last executing test programs: 16.457121854s ago: executing program 2 (id=145): unshare(0x60000000) r0 = socket$inet6(0xa, 0x2, 0x0) ioctl$sock_SIOCETHTOOL(r0, 0x89f0, &(0x7f0000000040)={'bridge0\x00', &(0x7f0000000100)=@ethtool_coalesce={0x8, 0x0, 0x1000, 0xb82, 0x400000, 0x1ff, 0x4, 0xc0000000, 0x402, 0x20009, 0x5, 0x7, 0x8, 0x80004006, 0x84, 0xfffffffc, 0x0, 0x37e9, 0x80000004, 0x6, 0x5, 0x40424f, 0x3}}) socket$tipc(0x1e, 0x0, 0x0) ioctl$VIDIOC_G_FMT(0xffffffffffffffff, 0xc0d05604, 0x0) r1 = openat$vim2m(0xffffff9c, &(0x7f0000000b00), 0x2, 0x0) ioctl$vim2m_VIDIOC_CREATE_BUFS(r1, 0xc0f8565c, &(0x7f0000000000)={0x40000000, 0xbd5, 0x2, {0x2, @raw_data="f91fd2868ba3d9189024fc40809db9e19479c0b5fce2c721330d5771dbf9dbfa9e2ad24622489141b4803cfeb0b70909e75715a13fada32fef53473eb9ce014fbe3929ea41fdeb0ff177dfb9d3227f213a6451b667d35b03b25618d20cea1f072990b86d463a0de7513744a2bb3bf4fb6049e30f7c533837beba9566c9fd8721c48fad424a5fb17bc1419fb85e5e7dce382ba5a1ce182b419becd67c18f0ba055b8d72225df5a5e7917f8a87a52b8c2516745c462e944b0c22a7e71ecf492a0ef916598abba0e732"}}) ioctl$vim2m_VIDIOC_QBUF(r1, 0xc04c560f, &(0x7f0000000280)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x100000, 0x1, {}, {0x0, 0x8, 0x0, 0x4, 0x0, 0x0, '\x00\x00\x00\b'}, 0x5141, 0x1, {0x0}, 0x2, 0x20000000}) socket(0xa, 0x3, 0x3a) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000200)={0x28b, 0xfff, 0xa}) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000700)={0x0, &(0x7f0000000000)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_CURSOR(0xffffffffffffffff, 0xc01c64a3, &(0x7f0000000340)={0x3, r2, 0xfffffffa, 0x4, 0xb, 0x1fd, 0x1}) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r3, 0xc04064a0, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETCRTC(r3, 0xc06864a1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_GETFB2(0xffffffffffffffff, 0xc06864ce, &(0x7f0000000680)={r4, 0x1ff, 0x0, 0x12000, 0x3, [], [0x0, 0x0, 0x3], [0x0, 0x1001000, 0x800001, 0x4], [0x0, 0x401, 0xfffffffffefffffc, 0x9]}) ioctl$DRM_IOCTL_MODE_GETPLANE(0xffffffffffffffff, 0xc02064b6, &(0x7f00000003c0)={0x0, r2, r4, 0x0, 0x0, 0x6, &(0x7f0000000380)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0]}) ioctl$VIDIOC_OVERLAY(0xffffffffffffffff, 0x4004560e, &(0x7f0000000080)=0x9) openat$uinput(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000140)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x6f, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={0xffffffffffffffff, 0x5, 0xb68, 0xfffffffffffffd2e, &(0x7f0000000000)='e', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x4}, 0x48) socket$unix(0x1, 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000001880)=ANY=[@ANYBLOB="60000000090603000000000000000000050000000900020073797a3100000000050001000700000038000780060004404e21000005000700ff0000000c000180080001400a0101010c00028008000140e00000020c00148008000140"], 0x60}, 0x1, 0x0, 0x0, 0x10004893}, 0x80) 15.95939693s ago: executing program 0 (id=149): r0 = socket$kcm(0x2, 0x200000000000001, 0x106) sendmsg$kcm(r0, &(0x7f0000001900)={0x0, 0x0, 0x0}, 0x20040000) openat$kvm(0xffffffffffffff9c, 0x0, 0x2200, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x6, 0x8031, 0xffffffffffffffff, 0x6a855000) mmap(&(0x7f000095f000/0x3000)=nil, 0x3000, 0x0, 0x3032, 0xffffffffffffffff, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_GUEST_MEMFD(r2, 0xc040aed4, &(0x7f00000001c0)={0x1000200001ee0000, 0x3}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x28011, r3, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x9) mbind(&(0x7f0000008000/0x7000)=nil, 0x7000, 0x1, 0x0, 0x2, 0x1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) mmap(&(0x7f0000ffc000/0x2000)=nil, 0x2000, 0x1000000, 0x8013, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x9) sendmsg$inet(r0, &(0x7f0000000080)={&(0x7f0000000140)={0x2, 0x4001, @loopback}, 0x10, 0x0}, 0x30004001) r4 = socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x49, '\x00', 0x0, @sched_cls=0x2f, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000040)={0x3, 0x0, 0x9, 0xb5e}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0xffffffff}, 0x94) r5 = syz_open_dev$mtd(&(0x7f0000000100), 0x48a99fbe, 0x10b241) writev(r5, &(0x7f0000000240)=[{&(0x7f0000000000)="d7888530a45a9e", 0x200e4}, {0x0, 0xe4}], 0x2) syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58) io_setup(0x8, &(0x7f0000000600)=0x0) io_submit(r7, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r6, 0x0}]) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000002400010026060000fcdbdf2504"], 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) 14.884243634s ago: executing program 1 (id=150): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000540)='./binderfs/binder0\x00', 0x802, 0x0) syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00') openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setrlimit(0x0, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) syz_open_dev$tty1(0xc, 0x4, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000440)='./file1\x00', 0x100) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) socket(0x2d, 0x2, 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r1 = syz_open_procfs(0x0, &(0x7f0000000280)='net/route\x00') preadv(r1, &(0x7f00000001c0)=[{&(0x7f0000000340)=""/127, 0x7f}], 0x1, 0x6, 0x0) write$proc_mixer(0xffffffffffffffff, &(0x7f0000000340)=ANY=[@ANYBLOB='LINE \''], 0x8c) close(0xffffffffffffffff) r2 = open(&(0x7f0000000040)='./file0\x00', 0x84242, 0x1df2a23c5997fad6) write$FUSE_CREATE_OPEN(r2, &(0x7f0000000180)={0xa0, 0x0, 0x0, {{0x4, 0x10000, 0x5, 0x7, 0x800003, 0xfffffffd, {0x400000080001, 0xfd, 0x20ff, 0x8, 0xe, 0xd615, 0x10009, 0x3, 0xfffffffc, 0x6000, 0x0, 0x0, 0x0, 0xd, 0x7}}, {0x0, 0x13}}}, 0xa0) sendfile(r2, r2, &(0x7f0000000080), 0x7f03) 13.566272929s ago: executing program 2 (id=152): r0 = socket$netlink(0x10, 0x3, 0xc) bind$netlink(r0, &(0x7f0000000040)={0x10, 0x0, 0x25dfdbfd}, 0xc) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) mkdirat(0xffffffffffffff9c, 0x0, 0x1e0) r2 = syz_ublk_setup_io_uring(0x20, &(0x7f0000000240)={0x0, 0x2c58, 0x80, 0x20002, 0x16c}, &(0x7f00000000c0)=0x0, 0x0, &(0x7f0000000180)=0x0) syz_io_uring_submit(r3, 0x0, r4, &(0x7f0000000980)=@IORING_OP_UNLINKAT={0x24, 0x1, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x200, 0x1}) syz_ublk_add_dev(r2, r3, 0x0, r4, &(0x7f00000031c0)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x1, 0xffffffffffffffff, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000003180)=@any_dev={0x1, 0x881, 0x0, 0x0, 0x1000, 0x9, 0x0, 0x0, 0x14}}}, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0xc8) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r5 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) r6 = openat(0xffffffffffffffff, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000280)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x0, 0x0, 0x0, 0x10002, 0x0, 0x0, 0x41100, 0x60, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000b80)={r6, 0x2000012, 0x0, 0x0, &(0x7f0000000240), 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xd}, 0x4c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r7 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) socket$nl_generic(0x10, 0x3, 0x10) writev(r7, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$nl_route(0x10, 0x3, 0x0) close(r5) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'syztnl2\x00', &(0x7f0000000100)={'syztnl2\x00', 0x0, 0x2f, 0x0, 0xe, 0x2, 0x6, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast1, 0x20, 0x20, 0x2, 0x9}}) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000880)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_DESC={0xc, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x1}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) 13.498670725s ago: executing program 3 (id=153): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x101280, 0x2) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r0, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000000000100000024000180060005004e230007060001000200000008000300ac1414aa0800060009"], 0x38}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r3 = socket$inet6(0xa, 0x3, 0x5) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r4, 0xaf01, 0x0) ioctl$VHOST_SET_FEATURES(r4, 0x4008af00, &(0x7f0000000080)=0x200000000) r5 = dup2(r3, r4) mkdir(&(0x7f0000000400)='./tracefs\x00', 0x1ff) mount(0x0, &(0x7f0000000440)='./tracefs\x00', &(0x7f0000000480)='tracefs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f00000004c0)='./tracefs/events/xhci-hcd/xhci_portsc_writel/format\x00', 0x0, 0x0) read(r6, &(0x7f0000000500)=""/1024, 0x400) read$FUSE(r5, &(0x7f0000000440)={0x2020}, 0x2020) write$vhost_msg_v2(r5, &(0x7f0000000380)={0x2, 0x0, {&(0x7f0000000140)=""/104, 0x68, 0x0, 0x1, 0x2}}, 0x48) mq_open(&(0x7f00000013c0)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5\x00\x02\x00\x00\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\x06\x00[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x00\x00\x00\x00\x00\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00\xac8t\xc5\xd7Q?\xb4\xeex@\xe4\xcc\xfe\x98\xf63\xde\xcd\x1841\x93\xe5\xb7D\xd49\"\f<\x8d\xa5m\x883\xcf\xc7\xe5Y\xb6H\xa4\xc4_Q|\v\x06:\xdap48T\xa6\xcb:+\x7f\x9771fK=\xc2)\xa60\x1d>\xd2\xe8\xc0\x03\xa7e\xbeo\x8d\xe3\x854\x11\xc5d\xcb\x82', 0x2, 0x11b, 0x0) mq_unlink(&(0x7f0000000000)='eth0\x00') bpf$MAP_CREATE(0x0, 0x0, 0x0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, 0x0, 0x2b) 13.406472431s ago: executing program 1 (id=154): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) syz_open_dev$usbfs(&(0x7f00000000c0), 0xd, 0x20000) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 12.003886987s ago: executing program 0 (id=155): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{0x0}], 0x1) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) syz_open_dev$usbfs(&(0x7f00000000c0), 0xd, 0x20000) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 11.516662539s ago: executing program 3 (id=156): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$kcm(0x10, 0x400000002, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000980)=@delchain={0x24, 0x65, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xfff2, 0x8}, {0x0, 0x1}, {0xffec, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x8d0}, 0x8000000) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r6, r5}, 0xc) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="0bf600004e00075d"], 0xfe33) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r7) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x14, r8, 0x701, 0x70bd2d, 0x25dfdbff}, 0x14}}, 0x10044880) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/tty/ttyS0/console\x00', 0x2, 0x0) write(r9, &(0x7f0000000080)='y', 0x1) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x52, 0xd8, 0xfffc, {0x4, 0x1}, {0x47, 0x2}, @rumble={0x46f2, 0x4}}) r10 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r10, &(0x7f0000000040)="e2", 0x12d8) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a5c000000060a010400000000000000000a0000040900010073797a31000000000900020073797a3200000000300004802c0001800b000100736f636b657400001c00028008000302000000090800"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044014) 9.197935551s ago: executing program 1 (id=157): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) syz_open_dev$usbfs(&(0x7f00000000c0), 0xd, 0x20000) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 8.733290893s ago: executing program 3 (id=158): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000ec0)) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', 0x0, 0x2c, 0x2) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) r4 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_LIMIT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xf0}}, 0x0) 8.174201692s ago: executing program 2 (id=159): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000ec0)) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', 0x0, 0x2c, 0x2) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r5 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r5, r4, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_LIMIT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xf0}}, 0x0) 7.777238556s ago: executing program 0 (id=160): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYRESDEC=r2], 0x38}, 0x1, 0x0, 0x0, 0x4048011}, 0x0) r4 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$DRM_IOCTL_GET_CLIENT(r4, 0xc0186405, &(0x7f0000000100)={0xb, 0x5, {0xffffffffffffffff}, {0xee01}, 0xffff}) prctl$PR_SCHED_CORE(0x3e, 0x1, r5, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x143102) writev(r6, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) shmget$private(0x0, 0x2000, 0x0, &(0x7f00000eb000/0x2000)=nil) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000040)={0x1c, 0x2, 0x6, 0x3, 0x0, 0x0, {0xd}, [@IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x1c}}, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) r8 = syz_genetlink_get_family_id$nbd(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NBD_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000003c0)=ANY=[@ANYBLOB='h\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="010000000000000000000100000008000100400000000c000200700f0000000000000c00060003000000000000000a000a00272d5d29212b0000140007"], 0x6c}}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) socket$nl_generic(0x10, 0x3, 0x10) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$ETHTOOL_MSG_LINKMODES_SET(r9, &(0x7f0000000240)={0x0, 0x0, 0x0}, 0x0) r10 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_SET_MP_STATE(r10, 0x4004ae99, &(0x7f0000000280)=0x3) ioctl$KVM_INTERRUPT(r10, 0x4004ae86, &(0x7f0000000240)=0x4) 7.653590679s ago: executing program 3 (id=161): r0 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r0, 0xae41, 0x0) syz_emit_ethernet(0x66, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r1, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x4, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$vimc2(0xffffffffffffff9c, 0x0, 0x2, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) execveat(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1000) r2 = add_key$user(&(0x7f0000000040), 0x0, &(0x7f0000000080)='\x00', 0x1, 0xfffffffffffffffb) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x1f) keyctl$KEYCTL_WATCH_KEY(0x20, r2, r4, 0x5b) read$watch_queue(r3, &(0x7f0000000000)=""/1, 0x1) keyctl$revoke(0x3, r2) r5 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) syz_io_uring_setup(0x1fc7, &(0x7f0000000140)={0x0, 0x79b2, 0x3180, 0x1, 0x3b1}, 0x0, 0x0, &(0x7f0000000000)) r6 = syz_usb_connect$printer(0x0, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402505a8a4410001020b0109021b00010100c000090400000207010100090501020002"], 0x0) syz_usb_control_io$printer(r6, 0x0, &(0x7f00000011c0)={0x34, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000001180)={0x20, 0x0, 0x1}}) r7 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) pwritev2(r7, &(0x7f00000015c0)=[{&(0x7f0000000080)="ec", 0x1}], 0x1, 0xfffff, 0x0, 0x0) write$uinput_user_dev(r4, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x40, [0x7ffd, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0x2, 0xe661, 0x4, 0x7, 0xdf, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x200, 0x1, 0x7, 0x200, 0x3e, 0x2, 0x6, 0x6, 0xc, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000009, 0x9, 0x8000012f, 0x8004, 0x1, 0xfffffff3, 0x129432e6, 0x88, 0xf9, 0xe, 0x8, 0x6c7, 0x9, 0xfffffffc, 0x8, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x30e, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x6, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f34, 0xd, 0x100004e0, 0x2, 0x4, 0xb, 0x8001, 0x9, 0x8, 0x9, 0x3b, 0x47, 0x8020, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x3, 0x3, 0x9, 0x1, 0x3, 0xffffffff, 0xbc45, 0x48c93690, 0x43, 0x103], [0x7, 0xa, 0x4, 0x5, 0x7f, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0x9, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0xbe7, 0xb, 0x5, 0x2, 0x2, 0x3, 0x20000008, 0x2, 0x6d03, 0x6, 0x2c6, 0x800003, 0x200, 0x0, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0x6, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x8b, 0xfffffff9, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x4, 0x25], [0x80009, 0xbb33, 0x80000000, 0xb, 0xfffffff3, 0x93a, 0x6, 0x1000006, 0xfffffffe, 0xb9, 0xce7, 0x1ff, 0x2, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7ff, 0x2, 0x5, 0x1, 0x2, 0x14d, 0x60a7, 0x16, 0x96, 0xfffffffe, 0x80000000, 0x5, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7e, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0xf, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0x1]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) close_range(r5, 0xffffffffffffffff, 0x3f00000000000000) 5.481346877s ago: executing program 1 (id=162): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000ec0)) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) pipe2$watch_queue(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r4 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r4, r3, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_LIMIT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xf0}}, 0x0) 5.472290276s ago: executing program 2 (id=163): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000080), 0x40202, 0x0) ioctl$SNDCTL_DSP_SETTRIGGER(r0, 0x40045010, &(0x7f00000004c0)=0x4) socket$nl_netfilter(0x10, 0x3, 0xc) mmap(&(0x7f0000200000/0x4000)=nil, 0x4000, 0x4, 0x200000006c832, 0xffffffffffffffff, 0x0) r1 = socket(0x40000000015, 0x5, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x31, &(0x7f0000000100)=0x8, 0x4) connect$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) bind$inet(r1, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) recvmmsg(r1, &(0x7f0000001740)=[{{0x0, 0x0, &(0x7f0000001400)=[{&(0x7f0000000400)=""/4096, 0x10c4}], 0x1}}], 0x4000210, 0x2, 0x0) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x23, &(0x7f00000000c0)=0xfe, 0x4) sendmsg$NFT_BATCH(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[], 0xc4}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) r2 = add_key$fscrypt_provisioning(&(0x7f0000000000), &(0x7f0000000140)={'syz', 0x0}, &(0x7f00000001c0)={0x2, 0x0, @a}, 0x48, 0xfffffffffffffffd) keyctl$describe(0x6, r2, &(0x7f0000000240)=""/9, 0x9) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_AUTH_DEACTIVATE_KEY(r3, 0x84, 0x23, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004000}, 0x24000840) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{0x0}], 0x1) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, 0x0}, 0x0) 4.256695839s ago: executing program 0 (id=164): mkdir(&(0x7f0000000080)='./file1\x00', 0x8) mount(0x0, &(0x7f0000000200)='./file1\x00', &(0x7f0000000000)='tmpfs\x00', 0x8, &(0x7f0000000300)='usrquota') chdir(0x0) memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x4, 0x6}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000ec0)) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), r1) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) r2 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r3 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bc82000000000000a6020000f8ffffffb703000008000000b703000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) fsetxattr$system_posix_acl(r3, &(0x7f0000000080)='system.posix_acl_access\x00', 0x0, 0x2c, 0x2) syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), r1) r4 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r4, 0xffffffffffffffff, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x40, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_HOOK={0x14, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8}, @NFTA_HOOK_HOOKNUM={0x8}]}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x68, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x40, 0x4, 0x0, 0x1, [{0x3c, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_LIMIT_TYPE={0x8, 0x4, 0x1, 0x0, 0x1}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_LIMIT_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}]}}}]}]}], {0x14}}, 0xf0}}, 0x0) 4.117754892s ago: executing program 1 (id=165): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) r4 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) syz_open_dev$usbfs(&(0x7f00000000c0), 0xd, 0x20000) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 3.843164296s ago: executing program 3 (id=166): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$kcm(0x10, 0x400000002, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'veth0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xfffffffd, {0x0, 0x0, 0x0, r4, {0x0, 0x1}, {0xffff, 0xffff}, {0xffe0, 0xfff3}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}, 0x1, 0x0, 0x0, 0x200000c0}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000980)=@delchain={0x24, 0x65, 0x1, 0x70bd26, 0x25dfdbfc, {0x0, 0x0, 0x0, r4, {0xfff2, 0x8}, {0x0, 0x1}, {0xffec, 0x4}}}, 0x24}, 0x1, 0x0, 0x0, 0x8d0}, 0x8000000) r5 = bpf$MAP_CREATE(0x0, 0x0, 0x50) r6 = bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$PROG_BIND_MAP(0xa, &(0x7f00000003c0)={r6, r5}, 0xc) write$cgroup_subtree(r1, &(0x7f0000000280)=ANY=[@ANYBLOB="0bf600004e00075d"], 0xfe33) r7 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000240), r7) sendmsg$IEEE802154_LLSEC_LIST_SECLEVEL(r7, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000040)={0x14, r8, 0x701, 0x70bd2d, 0x25dfdbff}, 0x14}}, 0x10044880) mkdir(&(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='./sys\x00', &(0x7f0000000300)='sysfs\x00', 0x0, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000400)='./sys/class/tty/ttyS0/console\x00', 0x2, 0x0) write(r9, &(0x7f0000000080)='y', 0x1) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) ioctl$EVIOCSFF(0xffffffffffffffff, 0x40304580, &(0x7f0000000480)={0x52, 0xd8, 0xfffc, {0x4, 0x1}, {0x47, 0x2}, @rumble={0x46f2, 0x4}}) r10 = syz_open_dev$evdev(&(0x7f0000000000), 0x1, 0x8c2b01) write$char_usb(r10, &(0x7f0000000040)="e2", 0x12d8) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000300000a5c000000060a010400000000000000000a0000040900010073797a31000000000900020073797a3200000000300004802c0001800b000100736f636b657400001c00028008000302000000090800"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x24044014) 3.659040375s ago: executing program 2 (id=167): mmap(&(0x7f0000001000/0x3000)=nil, 0x3000, 0x8, 0x32, 0xffffffffffffffff, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000540)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000", @ANYRES32=0xffffffffffffffff], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b00000005000000"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0x4, &(0x7f0000000480)=ANY=[@ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000580)={0x18, 0x5, &(0x7f00000002c0)=ANY=[@ANYRESOCT=r1], 0x0, 0x1, 0x0, 0x0, 0x0, 0xb4a02fe0ce239f93, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x7}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0xe, 0x0, &(0x7f00000004c0)=ANY=[@ANYBLOB, @ANYRESOCT=r1], 0x0, 0x400, 0x0, 0x0, 0x41100, 0x59, '\x00', 0x0, @fallback=0x2c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x94) bind$inet6(0xffffffffffffffff, &(0x7f00000000c0)={0xa, 0x4e21, 0xb, @empty}, 0x1c) connect$inet6(0xffffffffffffffff, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @private=0xa010102}}, 0x1c) getsockopt$inet_sctp_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, 0x0, &(0x7f00000001c0)) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a300000000009"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r2, 0x0, 0x0) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="2800000010000100000000000000000085ff00003f0000009bd000000000000008001c00c9000000"], 0x28}], 0x1, 0x0, 0x0, 0xb305e06d8ab48277}, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f0000000300)={0x0, @in={{0x2, 0x4e22, @empty}}, 0x2000006, 0x0, 0x0, 0xb3, 0x0, 0x0, 0x1}, 0x9c) bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x4, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x68}, 0x94) unshare(0x26020480) r3 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="02000000040000000800400001"], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f00000003c0)={r3, &(0x7f0000000500), &(0x7f0000000080)=""/12}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000900)=ANY=[@ANYRES8=r0, @ANYRES32], 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_CREATE(0x0, &(0x7f0000000740)=ANY=[@ANYBLOB="0b0000000500000000040000090000"], 0x48) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x2000000, 0xe, 0x0, &(0x7f0000000040)="630b008646dc3f0adf33c9f7b986", 0x0, 0xcf25, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x80}, 0x50) socket$alg(0x26, 0x5, 0x0) 3.340320343s ago: executing program 0 (id=168): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r0, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008f}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=@deltclass={0x44, 0x29, 0x10, 0x70bd2a, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0xf, 0x6}, {0x1, 0x4}, {0xc, 0xa}}, [@TCA_RATE={0x6, 0x5, {0xe, 0x8}}, @TCA_RATE={0x6, 0x5, {0xff, 0x2}}, @TCA_RATE={0x6, 0x5, {0xff}}, @tclass_kind_options=@c_mq={0x7}]}, 0x44}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) syz_open_dev$video(&(0x7f0000000280), 0x101, 0xab02) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r2 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r2, 0x400452c8, &(0x7f0000000100)) openat$fuse(0xffffff9c, &(0x7f0000000080), 0x2, 0x0) ioctl$FS_IOC_GETFSLABEL(r2, 0x800452d3, &(0x7f0000000100)) mkdir(&(0x7f00000000c0)='./file0\x00', 0x0) mount$tmpfs(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f00000001c0), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='quota,grpquota_block_hardlimit=3']) chdir(&(0x7f0000000100)='./file0\x00') r3 = creat(&(0x7f0000000100)='./file0\x00', 0x59) quotactl_fd$Q_GETNEXTQUOTA(r3, 0xffffffff80000901, 0x0, &(0x7f0000000500)) sendto$inet6(r0, &(0x7f0000847fff), 0x0, 0xe0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) 3.111816886s ago: executing program 2 (id=169): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000002c0), 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) r4 = syz_open_dev$sndmidi(0x0, 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) syz_open_dev$usbfs(&(0x7f00000000c0), 0xd, 0x20000) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) 3.110829382s ago: executing program 3 (id=170): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000680)={0x10, 0x3, &(0x7f0000000100)=@framed={{0x18, 0x2}}, &(0x7f00000000c0)='GPL\x00', 0x1}, 0x94) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/platform/drivers/vhci_hcd/unbind\x00', 0x1, 0x0) write(r1, &(0x7f0000000300)='vhci_hcd.0', 0xa) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x1) r2 = syz_open_dev$media(0x0, 0x0, 0x0) ioctl$MEDIA_IOC_ENUM_LINKS(r2, 0xc0287c02, &(0x7f0000000480)={0x80000000, 0xffffffffffffffff, 0x0}) r3 = bpf$MAP_CREATE(0x0, &(0x7f00000023c0)=@base={0x5, 0x4, 0x8, 0xb}, 0x50) r4 = socket(0x10, 0x3, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="680000001000ffff25bd7000fddbdf2500000000", @ANYRES32=0x0, @ANYBLOB="1720000021200000400012800c0001006d6163766c616e0030000280080003000300000008000100100000001c0005800a000400aaaaaaaaaa2d00000a0004003426f7b68ed1000008000500", @ANYRES32=r5], 0x68}, 0x1, 0x0, 0x0, 0x1}, 0x8000002) getsockopt$CAN_RAW_FILTER(0xffffffffffffffff, 0x65, 0x1, &(0x7f0000001040)=[{}], &(0x7f0000000100)=0x8) sendmmsg(r4, &(0x7f0000000000), 0x4000000000001f2, 0xfc) r6 = add_key(&(0x7f0000000000)='keyring\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0, 0x0, 0xfffffffffffffffc) add_key$keyring(&(0x7f00000001c0), &(0x7f0000000780)={'syz', 0x1}, 0x0, 0x0, r6) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000, 0x0, 0x0, 0x8000000}) r7 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETA(r7, 0x5406, &(0x7f0000000200)={0xfff, 0xa925, 0x9, 0x8007, 0x8, "7a3800e5ffffff00"}) ioctl$TIOCL_GETMOUSEREPORTING(r7, 0x5412, &(0x7f00000006c0)=0x16) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000300)={@cgroup, 0xe, 0x1, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) r8 = add_key(&(0x7f0000000040)='asymmetric\x00', 0x0, &(0x7f0000000200)="308205553082033da00302010202147398ea982dd02ea8b1cf57c7f297b3e61afc8c0a300d06092a864886f70d01010b050030343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b65793020170d3232303531383232333234315a180f32313232303432343232333234315a30343132303006035504030c29436572746966696361746520766572696669636174696f6e2073656c662d74657374696e67206b657a30820222300d06092a864886f70d01010105000382020f003082020a0282020100ccac49dd3bcab0157e846ab20a695f1c0a61823b4f2ca3952c08584bb15d99e0c3c179c2b3ebc01e6d3e541dbdb7927b4db59558b2522ec6244b7163803277a7385edb72ae6e0decfbb66d017fe95566dfbf1d76780231e8e507f8b7825c0dd4bbfba2590d2e3a78953a8b4606474446d7cd066a4113e319f6bb6e38f48301a3bf4a394fd70ae938b3f594144eddf743fd24b2493ca5f77a7cd4453d977568f1ed4c420b70ca85f3dee5882cc5beb69734ba2402cd8b869fa973ca73cf9281ee7555bb18675cff3fb5dd331b0ce978db5ccfaa5c4342df5ea96decd7d7ffe6a13a921adaaef68c6f7bd5b46e06e98fe8de093189ed0e11a1fa8ae9e964596253dad170be11d4999711cf99de0b9d947eaab852ea37db907e35bdd9fe6d0a487028ddd50d7f03809314238fb922cd7c29fef172b55c0b12cf9c15f6114c7a45258c450a34ac2d9a81ca0b1322cdeb1a38881897960881aacc8f0f8a327b7668036843bf11ba5560fd801c0d9b69b60972bc0f412f0782c6e3b21391c46d149531be19bdbcede14c74a2e0780bbb94ec4c533aa2b5841d4b657edcf7db367dbe9e3b366642667635bfbef0c13c7ce9425c24530305a86724500275ff24463b358976e670dac5518c9ae505b00bd02dd47d5775946bf90aad0e410015d04fc07f902d18488f28fe5da7cd999ebd026c8a31f31cc74be693cd42a2e46810479dfc210203010001a35d305b300c0603551d130101ff04023000300b0603551d0f040403020780301d0603551d0e04160414f58703bb33ce1b73ee02eccdee5b8817518fe3db301f0603551d23041830168014f58703bb33ce1b73ee02eccdee5b8817518fe3db300d06092a864886f70d01010b05000382020100c02e12417b738516c8db8679e8f5cd44f4c6e281235e47cbab25f11e583e317f78ad85ebfe148860f77fd226a2f4982afdba050c203312cc4d1461648193d333edc8fff178cc5f519f09d7be0d5c74fd9bdf524ac9a871253304106736d0b30bc9a14072ae417b68e6e47bd028f76de73f50fc917c9156d4dfa6bbe84d1b58aa28fac119eb112f248b7cc5a98626aa6eb79bd5f806fb02527b9c9ea1e0078b5ee4b85529f648521c1b542d46d8e571b960d145b592898a63582ab3c6b276e23c825904ae5ac4997b2e4b4657b82924b2fdee2c0da483fa652a07358b97cfbd962ed17e6cc21e87b66c7665b5b262da8be973e3db33dd133a17636a76de8d8fe04761283a83ff8fe7c7e04aa3e507cfe98c35352ee7806631bf91580ae1253d38d3a4f059344707620fbe30dd818858f028b096e582f805b71301bcfac61f8672ccf9ee8ed9d6048c246cbf0f5d3739cf45c1933ad2ed5c5879748662307e8ebbdd7aa9edca40cb6247f4b49f527f7263a8f02baf452a48196de3fbf9196669c8cc62876c532b2d6e906c543a822541cb186aa422a8a1c447d781001c15510f1aafef9fa6618cbd6b8bede6ac0eb63a4c92e60f910a0f71c7a0b90d3a175a6f35c8e7504f46e870604806828b6658e673919c123d358e46ad5af5b3db692104fdd31cdf949d56b00ad19576", 0x544, r6) keyctl$KEYCTL_PKEY_DECRYPT(0x1a, &(0x7f0000000180)={r8}, &(0x7f0000000840)=ANY=[], 0x0, 0x0) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000140)={@map=r3, r0, 0x7}, 0x10) prctl$PR_SET_TAGGED_ADDR_CTRL(0x37, 0x7fff8) 165.54914ms ago: executing program 1 (id=171): listen(0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) recvmmsg(r0, &(0x7f0000000580)=[{{&(0x7f00000005c0)=@phonet, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000400)=""/23, 0x17}, {0x0}], 0x2, &(0x7f0000000500)=""/88, 0x58}, 0x4}], 0x1, 0x0, 0x0) sched_setattr(0x0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x891e, &(0x7f0000000380)={'ip6gre0\x00', 0x0}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000d00)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010000000900010073797a30000000002c000000030a010800000000000000000100000b0900030073797a32000000000900010073797a300000000060000000060a010400000000000000000100000008000b40000000000900010073797a300000000038000480340001800a0001006d61746368000000240002800c000300b07346e358c219250b0001006367726f75700000080002"], 0xd4}}, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) io_uring_setup(0x549c, &(0x7f0000000000)={0x0, 0x70e6, 0x2, 0x2, 0xf2}) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, 0x0, &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_procfs(0xffffffffffffffff, 0x0) unshare(0x6a040000) mmap(&(0x7f00004a3000/0x1000)=nil, 0x1000, 0x0, 0x4000010, 0xffffffffffffffff, 0x0) r3 = openat$pmem0(0xffffffffffffff9c, &(0x7f0000002340), 0x80d01, 0x0) pwrite64(r3, &(0x7f0000000000)="a5", 0xfffffe8c, 0x2) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000000)='loginuid\x00') write$binfmt_format(r4, &(0x7f0000000040)='1\x00', 0x2) ioctl$BLKRRPART(r3, 0x125f, 0x1f) 0s ago: executing program 0 (id=172): r0 = syz_open_dev$cec(0x0, 0x0, 0xe8c00) ioctl$CEC_DQEVENT(r0, 0xc0506107, 0x0) r1 = dup2(r0, r0) ioctl$SOUND_MIXER_WRITE_VOLUME(r1, 0xc0044d1d, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r2 = openat$kvm(0xffffffffffffff9c, 0x0, 0x200, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_GET_DIRTY_LOG(r3, 0x4010ae42, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000/0x3000)=nil}) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) r5 = io_uring_setup(0x2e08, &(0x7f00000001c0)={0x0, 0x5acf, 0x40, 0xffffffff}) syz_open_dev$usbfs(&(0x7f00000000c0), 0xd, 0x20000) io_uring_register$IORING_REGISTER_BUFFERS(r5, 0x0, &(0x7f0000000240)=[{&(0x7f0000001700)=""/4095, 0xfff}], 0x1) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f0000000180)={0xaa, 0x1a5}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f0000000080)={{&(0x7f0000ffd000/0x3000)=nil, 0x3000}, 0x1}) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000040)={&(0x7f0000ffd000/0x3000)=nil, &(0x7f0000000000/0x3000)=nil, 0x3000}) kernel console output (not intermixed with test programs): Warning: Permanently added '[localhost]:31701' (ED25519) to the list of known hosts. syzkaller login: [ 95.861391][ T5727] cgroup: Unknown subsys name 'net' [ 96.148419][ T5727] cgroup: Unknown subsys name 'cpuset' [ 96.180990][ T5727] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 98.040796][ T5727] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 108.039764][ T1345] cfg80211: failed to load regulatory.db [ 110.215464][ T5755] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 110.230127][ T5755] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 110.244512][ T5759] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 110.247272][ T5756] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 110.248311][ T5759] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 110.271678][ T5756] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 110.274611][ T5761] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 110.278912][ T5756] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 110.280876][ T5756] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 110.292595][ T5763] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 110.298892][ T5761] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 110.302141][ T5759] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 110.307764][ T5763] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 110.322926][ T5759] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 110.324858][ T5761] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 110.329645][ T5763] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 110.356537][ T5763] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 110.357432][ T5759] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 110.392230][ T5763] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 110.399378][ T5759] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 111.929982][ T5750] bridge0: port 1(bridge_slave_0) entered blocking state [ 111.933564][ T5750] bridge0: port 1(bridge_slave_0) entered disabled state [ 111.953959][ T5750] bridge_slave_0: entered allmulticast mode [ 111.959552][ T5750] bridge_slave_0: entered promiscuous mode [ 112.039547][ T5750] bridge0: port 2(bridge_slave_1) entered blocking state [ 112.072749][ T5750] bridge0: port 2(bridge_slave_1) entered disabled state [ 112.076154][ T5750] bridge_slave_1: entered allmulticast mode [ 112.080374][ T5750] bridge_slave_1: entered promiscuous mode [ 112.209973][ T5750] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 112.227310][ T5750] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 112.267533][ T5750] team0: Port device team_slave_0 added [ 112.279515][ T5750] team0: Port device team_slave_1 added [ 112.365935][ T5761] Bluetooth: hci2: command tx timeout [ 112.453288][ T5761] Bluetooth: hci3: command tx timeout [ 112.482640][ T5761] Bluetooth: hci1: command tx timeout [ 112.482698][ T5093] Bluetooth: hci0: command tx timeout [ 112.527181][ T5750] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 112.530461][ T5750] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.552586][ T5750] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 112.764885][ T5750] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 112.784539][ T5750] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 112.813711][ T5750] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 113.139335][ T5750] hsr_slave_0: entered promiscuous mode [ 113.165800][ T5750] hsr_slave_1: entered promiscuous mode [ 113.194990][ T5748] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.197871][ T5748] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.201297][ T5748] bridge_slave_0: entered allmulticast mode [ 113.205907][ T5748] bridge_slave_0: entered promiscuous mode [ 113.275878][ T5758] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.278812][ T5758] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.282236][ T5758] bridge_slave_0: entered allmulticast mode [ 113.290467][ T5758] bridge_slave_0: entered promiscuous mode [ 113.299045][ T5748] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.302581][ T5748] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.305811][ T5748] bridge_slave_1: entered allmulticast mode [ 113.320407][ T5748] bridge_slave_1: entered promiscuous mode [ 113.339236][ T5747] bridge0: port 1(bridge_slave_0) entered blocking state [ 113.350638][ T5747] bridge0: port 1(bridge_slave_0) entered disabled state [ 113.357688][ T5747] bridge_slave_0: entered allmulticast mode [ 113.365370][ T5747] bridge_slave_0: entered promiscuous mode [ 113.385115][ T5758] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.387849][ T5758] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.391225][ T5758] bridge_slave_1: entered allmulticast mode [ 113.401371][ T5758] bridge_slave_1: entered promiscuous mode [ 113.434093][ T5747] bridge0: port 2(bridge_slave_1) entered blocking state [ 113.436949][ T5747] bridge0: port 2(bridge_slave_1) entered disabled state [ 113.440773][ T5747] bridge_slave_1: entered allmulticast mode [ 113.447833][ T5747] bridge_slave_1: entered promiscuous mode [ 113.589555][ T5747] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.597810][ T5758] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.613865][ T5748] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 113.642065][ T5748] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.652339][ T5747] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.693155][ T5758] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 113.779771][ T5747] team0: Port device team_slave_0 added [ 113.830316][ T5747] team0: Port device team_slave_1 added [ 113.852856][ T5748] team0: Port device team_slave_0 added [ 113.857760][ T5748] team0: Port device team_slave_1 added [ 113.978164][ T5758] team0: Port device team_slave_0 added [ 113.995375][ T5748] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 113.999486][ T5748] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.015167][ T5748] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.038345][ T5747] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 114.041695][ T5747] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.058460][ T5747] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.102173][ T5758] team0: Port device team_slave_1 added [ 114.147855][ T5748] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.150943][ T5748] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.169627][ T5748] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.181313][ T5747] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.200914][ T5747] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.241676][ T5747] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.381582][ T5758] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 114.386384][ T5758] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.403765][ T5758] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 114.423637][ T5748] hsr_slave_0: entered promiscuous mode [ 114.427716][ T5748] hsr_slave_1: entered promiscuous mode [ 114.435234][ T5093] Bluetooth: hci2: command tx timeout [ 114.442211][ T5748] debugfs: 'hsr0' already exists in 'hsr' [ 114.442325][ T5748] Cannot create hsr debugfs directory [ 114.488921][ T5758] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 114.505766][ T5758] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 114.512566][ T5093] Bluetooth: hci0: command tx timeout [ 114.512634][ T5761] Bluetooth: hci1: command tx timeout [ 114.546770][ T5761] Bluetooth: hci3: command tx timeout [ 114.564633][ T5758] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 114.615036][ T5747] hsr_slave_0: entered promiscuous mode [ 114.623689][ T5747] hsr_slave_1: entered promiscuous mode [ 114.628897][ T5747] debugfs: 'hsr0' already exists in 'hsr' [ 114.633438][ T5747] Cannot create hsr debugfs directory [ 114.742321][ T5758] hsr_slave_0: entered promiscuous mode [ 114.748967][ T5758] hsr_slave_1: entered promiscuous mode [ 114.754315][ T5758] debugfs: 'hsr0' already exists in 'hsr' [ 114.758486][ T5758] Cannot create hsr debugfs directory [ 114.949158][ T5750] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 115.008651][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 115.053161][ T5750] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 115.059865][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 115.099795][ T5750] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 115.126005][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 115.175913][ T5750] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 115.187804][ T5750] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 115.468104][ T5747] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 115.503900][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 115.524910][ T5747] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 115.541280][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 115.546818][ T5747] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 115.555060][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 115.585138][ T5747] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 115.595396][ T5747] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 115.724596][ T5758] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 115.772264][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 115.804357][ T5750] 8021q: adding VLAN 0 to HW filter on device bond0 [ 115.868953][ T5758] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 115.876035][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 115.923404][ T5758] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 115.935257][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 115.942868][ T5750] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.015975][ T5758] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 116.024430][ T5758] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 116.032683][ T403] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.036562][ T403] bridge0: port 1(bridge_slave_0) entered forwarding state [ 116.163992][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 116.167444][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 116.379122][ T5748] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 116.400891][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 116.442747][ T5748] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 116.470483][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 116.497231][ T5748] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 116.523592][ T5761] Bluetooth: hci2: command tx timeout [ 116.542200][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 116.553927][ T5748] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 116.567533][ T5748] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 116.595192][ T5761] Bluetooth: hci3: command tx timeout [ 116.602490][ T5761] Bluetooth: hci0: command tx timeout [ 116.616117][ T5093] Bluetooth: hci1: command tx timeout [ 116.658086][ T5747] 8021q: adding VLAN 0 to HW filter on device bond0 [ 116.786843][ T5747] 8021q: adding VLAN 0 to HW filter on device team0 [ 116.860849][ T1172] bridge0: port 1(bridge_slave_0) entered blocking state [ 116.884763][ T1172] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.218955][ T1172] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.232644][ T1172] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.335767][ T5758] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.364994][ T5758] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.443657][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.447542][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.476835][ T72] bridge0: port 2(bridge_slave_1) entered blocking state [ 117.501044][ T72] bridge0: port 2(bridge_slave_1) entered forwarding state [ 117.544371][ T5748] 8021q: adding VLAN 0 to HW filter on device bond0 [ 117.728056][ T5747] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 117.851430][ T5748] 8021q: adding VLAN 0 to HW filter on device team0 [ 117.955700][ T38] bridge0: port 1(bridge_slave_0) entered blocking state [ 117.960869][ T38] bridge0: port 1(bridge_slave_0) entered forwarding state [ 117.975602][ T38] bridge0: port 2(bridge_slave_1) entered blocking state [ 118.002927][ T38] bridge0: port 2(bridge_slave_1) entered forwarding state [ 118.027355][ T5750] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 118.344262][ T5750] veth0_vlan: entered promiscuous mode [ 118.380080][ T5750] veth1_vlan: entered promiscuous mode [ 118.499560][ T5750] veth0_macvtap: entered promiscuous mode [ 118.529349][ T5750] veth1_macvtap: entered promiscuous mode [ 118.592886][ T5093] Bluetooth: hci2: command tx timeout [ 118.645756][ T5750] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 118.672970][ T5093] Bluetooth: hci0: command tx timeout [ 118.679500][ T5093] Bluetooth: hci3: command tx timeout [ 118.683670][ T5093] Bluetooth: hci1: command tx timeout [ 118.690124][ T5750] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 119.025097][ T5747] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.207046][ T5824] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.213380][ T5824] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.217060][ T5824] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.224319][ T5824] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 119.287446][ T5758] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.418195][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.421295][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.517618][ T5748] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 119.569843][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 119.585380][ T5747] veth0_vlan: entered promiscuous mode [ 119.589817][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 119.709452][ T5758] veth0_vlan: entered promiscuous mode [ 119.715667][ T5747] veth1_vlan: entered promiscuous mode [ 119.815160][ T5747] veth0_macvtap: entered promiscuous mode [ 119.836848][ T5758] veth1_vlan: entered promiscuous mode [ 119.885635][ T5748] veth0_vlan: entered promiscuous mode [ 119.903520][ T5747] veth1_macvtap: entered promiscuous mode [ 119.908717][ T5750] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 119.967776][ T5748] veth1_vlan: entered promiscuous mode [ 120.036567][ T5750] ebtables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 120.039640][ T5747] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.079838][ T5750] arp_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 120.086964][ T5747] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.115486][ T5758] veth0_macvtap: entered promiscuous mode [ 120.129549][ T5758] veth1_macvtap: entered promiscuous mode [ 120.138273][ T5750] ip_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 120.196506][ T5748] veth0_macvtap: entered promiscuous mode [ 120.309890][ T5748] veth1_macvtap: entered promiscuous mode [ 120.332071][ T5750] ip6_tables: xtables 32bit compat interface no longer supported in namespaces and will be removed soon. [ 120.345141][ T5758] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.391407][ T5748] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 120.448663][ T5897] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.452737][ T5897] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.461477][ T5758] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.511176][ T5748] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 120.551084][ T5824] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.703106][ T72] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 120.710595][ T5824] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.710779][ T72] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 120.797898][ T5897] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 120.935967][ T5549] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.014849][ T5549] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.048805][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.058428][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.344325][ T5549] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.348218][ T5549] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.366855][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.371325][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.443559][ T5824] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.468305][ T5549] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.522207][ T38] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.525245][ T5824] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 121.554202][ T38] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.773884][ T38] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.812581][ T38] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 121.915724][ T164] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 121.954156][ T164] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 124.203867][ T5917] netlink: 20 bytes leftover after parsing attributes in process `syz.3.4'. [ 126.183234][ T5927] wlan0 speed is unknown, defaulting to 1000 [ 126.240566][ T5927] wlan0 speed is unknown, defaulting to 1000 [ 126.246896][ T5927] wlan0 speed is unknown, defaulting to 1000 [ 126.257595][ T5927] smbdirect: ib_dev[syz0]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 126.285952][ T5927] smbdirect: ib_dev[syz0]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 126.312830][ T5742] udevd[5742]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 126.409803][ T5927] smbdirect: ib_dev[syz0]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 126.415016][ T5749] udevd[5749]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 126.541799][ T5927] iwpm_register_pid: Unable to send a nlmsg (client = 2) [ 126.661852][ T5927] infiniband syz0: RDMA CMA: cma_listen_on_dev, error -98 [ 126.837438][ T5927] wlan0 speed is unknown, defaulting to 1000 [ 126.872291][ T5927] wlan0 speed is unknown, defaulting to 1000 [ 126.984479][ T5927] wlan0 speed is unknown, defaulting to 1000 [ 127.037463][ T5927] wlan0 speed is unknown, defaulting to 1000 [ 128.515498][ T5938] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(7) [ 128.518832][ T5938] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 128.525249][ T5938] vhci_hcd vhci_hcd.0: Device attached [ 129.293349][ T5938] wg2 speed is unknown, defaulting to 1000 [ 129.318175][ T5947] SQUASHFS error: Failed to read block 0x0: -5 [ 129.319657][ T5938] wg2 speed is unknown, defaulting to 1000 [ 129.336891][ T5947] unable to read squashfs_super_block [ 129.354712][ T5938] wg2 speed is unknown, defaulting to 1000 [ 129.679686][ T5938] infiniband syz2: set active [ 129.684437][ T5938] infiniband syz2: added wg2 [ 129.773896][ T5938] smbdirect: ib_dev[syz2]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 129.773957][ T5938] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 129.774003][ T5938] smbdirect: ib_dev[syz2]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 129.883072][ T5938] RDS/IB: syz2: added [ 129.883486][ T5938] smc: adding ib device syz2 with port count 1 [ 129.883561][ T5938] smc: ib device syz2 port 1 has no pnetid [ 129.885406][ T5938] wg2 speed is unknown, defaulting to 1000 [ 129.894155][ T5902] usb 40-1: SetAddress Request (2) to port 0 [ 130.015158][ T29] wg2 speed is unknown, defaulting to 1000 [ 130.022121][ T5854] wg2 speed is unknown, defaulting to 1000 [ 130.061187][ T5899] Set syz1 is full, maxelem 65536 reached [ 130.662467][ T5938] wg2 speed is unknown, defaulting to 1000 [ 130.812517][ T5938] wg2 speed is unknown, defaulting to 1000 [ 131.030294][ T5938] wg2 speed is unknown, defaulting to 1000 [ 131.074022][ T5902] usb 40-1: new SuperSpeed USB device number 2 using vhci_hcd [ 132.970617][ T5944] vhci_hcd: connection reset by peer [ 133.007755][ T12] vhci_hcd vhci_hcd.1: stop threads [ 133.011509][ T12] vhci_hcd vhci_hcd.1: release socket [ 133.035144][ T12] vhci_hcd vhci_hcd.1: disconnect device [ 133.598143][ T5974] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(5) [ 133.612040][ T5974] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 133.669574][ T5974] vhci_hcd vhci_hcd.0: Device attached [ 133.776344][ T5868] usb 5-1: new full-speed USB device number 2 using dummy_hcd [ 134.033858][ T5868] usb 5-1: New USB device found, idVendor=134c, idProduct=0002, bcdDevice=ac.7e [ 134.157432][ T5868] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 10 [ 134.162826][ T5868] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 134.236972][ T5868] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 134.240748][ T5868] usb 5-1: Product: syz [ 134.242699][ T5868] usb 5-1: Manufacturer: syz [ 134.244781][ T5868] usb 5-1: SerialNumber: syz [ 134.489137][ T5868] usb 5-1: config 0 descriptor?? [ 134.509707][ T5868] hub 5-1:0.0: bad descriptor, ignoring hub [ 134.519247][ T5868] hub 5-1:0.0: probe with driver hub failed with error -5 [ 134.566006][ T5868] input: syz syz as /devices/platform/dummy_hcd.0/usb5/5-1/5-1:0.0/input/input5 [ 134.708064][ T1345] libceph: connect (1)[c::]:6789 error -101 [ 134.813922][ T1345] libceph: mon0 (1)[c::]:6789 connect error [ 135.048239][ T5970] ceph: No mds server is up or the cluster is laggy [ 135.250123][ T5868] libceph: connect (1)[c::]:6789 error -101 [ 135.252758][ T5868] libceph: mon0 (1)[c::]:6789 connect error [ 135.257249][ T5975] vhci_hcd: connection closed [ 135.262705][ T5549] vhci_hcd vhci_hcd.1: stop threads [ 135.337333][ T5549] vhci_hcd vhci_hcd.1: release socket [ 135.354188][ T5549] vhci_hcd vhci_hcd.1: disconnect device [ 135.763423][ T1345] libceph: connect (1)[c::]:6789 error -101 [ 135.766206][ T1345] libceph: mon0 (1)[c::]:6789 connect error [ 136.071888][ T5983] Zero length message leads to an empty skb [ 136.331927][ T5902] usb 40-1: device descriptor read/8, error -110 [ 136.729015][ T5998] comedi comedi0: Minor 3 could not be opened [ 136.879383][ T5902] usb usb40-port1: attempt power cycle [ 136.911233][ T5999] netlink: 32 bytes leftover after parsing attributes in process `syz.3.21'. [ 137.112899][ T5994] kvm: pic: non byte write [ 137.210994][ T5861] usb 5-1: USB disconnect, device number 2 [ 137.510300][ T6005] 9p: Bad value for 'rfdno' [ 137.661290][ T5902] usb usb40-port1: unable to enumerate USB device [ 140.427491][ T6033] wlan0 speed is unknown, defaulting to 1000 [ 141.588843][ T6033] wg2 speed is unknown, defaulting to 1000 [ 142.515024][ T6044] netlink: 20 bytes leftover after parsing attributes in process `syz.0.27'. [ 142.891984][ T6048] netlink: 'syz.0.27': attribute type 1 has an invalid length. [ 142.898266][ T6048] netlink: 24 bytes leftover after parsing attributes in process `syz.0.27'. [ 143.422758][ T6044] team0 (unregistering): Port device team_slave_0 removed [ 143.859997][ T6044] team0 (unregistering): Port device team_slave_1 removed [ 143.921496][ T1429] ieee802154 phy0 wpan0: encryption failed: -22 [ 143.926906][ T1429] ieee802154 phy1 wpan1: encryption failed: -22 [ 146.023224][ T6056] netlink: 20 bytes leftover after parsing attributes in process `syz.1.31'. [ 146.987391][ T6068] netlink: 'syz.3.33': attribute type 4 has an invalid length. [ 147.006930][ T6068] netlink: 17 bytes leftover after parsing attributes in process `syz.3.33'. [ 147.404585][ T6071] binder: 6070:6071 ioctl c00c6211 0 returned -14 [ 149.203245][ T5960] udevd[5960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 149.759176][ T6088] veth1_macvtap: left promiscuous mode [ 150.241523][ T6088] veth1_macvtap: entered promiscuous mode [ 151.682659][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 152.133098][ T6115] ehci-pci 0000:00:1d.7: remove, state 1 [ 152.136480][ T6115] usb usb2: USB disconnect, device number 1 [ 152.156158][ T6115] usb 2-1: USB disconnect, device number 2 [ 152.547982][ T6115] ehci-pci 0000:00:1d.7: USB bus 2 deregistered [ 152.998405][ T914] usb 1-1: new full-speed USB device number 2 using uhci_hcd [ 153.219503][ T914] usb 1-1: not running at top speed; connect to a high speed hub [ 153.223928][ T914] usb 1-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 153.299948][ T914] usb 1-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 153.314759][ T914] usb 1-1: Product: QEMU USB Tablet [ 153.321508][ T914] usb 1-1: Manufacturer: QEMU [ 153.336286][ T914] usb 1-1: SerialNumber: 28754-0000:00:1d.7-1 [ 153.654984][ T914] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.0/usb1/1-1/1-1:1.0/0003:0627:0001.0002/input/input7 [ 153.731746][ T6134] netlink: 10 bytes leftover after parsing attributes in process `syz.0.46'. [ 153.919525][ T914] hid-generic 0003:0627:0001.0002: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.0-1/input0 [ 154.035535][ T6117] usb 1-1: USB disconnect, device number 2 [ 154.284034][ T6130] netlink: 'syz.0.46': attribute type 2 has an invalid length. [ 154.291773][ T6130] netlink: 'syz.0.46': attribute type 2 has an invalid length. [ 154.366389][ T6139] fido_id[6139]: Failed to open report descriptor at '/sys/devices/pci0000:00/0000:00:1d.0/usb1/1-1/report_descriptor': No such file or directory [ 156.082154][ T6117] ehci-pci 0000:00:1d.7: EHCI Host Controller [ 156.263285][ T6117] ehci-pci 0000:00:1d.7: new USB bus registered, assigned bus number 2 [ 156.462009][ T6117] ehci-pci 0000:00:1d.7: irq 19, io mem 0xfeaf7000 [ 156.617795][ T6117] ehci-pci 0000:00:1d.7: USB 2.0 started, EHCI 1.00 [ 156.670054][ T6117] usb usb2: New USB device found, idVendor=1d6b, idProduct=0002, bcdDevice= 7.02 [ 156.873237][ T6117] usb usb2: New USB device strings: Mfr=3, Product=2, SerialNumber=1 [ 156.924161][ T6117] usb usb2: Product: EHCI Host Controller [ 156.938762][ T6117] usb usb2: Manufacturer: Linux syzkaller ehci_hcd [ 157.415276][ T6117] usb usb2: SerialNumber: 0000:00:1d.7 [ 157.766175][ T6170] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 158.234773][ T6117] hub 2-0:1.0: USB hub found [ 158.272811][ T6117] hub 2-0:1.0: 6 ports detected [ 159.109526][ T6179] bond1: entered promiscuous mode [ 159.248840][ T5861] usb 2-1: new high-speed USB device number 2 using ehci-pci [ 159.355283][ T6117] hub 1-0:1.0: USB hub found [ 159.539532][ T6117] hub 1-0:1.0: 2 ports detected [ 159.836725][ T5861] usb 2-1: New USB device found, idVendor=0627, idProduct=0001, bcdDevice= 0.00 [ 160.038160][ T5861] usb 2-1: New USB device strings: Mfr=1, Product=3, SerialNumber=10 [ 160.038267][ T5861] usb 2-1: Product: QEMU USB Tablet [ 160.038283][ T5861] usb 2-1: Manufacturer: QEMU [ 160.038298][ T5861] usb 2-1: SerialNumber: 28754-0000:00:1d.7-1 [ 160.110057][ T6117] hub 3-0:1.0: USB hub found [ 160.120381][ T6117] hub 3-0:1.0: 2 ports detected [ 160.619405][ T6117] hub 4-0:1.0: USB hub found [ 160.619910][ T6117] hub 4-0:1.0: 2 ports detected [ 160.989794][ T5861] input: QEMU QEMU USB Tablet as /devices/pci0000:00/0000:00:1d.7/usb2/2-1/2-1:1.0/0003:0627:0001.0003/input/input8 [ 161.276131][ T5861] hid-generic 0003:0627:0001.0003: input,hidraw0: USB HID v0.01 Mouse [QEMU QEMU USB Tablet] on usb-0000:00:1d.7-1/input0 [ 163.330108][ T6214] vhci_hcd vhci_hcd.0: pdev(3) rhport(0) sockfd(5) [ 163.330175][ T6214] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 163.362066][ T6214] vhci_hcd vhci_hcd.0: Device attached [ 163.587249][ T6224] mmap: syz.2.65 (6224) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 163.842964][ T29] usb 44-1: SetAddress Request (2) to port 0 [ 163.843025][ T29] usb 44-1: new SuperSpeed USB device number 2 using vhci_hcd [ 164.168594][ T6222] ======================================================= [ 164.168594][ T6222] WARNING: The mand mount option has been deprecated and [ 164.168594][ T6222] and is ignored by this kernel. Remove the mand [ 164.168594][ T6222] option from the mount to silence this warning. [ 164.168594][ T6222] ======================================================= [ 164.234134][ T6230] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7) [ 164.234168][ T6230] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 164.234264][ T6230] vhci_hcd vhci_hcd.0: Device attached [ 164.613494][ T5844] usb 38-1: SetAddress Request (2) to port 0 [ 164.613559][ T5844] usb 38-1: new SuperSpeed USB device number 2 using vhci_hcd [ 164.822597][ T0] NOHZ tick-stop error: local softirq work is pending, handler #80!!! [ 165.276757][ T6217] vhci_hcd: connection reset by peer [ 165.288871][ T12] vhci_hcd vhci_hcd.3: stop threads [ 165.293341][ T12] vhci_hcd vhci_hcd.3: release socket [ 165.299113][ T12] vhci_hcd vhci_hcd.3: disconnect device [ 165.406807][ T6234] rdma_rxe: rxe_newlink: failed to add wg2 [ 165.471339][ T6231] vhci_hcd: connection reset by peer [ 165.499240][ T12] vhci_hcd vhci_hcd.0: stop threads [ 165.502152][ T12] vhci_hcd vhci_hcd.0: release socket [ 165.505070][ T12] vhci_hcd vhci_hcd.0: disconnect device [ 168.922710][ T29] usb 44-1: device descriptor read/8, error -110 [ 171.044030][ T5844] usb 38-1: device descriptor read/8, error -110 [ 171.084875][ T29] usb usb44-port1: attempt power cycle [ 171.464609][ T6283] bridge0: port 2(bridge_slave_1) entered disabled state [ 171.471803][ T6283] bridge0: port 1(bridge_slave_0) entered disabled state [ 171.615471][ T5844] usb usb38-port1: attempt power cycle [ 171.833443][ T29] usb usb44-port1: unable to enumerate USB device [ 171.851488][ T6283] Console: switching to colour dummy device 80x25 [ 172.380050][ T5844] usb usb38-port1: unable to enumerate USB device [ 172.836283][ T6287] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 173.247647][ T6287] pci 0000:00:01.0: BAR 0 [mem 0xfd000000-0xfdffffff pref] [ 173.253915][ T6287] pci 0000:00:01.0: BAR 2 [mem 0xfeaf4000-0xfeaf4fff] [ 173.369835][ T6287] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 173.374811][ T6287] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 173.402743][ T6287] pci 0000:00:01.0: pci_fixup_video+0x0/0x280 took 27510 usecs [ 173.649698][ T6287] pci 0000:00:01.0: Adding to iommu group 1 [ 173.695602][ T6287] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 173.701246][ T6287] pci 0000:00:01.0: vgaarb: bridge control possible [ 173.710089][ T6287] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 173.787973][ T6287] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 173.824056][ T6287] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 173.861731][ T6287] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 173.883784][ T6287] [drm] Found bochs VGA, ID 0xb0c5. [ 173.889777][ T6287] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 174.073370][ T6287] bochs-drm 0000:00:01.0: probe with driver bochs-drm failed with error -4 [ 174.912522][ T6318] vhci_hcd vhci_hcd.0: pdev(2) rhport(0) sockfd(7) [ 174.924806][ T6318] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 174.978968][ T6318] vhci_hcd vhci_hcd.0: Device attached [ 175.284957][ T29] usb 42-1: SetAddress Request (2) to port 0 [ 175.285039][ T29] usb 42-1: new SuperSpeed USB device number 2 using vhci_hcd [ 175.687801][ T6318] rdma_rxe: rxe_newlink: failed to add wg2 [ 176.193006][ T6320] vhci_hcd: connection reset by peer [ 176.197639][ T5824] vhci_hcd vhci_hcd.2: stop threads [ 176.199829][ T5824] vhci_hcd vhci_hcd.2: release socket [ 176.204166][ T5824] vhci_hcd vhci_hcd.2: disconnect device [ 176.430108][ T6334] netlink: 8 bytes leftover after parsing attributes in process `syz.0.86'. [ 176.995459][ T6342] wlan0 speed is unknown, defaulting to 1000 [ 177.081500][ T6342] wg2 speed is unknown, defaulting to 1000 [ 177.758107][ T6349] netlink: 'syz.3.91': attribute type 1 has an invalid length. [ 177.772841][ T41] audit: type=1800 audit(1786469097.833:2): pid=6349 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.91" name="memory_backed" dev="configfs" ino=10092 res=0 errno=0 [ 177.807608][ T6349] netlink: 84 bytes leftover after parsing attributes in process `syz.3.91'. [ 177.819123][ T41] audit: type=1800 audit(1786469097.843:3): pid=6350 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.91" name="zoned" dev="configfs" ino=10093 res=0 errno=0 [ 177.843528][ T6349] netlink: 'syz.3.91': attribute type 2 has an invalid length. [ 177.864532][ T6349] netlink: 4 bytes leftover after parsing attributes in process `syz.3.91'. [ 177.924443][ T41] audit: type=1800 audit(1786469097.993:4): pid=6349 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.3.91" name="power" dev="configfs" ino=13556 res=0 errno=0 [ 178.028911][ T6349] null_blk: my_zoned_dev: using native zone append [ 178.462145][ T6349] null_blk: disk my_zoned_dev created [ 180.443359][ T29] usb 42-1: device descriptor read/8, error -110 [ 180.869686][ T29] usb usb42-port1: attempt power cycle [ 181.011183][ T6376] netlink: 4064 bytes leftover after parsing attributes in process `syz.2.98'. [ 181.283073][ T6369] mac80211_hwsim hwsim6 wlan0: entered promiscuous mode [ 181.473952][ T29] usb usb42-port1: unable to enumerate USB device [ 181.675430][ T6385] netlink: 20 bytes leftover after parsing attributes in process `syz.2.100'. [ 184.314988][ T5742] udevd[5742]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 184.399867][ T5960] udevd[5960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 184.621869][ T6405] rdma_rxe: rxe_newlink: failed to add bond_slave_1 [ 187.496494][ T6416] gadgetfs: bound to dummy_udc driver [ 187.991600][ T5868] usb 5-1: new full-speed USB device number 3 using dummy_hcd [ 188.028765][ C2] gadgetfs: connected [ 188.059895][ T5868] gadgetfs: disconnected [ 188.412711][ T6407] process 'syz.2.104' launched './file0' with NULL argv: empty string added [ 189.247989][ T41] audit: type=1326 audit(1786469109.323:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.0.108" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 193.279313][ T41] audit: type=1326 audit(1786469110.223:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=6419 comm="syz.0.108" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf700efec code=0x7ffc0000 [ 193.423451][ T6439] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 193.968960][ T6449] netlink: 20 bytes leftover after parsing attributes in process `syz.0.114'. [ 194.148522][ T6455] wlan0 speed is unknown, defaulting to 1000 [ 194.154168][ T6455] wg2 speed is unknown, defaulting to 1000 [ 195.205279][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 197.919367][ T6469] netlink: 'syz.1.119': attribute type 1 has an invalid length. [ 199.142158][ T6469] 8021q: adding VLAN 0 to HW filter on device bond1 [ 199.710934][ T5960] udevd[5960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 203.654619][ T6518] ./bus: Can't lookup blockdev [ 203.835272][ T6512] x_tables: duplicate underflow at hook 3 [ 205.324245][ T1429] ieee802154 phy0 wpan0: encryption failed: -22 [ 205.328349][ T1429] ieee802154 phy1 wpan1: encryption failed: -22 [ 206.952868][ T6530] BTRFS info: 'norecovery' is for compatibility only, recommended to use 'rescue=nologreplay' [ 207.123785][ T6530] netlink: 12 bytes leftover after parsing attributes in process `syz.1.133'. [ 207.393526][ T6538] netlink: 20 bytes leftover after parsing attributes in process `syz.2.135'. [ 207.501242][ T914] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 207.915797][ T914] usb 6-1: Using ep0 maxpacket: 32 [ 207.921708][ T914] usb 6-1: New USB device found, idVendor=03f0, idProduct=6c17, bcdDevice= 0.40 [ 208.046203][ T914] usb 6-1: config index 0 descriptor too short (expected 29220, got 36) [ 208.095877][ T914] usb 6-1: config 0 has too many interfaces: 81, using maximum allowed: 32 [ 208.113530][ T914] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 81 [ 208.155804][ T914] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 208.328243][ T914] usb 6-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 208.402536][ T914] usb 6-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 18 [ 208.411531][ T914] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 208.508149][ T5960] udevd[5960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 208.546198][ T914] usb 6-1: config 0 descriptor?? [ 208.580233][ T5960] udevd[5960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 208.676615][ T6551] input: syz0 as /devices/virtual/input/input9 [ 209.315496][ T914] usblp 6-1:0.0: usblp0: USB Bidirectional printer dev 2 if 0 alt 0 proto 3 vid 0x03F0 pid 0x6C17 [ 210.038252][ T5868] usb 6-1: USB disconnect, device number 2 [ 210.094362][ T5868] usblp0: removed [ 210.122786][ T6562] netlink: 12 bytes leftover after parsing attributes in process `syz.2.138'. [ 210.131251][ T6562] vlan0: entered promiscuous mode [ 210.284182][ T5751] Bluetooth: hci3: command 0x0405 tx timeout [ 213.122464][ T0] NOHZ tick-stop error: local softirq work is pending, handler #82!!! [ 214.331065][ T5868] IPVS: starting estimator thread 0... [ 214.365789][ T6585] netlink: 8 bytes leftover after parsing attributes in process `syz.3.146'. [ 214.447813][ T6588] wlan0 speed is unknown, defaulting to 1000 [ 214.451839][ T6588] wg2 speed is unknown, defaulting to 1000 [ 214.456255][ T6586] IPVS: using max 32 ests per chain, 76800 per kthread [ 216.230331][ T41] audit: type=1800 audit(1786469136.263:7): pid=6605 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.150" name="file0" dev="overlay" ino=225 res=0 errno=0 [ 218.776804][ T50] usb 7-1: new high-speed USB device number 2 using dummy_hcd [ 219.124513][ T50] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 219.137701][ T50] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 219.148280][ T50] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 219.160365][ T50] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 219.203747][ T6610] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 219.301205][ T50] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 221.703800][ T6633] netlink: 8 bytes leftover after parsing attributes in process `syz.3.156'. [ 222.174112][ T34] usb 7-1: USB disconnect, device number 2 [ 223.054563][ T6642] netlink: 20 bytes leftover after parsing attributes in process `syz.0.160'. [ 224.984154][ T1473] usb 8-1: new high-speed USB device number 2 using dummy_hcd [ 225.603671][ T1473] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 226.000009][ T1473] usb 8-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 226.064911][ T1473] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 226.099767][ T1473] usb 8-1: Product: syz [ 226.103106][ T1473] usb 8-1: Manufacturer: syz [ 226.106233][ T1473] usb 8-1: SerialNumber: syz [ 226.437198][ T1473] usblp 8-1:1.0: usblp0: USB Unidirectional printer dev 2 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 226.567921][ T5960] udevd[5960]: inotify_add_watch(7, /dev/nbd64, 10) failed: No such file or directory [ 227.049138][ T6670] netlink: 8 bytes leftover after parsing attributes in process `syz.3.166'. [ 227.287689][ T1473] usb 8-1: USB disconnect, device number 2 [ 227.300994][ T1473] usblp0: removed [ 227.598109][ T6677] vhci_hcd vhci_hcd.0: remove, state 4 [ 227.628126][ T6677] usb usb38: USB disconnect, device number 1 [ 229.996631][ T6680] capability: warning: `syz.3.170' uses deprecated v2 capabilities in a way that may be insecure [ 230.403270][ T6677] vhci_hcd vhci_hcd.0: USB bus 38 deregistered [ 230.411712][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.420228][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.424754][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.429423][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.433651][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.437503][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.441739][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.448903][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.457477][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.464571][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.469310][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.472296][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.475755][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.477746][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.479958][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.483373][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.488862][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.492311][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.495792][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.500427][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.504417][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.678211][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 230.689204][ T5824] vhci_hcd vhci_hcd.0: release socket [ 230.768445][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 230.871985][ T6677] vhci_hcd vhci_hcd.0: remove, state 4 [ 230.874639][ T6677] usb usb37: USB disconnect, device number 1 [ 230.996719][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 231.019049][ T5824] vhci_hcd vhci_hcd.0: release socket [ 231.021666][ T6677] vhci_hcd vhci_hcd.0: USB bus 37 deregistered [ 231.024968][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 231.029873][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 231.070554][ T6687] x_tables: (null)_tables: cgroup match: used from hooks PREROUTING, but only valid from INPUT/OUTPUT/POSTROUTING [ 231.192505][ T5824] vhci_hcd vhci_hcd.0: release socket [ 231.201350][ T5824] vhci_hcd vhci_hcd.0: disconnect device [ 231.215564][ T5824] vhci_hcd vhci_hcd.0: stop threads [ 231.218063][ T5824] vhci_hcd vhci_hcd.0: release socket [ 231.264447][ T5824] ================================================================== [ 231.268026][ T5824] BUG: KASAN: slab-use-after-free in vhci_cleanup_unlink_list+0x44/0x456 [ 231.285228][ T5824] Read of size 4 at addr ffff888021ba88f0 by task kworker/u32:3/5824 [ 231.307604][ T5824] [ 231.309283][ T5824] CPU: 0 UID: 0 PID: 5824 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) [ 231.309310][ T5824] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 231.309363][ T5824] Workqueue: usbip_event event_handler [ 231.309571][ T5824] Call Trace: [ 231.309580][ T5824] [ 231.309588][ T5824] dump_stack_lvl+0x100/0x190 [ 231.309702][ T5824] print_report+0x13d/0x4b0 [ 231.309727][ T5824] ? __virt_addr_valid+0x239/0x430 [ 231.309840][ T5824] ? vhci_cleanup_unlink_list+0x44/0x456 [ 231.309863][ T5824] kasan_report+0xdf/0x1c0 [ 231.309983][ T5824] ? vhci_cleanup_unlink_list+0x44/0x456 [ 231.310010][ T5824] vhci_cleanup_unlink_list+0x44/0x456 [ 231.310070][ T5824] vhci_shutdown_connection.cold+0x165/0x37c [ 231.310136][ T5824] event_handler+0x216/0x570 [ 231.310156][ T5824] process_one_work+0xa23/0x1940 [ 231.310184][ T5824] ? __pfx_process_one_work+0x10/0x10 [ 231.310244][ T5824] ? __pfx_event_handler+0x10/0x10 [ 231.310299][ T5824] worker_thread+0x5ef/0xe50 [ 231.310323][ T5824] ? __pfx_worker_thread+0x10/0x10 [ 231.310379][ T5824] ? kthread+0x13a/0x450 [ 231.310403][ T5824] ? __pfx_worker_thread+0x10/0x10 [ 231.310426][ T5824] kthread+0x370/0x450 [ 231.310447][ T5824] ? __pfx_kthread+0x10/0x10 [ 231.310468][ T5824] ret_from_fork+0x72b/0xd50 [ 231.310491][ T5824] ? __pfx_ret_from_fork+0x10/0x10 [ 231.310512][ T5824] ? __switch_to+0x800/0x10f0 [ 231.310565][ T5824] ? __pfx_kthread+0x10/0x10 [ 231.310688][ T5824] ret_from_fork_asm+0x1a/0x30 [ 231.310927][ T5824] [ 231.310936][ T5824] [ 231.473697][ T5824] Allocated by task 1: [ 231.475660][ T5824] kasan_save_stack+0x30/0x50 [ 231.478487][ T5824] kasan_save_track+0x14/0x30 [ 231.483341][ T5824] __kasan_kmalloc+0xaa/0xb0 [ 231.485854][ T5824] __kmalloc_noprof+0x322/0x820 [ 231.488496][ T5824] __usb_create_hcd+0x5e/0xac0 [ 231.490758][ T5824] vhci_hcd_probe+0xf3/0x4e0 [ 231.493438][ T5824] platform_probe+0x106/0x1d0 [ 231.496538][ T5824] really_probe+0x241/0xa60 [ 231.499143][ T5824] __driver_probe_device+0x20e/0x450 [ 231.503300][ T5824] driver_probe_device+0x4a/0x140 [ 231.506278][ T5824] __device_attach_driver+0x1df/0x320 [ 231.509357][ T5824] bus_for_each_drv+0x159/0x1e0 [ 231.512117][ T5824] __device_attach+0x1e4/0x4d0 [ 231.516924][ T5824] device_initial_probe+0xaf/0xd0 [ 231.520741][ T5824] bus_probe_device+0x64/0x160 [ 231.534400][ T5824] device_add+0x121d/0x1970 [ 231.538331][ T5824] platform_device_add+0x35a/0x800 [ 231.543469][ T5824] platform_device_register_full+0x5cf/0x830 [ 231.550384][ T5824] vhci_hcd_init+0x1a1/0x2f0 [ 231.559980][ T5824] do_one_initcall+0x11d/0x700 [ 231.565650][ T5824] kernel_init_freeable+0x6ea/0x7b0 [ 231.568368][ T5824] kernel_init+0x1f/0x1e0 [ 231.573449][ T5824] ret_from_fork+0x72b/0xd50 [ 231.584722][ T5824] ret_from_fork_asm+0x1a/0x30 [ 231.589101][ T5824] [ 231.605051][ T5824] Freed by task 6677: [ 231.606704][ T5824] kasan_save_stack+0x30/0x50 [ 231.615613][ T5824] kasan_save_track+0x14/0x30 [ 231.623167][ T5824] kasan_save_free_info+0x3b/0x70 [ 231.635497][ T5824] __kasan_slab_free+0x5f/0x80 [ 231.642747][ T5824] kfree+0x22b/0x6c0 [ 231.644695][ T5824] usb_put_hcd+0x149/0x1f0 [ 231.654830][ T5824] vhci_hcd_remove+0x107/0x1b0 [ 231.665311][ T5824] platform_remove+0x5f/0x80 [ 231.670989][ T5824] device_remove+0xcb/0x180 [ 231.680973][ T5824] device_release_driver_internal+0x44e/0x620 [ 231.686343][ T5824] unbind_store+0xf8/0x110 [ 231.689265][ T5824] drv_attr_store+0x74/0xb0 [ 231.698001][ T5824] sysfs_kf_write+0xf2/0x150 [ 231.714927][ T5824] kernfs_fop_write_iter+0x3e0/0x5f0 [ 231.718471][ T5824] vfs_write+0x6ac/0x1050 [ 231.726933][ T5824] ksys_write+0x12a/0x250 [ 231.733020][ T5824] __do_fast_syscall_32+0xe7/0x970 [ 231.737667][ T5824] do_fast_syscall_32+0x32/0x70 [ 231.745557][ T5824] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 231.762611][ T5824] [ 231.763470][ T5824] Last potentially related work creation: [ 231.773464][ T5824] kasan_save_stack+0x30/0x50 [ 231.775364][ T5824] kasan_record_aux_stack+0xa7/0xc0 [ 231.779384][ T5824] insert_work+0x36/0x230 [ 231.785933][ T5824] __queue_work+0x9bc/0x12b0 [ 231.789369][ T5824] queue_work_on+0x1a9/0x1e0 [ 231.798531][ T5824] usb_hcd_giveback_urb+0x330/0x4a0 [ 231.805907][ T5824] unlink1+0x418/0x510 [ 231.822222][ T5824] usb_hcd_unlink_urb+0x131/0x210 [ 231.831609][ T5824] usb_kill_urb+0x121/0x320 [ 231.845216][ T5824] hub_quiesce+0x1e9/0x320 [ 231.847266][ T5824] hub_suspend+0x4ab/0x9e0 [ 231.849170][ T5824] usb_suspend_both+0x288/0x950 [ 231.851054][ T5824] usb_runtime_suspend+0x49/0x120 [ 231.853396][ T5824] __rpm_callback+0xc8/0x620 [ 231.855453][ T5824] rpm_callback+0x16a/0x1b0 [ 231.858117][ T5824] rpm_suspend+0x2f4/0x11a0 [ 231.872888][ T5824] __pm_runtime_suspend+0xba/0x1a0 [ 231.875639][ T5824] usb_new_device.part.0+0x1653/0x1686 [ 231.880702][ T5824] register_root_hub+0x4e6/0x639 [ 231.885129][ T5824] usb_add_hcd.cold+0xccd/0x1158 [ 231.887339][ T5824] vhci_hcd_probe+0x14b/0x4e0 [ 231.911605][ T5824] platform_probe+0x106/0x1d0 [ 231.919928][ T5824] really_probe+0x241/0xa60 [ 231.921759][ T5824] __driver_probe_device+0x20e/0x450 [ 231.924105][ T5824] driver_probe_device+0x4a/0x140 [ 231.926468][ T5824] __device_attach_driver+0x1df/0x320 [ 231.944812][ T5824] bus_for_each_drv+0x159/0x1e0 [ 231.949029][ T5824] __device_attach+0x1e4/0x4d0 [ 231.952286][ T5824] device_initial_probe+0xaf/0xd0 [ 231.956785][ T5824] bus_probe_device+0x64/0x160 [ 231.962138][ T5824] device_add+0x121d/0x1970 [ 231.968431][ T5824] platform_device_add+0x35a/0x800 [ 231.977176][ T5824] platform_device_register_full+0x5cf/0x830 [ 231.985104][ T5824] vhci_hcd_init+0x1a1/0x2f0 [ 232.005493][ T5824] do_one_initcall+0x11d/0x700 [ 232.008571][ T5824] kernel_init_freeable+0x6ea/0x7b0 [ 232.014915][ T5824] kernel_init+0x1f/0x1e0 [ 232.022957][ T5824] ret_from_fork+0x72b/0xd50 [ 232.024866][ T5824] ret_from_fork_asm+0x1a/0x30 [ 232.034791][ T5824] [ 232.038812][ T5824] Second to last potentially related work creation: [ 232.046309][ T5824] kasan_save_stack+0x30/0x50 [ 232.052130][ T5824] kasan_record_aux_stack+0xa7/0xc0 [ 232.065219][ T5824] insert_work+0x36/0x230 [ 232.069048][ T5824] __queue_work+0x9bc/0x12b0 [ 232.073953][ T5824] queue_work_on+0x1a9/0x1e0 [ 232.077097][ T5824] usb_hcd_giveback_urb+0x3b8/0x4a0 [ 232.087743][ T5824] usb_hcd_submit_urb+0xab7/0x2150 [ 232.093607][ T5824] usb_submit_urb+0x827/0x19b0 [ 232.100117][ T5824] usb_start_wait_urb+0x10e/0x580 [ 232.106718][ T5824] usb_control_msg+0x328/0x4b0 [ 232.113440][ T5824] hub_ext_port_status+0x152/0x600 [ 232.121667][ T5824] hub_activate+0x6e5/0x1c40 [ 232.128541][ T5824] process_one_work+0xa23/0x1940 [ 232.133853][ T5824] worker_thread+0x5ef/0xe50 [ 232.137748][ T5824] kthread+0x370/0x450 [ 232.140767][ T5824] ret_from_fork+0x72b/0xd50 [ 232.146344][ T5824] ret_from_fork_asm+0x1a/0x30 [ 232.163264][ T5824] [ 232.164187][ T5824] The buggy address belongs to the object at ffff888021ba8000 [ 232.164187][ T5824] which belongs to the cache kmalloc-8k of size 8192 [ 232.172064][ T5824] The buggy address is located 2288 bytes inside of [ 232.172064][ T5824] freed 8192-byte region [ffff888021ba8000, ffff888021baa000) [ 232.184944][ T5824] [ 232.186275][ T5824] The buggy address belongs to the physical page: [ 232.191864][ T5824] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x21ba8 [ 232.198656][ T5824] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0 [ 232.205496][ T5824] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff) [ 232.208301][ T5824] page_type: f5(slab) [ 232.210676][ T5824] raw: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122 [ 232.214538][ T5824] raw: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 232.220145][ T5824] head: 00fff00000000040 ffff88801bc43180 dead000000000100 dead000000000122 [ 232.226191][ T5824] head: 0000000000000000 0000000800020002 00000000f5000000 0000000000000000 [ 232.232263][ T5824] head: 00fff00000000003 fffffffffffffe01 00000000ffffffff 00000000ffffffff [ 232.237872][ T5824] head: ffffffffffffffff 0000000000000000 00000000ffffffff 0000000000000008 [ 232.243357][ T5824] page dumped because: kasan: bad access detected [ 232.246861][ T5824] page_owner tracks the page as allocated [ 232.250039][ T5824] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd20c0(__GFP_IO|__GFP_FS|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 1, tgid 1 (swapper/0), ts 8129172729, free_ts 0 [ 232.262716][ T5824] post_alloc_hook+0xfd/0x120 [ 232.265757][ T5824] get_page_from_freelist+0xf48/0x3530 [ 232.269066][ T5824] __alloc_frozen_pages_noprof+0x299/0x2dc0 [ 232.272250][ T5824] new_slab+0xa2/0x640 [ 232.274934][ T5824] refill_objects+0xe3/0x410 [ 232.278013][ T5824] __pcs_replace_empty_main+0x376/0x680 [ 232.282022][ T5824] __kmalloc_cache_noprof+0x479/0x6c0 [ 232.285889][ T5824] mr_table_alloc+0x61/0x3e0 [ 232.288352][ T5824] ipmr_net_init+0x41c/0x5e0 [ 232.290833][ T5824] ops_init+0x1e2/0x5f0 [ 232.293158][ T5824] register_pernet_operations+0x3cb/0x740 [ 232.297035][ T5824] register_pernet_subsys+0x28/0x40 [ 232.300877][ T5824] ip_mr_init+0x5f/0x150 [ 232.304190][ T5824] inet_init+0x4e6/0x640 [ 232.306470][ T5824] do_one_initcall+0x11d/0x700 [ 232.309109][ T5824] kernel_init_freeable+0x6ea/0x7b0 [ 232.311852][ T5824] page_owner free stack trace missing [ 232.315653][ T5824] [ 232.317940][ T5824] Memory state around the buggy address: [ 232.322366][ T5824] ffff888021ba8780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.326593][ T5824] ffff888021ba8800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.330742][ T5824] >ffff888021ba8880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.336392][ T5824] ^ [ 232.342131][ T5824] ffff888021ba8900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.346468][ T5824] ffff888021ba8980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb [ 232.350876][ T5824] ================================================================== [ 232.468993][ T5824] Kernel panic - not syncing: KASAN: panic_on_warn set ... [ 232.477896][ T5824] CPU: 0 UID: 0 PID: 5824 Comm: kworker/u32:3 Not tainted syzkaller #0 PREEMPT(full) [ 232.482506][ T5824] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 232.486426][ T5824] Workqueue: usbip_event event_handler [ 232.520468][ T5824] Call Trace: [ 232.521903][ T5824] [ 232.523129][ T5824] dump_stack_lvl+0x100/0x190 [ 232.525157][ T5824] vpanic+0x552/0x970 [ 232.526785][ T5824] ? __pfx_vpanic+0x10/0x10 [ 232.528588][ T5824] ? vhci_cleanup_unlink_list+0x44/0x456 [ 232.541128][ T5824] panic+0xd1/0xe0 [ 232.542708][ T5824] ? __pfx_panic+0x10/0x10 [ 232.544419][ T5824] ? vhci_cleanup_unlink_list+0x44/0x456 [ 232.546546][ T5824] ? preempt_schedule_common+0x42/0xc0 [ 232.549018][ T5824] ? check_panic_on_warn+0x1f/0x90 [ 232.553503][ T5824] check_panic_on_warn.cold+0x19/0x34 [ 232.564110][ T5824] end_report.part.0+0x3a/0x90 [ 232.566342][ T5824] kasan_report.cold+0xe/0x18 [ 232.568472][ T5824] ? vhci_cleanup_unlink_list+0x44/0x456 [ 232.571693][ T5824] vhci_cleanup_unlink_list+0x44/0x456 [ 232.589448][ T5824] vhci_shutdown_connection.cold+0x165/0x37c [ 232.592717][ T5824] event_handler+0x216/0x570 [ 232.595468][ T5824] process_one_work+0xa23/0x1940 [ 232.604478][ T5824] ? __pfx_process_one_work+0x10/0x10 [ 232.608016][ T5824] ? __pfx_event_handler+0x10/0x10 [ 232.612927][ T5824] worker_thread+0x5ef/0xe50 [ 232.622266][ T5824] ? __pfx_worker_thread+0x10/0x10 [ 232.624779][ T5824] ? kthread+0x13a/0x450 [ 232.626653][ T5824] ? __pfx_worker_thread+0x10/0x10 [ 232.628798][ T5824] kthread+0x370/0x450 [ 232.639478][ T5824] ? __pfx_kthread+0x10/0x10 [ 232.641960][ T5824] ret_from_fork+0x72b/0xd50 [ 232.644464][ T5824] ? __pfx_ret_from_fork+0x10/0x10 [ 232.648030][ T5824] ? __switch_to+0x800/0x10f0 [ 232.650903][ T5824] ? __pfx_kthread+0x10/0x10 [ 232.655652][ T5824] ret_from_fork_asm+0x1a/0x30 [ 232.659350][ T5824] [ 232.662275][ T5824] Kernel Offset: disabled [ 232.664368][ T5824] Rebooting in 86400 seconds.. VM DIAGNOSIS: 17:25:52 Registers: info registers vcpu 0 CPU#0 RAX=0000000000000054 RBX=00000000000003f8 RCX=0000000000000000 RDX=00000000000003f8 RSI=ffffffff85a0f545 RDI=ffffffff9b9e3520 RBP=ffffffff9b9e34e0 RSP=ffffc900067df560 R8 =0000000000000001 R9 =000000000000001f R10=0000000000000000 R11=6231323038386552 R12=0000000000000000 R13=0000000000000054 R14=ffffffff9b6e31f0 R15=ffffffff85a0f4e0 RIP=ffffffff85a0f56f RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096bf3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000003000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe0000001000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=000000008001c018 CR3=000000004c151000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000f000000000 0000000300000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 1 CPU#1 RAX=00000000000ed31f RBX=ffff88801c742540 RCX=ffffffff8bb82335 RDX=0000000000000000 RSI=ffffffff8e1a2c56 RDI=ffffffff8c3fe580 RBP=ffffed10038e84a8 RSP=ffffc9000046fe00 R8 =0000000000000001 R9 =ffffed100566678d R10=ffff88802b333c6b R11=0000000000000000 R12=0000000000000000 R13=0000000000000000 R14=1ffff9200008dfc4 R15=dffffc0000000000 RIP=ffffffff8bb808ff RFL=00000202 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=1 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096cf3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe000004a000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe0000048000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=0000000034213ff8 CR3=000000004c151000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000002 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 000000f000000000 0000000300000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 2 CPU#2 RAX=dffffc0000000000 RBX=ffff88802b433c68 RCX=0000000000000001 RDX=1ffffffff1c8cd26 RSI=ffffffff8c3fe500 RDI=ffffffff8e466930 RBP=0000000000000002 RSP=ffffc9000052f8b0 R8 =0000000000000001 R9 =0000000000000000 R10=0000000000000000 R11=0000000000000000 R12=ffff88802b4245c0 R13=0000000000000000 R14=0000000000000002 R15=0000000000000000 RIP=ffffffff81edeed5 RFL=00000083 [--S---C] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =0000 0000000000000000 ffffffff 00c00000 CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0018 0000000000000000 ffffffff 00c09300 DPL=0 DS [-WA] DS =0000 0000000000000000 ffffffff 00c00000 FS =0000 0000000000000000 ffffffff 00c00000 GS =0000 ffff888096df3000 ffffffff 00c00000 LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe0000091000 00000067 00008b00 DPL=0 TSS64-busy GDT= fffffe000008f000 0000007f IDT= fffffe0000000000 0000ffff CR0=80050033 CR2=0000000080001000 CR3=0000000013e2f000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 2323232323232323 2323232323232323 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ffffffffffffffff ffffffffffffff00 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 info registers vcpu 3 CPU#3 RAX=0000000000000001 RBX=ffff88802b43b648 RCX=0000000000000100 RDX=0000000000000001 RSI=0000000000000002 RDI=ffff88802b43b64a RBP=dffffc0000000000 RSP=ffffc900005e8b28 R8 =0000000000000001 R9 =ffffed10056876c9 R10=ffff88802b43b64b R11=0000000000000000 R12=0000000000001fc8 R13=ffffed10056876c9 R14=ffff88802b53c600 R15=0000000000000000 RIP=ffffffff8bbb2074 RFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0 ES =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] CS =0010 0000000000000000 ffffffff 00a09b00 DPL=0 CS64 [-RA] SS =0000 0000000000000000 ffffffff 00c00000 DS =002b 0000000000000000 ffffffff 00c0f300 DPL=3 DS [-WA] FS =0000 0000000000000000 ffffffff 00c00000 GS =0063 ffff888096ef3000 ffffffff 00d0f300 DPL=3 DS [-WA] LDT=0000 0000000000000000 ffffffff 00c00000 TR =0040 fffffe00000d8000 00004087 00008b00 DPL=0 TSS64-busy GDT= fffffe00000d6000 0000007f IDT= fffffe0000000000 00000fff CR0=80050033 CR2=00000000f71c8b50 CR3=0000000013e2f000 CR4=00352ef0 DR0=0000000000000000 DR1=0000000000000000 DR2=0000000000000000 DR3=0000000000000000 DR6=00000000ffff0ff0 DR7=0000000000000400 EFER=0000000000000d01 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000 Opmask00=0000000000000000 Opmask01=0000000000000000 Opmask02=0000000000000000 Opmask03=0000000000000000 Opmask04=0000000000000000 Opmask05=0000000000000000 Opmask06=0000000000000000 Opmask07=0000000000000000 ZMM00=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM01=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000052 ZMM02=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM03=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM04=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM05=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM06=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM07=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM08=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM09=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM10=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM11=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM12=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM13=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM14=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM15=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM16=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM17=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM18=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM19=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM20=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM21=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM22=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM23=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM24=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM25=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM26=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM27=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM28=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM29=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM30=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 ZMM31=0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000 0000000000000000