last executing test programs: 3.047145209s ago: executing program 3 (id=4): r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000140)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_PEER_MEASUREMENT_START(r0, &(0x7f00000027c0)={0x0, 0x0, &(0x7f0000002780)={&(0x7f0000002940)={0x7f8, 0x0, 0x800, 0x70bd29, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r1}, @void}}, [@NL80211_ATTR_PEER_MEASUREMENTS={0x7dc, 0x111, 0x0, 0x1, {0x7d8, 0x5, 0x0, 0x1, [{0x284, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x164, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0xb0, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xe0}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x94, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x44, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1b}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8000}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_REQ={0x54, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_DATA={0x50, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xf8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_REQ={0xc8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x60, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xa}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x4dd}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xc}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x13}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x2}]}]}]}]}, {0x388, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}, @NL80211_PMSR_PEER_ATTR_REQ={0x2a0, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x64, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}]}, @NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7f}]}, @NL80211_PMSR_TYPE_FTM={0x24, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x9c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x400}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xa0}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xfa}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xf}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x78, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x40, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xc}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x34, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x10c, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x547}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x30, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xff}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x8}, @NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x7}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x10}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x4}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @broadcast}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}, @NL80211_PMSR_PEER_ATTR_REQ={0xb4, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x98, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x20, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xd}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0xfe00}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x17}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xd}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x9}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa, 0x1, @device_b}]}, {0x18c, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x17c, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0xb8, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x8001}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xa}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xd}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x16}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xff}]}, @NL80211_PMSR_TYPE_FTM={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_FTMR_RETRIES={0x5, 0x7, 0xc}]}, @NL80211_PMSR_TYPE_FTM={0x28, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x1f}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xb}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x1c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x6}, @NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0xd}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x38, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x8, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_TRIGGER_BASED={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x2c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_LMR_FEEDBACK={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x100}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x5}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x9}, @NL80211_PMSR_FTM_REQ_ATTR_ASAP={0x4}]}]}, @NL80211_PMSR_REQ_ATTR_DATA={0x58, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x18, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_FTMS_PER_BURST={0x5, 0x6, 0x19}, @NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_LCI={0x4}]}, @NL80211_PMSR_TYPE_FTM={0x3c, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_PREAMBLE={0x8, 0x2, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0xe}, @NL80211_PMSR_FTM_REQ_ATTR_REQUEST_CIVICLOC={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}, @NL80211_PMSR_FTM_REQ_ATTR_NUM_BURSTS_EXP={0x5, 0x3, 0x2}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x4}, @NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0xa}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0xc, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_PERIOD={0x6, 0x4, 0x1}]}]}, @NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}, @NL80211_PMSR_REQ_ATTR_DATA={0x14, 0x1, 0x0, 0x1, [@NL80211_PMSR_TYPE_FTM={0x10, 0x1, 0x0, 0x1, [@NL80211_PMSR_FTM_REQ_ATTR_BURST_DURATION={0x5, 0x5, 0x3}, @NL80211_PMSR_FTM_REQ_ATTR_NON_TRIGGER_BASED={0x4}]}]}]}, @NL80211_PMSR_PEER_ATTR_ADDR={0xa}]}, {0x38, 0x0, 0x0, 0x1, [@NL80211_PMSR_PEER_ATTR_REQ={0x8, 0x3, 0x0, 0x1, [@NL80211_PMSR_REQ_ATTR_GET_AP_TSF={0x4}]}, @NL80211_PMSR_PEER_ATTR_CHAN={0x2c, 0x2, 0x0, 0x1, [@NL80211_ATTR_WIPHY_EDMG_CHANNELS={0x5, 0x118, 0x24}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3ff}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x3}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffff7}]}]}, {0x4}]}}]}, 0x7f8}, 0x1, 0x0, 0x0, 0x818}, 0x4000000) r2 = syz_genetlink_get_family_id$mptcp(&(0x7f0000002840), r0) sendmsg$MPTCP_PM_CMD_SET_LIMITS(r0, &(0x7f0000002900)={&(0x7f0000002800)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f00000028c0)={&(0x7f0000002880)={0x14, r2, 0x400, 0x70bd25, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x4041005}, 0x4000) openat$nsim_port_qreset(0xffffffffffffff9c, &(0x7f0000000040)={'/sys/kernel/debug/netdevsim/netdevsim', 0x0, '/ports/', 0x31}, 0x1, 0x0) setns(0xc9, 0x0) socket$nl_generic(0x10, 0x3, 0x10) pipe2(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80000) write$tun(r4, &(0x7f0000000080)={@val={0x0, 0x88e5}, @void, @eth={@remote, @empty, @void, {@mpls_uc={0x8847, {[{0xffffb, 0x0, 0x1}, {0x0, 0x0, 0x1}, {0x0, 0x0, 0x1}], @ipv6=@gre_packet={0x6, 0x6, "e943ff", 0x44, 0x2f, 0x1, @mcast1, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, {[], {{}, {0x1, 0x0, 0x1, 0x1}, {0x1}, {0x8, 0x88be, 0x4, {{0x1, 0x1, 0xe, 0x1, 0x0, 0x1, 0x1, 0x4}, 0x1, {0xffffffff}}}, {0x8, 0x22eb, 0x0, {{0x3, 0x2, 0x7, 0x2, 0x0, 0x2, 0x3, 0x63}, 0x2, {0x715, 0x1, 0x2, 0x13, 0x0, 0x0, 0x2, 0x0, 0x1}}}}}}}}}}}, 0x8a) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000003140)="de98ee653502c564abeb97fc678bde22efebcf99c2d89952950acc703a3c6268a54c8b1bd1ee165c82980cd315b55a070dc41deeb2d4c1842d936a0bcde5fd7ed6031fdd9cb58ebfe8261528f097f309813b5722c24a1af8e6bc6ddaef7e85d2659690154bc5e6ee73c3fe7176509ad7b30e1098fc9873db91d3c1816825e710374de8d40693578b598922d9c523cfff93a630f121251d17ad40bce021d7fd57945fe2a186618a40b5f3995a9f0ceaa3e22b57e4f68e53fffeb5474fb83afaf5cde6b0aaf5cf0313ede442ddf1df6c280921e43d80dddfd005969272e1719b37fd8f749fcde83f8201826b4cf5b1c1da394568aa7d8833dd11309f46422b0152ede5ab29b17bc1ae80147346155b20a98d6fc2650bec3fe73327c45cad1b38f7c983cd070556a8f8ed5d58e1052f6436fad905099d18fb3e62c2c36a1c2209a94c820e30e5234e77be3beb4cd183015d281e7bf39cdcf0f1e541211c75d64a49b55ba4c2c444bef36d98df66bea814bab91ed65386d6a491a6295c24dbaf752a5e7a856e0dfe46a6f9e718ca3919c6f8978b0fd65c9e389114e5afd8e9e2a575b854463b63f46d08795f0f1d0d48d6d610fd74e9238de32ee3fa2ffef550336341803c083ac1d749be6c5440bbe4bd3bc3015bcde2b4e2160ba266d281a9641f74d9348fb6fa8550d1e8a8362999452e40b75c412cfa77ab8e1aaf1a9e83c855ec9b7ada38690f0d2e59f67a1f3babbcda8011595ea720816c24726b833beaca0a9d11e7b99373601d27d18c9e29940503d3a12149fdc4fe0065c3d023d6e7712eb853df19f2b4b886e08d61629288ff16c2597d7fae5bfc8b41f92fc325ffe0f61683b1f661409bdd7c3d88a854f8393484f4669b5d9654fd3a0819a32110b9064539a7419c332629b3fc71da35b783ef7c693842ce83733a63f2e6af37989cfcb768ab8cea5d21b82a0e9f6fdcec26b0107708867dec54c4e739fe9b931b3c6da013bfae097c57f1e16ba54f9028e672511938a0ad9d681d7feebc65a2f5f588abd66261393f3ba02d7b2cf650a9f7c6a4ca55b4d41132908dc9c90e26f0da8e2259e3a2b63b2d9e27754e278827ab80438070698c690ec375a9aeb4193079a28a2a062961ba0e65af01644af063f3ebefda92c4986379f7b099b2fd3960929578736f09887fc5816cb1b982e5b121b79662d1674dd0c6e82627cf8c63e576e5c1eb0af9415ddc10ff880e8ae3ce8c4fb87b8f9d364974c2a1d8eba4e04bc2bc018bfabc435683b2551c0e4908570b930c4fd7c03ddb95e9ec1d1994e3df0305fdac4e5b914641ae25b0c469b194c0bb78ab04887cdc4262da468475b926a18254d23b4c44705aeca34ef8a7b04dd55a43f39996529a23804e054655c5ba8661f7c02737e7539650364928d62b9b8d80988232009acb54214f06640e9bc6614c0ce02e4a22dc8b91a0aad711e4fd01d7020b7c7185e41e27ce266b9f5aec682cbd4bba3240d6277b17b564937254f37afe580cba0b78c6b0cc81830eaf10d7cc1f7e918d49e935629fe6c24b4368a04af1b99f6981340ee031874f3d4b3a9ebc31719b3b775bfe1fdfa0460a3820bff6f61b49b11ac2ca00836a0c4a74aed92a619f34231196669b942e761538e64f965d23d4f7814256e876263fe5307985c4e6eb69c974f66276764e80ab1de3f5c55e7b2cfdb78dd183a85473e968918ad73f29a266c818b9bf9f62eed86df25b2577bb6d98e3996e94f5bdf119b869541a94eb3536c979c3d77cc0df7c0c48a902ca2f03f5ba5a8ef9431cf95f6fc89744e8440e1d5ebb837e30ef7541fbc27672c31566ac3676a173cb9e466a2d206ba1ebc2b985eddcd6ff937375fbc8415eba46f5ec68cfa9f3a669d41b078867dd9f5160ba45fa4719f32cf877d4b7a6d77c977533659f7c7ac22c68f5e93c1df6c2a3d45b55a4afd3355680aed864f6bbe13da2da28a4851f73c88e555f3bb1c34a21fc45ab6c28287902e8b5fcae6899c804f364cd878a8d1734462bb075cb7bc709cc2c5d7747c4c29a2fa9259752301c26b852b7993adf889d45dbe39094c9b7b168756e5b939ed10bb6df57b8f5e14352cfc7d8b03cda5b978b06cf2430af5db17177b1ef664bc4b00307f970c4fc606a6bab72125f62b0f59655c35b104da7af188a953cfc09b3aa0785abf330830fefedcc8bf9a11d5dc4b5642f679d45cb44fe61ab1d906345c1c345f6b8027bae9585580c20115d2504d9c83ab54ea2557b6d2dd3bc65fa29f091aa46a215e77621836154104e6969fa9107139a19f2e45cc6bf55422a0e1a6d037ad9e63df5f9cd2045e13ac2d6a15bc12008c4cd23782df7d41bfecc0037292d22c7b42f2cc1a22db7502332d9f4fa85f7640c8635b9469681adb6bcec2dfdf6926f1815156d80a835ae918527f549ea6df45f350f618dc1f3ca139759be28e35013034f8bbfd3fa1a8f302594213c18015305911f42e287f2d86f17d76f8a0ea03fb574c60c808669f9f4454fc2eaf0e93873f688e34bd3341f6874d5d8fe754172a751d6ab23dc1642220e7fb1071df0ee3c7e07c338915494a3b360bdc0b38ed221c2c2bc86b29744448b255802b3ddfe600c1d0f9acabb2185e4e9dae5e456d5825f516c857f63e72e4a5f3d45eaf11a0e3a5ad0ba30a0bf0f94cc99586fd202d6118bb6f9c272f6cbe39dd9b8b36ea7fa51dfe0bb87a633be11c16a14d1bce8492387696e195fa3c5f172690b4434aa2e91ce7d225d73b1983d2605ec725aae0ae402cd2f79fc202a307f1896f3dfcf8c0fd8b841dcfeda5d65bb7d76f7c2d2eb1b164c0368e9984f320a224d7d438bc5c69dacbc18a587b7589e960af114afbc9f59243646557962fc2e0cb5b5bf160a313bcfd9ade3e140b808e9f19415808aa312ae9c9e8bcd5a47fc721eda59d10670088714984a71d5c0df8b68e675a8e31ec15a92ff6a04d17e0ef849c782b302d11f742efe6486ab904fd65c0aac4ec25c6d877b453dce80e894de703aa8b1e5d00701850f149fe437fd0944cb95e54a924a49bd86bb9a602cf2904fbd9e399f1cdcd0b45b6d8f872e285f9dfeaa26aa760074651393c6451b36c643dd0b7236ec7803d69cec1b09bf1b63fbb68ad7c01507f00083b184ff01a62096f386f4c8fdc85e93eecf3f4b384aec1c10ccc60d8109a6d887bd389c3406163f9600879f0e944443d783e8644f69344f6f44f7bbf1883cda7369c9b9904d991c01552135f158a0bbb7f40c354f292c034824d82c209ebc770f5b756768ae51d45f8875b59904a07090689e65b40625566eed5d209130db812f287b966ae21ba46a3a7a3a0360a4e284d8d91ba9ed9806ea063827c8dda0fa98f758cbfa523ac645421f444a40b95bb065a64256c19354b1ad5002bb7b2add9b5236ad64e9052734b9d263515683db121b5e4dc1eab244dd8fc0fc62d962834ba0b21aad872b127afc0a33c7869a3f213519aa2ef51bab9ab28ed18859fd8239841a6668fc614dedd099121ae6c220a143c119cb9bff9068f65d0554b4c12105e59a22e91203a08ab8c718ec62c42d7ebb7b495e9e1be8fb7e4aab2777025da37b48d9d7b97578841a73898a6eab994e250106e096390c77b0600537be881ab7d81e3cb468bf1fe318b1e804d8df9875e9b8da22e6244997317391cce608085a28b8d070d654a29afab324ba3eecf427b6dfd43501ec0db919f71a932897eb37fe3bd64ab5a34ec60011696298b74ddd7a3710d3e444cedcc5cdc357f9dd58e67dc0ed3fc8df6dad82b3c00b4290c3280c28f78df052ec9cdd9df025abe8834616eddd5bb93379c69092911cd60761e7d14b426a83e335bfc8bf67a14e01df7cefb6023f0c6556534b975ed889de0d96d968526372402ce3d21a2c5c64a449dc3ba4ee0b5ceabc2fa29679e225681c8e946dc94b48af024bb1633e1860c7d8c14500967f24e2f8f46db537232a4e9f4abf8408f53bb52b035bdb89917a6f2f4bd22403ad002c2d936b785ecd965177e9f6235787a185d0eca92532f1aab16756ae86ece13925ba4a1fd08125102ae08c428d073aa426c4e792b5a4acf618605df1707021ce1eed62da4ee87334e34edf43338a0076b8ec739e2c31071e10c6a853e19fbf25b8a356527a67c8f7696dc184e374f4641f4e5b0aa345f1e6c4bfeba3a392d9a994bc271717a051c98d6c5b1f3296caf4c01d80ffb75b6fbdd0a0583f9d4695a44a2878df0c09a85aaab14522320cc3d2611603a34e52da03677a60cc87cc3c689975e5b5366c82e040b6643b8865d8bea0c84cef9ff85245a8b4bc41af1a50775b29fe55e42ac4b29fe80ddaf02e8c9bd07cab823f3d9021ac88236525ec045688a2fc9c6df66f549b10720cebf09ead919524f071cd128fb7575c84190c698b420f89b3c11195b5d83022d1f7e48afc21203995caf8f9286dcd5bd51b65c1af1caadf5a1b3f12579066855ff851075adb959dc3e086a7fb4e9a27fe80e8f3c0959b042486310ae7b785b0612e0385e36f50d4cae3474dd000c3957955534b4907b9480e2e5d83dedbeb76cb78d893c5b64dd51e31abc8e8b4c56b96f67c4b6e43861d91681af3270aae1a8f50712bd97326ee46a2640285b2902f051071d5a3400e99b76459956ac6908688c314bd8e54365383a65b186a6386cc5218e41e0b386759de81bccf5aa68f8608831a9d33ad1af2bdbd8579c5921cd8c3dd2f3bf1f123c742e118c76e2f43618bb7885e44826b7417c9ca5a139d774c16fbf74c8969c038ba6a54f27bab46ecc94d6455188d8dc1edf1da715c8d9976226877096df4158eeecced2248c7b88de0dd11a076db1f06bae4adba8286dc39aa62a55233886e011622ae1cf97238914a55078a78908145295777dbbc4e0d34364e0f3daa9eba6fa54c085777b18c0523818ff8710dee4bfeb3db549c3f38dde73b99a7b1b219282407a4e0ab3794089e21f6f2045ab6254ac3703903edb302fb2f0f97e47cca7969ad6b5b6cf27314137a04d5f4f29c193cfc5540592ab1342a1a9cbd514a7b4d6b23f724a5d7bfa6ffe8e3d9de29b8661139f179a0fafecf234f19bee75c25faffc765e02377d83e0ad0a0029c08f5c71595bc1b2fe88f0fe958f3f1f8ba6821ab834cab9bc902b2d47bd4b5ed52b5b0d7b3bc999b2f68879be39ddcb0428ce3a617b68c11459b746651f413d9e9a098cd2b5c0fcfd0ea1db2cde1672818d7bc73b053015692f9e9259a0153e3c9ac5e73e3343dd350cfbcaa57be93cc881a35063aec2db4ed71df2b1bd90b5ecbd84f399d4530c5450d622188423e151cec49673dc633e503c497d53843f4824750dc09abae9f2f465e92888715b6879f5edbab7bcd58f0899e1430ffb5f3063450945cb0fb3b5c3088ed6966c54dddae3aab489a80341b45a17cac02ae62749f209a7e16ecdfd86b43569c7b34511c65474acf2b2c18834e158e20957bf2320e4a6b9d63caea93b3a7dd4f7ba54443aba1ac2b6f2b27e1bf6f17d3fd1582462e0debc7069bb70e219654cbb99adfed54ab94329382163f2ab6710bb581d189cb3449a02c917c1f2d1d5f51958ce605fdb0e37ae5f3cb3f123276d43b2c26ea948dee863e0b679ecddf0fe41ce78bbca30167c9c7d6b0e9193c98090facd7205a490727e1ac49bb4d639348a32546007459c61c27bf8df87dd2ed3f3228b8193422a72d15f848bac13c6ffa7b8a767cf04866feb7c7a81267d7a8e890128d4709e4873223578aa7febdd562403c6092c0a3f6e0650772ede935ab6ef95e375bcbfa395e23ef1d73532388b845a95f158dc845a123f798176c73e177926d39abd38a910d40653006375110be2f2c5f6efc87b31908be36dd07c8ba5853519a37dfc4dea981af855293f49a3270bb67cdc17b780fbf2a418fcec8953dae927909a6bbbdce230d23113efad9c02474682dafc63311050cb4f3f86c282ff29728eefac5c678360122b4ce221bcec82d24e053b63972d2e9a631a180b48bb8d2d4de7254d91a856071df51a1d87ca7eb5d19ac3def1fdd6ebd8f57c2c9e43cb6ff2fa00d27f279368f5ee29a84ba219a51d1f0f1965781164edbb3aa6209fbce6d40284fbb4a33f59bf9e1248100a623de16613eebc11f510b7718dde9f13b4c9b2b6a10dd932696cdb7fa4b5733b0377453471462762457d42038ebf8c0fb392ca7656ad1f050c326de75fffc698c48f5d809ae360ddb9856b9a54b811073233294bf91e46414441b6665f432201da12e49718b0d7929b6cbcbf310a09ce0d22f07ee5cfa8ffb9f03acd224641171ffafdf50f18be8fa3c907226cc1a6f3b16a776781a6396dbf09f689ad6bba4d537dad490a6f036a45ee3e224e6f519e44b7352ee3e7d3f0d89f8c7c8f54b6d2698c0298a07866c9d9ca09c96c2ac8efd7974294df6dd1bb0598debadb6135e7123bbfddf84870de54476a291586fc0e64784e65fdf78d462e8b51cbac38e7ff1878b11418f188220e3deb5367a2d90ad7d44395f6965cc6d680c59daac268c16814d1085302d0453b48e4a8ae78b8a5b6951a875ef42776f6d11955da7e5734a72b61cefcc6889b8f8d58db51ee78d7b1a8ffebd90e15a64654054767aaec24dd3b5f338b572496c8731049c10622b7f54fdfa43aaea316946291fee7bc9e64640e8bccf33fd1e8693b67020b49cf77faaaa8269e2fecc4e2b43c8c3378a4a9b9b85a4fe2c346c5512cda631542e0ff5706eba996f4f72e629b076d6be1966d44b1835ce664e3c6a4f18c68f5e32f900a0a167e547d5aa79c0aede966f83d00366a623ef8107e328654c8558d5e606f69a12b6c2a6fcbe0e08f945c4ad2738ed0b28d79c98514abe0819569c6e4f4751c665fd651aaa9ee392c330560ef6d57c0a97f0764f88433b2bf7641ba391634316b0ee1dac23a63be21270e50ea1ac24ac3b429a0b46c38dbd48c540bfb1e141b8b3df6caa179c7e54f2b7b1371e8eb05a30f13da95200ab70dc58325f6bea0ee9fe1f04154998df393f2b4ff4431363f3a7450fa5210e883d67620ae63cc41f72e74e26a0244de1ac722b6f1c1d293f7483b331a0efda65a4e4e9144547fe6dce2f4535e29048b07079329b63754bb124b9e046a6e97929b1f4a387765bf93804530791c9f649db6efbebebf46fa4f9af7ff2587130d0e70a32d4aab1dfbee6aadd1f3e5317e3d4c8cde75b1479bc3dd16ea35db3dca11cf1eb1d2bbac60b83605e171619d85fd4b6d0e24be8db76df12efef05eb87473b832e59f3039df44ef034e5e7546b399cc817a41b2f020286ff139072a5b909ebb185a3c955cf88f4a9929b2112e0a9ab43da0288ce3ea268ccc9f46f852d387f5d0a2831dfc8cb0bf593905ba376c069b8c9b70558ec826c5bf9835031199c4c6d84c913da7e9e7db49c1d34511d917b9ad3c40af0598737d58fd61b8f2adc46b73a284957a99943cf73414412fa5440a5f85b63c20794d122c267fba72bfcd0e2741642fd8ff5a0ae1ffd8b30d852c053d0e31f505ca13a21c0223a8ee77cdd92de1b9f87ebee4ea332e9d4573d7efb2ad3f50c35fb7a596c4edb4b72bf6df5a16ffe3c8a236f2cab8c0712ac26c2cbcc68c1dc45209b579c952c7d645642aeed7d60407ee2dc168179d536da950108e962c5c976d3a05bf5142466ee38939ee94e707a0135f99c99b5d6376f63c711e4f64950f08dbc931c812f34735d9eb1c5997770d8159068cdca2e0f192311ca438d613728b544d6a3e50ae0e4e6b1eb611ce55a96bb2f991d49173073d8547f5ede69d8b587a34bb8f637297a15ab4fc45f1384bbd19b3feab5fb81322ba831386eeb6067e55af374c1b1eb9613a6c41dfe2bbbcfad157dd042c67c44400b350f0dc40a8611f2e947f32ea3ac3f609027b5dbc95b157c13216fe7c35edcc82950bd4e38bcb02b63d2576489c331a222e013e73b5333694889b184bedbbb6fdd6fd40a62b1d5d494e68cd2aefc264f74bf70ef38373e599faaa326f574ae32b1aad86854af22db8c9673d14666aa7c0c3bbe0d76a835ba4b391552777ed20c5c6cd0aa84f3be73ca0a3c128914107fb8fc02220317fb111cf13398480cd3325582a7e55f4c4ef5a258bcd01a97615e95f89c8064d41d04340b88cd5f4b1d827a030637145d98422facadbbbce97dc3060402a7bfa73d7b4dde53184a0923c0ee29c6e8e2c35e396808df2481af6aab053b619fcb2833f14f87051c5461567c5f8dd40383a7521971775493f896e18c78bad8219f88258ea686652780c03ebafb63ecbfcb23e24d52a2f88a77ed3b2280637807a5e155f4fad7149b76841772471a3b77aa42e8058c0af1ac2be9d88b5152851708f1a77582b3e31702864ee6a244a38f3f95d9797a60cddeb5ddf08cc48fc677f03f9e717ebe7f472883e5a6a7df31ca4272228f26991460c537ebc8aecb6a0c34a763eb1f57124fbfafd6db4c21bedf6723b252aeb21eb1fd9f4f811fd3e2e764422964761b2ef3aaaf986a48f7be66f6387578f9492feebc97dfbc6bc97380394a5635dbe582e52a1fb18ea8fc4e53974c63d198cf0d878ba8a8d58688a037c0f753c7073337ef3da4c134ef939c98c8806d09943591e6013a1342de7c722f993fd7eb36ba8e8407d1ea60eb5724b0d6262c70469dbd8ea1956b8d7f5a77707a9cbe2137079e7abda3966c5bee4fd86e8a3c4969bc88ff328a2adc8f4546f647575866d5ced16df06bf40d9a5f178f9d19e490bd76e187c441e7de0e571f6cea5512ec9bea48903d91a519dc82defe34a06b0244d623090b5a250786bbc66c1e76db6b18d81ed33c81a7c93782d5cdbe0a7cf7d1ab29c04be6ff4a9bbc10f716a67d52fd52d91425abd2002cf83c3797861db5fbeaec745a552ca4a50604340f2cf2c1b10e9ba76c8ea43b283c73f774f8be213f17f70cf93b9f6a8bab1f516a935e80c3cc6756945edafd572e6e00840eedf61fc40351869f03562d8c13006de585a1141c02f1311fbc8e45e4b3878c32810698e4764a6e8495f165eefee35714a1794f9ab50897c5565ab745425933d9d6272a172c1f2a274f9ca7bc8e1b01a27b8bd06fd9dc61880789696348c99e9a70c9dd2a62ca04d1f86dc87380b618c2a78b16229d614702fce242fa17ea90cda2648f9375bf7e78b4267d558983e08a9566d95871998d23cc6d22c23370ae067b677609844abc140df81cbd9addbf657fffaab5c22c479acca18f3e4b508cf01ff7b2ca308ff116389790f26f2c7635f89c747a5bc66f61de575653069349a89fd7e3dd785266b7bccf16eb8b4a8a86751de60d33e17d64f6e4e0f9d13a16d243ad7364114db7ad011f094c4debf20a39e35e7eeb440bbe8811db2857b965edd1e2675ceb1bc9a1691f123dedb341962fbbe539485d2241b0409adce2587d035187a0dd5a62076ac4eb5c3e2f4455569b6eac0fc16155da1774cbe505dc92e2087585a7846bae699bef32e3c5ec2356dd4433ed29d4b03ff7b38f7b3cb96b92874eefda6c2e0e326214e40f14cc2ef80e1cd3fe226257a423b8ff5bb368b87ac7066c5136487775b5b122a858334c37f6a3f53d758c3c866e2e79daf9aeab36a59eddbae2fa5b6d20973014196ef0a4cde1373c7297833e6f1e46828f4a42eebd829dd4f17999abe285218ed5dc6007b21bceb588a213b29dbb1ab1a79b41a12df26fe35f0cf6a310c9e50cf10d71ad5960626e4efec211032ec4ae52512001362ba4108d86eb774d2d4d0364cbb1dae68f03a774e328c2dc09899ee80c05ac2a8e3ba905b0b3b7a08a3df20b505901123e7dc0a15db48d09c84189ca4345c23c2010c12cc35287fad30211cab9631e148a7c1e8bfab61ced30e098d1c3cf7b6a7fbd8288dfdc48044d0d47c17f129f6b5d751af1984d395ab1b08ccca3e7309a89a8a36dfc3fb82d2a4269bffc32571438d04a7b98137b46ae1fea1bd9ea64f99e2f0c5f12ed84886b10bbd511993b0447036c4e57b9dae6d5bdad6aa3f2d12e62471194e43111613b8b6944c2baf1f539ea14dd76c356bfef7e3d4b6fb91f6d321a796a4bce5a4c6a5caaf0f3eccd914dea21ae909be7ba486075ff6139e7e351fdd7e98013ba51ff0248852398c734f245ffd7fde8cacfa4805496ad7350b1c96d7bf9da9be492f2f414e973937ac9109b6e8b8315aa9b81840f2c21239caf85a28f0e590bb6ad12148e75bd4d7ea69a9ffb053781db98d5fb5aca30a734017be7683a559c203c006ecd4b135afe3650b906e0aa208c889f2af09f3f8263260c3bd07cf8021124b6f0e0d021f9839e47996905c3d7562df810484552de3bcc9ae054b62a01af6a7991e4d63f30c7a92d8b58e01052e53818e64d7540a3208af321709a5d891ceecae5d27a999b00ed01616a73ec8854ca61973ed1fd3d82f8628b215c55eb7908e297d77098a7b0c362709005a7d13c89c54556589b2a926c6e08cc1c0afebc7eeb5d7ae4ef0507c91b8e706e6dbf83d898819192c812554ad1c6377871a8ca50f1325630f7b5266b807ef61d0c8d399fada49cb02a14c16d39f4fa7b81272573808e761c9dce7cfd12f4f18dd06b0ee471c166e095bf84aa4aaa2d82f1afcf09e5d960257c0a8dc404225b4b62187829c59e57da50bf848d72fabfb69362c117c6913541f84095a2a4ccdd2d30860cd96640bb2315e435a4af08c62c584ad129300adb02a871f3c548b96c4f6c47efdf4a1163a8a5ba9b4766b01437bc5957324660a8cd87df0f7e000d1309e896e3ce9f57b17562c9368a95a4cf66b3a5b57f0cca563b045452bbc8ad07b96fd0322728ccb3b05bfda14ef36ecfa2f32c5aa899811a67f2d62ed970db5723d6e4e4913c98c81ed6c03469112c23549f7e20be6401c6544db9078f34e6a4ad3cc868bace2e7ec6ea17225986f9e941ec67d9a3fc57958f9df8a60f585aa38b1769e26ed3f68dd85685b2cefae9dd72a18abc0de6b94689785df377ef4a812a6abc7f738a396f0e99ccbc5731801c36e746ab6b1dda88ca6ecb899528e18543cb3dfd439cd5be566594f01a4533da3638e6331fedf5b67870938ad044aa0dfdae33e3a6258ad40baadd726eacb1f3c1eb8d83ef4e185d7603a4f1eb006d90bf5849e2f65d37ffe750eb061bbad08a0c0cfabb9abf7f27d36ee5687d23feaa923e09d2ae905410a9193f21ed9b1d6331bb1f3babb90da2f2e023a6ceda4b4fe0f5d864738ee7f65a0b136021fbe076b4adf2d3af760e1361bad7ae35cb7ca010ddf4488255a2d3c492d0b26a1a5643f998b5d04a52a59f176d9bda85c916ff901329f09fe953b030b92f6415172476ad89d3e8cdcb4eda7dde5d4fcd5d6a584a312563558e784b0f9bcea7c53d26c3f2d3350c70a5e06a67c4c0373dd6279e29c320e6580fba8ab2df3039c289235c066af1b07dd112f25b25e292020f36c1aba246cba4e054d64b38f53ed57a712dffad7d3dc97f86af511638a2779107fc55da63b6498ea5f3ae36883163e5bf2324211a61a9889278f828e58daae797fdba9218d322da7aa23db7a48a00", 0x2000, 0x0) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000005140), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000005180)={0x1fe, 0x3, 0x4000, 0x2000, &(0x7f0000002000/0x2000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r6, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r7, &(0x7f0000000000/0x18000)=nil, &(0x7f00000051c0)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f0000000000/0x18000)=nil, &(0x7f0000005200)=[@text16={0x10, 0x0}], 0x1, 0x55, 0x0, 0x0) ioctl$KVM_RUN(r7, 0xae80, 0x0) read$FUSE(r3, &(0x7f0000000640)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) wait4(r8, 0x0, 0x20000000, 0x0) r9 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000500)={0x20, 0x11, 0x1, 0x0, 0x25dfdbff, "", [@nested={0x10, 0x0, 0x0, 0x0, [@typed={0x4, 0x0, 0x0, 0x0, @binary}, @typed={0x8, 0x11e, 0x0, 0x0, @fd}]}]}, 0x20}], 0x1, 0x0, 0x0, 0xc010}, 0x40080) 3.044289799s ago: executing program 0 (id=1): syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x0, 0x0) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) mkdirat(0xffffffffffffff9c, 0x0, 0x11d) mkdir(&(0x7f0000000500)='./dev\x00', 0x1fc) mount(0x0, &(0x7f0000000540)='./dev\x00', &(0x7f0000000580)='devtmpfs\x00', 0x2, 0x0) r0 = socket(0x10, 0x3, 0x0) mmap$IORING_OFF_SQ_RING(0x110c230000, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000bc0)={0x2, {{0xa, 0x1, 0x9, @mcast2}}, {{0xa, 0x4e20, 0x2, @local}}}, 0x108) setsockopt$inet6_MCAST_MSFILTER(0xffffffffffffffff, 0x29, 0x30, &(0x7f0000000d00)=ANY=[@ANYBLOB], 0x210) fcntl$F_SET_RW_HINT(0xffffffffffffffff, 0x40c, &(0x7f0000000dc0)=0x2) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x400000, 0x3, &(0x7f0000000000/0x400000)=nil) mkdirat(0xffffffffffffff9c, &(0x7f00000005c0)='./mnt\x00', 0x1ff) mount(&(0x7f0000000600)=@filename='./dev/sda1\x00', &(0x7f0000000640)='./mnt\x00', &(0x7f0000000680)='ext4\x00', 0x8410, 0x0) chdir(&(0x7f00000006c0)='./mnt\x00') r1 = openat(0xffffffffffffff9c, &(0x7f0000000700)='./dev/sda\x00', 0x1c5e42, 0x0) write$P9_RUNLINKAT(r1, &(0x7f0000000740)={0xfffffffffffffecb, 0x4d, 0x1}, 0xffffffd7) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file0\x00', 0x1a2) mount$overlay(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@volatile}]}) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000400)='./file0\x00', 0x0, 0x0) fsync(r2) socket$inet6_tcp(0xa, 0x1, 0x0) openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) fsopen(&(0x7f0000000440)='fuse\x00', 0x0) r3 = syz_ublk_setup_io_uring(0x383b, &(0x7f0000000340)={0x0, 0x2, 0x1, 0x1, 0x1e8, 0x0, r1}, &(0x7f0000000100)=0x0, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_ublk_add_dev(r3, r4, r5, r6, &(0x7f0000000480)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0xc, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000000c0)=@new_dev={0x3, 0x879, 0x0, 0x0, 0x1000, 0xffffffff, 0xffffffffffffffff, 0x0, 0x160}}}, &(0x7f0000000280)=0x0) sendto$packet(r0, &(0x7f00000000c0)="37031c00", 0xfeb5, 0x4000804, 0x0, 0x47) syz_ublk_setup_queues(r3, r7, &(0x7f0000000200)={0x0, 0x40, 0x800, 0x7, 0x264}, &(0x7f0000000840)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x4483, 0x8, 0x2, 0xe5, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x9208, 0x800, 0x3, 0x2080008, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x801, 0x1000, 0x0, 0x1000000, 0x0, r3}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xf6a9, 0x1, 0x20000, 0x38e, 0x0, r3}}], 0x4, &(0x7f0000000b40)={0x2e, 0x58, 0x0, 0xffffffffffffffff, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x6}, 0x0, 0x0, '\x00', {0xfffd, 0xc8b, 0x0, 0x0}}, 0x0) 3.013443502s ago: executing program 1 (id=2): r0 = syz_usb_connect$hid(0x5, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000000000104c05d50300000000000109022400010000000009040000020300000009210000000122050009058103"], 0x0) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xffffffffffffffff) add_key$keyring(0x0, &(0x7f00000001c0)={'syz', 0x2}, 0x0, 0x0, 0xffffffffffffffff) bind$inet(0xffffffffffffffff, &(0x7f0000000640)={0x2, 0x4e20, @multicast2}, 0x10) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, &(0x7f0000000080)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="000005"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$evdev(0x0, 0x4, 0xac502) syz_usb_control_io$hid(r0, &(0x7f0000000a40)={0x24, &(0x7f00000008c0)={0x20, 0x22, 0x98, {0x98, 0x3, "32f05ec1028ee32d0059881c44e0a4c7e44fa3c1b600305fa20dfd861e6e9743cf2a56212740a5655c5409478f2890ecf625d05df4fad9517c995f2cd21b87aca1a801f86774d5986d09c19cb9a02536c37f143f032e7f8b5ff0e769b4bfea752c3bf22c3a5d099bf76f4ea436a894897b47be95a5f47dd3a6ccbcf88e8f985f9064b4e2a42c980d8a5c21c55c1cafc16184bf2a9a64"}}, &(0x7f0000000980)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x40a}}, &(0x7f00000009c0)={0x0, 0x22, 0x9, {[@main=@item_012={0x2, 0x0, 0x8, "8cbe"}, @global=@item_012={0x0, 0x1, 0xa}, @main=@item_4={0x3, 0x0, 0xb, "7b433a95"}]}}, &(0x7f0000000a00)={0x0, 0x21, 0x9, {0x9, 0x21, 0x40, 0x9, 0x1, {0x22, 0x433}}}}, &(0x7f0000000d00)={0x2c, &(0x7f0000000a80)={0x0, 0xd, 0xf4, "4b04b0678a272e3087a6db17d51225dc02988599ed69a972ff3be0449240375af0305e21591c637876082980b11496493401399f1dd061ac664c59b64599b8bf8019034142359ef711154ab78ae7ca4f0c190c9c249e9729a87b59b9b7fc7e06b87badf0be4784e9ee115a62324f6958d46e461e5a21236b9e63c8e42c65480024a2eb309ea5e6eecfc31fce9ccf7f59e9984968aff6e15a2ae03a11bf748f3f997d20bff6ec43935bf84d8cd54deb8d7ba1c64577bd1f26c778df13faca671e39cc58512aa3d464099ccc3b09168f047ce1f1deee84d058e684103dab58a970c77f97bd1822906cc6dff6cc2237fdc22354f451"}, &(0x7f0000000b80)={0x0, 0xa, 0x1, 0xa}, &(0x7f0000000bc0)={0x0, 0x8, 0x1, 0x8}, &(0x7f0000000c00)={0x20, 0x1, 0x93, "323bab163f182ce936e2959b9ebf65ea4e5f4afd8e468bd48b10cc3d1f481126b053dfb4e74f79d6e0dcaa1c839075e80eb06f59b57a7f4195ac383ec31cdc23746ad7ecce5a31cfaad43ac0bcdba68e204041e80551a640d10984cde6ebee3ee3ae1f8696919a504ad99c795857e95178c693c9e45c2cc988487a7315065ea4df5cb007999ebc51017046ecc709f28ff254a5"}, &(0x7f0000000cc0)={0x20, 0x3, 0x1, 0x3}}) syz_usb_control_io(r0, &(0x7f0000000300)={0x2c, &(0x7f0000000100)={0x0, 0x0, 0xa0, {0xa0, 0x4, "9f0be6e0e3b25b4f3ea88cd0f38241d61f3df050107c696bd91accd8b5e903657e3746dee46e692095ea771a7b4a3ea28f6d81ba164d820a7a6ccc2fac0b0402b3bf643f53697a90387a6b814a0133bfacc4db0e82e18d6dd31e0679e466407d3acd377909c445506eb829d5cb58a5213bf88060d2ee54976e8a7400c969177185819ea57d82e4b33cf145907e6a2d3f01a5e2053c381944cc2c63161ee4"}}, &(0x7f0000000200)={0x0, 0x3, 0x32, @string={0x32, 0x3, "b59f9942546b9717d328ef131bf88374a5627d4f5e4ad5c2babf850284a94d5e4622164413ffe989e5c0c9257a5c9653"}}, &(0x7f0000000240)={0x0, 0xf, 0x31, {0x5, 0xf, 0x31, 0x4, [@ss_cap={0xa, 0x10, 0x3, 0x0, 0x4, 0x2, 0x7, 0xaaff}, @ext_cap={0x7, 0x10, 0x2, 0x1e, 0x8, 0x8, 0x64}, @ext_cap={0x7, 0x10, 0x2, 0x16, 0x4, 0x3, 0x5}, @ss_container_id={0x14, 0x10, 0x4, 0x32, "a5dd0cc3ad8da2ad7a8df27ccb5560ab"}]}}, &(0x7f0000000280)={0x20, 0x29, 0xf, {0xf, 0x29, 0x2, 0x2, 0x1, 0x7f, "e87f4b73", "a7385034"}}, &(0x7f00000002c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x5, 0x2, 0x0, 0x4, 0x9, 0x5, 0x8}}}, &(0x7f0000000800)={0x84, &(0x7f0000000340)={0x20, 0x0, 0xad, "9e82c8ccf948750167d5f45c62f3377690ebc1fa997726f4f43708e598f03c86b8e6997cb1202b042a8e2f7723a4ab46847cb56d1e91a6eba144936face815a529add33c7404b41fccd69e195026ea09f0e89743af2dadee667b7ae60990f2ffeb0867b513083d819ae0d1899ea8a2c11d1d96f0a5e4aac9a431616730169d16e618dce7265e201211ae847ebb4cfd354add7ad28935f440b9f984da49b6827fe9bf0666f6405aca7bac56f6f4"}, &(0x7f0000000400)={0x0, 0xa, 0x1, 0x7}, &(0x7f0000000440)={0x0, 0x8, 0x1, 0x5}, &(0x7f0000000480)={0x20, 0x0, 0x4, {0x2, 0x3}}, &(0x7f00000004c0)={0x20, 0x0, 0x4, {0x2, 0x80}}, &(0x7f0000000500)={0x40, 0x7, 0x2, 0x80}, &(0x7f0000000540)={0x40, 0x9, 0x1, 0x3}, &(0x7f0000000580)={0x40, 0xb, 0x2, "3d03"}, &(0x7f00000005c0)={0x40, 0xf, 0x2, 0xffff}, &(0x7f0000000600)={0x40, 0x13, 0x6, @remote}, &(0x7f0000000680)={0x40, 0x17, 0x6, @multicast}, &(0x7f00000006c0)={0x40, 0x19, 0x2, "75f4"}, &(0x7f0000000700)={0x40, 0x1a, 0x2, 0x8}, &(0x7f0000000740)={0x40, 0x1c, 0x1, 0x4}, &(0x7f0000000780)={0x40, 0x1e, 0x1, 0x97}, &(0x7f00000007c0)={0x40, 0x21, 0x1, 0x7}}) 2.760341838s ago: executing program 0 (id=5): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x168) mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000001c0)='./file0\x00', &(0x7f0000000200), 0x805408, &(0x7f0000000240)) mount$overlay(0x0, &(0x7f0000000280)='./bus\x00', &(0x7f00000002c0), 0x0, &(0x7f0000000300)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file1'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) r0 = accept$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @local}, &(0x7f0000000040)=0x14) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'syzkaller0\x00', 0x0}) r3 = socket$packet(0x11, 0x2, 0x300) sendto$packet(r3, &(0x7f00000000c0)=']', 0x1, 0x40000, &(0x7f0000000340)={0x11, 0x7, r2, 0x1, 0x2}, 0x14) setsockopt$packet_drop_memb(r0, 0x107, 0x2, &(0x7f0000000380)={r2, 0x1, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x1e}}, 0x10) unlinkat(0xffffffffffffff9c, &(0x7f0000000580)='./file0/file1\x00', 0x200) 2.658711958s ago: executing program 0 (id=6): mlock(&(0x7f0000400000/0xc00000)=nil, 0xc00000) mremap(&(0x7f0000bfd000/0x400000)=nil, 0x400000, 0x3000, 0x0, &(0x7f00005d4000/0x3000)=nil) unshare(0x60000600) r0 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCSIFBR(r0, 0x890c, &(0x7f0000000000)=@generic={0x0, 0x2}) r1 = userfaultfd(0x801) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000040)={0xaa, 0x653}) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000400)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x2}) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x19) 2.595894385s ago: executing program 0 (id=7): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x10000, 0x2000, &(0x7f0000010000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x0) r4 = dup(r3) r5 = openat$urandom(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) read(r5, &(0x7f0000000100)=""/18, 0x12) utimensat(r4, 0x0, &(0x7f0000000040)={{}, {0x0, 0xfffffff9}}, 0x0) ioctl$KVM_SET_CPUID2(r2, 0x4008ae90, &(0x7f00000001c0)={0x6666666666666cd, 0x0, [{0x40000001, 0x400, 0x0, 0x31237648}]}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000200)={0x2, 0x0, [{0x40000000, 0x0, 0x1}, {0x40000001, 0x0, 0x10001}]}) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000240)={{0x0, 0xffffffff, 0x10, 0xb, 0x1, 0x0, 0x11, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x18, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x5}, {0xffe, 0xffffffff, 0x18, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x0, 0xffffffff, 0x18, 0x3, 0x1, 0x0, 0x1, 0x1, 0x0, 0x1}, {0x41000, 0xffffffff, 0x18, 0x3, 0x1, 0x0, 0x1, 0x1, 0x6, 0x1}, {0x0, 0xfec00000, 0x18, 0x3, 0x1, 0x0, 0x1, 0x1, 0x1, 0x1, 0x0, 0x4}, {0x0, 0xffff, 0x20, 0xa, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa9}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, {}, {}, 0x1}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000380)={[0x4, 0x0, 0x8001, 0x100, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2], 0x10000, 0x2}) ioctl$KVM_RUN(r2, 0xae80, 0x0) mlock(&(0x7f000068f000/0x1000)=nil, 0x1000) r6 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r6, &(0x7f0000000440)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x6, 0x104}}, 0x10) r7 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r7, &(0x7f0000000480)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x0, 0x2}}, 0x10) r8 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r8, &(0x7f00000004c0)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x4}}, 0x10) r9 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r9, 0x6, 0x13, &(0x7f0000000600)=0x100000001, 0x4) connect$inet6(r9, &(0x7f0000000640)={0xa, 0x4e24}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r9, 0x6, 0x1f, &(0x7f0000000680), 0x4) r10 = fcntl$dupfd(r9, 0x0, r9) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r9, 0x6, 0x14, &(0x7f00000006c0)=0x1, 0x4) sendmsg$IPVS_CMD_GET_CONFIG(r10, &(0x7f0000000700)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000780)=ANY=[], 0x14}}, 0x0) setsockopt$inet6_tcp_TLS_TX(r10, 0x11a, 0x2, &(0x7f00000007c0)=@ccm_128={{0x304}, "ab624f6011dc5562", "21004bb854986b0b74c0152fbf338bad", "270689dd", "2969c92218294513"}, 0x28) bind$tipc(r8, &(0x7f0000000500)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x2, 0x3}}, 0x10) 2.494425566s ago: executing program 0 (id=8): capset(&(0x7f00000020c0)={0x20080522}, &(0x7f0000002100)={0x0, 0x0, 0x8, 0x81, 0xffffffff}) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x20000000) r2 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) r3 = dup(r2) syz_kvm_setup_syzos_vm$x86(r3, &(0x7f00004da000/0x400000)=nil) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) recvfrom(r5, 0x0, 0x0, 0x40000000, 0x0, 0x0) syz_io_uring_setup(0x10cc, &(0x7f0000000240)={0x0, 0x5509, 0x8, 0x0, 0x241}, 0x0, 0x0, 0x0) (async) r6 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r6, 0x400448c8, &(0x7f00000002c0)={r4, 0xffffffffffffffff, 0x5, 0x0, 0x0, 0x1f, 0x81, 0xfffe, 0x71, 0x800, 0x1, 0x0, 'syz1\x00'}) (async) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x100, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x8) (async) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./proc\x00', 0x1ff) (async) personality(0xfe47fef9f5ff7379) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) mount(0x0, &(0x7f0000000100)='./proc\x00', &(0x7f0000000140)='proc\x00', 0x4000, 0x0) r9 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./proc/thread-self/fail-nth\x00', 0x2, 0x0) write(r9, &(0x7f00000001c0)='27', 0x2) (async) socket$inet_tcp(0x2, 0x1, 0x0) (async) ioctl$KVM_CREATE_VCPU(r8, 0xae41, 0x0) (async) r10 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r10, &(0x7f0000000f40)={0x0, 0x0, &(0x7f0000000f80)=[{&(0x7f0000000fc0)=ANY=[@ANYBLOB="2c0000001000010000000000fedbdf250400000008000000", @ANYRES32, @ANYBLOB="1000ffffff7f01000500000000000000"], 0x2c}], 0x1}, 0x20000000) (async) ioctl$KVM_TDX_CAPABILITIES(r9, 0xc008aeba, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000600)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/2000, {0x2, 0x0, [{}, {}]}}}) (async) r11 = syz_open_procfs$pagemap(0x0, &(0x7f0000000380)) ioctl$PAGEMAP_SCAN(r11, 0xc0606610, &(0x7f0000000ec0)={0x60, 0x2, &(0x7f0000603000/0x1000)=nil, &(0x7f0000ffc000/0x3000)=nil, 0x7fff, &(0x7f00000003c0)=[{0x2, 0xffffffff, 0x6}], 0x1, 0x2, 0x21, 0x60, 0xf6, 0x3a}) (async) epoll_ctl$EPOLL_CTL_MOD(0xffffffffffffffff, 0x3, r11, &(0x7f0000000040)={0x20000000}) 2.086596117s ago: executing program 3 (id=9): memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000040)=@sg0, 0xffffffffffffffff, 0x0) (async) quotactl$Q_GETQUOTA(0xffffffff80000701, &(0x7f0000000040)=@sg0, 0xffffffffffffffff, 0x0) r0 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000001c0)='/sys/power/disk', 0x1, 0x0) io_submit(0x0, 0x1, &(0x7f0000000200)=[&(0x7f0000000240)={0x0, 0x0, 0x0, 0x1, 0x734b, r0, &(0x7f0000000280)="c2", 0x1, 0x7, 0x0, 0x2}]) socket$nl_generic(0x10, 0x3, 0x10) (async) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000480), 0xffffffffffffffff) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'lo\x00'}) (async) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000004c0)={'lo\x00', 0x0}) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) (async) r5 = memfd_create(&(0x7f00000005c0)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) fcntl$lock(r5, 0x24, &(0x7f0000000780)={0x1, 0x4, 0xa5, 0x2}) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000580)={0x20, r2, 0x1, 0x70bd27, 0x25dfdbfd, {}, [@ETHTOOL_A_COALESCE_HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x144}, 0xc080) mount$9p_unix(0x0, &(0x7f00000003c0)='./cgroup\x00', &(0x7f0000000400), 0x200042, &(0x7f0000000440)={'trans=unix,', {[{@ignoreqv}]}}) sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb47, 0x4, 0xfffffffffffffff7, 0x0, 0x3e}, 0x0) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) (async) r6 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000300), 0x101001, 0x0) write$vga_arbiter(r6, &(0x7f0000000340)=ANY=[@ANYBLOB='target '], 0x17) (async) write$vga_arbiter(r6, &(0x7f0000000340)=ANY=[@ANYBLOB='target '], 0x17) openat$tun(0xffffffffffffff9c, &(0x7f0000000380), 0x40241, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x65) syz_usb_connect(0x5, 0xc8, &(0x7f00000000c0)={{0x12, 0x1, 0x310, 0xd6, 0x1c, 0x71, 0x10, 0x1163, 0x100, 0x1e5, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0xb6, 0x1, 0xe0, 0xb, 0xa0, 0x4, "", [{{0x9, 0x4, 0x90, 0x9, 0x1, 0xef, 0xb6, 0x35, 0x48, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x47a}, {0xd, 0x24, 0xf, 0x1, 0xd3e, 0x0, 0x7, 0x8}, [@mbim_extended={0x8, 0x24, 0x1c, 0x80, 0x7a, 0x8}, @network_terminal={0x7, 0x24, 0xa, 0x4, 0xfb, 0x8, 0x7f}, @ncm={0x6, 0x24, 0x1a, 0xd74f}, @mbim_extended={0x8, 0x24, 0x1c, 0x6, 0x35, 0x1ff}, @mdlm_detail={0x60, 0x24, 0x13, 0x3c, "138d396d3372d9be1a4e2c4fc5b0b808ec3e7fd384202d70f42033741c01624971d7f20eb7237a335fd940031ea58a83d708443474bbeb1d32b7cfff3663dbd7949a3c641101478709840a155b919ff45f695066cd1d3c1668e0a5c8"}, @call_mgmt={0x5, 0x24, 0x1, 0x1, 0x1}]}], [{{0x9, 0x5, 0xa, 0x1, 0x200, 0x1, 0xe, 0x7, [@generic={0x2, 0x8}]}}]}}]}}]}}, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0}) 1.644164562s ago: executing program 0 (id=11): keyctl$update(0x2, 0x0, 0x0, 0x0) mlock(&(0x7f0000ffc000/0x1000)=nil, 0x1000) syz_clone(0x80800, 0x0, 0x0, 0x0, 0x0, 0x0) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[], 0x0) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000100)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000140)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000180)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000001c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000200)) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000240)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000280)) socket$tipc(0x1e, 0x2, 0x0) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f00000002c0)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000300)) socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000380)) ioctl$KVM_SET_VCPU_EVENTS(0xffffffffffffffff, 0x4400ae8f, &(0x7f0000000000)=@x86={0x60, 0x4, 0xc, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x80, 0x9, 0x1, 0x0, 0xa, 0x8, 0x0, 0xff, 0xff, 0x0, '\x00', 0x0, 0x1}) r0 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000580)={0x0, &(0x7f00000005c0)=[@code={0xa, 0x70, {"b805000000b9000000000f01d96467f3250000000066b811010f00d866b80e010f00d0460f0848b804000000000000000f23d00f21f8350000000c0f23f84281bc0800a00000907c0000c4e221936457e565650f1c860000c0fec401557623"}}], 0x70}) r1 = openat$kvm(0xffffff9c, &(0x7f0000000640), 0x8000, 0x0) ioctl$KVM_SET_MSRS(r0, 0xc008ae88, &(0x7f0000000680)={0x1, 0x0, [{0xf88e470f, 0xed, 0x5}]}) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r1, 0xc008ae05, &(0x7f00000006c0)={0x1, 0x0, [{0x40000000, 0x9, 0x5, 0xffffffff, 0xff, 0x4, 0x1}]}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000700)={0x0, 0x0, 0xffff1000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000740)={[0x2, 0x9, 0xfffffffffffffffd, 0x77, 0x2, 0x2, 0x4002004c0, 0x1004, 0x8000000000000004, 0xc595, 0x0, 0x5, 0xffffffffffffffff, 0x5, 0x5, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r3, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000800), 0x42282, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) 1.422617315s ago: executing program 2 (id=12): mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./bus\x00', 0x180) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0) r0 = userfaultfd(0x80001) socket$pptp(0x18, 0x1, 0x2) r1 = epoll_create(0x8) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000340)={0xb0000001}) epoll_wait(r1, &(0x7f0000000380)=[{}], 0x1, 0x6) mount$overlay(0x0, &(0x7f0000000200)='./bus\x00', &(0x7f0000000240), 0x8, &(0x7f0000000280)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file0'}}]}) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f0000000100)=[{{0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000000400)="a1", 0x1}], 0x1, &(0x7f0000000440)=ANY=[@ANYBLOB="14000000000000000100000001000000", @ANYRES32=r2, @ANYBLOB="0000000014"], 0x30, 0x40400d1}}], 0x1, 0x10) pipe(&(0x7f0000000480)={0xffffffffffffffff, 0xffffffffffffffff}) splice(r2, 0x0, r4, 0x0, 0x400000, 0x3) r5 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./bus\x00', 0x0, 0x80c2dbaf2417f8e4) ioctl$FS_IOC_FSSETXATTR(r5, 0x401c5820, &(0x7f0000000300)={0x8}) r6 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r7 = ioctl$KVM_CREATE_VM(r6, 0xae01, 0x0) r8 = ioctl$KVM_CREATE_VCPU(r7, 0xae41, 0x1) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) syz_kvm_setup_cpu$x86(r7, r8, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@textreal={0x8, &(0x7f00000003c0)="ba2000b09aeef3ab0f4d17640f302e2e660fae320fc75853b800088ec8f2ab2e66f20f38f09b008036f30f1c860020"}], 0x1, 0x49, 0x0, 0x32) socket$packet(0x11, 0x2, 0x300) ioctl$KVM_RUN(r8, 0xae80, 0x0) 1.422396865s ago: executing program 2 (id=13): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000040)={0x200000, 0x200000, 0x7}) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./dev\x00', 0x1ff) mount(0x0, &(0x7f00000000c0)='./dev\x00', &(0x7f0000000100)='devtmpfs\x00', 0x0, 0x0) r0 = socket(0x11, 0xa, 0x5) ioctl$sock_inet_SIOCSIFDSTADDR(r0, 0x8918, &(0x7f00000001c0)={'ipvlan0\x00', {0x2, 0x4e20, @broadcast}}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) syz_open_dev$loop(0x0, 0x3ff, 0x22800) sendto$inet(r0, 0x0, 0x0, 0x10, &(0x7f0000000200)={0x2, 0x4e22, @loopback}, 0x10) r1 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./dev/sda\x00', 0x101042, 0x5) ioctl$FIBMAP(r1, 0x5393, &(0x7f0000000180)=0x93) 1.422088355s ago: executing program 2 (id=14): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) ioctl$TCSETSW2(r1, 0x5437, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_GET(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000000101011f00000000000000000a000004"], 0x14}}, 0x0) close_range(r0, r1, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000380)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x204}, 0xc, &(0x7f0000000340)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x7}}, [@NFT_MSG_NEWOBJ={0x1c, 0x12, 0xa, 0x101, 0x0, 0x0, {0x7, 0x0, 0x2}, @NFT_OBJECT_CT_HELPER=@NFTA_OBJ_TYPE={0x8}}, @NFT_MSG_NEWTABLE={0x154, 0x0, 0xa, 0x301, 0x0, 0x0, {0x3, 0x0, 0x8}, [@NFTA_TABLE_USERDATA={0xf4, 0x6, "c776bd776d5b7e071c29c3477e16ddc625634ffa1c0379ebb5a7c9aaca608977823b772330605daef3ab9a86b0dc13313787a91c19ac0d54b45c40f51b52a6d6db6eebf33b2481353d9a03869f9f844c911f18350b4af7493786cc69b9bc9b4d83da1d7d7bef42d9a064340348025bf48ed68b26c2458e27ea15b12216dfce2621869c37e9ca7dcfe45aefa00344402c03de5cb43615d936957293e634af276c7dd22ebb81ded26ae747617f23d5da0ecac14cb3fc2d2ae7d4ed07ef6351a300b48998253f3984d7abb6d520404ebb3cdb96adde0d27462778e89f1bcc58b78fc70e90841a648dad757e93344f861423"}, @NFTA_TABLE_USERDATA={0x4b, 0x6, "2305c64ed56e6530880b7c99bd2ef6b358b49426f65b31beddabb1a659d38f91ffa9d62c3a9d38dcb31c14498df45c08a5ea68a1364514e38e45c26a6d81b26611763c647ebdb9"}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x198}, 0x1, 0x0, 0x0, 0x20000800}, 0x1) 1.411349486s ago: executing program 2 (id=15): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x28100, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) (async) mmap(&(0x7f0000000000/0xa000)=nil, 0xa000, 0x3, 0x20132, 0xffffffffffffffff, 0xb299b000) (async) process_vm_writev(0x0, &(0x7f0000000080)=[{&(0x7f0000000140)=""/156, 0x9c}], 0x67, &(0x7f0000000200)=[{&(0x7f0000000280)=""/116, 0xd8d0481}], 0x1, 0x0) (async, rerun: 64) sendmsg$key(0xffffffffffffffff, &(0x7f0000000300)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000380)=ANY=[@ANYBLOB="02030003100000002cbd7000fbdbdf2502000900080000001c0000000000000005000600000000000a0000000000000000000000000000000000000000000001020000000000000002000100000004d30e0803010000000005000500000000000a00000000008900002001000000000000000000000000000207001000000011"], 0x80}, 0x1, 0x7}, 0x0) (rerun: 64) openat$ashmem(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) (async) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_NMI(r3, 0xae9a) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000480)={[0x0, 0x100000000, 0x0, 0x7f, 0x100000, 0x0, 0x2004c8, 0x88000000, 0x0, 0x0, 0x7, 0x0, 0x5, 0x0, 0x2, 0xffffffffffffffff], 0x0, 0x102280}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000540)={[0x100, 0x5, 0x6, 0x4002, 0x9, 0x5, 0xefffffffffffffff, 0x0, 0xffffffffffffffff, 0x2000001, 0x0, 0x40000000001c, 0x1, 0xffffffffffffffff, 0x100], 0x0, 0x41801}) (async) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) setsockopt$inet6_tcp_int(r0, 0x6, 0x2, &(0x7f0000000240)=0x1000, 0x4) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x8, @remote, 0x5}, 0x1c) (async, rerun: 32) getsockopt$inet6_tcp_int(r0, 0x6, 0x2, 0x0, &(0x7f0000000100)) (rerun: 32) 542.154274ms ago: executing program 2 (id=16): mkdirat(0xffffffffffffff9c, &(0x7f0000000300)='./dev\x00', 0x1ff) r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) setns(r1, 0x24020000) mount_setattr(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x9000, &(0x7f0000000080)={0x0, 0x87, 0x100000}, 0x20) mount(0x0, &(0x7f0000000340)='./dev\x00', &(0x7f0000000380)='devtmpfs\x00', 0x1, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f00000003c0)='./dev/ram0\x00', 0x2, 0x0) socketpair$unix(0x1, 0x7, 0x0, &(0x7f0000000000)) pwrite64(r2, &(0x7f0000000400)="fc", 0xfffffdd8, 0x7) close(0x3) 490.56037ms ago: executing program 2 (id=17): r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') mkdirat(0xffffffffffffff9c, &(0x7f00000004c0)='./dev\x00', 0x1ff) mount(0x0, &(0x7f0000000840)='./dev\x00', &(0x7f0000000880)='devtmpfs\x00', 0x4010, 0x0) r1 = syz_usb_connect(0x0, 0x39, &(0x7f00000008c0)=ANY=[@ANYBLOB="12010002000000407b0603230001000000010902270001010080320904000003ff000000070581024000000705020240000007058303"], 0x0) openat(0xffffffffffffff9c, &(0x7f0000000900)='./dev/ttyUSB0\x00', 0x12df00, 0x0) syz_usb_control_io(r1, &(0x7f0000000940)={0x2c, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x0) prctl$PR_GET_SPECULATION_CTRL(0x35, 0x0, 0x4) openat$ppp(0xffffffffffffff9c, &(0x7f0000000d00), 0x2500, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000d80), 0x802, 0x0) pselect6(0x40, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xee}, &(0x7f0000000e00)={0x1f, 0x0, 0x3837, 0x0, 0xfffffffffffffffc, 0x0, 0x8}, 0x0, 0x0, 0x0) r2 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r3 = openat$selinux_policy(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000980)={0x0, 0x0, &(0x7f00000009c0)={&(0x7f0000000a00)=@newsa={0x150, 0x10, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {@in6=@loopback, 0x4d2, 0x32}, @in6=@loopback, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x80, '1234567890123456dcba'}}]}, 0x150}}, 0x0) sendmsg$nl_xfrm(r4, &(0x7f0000000b80)={0x0, 0x0, &(0x7f0000000bc0)={&(0x7f0000000c00)=@newpolicy={0xfc, 0x13, 0x401, 0x0, 0x0, {{@in6=@loopback, @in6=@loopback, 0x1234, 0xffff, 0x0, 0x0, 0xa, 0x80, 0x80, 0x11}, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in6=@loopback, 0x4d2, 0x32}, 0xa, @in6=@loopback}]}]}, 0xfc}}, 0x0) r5 = socket$inet6(0xa, 0x2, 0x0) sendto$inet6(r5, &(0x7f0000000d00), 0xffe7, 0x4003e8, &(0x7f0000000d40)={0xa, 0x1234, 0x0, @loopback}, 0x1c) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x100000a, 0x12, r3, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r6, 0x6, 0x210000000013, &(0x7f0000000080)=0x100000001, 0x4) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r6, 0x6, 0x14, &(0x7f00000000c0)=0x2, 0x4) connect$inet(r6, &(0x7f0000000100)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0xe}}, 0x10) sendto$inet(r6, &(0x7f0000000140)="abc7153306", 0x75f32760, 0x4000805, 0x0, 0x0) recvmmsg(r6, &(0x7f0000000180)=[{{0x0, 0x0, &(0x7f0000000200)=[{&(0x7f0000000240)=""/229, 0xe5}, {&(0x7f0000000340)=""/179, 0xb3}, {&(0x7f0000000400)=""/184, 0xb8}], 0x3}, 0x8}, {{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f00000005c0)=""/83, 0x53}, {0x0, 0x12}, {&(0x7f0000000640)=""/39, 0x27}, {&(0x7f0000000680)=""/124, 0x7c}, {&(0x7f0000000700)=""/76, 0x4c}], 0x5, &(0x7f0000000780)=""/168, 0xa8}, 0x4}], 0x2, 0x22, 0x0) write$selinux_load(r2, &(0x7f0000000080)=ANY=[], 0x11a00) read$FUSE(r0, &(0x7f0000002580)={0x2020}, 0x6d) 0s ago: executing program 1 (id=18): r0 = openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) r2 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r2, &(0x7f00000000c0), 0x4) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000440)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x4000, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x14a8, 0x0, 0x60, 'snapshot-merge\x00', {@ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, 'p', 0x20, '128'}}]}) r3 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f000000a000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) write(r4, &(0x7f0000000300)='0', 0x1) ioctl$TIOCSISO7816(r3, 0xc0285443, 0x0) ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000600)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x5800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}}) ioctl$DM_TARGET_MSG(r0, 0xc138fd0e, &(0x7f0000002880)={0x4, 0x0, 0x0, 0x168, 0x138, 0x0, 0x0, 0x4600, 0x0, 0x0, @by_dev={r1}, {0x3000, @thin_create={'create_thin ', 0x2}}}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x12) openat$dm_control(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) (async) ioctl$DM_DEV_CREATE(r0, 0xc138fd03, &(0x7f0000000100)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, {'syz', 0x0, '0\x00'}}}) (async) socket$can_bcm(0x1d, 0x2, 0x2) (async) connect$can_bcm(r2, &(0x7f00000000c0), 0x4) (async) ioctl$DM_TABLE_LOAD(r0, 0xc138fd09, &(0x7f0000000440)={0x4, 0x0, 0x0, 0x198, 0x138, 0x1, 0x0, 0x4000, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}, [@snapshot={0x0, 0x14a8, 0x0, 0x60, 'snapshot-merge\x00', {@ram_num={'1:', 0x0}, 0x20, @ram_num={'1:', 0x0}, 0x20, 'p', 0x20, '128'}}]}) (async) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) (async) openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/memory.force_empty\x00', 0x2, 0x4) (async) openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) (async) ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) (async) syz_kvm_setup_cpu$x86(r6, 0xffffffffffffffff, &(0x7f000000a000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x44, 0x0, 0x0) (async) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) (async) write(r4, &(0x7f0000000300)='0', 0x1) (async) ioctl$TIOCSISO7816(r3, 0xc0285443, 0x0) (async) ioctl$DM_DEV_SUSPEND(r0, 0xc138fd06, &(0x7f0000000600)={0x4, 0x0, 0x0, 0x138, 0x138, 0x0, 0x0, 0x5800, 0x0, 0x0, @by_name={0x0, {'syz', 0x0, '0\x00'}}}) (async) ioctl$DM_TARGET_MSG(r0, 0xc138fd0e, &(0x7f0000002880)={0x4, 0x0, 0x0, 0x168, 0x138, 0x0, 0x0, 0x4600, 0x0, 0x0, @by_dev={r1}, {0x3000, @thin_create={'create_thin ', 0x2}}}) (async) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000080)=0x12) (async) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.0.88' (ED25519) to the list of known hosts. [ 19.209711][ T36] audit: type=1400 audit(1794136380.659:64): avc: denied { mounton } for pid=287 comm="syz-executor" path="/syzcgroup/unified" dev="sda1" ino=2023 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:root_t tclass=dir permissive=1 [ 19.232722][ T36] audit: type=1400 audit(1794136380.689:65): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="cgroup2" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.233669][ T287] cgroup: Unknown subsys name 'net' [ 19.260650][ T36] audit: type=1400 audit(1794136380.709:66): avc: denied { unmount } for pid=287 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=filesystem permissive=1 [ 19.260772][ T287] cgroup: Unknown subsys name 'devices' [ 19.374072][ T287] cgroup: Unknown subsys name 'hugetlb' [ 19.379700][ T287] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 19.513165][ T36] audit: type=1400 audit(1794136380.969:67): avc: denied { setattr } for pid=287 comm="syz-executor" name="raw-gadget" dev="devtmpfs" ino=190 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 19.531870][ T289] SELinux: Context root:object_r:swapfile_t is not valid (left unmapped). [ 19.536322][ T36] audit: type=1400 audit(1794136380.969:68): avc: denied { mounton } for pid=287 comm="syz-executor" path="/proc/sys/fs/binfmt_misc" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=dir permissive=1 [ 19.553205][ T287] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 19.569543][ T36] audit: type=1400 audit(1794136380.969:69): avc: denied { mount } for pid=287 comm="syz-executor" name="/" dev="binfmt_misc" ino=1 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:binfmt_misc_fs_t tclass=filesystem permissive=1 [ 19.601634][ T36] audit: type=1400 audit(1794136380.999:70): avc: denied { relabelto } for pid=289 comm="mkswap" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.627127][ T36] audit: type=1400 audit(1794136380.999:71): avc: denied { write } for pid=289 comm="mkswap" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.652999][ T36] audit: type=1400 audit(1794136381.009:72): avc: denied { read } for pid=287 comm="syz-executor" name="swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 19.678582][ T36] audit: type=1400 audit(1794136381.009:73): avc: denied { open } for pid=287 comm="syz-executor" path="/root/swap-file" dev="sda1" ino=2026 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 trawcon="root:object_r:swapfile_t" [ 20.509243][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.516377][ T297] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.523673][ T297] bridge_slave_0: entered allmulticast mode [ 20.529873][ T297] bridge_slave_0: entered promiscuous mode [ 20.545143][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.552313][ T295] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.559374][ T295] bridge_slave_0: entered allmulticast mode [ 20.565805][ T295] bridge_slave_0: entered promiscuous mode [ 20.572041][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.579125][ T297] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.586261][ T297] bridge_slave_1: entered allmulticast mode [ 20.592509][ T297] bridge_slave_1: entered promiscuous mode [ 20.607937][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.615019][ T295] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.622081][ T295] bridge_slave_1: entered allmulticast mode [ 20.628377][ T295] bridge_slave_1: entered promiscuous mode [ 20.661544][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.668696][ T294] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.676188][ T294] bridge_slave_0: entered allmulticast mode [ 20.682568][ T294] bridge_slave_0: entered promiscuous mode [ 20.694741][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.701781][ T294] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.709111][ T294] bridge_slave_1: entered allmulticast mode [ 20.715421][ T294] bridge_slave_1: entered promiscuous mode [ 20.757934][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.765259][ T296] bridge0: port 1(bridge_slave_0) entered disabled state [ 20.772398][ T296] bridge_slave_0: entered allmulticast mode [ 20.778552][ T296] bridge_slave_0: entered promiscuous mode [ 20.787747][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.794892][ T296] bridge0: port 2(bridge_slave_1) entered disabled state [ 20.801970][ T296] bridge_slave_1: entered allmulticast mode [ 20.808300][ T296] bridge_slave_1: entered promiscuous mode [ 20.916732][ T297] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.923805][ T297] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.931088][ T297] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.938152][ T297] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.950047][ T295] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.957136][ T295] bridge0: port 2(bridge_slave_1) entered forwarding state [ 20.964394][ T295] bridge0: port 1(bridge_slave_0) entered blocking state [ 20.971398][ T295] bridge0: port 1(bridge_slave_0) entered forwarding state [ 20.987778][ T294] bridge0: port 2(bridge_slave_1) entered blocking state [ 20.994848][ T294] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.002148][ T294] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.009197][ T294] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.044080][ T296] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.051151][ T296] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.058455][ T296] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.065577][ T296] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.077440][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.084712][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.091849][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.099498][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.106945][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.114306][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.121487][ T46] bridge0: port 1(bridge_slave_0) entered disabled state [ 21.128761][ T46] bridge0: port 2(bridge_slave_1) entered disabled state [ 21.146773][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.153831][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.161424][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.168481][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.183457][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.190488][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.198459][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.205501][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.234072][ T13] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.241121][ T13] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.248722][ T13] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.255781][ T13] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.275931][ T46] bridge0: port 1(bridge_slave_0) entered blocking state [ 21.283000][ T46] bridge0: port 1(bridge_slave_0) entered forwarding state [ 21.295339][ T297] veth0_vlan: entered promiscuous mode [ 21.307417][ T46] bridge0: port 2(bridge_slave_1) entered blocking state [ 21.314489][ T46] bridge0: port 2(bridge_slave_1) entered forwarding state [ 21.335649][ T297] veth1_macvtap: entered promiscuous mode [ 21.344596][ T294] veth0_vlan: entered promiscuous mode [ 21.366692][ T295] veth0_vlan: entered promiscuous mode [ 21.378732][ T294] veth1_macvtap: entered promiscuous mode [ 21.404658][ T296] veth0_vlan: entered promiscuous mode [ 21.420681][ T295] veth1_macvtap: entered promiscuous mode [ 21.433858][ T297] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 21.451074][ T296] veth1_macvtap: entered promiscuous mode [ 21.489148][ T315] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 21.538056][ T326] overlayfs: failed to resolve './bus': -2 [ 21.757090][ T350] overlayfs: conflicting lowerdir path [ 21.772414][ T63] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 21.782447][ T31] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 21.952716][ T63] usb 2-1: Using ep0 maxpacket: 16 [ 21.959030][ T31] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 21.969324][ T63] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 21.981008][ T31] usb 3-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 21.994365][ T63] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 22.017071][ T63] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 22.030273][ T63] usb 2-1: New USB device found, idVendor=054c, idProduct=03d5, bcdDevice= 0.00 [ 22.042476][ T63] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 22.050583][ T31] usb 3-1: New USB device found, idVendor=04dd, idProduct=8005, bcdDevice= 0.00 [ 22.060033][ T31] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 22.068704][ T31] usb 3-1: Product: syz [ 22.074025][ T63] usb 2-1: config 0 descriptor?? [ 22.079619][ T377] Zero length message leads to an empty skb [ 22.081887][ T31] usb 3-1: Manufacturer: syz [ 22.091161][ T31] usb 3-1: SerialNumber: syz [ 22.101342][ T31] usb 3-1: unsupported MDLM descriptors [ 22.328749][ T31] usb 3-1: USB disconnect, device number 2 [ 22.489002][ T63] input: HID 054c:03d5 as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:054C:03D5.0001/input/input4 [ 22.510065][ T63] sony 0003:054C:03D5.0001: input,hidraw0: USB HID v0.00 Joystick [HID 054c:03d5] on usb-dummy_hcd.1-1/input0 [ 22.632286][ T324] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 22.762286][ T324] usb 4-1: device descriptor read/64, error -71 [ 23.002288][ T324] usb 4-1: device descriptor read/64, error -71 [ 23.122733][ T311] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 23.242254][ T324] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 23.252294][ T311] usb 1-1: device descriptor read/64, error -71 [ 23.372341][ T324] usb 4-1: device descriptor read/64, error -71 [ 23.492308][ T311] usb 1-1: device descriptor read/64, error -71 [ 23.613036][ T324] usb 4-1: device descriptor read/64, error -71 [ 23.722497][ T324] usb usb4-port1: attempt power cycle [ 23.732349][ T311] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 23.862273][ T311] usb 1-1: device descriptor read/64, error -71 [ 24.062406][ T324] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 24.083675][ T324] usb 4-1: device descriptor read/8, error -71 [ 24.102297][ T311] usb 1-1: device descriptor read/64, error -71 [ 24.212360][ T31] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 24.220792][ T324] usb 4-1: device descriptor read/8, error -71 [ 24.222351][ T311] usb usb1-port1: attempt power cycle [ 24.363522][ T31] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x81 has invalid maxpacket 64 [ 24.373408][ T31] usb 3-1: config 1 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 64 [ 24.383168][ T31] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 24.394051][ T31] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x83 has invalid wMaxPacketSize 0 [ 24.403895][ T31] usb 3-1: New USB device found, idVendor=067b, idProduct=2303, bcdDevice= 1.00 [ 24.413059][ T31] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 24.421961][ T414] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 24.429291][ T414] raw-gadget.3 gadget.2: fail, usb_ep_enable returned -22 [ 24.437177][ T31] pl2303 3-1:1.0: pl2303 converter detected [ 24.444366][ T31] usb 3-1: pl2303 converter now attached to ttyUSB0 [ 24.472266][ T324] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 24.493249][ T324] usb 4-1: device descriptor read/8, error -71 [ 24.503458][ T388] usb 2-1: USB disconnect, device number 2 [ 24.516042][ T36] kauditd_printk_skb: 56 callbacks suppressed [ 24.516059][ T36] audit: type=1400 audit(1794136385.969:130): avc: denied { read write } for pid=415 comm="syz.1.18" name="control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 24.519631][ T416] ================================================================== [ 24.522815][ T36] audit: type=1400 audit(1794136385.969:131): avc: denied { open } for pid=415 comm="syz.1.18" path="/dev/mapper/control" dev="devtmpfs" ino=198 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 24.545485][ T416] BUG: KASAN: slab-use-after-free in snapshot_ctr+0x586/0x1350 [ 24.545515][ T416] Read of size 8 at addr ffff8881142d1c98 by task syz.1.18/416 [ 24.545530][ T416] [ 24.545543][ T416] CPU: 1 UID: 0 PID: 416 Comm: syz.1.18 Not tainted syzkaller #0 ff996278633adec6fd25d1632b496761701c4fe9 [ 24.545565][ T416] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/15/2026 [ 24.545584][ T416] Call Trace: [ 24.545592][ T416] [ 24.545599][ T416] __dump_stack+0x21/0x30 [ 24.545618][ T416] dump_stack_lvl+0x140/0x1c0 [ 24.545634][ T416] ? __cfi_dump_stack_lvl+0x10/0x10 [ 24.545651][ T416] ? __cfi__printk+0x10/0x10 [ 24.545674][ T416] print_address_description+0x71/0x210 [ 24.545691][ T416] print_report+0x4a/0x70 [ 24.545706][ T416] kasan_report+0x162/0x1a0 [ 24.545725][ T416] ? snapshot_ctr+0x586/0x1350 [ 24.545744][ T416] ? snapshot_ctr+0x586/0x1350 [ 24.545763][ T416] __asan_report_load8_noabort+0x18/0x20 [ 24.545785][ T416] snapshot_ctr+0x586/0x1350 [ 24.545804][ T416] ? dm_split_args+0xa1/0x740 [ 24.545820][ T416] ? __cfi_snapshot_ctr+0x10/0x10 [ 24.545839][ T416] ? dm_split_args+0x5d0/0x740 [ 24.545856][ T416] dm_table_add_target+0x59f/0xcb0 [ 24.545874][ T416] table_load+0x2eb/0x7d0 [ 24.545896][ T416] ? __check_object_size+0x99/0x870 [ 24.545920][ T416] ? __cfi_table_load+0x10/0x10 [ 24.545942][ T416] ? __kasan_check_write+0x18/0x20 [ 24.545964][ T416] ? __cfi_table_load+0x10/0x10 [ 24.545984][ T416] dm_ctl_ioctl+0x8f3/0xde0 [ 24.546007][ T416] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 24.546031][ T416] ? __fget_files+0x2bc/0x330 [ 24.546049][ T416] ? bpf_lsm_file_ioctl+0xd/0x20 [ 24.546068][ T416] ? security_file_ioctl+0x3e/0x110 [ 24.546091][ T416] ? __cfi_dm_ctl_ioctl+0x10/0x10 [ 24.546111][ T416] __se_sys_ioctl+0x123/0x1b0 [ 24.546130][ T416] __x64_sys_ioctl+0x7f/0xa0 [ 24.546147][ T416] x64_sys_call+0x1878/0x2ee0 [ 24.546165][ T416] do_syscall_64+0x57/0xf0 [ 24.546182][ T416] ? clear_bhb_loop+0x50/0xa0 [ 24.546204][ T416] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.546230][ T416] RIP: 0033:0x7f722b99fb19 [ 24.546250][ T416] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48 [ 24.546263][ T416] RSP: 002b:00007f722c7ac028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 24.546286][ T416] RAX: ffffffffffffffda RBX: 00007f722bc25fa0 RCX: 00007f722b99fb19 [ 24.546300][ T416] RDX: 0000200000000440 RSI: 00000000c138fd09 RDI: 0000000000000003 [ 24.546311][ T416] RBP: 00007f722ba37b70 R08: 0000000000000000 R09: 0000000000000000 [ 24.546322][ T416] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 24.546333][ T416] R13: 00007f722bc26038 R14: 00007f722bc25fa0 R15: 00007fff08bdb2b8 [ 24.546348][ T416] [ 24.546354][ T416] [ 24.553718][ T36] audit: type=1400 audit(1794136385.969:132): avc: denied { ioctl } for pid=415 comm="syz.1.18" path="/dev/mapper/control" dev="devtmpfs" ino=198 ioctlcmd=0xfd03 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1 [ 24.577358][ T416] Allocated by task 416: [ 24.577372][ T416] kasan_save_track+0x3e/0x80 [ 24.577409][ T416] kasan_save_alloc_info+0x3a/0x50 [ 24.587983][ T311] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 24.592539][ T416] __kasan_kmalloc+0x96/0xb0 [ 24.592565][ T416] __kmalloc_cache_node_noprof+0x225/0x430 [ 24.595475][ T36] audit: type=1400 audit(1794136385.969:133): avc: denied { create } for pid=415 comm="syz.1.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 24.606128][ T416] dm_get_table_device+0x1e3/0x6c0 [ 24.606154][ T416] dm_get_device+0x32b/0x7f0 [ 24.606167][ T416] snapshot_ctr+0x292/0x1350 [ 24.606183][ T416] dm_table_add_target+0x59f/0xcb0 [ 24.606196][ T416] table_load+0x2eb/0x7d0 [ 24.616406][ T36] audit: type=1400 audit(1794136385.969:134): avc: denied { connect } for pid=415 comm="syz.1.18" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=can_socket permissive=1 [ 24.619503][ T416] dm_ctl_ioctl+0x8f3/0xde0 [ 24.633411][ T311] usb 1-1: device descriptor read/8, error -71 [ 24.636533][ T416] __se_sys_ioctl+0x123/0x1b0 [ 24.636561][ T416] __x64_sys_ioctl+0x7f/0xa0 [ 24.636578][ T416] x64_sys_call+0x1878/0x2ee0 [ 24.833453][ T311] usb 1-1: device descriptor read/8, error -71 [ 24.840935][ T416] do_syscall_64+0x57/0xf0 [ 24.840968][ T416] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 24.840990][ T416] [ 24.840994][ T416] Freed by task 416: [ 25.020035][ T416] kasan_save_track+0x3e/0x80 [ 25.024711][ T416] kasan_save_free_info+0x44/0x50 [ 25.029728][ T416] __kasan_slab_free+0x5f/0x80 [ 25.034490][ T416] kfree+0x158/0x440 [ 25.038371][ T416] dm_put_table_device+0x298/0x2e0 [ 25.043465][ T416] dm_get_device+0x571/0x7f0 [ 25.048038][ T416] snapshot_ctr+0x435/0x1350 [ 25.052608][ T416] dm_table_add_target+0x59f/0xcb0 [ 25.057698][ T416] table_load+0x2eb/0x7d0 [ 25.062023][ T416] dm_ctl_ioctl+0x8f3/0xde0 [ 25.066510][ T416] __se_sys_ioctl+0x123/0x1b0 [ 25.071167][ T416] __x64_sys_ioctl+0x7f/0xa0 [ 25.075732][ T416] x64_sys_call+0x1878/0x2ee0 [ 25.080387][ T416] do_syscall_64+0x57/0xf0 [ 25.084782][ T416] entry_SYSCALL_64_after_hwframe+0x76/0x7e [ 25.090654][ T416] [ 25.092955][ T416] The buggy address belongs to the object at ffff8881142d1c80 [ 25.092955][ T416] which belongs to the cache kmalloc-96 of size 96 [ 25.106813][ T416] The buggy address is located 24 bytes inside of [ 25.106813][ T416] freed 96-byte region [ffff8881142d1c80, ffff8881142d1ce0) [ 25.120415][ T416] [ 25.122722][ T416] The buggy address belongs to the physical page: [ 25.129133][ T416] page: refcount:1 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x1142d1 [ 25.137962][ T416] flags: 0x4000000000000000(zone=1) [ 25.143141][ T416] page_type: f5(slab) [ 25.147127][ T416] raw: 4000000000000000 ffff888100041280 dead000000000122 0000000000000000 [ 25.155687][ T416] raw: 0000000000000000 0000000080200020 00000001f5000000 0000000000000000 [ 25.164259][ T416] page dumped because: kasan: bad access detected [ 25.170666][ T416] page_owner tracks the page as allocated [ 25.176362][ T416] page last allocated via order 0, migratetype Unmovable, gfp_mask 0x152cc0(GFP_USER|__GFP_NOWARN|__GFP_NORETRY|__GFP_COMP), pid 323, tgid 323 (udevd), ts 24455355004, free_ts 24454599864 [ 25.194747][ T416] post_alloc_hook+0x37d/0x3b0 [ 25.199501][ T416] prep_new_page+0x2d/0x180 [ 25.202294][ T311] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 25.203989][ T416] get_page_from_freelist+0x4aea/0x4ba0 [ 25.204015][ T416] __alloc_pages_noprof+0x35a/0x7e0 [ 25.214646][ T36] audit: type=1400 audit(1794136386.659:135): avc: denied { read } for pid=93 comm="syslogd" name="log" dev="sda1" ino=2010 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:var_t tclass=lnk_file permissive=1 [ 25.216983][ T416] alloc_slab_page+0x6b/0x1e0 [ 25.222490][ T36] audit: type=1400 audit(1794136386.659:136): avc: denied { search } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.243825][ T416] allocate_slab+0x69/0x430 [ 25.243848][ T416] ___slab_alloc+0x591/0x8c0 [ 25.243863][ T416] __kmalloc_node_noprof+0x2e7/0x500 [ 25.243885][ T416] __kvmalloc_node_noprof+0x128/0x300 [ 25.249020][ T36] audit: type=1400 audit(1794136386.659:137): avc: denied { write } for pid=93 comm="syslogd" name="/" dev="tmpfs" ino=1 scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.269762][ T416] simple_xattr_alloc+0x67/0x140 [ 25.269785][ T416] shmem_initxattrs+0x24f/0x530 [ 25.269803][ T416] security_inode_init_security+0x431/0x600 [ 25.274819][ T36] audit: type=1400 audit(1794136386.659:138): avc: denied { add_name } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1 [ 25.278859][ T416] shmem_mknod+0xd5/0x200 [ 25.278885][ T416] shmem_create+0x38/0x50 [ 25.284563][ T36] audit: type=1400 audit(1794136386.659:139): avc: denied { create } for pid=93 comm="syslogd" name="messages" scontext=system_u:system_r:syslogd_t tcontext=system_u:object_r:tmpfs_t tclass=file permissive=1 [ 25.289496][ T416] path_openat+0x150b/0x35a0 [ 25.289519][ T416] do_filp_open+0x1f2/0x440 [ 25.310793][ T311] usb 1-1: device descriptor read/8, error -71 [ 25.315609][ T416] page last free pid 323 tgid 323 stack trace: [ 25.315625][ T416] free_unref_page+0xb99/0xf50 [ 25.397611][ T419] /dev/sr0: Can't lookup blockdev [ 25.401827][ T416] __free_pages+0x6b/0x3b0 [ 25.401857][ T416] __free_slab+0xb2/0x110 [ 25.410279][ T419] netlink: 'syz.3.19': attribute type 49 has an invalid length. [ 25.411276][ T416] free_slab+0x18/0xe0 [ 25.427248][ T416] discard_slab+0x23/0x40 [ 25.431580][ T416] __slab_free+0x1fd/0x2a0 [ 25.435982][ T416] ___cache_free+0xc9/0xe0 [ 25.440410][ T416] qlist_free_all+0xb5/0x130 [ 25.444984][ T416] kasan_quarantine_reduce+0x14f/0x180 [ 25.450516][ T416] __kasan_slab_alloc+0x28/0x90 [ 25.455349][ T416] kmem_cache_alloc_noprof+0x1bf/0x410 [ 25.460796][ T416] prepare_creds+0x47/0x6b0 [ 25.465301][ T416] selinux_lsm_setattr+0x216/0x8e0 [ 25.470395][ T416] selinux_setprocattr+0x53/0x70 [ 25.475314][ T416] security_setprocattr+0x35b/0x380 [ 25.480610][ T416] proc_pid_attr_write+0x2aa/0x310 [ 25.485706][ T416] [ 25.488009][ T416] Memory state around the buggy address: [ 25.493614][ T416] ffff8881142d1b80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 25.501656][ T416] ffff8881142d1c00: 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc [ 25.503263][ T311] usb 1-1: device descriptor read/8, error -71 [ 25.509702][ T416] >ffff8881142d1c80: fa fb fb fb fb fb fb fb fb fb fb fb fc fc fc fc [ 25.509713][ T416] ^ [ 25.509723][ T416] ffff8881142d1d00: 00 00 00 00 00 00 00 00 00 fc fc fc fc fc fc fc [ 25.509734][ T416] ffff8881142d1d80: 00 00 00 00 00 00 00 00 03 fc fc fc fc fc fc fc [ 25.544851][ T416] ================================================================== [ 25.556736][ T416] Disabling lock debugging due to kernel taint [ 25.562949][ T416] device-mapper: table: 252:0: device 1:2 not in table devices list [ 25.570948][ T416] device-mapper: table: 252:0: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 25.583503][ T416] device-mapper: ioctl: error adding target to table [ 25.590279][ T416] device-mapper: table: 252:0: dm_table_destroy: dm_put_device call missing for 1:2 [ 25.599762][ T324] usb 4-1: device descriptor read/8, error -71 [ 25.611358][ T419] team_slave_1: entered promiscuous mode [ 25.617228][ T311] usb usb1-port1: unable to enumerate USB device [ 25.623937][ T419] team_slave_1: entered allmulticast mode [ 25.642664][ T416] device-mapper: ioctl: The device has no table. [ 25.649738][ T416] device-mapper: table: 252:0: device 1:2 not in table devices list [ 25.660423][ T427] device-mapper: ioctl: The device has no table. [ 25.667536][ T426] device-mapper: ioctl: Invalid ioctl structure: name syzb0, dev fc00 [ 25.671885][ T416] device-mapper: table: 252:0: snapshot-merge: COW device cannot be the same as origin device (-EINVAL) [ 25.688469][ T416] device-mapper: ioctl: error adding target to table [ 25.703608][ T416] device-mapper: table: 252:0: dm_table_destroy: dm_put_device call missing for 1:2 [ 25.713308][ T324] usb usb4-port1: unable to enumerate USB device [ 25.722419][ T414] pl2303 ttyUSB0: pl2303_get_line_request - failed: -110 [ 25.729805][ T414] pl2303 ttyUSB0: pl2303_set_line_request - failed: -32 [ 25.744037][ T414] pl2303 3-1:1.0: pl2303_vendor_read - failed to read [000a]: -32 [ 25.760378][ T414] pl2303 ttyUSB0: failed to submit interrupt urb: -90 [ 25.859852][ T414] SELinux: policydb magic number 0xb65 does not match expected magic number 0xf97cff8c [ 25.869674][ T414] SELinux: failed to load policy [ 25.878497][ T10] usb 3-1: USB disconnect, device number 3 [ 25.885124][ T10] pl2303 ttyUSB0: pl2303 converter now disconnected from ttyUSB0 [ 25.893148][ T10] pl2303 3-1:1.0: device disconnected