Extracting prog: 54m36.656888857s Minimizing prog: 1h4m38.723222637s Simplifying prog options: 0s Extracting C: 57.012202816s Simplifying C: 11m25.317442667s extracting reproducer from 21 programs testing a last program of every proc single: executing 4 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS-syz_usb_control_io$uac1-syz_usb_control_io detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$hid-syz_usb_control_io-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-socket$nl_generic-syz_genetlink_get_family_id$ethtool-sendmsg$ETHTOOL_MSG_DEBUG_SET-syz_usb_control_io$cdc_ncm-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$cdc_ecm detailed listing: executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): fsopen-fsconfig$FSCONFIG_CMD_CREATE-socket-listen-connect$phonet_pipe-fsmount-fchdir-syz_init_net_socket$bt_hci-ioctl$BTRFS_IOC_SUBVOL_GETFLAGS-bind$bt_hci-openat$ptmx-ioctl$KVM_SET_XSAVE-memfd_create-fcntl$addseals-ioctl$FS_IOC_RESVSP-ioctl$TIOCSETD-openat-setrlimit-truncate-finit_module-ioctl$TCFLSH-socket-socket-setsockopt-close-openat$dir-lseek-getdents64-syz_usb_connect$cdc_ecm detailed listing: executing program 0: r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x23, 0x80805, 0x0) listen(r1, 0x0) connect$phonet_pipe(r1, &(0x7f0000000080)={0x23, 0x0, 0x8, 0xaa}, 0x10) r2 = fsmount(r0, 0x0, 0xa) fchdir(r2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r2, 0x80089419, &(0x7f0000000080)) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000001500)={[0xc, 0xb427, 0x1, 0x6, 0x7, 0x0, 0x4, 0x2, 0x5, 0x4, 0xc, 0x2, 0x0, 0xd, 0x3, 0x7, 0x9, 0xeb8, 0x7fffffff, 0xf, 0x7e, 0x7fffffff, 0x9, 0x8001, 0x2fd, 0x6, 0x6, 0x1, 0x1, 0x9, 0xaf, 0x9, 0x800, 0x6fbea62c, 0xcc0, 0xffff8001, 0x81, 0x1, 0xd, 0x6, 0x8, 0xfffffff4, 0x1, 0x4800, 0x4, 0x2, 0x5, 0xfffffffd, 0x8, 0x8, 0x3ff, 0xe, 0xfffffff9, 0x2, 0xffff578d, 0xc, 0x1, 0x4, 0x8, 0xb5d, 0x2c3, 0x400000, 0x7, 0x1ff, 0xf, 0x9, 0x10, 0x5, 0x3c82, 0x8, 0x100, 0x6, 0x0, 0x1, 0x7, 0x6, 0xfffffffb, 0x7, 0x3ff, 0x10, 0xb69, 0x59, 0x1, 0xd7, 0x4, 0x2, 0x74c, 0x5, 0xdef, 0x5, 0x8, 0xfffff683, 0x7, 0x101, 0x10, 0xc, 0x5, 0x4, 0x9, 0x28febf19, 0x5, 0xfff, 0x80, 0x8, 0x7ff, 0x9, 0x5, 0x3, 0x1, 0x800, 0x3, 0x8, 0x80000000, 0x5, 0x3, 0x7, 0x5, 0x1, 0xff, 0x7, 0x1e00000, 0x3, 0x5, 0x6, 0xd, 0x6f0, 0x0, 0x1, 0x8000, 0x401, 0xe5a8, 0x80000000, 0x9, 0xd4c4, 0x3ff, 0x3, 0x9, 0x714, 0x2, 0x9, 0x9, 0x78a223e7, 0x6f4f, 0x1, 0x1, 0x3, 0x3, 0x8e000, 0x1000, 0xc, 0x6, 0xfffffffa, 0x3, 0x9783, 0x2, 0x1, 0x3, 0x3, 0x97d, 0x1000, 0x0, 0x4, 0x4, 0xb, 0x1, 0x8, 0x3, 0x3, 0x7fffffff, 0x5, 0x7, 0x80000001, 0x7, 0x2, 0x5, 0x2, 0x1, 0x40, 0x3, 0x5, 0x7a7, 0x9, 0x10000, 0x1, 0x9, 0x200, 0x4, 0x8, 0x3, 0x8, 0x7a4b, 0x0, 0x4, 0x2, 0x0, 0xfffff800, 0x1, 0x4, 0x8, 0xfff, 0x5, 0x7, 0x6, 0x80000000, 0x2, 0x40, 0x7c6d459f, 0x0, 0x2, 0x7, 0x7, 0x400, 0x7fffffff, 0x80000001, 0xfffffffe, 0x5, 0x0, 0x1, 0x399, 0x0, 0xe87, 0x7fff, 0x77c2, 0xffffff80, 0x5, 0x84b8, 0x80, 0x1, 0x6, 0x0, 0x29f4cc21, 0x0, 0x8, 0x8001, 0x4ec, 0x9, 0x7fffffff, 0x2, 0xc5f, 0xc59, 0x236, 0x3, 0x4, 0x6, 0x8, 0xfffffffc, 0x9, 0x4, 0x6, 0x8, 0xd, 0x3c, 0x5, 0x3, 0x0, 0x84, 0x53d, 0xffff49f5, 0xb3, 0x100000, 0x6, 0x2, 0xe, 0x3ff, 0x4, 0xf1, 0x5, 0x2, 0x8000, 0xf7, 0x7fff, 0x7fff, 0x2, 0xbb0, 0x8, 0x8, 0x4, 0xf, 0x7fff, 0xfffffffe, 0x2, 0x7, 0x7ff, 0x6, 0xfffffff8, 0x0, 0x80, 0x10001, 0x989, 0xfff, 0x9, 0x9, 0x4, 0x5, 0x9, 0x1000, 0x2, 0x101, 0x7ff, 0x2, 0x0, 0x347dfd5e, 0x10001, 0x9, 0x5a3, 0x9, 0x3, 0x8, 0x7, 0x66, 0x3, 0x0, 0x9, 0x1, 0xffffffb5, 0x7, 0x53ad, 0x4, 0x5, 0x2, 0x2, 0x5cc6, 0x3, 0x5, 0xb72c, 0x2, 0x1, 0x38cc, 0xb2fd, 0x2, 0x7ff, 0x5, 0x6, 0x6, 0x3, 0x3, 0x9, 0x7, 0x5, 0x3, 0x1c45, 0x98, 0x0, 0xb, 0x6, 0x6, 0xc, 0x3, 0x1ff, 0xca, 0x7, 0x47, 0xcc, 0x1ff, 0x7, 0x2, 0x81, 0x5, 0x2, 0x0, 0x9, 0x1, 0x3, 0x5, 0x80000000, 0x7ee0, 0x9, 0xffffff1b, 0x5, 0x5, 0x5, 0x2, 0x80000000, 0x8, 0xfffffff9, 0x5, 0x8, 0x9, 0xc1b4, 0xaf4, 0x8, 0x9, 0x38000000, 0x9, 0x6, 0x9, 0x0, 0x40, 0x0, 0xfffffffb, 0xfffff41d, 0x3, 0x2, 0x9, 0x6a, 0x9, 0x1, 0x9, 0x6bad8, 0xb87b, 0x1, 0x4, 0x3, 0x6, 0x4ab9, 0x5, 0x1000, 0x5, 0x2000000, 0x82, 0x5, 0x6166, 0x0, 0x0, 0x9, 0x5, 0x9, 0xfffffffc, 0x2, 0xffff, 0x8000, 0x6, 0x8, 0x7, 0xfffffff8, 0x0, 0x9, 0x4, 0xb, 0x5, 0x5626, 0xb, 0x80000001, 0x6, 0x101, 0x401, 0x8001, 0x3ff, 0x7, 0x9, 0xb9, 0x0, 0x5, 0x6, 0x8, 0x6, 0x6, 0x9, 0x3ff, 0xab, 0xfffffffe, 0x1000, 0x2, 0x40, 0x3, 0x8, 0x6, 0x0, 0x9, 0x9, 0xe38, 0x3ff, 0x2db, 0x1, 0x4, 0x96c0, 0x10, 0x5, 0x9, 0x3, 0x10001, 0x8, 0x1, 0x8, 0x7fff, 0xff, 0xd386, 0x7, 0x6, 0x0, 0x1, 0x8001, 0x7, 0x8000, 0x5, 0x2, 0x3, 0x3, 0xfffffffc, 0x4, 0x24, 0xa, 0x3, 0x6, 0x81, 0x6b71, 0xc, 0x1, 0x6, 0xbd, 0xde9c, 0x1000, 0x401, 0x9, 0x3, 0x5, 0x100, 0x7, 0x28, 0x7, 0x6, 0x200, 0x8e1, 0x6, 0x101, 0x1, 0xf40c, 0x8000, 0x800, 0x2, 0x1, 0x0, 0x7f7f, 0x4, 0x322, 0x3, 0xfffffffe, 0x7fff, 0x0, 0x7fffffff, 0xff, 0x5, 0x1, 0x0, 0x1, 0x4, 0x3, 0x401, 0x1, 0x9, 0x9, 0x6c7d, 0x8, 0x3, 0x4, 0x5d9, 0x80000001, 0x3, 0x9, 0x10, 0x9, 0x8c, 0x9, 0x0, 0x0, 0xff, 0x2, 0xfe41, 0x9, 0x2, 0x2, 0x6, 0x9f2, 0x4, 0x2, 0x924, 0x6, 0x8, 0x721, 0x7e1bfacc, 0xb51, 0x401, 0xfffffff9, 0x4, 0xffffff72, 0x7, 0x100, 0x3, 0x7, 0x9, 0x27, 0x7, 0x6, 0x7f, 0x7, 0x7, 0x9, 0x7, 0x5, 0x1, 0x18, 0x81, 0x10000, 0x5, 0x1, 0x701c, 0x6, 0x81, 0x6, 0xa, 0x8, 0xe, 0x3, 0xfffffffd, 0xac, 0x13f, 0x7, 0x8, 0x1, 0xfffeffff, 0x7, 0x1, 0x2, 0x4, 0x9, 0xb3, 0x9, 0x3bdc5d0, 0xfffffffa, 0x5, 0x401, 0xa, 0x4, 0x8, 0x0, 0x3, 0x0, 0x1, 0x5, 0x3, 0x3a07bff, 0x3, 0x0, 0x2, 0x5, 0x5, 0x3, 0x3ff, 0xa, 0x6, 0x8, 0x7fffffff, 0x400, 0x1da, 0x0, 0x4cbea66d, 0x10, 0x5, 0x100, 0x90000, 0x7, 0x5, 0x3, 0x7, 0x5, 0x7, 0x6, 0x0, 0x9e63, 0x7, 0x8, 0x40, 0x2, 0x8001, 0x4, 0xa1, 0x3, 0x4, 0x400, 0x0, 0x296, 0x3, 0x74, 0x8, 0x4, 0x5, 0x1, 0x7fff, 0xed, 0x0, 0x0, 0x3d, 0x1, 0x8, 0x1, 0x9, 0x10, 0x4b, 0x6, 0x5, 0x8001, 0x8001, 0x1, 0x0, 0x900b, 0xe, 0x40, 0x491a, 0x81, 0x9, 0xa1, 0x3, 0x7, 0x5a58, 0xf, 0x5, 0x1, 0x54, 0x9, 0x200, 0xfda, 0x40, 0x7, 0x7, 0x99c, 0x6, 0x100, 0x8, 0x7fff, 0x8, 0xe927, 0x4, 0x7, 0x7, 0xf, 0x8, 0x1, 0x2, 0x4, 0x8, 0xe, 0xfffff000, 0x4, 0x8, 0x7, 0x8, 0x4, 0x81, 0x1, 0x1, 0x9, 0xe, 0xfffffff9, 0x8, 0x0, 0x1, 0x7, 0x8001, 0x81f, 0x8, 0xfffffffd, 0x56, 0x1, 0x1, 0x3ff, 0x3ff, 0x2, 0x2, 0x7, 0xfffffffa, 0x2, 0x1, 0x8, 0x3, 0x7, 0xd, 0x7fffffff, 0xb02a, 0x3, 0x4, 0x1, 0x2, 0x5, 0x16, 0x0, 0x1000, 0x6, 0xffff, 0x5, 0x4, 0xc6f0, 0x4, 0x8, 0xa, 0xb260, 0x6, 0x9, 0x9, 0x200, 0xde1, 0x81, 0x81, 0x9, 0x2, 0xd1, 0x81, 0x80000001, 0x7c78, 0x5, 0x7, 0x1c0000, 0x2, 0x4, 0x9, 0x0, 0x0, 0x2, 0xfff, 0x2, 0xffffffff, 0xb6ed, 0x1ff, 0x3, 0xf, 0x401, 0x7, 0x80000000, 0x3, 0xc, 0x7, 0x3, 0xeb8e, 0x100, 0xb2fc, 0x80000000, 0x8ec, 0x7000, 0xf4a, 0x8, 0x6, 0xd, 0x80, 0xff, 0xfff, 0x4, 0x5, 0x3, 0x6, 0x1e975a25, 0x1, 0x0, 0x100, 0x200, 0x5, 0x3, 0x7, 0x7fff, 0x6, 0x9, 0x0, 0x6, 0x10000, 0x8, 0x72, 0x8, 0xe0000000, 0x9, 0x3, 0x2, 0x2, 0xa, 0x5, 0x2, 0x2, 0xfffffffa, 0xffff, 0x4c8, 0x3, 0x6, 0x0, 0x6, 0x3000000, 0xb84, 0x8, 0x7fffffff, 0x2, 0x100000, 0xffffffff, 0x4, 0xffff, 0x5, 0x3, 0x5, 0xd2, 0x40, 0x7, 0xfffffffc, 0x7, 0x5, 0x9, 0x5, 0x9, 0xa93, 0xe, 0x8, 0x4, 0x2, 0x5, 0xff, 0x1, 0xfffffffd, 0x9, 0x3, 0x5, 0x3, 0x6, 0xff, 0xf1e, 0x81, 0x6, 0xdfa, 0x4, 0x1af, 0x80, 0x0, 0x7, 0x0, 0x8, 0x58a, 0x5, 0xd, 0x8, 0x6, 0x2b, 0xffffffff, 0x1, 0x81, 0x3, 0xf74, 0x7, 0x3, 0x80000000, 0xffffff39, 0xc, 0x2, 0x40000, 0xfffffffa, 0xafc, 0xe26, 0x80, 0x1, 0xe, 0x9, 0xf7e, 0x2339f48d, 0x0, 0x6, 0x30, 0x5, 0x80000001, 0x81, 0x6, 0xff, 0x1, 0x9, 0x101, 0x0, 0xb, 0x71d, 0x100, 0x39d, 0x80, 0xb54, 0xf2b, 0x6, 0x4, 0x1b, 0xd, 0x4, 0x10000, 0x1, 0x8, 0x9, 0x4, 0x7f, 0x2, 0x2, 0x7ff, 0x7, 0xdbcf, 0x4c, 0x5, 0x5, 0xffffffff, 0x2bef00a, 0x9, 0xc5, 0x3, 0x5, 0x6b7, 0x200, 0x3ff, 0x6, 0x355, 0x5, 0xe4, 0x2, 0x200, 0xf, 0xfffffe01, 0xfffffeff, 0x83e8, 0x5, 0x7fffffff, 0xfffffffb, 0x200, 0x8, 0xdfb, 0x5, 0x25ba, 0x80, 0x2, 0x3, 0x800, 0x2, 0x7, 0x8000, 0x0, 0x57d, 0x5, 0x7, 0x0, 0x8, 0x3ff00]}) r5 = memfd_create(&(0x7f00000007c0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xbf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\x02\x00\x00\x00\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xddW\xe6}\xc5\xa4\x8f\x98\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8\xac\x00P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\x01\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0m\xc9\x82<\xa9\xdc\xddRU\t\xe9\xbah\xb6\xb2\xea-{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DL\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9dn\x06\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96\xb71~2{@:\x97^\xbfcu9\x8c<^ll\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\xd7\x99\x19pn\xbe\xb8\f#\xe2\x8f\x02\xedk\x10\x1b\x9c\x10\xd5\xab\x95Yn\xe9\x00\xb5\xa29\xd7\xd1\bs\xd0x0\xf2F\xaam\xd8\\\x16\x98\x86\xbe\xbc|h+\t.\x0f\x1b?\xbf5\x9fW\xa7\x02\x14J\x16|TV\x1bW\xd6r\nR\x82\xe0\x88%\xfa\x1f\xae\xcb\xb5g\xd5\x9a\x17\xd2F3A\x03-\xe22\x1b\xb4\xb5\b\x8b\xe79\xbew#2\xbd`', 0x7) fcntl$addseals(r5, 0x409, 0xc) ioctl$FS_IOC_RESVSP(r5, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000002c0)=0xf) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x189040, 0x2) setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) truncate(&(0x7f0000000340)='./file1\x00', 0x20fffbfffc) finit_module(r6, 0x0, 0x1) ioctl$TCFLSH(r4, 0x400455c8, 0x0) socket(0x10, 0x3, 0x0) r7 = socket(0x11, 0x2, 0x0) setsockopt(r7, 0x107, 0x1, &(0x7f0000000000)="110000000000060000071a80010061cc", 0x10) close(0x4) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r8, 0x100, 0x1) getdents64(r8, 0x0, 0x4f) syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000020000082505a5a4400000000101090244000101000000090400000302060000052406000005242000000d240f010000000000000000000905810320000000000905820208"], 0x0) program crashed: lost connection to test machine suppressed program crash: lost connection to test machine single: failed to extract reproducer bisect: bisecting 21 programs with base timeout 30s testing program (duration=35s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 8, 30, 7, 6, 8, 27, 28, 6, 4, 29, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r0 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r1, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r0, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x22200, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x88, 0x1, 0x0, 0x3}, 0xe) shutdown(r1, 0x1) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48db4b8e1f344dc21e7f", @ANYRES16=r7, @ANYBLOB="01002cbd7010fbdbdf25050000000600010005000000080009000200000008000b000000000008000c00a80a0000140008007663616e3000"/66], 0x48}, 0x1, 0x0, 0x0, 0x402008a}, 0x30) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x5}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x18, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x20004000}, 0x240000c8) ioctl$KVM_RUN(r3, 0xae80, 0x0) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r9, 0xc01064bd, &(0x7f0000000280)={&(0x7f0000000240)='H', 0x1}) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) r10 = syz_open_dev$video4linux(&(0x7f0000000000), 0x401, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r10, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xdd2fcb245114ab72}}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000080)=0x434c, 0x8) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000040)={0x2c, 0x10, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r4}, @typed={0x8, 0x0, 0x0, 0x0, @fd}, @nested={0xc, 0x2b, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @pid}]}]}, 0x2c}], 0x1}, 0x20000000) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x36) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r5, 0x19) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r2, 0xffffffffffffffff) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_SNDMTU(r6, 0x112, 0xc, 0x0, &(0x7f0000000040)) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x29, 0x6, 0x86, 0x80000000, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, 0x80, 0x1, 0x7fff, 0xfffffe01}}) fstat(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r2, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@getpolicy={0x74, 0x15, 0x8, 0x70bd2c, 0x25dfdbff, {{@in=@broadcast, @in6=@mcast1, 0x4e22, 0x0, 0x4e22, 0x1, 0xa, 0xc0, 0x0, 0x29, r7, r8}, 0x6e6bb1}, [@lastused={0xc, 0xf, 0x1}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2c, 0x8000}}, @tfcpad={0x8, 0x16, 0x10}]}, 0x74}, 0x1, 0x0, 0x0, 0x24040004}, 0x44000) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r10 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r11, 0x10e, 0x2, &(0x7f0000000140)=0xd, 0x4) setsockopt$llc_int(r10, 0x10c, 0x7, &(0x7f0000000080)=0x3, 0x4) keyctl$setperm(0x5, r3, 0x1) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r11, &(0x7f0000000600)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000005c0)={&(0x7f00000004c0)={0xc8, r12, 0x20, 0x70bd25, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x4}, {0x8, 0x15, 0x10000}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x6}, {0x8, 0x15, 0x800}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x800000}, {0x6, 0x11, 0x4}, {0x8, 0x15, 0xe9}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4008000}, 0x40) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a1180002", 0x1f}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r13 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b9040a", 0x11}], 0x1, 0x0, 0x0, 0x7400}, 0x0) write$cgroup_subtree(r13, &(0x7f0000000580)=ANY=[], 0xfe33) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)={0x14, r9, 0x0, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x0) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f00000011c0)=ANY=[@ANYBLOB="8704040000000000fc02000000619cc0694d00000000000000ed"], 0x28) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x2, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x10a, 0xec000000, 0xcd}]}) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x134, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x32, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @random=0x4, 0x1, @void, @val, @void, @val={0x4, 0x6, {0x3, 0x7, 0x5, 0x3}}, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @beacon=[@NL80211_ATTR_BEACON_TAIL={0x4}, @NL80211_ATTR_FTM_RESPONDER={0x4}, @NL80211_ATTR_IE_ASSOC_RESP={0x4}, @NL80211_ATTR_PROBE_RESP={0x97, 0x91, "62eec47b25e9190479619aa9470cbb0a1249848a8b592af5bbe73e291b96d4c4ee63c4188d8478407afec6e69e9a1d2278954e836309be5a683a7d14647ef92a202959c68542191091404a7a0f7e58a4095801e369709588b16588f172eeadf88b85df6abed3f5254a2fb31f6f47a85607066386071ec8a417d8bd7078f21ad277fbc8a07c71ddb45cdf4d76d2d9abe597f5ef"}, @NL80211_ATTR_IE={0x1b, 0x2a, [@rann={0x7e, 0x15, {{0x0, 0x25}, 0x7, 0x13, @device_b, 0x6, 0x8001, 0x7}}]}]]}, 0x134}, 0x1, 0x0, 0x1000000}, 0x0) executing program 1: r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x23, 0x80805, 0x0) listen(r1, 0x0) connect$phonet_pipe(r1, &(0x7f0000000080)={0x23, 0x0, 0x8, 0xaa}, 0x10) r2 = fsmount(r0, 0x0, 0xa) fchdir(r2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r2, 0x80089419, &(0x7f0000000080)) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000001500)={[0xc, 0xb427, 0x1, 0x6, 0x7, 0x0, 0x4, 0x2, 0x5, 0x4, 0xc, 0x2, 0x0, 0xd, 0x3, 0x7, 0x9, 0xeb8, 0x7fffffff, 0xf, 0x7e, 0x7fffffff, 0x9, 0x8001, 0x2fd, 0x6, 0x6, 0x1, 0x1, 0x9, 0xaf, 0x9, 0x800, 0x6fbea62c, 0xcc0, 0xffff8001, 0x81, 0x1, 0xd, 0x6, 0x8, 0xfffffff4, 0x1, 0x4800, 0x4, 0x2, 0x5, 0xfffffffd, 0x8, 0x8, 0x3ff, 0xe, 0xfffffff9, 0x2, 0xffff578d, 0xc, 0x1, 0x4, 0x8, 0xb5d, 0x2c3, 0x400000, 0x7, 0x1ff, 0xf, 0x9, 0x10, 0x5, 0x3c82, 0x8, 0x100, 0x6, 0x0, 0x1, 0x7, 0x6, 0xfffffffb, 0x7, 0x3ff, 0x10, 0xb69, 0x59, 0x1, 0xd7, 0x4, 0x2, 0x74c, 0x5, 0xdef, 0x5, 0x8, 0xfffff683, 0x7, 0x101, 0x10, 0xc, 0x5, 0x4, 0x9, 0x28febf19, 0x5, 0xfff, 0x80, 0x8, 0x7ff, 0x9, 0x5, 0x3, 0x1, 0x800, 0x3, 0x8, 0x80000000, 0x5, 0x3, 0x7, 0x5, 0x1, 0xff, 0x7, 0x1e00000, 0x3, 0x5, 0x6, 0xd, 0x6f0, 0x0, 0x1, 0x8000, 0x401, 0xe5a8, 0x80000000, 0x9, 0xd4c4, 0x3ff, 0x3, 0x9, 0x714, 0x2, 0x9, 0x9, 0x78a223e7, 0x6f4f, 0x1, 0x1, 0x3, 0x3, 0x8e000, 0x1000, 0xc, 0x6, 0xfffffffa, 0x3, 0x9783, 0x2, 0x1, 0x3, 0x3, 0x97d, 0x1000, 0x0, 0x4, 0x4, 0xb, 0x1, 0x8, 0x3, 0x3, 0x7fffffff, 0x5, 0x7, 0x80000001, 0x7, 0x2, 0x5, 0x2, 0x1, 0x40, 0x3, 0x5, 0x7a7, 0x9, 0x10000, 0x1, 0x9, 0x200, 0x4, 0x8, 0x3, 0x8, 0x7a4b, 0x0, 0x4, 0x2, 0x0, 0xfffff800, 0x1, 0x4, 0x8, 0xfff, 0x5, 0x7, 0x6, 0x80000000, 0x2, 0x40, 0x7c6d459f, 0x0, 0x2, 0x7, 0x7, 0x400, 0x7fffffff, 0x80000001, 0xfffffffe, 0x5, 0x0, 0x1, 0x399, 0x0, 0xe87, 0x7fff, 0x77c2, 0xffffff80, 0x5, 0x84b8, 0x80, 0x1, 0x6, 0x0, 0x29f4cc21, 0x0, 0x8, 0x8001, 0x4ec, 0x9, 0x7fffffff, 0x2, 0xc5f, 0xc59, 0x236, 0x3, 0x4, 0x6, 0x8, 0xfffffffc, 0x9, 0x4, 0x6, 0x8, 0xd, 0x3c, 0x5, 0x3, 0x0, 0x84, 0x53d, 0xffff49f5, 0xb3, 0x100000, 0x6, 0x2, 0xe, 0x3ff, 0x4, 0xf1, 0x5, 0x2, 0x8000, 0xf7, 0x7fff, 0x7fff, 0x2, 0xbb0, 0x8, 0x8, 0x4, 0xf, 0x7fff, 0xfffffffe, 0x2, 0x7, 0x7ff, 0x6, 0xfffffff8, 0x0, 0x80, 0x10001, 0x989, 0xfff, 0x9, 0x9, 0x4, 0x5, 0x9, 0x1000, 0x2, 0x101, 0x7ff, 0x2, 0x0, 0x347dfd5e, 0x10001, 0x9, 0x5a3, 0x9, 0x3, 0x8, 0x7, 0x66, 0x3, 0x0, 0x9, 0x1, 0xffffffb5, 0x7, 0x53ad, 0x4, 0x5, 0x2, 0x2, 0x5cc6, 0x3, 0x5, 0xb72c, 0x2, 0x1, 0x38cc, 0xb2fd, 0x2, 0x7ff, 0x5, 0x6, 0x6, 0x3, 0x3, 0x9, 0x7, 0x5, 0x3, 0x1c45, 0x98, 0x0, 0xb, 0x6, 0x6, 0xc, 0x3, 0x1ff, 0xca, 0x7, 0x47, 0xcc, 0x1ff, 0x7, 0x2, 0x81, 0x5, 0x2, 0x0, 0x9, 0x1, 0x3, 0x5, 0x80000000, 0x7ee0, 0x9, 0xffffff1b, 0x5, 0x5, 0x5, 0x2, 0x80000000, 0x8, 0xfffffff9, 0x5, 0x8, 0x9, 0xc1b4, 0xaf4, 0x8, 0x9, 0x38000000, 0x9, 0x6, 0x9, 0x0, 0x40, 0x0, 0xfffffffb, 0xfffff41d, 0x3, 0x2, 0x9, 0x6a, 0x9, 0x1, 0x9, 0x6bad8, 0xb87b, 0x1, 0x4, 0x3, 0x6, 0x4ab9, 0x5, 0x1000, 0x5, 0x2000000, 0x82, 0x5, 0x6166, 0x0, 0x0, 0x9, 0x5, 0x9, 0xfffffffc, 0x2, 0xffff, 0x8000, 0x6, 0x8, 0x7, 0xfffffff8, 0x0, 0x9, 0x4, 0xb, 0x5, 0x5626, 0xb, 0x80000001, 0x6, 0x101, 0x401, 0x8001, 0x3ff, 0x7, 0x9, 0xb9, 0x0, 0x5, 0x6, 0x8, 0x6, 0x6, 0x9, 0x3ff, 0xab, 0xfffffffe, 0x1000, 0x2, 0x40, 0x3, 0x8, 0x6, 0x0, 0x9, 0x9, 0xe38, 0x3ff, 0x2db, 0x1, 0x4, 0x96c0, 0x10, 0x5, 0x9, 0x3, 0x10001, 0x8, 0x1, 0x8, 0x7fff, 0xff, 0xd386, 0x7, 0x6, 0x0, 0x1, 0x8001, 0x7, 0x8000, 0x5, 0x2, 0x3, 0x3, 0xfffffffc, 0x4, 0x24, 0xa, 0x3, 0x6, 0x81, 0x6b71, 0xc, 0x1, 0x6, 0xbd, 0xde9c, 0x1000, 0x401, 0x9, 0x3, 0x5, 0x100, 0x7, 0x28, 0x7, 0x6, 0x200, 0x8e1, 0x6, 0x101, 0x1, 0xf40c, 0x8000, 0x800, 0x2, 0x1, 0x0, 0x7f7f, 0x4, 0x322, 0x3, 0xfffffffe, 0x7fff, 0x0, 0x7fffffff, 0xff, 0x5, 0x1, 0x0, 0x1, 0x4, 0x3, 0x401, 0x1, 0x9, 0x9, 0x6c7d, 0x8, 0x3, 0x4, 0x5d9, 0x80000001, 0x3, 0x9, 0x10, 0x9, 0x8c, 0x9, 0x0, 0x0, 0xff, 0x2, 0xfe41, 0x9, 0x2, 0x2, 0x6, 0x9f2, 0x4, 0x2, 0x924, 0x6, 0x8, 0x721, 0x7e1bfacc, 0xb51, 0x401, 0xfffffff9, 0x4, 0xffffff72, 0x7, 0x100, 0x3, 0x7, 0x9, 0x27, 0x7, 0x6, 0x7f, 0x7, 0x7, 0x9, 0x7, 0x5, 0x1, 0x18, 0x81, 0x10000, 0x5, 0x1, 0x701c, 0x6, 0x81, 0x6, 0xa, 0x8, 0xe, 0x3, 0xfffffffd, 0xac, 0x13f, 0x7, 0x8, 0x1, 0xfffeffff, 0x7, 0x1, 0x2, 0x4, 0x9, 0xb3, 0x9, 0x3bdc5d0, 0xfffffffa, 0x5, 0x401, 0xa, 0x4, 0x8, 0x0, 0x3, 0x0, 0x1, 0x5, 0x3, 0x3a07bff, 0x3, 0x0, 0x2, 0x5, 0x5, 0x3, 0x3ff, 0xa, 0x6, 0x8, 0x7fffffff, 0x400, 0x1da, 0x0, 0x4cbea66d, 0x10, 0x5, 0x100, 0x90000, 0x7, 0x5, 0x3, 0x7, 0x5, 0x7, 0x6, 0x0, 0x9e63, 0x7, 0x8, 0x40, 0x2, 0x8001, 0x4, 0xa1, 0x3, 0x4, 0x400, 0x0, 0x296, 0x3, 0x74, 0x8, 0x4, 0x5, 0x1, 0x7fff, 0xed, 0x0, 0x0, 0x3d, 0x1, 0x8, 0x1, 0x9, 0x10, 0x4b, 0x6, 0x5, 0x8001, 0x8001, 0x1, 0x0, 0x900b, 0xe, 0x40, 0x491a, 0x81, 0x9, 0xa1, 0x3, 0x7, 0x5a58, 0xf, 0x5, 0x1, 0x54, 0x9, 0x200, 0xfda, 0x40, 0x7, 0x7, 0x99c, 0x6, 0x100, 0x8, 0x7fff, 0x8, 0xe927, 0x4, 0x7, 0x7, 0xf, 0x8, 0x1, 0x2, 0x4, 0x8, 0xe, 0xfffff000, 0x4, 0x8, 0x7, 0x8, 0x4, 0x81, 0x1, 0x1, 0x9, 0xe, 0xfffffff9, 0x8, 0x0, 0x1, 0x7, 0x8001, 0x81f, 0x8, 0xfffffffd, 0x56, 0x1, 0x1, 0x3ff, 0x3ff, 0x2, 0x2, 0x7, 0xfffffffa, 0x2, 0x1, 0x8, 0x3, 0x7, 0xd, 0x7fffffff, 0xb02a, 0x3, 0x4, 0x1, 0x2, 0x5, 0x16, 0x0, 0x1000, 0x6, 0xffff, 0x5, 0x4, 0xc6f0, 0x4, 0x8, 0xa, 0xb260, 0x6, 0x9, 0x9, 0x200, 0xde1, 0x81, 0x81, 0x9, 0x2, 0xd1, 0x81, 0x80000001, 0x7c78, 0x5, 0x7, 0x1c0000, 0x2, 0x4, 0x9, 0x0, 0x0, 0x2, 0xfff, 0x2, 0xffffffff, 0xb6ed, 0x1ff, 0x3, 0xf, 0x401, 0x7, 0x80000000, 0x3, 0xc, 0x7, 0x3, 0xeb8e, 0x100, 0xb2fc, 0x80000000, 0x8ec, 0x7000, 0xf4a, 0x8, 0x6, 0xd, 0x80, 0xff, 0xfff, 0x4, 0x5, 0x3, 0x6, 0x1e975a25, 0x1, 0x0, 0x100, 0x200, 0x5, 0x3, 0x7, 0x7fff, 0x6, 0x9, 0x0, 0x6, 0x10000, 0x8, 0x72, 0x8, 0xe0000000, 0x9, 0x3, 0x2, 0x2, 0xa, 0x5, 0x2, 0x2, 0xfffffffa, 0xffff, 0x4c8, 0x3, 0x6, 0x0, 0x6, 0x3000000, 0xb84, 0x8, 0x7fffffff, 0x2, 0x100000, 0xffffffff, 0x4, 0xffff, 0x5, 0x3, 0x5, 0xd2, 0x40, 0x7, 0xfffffffc, 0x7, 0x5, 0x9, 0x5, 0x9, 0xa93, 0xe, 0x8, 0x4, 0x2, 0x5, 0xff, 0x1, 0xfffffffd, 0x9, 0x3, 0x5, 0x3, 0x6, 0xff, 0xf1e, 0x81, 0x6, 0xdfa, 0x4, 0x1af, 0x80, 0x0, 0x7, 0x0, 0x8, 0x58a, 0x5, 0xd, 0x8, 0x6, 0x2b, 0xffffffff, 0x1, 0x81, 0x3, 0xf74, 0x7, 0x3, 0x80000000, 0xffffff39, 0xc, 0x2, 0x40000, 0xfffffffa, 0xafc, 0xe26, 0x80, 0x1, 0xe, 0x9, 0xf7e, 0x2339f48d, 0x0, 0x6, 0x30, 0x5, 0x80000001, 0x81, 0x6, 0xff, 0x1, 0x9, 0x101, 0x0, 0xb, 0x71d, 0x100, 0x39d, 0x80, 0xb54, 0xf2b, 0x6, 0x4, 0x1b, 0xd, 0x4, 0x10000, 0x1, 0x8, 0x9, 0x4, 0x7f, 0x2, 0x2, 0x7ff, 0x7, 0xdbcf, 0x4c, 0x5, 0x5, 0xffffffff, 0x2bef00a, 0x9, 0xc5, 0x3, 0x5, 0x6b7, 0x200, 0x3ff, 0x6, 0x355, 0x5, 0xe4, 0x2, 0x200, 0xf, 0xfffffe01, 0xfffffeff, 0x83e8, 0x5, 0x7fffffff, 0xfffffffb, 0x200, 0x8, 0xdfb, 0x5, 0x25ba, 0x80, 0x2, 0x3, 0x800, 0x2, 0x7, 0x8000, 0x0, 0x57d, 0x5, 0x7, 0x0, 0x8, 0x3ff00]}) r5 = memfd_create(&(0x7f00000007c0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xbf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\x02\x00\x00\x00\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xddW\xe6}\xc5\xa4\x8f\x98\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8\xac\x00P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\x01\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0m\xc9\x82<\xa9\xdc\xddRU\t\xe9\xbah\xb6\xb2\xea-{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DL\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9dn\x06\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96\xb71~2{@:\x97^\xbfcu9\x8c<^ll\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\xd7\x99\x19pn\xbe\xb8\f#\xe2\x8f\x02\xedk\x10\x1b\x9c\x10\xd5\xab\x95Yn\xe9\x00\xb5\xa29\xd7\xd1\bs\xd0x0\xf2F\xaam\xd8\\\x16\x98\x86\xbe\xbc|h+\t.\x0f\x1b?\xbf5\x9fW\xa7\x02\x14J\x16|TV\x1bW\xd6r\nR\x82\xe0\x88%\xfa\x1f\xae\xcb\xb5g\xd5\x9a\x17\xd2F3A\x03-\xe22\x1b\xb4\xb5\b\x8b\xe79\xbew#2\xbd`', 0x7) fcntl$addseals(r5, 0x409, 0xc) ioctl$FS_IOC_RESVSP(r5, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000002c0)=0xf) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x189040, 0x2) setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) truncate(&(0x7f0000000340)='./file1\x00', 0x20fffbfffc) finit_module(r6, 0x0, 0x1) ioctl$TCFLSH(r4, 0x400455c8, 0x0) socket(0x10, 0x3, 0x0) r7 = socket(0x11, 0x2, 0x0) setsockopt(r7, 0x107, 0x1, &(0x7f0000000000)="110000000000060000071a80010061cc", 0x10) close(0x4) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r8, 0x100, 0x1) getdents64(r8, 0x0, 0x4f) syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000020000082505a5a4400000000101090244000101000000090400000302060000052406000005242000000d240f010000000000000000000905810320000000000905820208"], 0x0) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension bisect: bisecting 21 programs bisect: split chunks (needed=false): <21> bisect: split chunk #0 of len 21 into 3 parts bisect: testing without sub-chunk 1/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [6, 8, 27, 28, 6, 4, 29, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 3: sendmsg$RDMA_NLDEV_CMD_NEWLINK(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r0 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r1 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r1, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r0, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x22200, 0x0) r1 = socket$inet6_sctp(0xa, 0x1, 0x84) sendto$inet6(r1, &(0x7f0000000640)='X', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x0, 0x0, @loopback={0xfec0ffffffffffff, 0x1c9ae7fffe9a6f34}}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r1, 0x84, 0xb, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x88, 0x1, 0x0, 0x3}, 0xe) shutdown(r1, 0x1) recvmmsg(r1, &(0x7f0000000840)=[{{0x0, 0x41, 0x0}}], 0x414, 0x406, 0x0) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, &(0x7f0000000640)="430fc73f0f2390b9800000c00f3235010000000f300f20d835080000000f22d8c4e18173f53866baf80cb83879e487ef66bafc0cec66b88e008ec02d1aa80000460f1c460041ae", 0x47}], 0x1, 0x74, 0x0, 0x0) getsockopt$sock_buf(0xffffffffffffffff, 0x1, 0x0, 0x0, &(0x7f0000000240)) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x8080}, 0x20004450) r5 = socket$pppl2tp(0x18, 0x1, 0x1) r6 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, r6, {0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x20}}, 0x2}}, 0x2e) r7 = syz_genetlink_get_family_id$l2tp(&(0x7f00000008c0), 0xffffffffffffffff) r8 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$L2TP_CMD_SESSION_DELETE(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000002c0)=ANY=[@ANYBLOB="48db4b8e1f344dc21e7f", @ANYRES16=r7, @ANYBLOB="01002cbd7010fbdbdf25050000000600010005000000080009000200000008000b000000000008000c00a80a0000140008007663616e3000"/66], 0x48}, 0x1, 0x0, 0x0, 0x402008a}, 0x30) sendmsg$NFT_BATCH(r4, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000180)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_HANDLE={0xc, 0x3, 0x1, 0x0, 0x5}, @NFTA_RULE_EXPRESSIONS={0x2c, 0x4, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @payload={{0xc}, @void}}, {0x18, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x10}]}}}]}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0x80}, 0x1, 0x0, 0x0, 0x20004000}, 0x240000c8) ioctl$KVM_RUN(r3, 0xae80, 0x0) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r9, 0xc01064bd, &(0x7f0000000280)={&(0x7f0000000240)='H', 0x1}) setrlimit(0xf, &(0x7f0000000000)={0x1, 0x5}) r10 = syz_open_dev$video4linux(&(0x7f0000000000), 0x401, 0x0) ioctl$VIDIOC_SUBDEV_S_FMT(r10, 0xc0585605, &(0x7f0000000040)={0x1, 0x0, {0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0xdd2fcb245114ab72}}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000000080)=0x434c, 0x8) executing program 1: r0 = socket$inet6_udp(0xa, 0x2, 0x0) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) r3 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000040)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000b40)=[{&(0x7f0000000040)={0x2c, 0x10, 0x1, 0x0, 0x0, "", [@typed={0x8, 0x0, 0x0, 0x0, @fd=r4}, @typed={0x8, 0x0, 0x0, 0x0, @fd}, @nested={0xc, 0x2b, 0x0, 0x1, [@typed={0x8, 0x3, 0x0, 0x0, @pid}]}]}, 0x2c}], 0x1}, 0x20000000) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r1, 0x36) pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r5, 0x19) keyctl$KEYCTL_WATCH_KEY(0x20, r3, r2, 0xffffffffffffffff) r6 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$bt_BT_SNDMTU(r6, 0x112, 0xc, 0x0, &(0x7f0000000040)) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(r2, 0x89f0, &(0x7f0000000240)={'syztnl2\x00', &(0x7f00000001c0)={'syztnl0\x00', 0x0, 0x29, 0x6, 0x86, 0x80000000, 0x5, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, 0x80, 0x1, 0x7fff, 0xfffffe01}}) fstat(r1, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0}) sendmsg$nl_xfrm(r2, &(0x7f0000000400)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000003c0)={&(0x7f0000000340)=@getpolicy={0x74, 0x15, 0x8, 0x70bd2c, 0x25dfdbff, {{@in=@broadcast, @in6=@mcast1, 0x4e22, 0x0, 0x4e22, 0x1, 0xa, 0xc0, 0x0, 0x29, r7, r8}, 0x6e6bb1}, [@lastused={0xc, 0xf, 0x1}, @replay_val={0x10, 0xa, {0x70bd2c, 0x70bd2c, 0x8000}}, @tfcpad={0x8, 0x16, 0x10}]}, 0x74}, 0x1, 0x0, 0x0, 0x24040004}, 0x44000) r9 = syz_genetlink_get_family_id$l2tp(&(0x7f0000000040), 0xffffffffffffffff) r10 = syz_init_net_socket$llc(0x1a, 0x2, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_DROP_MEMBERSHIP(r11, 0x10e, 0x2, &(0x7f0000000140)=0xd, 0x4) setsockopt$llc_int(r10, 0x10c, 0x7, &(0x7f0000000080)=0x3, 0x4) keyctl$setperm(0x5, r3, 0x1) r12 = syz_genetlink_get_family_id$devlink(&(0x7f0000000480), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_SET(r11, &(0x7f0000000600)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f00000005c0)={&(0x7f00000004c0)={0xc8, r12, 0x20, 0x70bd25, 0x25dfdbff, {}, [{{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x3}}, {0x8, 0xb, 0x8}, {0x6, 0x11, 0x4}, {0x8, 0x15, 0x10000}}, {{@pci={{0x8}, {0x11}}, {0x8}}, {0x8, 0xb, 0x2}, {0x6, 0x11, 0x6}, {0x8, 0x15, 0x800}}, {{@pci={{0x8}, {0x11}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x800000}, {0x6, 0x11, 0x4}, {0x8, 0x15, 0xe9}}]}, 0xc8}, 0x1, 0x0, 0x0, 0x4008000}, 0x40) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b904021d080225000000040000a1180002", 0x1f}], 0x1, 0x0, 0x0, 0x7400}, 0x0) r13 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000440)=[{&(0x7f0000000580)="d8000000140081054e81f782db44b9040a", 0x11}], 0x1, 0x0, 0x0, 0x7400}, 0x0) write$cgroup_subtree(r13, &(0x7f0000000580)=ANY=[], 0xfe33) sendmsg$L2TP_CMD_TUNNEL_DELETE(r2, &(0x7f0000000100)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000000440)={&(0x7f0000000080)={0x14, r9, 0x0, 0x70bd2a, 0x25dfdbfd}, 0x14}, 0x1, 0x0, 0x0, 0x40010}, 0x0) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, &(0x7f00000011c0)=ANY=[@ANYBLOB="8704040000000000fc02000000619cc0694d00000000000000ed"], 0x28) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000580)={0x1ff, 0x2, 0x0, 0x1000, &(0x7f0000456000/0x1000)=nil}) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f0000000040)={0x1, 0x0, [{0x10a, 0xec000000, 0xcd}]}) executing program 1: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x134, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@beacon=[@NL80211_ATTR_BEACON_HEAD={0x32, 0xe, {{{}, {}, @broadcast, @device_a, @from_mac}, 0x0, @random=0x4, 0x1, @void, @val, @void, @val={0x4, 0x6, {0x3, 0x7, 0x5, 0x3}}, @void, @void, @void, @void, @void, @void, @void, @void, @void}}], @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @beacon=[@NL80211_ATTR_BEACON_TAIL={0x4}, @NL80211_ATTR_FTM_RESPONDER={0x4}, @NL80211_ATTR_IE_ASSOC_RESP={0x4}, @NL80211_ATTR_PROBE_RESP={0x97, 0x91, "62eec47b25e9190479619aa9470cbb0a1249848a8b592af5bbe73e291b96d4c4ee63c4188d8478407afec6e69e9a1d2278954e836309be5a683a7d14647ef92a202959c68542191091404a7a0f7e58a4095801e369709588b16588f172eeadf88b85df6abed3f5254a2fb31f6f47a85607066386071ec8a417d8bd7078f21ad277fbc8a07c71ddb45cdf4d76d2d9abe597f5ef"}, @NL80211_ATTR_IE={0x1b, 0x2a, [@rann={0x7e, 0x15, {{0x0, 0x25}, 0x7, 0x13, @device_b, 0x6, 0x8001, 0x7}}]}]]}, 0x134}, 0x1, 0x0, 0x1000000}, 0x0) executing program 1: r0 = fsopen(&(0x7f00000014c0)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = socket(0x23, 0x80805, 0x0) listen(r1, 0x0) connect$phonet_pipe(r1, &(0x7f0000000080)={0x23, 0x0, 0x8, 0xaa}, 0x10) r2 = fsmount(r0, 0x0, 0xa) fchdir(r2) r3 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r2, 0x80089419, &(0x7f0000000080)) bind$bt_hci(r3, &(0x7f0000000100)={0x1f, 0xffff}, 0x6) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$KVM_SET_XSAVE(r2, 0x5000aea5, &(0x7f0000001500)={[0xc, 0xb427, 0x1, 0x6, 0x7, 0x0, 0x4, 0x2, 0x5, 0x4, 0xc, 0x2, 0x0, 0xd, 0x3, 0x7, 0x9, 0xeb8, 0x7fffffff, 0xf, 0x7e, 0x7fffffff, 0x9, 0x8001, 0x2fd, 0x6, 0x6, 0x1, 0x1, 0x9, 0xaf, 0x9, 0x800, 0x6fbea62c, 0xcc0, 0xffff8001, 0x81, 0x1, 0xd, 0x6, 0x8, 0xfffffff4, 0x1, 0x4800, 0x4, 0x2, 0x5, 0xfffffffd, 0x8, 0x8, 0x3ff, 0xe, 0xfffffff9, 0x2, 0xffff578d, 0xc, 0x1, 0x4, 0x8, 0xb5d, 0x2c3, 0x400000, 0x7, 0x1ff, 0xf, 0x9, 0x10, 0x5, 0x3c82, 0x8, 0x100, 0x6, 0x0, 0x1, 0x7, 0x6, 0xfffffffb, 0x7, 0x3ff, 0x10, 0xb69, 0x59, 0x1, 0xd7, 0x4, 0x2, 0x74c, 0x5, 0xdef, 0x5, 0x8, 0xfffff683, 0x7, 0x101, 0x10, 0xc, 0x5, 0x4, 0x9, 0x28febf19, 0x5, 0xfff, 0x80, 0x8, 0x7ff, 0x9, 0x5, 0x3, 0x1, 0x800, 0x3, 0x8, 0x80000000, 0x5, 0x3, 0x7, 0x5, 0x1, 0xff, 0x7, 0x1e00000, 0x3, 0x5, 0x6, 0xd, 0x6f0, 0x0, 0x1, 0x8000, 0x401, 0xe5a8, 0x80000000, 0x9, 0xd4c4, 0x3ff, 0x3, 0x9, 0x714, 0x2, 0x9, 0x9, 0x78a223e7, 0x6f4f, 0x1, 0x1, 0x3, 0x3, 0x8e000, 0x1000, 0xc, 0x6, 0xfffffffa, 0x3, 0x9783, 0x2, 0x1, 0x3, 0x3, 0x97d, 0x1000, 0x0, 0x4, 0x4, 0xb, 0x1, 0x8, 0x3, 0x3, 0x7fffffff, 0x5, 0x7, 0x80000001, 0x7, 0x2, 0x5, 0x2, 0x1, 0x40, 0x3, 0x5, 0x7a7, 0x9, 0x10000, 0x1, 0x9, 0x200, 0x4, 0x8, 0x3, 0x8, 0x7a4b, 0x0, 0x4, 0x2, 0x0, 0xfffff800, 0x1, 0x4, 0x8, 0xfff, 0x5, 0x7, 0x6, 0x80000000, 0x2, 0x40, 0x7c6d459f, 0x0, 0x2, 0x7, 0x7, 0x400, 0x7fffffff, 0x80000001, 0xfffffffe, 0x5, 0x0, 0x1, 0x399, 0x0, 0xe87, 0x7fff, 0x77c2, 0xffffff80, 0x5, 0x84b8, 0x80, 0x1, 0x6, 0x0, 0x29f4cc21, 0x0, 0x8, 0x8001, 0x4ec, 0x9, 0x7fffffff, 0x2, 0xc5f, 0xc59, 0x236, 0x3, 0x4, 0x6, 0x8, 0xfffffffc, 0x9, 0x4, 0x6, 0x8, 0xd, 0x3c, 0x5, 0x3, 0x0, 0x84, 0x53d, 0xffff49f5, 0xb3, 0x100000, 0x6, 0x2, 0xe, 0x3ff, 0x4, 0xf1, 0x5, 0x2, 0x8000, 0xf7, 0x7fff, 0x7fff, 0x2, 0xbb0, 0x8, 0x8, 0x4, 0xf, 0x7fff, 0xfffffffe, 0x2, 0x7, 0x7ff, 0x6, 0xfffffff8, 0x0, 0x80, 0x10001, 0x989, 0xfff, 0x9, 0x9, 0x4, 0x5, 0x9, 0x1000, 0x2, 0x101, 0x7ff, 0x2, 0x0, 0x347dfd5e, 0x10001, 0x9, 0x5a3, 0x9, 0x3, 0x8, 0x7, 0x66, 0x3, 0x0, 0x9, 0x1, 0xffffffb5, 0x7, 0x53ad, 0x4, 0x5, 0x2, 0x2, 0x5cc6, 0x3, 0x5, 0xb72c, 0x2, 0x1, 0x38cc, 0xb2fd, 0x2, 0x7ff, 0x5, 0x6, 0x6, 0x3, 0x3, 0x9, 0x7, 0x5, 0x3, 0x1c45, 0x98, 0x0, 0xb, 0x6, 0x6, 0xc, 0x3, 0x1ff, 0xca, 0x7, 0x47, 0xcc, 0x1ff, 0x7, 0x2, 0x81, 0x5, 0x2, 0x0, 0x9, 0x1, 0x3, 0x5, 0x80000000, 0x7ee0, 0x9, 0xffffff1b, 0x5, 0x5, 0x5, 0x2, 0x80000000, 0x8, 0xfffffff9, 0x5, 0x8, 0x9, 0xc1b4, 0xaf4, 0x8, 0x9, 0x38000000, 0x9, 0x6, 0x9, 0x0, 0x40, 0x0, 0xfffffffb, 0xfffff41d, 0x3, 0x2, 0x9, 0x6a, 0x9, 0x1, 0x9, 0x6bad8, 0xb87b, 0x1, 0x4, 0x3, 0x6, 0x4ab9, 0x5, 0x1000, 0x5, 0x2000000, 0x82, 0x5, 0x6166, 0x0, 0x0, 0x9, 0x5, 0x9, 0xfffffffc, 0x2, 0xffff, 0x8000, 0x6, 0x8, 0x7, 0xfffffff8, 0x0, 0x9, 0x4, 0xb, 0x5, 0x5626, 0xb, 0x80000001, 0x6, 0x101, 0x401, 0x8001, 0x3ff, 0x7, 0x9, 0xb9, 0x0, 0x5, 0x6, 0x8, 0x6, 0x6, 0x9, 0x3ff, 0xab, 0xfffffffe, 0x1000, 0x2, 0x40, 0x3, 0x8, 0x6, 0x0, 0x9, 0x9, 0xe38, 0x3ff, 0x2db, 0x1, 0x4, 0x96c0, 0x10, 0x5, 0x9, 0x3, 0x10001, 0x8, 0x1, 0x8, 0x7fff, 0xff, 0xd386, 0x7, 0x6, 0x0, 0x1, 0x8001, 0x7, 0x8000, 0x5, 0x2, 0x3, 0x3, 0xfffffffc, 0x4, 0x24, 0xa, 0x3, 0x6, 0x81, 0x6b71, 0xc, 0x1, 0x6, 0xbd, 0xde9c, 0x1000, 0x401, 0x9, 0x3, 0x5, 0x100, 0x7, 0x28, 0x7, 0x6, 0x200, 0x8e1, 0x6, 0x101, 0x1, 0xf40c, 0x8000, 0x800, 0x2, 0x1, 0x0, 0x7f7f, 0x4, 0x322, 0x3, 0xfffffffe, 0x7fff, 0x0, 0x7fffffff, 0xff, 0x5, 0x1, 0x0, 0x1, 0x4, 0x3, 0x401, 0x1, 0x9, 0x9, 0x6c7d, 0x8, 0x3, 0x4, 0x5d9, 0x80000001, 0x3, 0x9, 0x10, 0x9, 0x8c, 0x9, 0x0, 0x0, 0xff, 0x2, 0xfe41, 0x9, 0x2, 0x2, 0x6, 0x9f2, 0x4, 0x2, 0x924, 0x6, 0x8, 0x721, 0x7e1bfacc, 0xb51, 0x401, 0xfffffff9, 0x4, 0xffffff72, 0x7, 0x100, 0x3, 0x7, 0x9, 0x27, 0x7, 0x6, 0x7f, 0x7, 0x7, 0x9, 0x7, 0x5, 0x1, 0x18, 0x81, 0x10000, 0x5, 0x1, 0x701c, 0x6, 0x81, 0x6, 0xa, 0x8, 0xe, 0x3, 0xfffffffd, 0xac, 0x13f, 0x7, 0x8, 0x1, 0xfffeffff, 0x7, 0x1, 0x2, 0x4, 0x9, 0xb3, 0x9, 0x3bdc5d0, 0xfffffffa, 0x5, 0x401, 0xa, 0x4, 0x8, 0x0, 0x3, 0x0, 0x1, 0x5, 0x3, 0x3a07bff, 0x3, 0x0, 0x2, 0x5, 0x5, 0x3, 0x3ff, 0xa, 0x6, 0x8, 0x7fffffff, 0x400, 0x1da, 0x0, 0x4cbea66d, 0x10, 0x5, 0x100, 0x90000, 0x7, 0x5, 0x3, 0x7, 0x5, 0x7, 0x6, 0x0, 0x9e63, 0x7, 0x8, 0x40, 0x2, 0x8001, 0x4, 0xa1, 0x3, 0x4, 0x400, 0x0, 0x296, 0x3, 0x74, 0x8, 0x4, 0x5, 0x1, 0x7fff, 0xed, 0x0, 0x0, 0x3d, 0x1, 0x8, 0x1, 0x9, 0x10, 0x4b, 0x6, 0x5, 0x8001, 0x8001, 0x1, 0x0, 0x900b, 0xe, 0x40, 0x491a, 0x81, 0x9, 0xa1, 0x3, 0x7, 0x5a58, 0xf, 0x5, 0x1, 0x54, 0x9, 0x200, 0xfda, 0x40, 0x7, 0x7, 0x99c, 0x6, 0x100, 0x8, 0x7fff, 0x8, 0xe927, 0x4, 0x7, 0x7, 0xf, 0x8, 0x1, 0x2, 0x4, 0x8, 0xe, 0xfffff000, 0x4, 0x8, 0x7, 0x8, 0x4, 0x81, 0x1, 0x1, 0x9, 0xe, 0xfffffff9, 0x8, 0x0, 0x1, 0x7, 0x8001, 0x81f, 0x8, 0xfffffffd, 0x56, 0x1, 0x1, 0x3ff, 0x3ff, 0x2, 0x2, 0x7, 0xfffffffa, 0x2, 0x1, 0x8, 0x3, 0x7, 0xd, 0x7fffffff, 0xb02a, 0x3, 0x4, 0x1, 0x2, 0x5, 0x16, 0x0, 0x1000, 0x6, 0xffff, 0x5, 0x4, 0xc6f0, 0x4, 0x8, 0xa, 0xb260, 0x6, 0x9, 0x9, 0x200, 0xde1, 0x81, 0x81, 0x9, 0x2, 0xd1, 0x81, 0x80000001, 0x7c78, 0x5, 0x7, 0x1c0000, 0x2, 0x4, 0x9, 0x0, 0x0, 0x2, 0xfff, 0x2, 0xffffffff, 0xb6ed, 0x1ff, 0x3, 0xf, 0x401, 0x7, 0x80000000, 0x3, 0xc, 0x7, 0x3, 0xeb8e, 0x100, 0xb2fc, 0x80000000, 0x8ec, 0x7000, 0xf4a, 0x8, 0x6, 0xd, 0x80, 0xff, 0xfff, 0x4, 0x5, 0x3, 0x6, 0x1e975a25, 0x1, 0x0, 0x100, 0x200, 0x5, 0x3, 0x7, 0x7fff, 0x6, 0x9, 0x0, 0x6, 0x10000, 0x8, 0x72, 0x8, 0xe0000000, 0x9, 0x3, 0x2, 0x2, 0xa, 0x5, 0x2, 0x2, 0xfffffffa, 0xffff, 0x4c8, 0x3, 0x6, 0x0, 0x6, 0x3000000, 0xb84, 0x8, 0x7fffffff, 0x2, 0x100000, 0xffffffff, 0x4, 0xffff, 0x5, 0x3, 0x5, 0xd2, 0x40, 0x7, 0xfffffffc, 0x7, 0x5, 0x9, 0x5, 0x9, 0xa93, 0xe, 0x8, 0x4, 0x2, 0x5, 0xff, 0x1, 0xfffffffd, 0x9, 0x3, 0x5, 0x3, 0x6, 0xff, 0xf1e, 0x81, 0x6, 0xdfa, 0x4, 0x1af, 0x80, 0x0, 0x7, 0x0, 0x8, 0x58a, 0x5, 0xd, 0x8, 0x6, 0x2b, 0xffffffff, 0x1, 0x81, 0x3, 0xf74, 0x7, 0x3, 0x80000000, 0xffffff39, 0xc, 0x2, 0x40000, 0xfffffffa, 0xafc, 0xe26, 0x80, 0x1, 0xe, 0x9, 0xf7e, 0x2339f48d, 0x0, 0x6, 0x30, 0x5, 0x80000001, 0x81, 0x6, 0xff, 0x1, 0x9, 0x101, 0x0, 0xb, 0x71d, 0x100, 0x39d, 0x80, 0xb54, 0xf2b, 0x6, 0x4, 0x1b, 0xd, 0x4, 0x10000, 0x1, 0x8, 0x9, 0x4, 0x7f, 0x2, 0x2, 0x7ff, 0x7, 0xdbcf, 0x4c, 0x5, 0x5, 0xffffffff, 0x2bef00a, 0x9, 0xc5, 0x3, 0x5, 0x6b7, 0x200, 0x3ff, 0x6, 0x355, 0x5, 0xe4, 0x2, 0x200, 0xf, 0xfffffe01, 0xfffffeff, 0x83e8, 0x5, 0x7fffffff, 0xfffffffb, 0x200, 0x8, 0xdfb, 0x5, 0x25ba, 0x80, 0x2, 0x3, 0x800, 0x2, 0x7, 0x8000, 0x0, 0x57d, 0x5, 0x7, 0x0, 0x8, 0x3ff00]}) r5 = memfd_create(&(0x7f00000007c0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b \x00\x00\x00\x00\x00\x00\x01\x00\x00\xf7\xffg\xf5\x12oP\xfe\xe6\xd2SLR\xa1\x00\x00\x17\x1f$^\xe1\x00\x00\x00\x00\x00\x00\a\xff;\xeb\xf1\xd0\xce\xe5\x19\x12\b\x01\xd9\xbf>/\x05\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xdcc\x12.\x00\x00\x00\x00\x00\x00\r\x17\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x05\x00\xfd\xc7\x00\x00\x00\x00\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4h$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\x02\x00\x00\x00\xb5\x82q\x1f37\x02\xb9\xb2\x9a3\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\xba\xe3J\xc2t\x96\xddW\xe6}\xc5\xa4\x8f\x98\xbf\xca\xea\xa3\x83\x8e-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\b\x9dh\xcb)\xf4f\x12[\xf9\r\t\xef{h\x826`M\xab\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8\xac\x00P\xac\x86\x13b\xa8D\x0f\x93\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\x9b\xcc\x9b\f\xa7\x8f9\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xd9\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5\xf4\x8b\x03Ca8\x1e\xe9\\#\xf8O\fw\xd9\xf5cF\xcc\x1a2ex\xb4\x0fi$\x97\x81.\x02\x04m\xfbT2\xd4\x01\x1e\xf0\x16\x0f\x97\xe6j}J\xca\xb8)f\xd5\xfd>\x9bU\xb0\x03Zt0\xc0b\xad\xef@o\xc1\xd6\x17T\f\xc30\xe2\x89\xf6L\x1b\xbb\x04\xd7\xd1\x06\xa0m\xc9\x82<\xa9\xdc\xddRU\t\xe9\xbah\xb6\xb2\xea-{Q\xca\x14\x13\x9ajWt\xc9\xecd\r\xd5)\x1d\xaf\n\xc0\xc1\x1d}DL\x95&\xe7\xf4U\xff\xcd&\a\x9f\x1bg\xe5|~A\xc5n\x12%ur\xa1\x9e`\xc2\x01\b,\x18\xaf\xccD\xdeag\xc6\xf3\xd6\x94\x9dn\x06\xae\x8bl\xee\x7fu\xe5bu\x84\x04\xb3@\xa1\xf7\xc6\x13\xf9I\xfa\x12\xfc\x96\",aT\xfd\"\x01\x92\xb1\xbf\x8a\x15\x88\xfd\x8f\x88\x87\x82\x9c:L\xd2\xb8\xfa5\x066\x82\xf3_LUr\xfa\xd2\x99d \x97c9G\x99\xe3\xcc$\x96\xb71~2{@:\x97^\xbfcu9\x8c<^ll\x97\xe7\xc7a\tm\xe8\x01\x00j\xf8\x98\x81\xe7\xf7\xab3F\xf4u\xdaav\xd21\v\x99HG\xd8\x84\n\x13\x9a\x85&\v\xfeU\x18\x17o6m\x84\xdfx\x1cPl\t#\xc1\x8e\xddW\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\"\xd7\x99\x19pn\xbe\xb8\f#\xe2\x8f\x02\xedk\x10\x1b\x9c\x10\xd5\xab\x95Yn\xe9\x00\xb5\xa29\xd7\xd1\bs\xd0x0\xf2F\xaam\xd8\\\x16\x98\x86\xbe\xbc|h+\t.\x0f\x1b?\xbf5\x9fW\xa7\x02\x14J\x16|TV\x1bW\xd6r\nR\x82\xe0\x88%\xfa\x1f\xae\xcb\xb5g\xd5\x9a\x17\xd2F3A\x03-\xe22\x1b\xb4\xb5\b\x8b\xe79\xbew#2\xbd`', 0x7) fcntl$addseals(r5, 0x409, 0xc) ioctl$FS_IOC_RESVSP(r5, 0x40305829, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x80}) ioctl$TIOCSETD(r4, 0x5423, &(0x7f00000002c0)=0xf) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x189040, 0x2) setrlimit(0x1, &(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) truncate(&(0x7f0000000340)='./file1\x00', 0x20fffbfffc) finit_module(r6, 0x0, 0x1) ioctl$TCFLSH(r4, 0x400455c8, 0x0) socket(0x10, 0x3, 0x0) r7 = socket(0x11, 0x2, 0x0) setsockopt(r7, 0x107, 0x1, &(0x7f0000000000)="110000000000060000071a80010061cc", 0x10) close(0x4) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='.\x00', 0x8880, 0x85) lseek(r8, 0x100, 0x1) getdents64(r8, 0x0, 0x4f) syz_usb_connect$cdc_ecm(0x2, 0x56, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000020000082505a5a4400000000101090244000101000000090400000302060000052406000005242000000d240f010000000000000000000905810320000000000905820208"], 0x0) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: testing without sub-chunk 2/3 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 8, 30, 7, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program crashed: KASAN: use-after-free Read in em28xx_init_extension bisect: the chunk can be dropped bisect: testing without sub-chunk 3/3 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 8, 30, 7] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) program did not crash bisect: split chunks (needed=true): <7>, <7> bisect: split chunk #0 of len 7 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [8, 30, 7, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: split chunk #1 of len 7 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 8, 30, 7, 27, 8, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 8, 30, 7, 13, 12, 14, 6] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) program did not crash bisect: split chunks (needed=true): <4>, <3>, <4>, <3> bisect: split chunk #0 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [12, 27, 8, 30, 7, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 8, 30, 7, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 0: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a00000008", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 0: setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000000)="0a38a1aa2a85c36d1281be41e7934024e09df5c1f1892c3148c32289ec1c19c7b88439e1a53085", 0x27) r0 = accept4$netrom(0xffffffffffffffff, &(0x7f0000000040)={{0x3, @null}, [@rose, @remote, @netrom, @null, @rose, @bcast, @netrom, @netrom]}, &(0x7f00000000c0)=0x48, 0x80800) clock_gettime(0x0, &(0x7f0000003800)={0x0, 0x0}) recvmmsg(r0, &(0x7f0000003740)=[{{&(0x7f0000000100)=@alg, 0x80, &(0x7f0000000400)=[{&(0x7f0000000180)=""/49, 0x31}, {&(0x7f00000001c0)=""/180, 0xb4}, {&(0x7f0000000280)=""/174, 0xae}, {&(0x7f0000000340)=""/135, 0x87}], 0x4, &(0x7f0000000440)=""/49, 0x31}, 0x9}, {{&(0x7f0000000480)=@ieee802154, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000500)=""/42, 0x2a}, {&(0x7f0000000540)=""/113, 0x71}], 0x2}, 0x8}, {{&(0x7f0000000600)=@pppol2tpv3in6={0x18, 0x1, {0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @private0}}}, 0x80, &(0x7f0000003700)=[{&(0x7f0000000680)=""/4096, 0x1000}, {&(0x7f0000001680)=""/4096, 0x1000}, {&(0x7f0000002680)=""/74, 0x4a}, {&(0x7f0000002700)=""/4096, 0x1000}], 0x4}, 0x1}], 0x3, 0x2002, &(0x7f0000003840)={r1, r2+60000000}) r4 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000003880)='/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x2, 0x0) mq_timedreceive(r4, &(0x7f00000038c0)=""/154, 0x9a, 0x7, &(0x7f0000003980)={0x77359400}) r5 = semget(0x1, 0x2, 0x202) semtimedop(r5, &(0x7f00000039c0)=[{0x4, 0x200, 0x1800}], 0x1, &(0x7f0000003a00)) r6 = openat$cgroup_ro(r4, &(0x7f0000003a40)='memory.swap.current\x00', 0x0, 0x0) getsockopt$inet6_IPV6_IPSEC_POLICY(r4, 0x29, 0x22, &(0x7f0000003a80)={{{@in=@multicast1, @in=@multicast2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}}, {{@in=@initdev}, 0x0, @in=@empty}}, &(0x7f0000003b80)=0xe8) write$P9_RSTATu(r6, &(0x7f0000003bc0)={0x7d, 0x7d, 0x2, {{0x0, 0x64, 0x655, 0xfff, {0x1, 0x2, 0x3}, 0x91000000, 0x9, 0x9, 0x6, 0x1, ',', 0x2a, '/proc/sys/net/ipv4/vs/sync_refresh_period\x00', 0x6, '+*!.\\@'}, 0x4, '$&@}', r8, 0xee00, 0xee00}}, 0x7d) r9 = openat$vicodec1(0xffffffffffffff9c, &(0x7f0000003c40), 0x2, 0x0) ioctl$AUTOFS_IOC_ASKUMOUNT(r9, 0x80049370, &(0x7f0000003c80)) close_range(r4, r3, 0x0) r10 = syz_genetlink_get_family_id$nl80211(&(0x7f0000003d00), r4) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f0000003d40)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_VENDOR(r4, &(0x7f0000003f40)={&(0x7f0000003cc0)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000003f00)={&(0x7f0000003d80)={0x17c, r10, 0x800, 0x70bd2c, 0x25dfdbfb, {{}, {@val={0x8, 0x1, 0x3}, @val={0x8, 0x3, r11}, @val={0xc, 0x99, {0x5, 0x31}}}}, [@NL80211_ATTR_VENDOR_DATA={0x30, 0xc5, "fa5be157c6a1d26dd22317bf4b791dae16422d6fcad49b72ee5c0b36be5e1dc8f64f3a15aa6ae0b92b15d318"}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0x8}, @NL80211_ATTR_VENDOR_SUBCMD={0x8, 0xc4, 0xf52}, @NL80211_ATTR_VENDOR_DATA={0xe1, 0xc5, "c3771407a96f7fda862f6268d24866eac89a998054f9f1e0dc5e1a75a5e8631f26905151202197c609282b74aaf5efd76d030e8de1a3d74d71b5c164fc2a557b4eb43fc47cb1f50c5a5006a27915cd596332e059519eede609c8dc36c1fd74b99768ec897773dd77a93e8dbf551364cf9e56eb3d6c416b2f6dad3b3ca48e2aa4ed1eb62d77980df309162c56a538bb3ff6c5a401293ffff88e3d00776a321ac06ef74b07dc533ec6a7ce8ff9dd4755a467e0d08f56278ff1eefbe4994af3262fdc5d0751d7b86f522e5cedc3857ce696f71c16935b9b03a7bd39412465"}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x9}, @NL80211_ATTR_VENDOR_SUBCMD={0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x8}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x1}, @NL80211_ATTR_VENDOR_ID={0x8, 0xc3, 0x7}]}, 0x17c}, 0x1, 0x0, 0x0, 0x20000000}, 0x8081) semop(0x0, &(0x7f0000003f80)=[{0x4, 0x9, 0x800}, {0x2, 0x200, 0x1800}], 0x2) ioctl$VIDIOC_OVERLAY(r6, 0x4004560e, &(0x7f0000003fc0)=0xd24c) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000004040), r6) sendmsg$ETHTOOL_MSG_COALESCE_GET(r6, &(0x7f0000004240)={&(0x7f0000004000)={0x10, 0x0, 0x0, 0x10}, 0xc, &(0x7f0000004200)={&(0x7f0000004080)={0x17c, r12, 0x100, 0x9, 0x25dfdbfd, {}, [@HEADER={0x28, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}]}, @HEADER={0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_batadv\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0x1c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x38, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'caif0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}]}, @HEADER={0x50, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'lo\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_team\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'macvtap0\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x1}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r7}]}]}, 0x17c}, 0x1, 0x0, 0x0, 0x8000}, 0x4044084) ioctl$BTRFS_IOC_QUOTA_CTL(r3, 0xc0109428, &(0x7f0000004280)={0x1, 0xfff}) mount$9p_fd(0x0, &(0x7f00000042c0)='./file0\x00', &(0x7f0000004300), 0x200000a, &(0x7f0000004340)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r0}, 0x2c, {[{@cache_readahead}, {@version_9p2000}, {@cache_readahead}, {@posixacl}], [{@obj_user={'obj_user', 0x3d, 'memory.swap.current\x00'}}]}}) r13 = syz_open_dev$dvb_frontend(&(0x7f0000004400), 0x7ff, 0x40) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r4, &(0x7f0000004500)={&(0x7f0000004440)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000044c0)={&(0x7f0000004480)={0x14, r10, 0x20, 0x70bd2a, 0x25dfdbfc, {{}, {@void, @void}}, ["", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x90}, 0x80040) ioctl$XFS_IOC_PATH_TO_HANDLE(r6, 0xc0385869, &(0x7f0000004640)={r9, &(0x7f0000004540)='\x00', 0x101c01, &(0x7f0000004580)={@align=0x3, {0x7, 0x7, 0x2, 0xf}}, 0x6, &(0x7f00000045c0), &(0x7f0000004600)=0xd6e0}) r15 = syz_genetlink_get_family_id$mptcp(&(0x7f00000046c0), r4) getpeername$packet(r6, &(0x7f0000004700)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @link_local}, &(0x7f0000004740)=0x14) sendmsg$MPTCP_PM_CMD_DEL_ADDR(r14, &(0x7f0000004880)={&(0x7f0000004680)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000004840)={&(0x7f0000004780)={0x98, r15, 0x1, 0x70bd2b, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0x9}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x2}, @MPTCP_PM_ATTR_ADDR_REMOTE={0xc, 0x6, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_PORT={0x6, 0x5, 0x4e24}]}, @MPTCP_PM_ATTR_LOC_ID={0x5, 0x5, 0xa}, @MPTCP_PM_ATTR_ADDR={0x48, 0x1, 0x0, 0x1, [@MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x3}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x5}, @MPTCP_PM_ADDR_ATTR_FAMILY={0x6, 0x1, 0x8}, @MPTCP_PM_ADDR_ATTR_ID={0x5, 0x2, 0x7}, @MPTCP_PM_ADDR_ATTR_FLAGS={0x8, 0x6, 0x1}, @MPTCP_PM_ADDR_ATTR_ADDR6={0x14, 0x4, @private2}, @MPTCP_PM_ADDR_ATTR_IF_IDX={0x8, 0x7, r16}]}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x8}, @MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x3}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x5}]}, 0x98}, 0x1, 0x0, 0x0, 0x20000000}, 0x10) close(r13) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: split chunk #1 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=33s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 7, 13, 12, 14, 6, 27, 8, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaaaaaa"], 0x1a) executing program 0: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program crashed: KASAN: use-after-free Read in em28xx_init_extension bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #2 of len 4 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 7, 14, 6, 27, 8, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 2: userfaultfd(0x80801) socket$nl_netfilter(0x10, 0x3, 0xc) syz_init_net_socket$802154_dgram(0x24, 0x2, 0x0) socket$inet(0x2, 0x3, 0x2) r0 = creat(&(0x7f0000000140)='./file0\x00', 0xf1) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c0000001500010300000000000000000a000000080002", @ANYRES32=r0], 0x1c}}, 0x20000080) sendmsg$NLBL_UNLABEL_C_STATICADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000100)={0x0}, 0x8, 0x3000000000002, 0x0, 0x80}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program crashed: BUG: corrupted list in em28xx_init_extension bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #3 of len 3 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=32s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [13, 7, 12, 27, 7, 14, 6, 4] detailed listing: executing program 3: r0 = socket$inet6(0xa, 0x4, 0x1) sendto$inet6(r0, 0x0, 0x0, 0x24048048, 0x0, 0x0) getsockopt$inet_int(r0, 0x0, 0xe, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000000)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-camellia-aesni\x00'}, 0x58) r2 = socket$inet6_mptcp(0xa, 0x1, 0x106) ioctl$USBDEVFS_SETINTERFACE(0xffffffffffffffff, 0x80045510, 0x0) getsockopt$inet6_mptcp_buf(r2, 0x11c, 0x4, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, 0x0, 0x0, 0x0, 0x0, 0x0) ioctl$KVM_SET_REGS(r1, 0x4090ae82, 0x0) ioctl$KVM_RUN(r1, 0xae80, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="041817aaaa"], 0x1a) executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program crashed: BUG: corrupted list in em28xx_init_extension bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunks (needed=true): <2>, <2>, <1>, <2>, <1> bisect: split chunk #0 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 12, 27, 7, 14, 6, 4] detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program crashed: BUG: corrupted list in em28xx_init_extension bisect: the chunk can be dropped bisect: testing without sub-chunk 2/2 bisect: no need to test this chunk, it's definitely needed bisect: split chunk #1 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 27, 7, 14, 6, 4] detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 12, 7, 14, 6, 4] detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: split chunk #2 of len 1 into 2 parts bisect: no way to further split the chunk bisect: split chunk #3 of len 2 into 2 parts bisect: testing without sub-chunk 1/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 12, 27, 7, 6, 4] detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: testing without sub-chunk 2/2 testing program (duration=31s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [7, 12, 27, 7, 14, 4] detailed listing: executing program 0: r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x38, 0x1403, 0x1, 0x70bd25, 0x25dfdbff, "", [{{0x9, 0x2, 'syz2\x00'}, {0x8, 0x41, 'siw\x00'}, {0x14, 0x33, 'bridge_slave_1\x00'}}]}, 0x38}, 0x1, 0x0, 0x0, 0x40004045}, 0x4000) r1 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) r2 = syz_open_dev$hiddev(&(0x7f0000000040), 0xffffffff, 0x80000) ioctl$HIDIOCGFIELDINFO(r2, 0xc038480a, &(0x7f00000000c0)={0x2, 0xffffffff, 0x7, 0x76, 0x7, 0x101, 0x9, 0x8, 0x5, 0x101, 0x0, 0x10000, 0x4, 0x7}) syz_usb_connect$cdc_ncm(0xb78f390f27b9daab, 0x8b, &(0x7f00000005c0)={{0x12, 0x1, 0x201, 0x2, 0x0, 0x0, 0x20, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x79, 0x2, 0x1, 0x8, 0x0, 0x7, "", {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0xa, 0x24, 0x6, 0x0, 0x1, "f9746d40b3"}, {0x5, 0x24, 0x0, 0xff}, {0xd, 0x24, 0xf, 0x1, 0x7fff, 0xe, 0x7, 0xf}, {0x6, 0x24, 0x1a, 0x5}, [@mbim={0xc, 0x24, 0x1b, 0xb, 0x5, 0x10, 0x80, 0x7f, 0x7}, @mbim={0xc, 0x24, 0x1b, 0x2, 0x1000, 0x10, 0xc, 0x0, 0xc0}]}, {{0x9, 0x5, 0x81, 0x3, 0x8, 0x7, 0x3, 0x1}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x3ff, 0xd, 0x9, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x40, 0x1, 0x0, 0xe}}}}}}}]}}, &(0x7f0000000440)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x110, 0x0, 0x4, 0x5, 0x10}, 0x9d, &(0x7f0000000200)={0x5, 0xf, 0x9d, 0x4, [@ss_container_id={0x14, 0x10, 0x4, 0x3, "b405b3a33d7c59629bb6980c259b2e9b"}, @generic={0x73, 0x10, 0x4, "dcbf2645339fdac23f303f64a2326cc97a6eb97b2691b5c63d27884a11d0d24859c46a9192b522fff2463b586137d2004bd1ab7013c6f4f57cb74a0ddc3a7baab9c7069f967cb08a6e0101b886afc86ecd57e7e2d64a3e829b38d93dd3f862e38e004dc49ff669eaa7d02a3caf775a29"}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x7bed38573a7a4455, 0x3d, 0x7, 0xf}, @ext_cap={0x7, 0x10, 0x2, 0x18, 0x9, 0xc, 0xfff3}]}, 0x3, [{0xb8, &(0x7f0000000300)=@string={0xb8, 0x3, "625a46505ddd6685e6f8bb6d0540ea505645376964308909b5f5c5f2649cf1bdf967817712ead2316a999f4cb07d001f40c3a852a7d5fd8e7f5fbb4a61e04e64c5bcd78e80a5895c58bcbef574ce0aa67b2a51f7237f7e68deb9bb0bc68443ee89e011ef28c13e76bb20d5337b93e5f5b017a1808bb85ee858b09b1b5c4e333a5b250d79f252f00a09ec6818840a0a2a712e2ec315a26eff7fd4216e0af261d469fb160676bb33ab98a933a0c6673fdbabd362ed8eff"}}, {0x79, &(0x7f00000003c0)=@string={0x79, 0x3, "2dd2aae4b33a420d518df73545f44c9f963544079bd0db3a27193491cf45cc50a3cf1a1bdc7ce2cae72a9a8f0190360c5daf80e8614c774824e7561d0421f584f9942ccdaa85c510f154dedcdc633bd00f4e745aca823017e24f1df029a503e7da306b7d006d3427a27a9c697a694c61865257e604675d"}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x436}}]}) ioctl$HIDIOCGUCODE(r1, 0xc018480d, &(0x7f00000004c0)={0x1, 0x1, 0x1, 0x3, 0x100}) executing program 3: r0 = syz_usb_connect(0x2, 0x24, &(0x7f00000007c0)=ANY=[@ANYBLOB="12010000ed3ec908cd0cb300ea2d010203010902120001000000000904"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000240)=ANY=[], 0x0, 0x0}) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_DEBUG_SET(r1, &(0x7f0000001540)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000001c0)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002002000000004000100080004"], 0x44}, 0x1, 0x0, 0x0, 0x10}, 0x4008014) syz_usb_control_io$cdc_ncm(r0, 0x0, &(0x7f00000003c0)={0x44, &(0x7f0000000500)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, &(0x7f00000000c0)={0x14, &(0x7f0000000040)={0x0, 0x23, 0x19, {0x19, 0xe, "101a14a768fb68232590edb80689af7678ad6b083c6752"}}, &(0x7f0000000080)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000200)={0x1c, &(0x7f0000000100)={0x0, 0xf, 0x4f, "591cfd6730c121d0ce0ce7be96008f0346f59936f93e628a004af4ebbf00838989e44d31538af33896f2394eacf994524d96b535f2c1ee98c4e32303fe931e56fb8ac40a1afcb92c18b65b8bc584c3"}, &(0x7f0000000180)={0x0, 0xa, 0x1, 0x5}, &(0x7f00000001c0)={0x0, 0x8, 0x1, 0xa0}}) executing program 1: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) executing program 0: r0 = syz_usbip_server_init(0x1) r1 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_int(r1, 0x29, 0x48, &(0x7f0000000180)=0x1, 0x4) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x80380000, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}, 0x1c) r2 = socket$nl_audit(0x10, 0x3, 0x9) socket$kcm(0xa, 0x1, 0x0) write$usbip_server(r0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r2, @ANYRES64, @ANYRES64, @ANYRESDEC=r2, @ANYRES16=r1, @ANYRES32=r0, @ANYRESDEC=r1, @ANYRES32=r1, @ANYBLOB="0f6b9dd50f033e28593fe431b19e8b1073dac0e5e544dada14e7cc703f5ce1b309510bbbc91de47ea529488468c88211cf602af79100f663ef596befd5d76e193a7ceeaebcd5be266435ebb76f54ffba90b0050cfbf043208b987a6c240c40ea32d8354075a23e796bc139c3e1e58795acae601e1c2ad63b0cdf45d4eab79aff352e53b32e3d5a"], 0x35) executing program 3: r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) write$uinput_user_dev(r0, &(0x7f0000000a40)={'syz1\x00', {0x0, 0x0, 0x6}, 0xfffffffd, [0x0, 0x0, 0x0, 0x4, 0x1, 0x0, 0x401, 0x0, 0x4, 0x20008001, 0x2000, 0x0, 0x0, 0x0, 0x80, 0x80001, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x77, 0x90, 0x801, 0x0, 0x2, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0xfffffffb, 0x0, 0x9, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x7ff, 0x3, 0x0, 0x0, 0xffff1e06, 0x7], [0xfffffffd, 0x3, 0x6, 0x0, 0x0, 0x5, 0x8, 0xff, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x9, 0x6189fbd8, 0x0, 0x400000, 0x0, 0xfff, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x2, 0x0, 0x9e27, 0x0, 0xfffffffd, 0x5, 0x7aae62b1, 0x100000, 0x0, 0x40002, 0xffffffff, 0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0xfd5], [0x0, 0x0, 0x0, 0xd1, 0x0, 0x0, 0x0, 0xfa, 0x0, 0x0, 0x3, 0x7, 0x0, 0x1, 0x0, 0x3, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x1000, 0x3, 0x8000000, 0x8, 0x0, 0x0, 0x99, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x7, 0x0, 0x1, 0xfffffffd, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100000], [0x0, 0x0, 0x0, 0x0, 0x0, 0x4be3, 0x4a92, 0xf152, 0x0, 0x10004, 0x0, 0x0, 0xff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffff9bf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x7ff, 0x0, 0x0, 0x1, 0x0, 0x6, 0x9, 0x0, 0x735, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xb6, 0x1, 0x0, 0x0, 0x3, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x4]}, 0x45c) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000040)={0x26, 'skcipher\x00', 0x0, 0x0, 'xts-aes-aesni\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) r4 = accept4$alg(r3, 0x0, 0x0, 0x800) sendmsg$alg(r4, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, &(0x7f0000003240)=[@iv={0x10}, @op={0x10}], 0x20, 0x40000}, 0x1) ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={0x0}}, 0x0) sendmsg$NL80211_CMD_START_AP(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000780)={0x3c, r2, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8}, @NL80211_ATTR_DTIM_PERIOD={0x8}, @beacon=[@NL80211_ATTR_FTM_RESPONDER={0x8, 0x10e, 0x0, 0x1, [@NL80211_FTM_RESP_ATTR_ENABLED={0x4}]}]]}, 0x3c}}, 0x0) executing program 2: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash bisect: split chunk #4 of len 1 into 2 parts bisect: no way to further split the chunk bisect: too many guilty chunks, aborting single: executing 4 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$kvm-ioctl$KVM_CREATE_VM-ioctl$KVM_CREATE_VCPU-ioctl$KVM_SET_MSRS detailed listing: executing program 0: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000280), 0x20083, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x5) ioctl$KVM_SET_MSRS(r2, 0x4008ae89, &(0x7f00000000c0)={0x1, 0x0, [{0x6a6, 0x0, 0xd}]}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS-syz_usb_control_io$uac1-syz_usb_control_io detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) syz_usb_control_io(r2, &(0x7f0000000200)={0x2c, &(0x7f0000000080)={0x40, 0x0, 0x6d, {0x6d, 0x9, "bdb13dfb44b37c08c39d12ffa735d939196ab6477ac89ced78ccff173c8813580b971887eba0eee5692a2882303f5eb1b780b70505adcb45f4524aadc71176d27d583a1ac8bb2cddbb578fc3efe12de33bb62965a8aa1129b36ad15dbbdca1d8a1848127d6d82487d60637"}}, &(0x7f0000000680)=ANY=[@ANYBLOB="00031000e5c2b2ac010a9df61e82e4ee5eb66e8f12c5d6e914646b6e794100"], &(0x7f0000000140)={0x0, 0xf, 0x2d, {0x5, 0xf, 0x2d, 0x2, [@ssp_cap={0x10, 0x10, 0xa, 0xaf, 0x1, 0xff, 0xf, 0x7, [0xc0]}, @ssp_cap={0x18, 0x10, 0xa, 0x7, 0x3, 0xb507, 0x1100, 0x1c94, [0xffc0, 0xc0, 0xffc000]}]}}, &(0x7f0000000180)={0x20, 0x29, 0xf, {0xf, 0x29, 0xf, 0x1, 0x2, 0x6d, "0fdbcd95", "d0cdc9a6"}}, &(0x7f00000001c0)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0xfb, 0x10, 0x2, 0x3, 0x5, 0x2, 0x8}}}, &(0x7f00000008c0)={0x84, &(0x7f0000000240)={0x40, 0x1, 0xb3, "1b43e62ee6f30a891f3d615d8a6c75e1d31dad1bb642ad37acf4e3eff155e9e7464e45e3b53084e1df913377bb97de43629d7373bd40a308179ba18408a0d25e1b40eaed1c4703d846b706a717d05c637c16b85b8560be10f5b60e6ffc918ed5ce7fabd4bf9c7f8244b1019a7893c03f5f85ed1dec5e0d663ac32cdc8c537dcb81f983069e7da5f370086aeecc89cb6ab3a3ce78ba51ab779bb024116c1cc56d282324278a049025a19797565039fd5f2b32e0"}, &(0x7f0000000a40)={0x0, 0xa, 0x1, 0x1}, &(0x7f0000000500)={0x0, 0x8, 0x1, 0xfe}, &(0x7f0000000540)={0x20, 0x0, 0x4, {0x1, 0x2}}, &(0x7f00000005c0)={0x20, 0x0, 0x8, {0x20, 0x8, [0xff]}}, &(0x7f0000000600)={0x40, 0x7, 0x2}, &(0x7f0000000640)={0x40, 0x9, 0x1, 0x9}, &(0x7f0000000580)={0x40, 0xb, 0x2, "caf4"}, &(0x7f00000006c0)={0x40, 0xf, 0x2, 0x10}, &(0x7f0000000700)={0x40, 0x13, 0x6, @local}, &(0x7f0000000740)={0x40, 0x17, 0x6, @local}, &(0x7f0000000780)={0x40, 0x19, 0x2, "76b4"}, &(0x7f00000007c0)={0x40, 0x1a, 0x2, 0x8000}, &(0x7f0000000800)={0x40, 0x1c, 0x1}, &(0x7f0000000840)={0x40, 0x1e, 0x1, 0x1}, &(0x7f0000000880)={0x40, 0x21, 0x1, 0xf2}}) program crashed: BUG: corrupted list in em28xx_init_extension single: successfully extracted reproducer found reproducer with 27 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS-syz_usb_control_io$uac1 detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) syz_usb_control_io$uac1(r2, 0x0, 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video-ioctl$VIDIOC_ENUM_FRAMEINTERVALS detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) r11 = syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) ioctl$VIDIOC_ENUM_FRAMEINTERVALS(r11, 0xc034564b, &(0x7f0000000040)={0x0, 0x42474752, 0x780, 0x438, 0x3, @stepwise={{0x2, 0x7ffd}, {0x2, 0xfff}, {0x5, 0xd}}}) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun-syz_open_dev$video detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) syz_open_dev$video(&(0x7f0000000240), 0x75, 0x700) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH-write$tun detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) write$tun(r4, &(0x7f0000000ec0)={@val={0x8, 0x800}, @val={0x3, 0x0, 0x4, 0x1, 0x14}, @ipv4=@generic={{0x6, 0x4, 0x1, 0x27, 0x20, 0x65, 0x0, 0x60, 0x2, 0x0, @initdev={0xac, 0x1e, 0xc, 0x0}, @broadcast, {[@noop]}}, "11f3305280f125e6"}}, 0x2e) program crashed: KASAN: use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT-getsockopt$TIPC_SOCK_RECVQ_DEPTH detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r10 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r10, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r10, 0x89e0, &(0x7f0000000480)) getsockopt$TIPC_SOCK_RECVQ_DEPTH(r9, 0x10f, 0x84, 0x0, &(0x7f0000000080)) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg-ioctl$SIOCPNGETOBJECT detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r9, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) ioctl$SIOCPNGETOBJECT(r9, 0x89e0, &(0x7f0000000480)) program crashed: KASAN: use-after-free Read in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe-setsockopt$SO_BINDTODEVICE_wg detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) r9 = socket$phonet_pipe(0x23, 0x5, 0x2) setsockopt$SO_BINDTODEVICE_wg(r9, 0x1, 0x19, &(0x7f0000000040)='wg2\x00', 0x4) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc-socket$phonet_pipe detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) socket$phonet_pipe(0x23, 0x5, 0x2) program crashed: KASAN: use-after-free Read in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR-socketpair$tipc detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) socketpair$tipc(0x1e, 0x2, 0x0, &(0x7f0000000000)) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm-ioctl$SIOCSIFHWADDR detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) r8 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r8, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) program crashed: KASAN: slab-out-of-bounds Read in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan-socket$kcm detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) socket$kcm(0x2, 0x3, 0x2) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base-ioctl$ifreq_SIOCGIFINDEX_vcan detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) r7 = socket$isdn_base(0x22, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC-socket$isdn_base detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) socket$isdn_base(0x22, 0x3, 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6-sendmsg$SEG6_CMD_SETHMAC detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) sendmsg$SEG6_CMD_SETHMAC(r5, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000300)=ANY=[@ANYBLOB='4\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="0100000000000000000001000000050005000100000008000400000000000500060000000000080003"], 0x34}}, 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic-syz_genetlink_get_family_id$SEG6 detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$SEG6(&(0x7f0000000080), 0xffffffffffffffff) program crashed: KASAN: slab-use-after-free Read in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF-socket$nl_generic detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) socket$nl_generic(0x10, 0x3, 0x10) program crashed: KASAN: use-after-free Read in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun-ioctl$TUNSETIFF detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r4, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) program crashed: KASAN: use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS-openat$tun detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp-getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PEER_AUTH_CHUNKS(r3, 0x84, 0x1a, 0x0, &(0x7f0000000100)) program crashed: KASAN: use-after-free Read in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io-socket$inet6_sctp detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) socket$inet6_sctp(0xa, 0x5, 0x84) program crashed: KASAN: slab-use-after-free Read in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect-syz_usb_control_io detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) r2 = syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) syz_usb_control_io(r2, 0x0, 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals-syz_usb_connect detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-fcntl$addseals detailed listing: executing program 0: r0 = memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r1 = socket(0x10, 0x3, 0x0) write(r1, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) fcntl$addseals(r0, 0x409, 0x5) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-write-syz_usb_connect detailed listing: executing program 0: memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) r0 = socket(0x10, 0x3, 0x0) write(r0, &(0x7f00000000c0)="3c00000058001f00032ae4f9002304000a04d65f080001000201000217d1ae3b70b0406700912deb5b859322340b0100000078f72e230a19fb2bcb1d", 0x3c) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-socket-syz_usb_connect detailed listing: executing program 0: memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) socket(0x10, 0x3, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_close_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): memfd_create-syz_usb_connect detailed listing: executing program 0: memfd_create(&(0x7f0000000300)='+\x8b\x8a\x16\x11O\xdd\xdfk(F\x99\xdf\x92\xd5>oJ\x02u\x9b\xafa\xac\x06\x9c&\xf5\xe3j\xfa\tcqM\xb8R\x86\xd9\xd2.\x9f\x12\xed\x10\f\xbd\x1a|\x8a\xbb\xda\xcfY\x98gU@\xf2M\xc0\xb5\xdf\x9a\x8d\xdb,n\xae\x0eT\x80\x8c\xfd\xd7\xb0\x94\x82t\x96\rKx\xc5\x9b\x8c\x87\x96\x8bc\xbc\xee\xcc\x9f\xe3F\x99V4\x8e;M\xa9\x823\xe3\xb3mG\x8f\xdb\xed\x1b\x05\xec\xfc\xd1\xb5\xfd\xec@\xdeU\xdd\xa4\xc1\xe4L)\x8e\xe5\x91\x8e\xd4\x89\xef\x95T\x05G\xac\xb8\xc1: )mh\xc7\xf1?\xbb\x13;\xad\x95\xd70\xb6\x0e\x7f\x84r\x0e\xbf\xc5\xf6\xd4\xdd\t\x14\x18\xf7\xefi\x93\x03\xd2\xf2\bK\"\xd2\xb5\xaa\xb8\xc8\xe0\xac\x99\xe8su\xcd\xc3E\x12\xd7\xdd\x96!\x16Tu\xe3\xf0\x84#R\xd9\xe3~Wj\xb0r\x87\'\xea\a\xcfOeK\x9daW\xf4\x87@\x9c\xf3\xf1K\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x91\xe6\xdb\xc2\xa5h\'\xdfIn\x97\x0263~\xeb\xbe(i\n\xc2k4\x7f\x12\xa9e`SOs\x8c\xb4\xe7FeQ\xc6$\x92j_U\xfa\b\xea\xb0bYkW\xc0\x05\aC{\xcc\x03T\x17\xa5Sk\x87P\xc2\x97D\xb2\xfa\x1b\x9fe\xf4\x10\x1a\xad\x92\xce\x88\x1b\xbc\xe14\x19\xaa\xd3\r\xf4\xa2\xc3\x9e=\xa0 \xe6j\xe5\x85\xf8\x97\x03\x15\xaa\x920\xdcrI\xd8\b\xfb\xc7\xe7xX\x00>d\xbb\xa71\xad\x9a\xfb\xe6\x13\x87\x93\\\xe5W-\xfc\xfd\xb8O\xb9j\xb8\xf2\x9dx\xb2\x86\xad\x92', 0x3) syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB], 0x0) program did not crash extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: slab-use-after-free Read in em28xx_close_extension simplifying C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:4 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: KASAN: use-after-free Read in em28xx_close_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect program crashed: BUG: corrupted list in em28xx_init_extension testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension validation run: crashed=true testing program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:false Swap:false UseTmpDir:false HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect detailed listing: executing program 0: syz_usb_connect(0x0, 0x2d, &(0x7f00000009c0)=ANY=[@ANYBLOB="9f01000083667d1040206502d14e0102030109021b0001f6000000090400000190f19c000905f3ed8295091f8fee2efe39472f1ea3227d052d7556c97a470fa22bee95e09780953cc585369ad5511fb3243191c3"], 0x0) program crashed: BUG: corrupted list in em28xx_init_extension validation run: crashed=true reproducing took 2h17m12.980835696s repro crashed as (corrupted=false): em28xx 1-1:246.0: AC97 chip type couldn't be determined em28xx 1-1:246.0: No AC97 audio processor non-slab/vmalloc memory list_add corruption. prev->next should be next (ffffffff8fc129e0), but was ffffffff8133b13a. (prev=ffff88805a284250). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:34! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5861 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004376b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 3e48c5619a4e7200 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: ffffc900043768a7 R09: 1ffff9200086ed14 R10: dffffc0000000000 R11: fffff5200086ed15 R12: 1ffff1100b45084a R13: dffffc0000000000 R14: ffff88805a284250 R15: ffff888033ffc250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30c63fff CR3: 000000007a410000 CR4: 00000000003526f0 Call Trace: __list_add_valid include/linux/list.h:96 [inline] __list_add include/linux/list.h:158 [inline] list_add_tail include/linux/list.h:191 [inline] em28xx_init_extension+0x56/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1114 em28xx_init_dev+0xc01/0x3280 drivers/media/usb/em28xx/em28xx-cards.c:3686 em28xx_usb_probe+0x157b/0x2b10 drivers/media/usb/em28xx/em28xx-cards.c:4041 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953 process_one_work+0x9ab/0x1780 kernel/workqueue.c:3288 process_scheduled_works kernel/workqueue.c:3379 [inline] worker_thread+0xbee/0x11e0 kernel/workqueue.c:3465 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004376b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 3e48c5619a4e7200 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: ffffc900043768a7 R09: 1ffff9200086ed14 R10: dffffc0000000000 R11: fffff5200086ed15 R12: 1ffff1100b45084a R13: dffffc0000000000 R14: ffff88805a284250 R15: ffff888033ffc250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30c63fff CR3: 000000003888c000 CR4: 00000000003526f0 final repro crashed as (corrupted=false): em28xx 1-1:246.0: AC97 chip type couldn't be determined em28xx 1-1:246.0: No AC97 audio processor non-slab/vmalloc memory list_add corruption. prev->next should be next (ffffffff8fc129e0), but was ffffffff8133b13a. (prev=ffff88805a284250). ------------[ cut here ]------------ kernel BUG at lib/list_debug.c:34! Oops: invalid opcode: 0000 [#1] SMP KASAN PTI CPU: 0 UID: 0 PID: 5861 Comm: kworker/0:3 Not tainted syzkaller #0 PREEMPT(full) Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 02/12/2026 Workqueue: usb_hub_wq hub_event RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004376b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 3e48c5619a4e7200 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: ffffc900043768a7 R09: 1ffff9200086ed14 R10: dffffc0000000000 R11: fffff5200086ed15 R12: 1ffff1100b45084a R13: dffffc0000000000 R14: ffff88805a284250 R15: ffff888033ffc250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30c63fff CR3: 000000007a410000 CR4: 00000000003526f0 Call Trace: __list_add_valid include/linux/list.h:96 [inline] __list_add include/linux/list.h:158 [inline] list_add_tail include/linux/list.h:191 [inline] em28xx_init_extension+0x56/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1114 em28xx_init_dev+0xc01/0x3280 drivers/media/usb/em28xx/em28xx-cards.c:3686 em28xx_usb_probe+0x157b/0x2b10 drivers/media/usb/em28xx/em28xx-cards.c:4041 usb_probe_interface+0x668/0xc90 drivers/usb/core/driver.c:396 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_set_configuration+0x1a87/0x2110 drivers/usb/core/message.c:2266 usb_generic_driver_probe+0x8d/0x150 drivers/usb/core/generic.c:250 usb_probe_device+0x1c4/0x3b0 drivers/usb/core/driver.c:291 call_driver_probe drivers/base/dd.c:-1 [inline] really_probe+0x267/0xaf0 drivers/base/dd.c:721 __driver_probe_device+0x18c/0x320 drivers/base/dd.c:863 driver_probe_device+0x4f/0x240 drivers/base/dd.c:893 __device_attach_driver+0x279/0x430 drivers/base/dd.c:1021 bus_for_each_drv+0x258/0x2f0 drivers/base/bus.c:500 __device_attach+0x2c5/0x450 drivers/base/dd.c:1093 device_initial_probe+0xa1/0xd0 drivers/base/dd.c:1148 bus_probe_device+0x12a/0x220 drivers/base/bus.c:613 device_add+0x7b6/0xb70 drivers/base/core.c:3692 usb_new_device+0xa08/0x16f0 drivers/usb/core/hub.c:2695 hub_port_connect drivers/usb/core/hub.c:5567 [inline] hub_port_connect_change drivers/usb/core/hub.c:5707 [inline] port_event drivers/usb/core/hub.c:5871 [inline] hub_event+0x2a1c/0x4f30 drivers/usb/core/hub.c:5953 process_one_work+0x9ab/0x1780 kernel/workqueue.c:3288 process_scheduled_works kernel/workqueue.c:3379 [inline] worker_thread+0xbee/0x11e0 kernel/workqueue.c:3465 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x51e/0xb90 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Modules linked in: ---[ end trace 0000000000000000 ]--- RIP: 0010:__list_add_valid_or_report+0x123/0x130 lib/list_debug.c:32 Code: e8 a2 87 48 fd 43 80 3c 2c 00 74 08 4c 89 f7 e8 e3 24 6a fd 49 8b 16 48 c7 c7 60 89 4a 8c 48 89 de 4c 89 f1 e8 8e 7d 61 fc 90 <0f> 0b 66 66 2e 0f 1f 84 00 00 00 00 00 90 90 90 90 90 90 90 90 90 RSP: 0018:ffffc90004376b20 EFLAGS: 00010246 RAX: 0000000000000075 RBX: ffffffff8fc129e0 RCX: 3e48c5619a4e7200 RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 RBP: 1ffffffff1f8253d R08: ffffc900043768a7 R09: 1ffff9200086ed14 R10: dffffc0000000000 R11: fffff5200086ed15 R12: 1ffff1100b45084a R13: dffffc0000000000 R14: ffff88805a284250 R15: ffff888033ffc250 FS: 0000000000000000(0000) GS:ffff888124de1000(0000) knlGS:0000000000000000 CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 CR2: 0000001b30c63fff CR3: 000000003888c000 CR4: 00000000003526f0