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000040)={'sit0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f0000000080)={0xffffffffffffffff, 0x0, 0x0}, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@ipv6_newnexthop={0x24, 0x68, 0x309, 0x0, 0x0, {}, [@NHA_BLACKHOLE={0x4}, @NHA_ID={0x8, 0x1, 0x1}]}, 0x24}}, 0x0) r6 = bpf$OBJ_GET_MAP(0x7, &(0x7f00000006c0)=@o_path={&(0x7f0000000680)='./file0\x00', 0x0, 0x0, r4}, 0x18) r7 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000007c0)={&(0x7f0000000700)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x30, 0x30, 0x7, [@func={0xa, 0x0, 0x0, 0xc, 0x4}, @ptr={0x5, 0x0, 0x0, 0x2, 0x4}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x5, 0x3, 0x7fff}}]}, {0x0, [0x2e, 0x2e, 0x30, 0x0, 0x2e]}}, &(0x7f0000000780)=""/41, 0x4f, 0x29, 0x7fff, 0x8}, 0x28) bpf$MAP_CREATE(0x0, &(0x7f0000000800)=@base={0x1d, 0x4, 0x80000, 0xf, 0x4008, r6, 0x2, '\x00', r3, r7, 0x0, 0x2, 0x3}, 0x50) syz_80211_inject_frame(&(0x7f00000004c0)=@device_b, &(0x7f0000000500)=@mgmt_frame=@assoc_resp={{{}, {}, @device_b, @device_a, @from_mac, {0x0, 0x2}}, 0x1, 0x0, @default, @val={0x1, 0x8, [{0x2, 0x1}, {0x4, 0x1}, {0xb, 0x1}, {0x16, 0x1}, {0xc}, {0x12}, {0x18}, {0x24}]}, @void}, 0x28) ioctl$COMEDI_BUFCONFIG(r4, 0x8020640d, &(0x7f0000000600)={0x7, 0x3, 0xd8, 0x3536}) r8 = bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000640)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26}, 0x28) r9 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xd, 0x3, &(0x7f0000000400)=ANY=[@ANYBLOB="1800000000000000000000000000000095000000000000006dc6c6c6fdd45d9567b59822e76673c3508910b36114014c45719628e51ed583b52748989a6a8739111a05b595f5633c6a1be8383a94dadb0a6500c706fb3665819a2b8737fa9e47e4defb1bacacbb7a7f2fec446bd111c1487b61846e11e81d56a2b1cd13f413864b53fa44aa03a11a7d03e4e991ed1028c3334e266ea377a488a7a5e301a976f47c07395b7836b49a8c60fb4fe294b110839ac1c76c89f10a2dafa1588efc53210372063fbfa7e9077a6c937e0f8be57c4644b6358c54d4cc303d250c50852d160ba31968738f36356d18750ee5b59a25272823de208e4f9457c1e8fe53deb7224a2f690b03b4051761f4271e05f501bee61d8e38"], &(0x7f0000000080)='GPL\x00', 0x5, 0x1f6, &(0x7f00000002c0)=""/168, 0x0, 0x0, '\x00', 0x0, @sock_ops, r8, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000200), 0x1}, 0x6d) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000c40)={r9, 0xe0, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, &(0x7f0000000180)=[0x0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0}}, 0x10) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x7) ptrace$getregs(0xe, 0x0, 0x2, &(0x7f0000000980)=""/206) 35.165534998s ago: executing program 2 (id=6696): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_REJECT(r0, &(0x7f0000000040)={0x9, 0x108, 0xfa00, {0xffffffffffffffff, 0x5f, "e826b9", "0f0c759b87dc57a2278e72fc73aec8f29abf0a2f163f4a2a446ca25b5dc414b225099a3c9cd23c7078f1a156c521e2bc2ff3ebb4da6dd21a24c7f6f8e9335d1df0ffeb42e97c670831ed87a275bbe643d072c963e4ff43de865de9b0c13f6e3c170eda32c04e45b472d2f256041557fef46c0a948018bd0d4d8e8ab30fb6469cfa335599414cb392d6ed2f457f69eba0da5713c40e70276197a5f174973ef8c272300384a86321afe680ce97b6562b57dd67579a2403c662cec3017491e61df916c6fc893f4274da6c86bc2001d9618a946c0cd86bb863b12716fe2e5dc67723152a754d8da219469eed57da53c3bcb81acd6a9a41b34bd3d6d38df1c225fe86"}}, 0x110) r1 = socket$nl_audit(0x10, 0x3, 0x9) sendmsg$AUDIT_USER(r1, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x74, 0x3ed, 0x1, 0x70bd2d, 0x25dfdbff, "54fa0eed108e629b162b15bb1a63f9288a064e3f5dff1e7c3181a89c829e6266810eeb9dc95534c0ec0da17098d089e19764c7546e399b5c9d47daa7b0d3654d11fdf5e5a192e4c74b5eafdf029d055d43663350925a46c75ed7637ab6deaa9ae9", ["", ""]}, 0x74}, 0x1, 0x0, 0x0, 0x40000}, 0x20000004) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = fcntl$getown(r1, 0x9) sendmsg$nl_generic(r2, &(0x7f0000000700)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f00000006c0)={&(0x7f0000000300)={0x38c, 0x1a, 0x100, 0x70bd2b, 0x25dfdbfe, {0xf}, [@generic="8b9c79e379190966606ec165dfdf389054b277600e835ba1440e12a0e476934345da49fe98bf767f2d01fec19c51956b62ed81dd3a7fdf4b4e7a3bce4a4680b5802f7b510a4f816858e162e03301c30559e9d3ebcb99fdf980c71cb5e9a8bb7bf5e187a541683ce17ea2f4bd8316d7d347b7ada7ad924e7a33d026ba92718a079d6a34a476d8f743cd61a8294def73b17009603a02362c351ba876f0e6fafda9bab45953a9b6450ad0e69a4cb23f0e7e4ee5bdf972751775ba4a8c3ee788f9cf61e00a20bd16810dcedde9bbd265c1aacc949cb86193e52d75dc7ce3b1700b2e00bb", @generic="8918b3cb0c6fe0ea477d598132bd68d1c20b64ac1ffc1e248fe2a8ad07d9acc5e9513052a314201ffbb074cfbae2f84d65bae3be7433d0d60740cf3545260f9f0646cdd24792ba0306267ac414720054c31754e6859b22c462b3632f646112c45779f6114a047a11be21ec3b3c4f7c2b6cda16d565b9ce9896b3ea1b581831b243bc1324f615a95703ef5a694dbbda69fd2056aee83c3670cfeaaea6d5a96fccac189a4a5ae68e5dfe5e6800672d55b1ca", @typed={0x8, 0x11e, 0x0, 0x0, @pid=r3}, @typed={0x14, 0x6e, 0x0, 0x0, @ipv6=@mcast2}, @typed={0x14, 0xf8, 0x0, 0x0, @ipv6=@private1={0xfc, 0x1, '\x00', 0x1}}, @nested={0x1b3, 0x10d, 0x0, 0x1, [@generic="8c5c47590e93e80bf1fcef837550832db616bd1d2bf5a03cba965163127bec727ef0a4c1bfb58350c317896a3c0f99b2fccf2accbae4929310e1b842d724f913d998dabd6e125f8f9baa68ccfcbc2560fd7ea912b99cb742ea3bc3780bf2e49383eab566e127d0dd0cc4032bbc84906ef71f803089cb7204c7fa76c772f01e4c98", @generic="89b520c99634d33a8496ca99aed126079d92b926b50de500213696f920eb463535b34c5499df7d4e57ada9d987053b4c9b27b3e3efacf76714852930d4ddb4df987bb838a43233a7ed3093dbc9f0e7b6b541e2d03cfe2998296f04ae8efcbc51332b6de2d11dedd0fe29a225cc877faf4f3145d2ad460b25191e1d798067518ce512f1f4ad6d35a4cfc3989b71000eb8636eceeb411e310b2beb416a27b3c078d184494af300a02149adc79e", @generic="f3a67caef6c5da8d44b4c84d813bf69e8bacc50550a991ee8620c0e0cc789b42a6510bcac12281d8dea979a0d6d009ada9ce54c369cc02ef8f847ad3cfda004336999f90a19f1729b04bb8a3b5fed9c82e38637738ee182bc96b86113d47492370666cad6d2f501891afb767a0a0", @nested={0x4, 0x2e}, @typed={0x8, 0x87, 0x0, 0x0, @fd=r0}, @nested={0x4, 0xcf}, @nested={0x4, 0xe6}]}]}, 0x38c}}, 0x800) r4 = openat$null(0xffffffffffffff9c, &(0x7f0000000740), 0x583d01, 0x0) ioctl$VIDIOC_DQEVENT(r4, 0x80885659, &(0x7f0000000780)={0x0, @data}) connect$vsock_stream(r4, &(0x7f0000000840)={0x28, 0x0, 0xffffffff}, 0x10) ioctl$VIDIOC_G_OUTPUT(r4, 0x8004562e, &(0x7f0000000880)) bind$l2tp6(r4, &(0x7f00000008c0)={0xa, 0x0, 0x7, @local, 0x0, 0x3}, 0x20) getsockopt$inet_sctp6_SCTP_RTOINFO(r4, 0x84, 0x0, &(0x7f0000000900)={0x0, 0x2, 0x5c1, 0x10}, &(0x7f0000000940)=0x10) getsockopt$inet_sctp6_SCTP_DELAYED_SACK(r4, 0x84, 0x10, &(0x7f0000000980)=@sack_info={r5, 0x6, 0x6}, &(0x7f00000009c0)=0xc) ioctl$NBD_SET_SIZE(0xffffffffffffffff, 0xab02, 0x5) openat$audio(0xffffffffffffff9c, &(0x7f0000000a00), 0x610001, 0x0) ioctl$BLKPBSZGET(r4, 0x127b, &(0x7f0000000a40)) read$msr(r4, &(0x7f0000000a80)=""/192, 0xc0) sendmsg$NFT_BATCH(r4, &(0x7f0000003740)={&(0x7f0000000b40)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000003700)={&(0x7f0000000b80)={{0x14}, [@NFT_MSG_DELCHAIN={0x94, 0x5, 0xa, 0x2, 0x0, 0x0, {0x2, 0x0, 0x1}, [@NFTA_CHAIN_COUNTERS={0x1c, 0x8, 0x0, 0x1, [@NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0x8}, @NFTA_COUNTER_PACKETS={0xc, 0x2, 0x1, 0x0, 0xffffffffffff0001}]}, @NFTA_CHAIN_FLAGS={0x8, 0xa, 0x1, 0x0, 0x2}, @NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x2}, @NFTA_CHAIN_HOOK={0x3c, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x6bcfe64b}, @NFTA_HOOK_DEV={0x14, 0x3, 'gretap0\x00'}, @NFTA_HOOK_DEV={0x14, 0x3, 'nicvf0\x00'}, @NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x37de88dc}]}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x2}]}, @NFT_MSG_DELOBJ={0x34, 0x14, 0xa, 0x401, 0x0, 0x0, {0x0, 0x0, 0x6}, [@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x4}, @NFTA_OBJ_TYPE={0x8, 0x3, 0x1, 0x0, 0x5}, @NFTA_OBJ_TABLE={0x9, 0x1, 'syz1\x00'}]}, @NFT_MSG_NEWSETELEM={0x2a80, 0xc, 0xa, 0x101, 0x0, 0x0, {0x2, 0x0, 0x5}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x2a4c, 0x3, 0x0, 0x1, [{0x1590, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY_END={0x20, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}, @NFTA_SET_ELEM_KEY={0x111c, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x9f, 0x1, "0b0dace20c0008bf52a9e1df310b68840678e19b9ef4d13c372120247db042e775be3781ac02fd338c8c5c50eac113bf18d14f21829ab4ce88af17fa607edf0fdce41f76221bda4fc690f18b1efbb00e3217c4d19167954d30274c46e09280e70dbb50ddd38d7528968435b1bcdfce965ebd06e534ee4c6dc6e81d0bcee95d3d4f3e8c35606ea96af56dde43627b7d445853878238b327c0d1d741"}, @NFTA_DATA_VALUE={0x1004, 0x1, "f142520f12466a4b1310cbdb76469c124959b7031f033517409a6c52cb14d2043731d1079e8c7ce2935c21171122e9053c5ad37c690093b209442fce3da5f43545987794a6933e413b6ef0f6858a6a4dcfbba137cad665d616764e59f58c0c142c9d8846dafd6e4d357596759f6b0035f7e3cde99e83ceba9cc179fc475a3d9c6b982c9df9edd643c4b51198625b6f2fea42ed2ff33418b84cf2792ddaaa7720e05f0b8d76d0d8d08a20ca2b7578af7475cdae1875c0170155a96a45eb9a884fdf155c550afc5d4158c946401417a51f470348905f66616c353b92f1882831aa44d637e9053c844957a69338c5c5066dd096b8f3c83c55b70243d1e7c9ae6896ad09ec08b971b9f91fa685a30368d7be686faa2848a2f4bf0b5b54e03675f1ae4147227f7743d9d35c2d2d498f6dd8e75bc84d875e2d569c297cd447e4deb0f3b9a9914cd42909b90ae3344dfd76158b0450467e8c037bf8c7ba0e2fa6345c79ebaee814a04a70798c44bdbc90239a72bbc2c03b98221589ed4e7dc3f1633a31497ffc94423ad055d866b1efc3d549e885d965206ca9a9451554399291c3d96b515f09d877daf6d5dd248145558336918081b6f631cd7d34c0a4be46c71184bd2057d9af203513c1e234db75ad70a100317ab3512747347f627c46f782fc8d6457c8b04a8e93f2eec986255305474102fa6659d19dd4c4336152071217d4a1ea8c47b8d4ce1803e5a88d61cc98d7e07f5a7e9a539d07a1e14665871823ea75930f4543379e703879f4bc1833afcdd3aeb5277c10cbe509c1f167fc16a6ccbd16739029bc31c922c37a6dde4fc42836047a3be1447394fae1fabb3da8c61d8007ce565f59c5f74f8e09929684764347a5d3a2b10817d562b114f89788d06227d2a38cc95fc71505a9e50f658fe6da68768b1cfb6695d5edd99a0834ef95b70b8f81fd6d0bb4abebe4b3064abe1cfc10a927f396d4afddb10d4c2b7e76d26198622f08c790f4a01ab3aa571a5db1c7477ba1ed417732eff0af825c3122cfeb0d0c985d17ad3efe8af9347315a952f22c77a644f8a47fa64c3fe042b300fe7d67216106f4cfa176a44f542b7d7c8bc64917b83b5f2e95e519588f13d24d672026bf94b7d4a550fa48faaa8ca69c30c90abc9658d6a39dffdd6eb487aea05be0781885ec10814d502f616884a0c1dcac398dad2c84f1f9868025074b54a7fd2cbfe40d66439bb52d8d1987805e41119edce877787fa8fcbab75aea5d73cdf967f188edf521294cf1a9bfde424226f6a849829af114288c1eb12f25ba564a6d97ce211f1d68cf8f9e8ef8bdce553266ab430fdfc87bfa0f2fa4b29ec135f1f37975fc571007371f20573d5209e80e996cd45324f04360b30a290801281b0bc0ebf990fa9d8283b20244c816344cf5f819d393e6fd7e8457e843a04d6d06a66c2c5e7ed6b01d707e767c296462880884340ee8a218fd259c1faa65f31272448e0f83696f91ea8063a9a6fc8d6a8980be0821573a4809fcec847aaa76f0832899bd2d628546a2643690eda7f4dadbb3e79ce2727edebdae56128490b36f97b7967e97c6d565005209fc6c29b36918ed7fdeac1962a8bae0a2570ed37f0f98822c8731eb2ebaaf1d193433ab170290229acd16a6b06905ed0e56b39a27db59e8f3b3bfbd13c4ad45f1afe22c9c03091b73a49b485c0162dc648a7f89b3fb771b50e6b211663f2141f15ebead453546ab343a1f489e09181f0c82d16b36e991b871c13e77e0ee4f0b76b9b30f1767b701e6296284adf6041859a0dcdfd04b24e1ad03a855905409323042ccf7a6982c22a27dd685716d85cc4e3083c855e2d95b6a1d973ef069a9f2c6b7d254bd0d70230cd58b2457b0091c7054582959bf8d596bcb15bab552f547fa767dae1e8b99d51bc535d4a67dea220b82d0ceeaa8dbd9314fbe447872ae5f24fa61d8bc31ec227edf954f01359495382355fb3c85b67f0da59d40d1374e0adbea51b86025abc94b3644c843045d4c1cf6a3e733c5a2ec0212e59b92c1eb533e3db71b1fc79d35952d416cea97b6a7cc72d4e978f1ab07483288a9afa09c170af2a30709123c89ba2ccf2a8ae6e71dfba8b9a90ab802401325c30d3dc0326511b642b0ad79108761bb44d969f517db2a28e8d9c96eb12599b44a82a216c694b6e7989aad267e8b8cf113881d0c4e1862d4f56bb9db8a209c187a2d9579a4a4eca56ed5d13df173c83e71bc2e34ca5cfcefbfd47cd818310f056586c2da33bc1fb51d6f5ea5b485723f5ffbb833d64d2f3e16cb1c2432060279430b84c4ee699887ac343072b05f0e4037605c76984a7ecf6054eb2e767a31014904e1ebb6f83ede20e265c60675882ffdd888da333a8f5595c8a9e34e44867999c90ee66994dd0a9d98c10e798a89e485647a4f6f4165c2ce6b8ab77f33b42cf316d2ebeac0a3389b875291de2be6f44ceb5269803e6f19c62216a2956910eb18fee4390300522e54d1ab9ada9d0d29cc747643ae41bbc451698b0661033b2078579e163a098b0c5484ddd38925ca35fda78304f22a1e36714c962542ce713f037ac73f4d407721813aa0ff87be5bbb611836ae99b126be10a5bf63f5623507b651aa7d404015b0ffd73b34daff5a718a127cc7f28c5dfc94eeba828662891b94ef50c165078ffc35bd634947d584d8feb57809903c991b5001170ace1b7da57e28ca06685e0251241d625b52824fbd26a1b5eb08264c970879a1f21f72409ee9b22a7e222db00c04b35443b96909bc4d4047f9097417add888409ce7abda4729fed628af943cc69b8a9d76d9fd13497cf54b678022e3f833d70d0911ecd183341d22a0745c29c1d22648c16be19f54b35c03428620f7f51587974e87dcaff2c45e356296ec7f73df7131293bf6307c8d63ef54bd067b5ff6cd7589dbd15753dfac47201cfd1dc13d7a5fd2aefcfb41698d60ae5c48e831ca8cf2a33f9ae41fc89fd96914aa67696ebe1ecfea561d79e01f46c2596a68fe8ac946ed5973b3a5f42c28425ba974f5964214380d13539ca3b2fc9ed9c7db8568ee98ed69e3eefe06942e1cae7de107f1213f087d965aee61ac5c9462644ec125a1f67b8d6187b543e97be8a827db6a07661e567892b1a09aa1e501cb516bc7d821d88749bbe24dc7d2043662a1fbc3e109faf1fcf6eb12a786746f732d649c1a87b913f10bff5d4e5ee1015fbf0104da999d147e991bce5bbdf755da03b1be897b0a9706f25a391ec2436cd6632b958ed79610d910c134563faea5a3fcae4ddf6a28b15def2324935f4ed914613f16e7485e53b4c1c6a43e3115c85f8b16e4e4541cf43cbfe8143f4ec664afaf773d027627cd404cc3b0933fe387aacf6eb8d2fac47fd2267796d17f3681cbe477bd82679dcf1323a8b14c77301b6d79dfe5422c6757067f5356176af14ade51e85dc008ee20acc59f50163d43c8cdd53bf2adb085356ab29d113f0c2a9cd578154e9961d5d07ae7d311c7bfb06e7505236f58c1e9a5b801ad4690ea624b085b4ea1843c6a1f5ccd93e10240dc9472fcbd4bc5f813c80c799c693a718cdcce757f88ba7ce20b9540c825fe0349e928ac57097d7c8cbd86bf380481863c1a838b10b572ddbec30010aea87966bb4ce0ee10031dce747ebcb457ea322d685d39e0c24ad87ce101ae7039a019dfc7cffcf85a73eef5526f3f8545fbc261d28a24884ce80a2d1587d5dc149b7042904d85a6a48dc599c5aea9f03f880fc8a17a7329434e2a0423007603a304f9c0d3f48847446d8af8f078a16b76875d94984c188a3b1c60a1ff165402c1bce377194e93c782b3e9b3ac2dba91e467eff0a65772353eaab0cb7f708c872b7e3086cf84073d769f17df4f2f442e8cc73df0010b17eafbbab16df9f7b90c9e50f98c893c12e4e1b68f1d2ad4034bcb9a75315d8b125404ae6d0400915f6767fe169606ef411c37a429b1f86f6d1cf50b0e7aecf11103165e709cd3054f375fd2a66787076bef52e8d64a64087ee35d757b7d9c1deedcb1f20d18c07074a7c6ff70a79cdb8b9e7cddd1928fd20dadcd88fefae1268ffefc350c8c09d0085a53a1b8bab6ad8dd647d66314c41c7a3015325db4af67b0b03b33645baa9fbf6b2595c8bd6d4576227722b852b580f09a273764479ae856c85d2cb6e84ba43a670fb5b9735cf7d72f6e20707c963bd53c16000baadcc8fd0a0584291080ed7a7e4178a7d3775127e1ee11a4754b5296031dfdfd67089a687efaf907b4af6253eddfd93f6e0c6f85f6d03de619c400760c63b5bbead6688dfb41a1bf7d3dd699a29be2d7b9f92b604e47b15ef23a6a43fc78a70b4133db68566bd006ff827257412ebdcbbee862f635736f2059428c06fd7eefbc09b28f63ba90d625416ac1d512c45fb658120f1aab2876ea20e1ccea10110070fc836a510a263759b49d2413d5d3cc8c47e409d3e6077ab1994a8f8f415fd528f4d43a399d8bbab322d8c52c28d88e9919018f55c1b45801d8d96653165558c3301ba725386c509e9a5464f12a3a41162b1797e0b03b4c2109578b2a8062d1168cfd81802417794d86046b17e9d787439bf7616ea297ca1eeebf2addb9075040494deb7b6a301816c776c255390817bed05c91e2adec85f1f72d50cdca753d6dd8ba25fac11330dfe62f180338c9462dd4396a3010ae2b546cabf8677e0a8ad37d106c609ff8f87dde62c6f26f7aa92edac53a19def682b0562ec6a0e3096caecdca004df2ef24dc1950fb98a44e777c4645c574447120f44f156d0ca1ac3a9114e324641e59957bebb14034510f289677ecc48788af50e851240b4109e1e2467939f50de9457716849e99c7ee13053caffc40298b866204182a57a88a9e540b3536ef6b06b3c170c1494e0e1916c5ff5f0ca645a2153ee22d6c6112bfb3383cf852a695dde548d92ad960e67e221b8bcd3a8b57c8fa7b8e12a37e9b2c1c353bf203a812a9d5fc26c98d7e95024fcf0eae8ec30ef28de86acb48675c7c706c5e58b9b2593fd9a36d3d9c68b8dd7f2fb0cacf925469e184ad752105541938d4f1099d36743595d73cd5592677a9f6b15d4bcf384d4fb09c6ec830f9c90f6c771136752eb913d8fd375fb881b480bd49daba3c50f61d2fd63ea11ac707fb5a096253aed3c0b6e6309e3126af0fa88484f38a3f4473abcfb888b556f53cadf91a69c952541bf259b54f6ac47b4c6fc6ada12fdb302b805865d15911a59645ded00eef3f60faba62aba36fda006a6dea54ac1d45519a937d9ee2518e335f1f1986c283ca5db06cda6ff280527f37e58c3f7f2001258c9d5796e123b969a145534a1060077328e382ae9d67d7d0a674bab54e3c825869c602d7d50030e095ea5b12002956b4fc7b432b83be2f399196bd879876f09962948cfbacc5c8c7e91baf96bbae4b50b76be22f0bb1e039ef2ca07c6fe96a0bd80c00b4c6fcff36df7efa37faab364aa37d67c664e48b8532d2272a486dc757dca699c9f564b0864b29bd2a2195df36110a4d0fbc6eba1dffd14287de9bbddee46fe13b9c4a2a8d2e1a32570104f6a0e36ba44c96eb7b4864b65627f42e046b3211750a0b7d31655f56db757a6b2f28221aa4357f2154a94ae4bd5a1654b4b3a56bda56fab9dce7a216a77b689042a96ff429f9899491c3856e47b0feae4752e660bcc2c1168c938819c7d3b8b9160e0fd2146e1b80bc8058b54b8ffa0ca030feaf4587c7c8be7f5a45c8c6eb852bed5f1d8872981e4e3efaabb05b720ccf9b5611b92659ef2041f944cff97fea"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}]}, @NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0x6aa4d97b5f5d8456}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}]}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_USERDATA={0xe2, 0x6, 0x1, 0x0, "b630b6bb264652f0e3d69ae95ca5a4ee1fadc52875698b9c79882069ec8f269b9b05a8d4b5553facb2afe08ace707e88b179500263443f150b2d8692d9034fc6680294e9418f6737e6c72c2553c636855a7f396c9aea615ae9f6a2c828ec449974e431d6c681ddbb6bc42752ae5e133273de3c6980083081aba6ab6f572785844f1a810fa822cedebe89deefc7f49856479b6a6862869b6084d8197fd7f020c1b018f1cbfb43b785de26ad35107f94424e313b3e6bbf805ce991c2e6dc7ec02bd6fb749b81b523b0f6cccf59b6851361141c4041df9f82229aac6517623b"}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_KEY_END={0x14c, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x24, 0x1, "315bc63bd91be0c1575a6cf6a04c17177ffc77d525c1396318d404101a4b4a0f"}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VERDICT={0x14, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0x74, 0x1, "3883919cae34ed1106c5b855a3d3896b3f94bf020526da45baaad6450056ead71ca6c33022268e50e0c4f343c2323ff871ef583c0830901e7b373cfa3e455f477d402850533b9b6711cc22274c9799d91cb8e7ad3643df2b19cc2a1efc75ec2fbb30f0b45b00d7947d79a6b6d9b104e0"}, @NFTA_DATA_VALUE={0x1c, 0x1, "f912c99189d67cf27d9ec2bc4fc40956e35a9186f46449dd"}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}]}, @NFTA_SET_ELEM_DATA={0x208, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x90, 0x1, "9db7852b69d82f3354e6bcd253206ddd3f374c290ba109837082c0b42f04e63d3b3a408466b3e58744d10ece95f5f79058035e4c177351f1797c1427a33e61d6a9579da33e41760dbf1991da2fc5aad9dc3084665d86268a255b56a4573d802489d38ff5d021c9540c424837575bd1f1721f86b21d04276499267e039aa78ac0d686c96cb619ca15bf861eb6"}, @NFTA_DATA_VALUE={0x65, 0x1, "08d538ef464e234b43eda3cef1c580e0c5fe244d6148092b65a59cd42cd0c11ce0a85012b56cba72371803ea2f72b86af6f10acd7ec9b5d29f2f4ecb1653abbbf3dd26615997a525fac1be6a7d8e15ded86d11baaf001f060ee62d01f41476fc7c"}, @NFTA_DATA_VALUE={0x98, 0x1, "09c3767b2f7cf353e30fe25a3b4ca327dbc6d7e83ab7ce36dccbb33984e85b83751718998ef988bd018ea6960241559b8801bd2b042aa7769e53158977ce31d25375558fe106e45d8997c0f9680408daa76440f35da905e38ea264dc01f425a5c6dc0f77d0c1f391fd2910a9fbb14f79aa22fc2138bb3c5afe8dd9175980b4453b210d772c8d8ffdcd53236a2520fdd4d2a90f9f"}, @NFTA_DATA_VALUE={0x4f, 0x1, "82c259ec5480fe1adeb932f2b852c30bdf1b384531263ff1061ec5f47f1561a4b942e680a1417a1abde2a505bcee3c541ca28f5814b337b25f695726cadaca361819576417a2d28b86dc84"}, @NFTA_DATA_VALUE={0x22, 0x1, "fc23d646c66055ea75196b552393577f23ea6cb4e04053c991ed19ee2640"}]}]}, {0x1268, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x1264, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x50, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VALUE={0x1004, 0x1, "70808ac33966ac6d12d84aa3640ccee8d72a686541c26b8c7ce449449fea7d53a55775da0b3a8ce389b27219b49677dc75ef7220c9f3f23a323a4d07f317fd51a437ec32e36d239ec189b951ba9119578799c00d4272f991094ef9b966deec35e9927bcc853376df45e6f09dbdbeda0a06e8de182b8c989ac56ec8fc6af83dcb44d574d0c56dce01c0c5c84513c495eaff6d4b66b733beb4bbc4a2bbd7784ff5b93c3b7343af63d0b33d0b0932b9706d7c06ef5e9a10e85ba35e37b60e34a82e7fffa461f4295480bed362bbb30a2122871cf4912566b8bd237932bd286d6b02b984bc37f40819aad3f78a562bb0ec95cab00b6a5b2eb319fba999980952196f2a1c14d39cc4f141de29edaaf606031471d45c8cb75f0c724921501a64579dcb12e8d36316903b15ae780681ffdb457be17f6ecf5bc080c70496299ea64394452f98599741c7c8c4e441da97e36beada9c26f9461e37ee22b89f42ec4373e3dd6366b4f85373983983106cbfade6f44ddaa2d4624d2674f1fa03c995a37aac175e238b6d704040cf4d25d71f2335d308015defcc34dd10a08d47a24d5509425a731d696e3dfdf91f09a639bc262c9be24d396026dff790a4247ccff92320dfb1fb827c0f3bc29f3e20b599bd3b6f828c988347487a234aeaf938cfd2a5e316b0468d7b8faab328bba274d31bf7404e3a2c71186c7cbead6f89db352e509cb052e13da02cbfad0e9bd5833bdaed53c336b950c4990040bbedbb5f2629943dc36cce7e1168c1ff6b6d0b785034c865827bf2489a86e23862757400790ff7f652e0fed40c6bb02146d4d2bb9a985a8cd6f15f9a3014aedb41b1be318fdbb7683a5b5a27e933adcaa500fb0342a7f8125cbb07ccccf6babfff141ecc550baa2a3a9aa44f7ddf9dd90afda36d1c7d2c1a562206d1445461637b720a9a2ccb372086773fee8fd239587bd12947985dde6e61caf3332babe0368f036d035fa09b13628474c905e65a56d7d58a151a8db8fe2be699da9aa89bd45c65ade9b204b5793bc6620d530db649250bb0c17de2963ace151d91f433c26968e37f442faa944736087767e55c1cdf8e61ad95e467e8c0092d59d19b3a3ca809b2fa0c3a4a0f968243365db1b8c255c07ac01d1ad933b55f4a89c20f36cf79bd8ee73d3679a234673cffae808e8ffbe3366dfe57a4bfe48c1d900a3f689a643b427e6b53a3eb74fc000d736dccd8a01c1fdbabdb86e2bb7cab2fb7b3a092b93def214b1ea6fe96dd6fa3db30e286f6d4ae8d244e54e7efa61b19131ed89f1ea10e94cd0bc3c0c15f86ba5f68851c29275fb3e4310f3622fa239d3935ad0a287a34716c33dcd1c24bc430a82b7f1e78701214dac30d878f603c27492b520dce47d2d953aabd0765158a0924470ae8dca3a98a8508d53a88823d2451d988eac7e9b252520ed2ebd994413286003130bc88718ab90156d72f298341d78ec553ac84b2dd7c8f0888c87105afd5e0d7fcdce7296893ca76ba91231ac67da62cdb0d3fbab28ff0bfbc4966a6d80452baeaf7356002ba592eb9f06e94ae181bfc4c3d6b6d11a32da74170376e5b3036ff16a8ff10c6ba4641f7afaab550d20d6e0c948dd87e01d470c3a5274b2a412074a0fd2649687280e60b8111cfb73d62121be96c49af0733464b3acfa5f0267ecffae6f373ca2f66664f96b2bf21eb7317615ddbe69143c0e978717d554a866ce278b0287537b3132cee2d7d5391fc9ee63e1d8d8edf69e66d38c129058ca428c92c17cceb3ff6d0d7d85e871b5b4d79a96d644eae44b75040f6c100c12bb32413e0669913f9ebafed414da388745e31e167c0c0f675ea599c6939b49e4c46bee81b2b820ec7f8094706b3ae0bdf497e7cab594195131b987ff0f55886281a8a5d750018ef7c307187fa8a5f8338cc37152352dbb4a53265ed75eff9e6fc937437dcdb9e1802f60b15674b9d903ff66a73a81f5bf91d000455d879f2e113028acfc3cd0e4df698db082623f0b00e3978efee5e8c0d879feb221b73bd117e37cbf20dff1fda4806acf32ad8585fb0308e1833352971df1dd251da4c96c0338eb74cb77e7cb6916cc9a2a4f51dad0dfd27ff9bb69f4ac0555a12c2cc9c202fc1df25dd13cc1bb32dbecd5cdedd4318ab7dc8e7ce2661b84bb9919938e4417ac4d395d295c4029376c78762f0e49dfb60612e3b5a9a0a7f2dc881af8d12d4319fdd505ad8d2d5d038f7e12cca76dbe77899cbb763fe5b6272b511ac1b3db830275466584f02cc1a1cf0d30872327cd702a275245fb36b428b025d618fcb920a38fd68d2acc4656da6883c1d9f723abd8a58c8e3608d7c9592fe93ddd9504c6520ce67508f49c38de776bee7fb94b95fba2e66dd0387c0dde65898528cc9c8b561f362e623be8ec8e0cda41389076b299a33182f786c317d75aded646147b390e72fa4c13345f02c265fca018502e79240fdc4e14556fab866dd8d48cc4047ee2d72c7fdc2ff08bc403c6593d49c545e91d3fb0f495c7b23e7740a072c84cd69967a77afda41f0901eb209284bf7052deedb34f3ae7b5545535f40f9e0462f236843dadf64cfd1bd9359b6ae2ce0a3d1d0861c6de766b13eb6a62fa356cf027f1041c6e3834e3d51334a8e6f33369806aad0c2cba7fd47846b5ce69408345d2ffc1583dbbd72ad56f27844ab051740f03c19652893a23a50c742f276d13ebf817c7373f3666f55749fd904478ce53096e49d79c091255cde266766b33f81bcd4ea17a467f5f203f04f6e5223b1100194ec7617b5c1d763c12dce43940c6f03fe9dd110f3ce916f27888b143801f186a9fb5bd7c31d2d63f0307b3744f46615e91d0fc091ef934c93936e04b0387d4f81661d602589d087a7a76357d951e51a8b2984e0fa2e24a481cfda9ee25f8c34fdf7afaeadd84c210e63708c55be0c2a94e43b93b36f640dc20ff60435168d542c4a67de907fae902717a51b834b4d1064b1f5632f3a031adffd84030e8099e7adfdd9299409e406890ac4e3c65475b15dd940a3578fa990bd4bf3bfd779a62fbe912b51dd75c7f2da1e7327d1bdda48e0ce8c733dfb68727348a86fbcecad25371b472ad6f1c1d1c82ab0862085441658ea4bf5c8c35e3f78cffa70d9e5bc59be765f3b031a61348ef3accfe1ef431a3a915449c37a27450a4a6aebe206472d8e5765b570814a2601261c69ee894e57a77862ab670ce1bb4a67ef6233d8adc6cf1883ecc319b07033eb2bc191790032b075c90384e4189967754b77e1e0bd0fb5bf42b359675fa11a2ebd3e002a131c1c2d9b71e2f2c878476e2d711257a69f6b92a81cd9096a1c749f9c3ed0765d7c819f1264a190876ad0647d39f01f9faba237ad05ad8bb5260154078c2f934d027e28748803d6fa75253b13ec2fbe5aa2a0380e3351d3e4efe41d8bec9f1ea8ca97016b0ab5ad47858533d52254b260ab1966eafa5ba4aca62919774cc58bef2d3679e12aad252f130413b81fba561e4bc028ac169dc60be2abd5b68e790d43ec56d4fa3bf976c8b826073757d5f92f335654f77cdc65b4780c4c3ce1bd20c6c8a901ca591bdfd7bfc5db2b63f6d4b9e43b44f1233c8c69bfe2b1cea2a2b59582b0e7bdeae2b61da1bfa13d4e72a17b951e268c7fc55c48d9c636b8df8351e4bcac86cf3582ead7872aa643f540f1b0bd1777045f8e0f55b9a9c3a57165786d8fbc7a523a0c6c56fdb0e2a44c774ec5dfe39e0038ee71172f1134bc578bd53a2bd52618a833d13036f5dcf2eaecbcc84bfa2dd6216050f809d896c769ab3be9ef87dcccc1a3b6e1a7feda21c1022d72d515ffe0fb89633d6f9d2a4f586da1c2c45d0eca1a345ebe8ca3ae1c86cc5e729d2a0fa27634922bb81ec8f67f742f087b2501cc04a54656c82e9e948e081f3d027d8125d7b1c168a2d79a2f0914af420f02e3c7347744d828c0b5bcf8ce6a46fee3f12ba14bddb1a0e975624be93aea12cf863abae69bcce18fdc21a7885f0e54f91023c10544ebab956c711f3db6bcb527737050faeda1522331229ae6cb7f7213123c3fb7cc11d8ad470f327f8e49573579226c6c6fcba0219826d84a133e3ca840671653bcdc89e9dca435c677807554ada2841d060a7fa45dab9e3848e4efea17da720f93734b64b31af314ffd8e478959fb91429c93f770608dac051db54812ff8a5cb0dd355479a19f23760a9f4752764828b11ce0ed41a643f780d4d64fc0a1477a6e985bfe0ab3a4c191a61f0c69f97a64c2f0751f331b5253dced2a9b434351dd88a353be6ba8a34acb0e9d504e88bdb84f946edd6acbc83bb755b5b76ecdd23d824eb024138018184bd977c77c41cd9c67af0b5b3a2951ca10786ab3b7b9cd780f17d77b7466b9ab5cc4b6429f34b1c37cdfc12b3cdc447186dea13091eef4cb6af65ae9f5f13e0bbad932874dd6b581f8e8bd6b4d9ab05063973859c269d5ff9d52fae51ef3bc98edf95ef24652b4acd705e9c2b272a16d6410d9f9ce12c68e165dfd1b55d3d2fef1c049176b94d5c5de61b9ef1a8a85be5c5bcef5b7df42ec86ae372021d776d532de198ced46a0511210b8338ebe79040fc3f8c92756052f4a340df429171ef15b238228b15b24749d61f7b9cd3962608e1655b1e9cc1f8f64438e0e7bb9b606126bd598580f6d8d4b9313315087b8d611f86fed4e4e4153ec268e31826052a257e3ab86a4007118297b18fb05ebecedff75bc28c193a506bf2330e7ea9210a4caa82abad0780421dd7baac164bd473baf2cec9e64ecafcdda070d3ace2d6d9f65a7cecf6d15267908ed726645b58e14a01ab76199f7fb735d02e754c16249440f04b420bd6e183fac6b7bf8a7397c4289c348eff4726308eb81cf3089c4668cc93f634120c31265583b70203d8f724fa6e8f18a4b2f905286ebfc9e501da28ea2e1df1697de9619e940a040b29f6c181916a89d836ebbdc1eeaaf45fdc20ad08c172943935fa7d58ff22e53dee2fa937faa1233a6588c1dbbd22842eb7c6aa25e0c5def0be56d522bf84b0e6ef955cb23c7a3f897e26c1e6a70f78ce2ffab3ee0b13fb26396670270dd03dfe7c667d3772e336c27eb7adfa0757913aeaaad8e940e8216124c087807343274033cf5ed81e5336dfe22558cd5312a166a1808124a3c8d2b2722a4ff6238e47806866924e51b6f2d9d3f42b8c7b91185e65dcdd9fe27e223b367845312585e217e233c59bc69c86bda8ad6275783d6e05f60e4c9074015d814a645dfe8bcbcfc0cce35fd5b6a7ff530258e7d6bb31576216b8b3d18d9703f6100a1893b44574a29007e0615db3b91807dce336ce425cf346f284a117818fee0381b82e208ad61b8af3f7ee15610f75669ddbe237d0d8427a1d1fc63c8c17dc88c1e5a8f75b132dd712ab6fe1d0215be5ec1f40053287ce5e5de88a93d44913f38337e3f22a4764b6bf3bb02e97a671868b5b1367ed13ce706b7c3070956e4c74c601831a82f365d010b2b94f9c07be221cb6cbb9542be2db9430849677d8b7d5bbf912fe8728a9e22ee2a0aba29db7968769125e07a66e85928c10880a2033e0e576c33d0a41761d34bcd4faa50b3c7686e4386433048b38ec7f701e72498e3eebcb39302454bada69c83f5f3ee7ac4c4741fe6f5e77b297a6daba52a39dd0a66ae976ade295b2bbf803b47c04b1a375c73fe9c229928bc62448d1ad9fbf8ff98ad7a9ed8dcdcf8a0b1a21d6a680d614340f714b13937362f3c08ae54a741ba78df35e9a3ad4b03a9e188d565430cad68dea5368c0401507fffcda8dd33a"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0x88, 0x1, "63c8fd22c2d1db6b03e45a364c2a02fd1aa377d193cfd3d436a2bea69fb0aa2c7b36937f2d8dc514f83e764f693a1b7837466dffd60056dd96a1a021775657a4951dedb3a6c9d61e07ae76e39c0523d503cafff3bfcc9eeb8ddf7e1acf452b21f51dfdbc1c062ffcfd06587b8c74375a97c59dc355512bb396b81e4cd28bf53a5b8e6c08"}, @NFTA_DATA_VALUE={0x41, 0x1, "658cb6dfe01829f42c70457c71c5d2f66507c640fb8f9897e5339e3fe71cbbf8656fa44074be8cc00e6e345d683c5b004fe75c92c3ddd79c8f233428cb"}, @NFTA_DATA_VERDICT={0x64, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VALUE={0x93, 0x1, "a5201ce0df03e9705795b9df9919b9cc87bcd8eb1864a08872b2333843a8d738997861c1da4248e9f3d9157a93cb68dc0c17e0454b8559174f62791b1663f66a768e51333a94610b4164ec11fa000d34163cd4ae6c99c3da284bb3c9c0aca76f4fcc8b1c5c159b0c26e6ada8b7a5747b6d241dfb390ea5ea87e140ae9c6d32256573a4397c3690785d563c95337048"}]}]}, {0x250, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7}, @NFTA_SET_ELEM_DATA={0x98, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x85, 0x1, "b7c29b53089531743b166d2da617fccd0be075137c70a1f9b4cd6c06317b1b1acfb644e15e05109126a458e36ba2ebaad7fdbf0714d8e3c82a6729f564b90ef94dd5e5cc52d26ae6c377878fbd6a989d7c5a20e510282b7944d76408d7063828d34de0c56ca58156ffbfc94338aa373333b346e4800d475a5aced487b9b278eb9f"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}]}, @NFTA_SET_ELEM_KEY={0x1a8, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x5a, 0x1, "8c6070dfdd680e5734835346d351638df9689031c805ce6435e07706abb799b1b8619273672e992689ef218a2a1929e7c2e78713f91b3216f2e9bd884eca2ffbcc2003410aaee0d77b098e90b691387256fa683da42c"}, @NFTA_DATA_VERDICT={0x18, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}]}, @NFTA_DATA_VERDICT={0x64, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0xca, 0x1, "7986555f2b4c8dccc548959218ab65464ea42e25d14e381dc64ac26f291b3673f3ea28b6b3ded0917d748835051ea523bd2beabce81340bed7e1baf73796dd2c496a29467b4ed83a02a1c99f8483ec6c7c6ba4dcc2bd3c9a478faeca3a62fe60f23219857111ccee3fbccb9956a0c571663974397d8bccce22993b235aced3f061803b4949ed3b641c0acbff371c1a320b08e300488d9008f827de83aaa71988a3e8e54c9c78388e47439450fc30bbbd37ccb13202b9e3ed89bab98b7c350616595d77162c84"}]}]}]}, @NFTA_SET_ELEM_LIST_SET={0x9, 0x2, 'syz1\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7ca5b119652b70b5}}}, 0x2b70}}, 0x0) r6 = openat$binderfs_ctrl(0xffffffffffffff9c, &(0x7f0000003780)='./binderfs2/binder-control\x00', 0x1000, 0x0) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) ppoll(&(0x7f00000037c0)=[{r6, 0x2288}], 0x1, &(0x7f0000003840)={r7, r8+10000000}, &(0x7f0000003880)={[0x80000000]}, 0x8) r9 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$EXT4_IOC_MOVE_EXT(r6, 0xc028660f, &(0x7f00000038c0)={0x0, r9, 0x2, 0x1, 0x6, 0x401}) ioctl$sock_ipv4_tunnel_SIOCDELTUNNEL(r4, 0x89f2, &(0x7f00000039c0)={'gre0\x00', &(0x7f0000003900)={'erspan0\x00', 0x0, 0x40, 0x80, 0x8f84, 0x87, {{0x1d, 0x4, 0x1, 0x8, 0x74, 0x65, 0x0, 0x3, 0x4, 0x0, @loopback, @multicast2, {[@timestamp={0x44, 0x8, 0xb9, 0x0, 0x6, [0x9]}, @timestamp_prespec={0x44, 0xc, 0x23, 0x3, 0x3, [{@dev={0xac, 0x14, 0x14, 0x25}, 0x1000}]}, @timestamp={0x44, 0x8, 0x5e, 0x0, 0x3, [0x1]}, @timestamp_prespec={0x44, 0x2c, 0x91, 0x3, 0x3, [{@remote, 0x7}, {@multicast1, 0x80}, {@broadcast, 0xb5}, {@remote, 0x9}, {@initdev={0xac, 0x1e, 0x0, 0x0}, 0x2}]}, @lsrr={0x83, 0xf, 0x88, [@empty, @remote, @loopback]}, @generic={0x7, 0x8, "4eff494e2003"}, @end]}}}}}) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r4, 0x89f8, &(0x7f0000003a80)={'gre0\x00', &(0x7f0000003a00)={'erspan0\x00', r10, 0x7, 0x7800, 0x7fffffff, 0x1000, {{0xa, 0x4, 0x1, 0x1c, 0x28, 0x64, 0x0, 0x8, 0x29, 0x0, @broadcast, @loopback, {[@generic={0x89, 0x11, "e948732a300139c2742abba76a4cc1"}]}}}}}) landlock_restrict_self(r4, 0x6) ioctl$BLKROTATIONAL(r4, 0x127e, &(0x7f0000003ac0)) r11 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r11, &(0x7f0000003bc0)={&(0x7f0000003b00)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f0000003b80)={&(0x7f0000003b40)=@newtclass={0x34, 0x28, 0xb08, 0x70bd2c, 0x25dfdbfe, {0x0, 0x0, 0x0, r10, {0x10, 0x5}, {0xd, 0x7}, {0x6, 0x2}}, [@TCA_RATE={0x6, 0x5, {0x2, 0xa6}}, @TCA_RATE={0x6, 0x5, {0x3, 0x3}}]}, 0x34}, 0x1, 0x0, 0x0, 0x800}, 0x40001) 35.021571956s ago: executing program 3 (id=6697): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0100180004000000040100000400000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="0000090000000005000000"], 0x50) sendfile(r1, r1, 0x0, 0x15) sendmsg$nl_route(r0, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="18000000720009d900007000fddbdf2507000000", @ANYRES32=r0], 0x18}, 0x1, 0x0, 0x0, 0x50}, 0x40000) 33.972816369s ago: executing program 3 (id=6698): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_ro(r0, 0x0, 0x275a, 0x0) read(r1, &(0x7f0000000900)=""/198, 0xc6) r2 = socket(0x40000000015, 0x5, 0x0) r3 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r4 = fsopen(0x0, 0x0) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_OPENQRY(r5, 0x4b46, &(0x7f0000000000)) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000280)='port', 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4) r6 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="380000000314230c2abd7000ff05df250900020073797a310000000008004100727865001400330073797a5f74756e"], 0x38}, 0x1, 0x0, 0x0, 0x48845}, 0x4010) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f00000001c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000100)={0xffffffffffffffff}, 0x13f, 0x4}}, 0x20) write$RDMA_USER_CM_CMD_BIND_IP(r7, &(0x7f0000000180)={0x2, 0x28, 0xfa00, {0x0, {0xa, 0x4e25, 0x10001, @local, 0xb}, r8}}, 0x30) write$RDMA_USER_CM_CMD_JOIN_MCAST(r7, &(0x7f0000000900)={0x16, 0x98, 0xfa00, {&(0x7f00000008c0)={0xffffffffffffffff}, 0x4, r8, 0x10, 0x0, @in={0x2, 0x6e23, @broadcast}}}, 0xa0) ptrace$ARCH_GET_CPUID(0x1e, 0x0, 0x0, 0x1011) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r7, &(0x7f0000000800)={0x11, 0x10, 0xfa00, {&(0x7f00000007c0), r9}}, 0x18) syz_genetlink_get_family_id$nfc(&(0x7f00000019c0), r3) getsockopt(r2, 0x200000000114, 0x4, 0x0, &(0x7f00000014c0)) r10 = socket$kcm(0x29, 0x7, 0x0) sendmsg$kcm(r10, &(0x7f0000001980)={&(0x7f0000000080)=@in={0x2, 0x4e20, @rand_addr=0x64010101}, 0x80, &(0x7f0000001500)=[{&(0x7f0000000100)="d77c2e789eb42c40ca509ebbb53c95ebf4ffca639ae1aceb9bc9ae89efb6c7e017674633a22278aac7058cb699da4b76286df66e5039964770f7251a528841d44a0b7403692e59a616ae9f984571a926e66544a109dc723e232004141af6bbf19bce3d2c490ac8f422a33f74301c99cfccc1c84015c3a9b1d785e121895b4048f3c78413dff102d523fea9d5775c19ee3ba78ebac3686e7d52f14833e8c3489c7d0c7f705f57844ade42ee2d39b81e5f80f145bdcdf11f193f4255a153b75b2bca48a32a1f9fb8a322407f723f43f271", 0xd0}, {&(0x7f0000000200)="96509c21c7ac5894524952491ae94c2ecd91cbf7439d67be9db452dba183093ce005dead33c85454cfe398bc8419eb66abb24095d240e3a9b0908baefb987ba409211a3964da70f5efb519410e16e2762f59aee9ab11180e5427f83f3f46d06a5d5fbb3d39d01721646d586ca27009cc66185a1a90133452f900923f52836f56020d909d10ee2150473ad761b9cece754132", 0x92}, {&(0x7f00000002c0)="57cc457415242c27da81dbf265c372e721ce53d513b32b356725fb1265efa67fdf43d4a8fb2ec5631e88ca74ec6361d0ecf1c9f39d6aa486df538bfe437d6af09875a631601120204eac567b4e66c7db3f5f7c61d6e90d4f2e562d3d53b05774be1e2d8ba3d0bfd971ba28bc9f55", 0x6e}, {&(0x7f0000000340)="a680d2f2f5f82fafd9f28f72b399bfe113d6381944a37d892c1f11b8ee6d8d506b23598a31798ba8223fb044db03fc655fe8952a3e10df51c904ac832d8c6b47499d11718cab7a42f13f009a4faf60066ec2a61b954100864e8883753e376ed301bd83f73ff09e5bdd2106e3daa0a635e4fc6983d26abb80fc0e0a2e4d5aeeafa9d68ddc26cb6084326856ee1edd1e1e0747820d542d8b725b7ca4549d2dc9ff9ebaa99e4c3c2122a4b85e9259d6e6cc9a32cb157c46393a6688b6231b031100693162721a84d0e828e92ffd3c679e6e05b36c6122fcdf5d4d97b61e70700a0750707c1530a3abd68f441ad6ef2b35389548796ed3969844ed51ab2a91c253460bc39fb9beaa528b5d2a67798674451f578f431b8f7304ae1f394913bc92dbad0e4c8f5679c495c347fa1031d12db0e3f2bedbb4b5fcc22ed342de69e8fe437cd79f2b889b9a5c3be5605448a4f538c3db9be664bba795c671bed0cc92924cc8c50b76f9f636c50ac32e8e622371ffc328d1a01bb4c40a89c289d44779ade089de948df432ce02372406302568b2345ea4998ba61e34e242fa62c105d8c9ee362d5b6e7b4c94745cddb9dc6092d6fde0210228020beeac2aef0ad1b9ace9ea1a1e93325e54cecaa990689547c12cf23251b06c3ad4d4529e5e691b7152abe5f63b4a2782864e23badf288a1be2e3572bd5a34690c95cd913fb8b5680c695aa147c69f0749c99f9b7ccb7c6988df3934038d4b73d24623031dee828abf7f164dd95fdc0a32caf94535a76b5977a846e1a0d8aad66408613c31a743864e128a16e011f4a7e8475d534e8fbfe7dbe85348fc0766e9a33983cc339f069759c7a18df44ae8edc5dea566fb9013083655173609efd25ba9d74bff229d5e67ccfb1c26ae7815cd2953f6c2dc872ceaf4a7512407174bfcc05111fcc3bd1895db1d3f97efcb50a17529877d381fbfc11b438cf5cf9d37604bd4d1bc2e4602f1b9700aaff9ea4fa68f3a94a8a4cf5eeab59531fce17881705c9104fc6b79b97e2a1b0db9b09de8d920634588506b557394e71c9ec3dbe587caf12c17f37837d2748abe3f5e67f4293ccea7f7dcc5a1eaf57ac614446487e6cbbd5d3603f82dbe29c9ff3fc719b47d1c1f44a581b0ee66413955f6991015fe39f0c0de1ea11942608848bbe8b89a0de0aec5da307354b278f176137b77a8d1e141db9c3869425904012cc3f535f302c44852399eea16aefe9e19a706e87c91d50619976a80214ed1540fe82ad2e539e7f323706ec3906b8aa8094b429c23511ce576d3f6fa7dbb6ad8ef2e9df9dfd5b66614c052c90192d53ea97d41ae21ac5bee75fe89152c78fa3010095686fcd6d3b8257def073c3538d97c4d2d03fbfae2cfd320c14203c67593adcfd63a47c49d3cc4774cce8c0ff94d60e7f359585abc6e87652e8c8ba2f033ca8f648ac39a411236e9e3814e40ffe458c04f80e814d8279156f889d13cb9941c680d879a6d33b857f64c8d4c99d0e8ed245added61ba51492a9c2367f3910f88c9ab4b883e532c3c7ed0a752c760a60b06161d21a6a3be3ff592e5eb511bd3a2bdda0a7ee2ab80ed5857a4c2db383d35204140a9c548e75b70282174d62e04ebf2f6d2f2bf6cde4b4f4ec5d9a8f71835b0c0c5b95932592f6517b259de8e04cef95d47440ba87a48c563a6e259a3be11eb2604e3730f3a32586f59506b6a86cc9dc82a8bf77b0155618e9c2d62ce017619f928d2a6be1fb7480b4d7ef93044f02ab532d1155ed992afb7fe2d087dc6b7a4e712270815bf3988345564672d38e540a3540acd7443ebbf84de4da6f68d398a1cabeb0f6f12ce553ff672f7c0fa9442aa8f27775f6cc04626476496c1eb80fde08f07f70e38a4c37ff60b76b4dea2adb233b70dc50fe99995f1970cdaad9e4c9580c3533f8f342fe71879d7422ed5596e1a465e655bb61ccb34d0e0cbd1e7f72261f14aaff8c6e1408562ec95277d0c4a05bdb5d49d9ced211687c60f840b85030cd12cb03dbc69f058184a313fd42e796ad399f808235fe86c64c2dff4283a610629355d7406712ea60fe66ad07217111917a7cb5173d14286085f09742dc38634cc60fd9498bfe1bfeafec6ddf9a0ecee62ba99d190161babb8f9a1399042c6d883ee0ad5bd899a35b987e15cf555aec6e7ed7e3a7f8c5145f83995c6a626eed50056bbfa3264d4a15737e7069680111982ceb79480bd6c6c2bbbc13d47b156a68a1a37228d91883a1dda2a7fbb672838539523c2bff181fc05f4b415c695f70a9e737c5c75081621949740a52d02c7692b1475767927b1255969bbaaef14ea562f1e7606a2ae969c618a74d849f57eccdf24f2f7ff037e9d2f43d5825bc7da276778171dc83900990a18c5884db6d09b4b3458fcac8d01431f88e03c35fa4b9b01775837fdb645c3cd709672b20234dff8c4b63adc6e25f1813813aff0c357baee509f26d19bf2b75c2663e56714a678f4294f48e3d785cb58d2170c9eba769637a503c946b7d8658a370e6022fd8a0ae42c68439b21308c8f5d3603381b5a8249f727a082eee5b1a162c052646e517acc7b58115bb100f21425495d209fa8e3b030ee7eec9c0adb656bf0c167fcf427bbd8f3c9c2459fa5328ba0e21492795f4069446d5af456f653232da96679f9f1d802b7580c09e663c89b247a3f49beb2789a3743dba92e342d1a645ffd999401cd8e8b464cd8e5fb33337605d62a7486b3dd6da7bb6f097a03e41278200e0b91353c77f0b76e2aa7a5e4b663d4e347a3ee8ab39d1c83958b2a61a7b585a40481e976c30e54b8fb26b499528e69e464261a98cd7d2c2ce398ee166f80ac4ac91560c2fe3c1402a28a7d5bba6f7a6a2177a5b4570ba2d42f9e059a11eb2b08154a303fad37293f243d385a3b26aa83f3a34041a06ec4b9c74062fa2db82a4934623a05589b81c564fe00aad6fe25faa32debba1ff0d14d70fbf0daf332fe1d7e0bae5a127e950837b3d5069591042ed58815c6aea1536c7b493d23d89637c369613cbea3c3e9ac3a5f3fe8f9d3c0454efa5893fcf9cce0ab4dabbfa1bafa40533181302ec801381559effe57ac1154402e2c04a118d7d502f3d55da3216cfe62c81be7a01d994d5b1f7ec7f9d91e17189a04a188fd08dd8fcf4ee689e366ac4c62b863f12cb4ddb8eee4e61c96ca7ffa33a05f7d75aceb555ca139719c73e8a1335b1d80bc809aba12dcc398bb488662308d77e0b665249bbc9342d3f8164b057cabfea10388a4274f26f5c657d5669316c188779afd6f02e1bddeccfd28df63ec77f67c7cdceabb4888869a2e7b71f422c2c93c2a37848cb12464904e12cc73a7572af2f3d85718d9de07d781ed74b3b5a0b22359366d7db1ead376b88e9e39c9b47e0a49c293e90aa6632700b19245a358646f26a2df6ddbb1f04b6e4221c00b75b0a558aadde2cf62e51cc24aa33413626faf1b540c137ab5e0bfbfa9058bfc071fce635e677a358f764fc7c3e65da3316044fb11f033be32ac6160430818f09cbc0994f6ef31585a6350c92d155eb50cefa7ccd5d301d60959360a306e81c7b22ba5ca4e92e68890273f47c6e86f5510b8b54c1b9a14cdf6ef3bb8c94417977d057898148fdc31a159a6a8eb6deee4076f9bcd872e2f41a0ceab5c0be9e87c8d9496cc53e895b78b105d26d19d058e753573a899b073996ee8074669449764e5b0f5402cea0f0a0cded40ab83444295bbe26a5c807f52e63fff2f29a02bee3e54de94c885aaaa60c260a114c72317a0b64eccf0399d45bf4c42b4159e5f47fb8a0ffe0fc17cd6e8698ee6158f55fabc585a176962bc9d39a66181adfc8bed26d74ee34139bbfe8814b71b3ee7e9da1b2a5c111dfc9b0b769581c778b2d479a61d5343ea74c4f63973c7031a59202718499a5c685a23ced17fc2e5b098056eff52ba7a904eb2cf1c45105476e709cadcc53347d9f4196bbe64348ac4629b08b3cb0d65e8976a98395f0c859dfd1de1c48f6027175a45f1b183b4d1d5527d09757f88c409b301d1437cd6575cc061d88dc0b0a33b7a93546e0fcbcd10f72c0609c05e2043353d3405d07a35fccdb8514ecc6776a74c8a6924ce0d6fa55bdb0e017fcb1bf49ff471c142a47d8592d19707c6ce8d6bb8b4c6874d91332f0a05eb97087d1b9b9bee25cd29ef2a6c35e08c748e4db277578c8e1d326d6f13ddc9ca6c6c87989ddaef597eb61e8058f937e6f8490de2491815d9acc0803f0521838422fccff93a5b8c4571a9068ce09d0c0affec0fbe70e05280163e2aac26375ad782239e2509468619fc224ce790e3d93b95f94370ba51865e2d28400ae5cea7c93bd8ac682e519871632361b0c82a3dce1fb81abe84ecd24ec3007511b61f8d27ad8529af960b70ca98e78f47a32b3ecdd86ffb56223ad16167d6dc7a5e44dcdcfa471c558c69e31d56e204483b97ed7d12941420d9e5821ca3f98c06ca3e472f22a556e9bfa40fa47fbf399b25834a1b84fb3ba38dd7940f7eabf7653b241a9a71513294cbf4142d778d20ff4c0062ed3eee4207b7a2d585134d9e55bfb5ab2fe784e34f8117472d5c0a7319f3571f5e854fd6e4181c2cd5987ee5482083e7763bd6ded667f3c2769c0c6294062939233a70c9bf33d8a14c91b45e1c2a40e507940eeb1f7fedb73be9a4253f3b7b31162fdd3b0888c6e4bfbf5ea3fae31bd10013e3dc85a976500f72e4447ff2cea8c3f498eac965c95c0e07e4ead9629da3e3eb72fb053349e30cc28a04906ad646a57148e29109b9d9414a5acd40dfa8993e2093ea8ca5d509eea6772b5262670eb8a12e8ff64aa6d5a2818a6cc8aad79fa14820f9fdb7447ebc7bb07f2904e8200cbf82cc6d430495c12833900eeea28dbf9b0dbf45578ea9d78b550353259cfca85a21f46d0f5f48823c425a31f778076bae9d0f853df4d7da558e839b237707fafb4ffa8a9b0b806cfc69791875cf6621dd506acb830d8eee173dfc6bdaf11bef3c0a64498f1cba4ac32d40929e0c14d02cb88c645a21fd6e7681deca510bcc5a95e1c162770c7cd46d5714381d04469d83b675d8e277206376dedefbf31b02c94921c5269dbe50fcd0f22449a07653cac0c3912525f20eceb80d70cb776fa7a2cffb316ce585c9f94aec372ac7c4adc8c90f6eecd790d2d56397425d24b8e32e376303a5dd2b333617e782102109304a914d97bd47e21739c5e23b35f2e8a5be5963de7eea899241bcf0c13549910fce91e8326379b4cf2ea9b77a33392d6f652f9763e27f29ef10ae68cf61980178f7ef777781d7f27c9f65408a96c8e4f61900c2bde86bc0117bd4e1944dd96aa7299f5238ba2eabafff2b35049f9bbfebeb1c18f4f8a2181c0c990fa3378ff58c8c406f9e2f3ea34931d7e32d8c9301fa52bf6ec0440730a611bc14d79e80fd3ab4de79314379be3ad8dfe07008903c62cbed599b8df50f4cb8e15c26fe7edb923da027f72d196034ec0933862a72d99a8e3b8982c4fdc63fa082162a9b0c5d763cb1bb1ab05a9dc0b29e6f2c72a6f8dbdda60417f6b2bc4f913406922679f5b8f71213e9ad1b2d3ba61b5b6675dfc9cd24e37c17fd87a4f11e1db0bc9ed396cb9031556911c7cd9554ccc1812c0b8f378017737a3b1c52f61a8976f859dcd36b8ff9192309b888189688d9bb31c8a7ba1a267f6dc127ad95fe29d109356d67863f3afac0752de97c8c2b530b9835f97666ac6cc07cbec46dd833bc44f241287f86f9dc5e4c864cf0a8619d63c8d48c9de7ae35ddad8e8726", 0xff8}, {&(0x7f0000001340)="f4fe38df0afc9f3faffa1587f73603d903cd4efa2b364159f8e6d7f75d401c58241f9a84fd64f6ddc701f09acbcf480471874ad4abf81a49c5253786aac646c7eddde6fb34b52161e07ba7d8b70c1e731e91bdd6712d0ab2a84977ec965e941bddfa6ed21fc670120285417bbf0218d839866c6b2a0c983fa407eb32948de874a23cef9572aa2c8e7c340d7a399b8c62c24e9790c6e04003ec48f1", 0x9b}, {&(0x7f0000001440)="aaffbf2a397ded88542a45c8084fdecf39308ef21690adf07e20b18eae1e5dbedd75765d9e1131fefbc94d848d5e25b7b4a00b268bc6ffc8dc09fbb46d6baeb75fbe495adfdd348d8864bdb196893b933278fefa566c46f894a5c2e27a581050c737b7909774991557f67c260b3ee634af", 0x71}, {&(0x7f0000000000)="d96934070bf50d8d0df0c9f8ff6178e28d95864fb69850f7af510e7bba3985d9b883b82fa9d30abb8b012296108061d3", 0x30}, {0x0}], 0x8, &(0x7f0000001580)=[{0xc8, 0x103, 0x8, "ea57a6131dec574364506c769240cd97fe04a87d130e1c815c6144f14d12cab713b6dcaada2e7091da8ae380c9a6091dd5c87fbac458965e040a9d03da92e9a357350c2a40779514f6fafe1a94e461c6df7bca1aec8c27a87b8c8806cc518b4088c8416676658d0ce677cc63c7a28368aa0ccbe7df6235094f5dd03535448f3aee682b23e4483bd68632e8cdc282da245e034ab752f6e6d62d13b0393abd2449db56b65dd7132760f234d761eae49463d5411c94c33651"}, {0x28, 0x18, 0x3, "89ac3078f215e96f19906f891d05937b2ef1ab0661"}, {0x100, 0x11, 0x19, "98011a2ca201649b9750289299717d0445a19e8b4b07970548209b38e35757a1d1d1614891d55e7538d0f45d854d17f9b6ed7fd72b2b1ae2a2ebe52ee2f16e63c933c8d1ccd0ebf0631745587c2a1a2fea6cfc3a97054a6abcaa5acb408a9287d11055cc852fbaf85bc2d13e7555f9e6470b4e3c615765dc1ce6dbb4815a4760a4188c522e348587429b6225bc8af261a99fc094cfd068497f8b1e4890ebb465cd53486b6fde07e1d522a472745473bb3df7084ae2733dd283e8e0e9fc66db032f59eb4bd368381494d34d71c5712433d22b386821c2fbf8d134cf5cdde07a7dcd75d6a9024477ef87"}, {0x18, 0x0, 0x1000, "a2cb02bb9603"}, {0x88, 0x111, 0xfffffff9, "e52ca486fbe89f941cf4418e7e4138e1e8994ac3e32d1575b9535e6cd377f47f0fa3fa56ada828ad5057024ab3eede1725150d88c7a3af93c8d1323cc6375be45bc4b5aca6712f04877fe42b078231f6e0f1444bb89d8cbc4a8446cbf1bd0aae70830abfd890c000e1bc0f63940cb6dcd6cd"}, {0x10, 0x116, 0x3}, {0xb0, 0x3a, 0x7, "eeb3294203b8ae5cdbd46b7edf2522e11779fd7c5c8114fda8ca65252e5200ac412ca815e8cf6f37555826426cebb9cc7f4da1421aa004f5945a9a2963631fe00c36c0aa080db4c6f40eee2080ff57a984959178416cdd520f0ac08f26e4573dc5a1b3b9a3a5f8bce818a1b38e71ab26e115520e9d09a59f62b9bf785cf95f05115649a1cdd559e54d7f46696c7688b01352d57447a6ca881f1a7659df27"}], 0x350}, 0x4080000) 33.971781845s ago: executing program 2 (id=6699): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000380)={{0x1, 0x1, 0x18, r0, {0x6}}, './file1\x00'}) getsockopt$SO_TIMESTAMP(r2, 0x1, 0x23, &(0x7f00000003c0), &(0x7f0000000440)=0x4) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(0xffffffffffffffff, 0x84, 0x70, &(0x7f00000000c0)={0x0, @in6={{0xa, 0x4e23, 0x5, @remote, 0x6}}, [0x2, 0xbb, 0x340, 0x5, 0x0, 0x40, 0x9, 0x7, 0x5, 0x951, 0xc598, 0x4, 0x6, 0xc50e, 0x1]}, &(0x7f0000000000)=0x100) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r1, 0x84, 0x6, &(0x7f00000001c0)={r3, @in6={{0xa, 0x4e21, 0x0, @mcast2, 0x3}}}, &(0x7f0000000040)=0x84) ioctl$AUTOFS_DEV_IOCTL_CATATONIC(0xffffffffffffffff, 0xc0189379, &(0x7f0000000280)={{0x1, 0x1, 0x18, r1}, './file0\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x88) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f0000000140)='./bus\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0) openat$dir(0xffffffffffffff9c, &(0x7f0000002180)='./file0\x00', 0x5558a1, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff0000/0x1000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ff0000/0xd000)=nil, &(0x7f0000ffc000/0x2000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000fec000/0x14000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0) r5 = io_uring_setup(0x1c79, &(0x7f0000000040)={0x0, 0xc8a1, 0xc000, 0x8, 0xc1}) bpf$PROG_LOAD(0x5, &(0x7f0000000000)={0x17, 0x3, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x20, '\x00', 0x0, @fallback=0x2f, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) io_uring_enter(r5, 0x2219, 0x7721, 0x1f, 0x0, 0x0) bind$bt_l2cap(r4, &(0x7f00000002c0)={0x1f, 0xf, @any, 0xffff, 0x1}, 0xe) sendmsg$netlink(r0, &(0x7f0000001ac0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000001200)=ANY=[@ANYBLOB="1401000020000186ec0aac0000000b000101aa800c0001"], 0x114}], 0x1}, 0x0) 33.953474254s ago: executing program 5 (id=6700): r0 = socket$packet(0x11, 0x3, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r0, 0x8933, &(0x7f0000000080)={'batadv0\x00', 0x0}) sendto$packet(r0, &(0x7f0000000100)="f257a8ea7bc273dfaeab96850806", 0x2a, 0x0, &(0x7f0000000200)={0x11, 0x0, r1, 0x1, 0x0, 0x6, @link_local}, 0x14) getsockopt$sock_timeval(r0, 0x1, 0x15, &(0x7f0000000100), &(0x7f0000000140)=0x10) r2 = socket$inet6(0xa, 0x1, 0x84) setsockopt$inet6_int(r2, 0x29, 0x1a, &(0x7f0000000080)=0x2, 0x4) sendto$inet6(r2, &(0x7f00000000c0)="13d7f17829c3b6c25dfdd7493e53fbc21f03008460eba94774a84b", 0x1b, 0x804, &(0x7f0000000000)={0xa, 0xfffc, 0x0, @private0, 0x10000}, 0x1c) getsockopt$bt_hci(r2, 0x84, 0x6d, 0x0, 0x0) dup(0xffffffffffffffff) sendmmsg$alg(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(0xffffffffffffffff, 0x4018620d, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) r4 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48) r5 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x16, 0x10, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000b7080000000000007b8ab8ff00000000b7080000000000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r4, @ANYBLOB="0000000000000000b703000000000000850000006900000095"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x26, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r5, 0x0, 0x30, 0x0, &(0x7f0000000000)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 32.636340567s ago: executing program 3 (id=6701): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, 0x0, 0x2, 0x0, 0x0, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) wait4(r0, 0x0, 0x8, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r1, 0x0, 0x0, 0x2, 0x0) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) chdir(&(0x7f0000000280)='./file1\x00') quotactl_fd$Q_GETINFO(0xffffffffffffffff, 0xffffffff80000501, 0xee00, 0x0) syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x16, 0x13, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000000000000018010000786c252500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000180100002020702500000000002020207b1ad8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000080000000850000007000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000080)={r3, 0x18000000000002a0, 0xe, 0xfffffffffffffffd, &(0x7f00000001c0)="186bf7ffffffffffffffef0a3254", 0x0, 0xff, 0x60000009, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff000}, 0x50) 32.237312223s ago: executing program 2 (id=6702): arch_prctl$ARCH_GET_GS(0x1004, &(0x7f0000000000)) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x0, &(0x7f0000000180)=0x3, 0x4) r0 = socket$inet_tcp(0x2, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) (async) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x0, &(0x7f0000000040), &(0x7f00000000c0)=0x4) (async) getsockopt$ax25_int(0xffffffffffffffff, 0x101, 0x0, &(0x7f0000000040), &(0x7f00000000c0)=0x4) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) (async) bind$inet(r0, &(0x7f0000000000)={0x2, 0x4e21, @broadcast}, 0x2f) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(0x0, 0x6, &(0x7f0000000100)=0x6) (async) sched_setscheduler(0x0, 0x6, &(0x7f0000000100)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$xdp(0x2c, 0x3, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) creat(&(0x7f00000002c0)='./file0\x00', 0x0) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) (async) open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) 31.451191038s ago: executing program 2 (id=6703): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = io_uring_setup(0x2c4e, &(0x7f00000000c0)={0x0, 0x8000002, 0x200, 0x1000001, 0x1a8}) syz_open_dev$evdev(0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(r0, 0x18, &(0x7f0000000000), 0x1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0xd4fcb000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) close(0xffffffffffffffff) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x2, 0x0, 0x2000000}, 0x10) sendmsg$NFT_BATCH(r4, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="140000001000040000000000000000000000000a20000000000a01020000000000000000010000000900010073797a300000000058000000160a01000000000000000000010000000900010073797a30000000000900020073797a30000000002c0003800800014000000000080002400000000010000380140001007465616d3000000000000000000000005c000000160a0101000b000000000000010000000900020073797a30000000000900010073797a3000000000300003802c000380"], 0xfc}}, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_GET_MSRS_cpu(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000100)={0x1, 0x0, [{0x28e, 0x0, 0x2}]}) r5 = openat$comedi(0xffffff9c, &(0x7f0000000040)='/dev/comedi2\x00', 0xa400, 0x0) ioctl$COMEDI_DEVCONFIG(r5, 0x40946400, 0x0) 31.199172882s ago: executing program 5 (id=6704): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000380)={0x26, 'rng\x00', 0x0, 0x0, 'drbg_pr_ctr_aes128\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) accept4(r0, 0x0, 0x0, 0x80800) recvmsg(r0, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)}, 0x40000140) socket$nl_generic(0x10, 0x3, 0x10) (async) socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000040)={{{@in=@rand_addr=0x64010100, @in6=@loopback, 0x4e23, 0x0, 0x0, 0x0, 0x2}, {0x0, 0x1, 0x0, 0x0, 0x5, 0xfffffffffffffffa}, {0x0, 0x0, 0x0, 0x2}, 0x0, 0x0, 0x1, 0x1}, {{@in=@empty, 0x0, 0x33}, 0x0, @in6=@ipv4={'\x00', '\xff\xff', @local}, 0x3507, 0x4, 0x1, 0x0, 0x0, 0x7c, 0xfffffffe}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) (async) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000140)={0x50, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_TYPENAME={0x16, 0x3, 'hash:net,port,net\x00'}]}, 0x50}}, 0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) (async) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000040)=@req={0x3fc, 0x0, 0x0, 0x5}, 0x10) r3 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r3, 0x10f, 0x87, &(0x7f0000000440)=@req={0x3fc}, 0x10) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async) sendmmsg(r3, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) (async) sendmmsg(r2, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) recvmmsg$unix(r2, &(0x7f00000043c0)=[{{0x0, 0x0, &(0x7f0000000580)=[{&(0x7f00000002c0)=""/240, 0xf0}], 0x1}}, {{0x0, 0x0, &(0x7f0000000780)=[{&(0x7f0000000640)=""/187, 0xbb}], 0x1}}, {{0x0, 0x0, &(0x7f0000002d00)=[{&(0x7f0000000900)=""/174, 0xae}], 0x1}}], 0x3, 0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) (async) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000100000a20000000000a01040000232100000000010080030900010073797a30000000002c000000030a01010000000000000000010000000900010073797a30000000000900030073797a320000000094000000060a010100000000000000000100000008000b40000000006c000480340001800b000100657874686472000024000280080001400000000e080003400000000008000440000000ac9ff59640000000c3340001800c00cd010062697477697365002400028008000340000000040800014000000014080002400000001208000640000000020900010073797a3000000000140000001100010000000000000000000700000ad882cd7c002fa221084c60a6667a7c33d6adae23832fc33c6524fded33b90ac2894ca3efbec19a3d3578085b2e7c088e765a71666837bd28e0d4eed373434100eab23afd0bc46b268f4ec2979de23e7536a87da71b2c466e36d05a0857afa702f75a87fb51c5d1c1ae91825c15dc793410ad42af37533580a87cff85f28d2697ea618fdfd16fa1c41dbc94e9c40ed699beb9008e09d944e97d85d1b7523dbb1d33d7d5d033f6edc7ae59f72e3906e2afd5238505f987640d0d8e902525fc0812e24ac4a3f40f6e3c2ff883fe146c3dbff6cff59b525d4c6eb801056833ce8fb378ef83c9b318f69ac5588a68a6f3b1b4cf1c3e0d7472604c413ba5c4bbf6983d2be1ff751d20d7ba6b326b6218e1804b1bbffab6b9ceaeebce835e001e7a5682f81e"], 0x108}}, 0x0) 30.596890937s ago: executing program 3 (id=6705): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000340), 0x4) ioctl$sock_ax25_SIOCADDRT(r0, 0x890b, &(0x7f00000003c0)={@default, @default, 0xfc, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default]}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) socket$alg(0x26, 0x5, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x13, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1, 0x0, 0x0, 0x4cbb, 0x1, r3}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, 0x0, 0x0) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) sendmmsg$unix(r4, &(0x7f0000001840)=[{{&(0x7f0000001180)=@file={0x0, './file1\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x880}}, {{&(0x7f0000000b00)=@file={0x1, './file1\x00'}, 0x6e, &(0x7f0000000100)=[{&(0x7f00000027c0)="9af76f", 0x3}], 0x1, 0x0, 0x0, 0x40000}}], 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) listen(r2, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10) r7 = syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f0000000040)={0x2}) close(r7) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r6, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r2}, 0x20) sendmmsg$inet6(r2, &(0x7f0000008c00)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="50558c", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000a80)}, {0x0}], 0x2}}], 0x2, 0x20004810) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) 30.582635579s ago: executing program 4 (id=6706): r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x0, &(0x7f0000000080)}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000640)='./file0/file0\x00', 0x4a300, 0xcd) ioctl$FIBMAP(r1, 0x401870cc, 0x0) r2 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000200), 0x24a002, 0x0) ioctl$AUTOFS_DEV_IOCTL_CLOSEMOUNT(r1, 0xc0189375, &(0x7f0000000240)={{0x1, 0x1, 0x4, r2}, './file0/file0\x00'}) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, &(0x7f00000000c0)=0xa1) r4 = socket(0x29, 0x80805, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x9}, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, 0x0, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x5f}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r5}, 0x18) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r6 = getpid() sched_setscheduler(r6, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f0000000180)=@abs={0x0, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(r8, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r9 = shmget$private(0x0, 0x3000, 0x40, &(0x7f0000ffd000/0x3000)=nil) shmat(r9, &(0x7f0000ffc000/0x3000)=nil, 0x4000) shmctl$IPC_RMID(r9, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @dev, 0x5}, 0x1c) syz_genetlink_get_family_id$devlink(&(0x7f00000001c0), r4) msgctl$MSG_STAT(0x0, 0xb, 0x0) msgctl$IPC_INFO(0x0, 0x3, &(0x7f0000000100)=""/191) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r0, 0xc0a85320, &(0x7f00000003c0)={{0x80}, 'port0\x00', 0x511e36599023629, 0x100040, 0x1b35, 0x8, 0x2, 0x2, 0x0, 0x0, 0x7, 0x1}) ioctl$SNDRV_SEQ_IOCTL_DELETE_PORT(r0, 0x40a85321, &(0x7f00000004c0)={{0x80, 0xd}, 'port0\x00', 0xd7, 0x100c75, 0x7fff, 0x4, 0x1ff, 0x0, 0x0, 0x0, 0x6, 0x6}) 30.464406546s ago: executing program 2 (id=6707): sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) socket$alg(0x26, 0x5, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000200)={&(0x7f0000000280)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c00000004000000020000000000000f040000"], 0x0, 0x28}, 0x28) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$EBT_SO_SET_ENTRIES(r2, 0x0, 0x80, 0x0, 0x108) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="0200000004000000040000000100000080000000", @ANYRES32, @ANYBLOB="000000000000000000000000000000004a41b2cd00afdb3100000000", @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="000000000100"/28], 0x50) bpf$MAP_CREATE(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0c00000004000000040000000010000000000000", @ANYRES32=r3, @ANYBLOB="0000000000000000cc3c4f536f67ccff00000000", @ANYRES32=0x0, @ANYRES32=r1, @ANYBLOB="000000008000"/20], 0x50) syz_genetlink_get_family_id$nfc(0x0, 0xffffffffffffffff) sendmsg$NFC_CMD_LLC_SET_PARAMS(0xffffffffffffffff, 0x0, 0x40000080) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000030000000900010073797a300000000028000000000a01040000000000000000030000000900010073797a3000000000080002400000000130000000030a03000000000000000000030000010900030073797a30000000000900010073797a30000000000400040714000000110001"], 0xa0}}, 0x0) 30.360888182s ago: executing program 5 (id=6708): r0 = socket$inet(0xa, 0x801, 0x84) mount(&(0x7f0000000000)=@nullb, &(0x7f00000000c0)='./cgroup\x00', &(0x7f0000000100)='befs\x00', 0x214003, 0x0) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet(r1, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) sysfs$3(0x3) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000340)=ANY=[@ANYBLOB="020000000400000008000000"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) r4 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) writev(r4, &(0x7f0000000380)=[{&(0x7f0000000400)}, {0x0}], 0x2) write$cgroup_subtree(0xffffffffffffffff, &(0x7f00000003c0)=ANY=[], 0xfe33) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_RATE_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="b70b2cbd7000fcdbdf250f0000000e0002"], 0x24}, 0x1, 0x0, 0x0, 0x8}, 0x2000c88c) sendmsg$DEVLINK_CMD_SB_OCC_SNAPSHOT(0xffffffffffffffff, 0x0, 0x90) syz_open_procfs(0xffffffffffffffff, 0x0) r6 = syz_open_procfs(0x0, 0x0) mount_setattr(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000180)={0xb, 0x0, 0x40000, {r6}}, 0x20) timer_create(0x3, 0x0, &(0x7f00000000c0)=0x0) timer_settime(r7, 0x0, &(0x7f00000001c0)={{0x0, 0x989680}}, 0x0) syz_open_dev$usbfs(&(0x7f0000000240), 0xb, 0x101301) munmap(&(0x7f0000a94000/0x2000)=nil, 0x2000) 29.428850207s ago: executing program 4 (id=6709): sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getdents(0xffffffffffffffff, &(0x7f0000000440)=""/4090, 0xffa) getpid() r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000001040)={0xfc, {"a2e3ad09edfc09f91b44090987f70e06d038e7ff7fc6e5539b303d0e8b089b07323068090890e0879b0a0ac6e70a9b3361959b4b9a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b35070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d060300f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba276f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2d8160f94e35f2d2d12913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516259e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc1943cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) 28.695632777s ago: executing program 2 (id=6710): prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x88480, 0x0) semget$private(0x0, 0x20000000102, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000640)=@file={0x1, './mnt\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x10) r3 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) writev(r3, &(0x7f0000000380)=[{&(0x7f0000000780)="8867e877ccd861dbc4ac96fe2951c97bbb02672a0dafe1ecac335719e80e17ae0dfc5271c4b47b93a2db31d2886ed844ba4a4c8df6441f413402741a38e805f5cd685936f3a05159074fef1aaec79b5f1007ad5da77d9c117746ae2ba939b1b1705a070d3c82d03005e0915c3347a3c9f8b11fa17f59dbc0325ce0c991cbac996d7eb1ac57947728edd7164fcdaee5d16907a30b8d24a680dafc1ee118fb9f776a9aa64f504e9837c1aedba0665f83b33befa1fb7b33f953a8bc51204e282c03850cf09999681ba82a992e25682a724b647cdfbbbb348025b700b9112b7ec222dbd1ad0852071c1793eb14555f12541d924818cec67849f7e367540b54eb4056d13bb47b3dca337de809db748eb3268d3193efeb76a5473410961a038ad1996f35e636e432c2f538b0d650e4c84519aa9e402600d5020c4819613d937bbb", 0x13e}], 0x1) syz_open_procfs(0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/snmp6\x00') read$FUSE(r4, &(0x7f00000051c0)={0x2020}, 0x2020) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$AUTOFS_IOC_SETTIMEOUT(r5, 0x80049367, &(0x7f00000002c0)=0x7) pread64(r4, &(0x7f0000000100)=""/253, 0xfd, 0xadc) r6 = syz_open_dev$usbfs(&(0x7f0000000240), 0x9, 0x10101) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000200)=@usbdevfs_driver={0x1, 0x400, &(0x7f00000004c0)="49b9758a12038899d8b9050d34029a530ff7d31351ab50a90c144977ca55d5eaf6b48f00160cfe4470787256971e629a28c6a12c479b14be451804d28dfbe0110f7d7ecb674594e77868fa0504b63d79718ae1672bec026c4334d5b044f91da2fc607d52164c55d1cdc96e6923d34b11634190b3f428a93832cd0550931bdfc8c5dbb41364c5d8e7cf3341abf2ca2d18ff3990467520cef88775146a4678e4d2fdc47090b465e4e7e7f397f7cec64845451f5ba144a44a85b31be3350d4723757d40c4effc9b7d169360380bd7fd5eeaba723c5d2c64c8f9419330a2a1059600dd3f8d1a359f5723c6cd19"}) ioctl$USBDEVFS_IOCTL(r6, 0x80045505, &(0x7f0000000040)=@usbdevfs_driver={0x5, 0x3ff, &(0x7f00000006c0)="bc65d273da46de05fc6db14d83551aad28c6769ec2324b2220d421fb44c91ee32d811e97bbdd92254343b10ea6fad2ffecd33148370f39f2b3c2d6f5c480c8810d6b685f09436cf31df099bed12119054e93cf43c930c1e25ab8315a9c67d9836e75f2c3aa767e19e5ca14479f2eeae6a6ed07b8ecc07dbf3a3f018de4a161083871f4f9eedec43a6eba683632bb47cd897bcde2a00e4674b886695908553766d72dec1553fa954255f433ed7cfa79813af095db87"}) ioctl$USBDEVFS_SETCONFIGURATION(r6, 0x80045505, &(0x7f0000000000)=0x1) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/time\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_open_procfs(0x0, &(0x7f00000001c0)='net/rpc\x00') readlinkat(0xffffffffffffffff, &(0x7f00000003c0)='./mnt\x00', &(0x7f00000000c0)=""/60, 0x3c) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, &(0x7f0000000180)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x40, 0x0, 0x0) 23.636687136s ago: executing program 5 (id=6711): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/binder0\x00', 0x802, 0x0) socket$alg(0x26, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8001, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB]) read$FUSE(0xffffffffffffffff, &(0x7f000000a400)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x90, 0x0, 0x153, {0x1, 0x1, 0x0, 0x3, 0xfffffffc, 0x0, {0x5, 0x6, 0x0, 0x6, 0x2, 0x0, 0x4, 0x290, 0xfffffffc, 0x2000, 0xfffffffe, r1, 0x0, 0x104, 0xfffffffe}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000340)={0xa0, 0x0, 0x0, {{0x0, 0x0, 0x2, 0x8000000000000000, 0x101, 0x1, {0x5, 0x59b7, 0xfffffffffffffff9, 0x2, 0x9, 0xfffffffffffffffa, 0x1ff, 0x9, 0xffffff01, 0xa000, 0x5, r1, 0x0, 0x0, 0x101}}, {0x0, 0x3}}}, 0xa0) read$msr(r0, &(0x7f000001b700)=""/102392, 0x18ff8) syz_open_dev$vbi(0x0, 0x2, 0x2) socket$netlink(0x10, 0x3, 0x0) mount(0x0, 0x0, &(0x7f0000000080)='configfs\x00', 0x200, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000500)={0x20, 0x0, &(0x7f0000000280)=[@clear_death={0x400c630f, 0x2}, @increfs={0x40046304, 0x2}, @decrefs], 0xa1, 0x0, &(0x7f0000000440)="d12534f06136a480f6ce516f78586fcf00bc62cd65971e0da71b68419d9ca9a2533fa6304e68fcdcc8af8e0fd1239bc8d26837c5861a09373bf49fb1a24bbab9dd432a59328c529d021c787dcbaefdc4ebeb229faa0b38588d801d42269cd03c6f16b6e81ceb3c690c7082c46b3294c36d80a96f57a6b9d283c64f694650cf91c81e46981187f7be80352739d87b913af41cfb0b87910ef3c37a445da8e082edc5"}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r4], 0x24}, 0x1, 0x0, 0x0, 0x4004810}, 0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d10402064"], 0x0) syz_usb_disconnect(r5) r6 = syz_open_dev$I2C(&(0x7f0000000140), 0x10009828, 0x48000) ioctl$BTRFS_IOC_QUOTA_RESCAN(r6, 0x4040942c, &(0x7f0000000080)={0x0, 0x7, [0x7, 0xaf46, 0x2, 0x8, 0xe2c, 0x2]}) ioctl$I2C_RDWR(r6, 0x707, &(0x7f00000000c0)={&(0x7f0000000040)=[{0x9, 0x1001, 0x3f, &(0x7f0000000180)="951e3d7b9ebb040e6569af77fec35c2c0c544a827534c8c614509a408a781b2bc909a5da9710252925c7a87735266c60eec775d293448edc83fdbf7e17b54b"}], 0x1}) 11.427819091s ago: executing program 33 (id=6686): socket$nl_crypto(0x10, 0x3, 0x15) mq_getsetattr(0xffffffffffffffff, 0x0, &(0x7f00000001c0)) prlimit64(0x0, 0xc, &(0x7f0000000200)={0x5, 0x5}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000}, 0x10) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e402010902"], 0x0) openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) r1 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000100)=[{&(0x7f0000000240)=""/216, 0xd8}], 0x1}) io_uring_enter(r1, 0x847ba, 0x0, 0xe, 0x0, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00'}) r5 = socket$inet6(0xa, 0x3, 0x3a) setsockopt$inet6_int(r5, 0x29, 0x4e, &(0x7f0000000040)=0x9, 0x4) bind$inet6(r5, &(0x7f0000000180)={0xa, 0x800, 0x4, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000100)={0x1, &(0x7f0000000140)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) membarrier(0x2, 0x0) 11.264297457s ago: executing program 34 (id=6710): prctl$PR_SCHED_CORE(0x3e, 0x3, 0x0, 0x2, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x88480, 0x0) semget$private(0x0, 0x20000000102, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000640)=@file={0x1, './mnt\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x3, 0x8, 0x8001, 0x0, 0xb, 0x8000000000000000, 0x6, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x10) r3 = openat$urandom(0xffffffffffffff9c, &(0x7f0000000000), 0x103902, 0x0) writev(r3, &(0x7f0000000380)=[{&(0x7f0000000780)="8867e877ccd861dbc4ac96fe2951c97bbb02672a0dafe1ecac335719e80e17ae0dfc5271c4b47b93a2db31d2886ed844ba4a4c8df6441f413402741a38e805f5cd685936f3a05159074fef1aaec79b5f1007ad5da77d9c117746ae2ba939b1b1705a070d3c82d03005e0915c3347a3c9f8b11fa17f59dbc0325ce0c991cbac996d7eb1ac57947728edd7164fcdaee5d16907a30b8d24a680dafc1ee118fb9f776a9aa64f504e9837c1aedba0665f83b33befa1fb7b33f953a8bc51204e282c03850cf09999681ba82a992e25682a724b647cdfbbbb348025b700b9112b7ec222dbd1ad0852071c1793eb14555f12541d924818cec67849f7e367540b54eb4056d13bb47b3dca337de809db748eb3268d3193efeb76a5473410961a038ad1996f35e636e432c2f538b0d650e4c84519aa9e402600d5020c4819613d937bbb", 0x13e}], 0x1) syz_open_procfs(0xffffffffffffffff, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000080)='net/snmp6\x00') read$FUSE(r4, &(0x7f00000051c0)={0x2020}, 0x2020) r5 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$AUTOFS_IOC_SETTIMEOUT(r5, 0x80049367, &(0x7f00000002c0)=0x7) pread64(r4, &(0x7f0000000100)=""/253, 0xfd, 0xadc) r6 = syz_open_dev$usbfs(&(0x7f0000000240), 0x9, 0x10101) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000200)=@usbdevfs_driver={0x1, 0x400, &(0x7f00000004c0)="49b9758a12038899d8b9050d34029a530ff7d31351ab50a90c144977ca55d5eaf6b48f00160cfe4470787256971e629a28c6a12c479b14be451804d28dfbe0110f7d7ecb674594e77868fa0504b63d79718ae1672bec026c4334d5b044f91da2fc607d52164c55d1cdc96e6923d34b11634190b3f428a93832cd0550931bdfc8c5dbb41364c5d8e7cf3341abf2ca2d18ff3990467520cef88775146a4678e4d2fdc47090b465e4e7e7f397f7cec64845451f5ba144a44a85b31be3350d4723757d40c4effc9b7d169360380bd7fd5eeaba723c5d2c64c8f9419330a2a1059600dd3f8d1a359f5723c6cd19"}) ioctl$USBDEVFS_IOCTL(r6, 0x80045505, &(0x7f0000000040)=@usbdevfs_driver={0x5, 0x3ff, &(0x7f00000006c0)="bc65d273da46de05fc6db14d83551aad28c6769ec2324b2220d421fb44c91ee32d811e97bbdd92254343b10ea6fad2ffecd33148370f39f2b3c2d6f5c480c8810d6b685f09436cf31df099bed12119054e93cf43c930c1e25ab8315a9c67d9836e75f2c3aa767e19e5ca14479f2eeae6a6ed07b8ecc07dbf3a3f018de4a161083871f4f9eedec43a6eba683632bb47cd897bcde2a00e4674b886695908553766d72dec1553fa954255f433ed7cfa79813af095db87"}) ioctl$USBDEVFS_SETCONFIGURATION(r6, 0x80045505, &(0x7f0000000000)=0x1) r7 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x0) syz_open_procfs$namespace(0x0, &(0x7f0000000100)='ns/time\x00') mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_open_procfs(0x0, &(0x7f00000001c0)='net/rpc\x00') readlinkat(0xffffffffffffffff, &(0x7f00000003c0)='./mnt\x00', &(0x7f00000000c0)=""/60, 0x3c) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r4, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000300)=[@text16={0x10, &(0x7f0000000180)="64670feea1096f00003e660f38054c880f323e26640fb9a9c94f660fc7b27f1a360f09366764f4660fdd40e69a3a00e300baa000b0e5ee", 0x37}], 0x1, 0x40, 0x0, 0x0) 11.14514873s ago: executing program 35 (id=6705): r0 = syz_init_net_socket$ax25(0x3, 0x2, 0xf0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r1, 0x0, 0xf, &(0x7f0000000340), 0x4) ioctl$sock_ax25_SIOCADDRT(r0, 0x890b, &(0x7f00000003c0)={@default, @default, 0xfc, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x3}, @bcast, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x2}, @bcast, @default]}) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0) socket$alg(0x26, 0x5, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="04000000040000000400000005"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x13, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000580)=@base={0x1, 0x0, 0x0, 0x4cbb, 0x1, r3}, 0x50) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) sendmsg$NL80211_CMD_START_AP(0xffffffffffffffff, 0x0, 0x0) r4 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) sendmmsg$unix(r4, &(0x7f0000001840)=[{{&(0x7f0000001180)=@file={0x0, './file1\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x880}}, {{&(0x7f0000000b00)=@file={0x1, './file1\x00'}, 0x6e, &(0x7f0000000100)=[{&(0x7f00000027c0)="9af76f", 0x3}], 0x1, 0x0, 0x0, 0x40000}}], 0x2, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) listen(r2, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x4, &(0x7f0000000380)=ANY=[@ANYBLOB="1802000000c400000000000000000000850000003e00000095"], &(0x7f00000000c0)='GPL\x00'}, 0x90) r6 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=ANY=[@ANYBLOB="1200000004000000080000000b"], 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000540)=ANY=[@ANYRES32=r6, @ANYRES32=r5, @ANYBLOB='\a'], 0x10) r7 = syz_open_dev$vim2m(&(0x7f0000000100), 0x2, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r7, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f0000000040)={0x2}) close(r7) bpf$MAP_UPDATE_ELEM(0x2, &(0x7f0000000100)={r6, &(0x7f0000000240), &(0x7f0000000140)=@tcp6=r2}, 0x20) sendmmsg$inet6(r2, &(0x7f0000008c00)=[{{0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000180)="50558c", 0x3}], 0x1}}, {{0x0, 0x0, &(0x7f0000000c80)=[{&(0x7f0000000a80)}, {0x0}], 0x2}}], 0x2, 0x20004810) r8 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r8, 0xffffffffffffffff, 0x0) 11.017490392s ago: executing program 36 (id=6709): sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000000)=0x7) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) getdents(0xffffffffffffffff, &(0x7f0000000440)=""/4090, 0xffa) getpid() r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) r4 = dup(r3) write$UHID_INPUT(r4, &(0x7f0000001040)={0xfc, {"a2e3ad09edfc09f91b44090987f70e06d038e7ff7fc6e5539b303d0e8b089b07323068090890e0879b0a0ac6e70a9b3361959b4b9a240d5b0af3988f7ef319520100ffe8d178708c523c921b1b5b35070d074a0936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6a62fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9e53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d060300f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076038e79a7962fb385a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba276f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaee5ee6cf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d6787463183b4b87c1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2d8160f94e35f2d2d12913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516259e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc1943cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f9000", 0x1000}}, 0x1006) 0s ago: executing program 37 (id=6711): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs2/binder0\x00', 0x802, 0x0) socket$alg(0x26, 0x5, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x8001, &(0x7f00000003c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB]) read$FUSE(0xffffffffffffffff, &(0x7f000000a400)={0x2020, 0x0, 0x0, 0x0}, 0x2020) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000002c0)={0x90, 0x0, 0x153, {0x1, 0x1, 0x0, 0x3, 0xfffffffc, 0x0, {0x5, 0x6, 0x0, 0x6, 0x2, 0x0, 0x4, 0x290, 0xfffffffc, 0x2000, 0xfffffffe, r1, 0x0, 0x104, 0xfffffffe}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) fstat(r0, 0x0) write$FUSE_CREATE_OPEN(0xffffffffffffffff, &(0x7f0000000340)={0xa0, 0x0, 0x0, {{0x0, 0x0, 0x2, 0x8000000000000000, 0x101, 0x1, {0x5, 0x59b7, 0xfffffffffffffff9, 0x2, 0x9, 0xfffffffffffffffa, 0x1ff, 0x9, 0xffffff01, 0xa000, 0x5, r1, 0x0, 0x0, 0x101}}, {0x0, 0x3}}}, 0xa0) read$msr(r0, &(0x7f000001b700)=""/102392, 0x18ff8) syz_open_dev$vbi(0x0, 0x2, 0x2) socket$netlink(0x10, 0x3, 0x0) mount(0x0, 0x0, &(0x7f0000000080)='configfs\x00', 0x200, 0x0) r2 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000240)='./binderfs/binder1\x00', 0x800, 0x0) ioctl$BINDER_WRITE_READ(r2, 0xc0306201, &(0x7f0000000500)={0x20, 0x0, &(0x7f0000000280)=[@clear_death={0x400c630f, 0x2}, @increfs={0x40046304, 0x2}, @decrefs], 0xa1, 0x0, &(0x7f0000000440)="d12534f06136a480f6ce516f78586fcf00bc62cd65971e0da71b68419d9ca9a2533fa6304e68fcdcc8af8e0fd1239bc8d26837c5861a09373bf49fb1a24bbab9dd432a59328c529d021c787dcbaefdc4ebeb229faa0b38588d801d42269cd03c6f16b6e81ceb3c690c7082c46b3294c36d80a96f57a6b9d283c64f694650cf91c81e46981187f7be80352739d87b913af41cfb0b87910ef3c37a445da8e082edc5"}) r3 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000080)={'bridge0\x00', 0x0}) sendmsg$nl_route(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000001c0)=ANY=[@ANYBLOB="240000001d00070f000000000000000007000000", @ANYRES32=r4], 0x24}, 0x1, 0x0, 0x0, 0x4004810}, 0x0) r5 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="1201000083667d10402064"], 0x0) syz_usb_disconnect(r5) r6 = syz_open_dev$I2C(&(0x7f0000000140), 0x10009828, 0x48000) ioctl$BTRFS_IOC_QUOTA_RESCAN(r6, 0x4040942c, &(0x7f0000000080)={0x0, 0x7, [0x7, 0xaf46, 0x2, 0x8, 0xe2c, 0x2]}) ioctl$I2C_RDWR(r6, 0x707, &(0x7f00000000c0)={&(0x7f0000000040)=[{0x9, 0x1001, 0x3f, &(0x7f0000000180)="951e3d7b9ebb040e6569af77fec35c2c0c544a827534c8c614509a408a781b2bc909a5da9710252925c7a87735266c60eec775d293448edc83fdbf7e17b54b"}], 0x1}) kernel console output (not intermixed with test programs): X: 0000000000000110 [ 2333.548513][T30573] RAX: ffffffffffffffda RBX: 00007f03e6de6090 RCX: 00007f03e6b8f749 [ 2333.548526][T30573] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000008000000 [ 2333.548536][T30573] RBP: 00007f03e796b090 R08: 0000000000000000 R09: 0000000000000000 [ 2333.548548][T30573] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2333.548559][T30573] R13: 00007f03e6de6128 R14: 00007f03e6de6090 R15: 00007ffd77bf2298 [ 2333.548585][T30573] [ 2333.552474][T28558] dvb-usb: bulk message failed: -22 (3/0) [ 2333.838909][T28558] dw2102: command 0x0e transfer failed. [ 2333.844521][T28558] dvb-usb: bulk message failed: -22 (3/0) [ 2333.867959][T28558] dw2102: command 0x0e transfer failed. [ 2333.961193][ T30] audit: type=1326 audit(2000000874.780:1919): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2333.995313][T30585] netlink: 24 bytes leftover after parsing attributes in process `syz.5.6301'. [ 2334.357369][T28558] dvb-usb: bulk message failed: -22 (3/0) [ 2334.361954][ T30] audit: type=1326 audit(2000000874.817:1920): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2334.368634][T28558] dw2102: command 0x0e transfer failed. [ 2334.393168][T28558] dvb-usb: bulk message failed: -22 (3/0) [ 2334.399128][T28558] dw2102: command 0x0e transfer failed. [ 2334.487552][T28558] dvb-usb: bulk message failed: -22 (1/0) [ 2334.496547][T28558] dw2102: command 0x51 transfer failed. [ 2334.506013][T28558] dvb-usb: bulk message failed: -22 (5/0) [ 2334.507649][ T30] audit: type=1326 audit(2000000874.817:1921): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=439 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2334.511934][T28558] dw2102: i2c probe for address 0x68 failed. [ 2334.550388][T17458] usb 2-1: new full-speed USB device number 67 using dummy_hcd [ 2334.560502][T28558] dvb-usb: bulk message failed: -22 (5/0) [ 2334.673866][ T30] audit: type=1326 audit(2000000874.817:1922): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2334.698414][T28558] dw2102: i2c probe for address 0x69 failed. [ 2334.712901][T17458] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2334.737833][T17458] usb 2-1: not running at top speed; connect to a high speed hub [ 2334.773399][T28558] dvb-usb: bulk message failed: -22 (5/0) [ 2334.790812][T28558] dw2102: i2c probe for address 0x6a failed. [ 2334.800561][T17458] usb 2-1: New USB device found, idVendor=1bc7, idProduct=1040, bcdDevice=91.0c [ 2334.815759][T17458] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2334.831914][T28558] dw2102: probing for demodulator failed. Is the external power switched on? [ 2334.852292][T30598] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2334.871108][ T30] audit: type=1326 audit(2000000874.826:1923): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2334.894709][T17458] usb 2-1: Product: syz [ 2334.899259][T28558] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 2334.909534][T17458] usb 2-1: Manufacturer: syz [ 2334.952926][T17458] usb 2-1: SerialNumber: syz [ 2335.339264][T30598] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2335.353853][T17458] option 2-1:2.0: GSM modem (1-port) converter detected [ 2335.365627][ T30] audit: type=1326 audit(2000000874.836:1924): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2335.416208][T28558] rc_core: IR keymap rc-tt-1500 not found [ 2335.421949][T28558] Registered IR keymap rc-empty [ 2335.435221][T28558] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 2335.446179][T17458] usb 2-1: USB disconnect, device number 67 [ 2335.459831][T17458] option 2-1:2.0: device disconnected [ 2335.476541][T28558] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input295 [ 2335.504392][T30598] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2335.512850][ T30] audit: type=1326 audit(2000000874.836:1925): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2335.577475][T28558] dvb-usb: schedule remote query interval to 250 msecs. [ 2335.603924][T28558] dw2102: su3000_power_ctrl: 0, initialized 1 [ 2335.624568][T28558] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 2335.638414][ T30] audit: type=1326 audit(2000000874.836:1926): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2335.689238][T28558] usb 4-1: USB disconnect, device number 49 [ 2335.884662][ T30] audit: type=1326 audit(2000000874.836:1927): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=47 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2336.071404][ T30] audit: type=1326 audit(2000000874.836:1928): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=30582 comm="syz.4.6303" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f8d52f8f749 code=0x7ffc0000 [ 2336.754558][T28558] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 2337.007934][T25547] usb 2-1: new high-speed USB device number 68 using dummy_hcd [ 2337.362010][T25547] usb 2-1: Using ep0 maxpacket: 32 [ 2337.381375][T25547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2337.496823][T25547] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2337.754005][T25547] usb 2-1: New USB device found, idVendor=0403, idProduct=6030, bcdDevice= 0.00 [ 2337.804084][T25547] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2337.808387][T30634] sch_tbf: burst 127 is lower than device syzkaller0 mtu (1514) ! [ 2337.839865][T25547] usb 2-1: config 0 descriptor?? [ 2337.869726][T30634] syzkaller0: entered promiscuous mode [ 2337.884429][T30637] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6320'. [ 2337.901497][T30634] syzkaller0: entered allmulticast mode [ 2337.938923][T30634] tipc: Started in network mode [ 2337.947440][T30634] tipc: Node identity 86911804f4de, cluster identity 4711 [ 2337.962839][T30634] tipc: Enabled bearer , priority 0 [ 2337.982968][T30633] tipc: Resetting bearer [ 2338.007963][T30633] tipc: Disabling bearer [ 2339.131587][T25547] ft260 0003:0403:6030.0082: unknown main item tag 0x0 [ 2339.162447][T25547] ft260 0003:0403:6030.0082: unknown main item tag 0x0 [ 2339.343318][T25547] ft260 0003:0403:6030.0082: chip code: 0000 0000 [ 2339.435469][T26060] usb 6-1: new high-speed USB device number 36 using dummy_hcd [ 2339.570113][T30660] IPVS: ip_vs_add_dest(): lower threshold is higher than upper threshold [ 2339.580472][T30660] IPVS: fo: FWM 3 0x00000003 - no destination available [ 2339.587826][ C0] IPVS: fo: FWM 3 0x00000003 - no destination available [ 2339.659135][T15007] IPVS: starting estimator thread 0... [ 2339.747878][T26060] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2339.788580][T30618] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2339.802196][T26060] usb 6-1: config 0 interface 0 has no altsetting 0 [ 2339.831385][T30618] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2339.859872][T26060] usb 6-1: New USB device found, idVendor=10fd, idProduct=1513, bcdDevice=7e.ce [ 2339.870306][T26060] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2339.873960][T30661] IPVS: using max 81 ests per chain, 194400 per kthread [ 2339.885024][T26060] usb 6-1: Product: syz [ 2339.888212][T25547] ft260 0003:0403:6030.0082: failed to retrieve system status [ 2339.890126][T26060] usb 6-1: Manufacturer: syz [ 2339.919546][T25547] ft260 0003:0403:6030.0082: probe with driver ft260 failed with error -71 [ 2339.937981][T26060] usb 6-1: SerialNumber: syz [ 2339.942161][T25547] usb 2-1: USB disconnect, device number 68 [ 2339.976137][T26060] usb 6-1: config 0 descriptor?? [ 2340.003485][T26060] dvb-usb: found a 'MSI DIGI VOX mini II DVB-T USB2.0' in warm state. [ 2340.022222][T26060] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2340.036683][T26060] dvbdev: DVB: registering new adapter (MSI DIGI VOX mini II DVB-T USB2.0) [ 2340.045920][T26060] usb 6-1: media controller created [ 2340.090854][T26060] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2340.172519][T26060] DVB: Unable to find symbol tda10046_attach() [ 2340.175912][T30663] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6326'. [ 2340.179903][T26060] dvb-usb: no frontend was attached by 'MSI DIGI VOX mini II DVB-T USB2.0' [ 2340.198523][T26060] dvb-usb: MSI DIGI VOX mini II DVB-T USB2.0 successfully initialized and connected. [ 2340.488115][T26060] dvb_usb_m920x 6-1:0.0: probe with driver dvb_usb_m920x failed with error -71 [ 2340.555442][T26060] usb 6-1: USB disconnect, device number 36 [ 2343.802772][T30721] netlink: 52 bytes leftover after parsing attributes in process `syz.5.6343'. [ 2343.847087][T30721] netlink: 52 bytes leftover after parsing attributes in process `syz.5.6343'. [ 2343.865549][T30721] netlink: 52 bytes leftover after parsing attributes in process `syz.5.6343'. [ 2344.977106][T30728] netlink: 20 bytes leftover after parsing attributes in process `syz.3.6345'. [ 2345.921393][T30753] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2346.087839][T30755] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2346.428544][T30753] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2348.380227][T25547] usb 6-1: new high-speed USB device number 37 using dummy_hcd [ 2348.874333][T25547] usb 6-1: Using ep0 maxpacket: 32 [ 2350.497788][T25547] usb 6-1: config 0 has an invalid interface number: 98 but max is 0 [ 2350.743000][T11710] Bluetooth: hci3: command 0x0406 tx timeout [ 2351.311307][T25547] usb 6-1: config 0 has no interface number 0 [ 2351.317469][T25547] usb 6-1: config 0 interface 98 has no altsetting 0 [ 2351.411189][T25547] usb 6-1: string descriptor 0 read error: -71 [ 2351.425485][T25547] usb 6-1: New USB device found, idVendor=0557, idProduct=2011, bcdDevice=9d.24 [ 2351.453243][T25547] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2351.505024][T25547] usb 6-1: config 0 descriptor?? [ 2351.514714][T25547] usb 6-1: can't set config #0, error -71 [ 2351.526530][T25547] usb 6-1: USB disconnect, device number 37 [ 2353.408821][T28558] kernel read not supported for file /dsp1 (pid: 28558 comm: kworker/1:7) [ 2353.921327][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2353.927628][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2354.386720][T30818] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6370'. [ 2354.432590][T15007] usb 2-1: new high-speed USB device number 69 using dummy_hcd [ 2354.811808][T15007] usb 2-1: Using ep0 maxpacket: 32 [ 2354.823700][T15007] usb 2-1: config 0 has no interfaces? [ 2354.833840][T15007] usb 2-1: New USB device found, idVendor=1b1c, idProduct=0c10, bcdDevice= 0.00 [ 2354.860225][T15007] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2354.901062][T15007] usb 2-1: config 0 descriptor?? [ 2355.022829][T26062] usb 6-1: new high-speed USB device number 38 using dummy_hcd [ 2355.205169][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 2355.205185][ T30] audit: type=1400 audit(2000000894.622:1943): avc: denied { mounton } for pid=30814 comm="syz.1.6369" path="/proc/310/cgroup" dev="proc" ino=133989 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1 [ 2355.245771][T26062] usb 6-1: Using ep0 maxpacket: 32 [ 2355.268502][T26062] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 2355.318839][T26062] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 2355.327889][T15007] usb 2-1: USB disconnect, device number 69 [ 2355.348274][T26062] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 2355.395663][T26062] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2355.412066][T26062] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 2355.426656][T26062] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2355.475384][T26062] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 2355.487157][T26062] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2355.510843][T26062] usb 6-1: config 0 descriptor?? [ 2355.737999][T26062] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 38 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 2355.966444][T26062] usb 6-1: USB disconnect, device number 38 [ 2355.997341][T26062] usblp0: removed [ 2357.126356][T28558] usb 6-1: new high-speed USB device number 39 using dummy_hcd [ 2357.288316][T28558] usb 6-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 2357.299167][T28558] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2357.364245][T28558] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2357.391821][T28558] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 2357.410687][T28558] usb 6-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 2357.424505][T28558] usb 6-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 2357.433808][T28558] usb 6-1: Manufacturer: syz [ 2357.455510][T28558] usb 6-1: config 0 descriptor?? [ 2358.086249][T30861] FAULT_INJECTION: forcing a failure. [ 2358.086249][T30861] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2358.102659][T30861] CPU: 0 UID: 0 PID: 30861 Comm: syz.5.6380 Tainted: G L syzkaller #0 PREEMPT(full) [ 2358.102686][T30861] Tainted: [L]=SOFTLOCKUP [ 2358.102693][T30861] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2358.102703][T30861] Call Trace: [ 2358.102710][T30861] [ 2358.102717][T30861] dump_stack_lvl+0x16c/0x1f0 [ 2358.102744][T30861] should_fail_ex+0x512/0x640 [ 2358.102775][T30861] _copy_to_user+0x32/0xd0 [ 2358.102803][T30861] simple_read_from_buffer+0xcb/0x170 [ 2358.102828][T30861] proc_fail_nth_read+0x197/0x240 [ 2358.102847][T30861] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2358.102866][T30861] ? rw_verify_area+0xcf/0x6c0 [ 2358.102880][T30861] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 2358.102891][T30861] vfs_read+0x1e4/0xcf0 [ 2358.102906][T30861] ? __pfx___mutex_lock+0x10/0x10 [ 2358.102922][T30861] ? __pfx_vfs_read+0x10/0x10 [ 2358.102945][T30861] ? __fget_files+0x20e/0x3c0 [ 2358.102977][T30861] ksys_read+0x12a/0x250 [ 2358.102997][T30861] ? __pfx_ksys_read+0x10/0x10 [ 2358.103016][T30861] ? fdget+0x187/0x210 [ 2358.103034][T30861] do_syscall_64+0xcd/0xf80 [ 2358.103050][T30861] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2358.103062][T30861] RIP: 0033:0x7fda3198e15c [ 2358.103071][T30861] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 2358.103086][T30861] RSP: 002b:00007fda328b1030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 2358.103103][T30861] RAX: ffffffffffffffda RBX: 00007fda31be5fa0 RCX: 00007fda3198e15c [ 2358.103115][T30861] RDX: 000000000000000f RSI: 00007fda328b10a0 RDI: 0000000000000005 [ 2358.103124][T30861] RBP: 00007fda328b1090 R08: 0000000000000000 R09: 0000000000000000 [ 2358.103134][T30861] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2358.103144][T30861] R13: 00007fda31be6038 R14: 00007fda31be5fa0 R15: 00007ffc31680308 [ 2358.103164][T30861] [ 2358.483710][T28558] usbhid 6-1:0.0: can't add hid device: -71 [ 2358.531232][T28558] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2358.791528][T28558] usb 6-1: USB disconnect, device number 39 [ 2359.846065][T30895] FAULT_INJECTION: forcing a failure. [ 2359.846065][T30895] name failslab, interval 1, probability 0, space 0, times 0 [ 2359.858916][T30895] CPU: 0 UID: 0 PID: 30895 Comm: syz.5.6388 Tainted: G L syzkaller #0 PREEMPT(full) [ 2359.858945][T30895] Tainted: [L]=SOFTLOCKUP [ 2359.858952][T30895] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2359.858963][T30895] Call Trace: [ 2359.858970][T30895] [ 2359.858977][T30895] dump_stack_lvl+0x16c/0x1f0 [ 2359.859005][T30895] should_fail_ex+0x512/0x640 [ 2359.859033][T30895] ? kmem_cache_alloc_node_noprof+0x65/0x800 [ 2359.859057][T30895] should_failslab+0xc2/0x120 [ 2359.859082][T30895] kmem_cache_alloc_node_noprof+0x86/0x800 [ 2359.859101][T30895] ? __alloc_skb+0x156/0x410 [ 2359.859134][T30895] ? __alloc_skb+0x156/0x410 [ 2359.859160][T30895] __alloc_skb+0x156/0x410 [ 2359.859186][T30895] ? __alloc_skb+0x35d/0x410 [ 2359.859213][T30895] ? __pfx___alloc_skb+0x10/0x10 [ 2359.859242][T30895] ? netlink_autobind.isra.0+0x158/0x370 [ 2359.859272][T30895] netlink_alloc_large_skb+0x69/0x140 [ 2359.859297][T30895] netlink_sendmsg+0x698/0xdd0 [ 2359.859323][T30895] ? __pfx_netlink_sendmsg+0x10/0x10 [ 2359.859355][T30895] ____sys_sendmsg+0xa5d/0xc30 [ 2359.859381][T30895] ? copy_msghdr_from_user+0x10a/0x160 [ 2359.859400][T30895] ? __pfx_____sys_sendmsg+0x10/0x10 [ 2359.859444][T30895] ___sys_sendmsg+0x134/0x1d0 [ 2359.859465][T30895] ? __pfx____sys_sendmsg+0x10/0x10 [ 2359.859516][T30895] __sys_sendmsg+0x16d/0x220 [ 2359.859536][T30895] ? __pfx___sys_sendmsg+0x10/0x10 [ 2359.859572][T30895] do_syscall_64+0xcd/0xf80 [ 2359.859598][T30895] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2359.859617][T30895] RIP: 0033:0x7fda3198f749 [ 2359.859633][T30895] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2359.859651][T30895] RSP: 002b:00007fda3286f038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2359.859669][T30895] RAX: ffffffffffffffda RBX: 00007fda31be6180 RCX: 00007fda3198f749 [ 2359.859681][T30895] RDX: 0000000000000080 RSI: 0000200000000880 RDI: 0000000000000005 [ 2359.859692][T30895] RBP: 00007fda3286f090 R08: 0000000000000000 R09: 0000000000000000 [ 2359.859703][T30895] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2359.859714][T30895] R13: 00007fda31be6218 R14: 00007fda31be6180 R15: 00007ffc31680308 [ 2359.859740][T30895] [ 2360.033782][T25547] usb 4-1: new high-speed USB device number 50 using dummy_hcd [ 2360.504158][T25547] usb 4-1: device descriptor read/64, error -71 [ 2360.804304][T25547] usb 4-1: new high-speed USB device number 51 using dummy_hcd [ 2361.092668][T25547] usb 4-1: device descriptor read/64, error -71 [ 2361.756718][T25547] usb usb4-port1: attempt power cycle [ 2363.131336][T30939] tipc: Started in network mode [ 2363.144411][T30939] tipc: Node identity 827932626ff8, cluster identity 4711 [ 2363.258973][T30939] tipc: Enabled bearer , priority 0 [ 2363.273910][T30941] syzkaller0: entered promiscuous mode [ 2363.280091][T30941] syzkaller0: entered allmulticast mode [ 2363.413065][T30941] Freezing with imperfect legacy cgroup freezer. See cgroup.freeze of cgroup v2 [ 2363.562098][ T30] audit: type=1400 audit(2000000902.377:1944): avc: denied { read } for pid=30938 comm="syz.1.6399" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 2363.731802][T30938] tipc: Resetting bearer [ 2363.781879][T30938] tipc: Disabling bearer [ 2364.391778][T26062] usb 6-1: new low-speed USB device number 40 using dummy_hcd [ 2364.509008][T15007] tipc: Node number set to 3984667234 [ 2365.519772][T26062] usb 6-1: New USB device found, idVendor=046d, idProduct=08b1, bcdDevice=6d.2a [ 2365.539119][T26062] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2365.550135][T26062] usb 6-1: config 0 descriptor?? [ 2365.567691][ T30] audit: type=1400 audit(2000000904.351:1945): avc: denied { ioctl } for pid=30952 comm="syz.2.6403" path="/dev/input/mice" dev="devtmpfs" ino=916 ioctlcmd=0xaebf scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 2365.593778][T26062] pwc: Logitech QuickCam Notebook Pro USB webcam detected. [ 2365.879826][T30961] netlink: 64 bytes leftover after parsing attributes in process `syz.5.6401'. [ 2365.963452][T30961] netlink: 40 bytes leftover after parsing attributes in process `syz.5.6401'. [ 2366.077520][T26062] pwc: Failed to set LED on/off time (-71) [ 2366.083586][T26062] pwc: send_video_command error -71 [ 2366.094437][T26062] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2366.148204][T26060] usb 2-1: new high-speed USB device number 70 using dummy_hcd [ 2366.174661][T26062] Philips webcam 6-1:0.0: probe with driver Philips webcam failed with error -71 [ 2366.346517][T26060] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2366.376531][T26062] usb 6-1: USB disconnect, device number 40 [ 2366.426990][T26060] usb 2-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 2366.498368][T26060] usb 2-1: New USB device found, idVendor=2294, idProduct=425b, bcdDevice=a2.10 [ 2366.546474][ T30] audit: type=1400 audit(2000000905.277:1946): avc: denied { create } for pid=30963 comm="syz.3.6408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 2366.569344][T26060] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2366.584850][T26060] usb 2-1: Product: syz [ 2366.590582][ T30] audit: type=1400 audit(2000000905.296:1947): avc: denied { write } for pid=30963 comm="syz.3.6408" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=isdn_socket permissive=1 [ 2366.613490][T26060] usb 2-1: Manufacturer: syz [ 2366.620378][T26060] usb 2-1: SerialNumber: syz [ 2366.632367][T26060] usb 2-1: config 0 descriptor?? [ 2366.645128][T26060] usb 2-1: ucan: probing device on interface #0 [ 2366.654476][T26060] usb 2-1: ucan: invalid EP count (0) [ 2366.672607][T26060] usb 2-1: ucan: probe failed; try to update the device firmware [ 2366.859234][ T30] audit: type=1400 audit(2000000905.567:1948): avc: denied { create } for pid=30957 comm="syz.1.6407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 2366.937970][T25547] usb 2-1: USB disconnect, device number 70 [ 2367.029027][ T3774] Bluetooth: (null): Invalid header checksum [ 2367.142892][T18352] Bluetooth: (null): Invalid header checksum [ 2367.246525][T30987] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2367.376734][T30987] 8021q: adding VLAN 0 to HW filter on device team0 [ 2367.460039][T30987] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 2368.664881][T31022] tc_dump_action: action bad kind [ 2370.443145][T31044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2370.622174][T31044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2370.846968][T31044] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2371.769741][T31059] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_rx_wq": -EINTR [ 2372.223590][ T30] audit: type=1326 audit(2000000910.582:1949): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=31068 comm="syz.2.6425" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7fbc1718f749 code=0x0 [ 2372.308225][ T30] audit: type=1400 audit(2000000910.666:1950): avc: denied { getopt } for pid=31068 comm="syz.2.6425" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 2372.740696][ T30] audit: type=1400 audit(2000000911.068:1951): avc: denied { getopt } for pid=31080 comm="syz.5.6428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 2372.761449][ T30] audit: type=1400 audit(2000000911.077:1952): avc: denied { connect } for pid=31080 comm="syz.5.6428" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1 [ 2372.808835][T31077] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6426'. [ 2373.203111][T25547] usb 6-1: new high-speed USB device number 41 using dummy_hcd [ 2373.343181][T31096] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6431'. [ 2373.352127][T31096] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6431'. [ 2373.361275][T31096] netlink: 'syz.2.6431': attribute type 18 has an invalid length. [ 2373.401815][T31097] netlink: 'syz.2.6431': attribute type 10 has an invalid length. [ 2373.439108][T31097] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2373.447408][T31097] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 2373.464250][T31097] netlink: 'syz.2.6431': attribute type 10 has an invalid length. [ 2373.472102][T31097] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6431'. [ 2373.481081][T31097] batadv0: entered promiscuous mode [ 2373.486846][T31097] batadv0: entered allmulticast mode [ 2373.578799][T31097] bond0: (slave batadv0): Releasing backup interface [ 2373.586889][T31097] bridge0: port 3(batadv0) entered blocking state [ 2373.594002][T31097] bridge0: port 3(batadv0) entered disabled state [ 2373.629300][ T30] audit: type=1400 audit(2000000911.891:1953): avc: denied { append } for pid=31091 comm="syz.2.6431" name="mice" dev="devtmpfs" ino=916 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 2373.661140][T25547] usb 6-1: device descriptor read/64, error -71 [ 2373.675046][ T30] audit: type=1400 audit(2000000911.938:1954): avc: denied { watch watch_reads } for pid=31098 comm="syz.4.6432" path="pipe:[134819]" dev="pipefs" ino=134819 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=fifo_file permissive=1 [ 2373.780874][ T49] batman_adv: batadv0: No IGMP Querier present - multicast optimizations disabled [ 2373.790620][ T49] batman_adv: batadv0: No MLD Querier present - multicast optimizations disabled [ 2374.018508][T25547] usb 6-1: new high-speed USB device number 42 using dummy_hcd [ 2374.026291][T17458] usb 5-1: new high-speed USB device number 40 using dummy_hcd [ 2374.327764][T31108] fuse: Bad value for 'fd' [ 2374.369506][T25547] usb 6-1: device descriptor read/64, error -71 [ 2374.380580][T31108] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6434'. [ 2374.390897][T17458] usb 5-1: Using ep0 maxpacket: 16 [ 2374.402771][T17458] usb 5-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2374.430421][T17458] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 2374.515090][T17458] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 2374.524492][T25547] usb usb6-port1: attempt power cycle [ 2374.537409][T17458] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2374.545551][T17458] usb 5-1: Product: syz [ 2374.549975][T17458] usb 5-1: Manufacturer: syz [ 2374.554864][T17458] usb 5-1: SerialNumber: syz [ 2374.657782][T28558] usb 3-1: new high-speed USB device number 33 using dummy_hcd [ 2374.782469][T17458] usb 5-1: 0:2 : does not exist [ 2374.801817][T17458] usb 5-1: 5:0: failed to get current value for ch 0 (-22) [ 2374.819125][T17458] usb 5-1: USB disconnect, device number 40 [ 2374.838540][T28558] usb 3-1: Using ep0 maxpacket: 16 [ 2374.846699][T28558] usb 3-1: no configurations [ 2374.848536][T31074] udevd[31074]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 2374.852608][T28558] usb 3-1: can't read configurations, error -22 [ 2374.892088][T25547] usb 6-1: new high-speed USB device number 43 using dummy_hcd [ 2374.914696][T25547] usb 6-1: device descriptor read/8, error -71 [ 2375.009614][T28558] usb 3-1: new high-speed USB device number 34 using dummy_hcd [ 2375.169910][T28558] usb 3-1: Using ep0 maxpacket: 16 [ 2375.175827][T28558] usb 3-1: no configurations [ 2375.180525][T28558] usb 3-1: can't read configurations, error -22 [ 2375.186905][T25547] usb 6-1: new high-speed USB device number 44 using dummy_hcd [ 2375.194798][T28558] usb usb3-port1: attempt power cycle [ 2375.213759][T25547] usb 6-1: device descriptor read/8, error -71 [ 2375.331247][T25547] usb usb6-port1: unable to enumerate USB device [ 2375.390705][T31115] FAULT_INJECTION: forcing a failure. [ 2375.390705][T31115] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2375.403791][T31115] CPU: 0 UID: 0 PID: 31115 Comm: syz.4.6436 Tainted: G L syzkaller #0 PREEMPT(full) [ 2375.403809][T31115] Tainted: [L]=SOFTLOCKUP [ 2375.403813][T31115] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2375.403819][T31115] Call Trace: [ 2375.403823][T31115] [ 2375.403828][T31115] dump_stack_lvl+0x16c/0x1f0 [ 2375.403845][T31115] should_fail_ex+0x512/0x640 [ 2375.403865][T31115] _copy_from_user+0x2e/0xd0 [ 2375.403883][T31115] copy_msghdr_from_user+0x98/0x160 [ 2375.403896][T31115] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 2375.403914][T31115] ___sys_sendmsg+0xfe/0x1d0 [ 2375.403926][T31115] ? __pfx____sys_sendmsg+0x10/0x10 [ 2375.403954][T31115] __sys_sendmsg+0x16d/0x220 [ 2375.403965][T31115] ? __pfx___sys_sendmsg+0x10/0x10 [ 2375.403986][T31115] do_syscall_64+0xcd/0xf80 [ 2375.404001][T31115] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2375.404013][T31115] RIP: 0033:0x7f8d52f8f749 [ 2375.404022][T31115] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2375.404033][T31115] RSP: 002b:00007f8d53e94038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 2375.404045][T31115] RAX: ffffffffffffffda RBX: 00007f8d531e5fa0 RCX: 00007f8d52f8f749 [ 2375.404052][T31115] RDX: 0000000000000080 RSI: 0000200000000880 RDI: 0000000000000003 [ 2375.404058][T31115] RBP: 00007f8d53e94090 R08: 0000000000000000 R09: 0000000000000000 [ 2375.404065][T31115] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2375.404071][T31115] R13: 00007f8d531e6038 R14: 00007f8d531e5fa0 R15: 00007ffe70e1e718 [ 2375.404086][T31115] [ 2375.586979][T28558] usb 3-1: new high-speed USB device number 35 using dummy_hcd [ 2375.608668][T28558] usb 3-1: Using ep0 maxpacket: 16 [ 2375.609217][T28558] usb 3-1: no configurations [ 2375.609234][T28558] usb 3-1: can't read configurations, error -22 [ 2375.628594][ T30] audit: type=1400 audit(2000000913.762:1955): avc: denied { associate } for pid=31116 comm="syz.3.6437" name="pfkey" scontext=root:object_r:sysadm_t tcontext=system_u:object_r:proc_t tclass=filesystem permissive=1 [ 2375.747253][T28558] usb 3-1: new high-speed USB device number 36 using dummy_hcd [ 2375.769060][T28558] usb 3-1: Using ep0 maxpacket: 16 [ 2375.774892][T28558] usb 3-1: no configurations [ 2375.781017][T28558] usb 3-1: can't read configurations, error -22 [ 2376.106909][T28558] usb usb3-port1: unable to enumerate USB device [ 2376.931012][T31140] netlink: 24 bytes leftover after parsing attributes in process `syz.1.6443'. [ 2377.779504][T28558] usb 4-1: new high-speed USB device number 53 using dummy_hcd [ 2378.034713][T28558] usb 4-1: device descriptor read/64, error -71 [ 2378.908546][ T30] audit: type=1400 audit(2000000916.775:1956): avc: denied { getopt } for pid=31153 comm="syz.1.6447" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 2379.648853][T28558] usb 4-1: new high-speed USB device number 54 using dummy_hcd [ 2379.865924][T28558] usb 4-1: device descriptor read/64, error -71 [ 2380.034896][T28558] usb usb4-port1: attempt power cycle [ 2380.450741][T28558] usb 4-1: new high-speed USB device number 55 using dummy_hcd [ 2380.774203][T28558] usb 4-1: device descriptor read/8, error -71 [ 2382.064998][T28558] usb 4-1: new high-speed USB device number 56 using dummy_hcd [ 2382.900928][T28558] usb 4-1: config 0 descriptor has 1 excess byte, ignoring [ 2382.927478][T28558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x9 has invalid wMaxPacketSize 0 [ 2382.965508][T28558] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0xA has an invalid bInterval 0, changing to 7 [ 2383.013719][T28558] usb 4-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2383.056680][T28558] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2383.110738][T28558] usb 4-1: Product: syz [ 2383.121044][T28558] usb 4-1: Manufacturer: syz [ 2383.136804][T28558] usb 4-1: SerialNumber: syz [ 2383.143508][T28558] usb 4-1: config 0 descriptor?? [ 2383.179233][T28558] usb 4-1: 0:0 : invalid sync pipe. is_playback 1, ep 0a, bSynchAddress f8 [ 2383.490748][T25185] usb 2-1: new high-speed USB device number 71 using dummy_hcd [ 2383.564711][T28558] usb 4-1: USB disconnect, device number 56 [ 2383.753597][T25185] usb 2-1: Using ep0 maxpacket: 8 [ 2383.769077][T25185] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2383.787096][T25185] usb 2-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2383.796250][T25185] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2383.811168][T25185] usb 2-1: config 0 descriptor?? [ 2384.203095][T25185] iowarrior 2-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 2384.445979][ T30] audit: type=1400 audit(2000000921.882:1957): avc: denied { setopt } for pid=31192 comm="syz.3.6457" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 2384.604122][T31197] atomic_op ffff888057c30198 conn xmit_atomic 0000000000000000 [ 2385.487001][ T30] audit: type=1400 audit(2000000922.968:1958): avc: denied { setopt } for pid=31205 comm="syz.3.6459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2385.542137][T31209] ./cgroup.net/devices.allow: Can't lookup blockdev [ 2385.646673][T31212] netlink: 44 bytes leftover after parsing attributes in process `syz.5.6461'. [ 2386.061047][ T30] audit: type=1400 audit(2000000922.968:1959): avc: denied { getopt } for pid=31205 comm="syz.3.6459" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1 [ 2386.100095][ T30] audit: type=1400 audit(2000000923.042:1960): avc: denied { mounton } for pid=31205 comm="syz.3.6459" path="/syzcgroup/net/syz3/devices.allow" dev="cgroup" ino=174 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 2386.800116][T15007] usb 6-1: new high-speed USB device number 45 using dummy_hcd [ 2387.026320][T15007] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2387.109266][T26062] usb 2-1: USB disconnect, device number 71 [ 2387.148465][T15007] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 2387.295765][T15007] usb 6-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00 [ 2387.409118][T15007] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2387.846109][T15007] usb 6-1: config 0 descriptor?? [ 2388.459249][T29044] Bluetooth: hci0: unexpected event 0x32 length: 13 > 9 [ 2388.459826][ T30] audit: type=1400 audit(2000000925.540:1961): avc: denied { setopt } for pid=31221 comm="syz.2.6464" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ax25_socket permissive=1 [ 2388.615271][T31232] FAULT_INJECTION: forcing a failure. [ 2388.615271][T31232] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 2388.628558][T31232] CPU: 1 UID: 0 PID: 31232 Comm: syz.3.6466 Tainted: G L syzkaller #0 PREEMPT(full) [ 2388.628583][T31232] Tainted: [L]=SOFTLOCKUP [ 2388.628587][T31232] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2388.628594][T31232] Call Trace: [ 2388.628598][T31232] [ 2388.628602][T31232] dump_stack_lvl+0x16c/0x1f0 [ 2388.628621][T31232] should_fail_ex+0x512/0x640 [ 2388.628640][T31232] _copy_from_user+0x2e/0xd0 [ 2388.628657][T31232] __sys_bpf+0x248/0x4980 [ 2388.628676][T31232] ? __pfx___sys_bpf+0x10/0x10 [ 2388.628691][T31232] ? find_held_lock+0x2b/0x80 [ 2388.628713][T31232] ? find_held_lock+0x2b/0x80 [ 2388.628733][T31232] ? __mutex_unlock_slowpath+0x161/0x790 [ 2388.628760][T31232] ? fput+0x70/0xf0 [ 2388.628770][T31232] ? ksys_write+0x1ac/0x250 [ 2388.628784][T31232] ? __pfx_ksys_write+0x10/0x10 [ 2388.628800][T31232] __x64_sys_bpf+0x78/0xc0 [ 2388.628816][T31232] ? lockdep_hardirqs_on+0x7c/0x110 [ 2388.628830][T31232] do_syscall_64+0xcd/0xf80 [ 2388.628846][T31232] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2388.628857][T31232] RIP: 0033:0x7fa9b298f749 [ 2388.628867][T31232] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2388.628878][T31232] RSP: 002b:00007fa9b3913038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 2388.628890][T31232] RAX: ffffffffffffffda RBX: 00007fa9b2be5fa0 RCX: 00007fa9b298f749 [ 2388.628897][T31232] RDX: 0000000000000048 RSI: 00002000000009c0 RDI: 0000000000000000 [ 2388.628904][T31232] RBP: 00007fa9b3913090 R08: 0000000000000000 R09: 0000000000000000 [ 2388.628911][T31232] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 2388.628917][T31232] R13: 00007fa9b2be6038 R14: 00007fa9b2be5fa0 R15: 00007ffc7fc14838 [ 2388.628932][T31232] [ 2390.113654][T15007] usb 4-1: new full-speed USB device number 57 using dummy_hcd [ 2390.253452][T15007] usb 4-1: device descriptor read/64, error -71 [ 2390.331920][T31265] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6475'. [ 2390.541561][T15007] usb 4-1: new full-speed USB device number 58 using dummy_hcd [ 2391.599500][T15007] usb 4-1: device descriptor read/64, error -71 [ 2391.739639][T17458] usb 6-1: USB disconnect, device number 45 [ 2391.740900][T15007] usb usb4-port1: attempt power cycle [ 2394.940301][T31280] netlink: 68 bytes leftover after parsing attributes in process `syz.5.6477'. [ 2395.242046][T31285] xt_CHECKSUM: CHECKSUM should be avoided. If really needed, restrict with "-p udp" and only use in OUTPUT [ 2395.650914][T15007] usb 4-1: new high-speed USB device number 60 using dummy_hcd [ 2395.661465][T17458] usb 2-1: new high-speed USB device number 72 using dummy_hcd [ 2395.821939][T17458] usb 2-1: Using ep0 maxpacket: 8 [ 2395.826294][T15007] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 2395.829384][T17458] usb 2-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 2395.843126][T15007] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2396.203100][T15007] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 2396.220855][T15007] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 2396.248586][T15007] usb 4-1: Manufacturer: syz [ 2396.268194][T17458] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2396.291100][T15007] usb 4-1: config 0 descriptor?? [ 2396.324759][T17458] pvrusb2: Hardware description: Terratec Grabster AV400 [ 2396.501484][T17458] pvrusb2: ********** [ 2396.517444][T17458] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 2396.695504][T17458] pvrusb2: Important functionality might not be entirely working. [ 2396.717425][T31275] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6478'. [ 2396.726545][T31294] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6478'. [ 2396.746797][T17458] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 2396.748181][T15007] rc_core: IR keymap rc-hauppauge not found [ 2396.758594][T17458] pvrusb2: ********** [ 2396.769261][T31295] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(6) [ 2396.775767][T31295] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 2396.790712][ T2338] pvrusb2: Invalid write control endpoint [ 2396.797122][T31295] vhci_hcd vhci_hcd.0: Device attached [ 2396.832298][T31295] bridge0: port 3(batadv0) entered disabled state [ 2396.846429][T31295] bridge_slave_0: left allmulticast mode [ 2396.864031][T15007] Registered IR keymap rc-empty [ 2396.869551][T15007] rc rc0: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0 [ 2396.882074][T15007] input: IgorPlug-USB IR Receiver as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/rc/rc0/input298 [ 2396.901662][T31295] bridge_slave_0: left promiscuous mode [ 2396.912835][T31295] bridge0: port 1(bridge_slave_0) entered disabled state [ 2397.264964][T26060] usb 38-1: SetAddress Request (2) to port 0 [ 2397.271096][T26060] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 2397.316232][T31295] bridge_slave_1: left allmulticast mode [ 2397.317121][ T2338] pvrusb2: Invalid write control endpoint [ 2397.330446][T31295] bridge_slave_1: left promiscuous mode [ 2397.337524][T15007] usb 4-1: USB disconnect, device number 60 [ 2397.359853][T31295] bridge0: port 2(bridge_slave_1) entered disabled state [ 2397.418918][ T2338] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 2397.663525][T31306] 9p: Bad value for 'wfdno' [ 2397.685487][ T2338] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 2397.703751][ T2338] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 2397.778530][T31295] bond0: (slave bond_slave_0): Releasing backup interface [ 2397.816949][ T2338] pvrusb2: Device being rendered inoperable [ 2397.935545][ T2338] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 2397.946164][T31295] bond0: (slave bond_slave_1): Releasing backup interface [ 2397.968479][T31295] team0: Port device team_slave_0 removed [ 2398.410955][T31295] team0: Port device team_slave_1 removed [ 2398.419552][T31295] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2398.426973][T31295] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2398.436276][T31295] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2398.444436][T31295] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2398.460431][ T2338] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_b) [ 2398.483081][ T2338] pvrusb2: Attached sub-driver cx25840 [ 2398.488624][ T2338] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 2398.498813][ T2338] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 2398.513404][T31295] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 2398.580917][T31311] netlink: 132 bytes leftover after parsing attributes in process `syz.1.6479'. [ 2398.596985][T31296] vhci_hcd: connection reset by peer [ 2398.609414][T25241] vhci_hcd vhci_hcd.2: stop threads [ 2398.625676][T25241] vhci_hcd vhci_hcd.2: release socket [ 2398.636238][T25241] vhci_hcd vhci_hcd.2: disconnect device [ 2399.028575][T17458] usb 5-1: new high-speed USB device number 41 using dummy_hcd [ 2399.188918][T17458] usb 5-1: Using ep0 maxpacket: 8 [ 2399.209942][T17458] usb 5-1: unable to get BOS descriptor or descriptor too short [ 2399.502073][T17458] usb 5-1: config 4 has an invalid interface number: 30 but max is 0 [ 2399.512081][T17458] usb 5-1: config 4 has no interface number 0 [ 2399.524722][T17458] usb 5-1: config 4 interface 30 has no altsetting 0 [ 2399.545563][T17458] usb 5-1: string descriptor 0 read error: -22 [ 2399.557043][T17458] usb 5-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 2399.577025][T17458] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2399.599025][T17458] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 2399.608711][T17458] dw2102: su3000_power_ctrl: 1, initialized 0 [ 2399.617512][T17458] dvb-usb: bulk message failed: -22 (2/0) [ 2399.643590][T17458] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2399.665475][T17458] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 2399.678663][T17458] usb 5-1: media controller created [ 2399.694299][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2399.702142][T17458] dw2102: i2c transfer failed. [ 2399.707722][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2399.745007][T17458] dw2102: i2c transfer failed. [ 2399.753440][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2399.762803][T25185] usb 2-1: USB disconnect, device number 72 [ 2399.808929][T17458] dw2102: i2c transfer failed. [ 2399.827099][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2399.840948][T17458] dw2102: i2c transfer failed. [ 2399.854314][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2399.869474][T17458] dw2102: i2c transfer failed. [ 2399.895151][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2399.900861][T17458] dw2102: i2c transfer failed. [ 2399.905123][T26062] usb 3-1: new low-speed USB device number 37 using dummy_hcd [ 2399.911231][T17458] dvb-usb: MAC address: 02:02:02:02:02:02 [ 2399.982325][T17458] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2400.287255][T26062] usb 3-1: New USB device found, idVendor=046d, idProduct=08b1, bcdDevice=6d.2a [ 2400.290223][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2400.326101][T17458] dw2102: command 0x0e transfer failed. [ 2400.332142][T26062] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2400.356243][T26062] usb 3-1: config 0 descriptor?? [ 2400.379245][T26062] pwc: Logitech QuickCam Notebook Pro USB webcam detected. [ 2400.386440][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2400.386459][T17458] dw2102: command 0x0e transfer failed. [ 2400.622387][T31338] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2400.695296][T31340] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6489'. [ 2400.717588][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2400.742102][T31340] netlink: 40 bytes leftover after parsing attributes in process `syz.2.6489'. [ 2400.926121][T17458] dw2102: command 0x0e transfer failed. [ 2400.932051][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2400.937768][T17458] dw2102: command 0x0e transfer failed. [ 2400.952640][T17458] dvb-usb: bulk message failed: -22 (1/0) [ 2400.959785][T17458] dw2102: command 0x51 transfer failed. [ 2400.981071][T31338] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2401.006096][T17458] dvb-usb: bulk message failed: -22 (5/0) [ 2401.011841][T17458] dw2102: i2c probe for address 0x68 failed. [ 2401.051035][T17458] dvb-usb: bulk message failed: -22 (5/0) [ 2401.105402][T31338] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2401.115984][T17458] dw2102: i2c probe for address 0x69 failed. [ 2401.150967][ T30] audit: type=1400 audit(2000000937.646:1962): avc: denied { sqpoll } for pid=31341 comm="syz.4.6495" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 2401.155908][T17458] dvb-usb: bulk message failed: -22 (5/0) [ 2401.179235][T26062] pwc: Failed to set LED on/off time (-71) [ 2401.348223][T17458] dw2102: i2c probe for address 0x6a failed. [ 2401.354263][T17458] dw2102: probing for demodulator failed. Is the external power switched on? [ 2401.363639][T17458] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 2401.444443][T26062] pwc: send_video_command error -71 [ 2401.449658][T26062] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2401.465785][T26062] Philips webcam 3-1:0.0: probe with driver Philips webcam failed with error -71 [ 2401.476655][T26062] usb 3-1: USB disconnect, device number 37 [ 2401.723028][T17458] rc_core: IR keymap rc-tt-1500 not found [ 2401.728766][T17458] Registered IR keymap rc-empty [ 2401.745603][T17458] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0 [ 2401.770674][T17458] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.4/usb5/5-1/rc/rc0/input299 [ 2401.811920][T17458] dvb-usb: schedule remote query interval to 250 msecs. [ 2401.829280][T17458] dw2102: su3000_power_ctrl: 0, initialized 1 [ 2401.836674][T17458] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 2401.942040][T17458] usb 5-1: USB disconnect, device number 41 [ 2402.631486][T17458] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 2402.737889][T26060] usb 38-1: device descriptor read/8, error -110 [ 2403.337763][T26060] usb usb38-port1: attempt power cycle [ 2403.957226][T26060] usb usb38-port1: unable to enumerate USB device [ 2404.261064][ T30] audit: type=1400 audit(2000000940.546:1963): avc: denied { read } for pid=31395 comm="syz.2.6501" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1 [ 2405.518661][T31412] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2405.634634][T18157] usb 4-1: new high-speed USB device number 61 using dummy_hcd [ 2406.013889][T31413] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2406.068902][T31412] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2406.158429][T18157] usb 4-1: Using ep0 maxpacket: 8 [ 2406.165279][T18157] usb 4-1: unable to get BOS descriptor or descriptor too short [ 2406.187227][T18157] usb 4-1: config 4 has an invalid interface number: 30 but max is 0 [ 2406.222300][T18157] usb 4-1: config 4 has no interface number 0 [ 2406.248669][T18157] usb 4-1: config 4 interface 30 has no altsetting 0 [ 2406.268720][T18157] usb 4-1: string descriptor 0 read error: -22 [ 2406.274933][T18157] usb 4-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 2406.313133][T18157] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2406.338906][T18157] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 2406.356287][T18157] dw2102: su3000_power_ctrl: 1, initialized 0 [ 2406.459844][T18157] dvb-usb: bulk message failed: -22 (2/0) [ 2406.472155][T18157] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2406.489992][T18157] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 2406.502627][T18157] usb 4-1: media controller created [ 2406.932298][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2406.938048][T18157] dw2102: i2c transfer failed. [ 2406.984120][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2406.996192][T18157] dw2102: i2c transfer failed. [ 2407.015260][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2407.035763][T18157] dw2102: i2c transfer failed. [ 2407.040542][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2407.077651][T18157] dw2102: i2c transfer failed. [ 2407.095793][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2407.113398][T18157] dw2102: i2c transfer failed. [ 2407.126767][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2407.157322][T31424] netlink: 24 bytes leftover after parsing attributes in process `syz.2.6509'. [ 2407.274908][T18157] dw2102: i2c transfer failed. [ 2407.282285][T18157] dvb-usb: MAC address: 02:02:02:02:02:02 [ 2407.789080][T18157] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2407.911439][ T24] usb 6-1: new high-speed USB device number 46 using dummy_hcd [ 2407.933154][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2407.964870][T18157] dw2102: command 0x0e transfer failed. [ 2407.970426][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2408.021084][T18157] dw2102: command 0x0e transfer failed. [ 2408.037757][T31432] GUP no longer grows the stack in syz.1.6511 (31432): 200000004000-200000008000 (200000002000) [ 2408.076148][ T24] usb 6-1: Using ep0 maxpacket: 32 [ 2408.179335][T31432] CPU: 1 UID: 0 PID: 31432 Comm: syz.1.6511 Tainted: G L syzkaller #0 PREEMPT(full) [ 2408.179369][T31432] Tainted: [L]=SOFTLOCKUP [ 2408.179376][T31432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2408.179388][T31432] Call Trace: [ 2408.179395][T31432] [ 2408.179403][T31432] dump_stack_lvl+0x16c/0x1f0 [ 2408.179432][T31432] gup_vma_lookup+0x1d2/0x220 [ 2408.179457][T31432] __get_user_pages+0x241/0x3590 [ 2408.179491][T31432] ? find_held_lock+0x2b/0x80 [ 2408.179522][T31432] ? __pfx___get_user_pages+0x10/0x10 [ 2408.179554][T31432] get_user_pages_remote+0x243/0xab0 [ 2408.179581][T31432] ? mas_new_root+0x690/0x6e0 [ 2408.179606][T31432] ? __pfx_get_user_pages_remote+0x10/0x10 [ 2408.179634][T31432] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 2408.179661][T31432] __access_remote_vm+0x24d/0x850 [ 2408.179688][T31432] ? do_raw_spin_lock+0x12c/0x2b0 [ 2408.179714][T31432] ? __pfx___access_remote_vm+0x10/0x10 [ 2408.179744][T31432] proc_pid_cmdline_read+0x4de/0x8e0 [ 2408.179768][T31432] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 2408.179789][T31432] ? rw_verify_area+0xcf/0x6c0 [ 2408.179810][T31432] ? __pfx_proc_pid_cmdline_read+0x10/0x10 [ 2408.179828][T31432] vfs_readv+0x5c1/0x8b0 [ 2408.179854][T31432] ? __pfx_vfs_readv+0x10/0x10 [ 2408.179893][T31432] ? __fget_files+0x20e/0x3c0 [ 2408.179926][T31432] ? do_preadv+0x1a6/0x270 [ 2408.179947][T31432] do_preadv+0x1a6/0x270 [ 2408.179971][T31432] ? __pfx_do_preadv+0x10/0x10 [ 2408.179999][T31432] do_syscall_64+0xcd/0xf80 [ 2408.180026][T31432] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2408.180046][T31432] RIP: 0033:0x7f03e6b8f749 [ 2408.180061][T31432] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 2408.180081][T31432] RSP: 002b:00007f03e798c038 EFLAGS: 00000246 ORIG_RAX: 0000000000000127 [ 2408.180098][T31432] RAX: ffffffffffffffda RBX: 00007f03e6de5fa0 RCX: 00007f03e6b8f749 [ 2408.180112][T31432] RDX: 0000000000000001 RSI: 0000200000000d00 RDI: 0000000000000003 [ 2408.180123][T31432] RBP: 00007f03e6c13f91 R08: 0000000000000200 R09: 0000000000000000 [ 2408.180134][T31432] R10: 0000000000000002 R11: 0000000000000246 R12: 0000000000000000 [ 2408.180145][T31432] R13: 00007f03e6de6038 R14: 00007f03e6de5fa0 R15: 00007ffd77bf2298 [ 2408.180171][T31432] [ 2408.181724][ T24] usb 6-1: config 0 has an invalid interface number: 67 but max is 0 [ 2408.582392][ T24] usb 6-1: config 0 has no interface number 0 [ 2408.591064][ T24] usb 6-1: New USB device found, idVendor=0424, idProduct=9901, bcdDevice=c2.57 [ 2408.600228][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2408.608224][ T24] usb 6-1: Product: syz [ 2408.612374][ T24] usb 6-1: Manufacturer: syz [ 2408.617054][ T24] usb 6-1: SerialNumber: syz [ 2408.653945][ T24] usb 6-1: config 0 descriptor?? [ 2408.659210][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2409.071651][ T24] smsc95xx v2.0.0 [ 2409.098486][ T30] audit: type=1400 audit(2000000944.765:1964): avc: denied { shutdown } for pid=31431 comm="syz.1.6511" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 2409.284969][T18157] dw2102: command 0x0e transfer failed. [ 2409.308850][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2409.329476][T18157] dw2102: command 0x0e transfer failed. [ 2409.354975][T18157] dvb-usb: bulk message failed: -22 (1/0) [ 2409.561835][T18157] dw2102: command 0x51 transfer failed. [ 2409.580565][T18157] dvb-usb: bulk message failed: -22 (5/0) [ 2409.604059][T18157] dw2102: i2c probe for address 0x68 failed. [ 2409.634251][T18157] dvb-usb: bulk message failed: -22 (5/0) [ 2409.650932][ T24] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to read reg index 0x00000030: -32 [ 2409.660928][T18157] dw2102: i2c probe for address 0x69 failed. [ 2409.673965][T31440] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6514'. [ 2409.696406][T31440] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.6514' sets config #31 [ 2409.713731][T18157] dvb-usb: bulk message failed: -22 (5/0) [ 2409.742462][T18157] dw2102: i2c probe for address 0x6a failed. [ 2409.757279][ T24] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Error reading E2P_CMD [ 2409.768240][T18157] dw2102: probing for demodulator failed. Is the external power switched on? [ 2409.829143][T18157] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 2410.070829][T18157] rc_core: IR keymap rc-tt-1500 not found [ 2410.112006][T18157] Registered IR keymap rc-empty [ 2410.310663][T18157] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 2410.400889][T18157] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input300 [ 2410.470147][T18157] dvb-usb: schedule remote query interval to 250 msecs. [ 2410.483204][ T24] smsc95xx 6-1:0.67 (unnamed net_device) (uninitialized): Failed to write reg index 0x00000104: -71 [ 2410.528859][ T24] smsc95xx 6-1:0.67: probe with driver smsc95xx failed with error -71 [ 2410.531018][T18157] dw2102: su3000_power_ctrl: 0, initialized 1 [ 2410.592777][T18157] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 2410.644947][ T24] usb 6-1: USB disconnect, device number 46 [ 2410.654022][T18157] usb 4-1: USB disconnect, device number 61 [ 2410.796400][T18157] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 2411.139726][T18157] usb 4-1: new low-speed USB device number 62 using dummy_hcd [ 2411.327713][T18157] usb 4-1: New USB device found, idVendor=046d, idProduct=08b1, bcdDevice=6d.2a [ 2411.384604][T18157] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2411.417724][T18157] usb 4-1: config 0 descriptor?? [ 2411.450632][T18157] pwc: Logitech QuickCam Notebook Pro USB webcam detected. [ 2411.976354][T31467] netlink: 64 bytes leftover after parsing attributes in process `syz.3.6517'. [ 2412.050064][T31467] netlink: 40 bytes leftover after parsing attributes in process `syz.3.6517'. [ 2412.358272][T18157] pwc: Failed to set LED on/off time (-71) [ 2412.387211][T18157] pwc: send_video_command error -71 [ 2412.423083][T18157] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2412.716065][T25547] usb 3-1: new high-speed USB device number 38 using dummy_hcd [ 2412.777000][T18157] Philips webcam 4-1:0.0: probe with driver Philips webcam failed with error -71 [ 2412.818092][T18157] usb 4-1: USB disconnect, device number 62 [ 2412.947659][T25547] usb 3-1: Using ep0 maxpacket: 8 [ 2412.954773][T25547] usb 3-1: unable to get BOS descriptor or descriptor too short [ 2412.963845][T25547] usb 3-1: config 4 has an invalid interface number: 30 but max is 0 [ 2412.995212][T25547] usb 3-1: config 4 has no interface number 0 [ 2413.031676][T25547] usb 3-1: config 4 interface 30 has no altsetting 0 [ 2413.045204][T25547] usb 3-1: string descriptor 0 read error: -22 [ 2413.054534][T25547] usb 3-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 2413.080344][T25547] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2413.152870][T25547] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 2413.247076][T25547] dw2102: su3000_power_ctrl: 1, initialized 0 [ 2413.270655][T25547] dvb-usb: bulk message failed: -22 (2/0) [ 2413.280130][T25547] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2413.292182][T25547] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 2413.798739][T25547] usb 3-1: media controller created [ 2413.804027][T25547] dvb-usb: bulk message failed: -22 (6/0) [ 2413.810393][T25547] dw2102: i2c transfer failed. [ 2413.815218][T25547] dvb-usb: bulk message failed: -22 (6/0) [ 2413.821811][T25547] dw2102: i2c transfer failed. [ 2413.826603][T25547] dvb-usb: bulk message failed: -22 (6/0) [ 2413.832318][T25547] dw2102: i2c transfer failed. [ 2413.837107][T25547] dvb-usb: bulk message failed: -22 (6/0) [ 2414.039460][T25547] dw2102: i2c transfer failed. [ 2414.283679][T25547] dvb-usb: bulk message failed: -22 (6/0) [ 2414.393964][T25547] dw2102: i2c transfer failed. [ 2414.404765][T25547] dvb-usb: bulk message failed: -22 (6/0) [ 2414.410502][T25547] dw2102: i2c transfer failed. [ 2414.439678][T25547] dvb-usb: MAC address: 02:02:02:02:02:02 [ 2414.895634][T18157] usb 2-1: new high-speed USB device number 73 using dummy_hcd [ 2414.905442][T25547] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2414.958866][T25547] dvb-usb: bulk message failed: -22 (3/0) [ 2414.972148][T31498] fuse: Bad value for 'fd' [ 2415.120820][T25547] dw2102: command 0x0e transfer failed. [ 2415.137594][T18157] usb 2-1: Using ep0 maxpacket: 8 [ 2415.148916][T31498] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6527'. [ 2415.160402][T25547] dvb-usb: bulk message failed: -22 (3/0) [ 2415.166127][T25547] dw2102: command 0x0e transfer failed. [ 2415.178431][T18157] usb 2-1: unable to get BOS descriptor or descriptor too short [ 2415.222062][T18157] usb 2-1: config 4 has an invalid interface number: 30 but max is 0 [ 2415.244722][T18157] usb 2-1: config 4 has no interface number 0 [ 2415.251257][T18157] usb 2-1: config 4 interface 30 has no altsetting 0 [ 2415.487096][ T8093] usb 5-1: new high-speed USB device number 42 using dummy_hcd [ 2415.556455][T18157] usb 2-1: string descriptor 0 read error: -22 [ 2415.562770][T18157] usb 2-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 2415.572296][T25547] dvb-usb: bulk message failed: -22 (3/0) [ 2415.639985][T25547] dw2102: command 0x0e transfer failed. [ 2415.655078][T25547] dvb-usb: bulk message failed: -22 (3/0) [ 2415.671576][ T8093] usb 5-1: Using ep0 maxpacket: 16 [ 2415.671656][T25547] dw2102: command 0x0e transfer failed. [ 2415.703995][T25547] dvb-usb: bulk message failed: -22 (1/0) [ 2415.704516][ T8093] usb 5-1: no configurations [ 2415.733950][T25547] dw2102: command 0x51 transfer failed. [ 2415.736345][ T8093] usb 5-1: can't read configurations, error -22 [ 2415.741336][T25547] dvb-usb: bulk message failed: -22 (5/0) [ 2415.762347][T25547] dw2102: i2c probe for address 0x68 failed. [ 2415.778841][T25547] dvb-usb: bulk message failed: -22 (5/0) [ 2415.789905][T25547] dw2102: i2c probe for address 0x69 failed. [ 2415.800204][T25547] dvb-usb: bulk message failed: -22 (5/0) [ 2415.805912][T25547] dw2102: i2c probe for address 0x6a failed. [ 2415.822251][T18157] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2415.832415][T25547] dw2102: probing for demodulator failed. Is the external power switched on? [ 2415.869504][T25547] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 2416.056718][T18157] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 2416.096407][T18157] dw2102: su3000_power_ctrl: 1, initialized 0 [ 2416.107162][T18157] dvb-usb: bulk message failed: -22 (2/0) [ 2416.119192][T18157] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2416.131586][ T8093] usb 5-1: new high-speed USB device number 43 using dummy_hcd [ 2416.177195][T18157] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 2416.259850][T18157] usb 2-1: media controller created [ 2416.275880][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2416.289485][T31509] netlink: 'syz.3.6530': attribute type 4 has an invalid length. [ 2416.319078][T18157] dw2102: i2c transfer failed. [ 2416.323852][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2416.340623][T11710] Bluetooth: hci0: command 0x0406 tx timeout [ 2416.346679][ T8093] usb 5-1: Using ep0 maxpacket: 16 [ 2416.352835][ T8093] usb 5-1: no configurations [ 2416.373157][ T8093] usb 5-1: can't read configurations, error -22 [ 2416.377443][T25547] rc_core: IR keymap rc-tt-1500 not found [ 2416.388109][T18157] dw2102: i2c transfer failed. [ 2416.404018][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2416.410011][ T8093] usb usb5-port1: attempt power cycle [ 2416.430883][T25547] Registered IR keymap rc-empty [ 2416.430889][T18157] dw2102: i2c transfer failed. [ 2416.430911][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2416.466578][T18157] dw2102: i2c transfer failed. [ 2416.472938][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2416.493123][T18157] dw2102: i2c transfer failed. [ 2416.493847][T25547] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0 [ 2416.498030][T18157] dvb-usb: bulk message failed: -22 (6/0) [ 2416.535103][T18157] dw2102: i2c transfer failed. [ 2416.547126][T18157] dvb-usb: MAC address: 02:02:02:02:02:02 [ 2416.666999][T18157] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2416.748178][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2416.771802][T18157] dw2102: command 0x0e transfer failed. [ 2416.772240][T25547] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.2/usb3/3-1/rc/rc0/input301 [ 2416.805039][ T8093] usb 5-1: new high-speed USB device number 44 using dummy_hcd [ 2416.849184][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2416.859052][ T8093] usb 5-1: Using ep0 maxpacket: 16 [ 2416.879888][ T8093] usb 5-1: no configurations [ 2416.884521][T18157] dw2102: command 0x0e transfer failed. [ 2416.905138][ T8093] usb 5-1: can't read configurations, error -22 [ 2416.926369][T25547] dvb-usb: schedule remote query interval to 250 msecs. [ 2417.355018][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2417.483702][T18157] dw2102: command 0x0e transfer failed. [ 2417.527394][T18157] dvb-usb: bulk message failed: -22 (3/0) [ 2417.617522][T18157] dw2102: command 0x0e transfer failed. [ 2417.630169][ T8093] usb 5-1: new high-speed USB device number 45 using dummy_hcd [ 2417.653662][T25547] dw2102: su3000_power_ctrl: 0, initialized 1 [ 2417.669235][T25547] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 2417.717693][T18157] dvb-usb: bulk message failed: -22 (1/0) [ 2417.736314][T18157] dw2102: command 0x51 transfer failed. [ 2418.240464][ T8093] usb 5-1: device not accepting address 45, error -71 [ 2418.253790][ T8093] usb usb5-port1: unable to enumerate USB device [ 2418.268758][T17458] dvb-usb: bulk message failed: -22 (1/0) [ 2418.284262][T29044] Bluetooth: hci2: unexpected event for opcode 0x0405 [ 2418.291444][T18157] dvb-usb: bulk message failed: -22 (5/0) [ 2418.301859][T17458] dw2102: i2c transfer failed. [ 2418.310507][T18157] dw2102: i2c probe for address 0x68 failed. [ 2418.320927][T18157] dvb-usb: bulk message failed: -22 (5/0) [ 2418.323155][T25547] usb 3-1: USB disconnect, device number 38 [ 2418.352390][T18157] dw2102: i2c probe for address 0x69 failed. [ 2418.362304][T18157] dvb-usb: bulk message failed: -22 (5/0) [ 2418.377008][T18157] dw2102: i2c probe for address 0x6a failed. [ 2418.387019][T18157] dw2102: probing for demodulator failed. Is the external power switched on? [ 2418.404608][T18157] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 2418.699637][T18157] rc_core: IR keymap rc-tt-1500 not found [ 2418.705366][T18157] Registered IR keymap rc-empty [ 2418.780461][T18157] rc rc1: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc1 [ 2418.833783][T18157] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.1/usb2/2-1/rc/rc1/input302 [ 2418.894331][T18157] dvb-usb: schedule remote query interval to 250 msecs. [ 2418.912897][T25547] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 2418.932276][T18157] dw2102: su3000_power_ctrl: 0, initialized 1 [ 2418.938354][T18157] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 2419.210117][T18157] dvb-usb: bulk message failed: -22 (1/0) [ 2419.237167][T18157] dw2102: i2c transfer failed. [ 2419.606059][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2419.612354][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2420.043869][T26062] dvb-usb: bulk message failed: -22 (1/0) [ 2420.049609][T26062] dw2102: i2c transfer failed. [ 2420.131523][T17458] usb 2-1: USB disconnect, device number 73 [ 2420.865641][T17458] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 2421.070199][T31561] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6541'. [ 2421.071059][ T30] audit: type=1400 audit(2000000956.281:1965): avc: denied { create } for pid=31554 comm="syz.4.6540" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 2421.284925][ T30] audit: type=1400 audit(2000000956.319:1966): avc: denied { setopt } for pid=31554 comm="syz.4.6540" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 2421.947474][ T30] audit: type=1400 audit(2000000957.104:1967): avc: denied { write } for pid=31571 comm="syz.4.6544" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 2422.008927][T31580] netlink: 56 bytes leftover after parsing attributes in process `syz.5.6547'. [ 2422.011467][T31579] netlink: 108 bytes leftover after parsing attributes in process `syz.1.6546'. [ 2422.223487][T31578] openvswitch: netlink: Flow key attr not present in new flow. [ 2423.261486][T17458] usb 6-1: new high-speed USB device number 47 using dummy_hcd [ 2423.475374][T17458] usb 6-1: Using ep0 maxpacket: 8 [ 2423.495426][T17458] usb 6-1: unable to get BOS descriptor or descriptor too short [ 2423.525734][T17458] usb 6-1: config 4 has an invalid interface number: 30 but max is 0 [ 2423.536038][T17458] usb 6-1: config 4 has no interface number 0 [ 2423.555465][T17458] usb 6-1: config 4 interface 30 has no altsetting 0 [ 2423.580149][T17458] usb 6-1: string descriptor 0 read error: -22 [ 2423.604077][T17458] usb 6-1: New USB device found, idVendor=9022, idProduct=d484, bcdDevice=ff.88 [ 2423.613121][T17458] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2423.732717][T17458] dvb-usb: found a 'TeVii S482 (tuner 2)' in warm state. [ 2423.782454][T17458] dw2102: su3000_power_ctrl: 1, initialized 0 [ 2423.839762][T17458] dvb-usb: bulk message failed: -22 (2/0) [ 2423.960121][T17458] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2424.001468][T17458] dvbdev: DVB: registering new adapter (TeVii S482 (tuner 2)) [ 2424.016467][T17458] usb 6-1: media controller created [ 2424.048650][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2424.106577][T17458] dw2102: i2c transfer failed. [ 2424.159296][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2424.180327][T17458] dw2102: i2c transfer failed. [ 2424.198497][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2424.221245][T17458] dw2102: i2c transfer failed. [ 2424.250172][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2424.286308][T17458] dw2102: i2c transfer failed. [ 2424.325167][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2424.343384][T17458] dw2102: i2c transfer failed. [ 2424.348173][T17458] dvb-usb: bulk message failed: -22 (6/0) [ 2424.574553][T17458] dw2102: i2c transfer failed. [ 2424.976707][T17458] dvb-usb: MAC address: 02:02:02:02:02:02 [ 2425.286161][T17458] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2425.376218][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2425.410018][T17458] dw2102: command 0x0e transfer failed. [ 2425.415587][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2425.450287][T17458] dw2102: command 0x0e transfer failed. [ 2425.794914][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2425.800701][T17458] dw2102: command 0x0e transfer failed. [ 2426.012102][T25547] usb 5-1: new high-speed USB device number 46 using dummy_hcd [ 2426.091659][T17458] dvb-usb: bulk message failed: -22 (3/0) [ 2426.232676][T17458] dw2102: command 0x0e transfer failed. [ 2426.305629][T17458] dvb-usb: bulk message failed: -22 (1/0) [ 2426.429111][T17458] dw2102: command 0x51 transfer failed. [ 2426.467144][T25547] usb 5-1: config 1 has an invalid interface number: 81 but max is 0 [ 2426.527001][T31631] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6560'. [ 2426.535912][T31631] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6560'. [ 2427.400153][T17458] dvb-usb: bulk message failed: -22 (5/0) [ 2427.471444][T25547] usb 5-1: config 1 has no interface number 0 [ 2427.478288][T17458] dw2102: i2c probe for address 0x68 failed. [ 2427.522117][T17458] dvb-usb: bulk message failed: -22 (5/0) [ 2427.590946][T17458] dw2102: i2c probe for address 0x69 failed. [ 2427.618887][T17458] dvb-usb: bulk message failed: -22 (5/0) [ 2427.625257][T25547] usb 5-1: New USB device found, idVendor=0b48, idProduct=2003, bcdDevice=78.61 [ 2427.642194][T17458] dw2102: i2c probe for address 0x6a failed. [ 2427.650643][T25547] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2427.652610][T31636] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2427.658921][T17458] dw2102: probing for demodulator failed. Is the external power switched on? [ 2427.719766][T25547] usb 5-1: Product: syz [ 2427.723963][T25547] usb 5-1: Manufacturer: syz [ 2427.728566][T25547] usb 5-1: SerialNumber: syz [ 2427.749041][T17458] dvb-usb: no frontend was attached by 'TeVii S482 (tuner 2)' [ 2427.753204][T25547] ttusbir 5-1:1.81: cannot find expected altsetting [ 2427.783375][T31636] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2427.883171][T31636] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2428.990973][T17458] rc_core: IR keymap rc-tt-1500 not found [ 2428.996831][T17458] Registered IR keymap rc-empty [ 2429.004035][T26062] usb 5-1: USB disconnect, device number 46 [ 2429.037231][T17458] rc rc0: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0 [ 2429.091095][T17458] input: TeVii S482 (tuner 2) as /devices/platform/dummy_hcd.5/usb6/6-1/rc/rc0/input305 [ 2429.117640][T17458] dvb-usb: schedule remote query interval to 250 msecs. [ 2429.140493][T17458] dw2102: su3000_power_ctrl: 0, initialized 1 [ 2429.148464][T17458] dvb-usb: TeVii S482 (tuner 2) successfully initialized and connected. [ 2429.185816][T17458] usb 6-1: USB disconnect, device number 47 [ 2429.378107][T17458] dvb-usb: TeVii S482 (tuner 2) successfully deinitialized and disconnected. [ 2429.636902][T31654] fuse: Bad value for 'fd' [ 2429.760558][T17458] usb 6-1: new full-speed USB device number 48 using dummy_hcd [ 2429.788931][T31657] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6566'. [ 2429.970851][T17458] usb 6-1: config 0 has an invalid interface number: 128 but max is 0 [ 2429.995695][T17458] usb 6-1: config 0 has no interface number 0 [ 2430.022598][T17458] usb 6-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 2430.045631][T17458] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2430.067095][T17458] usb 6-1: Product: syz [ 2430.077586][T17458] usb 6-1: Manufacturer: syz [ 2430.083508][T17458] usb 6-1: SerialNumber: syz [ 2430.103065][T25547] usb 2-1: new high-speed USB device number 74 using dummy_hcd [ 2430.117576][T17458] usb 6-1: config 0 descriptor?? [ 2430.284318][T25547] usb 2-1: Using ep0 maxpacket: 16 [ 2430.311511][T25547] usb 2-1: no configurations [ 2430.316480][T25547] usb 2-1: can't read configurations, error -22 [ 2430.456022][T31635] netlink: 'syz.5.6561': attribute type 10 has an invalid length. [ 2430.566584][T31635] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 2430.605337][T25547] usb 2-1: new high-speed USB device number 75 using dummy_hcd [ 2430.786837][T25547] usb 2-1: Using ep0 maxpacket: 16 [ 2430.810155][T17458] usb 6-1: Firmware: major: 225, minor: 107, hardware type: RZUSB (3) [ 2430.825004][T25547] usb 2-1: no configurations [ 2430.829723][T25547] usb 2-1: can't read configurations, error -22 [ 2430.947910][T25547] usb usb2-port1: attempt power cycle [ 2431.037723][T17458] usb 6-1: failed to fetch extended address, random address set [ 2431.298657][ T30] audit: type=1400 audit(2000000965.842:1968): avc: denied { mount } for pid=31666 comm="syz.4.6569" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 2431.362162][T17458] usb 6-1: USB disconnect, device number 48 [ 2431.385777][T25547] usb 2-1: new high-speed USB device number 76 using dummy_hcd [ 2431.420973][T25547] usb 2-1: Using ep0 maxpacket: 16 [ 2431.437894][T25547] usb 2-1: no configurations [ 2431.459643][T25547] usb 2-1: can't read configurations, error -22 [ 2431.684779][T25547] usb 2-1: new high-speed USB device number 77 using dummy_hcd [ 2431.732894][T31678] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6571'. [ 2431.741884][T31678] netlink: 44 bytes leftover after parsing attributes in process `syz.3.6571'. [ 2432.100936][T25547] usb 2-1: Using ep0 maxpacket: 16 [ 2432.109640][T25547] usb 2-1: no configurations [ 2432.115706][T25547] usb 2-1: can't read configurations, error -22 [ 2432.130336][T25547] usb usb2-port1: unable to enumerate USB device [ 2432.208681][T31682] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2432.304767][T31684] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2432.392369][T31682] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2433.458230][T31695] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=31695 comm=syz.4.6575 [ 2433.869687][ T30] audit: type=1400 audit(2000000967.881:1969): avc: denied { ioctl } for pid=31690 comm="syz.4.6575" path="socket:[137750]" dev="sockfs" ino=137750 ioctlcmd=0x89e2 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 2433.982396][T31694] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2434.085204][T31702] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2434.165163][T31701] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2434.254929][T31701] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2434.306189][T31704] bond0: (slave rose0): Error: Device can not be enslaved while up [ 2434.336212][T26062] usb 5-1: new high-speed USB device number 47 using dummy_hcd [ 2434.367930][T31694] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2434.458362][ T30] audit: type=1400 audit(2000000968.667:1970): avc: denied { ioctl } for pid=31696 comm="syz.1.6577" path="socket:[137776]" dev="sockfs" ino=137776 ioctlcmd=0x8990 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 2434.577780][T31701] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2434.587665][ T30] audit: type=1400 audit(2000000968.686:1971): avc: denied { bind } for pid=31696 comm="syz.1.6577" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 2434.608591][T26062] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2434.620561][T26062] usb 5-1: New USB device found, idVendor=0926, idProduct=3333, bcdDevice= 0.40 [ 2434.629704][T26062] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2434.641257][T26062] usb 5-1: config 0 descriptor?? [ 2435.003776][T31713] fuse: Bad value for 'fd' [ 2435.051903][T25185] usb 3-1: new high-speed USB device number 39 using dummy_hcd [ 2435.225514][T31719] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6582'. [ 2435.259642][T25185] usb 3-1: Using ep0 maxpacket: 8 [ 2435.278399][T25185] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2435.301917][T25185] usb 3-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2435.337225][T25185] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2435.367430][T25185] usb 3-1: config 0 descriptor?? [ 2435.575656][ T8093] usb 2-1: new high-speed USB device number 78 using dummy_hcd [ 2435.628129][T25185] iowarrior 3-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 2435.639928][T25547] usb 4-1: new high-speed USB device number 63 using dummy_hcd [ 2435.746801][ T8093] usb 2-1: Using ep0 maxpacket: 16 [ 2435.752468][ T8093] usb 2-1: no configurations [ 2435.762880][ T8093] usb 2-1: can't read configurations, error -22 [ 2435.821427][T25547] usb 4-1: Using ep0 maxpacket: 16 [ 2435.828785][T25547] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2435.844015][T25547] usb 4-1: config 0 has no interfaces? [ 2435.850676][T25547] usb 4-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 2435.877915][T25547] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2435.928856][ T8093] usb 2-1: new high-speed USB device number 79 using dummy_hcd [ 2436.108196][T25547] usb 4-1: config 0 descriptor?? [ 2436.259657][ T8093] usb 2-1: Using ep0 maxpacket: 16 [ 2437.200730][ T30] audit: type=1400 audit(2000000971.371:1972): avc: denied { mount } for pid=31726 comm="syz.5.6585" name="/" dev="debugfs" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 2437.289827][T31727] overlayfs: "xino" feature enabled using 3 upper inode bits. [ 2437.316365][T31727] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type [ 2437.326423][T31727] overlayfs: failed to look up (tracing) for ino (-66) [ 2437.750571][ T8093] usb 2-1: no configurations [ 2437.761018][ T8093] usb 2-1: can't read configurations, error -22 [ 2437.786533][ T8093] usb usb2-port1: attempt power cycle [ 2437.802403][T18157] usb 4-1: USB disconnect, device number 63 [ 2437.829341][ T30] audit: type=1400 audit(2000000971.904:1973): avc: denied { unmount } for pid=25536 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:debugfs_t tclass=filesystem permissive=1 [ 2437.969189][T26062] usbhid 5-1:0.0: can't add hid device: -71 [ 2437.985538][T26062] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2438.008047][T26062] usb 5-1: USB disconnect, device number 47 [ 2438.029820][T25547] usb 3-1: USB disconnect, device number 39 [ 2438.680966][ T8093] usb 2-1: new high-speed USB device number 80 using dummy_hcd [ 2438.718457][ T8093] usb 2-1: device descriptor read/8, error -71 [ 2438.964071][T25547] usb 3-1: new high-speed USB device number 40 using dummy_hcd [ 2439.054324][T31754] netlink: 24 bytes leftover after parsing attributes in process `syz.4.6593'. [ 2439.373057][T25547] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 2439.407711][T25547] usb 3-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 2439.478852][T25547] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 2439.616212][T25547] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2440.187235][T25547] usb 3-1: Product: syz [ 2440.206042][T25547] usb 3-1: Manufacturer: syz [ 2440.213165][T25547] usb 3-1: SerialNumber: syz [ 2440.528237][T31769] bond0: (slave rose0): Error: Device can not be enslaved while up [ 2440.925937][ T30] audit: type=1400 audit(2000000974.495:1974): avc: denied { setopt } for pid=31766 comm="syz.3.6595" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=x25_socket permissive=1 [ 2441.247184][T31742] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 2441.284128][T31742] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 2441.317050][T25547] cdc_ether 3-1:1.0: probe with driver cdc_ether failed with error -22 [ 2441.461975][T25547] usb 3-1: USB disconnect, device number 40 [ 2441.576410][T31781] bond0: (slave rose0): Error: Device can not be enslaved while up [ 2442.438246][T25547] usb 3-1: new full-speed USB device number 41 using dummy_hcd [ 2442.721725][T30365] usb 6-1: new high-speed USB device number 49 using dummy_hcd [ 2442.801817][ T8093] usb 4-1: new high-speed USB device number 64 using dummy_hcd [ 2442.963497][T30365] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2442.981120][T30365] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2443.030321][T30365] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 2443.106728][ T8093] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2443.142254][T30365] usb 6-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 2443.215734][ T8093] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 2443.296659][T30365] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2443.355958][ T8093] usb 4-1: New USB device found, idVendor=056a, idProduct=0010, bcdDevice= 0.00 [ 2443.397566][T30365] usb 6-1: config 0 descriptor?? [ 2443.407013][T25547] usb 3-1: device descriptor read/all, error -71 [ 2443.414524][ T8093] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2443.456350][ T8093] usb 4-1: config 0 descriptor?? [ 2443.490747][ T8093] usbhid 4-1:0.0: couldn't find an input interrupt endpoint [ 2443.659772][ T30] audit: type=1400 audit(2000000977.358:1975): avc: denied { bind } for pid=31792 comm="syz.2.6602" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 2443.940858][T31799] fuse: Bad value for 'fd' [ 2444.083546][T31803] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6603'. [ 2445.163968][ T8093] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 2445.473965][ T8093] usb 5-1: Using ep0 maxpacket: 16 [ 2445.479877][ T8093] usb 5-1: no configurations [ 2445.485704][ T8093] usb 5-1: can't read configurations, error -22 [ 2446.031144][T30365] usbhid 6-1:0.0: can't add hid device: -71 [ 2446.039898][T30365] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 2446.062021][T30365] usb 6-1: USB disconnect, device number 49 [ 2446.105329][ T8093] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 2446.538059][T25547] usb 4-1: USB disconnect, device number 64 [ 2446.592082][T31824] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 2446.602395][T31825] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=31825 comm=syz.3.6611 [ 2446.615689][ T30] audit: type=1400 audit(2000000980.174:1976): avc: denied { map } for pid=31823 comm="syz.3.6611" path="/dev/video8" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2446.640749][ T30] audit: type=1400 audit(2000000980.174:1977): avc: denied { execute } for pid=31823 comm="syz.3.6611" path="/dev/video8" dev="devtmpfs" ino=951 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 2446.666065][ T8093] usb 5-1: Using ep0 maxpacket: 16 [ 2446.676510][ T8093] usb 5-1: no configurations [ 2446.681106][ T8093] usb 5-1: can't read configurations, error -22 [ 2446.705437][ T8093] usb usb5-port1: attempt power cycle [ 2446.820760][T17458] usb 2-1: new high-speed USB device number 82 using dummy_hcd [ 2446.994840][T17458] usb 2-1: Using ep0 maxpacket: 32 [ 2447.022672][T17458] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 2447.096844][T17458] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 2447.403128][T17458] usb 2-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 2447.420958][ T30] audit: type=1400 audit(2000000980.932:1978): avc: denied { map } for pid=31826 comm="syz.2.6612" path="socket:[138010]" dev="sockfs" ino=138010 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tcp_socket permissive=1 [ 2447.424397][T17458] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2447.444815][T30365] usb 6-1: new high-speed USB device number 50 using dummy_hcd [ 2447.458150][T17458] usb 2-1: config 0 descriptor?? [ 2447.460113][ T8093] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 2447.468393][T17458] hub 2-1:0.0: USB hub found [ 2447.697810][ T8093] usb 5-1: device not accepting address 50, error -71 [ 2447.707993][T30365] usb 6-1: Using ep0 maxpacket: 8 [ 2447.717128][T30365] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2447.739330][T17458] hub 2-1:0.0: 1 port detected [ 2447.744200][T30365] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2447.757015][T30365] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2447.766663][T30365] usb 6-1: config 0 descriptor?? [ 2448.242573][T30365] iowarrior 6-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 2448.285238][T25547] usb 3-1: new high-speed USB device number 43 using dummy_hcd [ 2448.445545][T25547] usb 3-1: Using ep0 maxpacket: 16 [ 2448.452656][T25547] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2448.468259][T25547] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2448.478858][T25547] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2448.492434][T25547] usb 3-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 2448.501701][T25547] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2448.512705][T25547] usb 3-1: config 0 descriptor?? [ 2448.573011][T31845] SELinux: unrecognized netlink message: protocol=6 nlmsg_type=30736 sclass=netlink_xfrm_socket pid=31845 comm=syz.4.6617 [ 2448.974955][ T8093] usb 2-1: USB disconnect, device number 82 [ 2448.976596][T17458] hub 2-1:0.0: hub_ext_port_status failed (err = -71) [ 2449.288421][T25547] usbhid 3-1:0.0: can't add hid device: -71 [ 2449.327991][T25547] usbhid 3-1:0.0: probe with driver usbhid failed with error -71 [ 2449.439718][T25547] usb 3-1: USB disconnect, device number 43 [ 2451.216616][T18157] usb 6-1: USB disconnect, device number 50 [ 2451.230193][ T30] audit: type=1400 audit(2000000984.122:1979): avc: denied { bind } for pid=31867 comm="syz.1.6623" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=pppox_socket permissive=1 [ 2451.451311][T31873] fuse: Bad value for 'fd' [ 2451.521620][T31875] netlink: 8 bytes leftover after parsing attributes in process `syz.3.6625'. [ 2451.823660][T25547] usb 4-1: new high-speed USB device number 65 using dummy_hcd [ 2452.037298][T25547] usb 4-1: Using ep0 maxpacket: 16 [ 2452.226512][T25547] usb 4-1: no configurations [ 2452.260109][T25547] usb 4-1: can't read configurations, error -22 [ 2452.424517][T25547] usb 4-1: new high-speed USB device number 66 using dummy_hcd [ 2452.595929][T25547] usb 4-1: Using ep0 maxpacket: 16 [ 2452.608808][T25547] usb 4-1: no configurations [ 2452.628811][T25547] usb 4-1: can't read configurations, error -22 [ 2452.698465][T25547] usb usb4-port1: attempt power cycle [ 2452.870951][ T8093] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 2453.042014][ T8093] usb 5-1: Using ep0 maxpacket: 8 [ 2453.049832][ T8093] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 2453.061590][ T8093] usb 5-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 2453.070929][ T8093] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2453.084880][T25547] usb 4-1: new high-speed USB device number 67 using dummy_hcd [ 2453.198935][ T30] audit: type=1400 audit(2000000986.330:1980): avc: denied { watch } for pid=31904 comm="syz.1.6631" path="/143/bus/file1" dev="overlay" ino=769 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fs_t tclass=filesystem permissive=1 [ 2453.490548][ T8093] usb 5-1: config 0 descriptor?? [ 2453.503203][T25547] usb 4-1: Using ep0 maxpacket: 16 [ 2453.515359][T25547] usb 4-1: no configurations [ 2453.525653][T25547] usb 4-1: can't read configurations, error -22 [ 2453.552967][T31909] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2453.562824][T31911] netlink: 32 bytes leftover after parsing attributes in process `syz.5.6633'. [ 2453.628118][T31909] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2453.694210][T25547] usb 4-1: new high-speed USB device number 68 using dummy_hcd [ 2453.703304][T31909] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2453.735044][T31915] netlink: 28 bytes leftover after parsing attributes in process `syz.5.6634'. [ 2453.746577][ T30] audit: type=1400 audit(2000000986.825:1981): avc: denied { getopt } for pid=31912 comm="syz.5.6634" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=packet_socket permissive=1 [ 2453.768226][ T8093] iowarrior 5-1:0.0: IOWarrior product=0x1512, serial= interface=0 now attached to iowarrior0 [ 2453.776333][T25547] usb 4-1: Using ep0 maxpacket: 16 [ 2453.792607][T25547] usb 4-1: no configurations [ 2453.800914][T25547] usb 4-1: can't read configurations, error -22 [ 2453.811519][T25547] usb usb4-port1: unable to enumerate USB device [ 2454.724560][T31921] netlink: 64 bytes leftover after parsing attributes in process `syz.2.6636'. [ 2454.980734][T31930] netlink: 48 bytes leftover after parsing attributes in process `syz.2.6638'. [ 2455.803231][T18311] usb 5-1: USB disconnect, device number 52 [ 2456.603564][T31951] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2456.697060][T31951] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2456.797589][T31951] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2457.080260][T31955] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2457.234359][T31955] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2457.331528][T31955] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2457.402627][ T30] audit: type=1400 audit(2000000990.268:1982): avc: denied { ioctl } for pid=31964 comm="syz.2.6648" path="socket:[139292]" dev="sockfs" ino=139292 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1 [ 2457.542197][ T30] audit: type=1400 audit(2000000990.390:1983): avc: denied { ioctl } for pid=31962 comm="syz.4.6649" path="/dev/nvram" dev="devtmpfs" ino=623 ioctlcmd=0x9418 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nvram_device_t tclass=chr_file permissive=1 [ 2457.732051][T31973] openvswitch: netlink: IP tunnel dst address not specified [ 2457.861008][T31973] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=31973 comm=syz.4.6650 [ 2457.871035][T31974] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6650'. [ 2457.927789][T31973] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6650'. [ 2458.013458][T31977] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=65535 sclass=netlink_route_socket pid=31977 comm=syz.4.6650 [ 2458.516500][ T8093] usb 4-1: new high-speed USB device number 69 using dummy_hcd [ 2458.583970][T31990] netlink: 48 bytes leftover after parsing attributes in process `syz.5.6653'. [ 2458.698972][ T8093] usb 4-1: too many endpoints for config 0 interface 0 altsetting 0: 253, using maximum allowed: 30 [ 2458.723446][ T8093] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2458.793735][ T8093] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2458.803775][ T8093] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 253 [ 2458.821476][ T8093] usb 4-1: New USB device found, idVendor=05ac, idProduct=8243, bcdDevice=8b.40 [ 2458.830962][ T8093] usb 4-1: New USB device strings: Mfr=11, Product=0, SerialNumber=0 [ 2458.839845][ T8093] usb 4-1: Manufacturer: syz [ 2458.932124][ T8093] usb 4-1: config 0 descriptor?? [ 2459.406212][ T8093] usbhid 4-1:0.0: can't add hid device: -71 [ 2459.841118][ T8093] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 2461.068318][T32015] netlink: 'syz.5.6658': attribute type 1 has an invalid length. [ 2461.097978][T32015] netlink: 'syz.5.6658': attribute type 6 has an invalid length. [ 2461.142702][T32015] netlink: 52 bytes leftover after parsing attributes in process `syz.5.6658'. [ 2461.258359][ T8093] usb 4-1: USB disconnect, device number 69 [ 2462.309872][ T8093] usb 4-1: new high-speed USB device number 70 using dummy_hcd [ 2462.320599][T32029] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2462.460249][T32029] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2462.571223][T32029] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2462.634069][ T8093] usb 4-1: Using ep0 maxpacket: 32 [ 2462.640892][ T8093] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 2462.649607][ T8093] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 2462.658277][ T8093] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 2462.667319][ T8093] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2462.683878][ T8093] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 2462.694248][ T8093] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2462.716157][ T8093] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 2463.154737][ T8093] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2463.173121][ T8093] usb 4-1: config 0 descriptor?? [ 2463.230321][T18311] usb 5-1: new low-speed USB device number 53 using dummy_hcd [ 2463.403614][T32047] fuse: Unknown parameter 'fd0x0000000000000009' [ 2463.418605][T18311] usb 5-1: New USB device found, idVendor=046d, idProduct=08b1, bcdDevice=6d.2a [ 2463.497846][T18311] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2463.533863][T18311] usb 5-1: config 0 descriptor?? [ 2463.549048][ T8093] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 70 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 2463.554865][T18311] pwc: Logitech QuickCam Notebook Pro USB webcam detected. [ 2463.757836][ T8093] usb 4-1: USB disconnect, device number 70 [ 2463.767582][ T8093] usblp0: removed [ 2463.853648][T32053] netlink: 64 bytes leftover after parsing attributes in process `syz.4.6665'. [ 2463.876193][T32053] netlink: 40 bytes leftover after parsing attributes in process `syz.4.6665'. [ 2464.154929][T18311] pwc: Failed to set LED on/off time (-71) [ 2464.237204][T18311] pwc: send_video_command error -71 [ 2464.244861][T18311] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 2464.268247][T18311] Philips webcam 5-1:0.0: probe with driver Philips webcam failed with error -71 [ 2464.305487][T18311] usb 5-1: USB disconnect, device number 53 [ 2465.519146][T32073] netlink: 'syz.4.6674': attribute type 10 has an invalid length. [ 2465.562969][T32073] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2465.589028][T32073] team0: Port device bond0 added [ 2466.931871][T32082] pimreg: entered allmulticast mode [ 2467.140778][T32087] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6677'. [ 2467.516993][T32092] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2467.589906][T32094] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2467.673979][T32092] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2468.535415][T32103] netlink: 100 bytes leftover after parsing attributes in process `syz.1.6682'. [ 2468.572394][T18157] usb 4-1: new high-speed USB device number 71 using dummy_hcd [ 2468.838125][T18157] usb 4-1: Using ep0 maxpacket: 32 [ 2469.016692][T18157] usb 4-1: config index 0 descriptor too short (expected 29220, got 36) [ 2469.026079][T18157] usb 4-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 2469.035225][T18157] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 2469.056320][T18157] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 2469.076349][T18157] usb 4-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 2469.086583][T18157] usb 4-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 2469.100977][T18157] usb 4-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 2469.111344][T18157] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2469.329885][T18157] usb 4-1: config 0 descriptor?? [ 2469.499700][ T30] audit: type=1400 audit(2000001001.588:1984): avc: denied { connect } for pid=32121 comm="syz.2.6687" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 2469.556433][T18157] usblp 4-1:0.0: usblp0: USB Bidirectional printer dev 71 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 2469.643770][ T30] audit: type=1400 audit(2000001001.728:1985): avc: denied { read } for pid=32121 comm="syz.2.6687" name="rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 2469.672026][ T30] audit: type=1400 audit(2000001001.728:1986): avc: denied { open } for pid=32121 comm="syz.2.6687" path="/dev/rtc0" dev="devtmpfs" ino=921 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 2469.707854][ T30] audit: type=1400 audit(2000001001.747:1987): avc: denied { ioctl } for pid=32121 comm="syz.2.6687" path="/dev/rtc0" dev="devtmpfs" ino=921 ioctlcmd=0x7014 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:clock_device_t tclass=chr_file permissive=1 [ 2469.760170][T18311] usb 2-1: new high-speed USB device number 83 using dummy_hcd [ 2469.862506][T25547] usb 4-1: USB disconnect, device number 71 [ 2470.417845][T25547] usblp0: removed [ 2470.787286][T18311] usb 2-1: config 0 has no interfaces? [ 2470.822164][T18311] usb 2-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b [ 2470.835779][T18311] usb 2-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2 [ 2471.423541][T18311] usb 2-1: Product: syz [ 2471.427868][T18311] usb 2-1: Manufacturer: syz [ 2471.433405][T18311] usb 2-1: SerialNumber: syz [ 2471.461467][T18311] usb 2-1: config 0 descriptor?? [ 2471.844762][T32139] netlink: 24 bytes leftover after parsing attributes in process `syz.3.6692'. [ 2472.706576][T32155] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2472.772513][ T30] audit: type=1400 audit(2000001004.647:1988): avc: denied { audit_write } for pid=32156 comm="syz.2.6696" capability=29 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability permissive=1 [ 2472.874564][T32158] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 2472.890316][T25547] usb 2-1: USB disconnect, device number 83 [ 2473.946592][T32171] infiniband syz1: set active [ 2473.951331][T32171] infiniband syz1: added syz_tun [ 2474.015467][T32171] RDS/IB: syz1: added [ 2474.019458][T32171] smc: adding ib device syz1 with port count 1 [ 2474.025606][T32171] smc: ib device syz1 port 1 has no pnetid [ 2474.670358][T32178] netlink: 'syz.2.6699': attribute type 1 has an invalid length. [ 2474.784823][T32178] netlink: 244 bytes leftover after parsing attributes in process `syz.2.6699'. [ 2476.778158][T32193] netlink: 8 bytes leftover after parsing attributes in process `syz.2.6703'. [ 2478.363034][T32211] befs: (nullb0): invalid magic header [ 2479.124064][ T30] audit: type=1400 audit(2000001010.222:1989): avc: denied { write } for pid=32204 comm="syz.5.6708" name="urandom" dev="devtmpfs" ino=9 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:urandom_device_t tclass=chr_file permissive=1 [ 2496.338918][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2496.354528][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2496.517648][T32230] fuse: Bad value for 'fd' [ 2496.560583][T32230] netlink: 8 bytes leftover after parsing attributes in process `syz.5.6711'. [ 2496.836407][T30365] usb 6-1: new high-speed USB device number 51 using dummy_hcd [ 2500.015831][T30365] usb 6-1: Using ep0 maxpacket: 16 [ 2500.036706][T30365] usb 6-1: no configurations [ 2500.041283][T30365] usb 6-1: can't read configurations, error -22 [ 2506.905890][T30365] usb 6-1: new high-speed USB device number 52 using dummy_hcd [ 2508.030520][T21133] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2508.345192][T30009] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2508.357672][T30009] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2508.366604][T32250] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 2508.374730][T30009] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2508.383499][T32250] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2508.391275][T30009] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 2508.398527][T32250] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2508.409215][T30009] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 2508.416391][T30009] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2508.424157][T32250] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2508.431160][T30009] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 2508.438666][T32250] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2508.455939][T32250] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2508.467234][T30009] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 2510.758592][T11710] Bluetooth: hci1: command tx timeout [ 2510.775969][T11710] Bluetooth: hci7: command tx timeout [ 2510.787197][T11710] Bluetooth: hci6: command tx timeout [ 2513.127819][T29044] Bluetooth: hci6: command tx timeout [ 2513.138174][T29044] Bluetooth: hci1: command tx timeout [ 2513.149804][T11710] Bluetooth: hci7: command tx timeout [ 2513.181560][T29044] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 2513.201019][T29044] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 2513.212823][T29044] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 2513.226382][T29044] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 2513.245027][T29044] Bluetooth: hci9: unexpected cc 0x0c03 length: 249 > 1 [ 2513.252829][T32251] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 2513.262715][T29044] Bluetooth: hci9: unexpected cc 0x1003 length: 249 > 9 [ 2513.272074][T29044] Bluetooth: hci9: unexpected cc 0x1001 length: 249 > 9 [ 2513.280652][T29044] Bluetooth: hci9: unexpected cc 0x0c23 length: 249 > 4 [ 2513.288102][T29044] Bluetooth: hci9: unexpected cc 0x0c38 length: 249 > 2 [ 2513.427497][T18157] syz1: Port: 1 Link DOWN [ 2515.596418][T32251] Bluetooth: hci1: command tx timeout [ 2515.596464][T21133] Bluetooth: hci8: command tx timeout [ 2515.617723][T32250] Bluetooth: hci7: command tx timeout [ 2515.623249][T11710] Bluetooth: hci9: command tx timeout [ 2515.634674][T29044] Bluetooth: hci6: command tx timeout [ 2518.056992][T21133] Bluetooth: hci1: command tx timeout [ 2518.062453][T21133] Bluetooth: hci8: command tx timeout [ 2518.070303][T21133] Bluetooth: hci6: command tx timeout [ 2518.075699][T21133] Bluetooth: hci9: command tx timeout [ 2518.081140][T29044] Bluetooth: hci7: command tx timeout [ 2518.193267][T15276] smc: removing ib device syz1 [ 2520.469617][T11710] Bluetooth: hci8: command tx timeout [ 2520.578208][T21133] Bluetooth: hci9: command tx timeout [ 2523.017645][T21133] Bluetooth: hci8: command tx timeout [ 2523.130261][ T79] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2523.236604][T21133] Bluetooth: hci9: command tx timeout [ 2544.356324][ T79] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2544.491394][ T79] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2544.906873][ T79] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2546.603442][T32243] chnl_net:caif_netlink_parms(): no params data found [ 2550.090554][T32255] chnl_net:caif_netlink_parms(): no params data found [ 2550.158052][T32254] chnl_net:caif_netlink_parms(): no params data found [ 2550.232744][T32244] chnl_net:caif_netlink_parms(): no params data found [ 2550.266938][T32246] chnl_net:caif_netlink_parms(): no params data found [ 2559.712817][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2559.719128][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2565.173700][T32254] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wg2": -EINTR [ 2565.185136][T32246] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wg2": -EINTR [ 2565.195351][T11710] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2565.215038][T11710] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2565.223084][T11710] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2567.687072][T21133] Bluetooth: hci0: Opcode 0x1009 failed: -110 [ 2567.696831][T29044] Bluetooth: hci0: unexpected event for opcode 0x1009 [ 2567.703676][T29044] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2567.761563][T32255] bridge0: port 1(bridge_slave_0) entered blocking state [ 2567.769149][T32255] bridge0: port 1(bridge_slave_0) entered disabled state [ 2567.818195][T32255] bridge_slave_0: entered allmulticast mode [ 2567.874746][T32255] bridge_slave_0: entered promiscuous mode [ 2567.881677][T21133] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2567.931978][T32250] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2567.932034][T21133] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2567.952274][T21133] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2567.962325][T21133] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2567.970351][T32250] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2567.970743][T21133] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2567.985575][T32250] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2567.994035][T32250] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2568.003410][T32250] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2568.013802][T32255] bridge0: port 2(bridge_slave_1) entered blocking state [ 2568.092562][T32255] bridge0: port 2(bridge_slave_1) entered disabled state [ 2568.099688][T32255] bridge_slave_1: entered allmulticast mode [ 2569.845609][T32294] Bluetooth: hci0: Opcode 0x0c03 failed: -110 [ 2569.895457][T32255] bridge_slave_1: entered promiscuous mode [ 2569.905105][T11710] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2569.916021][T11710] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2569.923972][T11710] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2569.941949][T11710] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2569.949358][T11710] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2569.971672][T32244] workqueue: Failed to create a rescuer kthread for wq "wg-crypt-wg1": -EINTR [ 2570.358139][T11710] Bluetooth: hci3: command tx timeout [ 2570.358355][T32250] Bluetooth: hci2: command tx timeout [ 2572.199235][T32250] Bluetooth: hci4: command tx timeout [ 2572.393185][T11710] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2572.402362][T11710] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2572.409975][T11710] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2572.417517][T11710] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2572.426658][T11710] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2572.487042][T32250] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 2572.499309][T32250] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 2572.508635][T32250] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 2572.518436][T32250] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 2572.525869][T32250] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 2572.570799][T32250] Bluetooth: hci2: command tx timeout [ 2572.581498][T32250] Bluetooth: hci3: command tx timeout [ 2572.852501][ T79] bond0 (unregistering): Released all slaves [ 2574.409457][T32250] Bluetooth: hci4: command tx timeout [ 2574.634005][T32250] Bluetooth: hci0: command tx timeout [ 2574.708706][T32250] Bluetooth: hci1: command tx timeout [ 2574.807710][T11710] Bluetooth: hci2: command tx timeout [ 2574.814448][T32250] Bluetooth: hci3: command tx timeout [ 2576.807607][T32250] Bluetooth: hci4: command tx timeout [ 2576.846700][T32250] Bluetooth: hci0: command tx timeout [ 2576.932191][T32250] Bluetooth: hci1: command tx timeout [ 2577.039016][T21133] Bluetooth: hci2: command tx timeout [ 2577.044532][T11710] Bluetooth: hci3: command tx timeout [ 2577.547241][ T79] hsr_slave_0: left promiscuous mode [ 2577.555387][ T79] hsr_slave_1: left promiscuous mode [ 2577.600812][ T79] veth1_macvtap: left promiscuous mode [ 2577.607231][ T79] veth0_macvtap: left promiscuous mode [ 2577.614815][ T79] veth1_vlan: left promiscuous mode [ 2577.620257][ T79] veth0_vlan: left promiscuous mode [ 2585.015431][T11710] Bluetooth: hci4: command tx timeout [ 2585.015465][T21133] Bluetooth: hci0: command tx timeout [ 2585.020937][T32250] Bluetooth: hci1: command tx timeout [ 2587.283524][T32250] Bluetooth: hci0: command tx timeout [ 2587.289027][T32250] Bluetooth: hci1: command tx timeout [ 2600.610152][T32299] chnl_net:caif_netlink_parms(): no params data found [ 2600.621610][T32313] chnl_net:caif_netlink_parms(): no params data found [ 2600.791548][T32311] chnl_net:caif_netlink_parms(): no params data found [ 2600.914394][T32300] chnl_net:caif_netlink_parms(): no params data found [ 2600.964152][T32304] chnl_net:caif_netlink_parms(): no params data found [ 2605.914940][T32299] bridge0: port 1(bridge_slave_0) entered blocking state [ 2605.930768][T32299] bridge0: port 1(bridge_slave_0) entered disabled state [ 2605.949011][T32299] bridge_slave_0: entered allmulticast mode [ 2605.964138][T32299] bridge_slave_0: entered promiscuous mode [ 2605.998687][T32313] bridge0: port 1(bridge_slave_0) entered blocking state [ 2606.005720][T32313] bridge0: port 1(bridge_slave_0) entered disabled state [ 2606.028875][T32313] bridge_slave_0: entered allmulticast mode [ 2606.043789][T32313] bridge_slave_0: entered promiscuous mode [ 2606.097207][T32299] bridge0: port 2(bridge_slave_1) entered blocking state [ 2606.111622][T32299] bridge0: port 2(bridge_slave_1) entered disabled state [ 2606.127523][T32299] bridge_slave_1: entered allmulticast mode [ 2606.146334][T32299] bridge_slave_1: entered promiscuous mode [ 2606.171337][T32313] bridge0: port 2(bridge_slave_1) entered blocking state [ 2606.190041][T32313] bridge0: port 2(bridge_slave_1) entered disabled state [ 2606.244714][T32313] bridge_slave_1: entered allmulticast mode [ 2606.260519][T32313] bridge_slave_1: entered promiscuous mode [ 2606.323916][T32311] bridge0: port 1(bridge_slave_0) entered blocking state [ 2606.372410][T32311] bridge0: port 1(bridge_slave_0) entered disabled state [ 2606.379572][T32311] bridge_slave_0: entered allmulticast mode [ 2606.387662][T32311] bridge_slave_0: entered promiscuous mode [ 2606.450916][T32311] bridge0: port 2(bridge_slave_1) entered blocking state [ 2606.464730][T32311] bridge0: port 2(bridge_slave_1) entered disabled state [ 2606.480292][T32311] bridge_slave_1: entered allmulticast mode [ 2606.495903][T32311] bridge_slave_1: entered promiscuous mode [ 2606.514486][T32313] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2606.618656][ T79] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2606.652040][T32299] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2606.671990][T32300] bridge0: port 1(bridge_slave_0) entered blocking state [ 2606.679822][T32300] bridge0: port 1(bridge_slave_0) entered disabled state [ 2606.690784][T32300] bridge_slave_0: entered allmulticast mode [ 2610.331232][T32300] bridge_slave_0: entered promiscuous mode [ 2610.392885][T32313] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2616.635153][ T1296] ieee802154 phy0 wpan0: encryption failed: -22 [ 2616.641419][ T1296] ieee802154 phy1 wpan1: encryption failed: -22 [ 2617.736193][T32299] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2617.777948][ T79] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2617.816869][T32300] bridge0: port 2(bridge_slave_1) entered blocking state [ 2617.825596][T32300] bridge0: port 2(bridge_slave_1) entered disabled state [ 2617.840886][T32300] bridge_slave_1: entered allmulticast mode [ 2617.848794][T32300] bridge_slave_1: entered promiscuous mode [ 2617.867376][T32304] bridge0: port 1(bridge_slave_0) entered blocking state [ 2617.876730][T32304] bridge0: port 1(bridge_slave_0) entered disabled state [ 2617.886527][T32304] bridge_slave_0: entered allmulticast mode [ 2617.893316][T32304] bridge_slave_0: entered promiscuous mode [ 2617.964165][T32304] bridge0: port 2(bridge_slave_1) entered blocking state [ 2617.971884][T32304] bridge0: port 2(bridge_slave_1) entered disabled state [ 2617.979025][T32304] bridge_slave_1: entered allmulticast mode [ 2618.002312][T32304] bridge_slave_1: entered promiscuous mode [ 2618.012827][T32313] team0: Port device team_slave_0 added [ 2618.030134][T32311] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2618.154020][T32300] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2618.184218][ T79] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2618.207146][T32313] team0: Port device team_slave_1 added [ 2618.213941][T32311] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2618.232039][T32299] team0: Port device team_slave_0 added [ 2618.253142][T32300] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2618.349036][T32299] team0: Port device team_slave_1 added [ 2618.380421][T32304] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2618.415647][ T79] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2618.430458][T32311] team0: Port device team_slave_0 added [ 2618.458553][T32311] team0: Port device team_slave_1 added [ 2618.498717][T32304] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2620.930388][T32313] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2620.937336][T32313] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2623.313595][T32313] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2623.346835][T32300] team0: Port device team_slave_0 added [ 2623.460969][T32313] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2623.468324][T32313] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2623.505874][T32313] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2626.738092][T32300] team0: Port device team_slave_1 added [ 2626.764178][T32299] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2626.771542][T32299] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2626.839343][T32299] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2628.516949][ T79] netdevsim netdevsim4 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2628.846008][T32304] team0: Port device team_slave_0 added [ 2628.852379][T32311] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2628.859292][T32311] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2628.893328][T32311] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2629.250999][T32299] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2629.272083][T32299] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2629.417904][T32299] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2629.447175][T32304] team0: Port device team_slave_1 added [ 2629.453292][T32311] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2629.460233][T32311] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2629.503090][T32311] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2629.558224][ T79] netdevsim netdevsim4 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2629.592088][T32300] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2629.599335][T32300] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2629.738408][T32300] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2629.873240][T32300] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2629.884423][T32300] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2630.136872][T32300] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2630.931276][T32313] hsr_slave_0: entered promiscuous mode [ 2630.957235][T32313] hsr_slave_1: entered promiscuous mode [ 2630.964996][T32313] debugfs: 'hsr0' already exists in 'hsr' [ 2630.999271][T32313] Cannot create hsr debugfs directory [ 2631.000378][T32250] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2631.013956][T32250] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2631.023101][T32250] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2631.589894][T32250] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2631.599635][T32250] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2631.604504][T11710] Bluetooth: hci7: unexpected cc 0x0c03 length: 249 > 1 [ 2632.448494][T11710] Bluetooth: hci7: unexpected cc 0x1003 length: 249 > 9 [ 2632.514454][T11710] Bluetooth: hci7: unexpected cc 0x1001 length: 249 > 9 [ 2632.527015][T11710] Bluetooth: hci7: unexpected cc 0x0c23 length: 249 > 4 [ 2632.534632][T11710] Bluetooth: hci7: unexpected cc 0x0c38 length: 249 > 2 [ 2632.626402][T21133] Bluetooth: hci8: unexpected cc 0x0c03 length: 249 > 1 [ 2632.634234][T21133] Bluetooth: hci8: unexpected cc 0x1003 length: 249 > 9 [ 2632.644845][T21133] Bluetooth: hci8: unexpected cc 0x1001 length: 249 > 9 [ 2632.664407][T21133] Bluetooth: hci8: unexpected cc 0x0c23 length: 249 > 4 [ 2632.668035][ T79] netdevsim netdevsim4 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2632.787212][T21133] Bluetooth: hci8: unexpected cc 0x0c38 length: 249 > 2 [ 2632.838978][T32304] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2632.845936][T32304] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2632.998069][T32304] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2634.709734][T21133] Bluetooth: hci6: command tx timeout [ 2634.741532][T21133] Bluetooth: hci7: command tx timeout [ 2634.997109][T11710] Bluetooth: hci8: command tx timeout [ 2635.241182][ T79] netdevsim netdevsim4 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2635.287766][T32311] hsr_slave_0: entered promiscuous mode [ 2635.293832][T32311] hsr_slave_1: entered promiscuous mode [ 2637.127171][T21133] Bluetooth: hci6: command tx timeout [ 2637.132668][T11710] Bluetooth: hci7: command tx timeout [ 2637.139139][T32311] debugfs: 'hsr0' already exists in 'hsr' [ 2637.144859][T32311] Cannot create hsr debugfs directory [ 2637.305954][T21133] Bluetooth: hci8: command tx timeout [ 2637.447605][T11710] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2637.457300][T11710] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2637.596001][T11710] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2637.604006][T11710] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2637.624442][T11710] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2637.830290][T21133] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2637.846205][T21133] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2637.854434][T21133] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2637.863252][T21133] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2637.870416][T21133] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2639.230895][ T31] INFO: task syz.1.6686:32118 blocked for more than 153 seconds. [ 2639.273337][ T31] Tainted: G L syzkaller #0 [ 2639.279832][ T31] Blocked by coredump. [ 2639.294398][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2639.303048][ T31] task:syz.1.6686 state:D stack:26888 pid:32118 tgid:32117 ppid:29040 task_flags:0x400548 flags:0x00080004 [ 2639.327461][T11710] Bluetooth: hci6: command tx timeout [ 2639.358877][T11710] Bluetooth: hci7: command tx timeout [ 2639.394111][ T31] Call Trace: [ 2639.402855][ T31] [ 2639.405789][ T31] ? __schedule+0x10b9/0x6150 [ 2639.410447][ T31] __schedule+0x1139/0x6150 [ 2639.529343][T11710] Bluetooth: hci8: command tx timeout [ 2639.559612][ T31] ? __pfx___schedule+0x10/0x10 [ 2639.585421][ T31] ? find_held_lock+0x2b/0x80 [ 2639.590126][ T31] ? schedule+0x2d7/0x3a0 [ 2639.675418][ T31] schedule+0xe7/0x3a0 [ 2639.679753][ T31] schedule_timeout+0x257/0x290 [ 2639.684611][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2639.692369][ T31] ? rcu_is_watching+0x12/0xc0 [ 2639.697144][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2639.703391][ T31] __wait_for_common+0x2fc/0x4e0 [ 2639.708341][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 2639.828657][ T31] ? __pfx___wait_for_common+0x10/0x10 [ 2639.834133][ T31] io_wq_put_and_exit+0x271/0x8a0 [ 2639.839136][ T31] ? __pfx_xa_find_after+0x10/0x10 [ 2639.871429][ T31] ? __pfx_io_wq_put_and_exit+0x10/0x10 [ 2639.892947][ T31] ? __pfx___might_resched+0x10/0x10 [ 2639.931934][T11710] Bluetooth: hci2: command tx timeout [ 2639.937683][ T31] ? io_uring_del_tctx_node+0x279/0x350 [ 2640.065631][T11710] Bluetooth: hci3: command tx timeout [ 2640.071776][ T31] io_uring_clean_tctx+0x10d/0x190 [ 2640.080002][ T31] ? __pfx_io_uring_clean_tctx+0x10/0x10 [ 2640.096100][ T31] ? percpu_counter_add_batch+0x180/0x200 [ 2640.101852][ T31] io_uring_cancel_generic+0x69c/0x9a0 [ 2640.117223][ T31] ? find_held_lock+0x2b/0x80 [ 2640.121907][ T31] ? find_held_lock+0x2b/0x80 [ 2640.155407][ T31] ? __pfx_io_uring_cancel_generic+0x10/0x10 [ 2640.177286][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 2640.202773][ T31] ? rcu_is_watching+0x12/0xc0 [ 2640.207550][ T31] ? io_uring_unreg_ringfd+0xbc/0x130 [ 2640.212939][ T31] do_exit+0x2ce/0x2bd0 [ 2640.266886][ T31] ? lock_acquire+0x179/0x330 [ 2640.271599][ T31] ? find_held_lock+0x2b/0x80 [ 2640.276291][ T31] ? __pfx_do_exit+0x10/0x10 [ 2640.293255][ T31] ? find_held_lock+0x2b/0x80 [ 2640.298008][ T31] do_group_exit+0xd3/0x2a0 [ 2640.339521][ T31] get_signal+0x2671/0x26d0 [ 2640.360965][ T31] ? __pfx_get_signal+0x10/0x10 [ 2640.371830][ T31] ? do_futex+0x122/0x350 [ 2640.379620][ T31] arch_do_signal_or_restart+0x8f/0x7e0 [ 2640.393596][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 2640.405934][ T31] ? fput+0x70/0xf0 [ 2640.409805][ T31] ? __pfx___x64_sys_futex+0x10/0x10 [ 2640.415087][ T31] exit_to_user_mode_loop+0x8c/0x540 [ 2640.431427][ T31] do_syscall_64+0x4ee/0xf80 [ 2640.436015][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 2640.461378][ T31] RIP: 0033:0x7f03e6b8f749 [ 2640.465793][ T31] RSP: 002b:00007f03e798c0e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 2640.504689][ T31] RAX: fffffffffffffe00 RBX: 00007f03e6de5fa8 RCX: 00007f03e6b8f749 [ 2640.512662][ T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007f03e6de5fa8 [ 2640.548467][ T31] RBP: 00007f03e6de5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 2640.566992][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 2640.574974][ T31] R13: 00007f03e6de6038 R14: 00007ffd77bf21b0 R15: 00007ffd77bf2298 [ 2640.609052][ T31] [ 2641.651594][T21133] Bluetooth: hci7: command tx timeout [ 2641.659965][T11710] Bluetooth: hci6: command tx timeout [ 2641.667356][ T31] [ 2641.667356][ T31] Showing all locks held in the system: [ 2641.675083][ T31] 1 lock held by khungtaskd/31: [ 2641.682792][ T31] #0: [ 2641.764114][T21133] Bluetooth: hci8: command tx timeout [ 2641.941875][ T31] ffffffff8e3c96a0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 2641.952472][ T31] 7 locks held by kworker/u8:4/79: [ 2641.966536][ T31] #0: ffff88801badc948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 [ 2641.977067][ T31] #1: ffffc9000216fc90 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 [ 2641.987556][ T31] #2: ffffffff9012b410 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x830 [ 2641.998719][ T31] #3: ffff888032be20e8 (&dev->mutex){....}-{4:4}, at: devlink_pernet_pre_exit+0x12c/0x2b0 [ 2642.008719][ T31] #4: ffff888032be4250 (&devlink->lock_key#11){+.+.}-{4:4}, at: devlink_pernet_pre_exit+0x136/0x2b0 [ 2642.020044][ T31] #5: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: nsim_destroy+0x108/0x830 [ 2642.029202][ T31] #6: ffff88804778cd38 (&dev_instance_lock_key#20){+.+.}-{4:4}, at: unregister_netdevice_many_notify+0x1a23/0x2590 [ 2642.052095][ T31] 1 lock held by klogd/5176: [ 2642.056664][ T31] #0: ffff8880b843ac98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 2642.066586][ T31] 1 lock held by dhcpcd/5482: [ 2642.071283][ T31] #0: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: devinet_ioctl+0x26d/0x1f30 [ 2642.080535][ T31] 2 locks held by getty/5572: [ 2642.085269][ T31] #0: ffff88814d99d0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 2642.095906][T21133] Bluetooth: hci2: command tx timeout [ 2642.101303][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x1510 [ 2642.111412][ T31] 3 locks held by kworker/u8:32/31355: [ 2642.116949][ T31] #0: ffff88813ff69948 ((wq_completion)events_unbound#2){+.+.}-{0:0}, at: process_one_work+0x128d/0x1b20 [ 2642.128473][ T31] #1: ffffc9000cee7c90 ((linkwatch_work).work){+.+.}-{0:0}, at: process_one_work+0x914/0x1b20 [ 2642.139011][ T31] #2: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0x51/0xc0 [ 2642.148295][ T31] 3 locks held by iou-wrk-32118/32167: [ 2642.153782][ T31] 3 locks held by iou-wrk-32118/32168: [ 2642.159251][ T31] 5 locks held by syz-executor/32311: [ 2642.164621][ T31] #0: ffff888058a00ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xc0 [ 2642.179151][ T31] #1: ffff888058a000c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3af/0x1260 [ 2642.188917][ T31] #2: ffffffff903bee48 (hci_cb_list_lock){+.+.}-{4:4}, at: hci_conn_hash_flush+0xbb/0x290 [ 2642.198926][ T31] #3: ffff88807a233b38 (&conn->lock#2){+.+.}-{4:4}, at: l2cap_conn_del+0x80/0x760 [ 2642.208707][ T31] #4: ffffffff8e3d4df8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x284/0x3c0 [ 2642.218760][ T31] 3 locks held by syz-executor/32313: [ 2642.224172][ T31] #0: ffff888057628ec0 (&hdev->req_lock){+.+.}-{4:4}, at: hci_dev_do_close+0x26/0xc0 [ 2642.233921][ T31] #1: ffff8880576280c0 (&hdev->lock){+.+.}-{4:4}, at: hci_dev_close_sync+0x3af/0x1260 [ 2642.243773][ T31] #2: ffffffff8e3d4df8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: exp_funnel_lock+0x1a3/0x3c0 [ 2642.253836][ T31] 1 lock held by syz-executor/32404: [ 2642.259116][ T31] #0: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x255/0x4880 [ 2642.268609][T21133] Bluetooth: hci3: command tx timeout [ 2642.274038][ T31] 1 lock held by syz-executor/32406: [ 2642.279443][ T31] #0: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: inet_rtm_newaddr+0x30c/0x1540 [ 2642.289205][ T31] 1 lock held by syz-executor/32408: [ 2642.294525][ T31] #0: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x255/0x4880 [ 2642.303863][ T31] 1 lock held by syz-executor/32411: [ 2642.309224][ T31] #0: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: __tun_chr_ioctl+0x255/0x4880 [ 2642.319249][ T31] 2 locks held by syz-executor/32414: [ 2642.324633][ T31] #0: ffffffff9012b410 (pernet_ops_rwsem){++++}-{4:4}, at: copy_net_ns+0x333/0x7c0 [ 2642.334359][ T31] #1: ffffffff90141be8 (rtnl_mutex){+.+.}-{4:4}, at: ip_tunnel_init_net+0x21d/0x7d0 [ 2642.351372][ T31] [ 2642.353705][ T31] ============================================= [ 2642.353705][ T31] [ 2642.373432][ T31] NMI backtrace for cpu 1 [ 2642.373450][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2642.373475][ T31] Tainted: [L]=SOFTLOCKUP [ 2642.373481][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2642.373492][ T31] Call Trace: [ 2642.373498][ T31] [ 2642.373504][ T31] dump_stack_lvl+0x116/0x1f0 [ 2642.373530][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 2642.373558][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2642.373578][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 2642.373608][ T31] sys_info+0x133/0x180 [ 2642.373631][ T31] watchdog+0xe66/0x1180 [ 2642.373668][ T31] ? rcu_is_watching+0x12/0xc0 [ 2642.373683][ T31] ? __pfx_watchdog+0x10/0x10 [ 2642.373701][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2642.373723][ T31] ? __kthread_parkme+0x19e/0x250 [ 2642.373741][ T31] ? __pfx_watchdog+0x10/0x10 [ 2642.373759][ T31] kthread+0x3c5/0x780 [ 2642.373778][ T31] ? __pfx_kthread+0x10/0x10 [ 2642.373798][ T31] ? rcu_is_watching+0x12/0xc0 [ 2642.373812][ T31] ? __pfx_kthread+0x10/0x10 [ 2642.373832][ T31] ret_from_fork+0x983/0xb10 [ 2642.373851][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2642.373871][ T31] ? __switch_to+0x7af/0x10d0 [ 2642.373892][ T31] ? __pfx_kthread+0x10/0x10 [ 2642.373913][ T31] ret_from_fork_asm+0x1a/0x30 [ 2642.373949][ T31] [ 2642.373956][ T31] Sending NMI from CPU 1 to CPUs 0: [ 2642.513460][ C0] NMI backtrace for cpu 0 [ 2642.513477][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Tainted: G L syzkaller #0 PREEMPT(full) [ 2642.513499][ C0] Tainted: [L]=SOFTLOCKUP [ 2642.513504][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2642.513512][ C0] RIP: 0010:pv_native_safe_halt+0xf/0x20 [ 2642.513534][ C0] Code: c6 5f 02 c3 cc cc cc cc 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 13 49 12 00 fb f4 cc 35 03 00 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90 [ 2642.513548][ C0] RSP: 0018:ffffffff8e007df8 EFLAGS: 000002c6 [ 2642.513560][ C0] RAX: 000000000ec55c19 RBX: 0000000000000000 RCX: ffffffff8b7816d9 [ 2642.513570][ C0] RDX: 0000000000000000 RSI: ffffffff8dacdf23 RDI: ffffffff8bf2b400 [ 2642.513578][ C0] RBP: fffffbfff1c12f68 R08: 0000000000000001 R09: ffffed101708673d [ 2642.513587][ C0] R10: ffff8880b84339eb R11: ffffffff8e098670 R12: 0000000000000000 [ 2642.513596][ C0] R13: ffffffff8e097b40 R14: ffffffff9088b4d0 R15: 0000000000000000 [ 2642.513605][ C0] FS: 0000000000000000(0000) GS:ffff8881248f5000(0000) knlGS:0000000000000000 [ 2642.513620][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2642.513630][ C0] CR2: 00007ffcf8f09e08 CR3: 000000000e184000 CR4: 00000000003526f0 [ 2642.513652][ C0] Call Trace: [ 2642.513657][ C0] [ 2642.513662][ C0] default_idle+0x13/0x20 [ 2642.513681][ C0] default_idle_call+0x6c/0xb0 [ 2642.513700][ C0] do_idle+0x38d/0x510 [ 2642.513722][ C0] ? __pfx_do_idle+0x10/0x10 [ 2642.513746][ C0] cpu_startup_entry+0x4f/0x60 [ 2642.513772][ C0] rest_init+0x16b/0x2b0 [ 2642.513784][ C0] ? acpi_subsystem_init+0x133/0x180 [ 2642.513799][ C0] ? __pfx_x86_late_time_init+0x10/0x10 [ 2642.513814][ C0] start_kernel+0x3ef/0x4d0 [ 2642.513834][ C0] x86_64_start_reservations+0x18/0x30 [ 2642.513854][ C0] x86_64_start_kernel+0x130/0x190 [ 2642.513875][ C0] common_startup_64+0x13e/0x148 [ 2642.513897][ C0] [ 2642.705163][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 2642.712007][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Tainted: G L syzkaller #0 PREEMPT(full) [ 2642.722685][ T31] Tainted: [L]=SOFTLOCKUP [ 2642.726995][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 2642.737042][ T31] Call Trace: [ 2642.740307][ T31] [ 2642.743224][ T31] dump_stack_lvl+0x3d/0x1f0 [ 2642.747810][ T31] vpanic+0x640/0x6f0 [ 2642.751792][ T31] panic+0xca/0xd0 [ 2642.755509][ T31] ? __pfx_panic+0x10/0x10 [ 2642.759912][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2642.765881][ T31] ? nmi_trigger_cpumask_backtrace+0x1b1/0x300 [ 2642.772029][ T31] ? nmi_trigger_cpumask_backtrace+0x2be/0x300 [ 2642.778181][ T31] ? watchdog+0xe83/0x1180 [ 2642.782587][ T31] ? watchdog+0xe76/0x1180 [ 2642.786995][ T31] watchdog+0xe94/0x1180 [ 2642.791239][ T31] ? rcu_is_watching+0x12/0xc0 [ 2642.795990][ T31] ? __pfx_watchdog+0x10/0x10 [ 2642.800661][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 2642.805852][ T31] ? __kthread_parkme+0x19e/0x250 [ 2642.810861][ T31] ? __pfx_watchdog+0x10/0x10 [ 2642.815526][ T31] kthread+0x3c5/0x780 [ 2642.819586][ T31] ? __pfx_kthread+0x10/0x10 [ 2642.824165][ T31] ? rcu_is_watching+0x12/0xc0 [ 2642.828913][ T31] ? __pfx_kthread+0x10/0x10 [ 2642.833490][ T31] ret_from_fork+0x983/0xb10 [ 2642.838062][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2642.843154][ T31] ? __switch_to+0x7af/0x10d0 [ 2642.847815][ T31] ? __pfx_kthread+0x10/0x10 [ 2642.852387][ T31] ret_from_fork_asm+0x1a/0x30 [ 2642.857145][ T31] [ 2642.860419][ T31] Kernel Offset: disabled [ 2642.864717][ T31] Rebooting in 86400 seconds..