Extracting prog: 26m18.053084335s Minimizing prog: 23m46.33272817s Simplifying prog options: 0s Extracting C: 2m13.733691724s Simplifying C: 30m21.265326652s extracting reproducer from 50 programs testing a last program of every proc single: executing 11 programs separately with timeout 30s testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket-sendmsg$nl_route_sched-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@deltclass={0x24, 0x29, 0x800, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x5, 0xfff2}, {0x3, 0xb}, {0xf, 0x1}}}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5400000010000104000000000300000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000340012800b000100697036746e6c000024000280040013"], 0x54}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010000104002000"/20, @ANYRES32=r2, @ANYBLOB="02000000ac0e0000280012800b000100697036746e6c00001800020003006714e112"], 0x48}, 0x1, 0x0, 0x0, 0x240440c0}, 0x810) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$rtl8150-syz_usb_control_io$cdc_ecm-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$printer-syz_usb_control_io$cdc_ecm-syz_usb_control_io$cdc_ecm-syz_usb_control_io-syz_usb_control_io$printer detailed listing: executing program 0: r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12014101175129205705092006c70102030109022400010200100009045807028ab53800090506020001000006090582020002"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_generic-ioctl$sock_SIOCGIFINDEX_80211-mkdirat-ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES-syz_usb_connect-openat$sequencer2 detailed listing: executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1e0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x80489439, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): sendmsg$rds-socket$l2tp-bind$inet-mprotect-connect$inet detailed listing: executing program 0: sendmsg$rds(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x2c}], 0x1, 0x3}}], 0x48}, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) connect$inet(r0, &(0x7f00000006c0)={0x2, 0x4e22, @local}, 0x10) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$nl80211-socket$nl_generic-sendmsg$NL80211_CMD_SET_TID_CONFIG detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="495300000000000000006700000008000300", @ANYRES32=0x0, @ANYBLOB="04002c01"], 0x20}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_genetlink_get_family_id$nl80211-socket$nl_generic-sendmsg$NL80211_CMD_SET_TID_CONFIG detailed listing: executing program 0: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="495300000000000000006700000008000300", @ANYRES32=0x0, @ANYBLOB="04002c01"], 0x20}}, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ttyprintk-ioctl$TCXONC-socket$netlink-bind$netlink-ioctl$BTRFS_IOC_ENCODED_READ-setsockopt$sock_int-ioctl$TCGETA-setsockopt$netlink_NETLINK_BROADCAST_ERROR-socket$nl_generic-sendmsg$nl_generic-close-socket-connect$inet-syz_usb_connect-bpf$LINK_GET_FD_BY_ID-bpf$ITER_CREATE-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETLINK-socketpair$nbd-ioctl$SIOCSIFHWADDR-close-syz_usb_control_io$uac1-openat$vga_arbiter-ioctl$AUTOFS_DEV_IOCTL_FAIL-ioctl$FICLONERANGE-write$vga_arbiter-socket$inet_udp detailed listing: executing program 0: r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000440)={&(0x7f0000000400)=[{&(0x7f0000000340)="7200c82ad1cce49d63c9cc356033a235e4de909f5758061fa2911fd8aa7ceae57d3da60f8664961f53a4eddd9891d485afa57ed9ea2f232afc4badf28077620a7a4e6acffb992c743884de05da07ad10e90b0aecef969ab084779f87c23829b9157793f2807d58b68442d6dd9fc84027cc3f8b5a38c369a8e7bc3017d6c94d324f9c75755877583a1ccf64f86c59342e3e4476fba6554cf92289c74835037929a1ff105b3745680b51cb111f52", 0xad}], 0x1, 0x4, 0x0, 0x6, 0xf, 0x0, 0x0, 0x46b9}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) ioctl$TCGETA(r0, 0x5405, &(0x7f00000001c0)) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0x17fe, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x20000880) close(r0) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @private=0xa010100}, 0x8) r4 = syz_usb_connect(0x4, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010059eac60054a37b10720c13000000"], 0x0) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280)=0xffffffffffffffff, 0x4) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r5}, 0x8) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r6, 0x400454cd, 0x20) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local}) close(0x3) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="800c68000000ebf81c2900592cf6bdc08a7fbbe0072f13000000000075b779a73be0a6f9099287174afaccdf0100e7a65ee9bab87d9080ed80603826b56177b53e9f29ac2d830eaa8c17cbc4916f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x183081, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0xfffffffd, 0x2}}, './file0\x00'}) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000240)={{r3}, 0x1, 0x4, 0x1}) write$vga_arbiter(r8, &(0x7f0000000300)=ANY=[@ANYBLOB="7472796c6f9d7520696f2b6d656d00"], 0xf) socket$inet_udp(0x2, 0x2, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): openat$ttyprintk-ioctl$TCXONC-socket$netlink-bind$netlink-ioctl$BTRFS_IOC_ENCODED_READ-setsockopt$sock_int-ioctl$TCGETA-setsockopt$netlink_NETLINK_BROADCAST_ERROR-socket$nl_generic-sendmsg$nl_generic-close-socket-connect$inet-syz_usb_connect-bpf$LINK_GET_FD_BY_ID-bpf$ITER_CREATE-openat$tun-ioctl$TUNSETIFF-ioctl$TUNSETLINK-socketpair$nbd-ioctl$SIOCSIFHWADDR-close-syz_usb_control_io$uac1-openat$vga_arbiter-ioctl$AUTOFS_DEV_IOCTL_FAIL-ioctl$FICLONERANGE-write$vga_arbiter-socket$inet_udp detailed listing: executing program 0: r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000440)={&(0x7f0000000400)=[{&(0x7f0000000340)="7200c82ad1cce49d63c9cc356033a235e4de909f5758061fa2911fd8aa7ceae57d3da60f8664961f53a4eddd9891d485afa57ed9ea2f232afc4badf28077620a7a4e6acffb992c743884de05da07ad10e90b0aecef969ab084779f87c23829b9157793f2807d58b68442d6dd9fc84027cc3f8b5a38c369a8e7bc3017d6c94d324f9c75755877583a1ccf64f86c59342e3e4476fba6554cf92289c74835037929a1ff105b3745680b51cb111f52", 0xad}], 0x1, 0x4, 0x0, 0x6, 0xf, 0x0, 0x0, 0x46b9}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) ioctl$TCGETA(r0, 0x5405, &(0x7f00000001c0)) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0x17fe, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x20000880) close(r0) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @private=0xa010100}, 0x8) r4 = syz_usb_connect(0x4, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010059eac60054a37b10720c13000000"], 0x0) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280)=0xffffffffffffffff, 0x4) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r5}, 0x8) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r6, 0x400454cd, 0x20) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local}) close(0x3) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="800c68000000ebf81c2900592cf6bdc08a7fbbe0072f13000000000075b779a73be0a6f9099287174afaccdf0100e7a65ee9bab87d9080ed80603826b56177b53e9f29ac2d830eaa8c17cbc4916f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x183081, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0xfffffffd, 0x2}}, './file0\x00'}) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000240)={{r3}, 0x1, 0x4, 0x1}) write$vga_arbiter(r8, &(0x7f0000000300)=ANY=[@ANYBLOB="7472796c6f9d7520696f2b6d656d00"], 0xf) socket$inet_udp(0x2, 0x2, 0x0) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-madvise-syz_genetlink_get_family_id$ethtool-sched_setattr-madvise-mremap-prctl$PR_SET_IO_FLUSHER-creat-write$binfmt_script-fsopen-socket$rxrpc-setsockopt$RXRPC_SECURITY_KEY-fsconfig$FSCONFIG_SET_PATH_EMPTY-bpf$PROG_LOAD-setxattr$trusted_overlay_nlink-close-execve-syz_usb_connect-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_usb_connect-syz_open_dev$radio-readv-read detailed listing: executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f000082f000/0x2000)=nil, 0x2000, 0x19) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x1, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f00005e6000/0x4000)=nil, 0x4000, 0x3) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, 0x0, 0x0) fsopen(&(0x7f0000000300)='minix\x00', 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEY(r3, 0x110, 0x1, &(0x7f0000000040)='\x04]{!\x00', 0x5) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00', 0x0, 0xffffffffffffff9c) bpf$PROG_LOAD(0x5, 0x0, 0x0) setxattr$trusted_overlay_nlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000140), &(0x7f0000000180)={'L-', 0x40}, 0x16, 0x0) close(r2) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a130102030109021b0001000010000904cdf100d3"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, 0x0, &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) syz_usb_connect(0x1, 0x24, &(0x7f00000001c0)=ANY=[@ANYRES16=0x0], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x380a}}]}) r4 = syz_open_dev$radio(&(0x7f0000002100), 0x2, 0x2) readv(r4, &(0x7f0000000280)=[{&(0x7f0000000000)=""/183, 0xb7}], 0x1) read(0xffffffffffffffff, &(0x7f0000001e80)=""/96, 0x60) program did not crash testing program (duration=30s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket$nl_netfilter-socketpair$unix-connect$unix-sendmmsg$unix-recvmmsg-prctl$PR_SCHED_CORE-madvise-syz_genetlink_get_family_id$ethtool-sched_setattr-madvise-mremap-prctl$PR_SET_IO_FLUSHER-creat-write$binfmt_script-fsopen-socket$rxrpc-setsockopt$RXRPC_SECURITY_KEY-fsconfig$FSCONFIG_SET_PATH_EMPTY-bpf$PROG_LOAD-setxattr$trusted_overlay_nlink-close-execve-syz_usb_connect-bpf$BPF_PROG_RAW_TRACEPOINT_LOAD-syz_usb_connect-syz_open_dev$radio-readv-read detailed listing: executing program 0: socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f000082f000/0x2000)=nil, 0x2000, 0x19) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x1, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f00005e6000/0x4000)=nil, 0x4000, 0x3) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, 0x0, 0x0) fsopen(&(0x7f0000000300)='minix\x00', 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEY(r3, 0x110, 0x1, &(0x7f0000000040)='\x04]{!\x00', 0x5) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00', 0x0, 0xffffffffffffff9c) bpf$PROG_LOAD(0x5, 0x0, 0x0) setxattr$trusted_overlay_nlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000140), &(0x7f0000000180)={'L-', 0x40}, 0x16, 0x0) close(r2) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a130102030109021b0001000010000904cdf100d3"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, 0x0, &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) syz_usb_connect(0x1, 0x24, &(0x7f00000001c0)=ANY=[@ANYRES16=0x0], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x380a}}]}) r4 = syz_open_dev$radio(&(0x7f0000002100), 0x2, 0x2) readv(r4, &(0x7f0000000280)=[{&(0x7f0000000000)=""/183, 0xb7}], 0x1) read(0xffffffffffffffff, &(0x7f0000001e80)=""/96, 0x60) program did not crash single: failed to extract reproducer bisect: bisecting 50 programs with base timeout 30s testing program (duration=42s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): [28, 27, 27, 28, 28, 28, 27, 28, 28, 28, 28, 28, 28, 3, 16, 3, 3, 3, 3, 3, 5, 5, 5, 5, 5, 5, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6, 6] detailed listing: executing program 1: syz_usb_connect(0x5, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0x5c, 0xb7, 0x45, 0x20, 0x402, 0x5602, 0x6629, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x3, 0x8a, 0x0, 0x11, "", [{{0x9, 0x4, 0x2f, 0x3, 0x0, 0xb5, 0x12, 0xa0, 0x5}}]}}]}}, 0x0) r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000007c0), 0x2, 0x0) ioctl$TCXONC(0xffffffffffffffff, 0x540a, 0x3) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r2 = syz_open_procfs(0x0, &(0x7f0000000340)='timerslack_ns\x00') cachestat(r2, 0x0, 0x0, 0x0) ioctl$XFS_IOC_GETBMAP(r2, 0xc0205826, &(0x7f0000000040)={0x3ff, 0x6, 0x8, 0xfffffffb, 0x1}) sendmsg$netlink(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000040)=ANY=[@ANYBLOB], 0x20}], 0x1, 0x0, 0x0, 0x20040001}, 0x40040) r3 = eventfd(0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000800)={0xa, 0x4e24, 0x4bf, @dev={0xfe, 0x80, '\x00', 0xf}, 0x34bbe269}, 0x1c) writev(0xffffffffffffffff, &(0x7f0000000680)=[{&(0x7f0000000080)="580000001400add427323b472545b45602117fffffff81004e230e227f000001925aa80020007b00090080007f000001e80900", 0x33}], 0x1) ioctl$VHOST_SET_LOG_FD(r0, 0x4004af07, &(0x7f0000000240)=r3) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f00000002c0)={0x1, r3}) ioctl$ifreq_SIOCGIFINDEX_team(r1, 0x8933, &(0x7f0000000140)) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000880)={0x0, 0x0, 0x0, &(0x7f0000000180)=""/53, 0x0, 0x1000}) ioctl$VHOST_SET_VRING_ADDR(r0, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/245, &(0x7f00000000c0)=""/87, &(0x7f0000000800)=""/90}) ioctl$VHOST_SET_MEM_TABLE(r0, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r0, 0x4004af61, &(0x7f0000000340)=0x1) ioctl$BTRFS_IOC_SCRUB_PROGRESS(r0, 0xc400941d, &(0x7f0000000380)={0x0, 0x3ff, 0x5}) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)={0x60, 0x0, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x20, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast2=0xe0000001}, {0x8, 0x2, @dev}}}, @CTA_TUPLE_ZONE={0x6, 0x3, 0x1, 0x0, 0x4}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x2}]}, 0x60}}, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="6c000000000101040000660c141a000002000000240001801400018008000300e000000108000200e00000010c00028005000100000000002c00028014000180080001000000000008000200ac1e00010c000280050001000000000006000340000100000800074000000001"], 0x6c}}, 0x0) r6 = socket$netlink(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_PKTINFO(r6, 0x10e, 0xc, &(0x7f0000000040)=0x8, 0x4) sendmsg$nl_route(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000008c0)=ANY=[@ANYBLOB="7ab764efdc4f132c652485505d384ccc6b1989f725f8ef7896ac0fcd857fb5fbfca75c885de765e955a2131efa29f498aefa2ccd539c7b894e5e3a800a557245aa7d4041933732d0f75c0964e11886ce3068968d517015dc53dd537af0877b036d8b90487b5ab7ec906a472594136bbcdb340649b00edc3eb8c6824722c1da45763772022c5a831f4d381c2228d6dc416cb2ba4aeec684ad73e7a95c68467a8195f76dc6074183fc05166bc8ae52bae7b906873ceda06e8789f35a71e11dab5e7b6c3ade6ee6320d9060bf0c", @ANYRESHEX=r4], 0x28}, 0x1, 0x0, 0x0, 0x24028031}, 0x802) executing program 1: prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x4000000000000, 0x0, 0x0) r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000080)=0xa0000) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r2, 0x84, 0x64, &(0x7f0000000080)=[@in={0x2, 0x4e20, @empty}], 0x10) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r2, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x10, &(0x7f0000000040)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x20}}]}, &(0x7f0000000100)=0x10) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r2, 0x84, 0x85, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nbd(0x0, 0xffffffffffffffff) bpf$MAP_CREATE(0x0, 0x0, 0x48) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r2, 0x84, 0x9, &(0x7f0000000340)={r3, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x80000001, 0x2, 0x614, 0x1, 0xb5, 0x8, 0x4}, 0x9c) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, 0x0) r4 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_REALDEV_NAME_CMD(r4, 0x8982, &(0x7f0000000080)={0x8, 'vlan0\x00', {'vxcan1\x00'}, 0x7}) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f00000000c0)={'ip6tnl0\x00', &(0x7f0000000000)={'syztnl1\x00', 0x0, 0x4, 0x0, 0x0, 0x0, 0x7, @dev={0xfe, 0x80, '\x00', 0x2f}, @dev={0xfe, 0x80, '\x00', 0x30}, 0x8, 0x0, 0x3, 0x1}}) ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@my=0x0}) r5 = openat$ttynull(0xffffffffffffff9c, &(0x7f0000000140), 0x20502, 0x0) ioctl$TIOCSTI(r5, 0x5412, &(0x7f0000000040)=0x39) copy_file_range(r5, &(0x7f0000000080)=0x2, r5, 0x0, 0x7ff, 0x0) executing program 1: prctl$PR_SET_THP_DISABLE(0x29, 0x1000000) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000001c0)={0x30, 0x1, 0x4, 0x801, 0x0, 0x0, {0x5, 0x0, 0x4}, [@NFULA_CFG_CMD={0x5, 0x1, 0x1}, @NFULA_CFG_MODE={0xa, 0x2, {0x4}}, @NFULA_CFG_TIMEOUT={0x8, 0x4, 0x1, 0x0, 0x1}]}, 0x30}, 0x1, 0x0, 0x0, 0x10}, 0x40000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) r1 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TIOCSETD(r1, 0x5423, &(0x7f0000000340)=0x15) ioctl$TIOCSTI(r1, 0x5412, &(0x7f00000002c0)=0x7e) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000140)=0x1a) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000000)=0x7d) syz_open_dev$vcsa(&(0x7f0000000380), 0x6cf5, 0x20080) ioctl$TIOCSTI(r1, 0x5412, &(0x7f0000000300)=0x2) r2 = socket(0x10, 0x803, 0x0) preadv(r2, &(0x7f0000002c40)=[{&(0x7f0000000040)=""/166, 0xa6}, {&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000001800)=""/239, 0xef}, {&(0x7f0000001900)=""/96, 0x60}, {&(0x7f0000001980)=""/105, 0x69}, {&(0x7f0000001a00)=""/56, 0x38}, {&(0x7f0000001a40)=""/4096, 0x1000}, {&(0x7f0000002a40)=""/145, 0x91}, {&(0x7f0000002b40)=""/193, 0xc1}], 0x9, 0x3, 0x81) r3 = msgget$private(0x0, 0x200) r4 = socket$netlink(0x10, 0x3, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = accept4$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x0, @local}, &(0x7f0000000040)=0x10, 0x0) ioctl$sock_SIOCOUTQNSD(r6, 0x894b, &(0x7f0000000100)) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x1000000000021, 0x0, 0x0) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x24, 0x0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[], 0x78}, 0x1, 0x0, 0x0, 0x840}, 0x0) recvmmsg(r5, &(0x7f0000004980)=[{{0x0, 0x0, 0x0}, 0x2}, {{0x0, 0x0, 0x0}, 0x7f}, {{0x0, 0x0, 0x0}, 0x5a}, {{0x0, 0x0, &(0x7f0000000300)=[{&(0x7f0000001000)=""/41, 0x29}, {&(0x7f0000000180)=""/237, 0xed}, {&(0x7f0000002a80)=""/217, 0xd9}], 0x3}, 0x53}], 0x4, 0x40002002, 0x0) sendmsg$netlink(r4, &(0x7f0000000740)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f00000000c0)=ANY=[@ANYBLOB="3c0000001000010000000000000000002c00000020000000ff0f00000000000008001c00c9"], 0x3c}], 0x1, 0x0, 0x0, 0xb305e06d8ab48273}, 0x48800) msgsnd(r3, &(0x7f0000000200)=ANY=[@ANYBLOB="01"], 0xff, 0x0) fsetxattr$trusted_overlay_origin(r5, &(0x7f00000003c0), &(0x7f0000000400), 0x2, 0x3) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000007c0)=@newlink={0x40, 0x10, 0x437, 0xffdffffe, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x704c3, 0xc4a48b7f26bf141b}, [@IFLA_LINKINFO={0x20, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x10, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_INDEX={0x8, 0x15, 0x100000}, @IFLA_GRE_COLLECT_METADATA={0x4}]}}}]}, 0x40}, 0x1, 0x0, 0x0, 0x20a7d52d1a3e1087}, 0x1000c014) mount$binderfs(0x0, &(0x7f0000000000)='./binderfs\x00', 0x0, 0x22048a0, 0x0) executing program 1: r0 = socket$inet_sctp(0x2, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r1 = getpid() sched_setscheduler(r1, 0x1, &(0x7f0000000200)=0x7) syz_usb_connect(0x5, 0x0, 0x0, 0x0) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(0xffffffffffffffff, 0xc02064b9, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4040044) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000005ec0), 0xffffffffffffffff) r4 = socket$inet6_udp(0xa, 0x2, 0x0) bind$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000005f00)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000006000)={0x0, 0x0, &(0x7f0000005fc0)={&(0x7f0000000000)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="01002dbd0600ffdbdb2521000000", @ANYRES32=r5, @ANYBLOB="0600eb00000800000400ec000a00060008021100000100000600f70000ff000008009e"], 0x44}}, 0x28000) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) setsockopt$IP_VS_SO_SET_ADD(r0, 0x0, 0x482, &(0x7f0000000280)={0x84, @dev={0xac, 0x14, 0x14, 0xb}, 0x5, 0x3, 'sh\x00', 0x1, 0x4, 0x72}, 0x2c) setsockopt$IP_VS_SO_SET_ADDDEST(r0, 0x0, 0x487, &(0x7f0000000000)={{0x84, @rand_addr=0x64010102, 0x4e1f, 0x3, 'lc\x00', 0x34, 0x83, 0x5}, {@rand_addr=0x64010102, 0x4e23, 0x2, 0xcf, 0x12d5c, 0x12d5c}}, 0x44) setsockopt$IP_VS_SO_SET_EDITDEST(r0, 0x0, 0x489, &(0x7f0000000380)={{0x84, @multicast1, 0x4e20, 0x3, 'ovf\x00', 0x0, 0x60000000, 0xd}, {@rand_addr=0x64010102, 0x4e23, 0x1, 0x8, 0x48001, 0x38}}, 0x44) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000580)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x40, 0x40, 0x2, [@const={0x0, 0x0, 0x0, 0x9, 0x3}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x8}, @array={0x0, 0x0, 0x0, 0x3, 0x0, {0x2, 0x2}}, @restrict={0x0, 0x0, 0x0, 0xb, 0x3}]}}, 0x0, 0x5a, 0x0, 0x3}, 0x28) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x40) io_uring_setup(0x1b78, 0x0) executing program 1: socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f000082f000/0x2000)=nil, 0x2000, 0x19) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x1, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f00005e6000/0x4000)=nil, 0x4000, 0x3) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, 0x0, 0x0) fsopen(&(0x7f0000000300)='minix\x00', 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEY(r3, 0x110, 0x1, &(0x7f0000000040)='\x04]{!\x00', 0x5) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00', 0x0, 0xffffffffffffff9c) bpf$PROG_LOAD(0x5, 0x0, 0x0) setxattr$trusted_overlay_nlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000140), &(0x7f0000000180)={'L-', 0x40}, 0x16, 0x0) close(r2) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a130102030109021b0001000010000904cdf100d3"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, 0x0, &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) syz_usb_connect(0x1, 0x24, &(0x7f00000001c0)=ANY=[@ANYRES16=0x0], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x380a}}]}) r4 = syz_open_dev$radio(&(0x7f0000002100), 0x2, 0x2) readv(r4, &(0x7f0000000280)=[{&(0x7f0000000000)=""/183, 0xb7}], 0x1) read(0xffffffffffffffff, &(0x7f0000001e80)=""/96, 0x60) executing program 32: socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) madvise(&(0x7f000082f000/0x2000)=nil, 0x2000, 0x19) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x1, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) madvise(&(0x7f00005e6000/0x4000)=nil, 0x4000, 0x3) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x4000, 0x3, &(0x7f0000814000/0x4000)=nil) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) r2 = creat(&(0x7f0000000280)='./file0\x00', 0xecf86c37d53049cc) write$binfmt_script(r2, 0x0, 0x0) fsopen(&(0x7f0000000300)='minix\x00', 0x0) r3 = socket$rxrpc(0x21, 0x2, 0x2) setsockopt$RXRPC_SECURITY_KEY(r3, 0x110, 0x1, &(0x7f0000000040)='\x04]{!\x00', 0x5) fsconfig$FSCONFIG_SET_PATH_EMPTY(r2, 0x4, &(0x7f0000000080)='\x00\x00\x00\x00\x00\x00\x00', 0x0, 0xffffffffffffff9c) bpf$PROG_LOAD(0x5, 0x0, 0x0) setxattr$trusted_overlay_nlink(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000140), &(0x7f0000000180)={'L-', 0x40}, 0x16, 0x0) close(r2) execve(&(0x7f0000000000)='./file0\x00', 0x0, 0x0) syz_usb_connect(0x2, 0x2d, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100003f3fdc20221802324a130102030109021b0001000010000904cdf100d3"], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1, 0x4, 0x0, &(0x7f00000003c0)='GPL\x00', 0x2, 0x1007, &(0x7f00000005c0)=""/4103, 0x40f00, 0x4, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) syz_usb_connect(0x1, 0x24, &(0x7f00000001c0)=ANY=[@ANYRES16=0x0], &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x0, 0x0}, {0x4, &(0x7f0000000200)=@lang_id={0x4, 0x3, 0x380a}}]}) r4 = syz_open_dev$radio(&(0x7f0000002100), 0x2, 0x2) readv(r4, &(0x7f0000000280)=[{&(0x7f0000000000)=""/183, 0xb7}], 0x1) read(0xffffffffffffffff, &(0x7f0000001e80)=""/96, 0x60) executing program 0: ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, &(0x7f0000000000)={@local}) getsockopt$inet_sctp_SCTP_RESET_STREAMS(0xffffffffffffffff, 0x84, 0x77, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f00000000c0)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(r0, 0x1, &(0x7f0000000180)=0x3) r3 = socket$packet(0x11, 0x2, 0x300) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, 0x0) sendto$packet(r3, 0x0, 0x0, 0x14000b01, 0x0, 0x0) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x8, 0x0, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000040), &(0x7f0000000100)=0xc) r4 = openat$iommufd(0xffffffffffffff9c, 0x0, 0x88800, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f0000000000), 0x402, 0x0) r5 = epoll_create1(0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000100)={0x8}) shutdown(r6, 0x0) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, r6, &(0x7f0000000140)={0x2000200b}) epoll_wait(r5, &(0x7f0000000040)=[{}], 0x1, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r4, 0x3ba0, &(0x7f0000000340)={0x48, 0x5, 0x0, 0x0, 0xffffffffffffffff, 0x1}) executing program 0: capset(0x0, &(0x7f0000000040)={0x200000, 0x200000, 0x20000000}) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000300)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x3, 0xc, 0x6, [@enum64={0x3, 0x0, 0x0, 0x13, 0x1, 0x1}]}, {0x0, [0x2e, 0x61, 0x61, 0x2e]}}, 0x0, 0x2a}, 0x28) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$ieee802154(&(0x7f0000000400), r2) ioctl$sock_SIOCGIFINDEX_802154(r1, 0x8933, &(0x7f0000000080)={'wpan1\x00', 0x0}) sendmsg$IEEE802154_LLSEC_ADD_SECLEVEL(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000000)={0x3c, r3, 0x60b, 0x70bd2d, 0x3, {}, [@IEEE802154_ATTR_DEV_INDEX={0x8, 0x2, r4}, @IEEE802154_ATTR_LLSEC_FRAME_TYPE={0x5, 0x33, 0x3}, @IEEE802154_ATTR_LLSEC_CMD_FRAME_ID={0x5}, @IEEE802154_ATTR_LLSEC_SECLEVELS={0x5}, @IEEE802154_ATTR_LLSEC_DEV_OVERRIDE={0x5, 0x36, 0x1}]}, 0x3c}}, 0x0) sendmsg$NL802154_CMD_NEW_INTERFACE(r0, 0x0, 0x4000) r5 = getpid() r6 = syz_pidfd_open(r5, 0x0) setns(r6, 0x24020000) syz_clone(0x120e111f, 0x0, 0x13, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r8, 0x0, 0x5) setsockopt$sock_attach_bpf(r7, 0x1, 0xa, &(0x7f0000000180), 0x4) recvmsg(r7, &(0x7f0000000040)={0x0, 0x0, 0x0}, 0x0) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) kexec_load(0x3, 0x4, &(0x7f00000005c0)=[{&(0x7f0000000000)="6509534a17aa723cba21a9d63c6a556b30b910a580cb50d65e9fab1ed59a7eb00a7109e4a355bed417bce60d6a5baab4bbecc5b2faaf2eba28c331345b612f1f4cbfdfa7bcb9bd2a0fbc8d7786bb68", 0x4f, 0x5, 0xff}, {&(0x7f0000000100)="047715ac7141c111fab2fcda5de4dc8b278029bcb1bd17524f177856cac105f463c77e2d2ab44d875217dc82baa911f236f959fb9227524d4fe6b621a19823457d04c399283edbac755852623c82f7206d26e918a2981c", 0x57, 0x5, 0xffffffff}, {&(0x7f0000000200)="d8f3aabb28de3faf55566e010b6ef42f8002b91bf54d78caa3135bc4a5d30a8fd06d1e70130a8d2b505e9abe3aef1de2219df6f5f695131fe4fc01630cb7751927628d8d7ec59d998200794f89eea832f53f0f9aa4c91322544bc7f07e8cdf4598c9879e4af2de4daca6cf629d11f9c6ebdccfeca156899a", 0x78, 0x5, 0x4}, {0x0, 0x0, 0x7, 0x2}], 0x0) sendmsg$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{0x0}, {0x0}, {0x0}], 0x3}, 0x0) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000002840)=[{{&(0x7f0000000080)={0xa, 0x4e23, 0x0, @loopback, 0x20}, 0x1c, 0x0}}], 0x1, 0x14018891) sendmsg$inet(0xffffffffffffffff, &(0x7f0000003c00)={0x0, 0x0, &(0x7f0000000700)=[{&(0x7f0000000500)="4274aa814c8f6ea8d8", 0x9}, {0x0}, {0x0}], 0x3}, 0x41) sendmsg$nl_xfrm(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x48001}, 0x4044050) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000016c0)={0x0, 0x0, &(0x7f00000000c0)=[{0x0}, {&(0x7f0000001700)="0c74c75350f4a590e15c61c7942348092734fe1863473bbce6798a60e9", 0x1d}], 0x2, 0x0, 0x0, 0x10}, 0x0) executing program 0: r0 = syz_open_procfs(0x0, &(0x7f0000001e80)='net/ip_mr_vif\x00') pread64(r0, &(0x7f0000003b00)=""/195, 0xc3, 0x591f) r1 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000180), 0x400, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r1, 0xc004500a, &(0x7f0000000000)) ioctl$SNDCTL_DSP_SPEED(r0, 0xc0045002, &(0x7f0000000080)=0x8000056) socket(0x80000000000000a, 0x2, 0x0) syz_emit_ethernet(0x46, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) r2 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0) r3 = syz_genetlink_get_family_id$nl802154(&(0x7f0000000040), 0xffffffffffffffff) r4 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL802154_CMD_NEW_SEC_KEY(r4, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000480)={0x58, r3, 0x1, 0x70bd25, 0x25dfdbff, {}, [@NL802154_ATTR_SEC_KEY={0x38, 0x30, 0x0, 0x1, [@NL802154_KEY_ATTR_USAGE_FRAMES={0x5, 0x2, 0xbe}, @NL802154_KEY_ATTR_BYTES={0x14, 0x4, "e45808761b1042735b91862237f6080a"}, @NL802154_KEY_ATTR_ID={0x18, 0x1, 0x0, 0x1, [@NL802154_KEY_ID_ATTR_MODE={0x8, 0x1, 0x3}, @NL802154_KEY_ID_ATTR_SOURCE_EXTENDED={0xc, 0x5, 0x4}]}]}, @NL802154_ATTR_WPAN_DEV={0xc, 0x6, 0x100000001}]}, 0x58}, 0x1, 0x0, 0x0, 0x4010}, 0x4000084) r5 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$SW_SYNC_IOC_CREATE_FENCE(r5, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100", 0xffffffffffffffff}) ioctl$SW_SYNC_IOC_CREATE_FENCE(r2, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", 0xffffffffffffffff}) ioctl$SYNC_IOC_MERGE(r6, 0xc0303e03, &(0x7f0000000140)={"c14a7b741dbde86bb2dbb521a2b07e9566639c2cf78df8255ff0815d223546e2", r7}) ioctl$SW_SYNC_IOC_INC(r2, 0x40045701, &(0x7f0000000a40)=0xfff) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0xb, 0x6, 0xff}, 0x3a, [0x7ffe, 0xc95a, 0xf, 0x8, 0x80, 0x2, 0x3, 0x10007f, 0x20000006, 0x4d, 0x6, 0x3, 0x9, 0x2, 0xffff2d34, 0xffffff01, 0x6, 0x3, 0xfffffffc, 0x5, 0x4, 0x2, 0x7, 0x3c5b, 0x80000001, 0x24, 0xd, 0x1, 0x0, 0xffffffff, 0xe661, 0x4, 0x7, 0x3, 0x8, 0x4c74, 0x80000000, 0x0, 0x3, 0xe, 0x8, 0x8000806e, 0x7, 0x17, 0x1, 0x7, 0x200, 0x3e, 0x8c, 0x6, 0x6, 0x0, 0x5, 0x4, 0x8, 0x400, 0x80, 0x1, 0x5, 0x6, 0x8, 0x4, 0x1, 0x40], [0x10000007, 0x9, 0x8000012f, 0x4, 0x5, 0xfffffff3, 0x129432e6, 0xc8, 0xf9, 0xe, 0x7, 0x6c7, 0x9, 0xfffffffc, 0x3, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x4, 0x7, 0x7fff, 0x6, 0x400, 0x401, 0x6, 0x1, 0xff, 0x5, 0x3, 0x5f31, 0xd, 0x4e0, 0x2, 0x4, 0xb, 0x1, 0x9, 0x8, 0x9, 0x6, 0x47, 0x8020, 0x1, 0x4, 0xffff, 0x2, 0x4, 0x2, 0x3, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x48c93690, 0x43, 0x103], [0x4, 0xa, 0x4, 0x5, 0xfffffffa, 0x100, 0x8d2, 0x9, 0x5, 0x7fff, 0x0, 0x5, 0xf, 0x4, 0x6, 0x5, 0x0, 0x6, 0x5, 0x1, 0x86, 0x3, 0x303c, 0x3e7, 0xd, 0x5, 0x2, 0x763, 0x3, 0x2000000c, 0x4, 0x6d03, 0x6, 0x38, 0x800003, 0x200, 0x80, 0x3, 0x4, 0x2950bfaf, 0x1000, 0xa2, 0x7, 0xa9, 0x5, 0x6, 0xac8, 0xc2, 0x2, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x1000000a, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2ed, 0x1, 0x25], [0x9, 0xbb33, 0x80000000, 0xb, 0x5, 0x93a, 0x6, 0x1000009, 0x0, 0xbc, 0xce7, 0x1ff, 0x3, 0x57, 0x4, 0x3, 0x101, 0x10000, 0x4, 0x7fff, 0x10000, 0x7f, 0x2, 0x5, 0x1, 0x2, 0x14c, 0x60a7, 0x6, 0x96, 0xffffffff, 0x80000000, 0x0, 0x4, 0xc8, 0x1, 0xfffff000, 0x10080, 0x3, 0x7a, 0x100, 0x1000, 0x7, 0xaf, 0x8, 0x6, 0x226, 0x5, 0x5, 0x1, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x0, 0x4, 0x5, 0xb1e, 0xd7, 0x200, 0xffff3441, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r5, 0x40045701, &(0x7f00000002c0)=0x3) r8 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r8, &(0x7f0000000100)={0x3, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x2, 0x5, 0xfc, 0x2, 0xc, 0x0, 0x0, 0x0, [@sadb_address={0x3, 0x6, 0x3c, 0x0, 0x0, @in={0x2, 0x4e20, @dev}}, @sadb_sa={0x2, 0x1, 0x4d2, 0x0, 0x0, 0x9, 0x0, 0x80000000}, @sadb_address={0x5, 0x5, 0x0, 0x0, 0x0, @in6={0xa, 0x4e20, 0x4, @private2, 0x8}}]}, 0x60}, 0x1, 0x7}, 0x0) ioctl$SNDCTL_DSP_CHANNELS(r1, 0xc0045006, &(0x7f0000000040)=0xc) futex(&(0x7f000000cffc), 0xb, 0x0, &(0x7f0000fd7ff0), &(0x7f0000048000)=0x1, 0x0) syz_usb_connect$uac3(0x3, 0xdf, &(0x7f0000000240)=ANY=[@ANYBLOB="1201500200000020cc171c044000010203010902cd000301071005080b0003010130950904000000010130000a24010a310000000000140100030102050943000000000000000900feff132403050203060404cb0500000400400015"], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) r9 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r9, &(0x7f0000000000)={0xa, 0x4e20, 0x401, @private1={0xfc, 0x1, '\x00', 0x1}, 0x3}, 0x1c) executing program 0: mknod(&(0x7f0000000040)='./file0\x00', 0x8001420, 0x0) r0 = epoll_create1(0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0x40042, 0x1) r2 = userfaultfd(0x80801) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x3000002, 0x5d031, r2, 0x0) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000080)={0xaa, 0x28}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x80402, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r6 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r6, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r6, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r6, &(0x7f0000007fc0), 0x800001d, 0x0) r7 = syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000c00000/0x400000)=nil) syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil) r8 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000180)={0x0, 0x0}) r9 = syz_kvm_add_vcpu$x86(r7, &(0x7f0000000080)={0x0, &(0x7f00000001c0)=[@wrmsr={0x65, 0x20, {0x40000000, 0x3}}, @wrmsr={0x65, 0x20, {0x40000001, 0x3f}}], 0x40}) ioctl$KVM_SET_CPUID2(r9, 0x4008ae90, &(0x7f0000000000)={0x1, 0x0, [{0x40000001, 0x4, 0x3, 0x31237648, 0x6, 0x2, 0x80}]}) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_RUN(r9, 0xae80, 0x0) ioctl$KVM_RUN(r8, 0xae80, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0xf0ffffff) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000040)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4}) mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) ioctl$UFFDIO_COPY(r2, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f00006c0000/0x1000)=nil, 0x800000}) ioctl$KVM_CAP_HYPERV_DIRECT_TLBFLUSH(r1, 0x4068aea3, &(0x7f0000001040)) mount$9p_fd(0x0, &(0x7f00000000c0)='./file0\x00', &(0x7f0000000100), 0x2000001, &(0x7f0000000280)=ANY=[@ANYBLOB='trans=fd,rfdno', @ANYRESHEX=r1, @ANYBLOB=',wfdno', @ANYRESHEX=r0]) executing program 0: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$xdp(0x2c, 0x3, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r2 = getpgrp(0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000040)=0x10000005) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x2, 0x0) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r4 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r4, 0x1, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_xfrm(0x10, 0x3, 0x6) openat$sndseq(0xffffffffffffff9c, 0x0, 0x42202) ioctl$TIOCSWINSZ(0xffffffffffffffff, 0x5414, &(0x7f0000000040)={0x9, 0x2, 0x1000, 0x6}) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, 0x0, 0x0) r6 = socket$tipc(0x1e, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000000)={'veth1_to_batadv\x00', 0x0}) bind$xdp(r1, &(0x7f0000000100)={0x2c, 0x9, r7}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1/file2\x00', 0x81c0, 0x0) openat2$dir(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', &(0x7f0000000180)={0x8001, 0x20}, 0x18) keyctl$set_reqkey_keyring(0xe, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00'}) executing program 0: r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000440)={&(0x7f0000000400)=[{&(0x7f0000000340)="7200c82ad1cce49d63c9cc356033a235e4de909f5758061fa2911fd8aa7ceae57d3da60f8664961f53a4eddd9891d485afa57ed9ea2f232afc4badf28077620a7a4e6acffb992c743884de05da07ad10e90b0aecef969ab084779f87c23829b9157793f2807d58b68442d6dd9fc84027cc3f8b5a38c369a8e7bc3017d6c94d324f9c75755877583a1ccf64f86c59342e3e4476fba6554cf92289c74835037929a1ff105b3745680b51cb111f52", 0xad}], 0x1, 0x4, 0x0, 0x6, 0xf, 0x0, 0x0, 0x46b9}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) ioctl$TCGETA(r0, 0x5405, &(0x7f00000001c0)) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0x17fe, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x20000880) close(r0) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @private=0xa010100}, 0x8) r4 = syz_usb_connect(0x4, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010059eac60054a37b10720c13000000"], 0x0) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280)=0xffffffffffffffff, 0x4) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r5}, 0x8) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r6, 0x400454cd, 0x20) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local}) close(0x3) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="800c68000000ebf81c2900592cf6bdc08a7fbbe0072f13000000000075b779a73be0a6f9099287174afaccdf0100e7a65ee9bab87d9080ed80603826b56177b53e9f29ac2d830eaa8c17cbc4916f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x183081, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0xfffffffd, 0x2}}, './file0\x00'}) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000240)={{r3}, 0x1, 0x4, 0x1}) write$vga_arbiter(r8, &(0x7f0000000300)=ANY=[@ANYBLOB="7472796c6f9d7520696f2b6d656d00"], 0xf) socket$inet_udp(0x2, 0x2, 0x0) executing program 33: r0 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TCXONC(r0, 0x540a, 0x2) r1 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r1, &(0x7f0000000180)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$BTRFS_IOC_ENCODED_READ(r1, 0x80809440, &(0x7f0000000440)={&(0x7f0000000400)=[{&(0x7f0000000340)="7200c82ad1cce49d63c9cc356033a235e4de909f5758061fa2911fd8aa7ceae57d3da60f8664961f53a4eddd9891d485afa57ed9ea2f232afc4badf28077620a7a4e6acffb992c743884de05da07ad10e90b0aecef969ab084779f87c23829b9157793f2807d58b68442d6dd9fc84027cc3f8b5a38c369a8e7bc3017d6c94d324f9c75755877583a1ccf64f86c59342e3e4476fba6554cf92289c74835037929a1ff105b3745680b51cb111f52", 0xad}], 0x1, 0x4, 0x0, 0x6, 0xf, 0x0, 0x0, 0x46b9}) setsockopt$sock_int(r1, 0x1, 0x8, &(0x7f0000000000), 0x4) ioctl$TCGETA(r0, 0x5405, &(0x7f00000001c0)) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r1, 0x10e, 0x4, &(0x7f0000000640)=0x17fe, 0x4) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)=ANY=[@ANYBLOB="280000002e00090027097000000000220400000008000c"], 0x28}, 0x1, 0x0, 0x0, 0x8040}, 0x20000880) close(r0) r3 = socket(0x40000000015, 0x5, 0x0) connect$inet(r3, &(0x7f0000000080)={0x2, 0x0, @private=0xa010100}, 0x8) r4 = syz_usb_connect(0x4, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="12010059eac60054a37b10720c13000000"], 0x0) r5 = bpf$LINK_GET_FD_BY_ID(0x1e, &(0x7f0000000280)=0xffffffffffffffff, 0x4) bpf$ITER_CREATE(0x21, &(0x7f00000002c0)={r5}, 0x8) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'pim6reg1\x00', 0x2}) ioctl$TUNSETLINK(r6, 0x400454cd, 0x20) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r7, 0x8914, &(0x7f0000000140)={'pim6reg1\x00', @link_local}) close(0x3) syz_usb_control_io$uac1(r4, 0x0, &(0x7f0000000780)={0x44, &(0x7f0000000080)=ANY=[@ANYBLOB="800c68000000ebf81c2900592cf6bdc08a7fbbe0072f13000000000075b779a73be0a6f9099287174afaccdf0100e7a65ee9bab87d9080ed80603826b56177b53e9f29ac2d830eaa8c17cbc4916f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r8 = openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x183081, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000200)={{0x1, 0x1, 0x18, r1, {0xfffffffd, 0x2}}, './file0\x00'}) ioctl$FICLONERANGE(r9, 0x4020940d, &(0x7f0000000240)={{r3}, 0x1, 0x4, 0x1}) write$vga_arbiter(r8, &(0x7f0000000300)=ANY=[@ANYBLOB="7472796c6f9d7520696f2b6d656d00"], 0xf) socket$inet_udp(0x2, 0x2, 0x0) executing program 4: r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000180), r0) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r0, &(0x7f0000000780)={0x0, 0x0, &(0x7f0000000740)={&(0x7f0000000440)={0x34, r1, 0x1, 0x170bc2c, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_bond\x00'}]}, @ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x82}, 0x40040) executing program 4: r0 = syz_open_dev$tty20(0xc, 0x4, 0x1) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000009c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-camellia-aesni\x00'}, 0x58) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000840)={0xffffffffffffffff, 0xe0, &(0x7f0000000740)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000540), ""/16, 0x0, 0x0, 0x0, 0x0, 0x4, 0x9, &(0x7f0000000580)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000600)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0xce, 0x0, 0x0, 0x10, &(0x7f0000000680), 0x0, 0x0, 0x3a, 0x8, 0x8, &(0x7f0000000700)}}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0xf, 0xc, &(0x7f0000000940)=ANY=[@ANYBLOB="18000000ff0700000000000000000000850000002a00000018010000646c6c2500000000003120207b1af8ff000000d2c92380000000000007010000f8ffffffb70200002d937b46162f1aee91910b0ff45308000000b70300000000000085"], 0x0, 0x0, 0x0, 0x0, 0x41100, 0x72, '\x00', 0x0, @cgroup_device=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='cgroup.controllers\x00', 0x275a, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0) sendmsg$BATADV_CMD_SET_HARDIF(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) syz_open_procfs(0x0, &(0x7f0000000100)='fd\x00') setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000280)="ad56fa8ef1d91a4574758ecefbe1d7a46df6d558ecf1820f", 0x18) bind$alg(0xffffffffffffffff, &(0x7f0000000200)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000003c0)=[{&(0x7f0000000300)="e9a830dcb405b515c76b9cb4682e3c7d", 0x10}], 0x1, &(0x7f0000000400)=ANY=[], 0xf8}, 0x24000000) r3 = accept4(r1, 0x0, 0x0, 0x800) sendmmsg$alg(r3, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048"}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800) recvmsg(r3, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{0x0}, {&(0x7f0000000200)=""/83, 0x53}], 0x2}, 0x0) write$binfmt_misc(r0, &(0x7f0000000240), 0xfffffecc) executing program 4: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x50) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x1f, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000005080000000000008200000018010000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000048000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000200000085000000a6000000850000005000000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x35}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) executing program 4: r0 = socket$inet6_udp(0xa, 0x2, 0x0) connect$inet6(r0, 0x0, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r0, 0x89f1, &(0x7f00000003c0)={'ip6_vti0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x29, 0x5, 0x8, 0x5, 0x2, @loopback, @loopback, 0x40, 0x700, 0x280000, 0x8}}) executing program 4: r0 = open(&(0x7f0000000300)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r0, 0x40086602, &(0x7f00000001c0)=0x10) mknod$loop(&(0x7f0000000000)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x408, 0x1) executing program 4: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="495300000000000000006700000008000300", @ANYRES32=0x0, @ANYBLOB="04002c01"], 0x20}}, 0x0) executing program 34: r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_SET_TID_CONFIG(r1, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000340)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r0, @ANYBLOB="495300000000000000006700000008000300", @ANYRES32=0x0, @ANYBLOB="04002c01"], 0x20}}, 0x0) executing program 6: r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000440), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) ioctl$KVM_RUN(r2, 0xae80, 0x0) ioctl$KVM_GET_DEBUGREGS(r2, 0x8080aea1, &(0x7f0000000000)) executing program 6: r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000000000402609333340000000000109022400010000000009040000010301000009210000000122010009058103"], 0x0) syz_usb_disconnect(r0) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="31010000dccd5e08cb060700000800000001090224000100007e0009043401"], 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_open_dev$evdev(0x0, 0xe, 0x2) executing program 6: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="09000000060000000800000008"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000740)={0x0, 0xc, &(0x7f0000000440)=@framed={{}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x43, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0xff32, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000180), &(0x7f0000000180), 0x20ce, r0}, 0x38) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1f, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r1, 0xffffffffffffffff, 0x2000000}, 0xc) executing program 6: syz_usb_connect(0x2, 0x6b, &(0x7f00000000c0)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259"], 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000500), 0x28002) r1 = dup(r0) r2 = syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00') mount$9p_fd(0x0, &(0x7f00000001c0)='.\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}}) executing program 6: write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000040)={0xc, {"a2e3ad214fc752f91b3e090987f70e06d038e7ff7fc6e5539b3264078b089b0e083860090890e0878f0f1ac6e7049b334c959b669a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31310d3b5d5036cd3b78070daa61d8e809ea882f5802b77f07227227b7ba67e0e78669a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5003a9aaa1b469c3090000000002335875271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c55432a909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1fe90a56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617601000000be70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f677747abc360934b82910ff85bfd995083bba2987a67399eac427d145d595a40b9f6ff14ac488ec130fb3850a27af9544ae15a7e454dea05918b41243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9980000000b3309603f1d4ab966203861b5b15a841f2b575a8bd0d780231c9c99a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e1088334975e9f73483b6c82fa678ca14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce3803f465e41e610c2021d653a5520000008213b704a5000000000000008ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710a80000000000008000bea37ce0d0d4aa202f928f28381aab144a5d429a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f8ea2e2010000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4e38a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d97b9a6d6d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2bed9e53803edf1a4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034e00000000ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f42355bc7872c827467cfa5c478b095b68441a34cb51682a8ae4d24ad92f243941ed274549b79a7962fb385a882e8020f068bb87af8b90fd8f08876da865d258734dd73583df292892448039ef799cf0630becdbe6c4579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02cca4e91b2f001edb3d78fb4b55668dda93ae62fccfcbb2b75a2183c46eb65ca8124e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43e4fb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e01feffffffffffff83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369d75f2e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aa01b20f7694a00f16e2d0174035a2c22656dc00880acebdbe8ddbd7072f998d8ac2dfad2ba3a50200000045a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4483f8fd777d443e8b40426db6fe2907ac0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf463661c953fcad6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d27df2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7cd419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d81eaeecf1d0ab378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb84bed4b281769177c6d594f88a4facfd4c735a20307c737afae5136651b1b9bd522d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a37684f4113c48859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02dae17b118e5d6787463183b4b87c105000000302a808d7f5251440613d17ca51055f2f416a44fe180d2d50c312cca7cb14a20dc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb40100000006376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7ceec7dc808bf653639d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b34449e15e065cc7348663a52190202c7af288a4510de03dab19d26285eda89156d50dd385a602000000000000007007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4908b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf6529006c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6522fb5f6ffcdd56fed88935fcb75912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae233a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a5bd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08008897fb411a94b3c2fc5d5f0db42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b80c1c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9c861a0e7e65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c98ad90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2c1cde360500000000000000b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1062dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1df0d07b3d5bd3b01faffd0addbed2881a9700af561ac8c7e36bb2fc4c40e9c766c06817bb903729a7db6ff957697c9ede7885d94ffb0759be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c1484d2f9c55f4901203a9a8a2c3e51074b41bc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000600", 0x1000}}, 0x1006) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="380000002e00090027bd7000000000000400000024001180"], 0x38}, 0x1, 0x0, 0x0, 0x42890}, 0x4004004) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) sendmsg$nl_generic(r0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x42804}, 0x4000010) executing program 6: sendmsg$rds(0xffffffffffffffff, &(0x7f0000001600)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000200)=[@rdma_args={0x48, 0x114, 0x1, {{}, {0x0}, &(0x7f00000006c0)=[{&(0x7f0000000100)=""/44, 0x2c}], 0x1, 0x3}}], 0x48}, 0x0) r0 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r0, &(0x7f0000000000)={0x2, 0x0, @multicast1}, 0x10) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) connect$inet(r0, &(0x7f00000006c0)={0x2, 0x4e22, @local}, 0x10) executing program 5: socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) close(r1) bpf$MAP_DELETE_ELEM(0x2, &(0x7f00000003c0)={0xffffffffffffffff, 0x0, 0x20000000}, 0x20) recvmsg$unix(r0, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x40010040) r3 = socket$kcm(0x2c, 0x3, 0x0) setsockopt$sock_attach_bpf(r3, 0x11b, 0x2, &(0x7f0000000900)=r2, 0x4) executing program 2: r0 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x5, {{0xa, 0x4e20, 0x0, @mcast1={0xff, 0x7}, 0x9}}, {{0xa, 0x3, 0x0, @mcast2}}}, 0x108) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket(0x80000000000000a, 0x2, 0x0) setsockopt$inet6_group_source_req(r1, 0x29, 0x2a, &(0x7f0000000080)={0x5, {{0xa, 0x0, 0xfffffffe, @mcast1={0xff, 0x7}, 0x10}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) executing program 7: syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000000040)="10809660c714f069605860bff804a5bf5e1248460996124b35188304c27e96ec64af584726ddc09edf75135522a442c7a87b167b7c76059bb2ec8352dc05c52b07ecc199fecc02fb9a5d381f5ba54caa31174684bca91260727d2334bfe187a8a497afc420fd160aefc6e2fa77c53b2733f367b1f891874b2c48b1b61652f348ea419cba8cc87fbe5d93f8ce7abab83a7815b961b42fa80fef6f14ac26813d0d810216bcb1de7f58c485b2154f0e6fb59a8be5df10bdc9e8bbb5f12264a3ae6278ab220ba0f6d0c208eb855a80c63f02e9d4bed0e72bbd2936520a39b1f8efd93749549ae4a7ef85e8ee3b02ee88e942ec28e83df5f22bbde59bfa1247dd97d0b8ce3f8ec9ec7aec0bbe2736ed178bfbb69f07d24530859ad8cbe020dc1a52eab5a4546c88f6c8993821e017b97fec7c05d455d3b9bf2d07bcebd65e6b9c5bfc65001c86361635294dc43fabdd083c9cd52677e56f490f50ea96a94608dab3a1b1969fd81405667d925c8d5c6e007a62a3276e0af23a70a1ea5f63026e3a94d2641b05712fe258ca0fafdb3b1e2a776b9084d9002a5c4348c71f404de790a33e640fbecfc2e16f504318d83d45239a578730c464014f9e17d89ddf4448ed25ccba6c8b560ccef4fb23fe37defe7c38672cd772fa8b8f2e4b8596cb30b03672718b8ff26e28b4d2abc980d3226bd28bbe81162ed1c1f632d80ad7f9d941183c9847f1e24b9f6c4ba29ffcfc17b310ec1cc9736d3d3eec7c013c58bd3d07ec5e81b8d071b94833b39dc2ef1ee4eef04fa5770ba59e94bb3e27adf38758ec71493d35146b5b94bf1ab8911e8472b844d56a1feb506189ef308b595f631070b52a4c1d6b863efa5fb370a84a55a14bad9912b3f9dda86e27509c9615614fdb05eddf11fc6e94e8b2d85016fdb585a7b1023d4e7b9681e7357d0bb69302b841e3557e58511dd8cd2d57dda5ff3e9cf2343bd556ab937a79d441e1ce664c971fcdcc3fef36f5e56118598dddba97560a831559bf211d84e7941a2143d4b44d30f1c422a8c892fec20a4d8cde7e6445ea6871ea8645f0a69dd1c4c11bde2df9a3a9df0dc198d2e0b0404ff65ebded49e8b1cdd6232cd1f20968550757911f60ba617264c8eb7e0e330eae84ecc1b33e0447ef475676a059e4065de9f0cd28d0dddeca86efcba6894684402716e9f576e0d5b435661e51614dbf7c00538c30cb4f50158d385f7a194d03dc3b4a80955028fbb1e0eb243ecc6e7ff98c3b896b31bc9d974fb60766659f36c089bd762c1acfc781f3b367cf285315ba943ced5c212102ad673d6a01cc981c5fcbd0f53ee0c07d802ba4d0378c22dd7d41734f464676a5d5ed6bf683a880df52d43e5bc2ba989a2f70675d41e71fd2b944ed41bd06919e567a74c5934d66405e29d11e10d277a85d55a782c9bd5a055214ab1fcb4cd68ea7d6f94514b3880c2207d9f41c721d3e00673d86fdd42f4e5827943d0235370e7d8742ae82ddc1fd6378058e6f1ddcf2c89e3c3ae6099e625a341ab8f2637476b87ad749e4c90eb7b22769c3ef94a2699d4b9d1e9d6780795c4aff0fc2368e1d6dfc26486af0ce99621bfd50a3e4db3b6cde01a69cb805ca05189408be9d3d867d69b05ddd8700221dbc7b5a6e59210b430f5a5ca6fa21de5e6e7c45cf198c1805b7071ec264e76dce4cb3c05f1465f76ccc538dcc8abbc9a8b82a3306ae96eac99d972b0e31ecd54d258cc8f091f310b888e6489ef1d0d17be8e99faa9ebf8579416cd5f12999f822d042a2c665b794dba4f50a477b82e44c15bcd3d751b6cd26b6a6c45a96eab2e2f814e9bbbd801263fd818dbf8d87c9edf06d258b3b40ea7ef09d326b5fed89dc35e12c940cb94d673ca960326a72db1fa74dbadca00fa1157166ce38a913ebee38b27ffeddcbe5613ebfc8f0829ad278cd0596bd933d82765ee36ffe4da8cf6fbb08ec59abe85cf49028f73b735923a0b9ad1cb05e464d9f35ca7fb5d0c7b44ef2da4746c2e52cced4df50b6c28d5e0b0d89a42a4c37ec9232db01e6ed7f6105745772bbafee404d6bd559800f23646e22d8e48baf647a84a52ccda71a8e9705f238c0842eaa47cab5c1d6f87db1e56189aff7faad2e8b5f6e904cae3e28915a385e16b9796541782ca83bfd443f538d5ebd9ec3e86764fc190ff6d7e098e1af1c0bfbb397cf36f8cb86de517c7367f356475a2f316355ffcff40436406cd99d2c4c30e023d5705ae54dde198b31a6cdc9779f3226aa10c7db023dad99abd105f0c65e8d53486cf6bcf32f8b92ae660099577dcbd46c73bc5b83d47b798ebcda51c12109dad23eeab4e5e1442d9b00f604f80a2190b965e4363fabd5fc71bd9ca6481c398d500eecdc6fb088533221e869aacdabba399da6a61ec419c579408575d17939cdb5d4372f5178696666dcac04841aa94acd5b3c74b43f4a4ea986806b727cc967ead159854cc886ace493b099faf75dc1b527b07b129e5df8a0cfa2dde31d511cb8729abacb3747cf1d87ffd77d2d2f45926bf8804b6a9fe5b20da0411e1cb229dfd4314fa7dc8193a94099d95011aa498298d490f695103d51c18d801e38ec23421bdee51793f60611e8c287cbf7cfa0a94eb1c6ba3f08b38353760f6c3e04eaba86b4bde649b82f7df7e6c2c39db044216f229d804dc67644915f1482133b4ce6cf713de9436103437cad48774d5d4ac5502f87e6504031b67736d8308d16dbdd20a28d96721647d89064e96124bd492e658053aaa8599c3f205a9ae8a8aa77a09adc666e0e46b397f10d8b0c8e0c77502c331b9f4fc51135d697b4f0ddc591a6c1ec656cefb3a4724a402d8723da0fb58a06230502994d6032858ae141b942ed83fb90cbc961eb56acdd2c810d6988084aa575bbb125c73122fb564939dd1e86e0d7ced9cb7ac349212f7925aacc17a3647a5d1d4ef6102bae33d29ad43f54904d4d9566ef12c223b34a3d7718e51aaea28a6f32c6d11e976c20209e847135e1217b5a02b884470710b234ad2f266c4eb6a0c4b3bd2951112d13f1bd76357f7b193aa87bd2c93add38e7a76fb2459ea1e69e65421f84cedde0a8fa79587133bb1f357c6600db71d88441ad7763b3c1eba5fba4cb440cc119dd802b47ee7806b525217383363a080340b9b218b47c16ea5cf6603aea88d4707243cfad1669deb63ae018fce37c61122cda90be126e7ff68af82c1042eb24610ef0884ac1b02b1ea16776d48e55cb6e499b2f588cfcf2e0942a1954e58eda2bdb21aea5bbda1f5d3f79f6ee24178ba3de278071f283ab79c3548b0e241a2349c98ca1f5ee11b7e8fdeac726a3fbdaa3dc472ec9f896f47b41c86034c4e7b391c5912d5ac9359d8d495c55a67a96eea596449e4ececa03a0daa2c7c4a29d3755a752d05160590641800647a03551d292aa07630368c0b8174faa313e8c101bfb6bb806df5bd587ba80ccb6f8382596b69f6873f148f81a816de6f0bc6eb35fc54e94adec7c4d6e48a062e2ee837389b8ff9f44c8f8339975d8c2a2c149ac7f9a63543cc5530063e65b9adfa49ceecb511ebabb1d0a602e2ee5c1c7693c1433d949040b1dd5ed4b9f99188f9e278ac3b5c6f852ad070adf909ef4111e2e2a95ecc9e384d802039d8dbdfb99289b9926cc39672e3cb2322a4c915b1845b4364d623b92175d3783296c6628c17bc1c88c6d89f714c5d0fdc641ef20efc9bff15c0d2966286f823b847877d1942995b03e5f6ef2133ac4513de832bf1806cb41c711a1ed8dd72cec51e378a87c933e66e7588520777b1d77fd6abbde249696457d81c57ca13843bc500565e41020504e33cf46a8301fc576842944effe7cca57bd03d6c007f8627dda3cfdc7e8a840b6bb70778242dd12e89c24e864169f18d485b7cbf15dbbfd77aeb3b0813e758a848ab8820ac4ee0af2a24a85c0dcfe286accabfa1833138e3d1c4d646228c745aeecb71bf77c6ed196d8f19b3ee3d3abe8a3a136f14041260ec004b211774859372ed5a67bfc385519eef9831d3583b070099810091444a591e8642caa58fcc11548793ccb512accb67ab46492390366e62a9a5e1241d575fb1b67a865f57d1f8b60a5a859bfb56b751b18a290267ab770db19801c98ce15e4af7d6228ad3d1e57e4a538215f805ad866143803b6a0ad62b0b1e42716668cd460fa548204c89171e959c8f44699ce383892cec519d50704dff9607303f9546303ce869a967912b8fc5447740fd5c3651db4dec48c8b46770b62c248d4a23618291c2b30054bf1eb672fbe2ff5c57bb58ffd5de2bfca85a67ff67189e91fc492ad22163bb91524bf206c146e097b0ba9bf8933541e967ba5743b4bc8e3f8bc3fde78537d2c674734a0a2407aba3874c08498c655d2c1f5d9d1912ae2415038b900499462c1d1727bc12752cb271ea5d3c0cd26f4139411f4ef927e48e92618185513ccf331608d2a9bf192b0c048e0548cb95cba8423a8b47729892c31c1b90802d8143cb9c113dd3c1581af584b003f3040d87b6d61746bb92038507f96048444cc3df97e77683ad03aa8f8ece76452164f1a444cc4b9ee7e12c0f163c9d452b0af6363eeaf8545634deb74aec84b924b358d9fa162badaca9e41d54c3cc11549955d5b57cbf12ecf90833ac3f11a3383e5fa4fc69c916e6c2cac5f673882ccbbf5e26e021018b876c59ea1a8af9649bcf11215b8836ce1c2f72d1b666cf8e6e5bd511cfc5e4d3615ebbe8da6f5e15964c7dd691d443ccceb6b949e35b7af2273341904ca5d458091549befd14b42db03850a7161ea3b3f27bb4086deb55cc121242f4fbc5943feac0a89fab7babdf109f051b0c6dc4930cbd1e2d2f1e657a0583ecbd303dd5ad78a1da5856586dba70286f649c069311d754c1f95f4fedce9a45dea30772f77bde5f6eb897b4c4c7e38a95e77fde55e93d52e4de9ce61e380babfb50fc26b4f1993276b7fa7cf3ef06b53408adda61f615fe46a8442c3acfb0fae5d3adcbfb99f8002c0a155a714272a819913fb052da1dfb4b899a150c57b2dd868ff17580d7ac73520f2f83570ba5e8abafb430a14f7b2d739a29bfd129917428ca88ecb3c6935096c3cf12ad2169ac481dda743d65899d8349230dc0e0a758ff7e2b50e30a3fbaa9b8964b16d3e1fd116d8ce4f04c47602dd850e96ddeffd19c0c38685a95cab3c294902ea5f1b4b54794ee537feb73af8d36cf373fa9b6a5c6d7e170e11e9d30c4c9d0b65a6db381f939e94f8b62c69b400e6d59d3fdcf097e9b81b32e5f345c81846b399d19db6cb52fec58923664f633ed4af9364a292059d90d88a0ff98468df0d32aeb66f3a167a39336b20c7431c549d4160d841c87f8ff94bf0835c76e193c2cf4303dd3be829cb9c512b73bfb8524037592b59f4677b188b6440fddc87ada48005a3dcca481cb4c4d0468c8c882784bccd882069c1eda9abc85077459e4be76ae7905ecfa4e12d0a48a5060777deb879b23f1bacf71fd9a89871a6e91c12f8844a1091f070debe7f467d9ccfa80902c1e67d2933023f19e8e7087a8a15a48635a5df9ae10f2e7947f2676c53d85790b5fad045d89c7075ac326d14a3f8867961d5cc5e6347c68ac353dafd5568ab8255ba881a1052235efbd978488104a3d23118784361fb084aa357710caf854ef6fc105bf2c2e61a0e580987d071d85ef68f6c846d92e4b5636d21bbdbcb673bd0f4894e0eae05ea7d178d42aae5e8a2b9241c07dbc8bfc94f637d0ef9a9967687c0ac2ca83b2619a0fa130e1169ab42cd8c84d8640253df78fee9f7152c29717b0563855d9b8057df1f14eadab3f807ce54fabdf374a94cca4fcb29b05baf228daa17e29f0c2ddfbeedc3e82608c819345f8dda699d460b1bdfd63a515aa1b5b4484ac53d695870f5178dc045d2f09b023731a0dbb3eefd8223fddeba51c3b74084473ff6dc6db8bd44835b9d75bf1448bb87116b095a7918b9838b07edd88bb65570e042ed5b2a7b99f3f6d6a7f0f20f33c2f9a8eb272bf2ad009eef4a5e8ab2680f08765c22bf8ed04cb41d48d9ce50e15b2ba7473b34004557c0c1c84444526a8908eeca0062cc727e0b8fe8170446369b65872d42a47e75cebaab5fe6ce785663f8f872b177e582487053c1c1dc2a21924ae3748d25df291e7a5d75a87ff261f0266a699fe3b8030ee37b7d0b36a42abbd3c07415ba8b4a3fdb2df70796482e2c3c867304a298bbd327a091ef72f2d0adf41e8836f87b101937a7df5b08508e8be6ced1185e977f1fd316d8084636b9eb269086860c34c65d194dcdf97557cfbf520a9da098a84b747424589daa212714a60e9bbe9bc205ea89631554778efbfba3be63293422b02a29752300d010016601d0b3cc1aa9c11690c67eb0f2b4f6b1eb2daa2b4013d9b57a2904efe5bf5848a9e9868b9b068038b807f5a06a844bb2a00443b8b1e133b36b63ba4fbea62737e76c36908b251f4c7c60f8939a5900bfb576d951a0a058ee163bb002b8ff90cfa75af37bfb1a3df45420d810b8d93a7d850cc98e9b7de8b1eeeb36d49e0f5fe55eb94f1e0350dabfe9aee2b8dc2b2e79ca81c65e92d1188de9c11599c0ba65360804453d540515c9ccd1360776339efd552f45a1d6f28f1e2aa053212994d566efe921b1915c807634003f4a834b9a3f49c211de662c49b037cd46d4c8c9528cb3c7b4ea6be8737524cfd37b2b55380ab4b33c7a7d8886ee10922b2e88d71bd66440046e4413f8eb7b8417d9b4195ac7a36b2824c13136825c62b619b32ae5978d9f1ba7ae6410b870ccecbc2f6a07973f86573e48df89dcd52ec60ae9250c5d1daa5fbdd06a64bfba593c460514160779d5c7600b251916222350eaa3ce1cf967a19d05444ea0f6de609a3bb5210f9946037cb309cb67f1119df9a7619a346625cc48fe8fe1d4a873b7307a26089867d428bab1eb75cfe54fd1c6e6fe13c69300f8c46add08a0d33948a7e312171e5e2e7ab6bc22d74e861d8e93133198c6e9e0c9bd6a800011097ca049d3138a85fbd158880569946a64f2b20b76eeae076effbdd7cb69b06b25dd2ed5dc1cf6f58e1226cc578227bb9b15b5bf466dfb032d293ce934f68da2bd96efed347f166202a436586305c433cc02548c5d0f6d04815829f13559878e50d0295b2b7082ea38a12a40b350f9d885dcc96997de577eaea6da45f2004ec91340eb823e98e520af1b80d393df80958e35dd590c56077a18d82da1e20acd3ba9dca0d4439e997f082711ccde181d041b1fe25080fb0d69b983cc8f18b98a0320f8063e632bad4cd56a6884f9e0c294400c2d06ee214e3f80d40ab845d70bc14b4647656040ffd27c09da49650a35f7b60eea4b5fe3a3e7c5b822f5b1d75fcba3a6f59f4bec6c164bf5aa5858e868b2fff5b274e7e27270e3b520778c5644535412d56ae8a11c27d2f0c61c6a9d823e55e6f3c89596812dfe935764205d97f1886c4cbd36790cf9585d6eddc02785accc5ee91016c8547d51ebc6e7eac0863a67cc419f10a9aaad4d4369075761a238c61d16fd24f5c20e9d005615ab9bc46efc55b04495ed17613261e255c27b873cd9a56b190b15b4bb85ef20ef18a6d86c11124cb70d25b1ce1d83005162134050980c93ba876d84300da742b87a4229d674e70c9f7fea02a5a840da0bd7f74367d94ebf102788370b6a7fc926546445824f9948740c033756b9559c6bc46af021e46f9632082f5cf9391da6df8db3aa2cd517a9260180f33c2ec935d5ff7d3e51dc40a09c01e521d23b183da9e839bd1125b7262c9bf07bda440b6fd263022529a326d9bc69fb67b028cab430f9733d55789e8dd6daadb5e05b78491486f7ab1e0e17ff60efce3ff6d9221ad95ec1388f286da7bc23a14d504eaa74cb517e2aea2d19d8b88ebeb118ad0b1a357008cdc716f5f2f31a1aeb5121c4ccad97d3576084b214f6b291f0448b6f4b164b501d44d2c992a0992278b660bb4883f5dcdaa56e669faac77b2a3227477535abeaa29020c168bf2b0957bdd238e7f609731aafb33d51a47dd669b14b8285cd0c26c156a7c4d1fda90ca9e626eb535d06d5fad3b72df254cb137d4f2ee7f77e7592a69afe8544dad0a2af64204ae984f8abb7c54bb86729210feaacbffb584d8e8a815e49e37e03c8af32f73da49c3789abcefe1d52be154de930fbae4fc4b4a96ec4716fea8b3afc68cee3b90214193a2f6af46463eaedba7d957a987d6efbebe6c34ec503b74b4c5be58aeb847b73c2c6733885dae18f9e961131056f22012195d27ffd0284c159aae68308732785d3f24722ae09be88899c48e9e57928ed0a2fc4e0cdd06f4a70bf8a49a1fa4d0b3ed1fceaa3bcd9a968ed9fc9a227a332437c174171b005af5371287775904fcc974d2369ae36bf8cb4ed18f5bd284d9392cee217046482e69194389b132dd8474993629bfb13dedc135dc82ed647da6b04df420be604e4007a7ce29bd32f395a91b5e23ea6913fcb4755d3bc0c630364c722822cad5857e61324b492ec99062f45d1f15bad08f3a68bffba9c7707cbf19bce2d1d9765c7ca188540e9514aba891f9a90a8e0061c94695861070160e2a1cde55b400b0d89eb6eadbac343ce526e782a379f8e65a0b8316e2e21a3292d63ac7fd798f0ab067c7f1970563c7441850347bf75a5d7beedbcc15a0e4dbda421f81048c0c13ce098353e7ca3612e8dafe4b54dd2f7cd305e19b0b5646cbcd4abcd776024574a78fd4ab63dee7417f3f5b16e67445b4a68946e058ad68390c6c0d56415395ea029d9a79f3f39ba8ad6e466ea2f66ca185b357781d9c30b5e44239766d835648eb378ff8b1429ea1ecbd048de84b07285aeab7ba4af09e34865e445344602000e506ad59f12a5f4f3590dd8e2d1356afffcd5bd7cd5ff15716712560628991f7e069db335e6e188ca64d1c795a2e44b8aba92de95d56fd048c92f1bc6348e2d24e0ed3618bd8252ebe5db4d84aba7f87236aafa585a79be9b1ce1f8fa8981820d68686764656bc54061b60e7b7df5ebaec05466af151fa50129eaf4c7b82f603111ba568ba5141162d6df506204ac24ab299b16cbb91521d02a7996a70413d6ae197dbafe3aa1e8e72f967240afe5fe39d916945ce7425d9618158a83ed6547e00bc13e5488924aab1599b31d87c3431c28b376ef8824b2e377e0132acafc363962cbf402cb7bbd586a82f593517bf13e381c659e55b6508e500e4c5f1ff5607835021da41c259a3215fc31689df439bf9a0558ee95d0ce4186ecdcbafad599ece68e6af518e82dedb9b0a6b9a123acfe5b19fa7b64bc28633668b009a188e82f8b350fc031a89f09a25ae5fe05db1f6df0284309d4c9e5564facfdcfb158ff50594aceafeb4713c5cb61b3e955368a76b3f4672200dc739031fd853c99155bb279d9daa79966695f8a4885846f99367cc57b13b892a675f303a3c4aba210b9ad979849d08efce3733ea2a3cd47937976674aebe81fdecb154bdc1649d89f9105b6593004b224b79e1c1b5c4af9923c05cdc8839962d650eecc0daafbdd48ff23b55ef2f292ea5340925c9661fdc2c967987b7ba9663737920337f955b7a9c66a3b82d2a38cc9cd4383017db4a47b40c80ca307a77b9fb661f3eb6147a1fb94639941a598284f5aa425ecd60b21c4eef5215e1043b82346711150177eee06b25f765ba50ea44edaf3337e4634ba130e97db07d9beca14f004eee78e2b0105ea70d8c6c755afc8bd3e63278fcf051b58fc2616c7a4ae00b97ad72168db8275b5901366294e0389a7d762f9932720e4a01544576faf1669ae338fa60fb9129dbe166afb93d13ae5925ace512870529b83f05892f0a44a4d98ff55379c2d4fcaa0e1decfae5153e51e2ccc5a57943fc44e525a1c0845235725e08911e2157a59c44ec0235329ae733826cd1c70afa802f429bfcc29ab08b3bb7dba29049a74d370e2e4527ab64b4e1f67287578a93bb5e3a080d0dfbae6e960e5580e856a19eb5b4b8a4af8903ac54bcbfaa608e80ae518bd160f302dbcdb32d2853817a00758fe50c11660dbbf767cb1f306e469fae044ea7cdcf9fac5f4dd2b0280de662a1b8b4399f8abf6e3654606011f502b203ac4857631b45c267e0a432a3fe289a49f083e8a900ce08cdbee732b7eda09ff2f7311aa0ee28e0a2cecdd40120334b009142c4b5318a058b573518e74a41495320bae3fad05689b1f3be107cc20d9c952ecdc3b2741dbec5d1263610821f263d94054d646f1af2ec676502a5196f0aa9a76c72b34c4a1ab8db7b0290e9552aeb0d689c9d4dbe6d023673cca92c813bf62af8cc1089db8a8eb27fa205ef64b2dee49d82dd03a999416646a433fbf5149ccbb99f9b0d491df9d887d01b4597efd55f029140ee45a678ab317d9a5a2e6310a09cd1b0901c3180f1bc52e1b9a1462d1bf96cc3cc0c612f7087fe9ed5c9c12c14a806d4f7f86c39238612c7f3482e26ae498e7a1a0279699c63af16267f227b59e5dc61bc9dcac81222f30014b034d93942a9c9bd4c503d24dffc442fdc910b18fea6c4f1d87dce41f1f5c8647be48bea0ef332412e3b449ba61391ca0a6197fa3e4750703b531585e9f09979b26f5214e13f302cbf0dca6d7ea85c9e4a367196a54bb0094f538d59ed849bd79b7d54bb0bb1f9be4da0b5ac0465638c8a8ef6dc741855da516cb627d358ef2021baf4253081fb2ace70540eb7c31bd8b4615cecf28a7dc228e7fb34330c59bd3fe15971e15b601f6f8e9057e118ee4cad3d8c1a3b04d673792cea0b181344a544be82634c89a45b50977d38dd5ee32b50fe7d3b4a4e846f30b15325e31f561969852f561cb504c0966702478906fb2ea4d6d3db66ee3df31dbece165c1e1f94a72d73f72b46cf74985b7df53a86848a1525b4be45540fc76933c80844006a8abf7aa549c0bc76649e27cba0f22a03aed71d9d4023ae8df1bf648fb4fbb818948c0e1de041a1529642a333b9c89dfec2040c5fd5fd9a400e257ccca1903685fd3e4d3db2a15639e8e9e2124b3deea4df12ac1e977fb0f373b3c907fac4ebafb4c5ddbfb1c06ee8ac5403607438502afcccb6d9c1f8e2f608e984417a34c8552afef1f5622a66e998b5155f5036d825b8b7d988c5f4a497aa3a185a1b5a71f24367983af4b6d85294e07b535dc7b13fd5e14ad98b2f6d037fd5df59ecdad34e57de3fd31ace27523e08822799ca270b4b2df640d8f5a7c24dee904f8a17a45c830e7a35d67ca7dc73998659ff93f6683e07b7ce00d8ebe6ebb6195d3a581c3035c04241be2b09201c3898b44ff6d2e6345beb9f5d4095a47ec0d75b41b3ca1d4bccfdcbd6ce9db8806b1900e36401ee87b70757f3bcb35df0610ab566bcd8a2af06ed35927fc7478c5e62a19cadd466529e39662c5976480256b8340441065320b3ae861d8ab1f211bf0854be1e56b5aa166dd7fdf910df23ff79994a74d1c9dd5c1ecbbaf1390fb516a3e1c0128166af616088aaadda7038ec426f3cd4d2afb1361c948477ee52e55aefc46e70ce0e7cc26e64bf0d0ca2a3f1a69336b6a6e15180d5700a0d1a87d1e029de11bfe6abf2c93b1cd", 0x2000, 0x0) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40a01, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f00000000c0)=ANY=[@ANYBLOB="001c86dd0700100000001400000060ec970007483c00fe8000000000000000000000000000aaff020000000000000000000000000001"], 0xffe) executing program 5: syz_usb_connect$cdc_ncm(0x6, 0x6f, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000020000402505a1a860000102030109025d00020105e00409f7052400d4137bf1aae76c4e53897209c4fffff523"], 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000013c0)={'wlan1\x00', 0x0}) syz_80211_inject_frame(&(0x7f0000000040), &(0x7f00000001c0)=@data_frame={@msdu=@type10={{0x0, 0x2, 0x7, 0x1, 0x0, 0x0, 0x0, 0x1}, {0x6}, @initial, @device_b, @broadcast, {0x1, 0x1}}, @a_msdu=[{@device_a, @device_b}, {@device_a, @device_b, 0x37, "bc3ba9bf2cdf0bdac11f9b3e28da1882950401ed0e893ab462363595234455eae7a05c2af5b9639ce07f7972dd5e1736bb18b4682fe2ab"}, {}, {@broadcast, @broadcast, 0x3, "77c80f"}, {@device_a, @broadcast}, {@broadcast, @broadcast, 0x3, "ecacb0"}, {@broadcast, @broadcast, 0x73, "b2b7f59ef76dd2fc5e34954e71366fade16ebf81c306c49f04beee4bfe08ef74d96590d2e5aa37a3120874b2e0bf4731a4915ed6ddb0a4133f4ae7014eae7a1e122877124d2c62295510b061d1e22667964bea9bbd6f1e4a4e2e20a862ce1c891ea2ef821b8206f89fdebcf810cd5af6c5a363"}, {@broadcast, @broadcast, 0x67, "7c2eb8ce5a02117523848997917cc983743b900096de67b9f0dd65d2f283ad2ef1f031c9652996e9e81cdb8c1eb03a4a54db5c124cbd76481e391bcc40127b552a88025a991522b7e26c765a2ebad7c7ea6787160a89e74ea31a689b837eb0b4ada01004352ab1"}, {@device_a, @device_a, 0xc7, "deb7b2bed8aa271c1d3e04a41f1fc4b0144188439eb0b5920985811b84a31329ac39dd5aa1c6730a236a505134963b1a1a3d7e159c6324dbc0a41cef66ea42ba7effa83dfc38c039d600930fae7fd11f9feb5d33062232f4c8601ef1ce2492052edfa573883675d55adc12f70979ccf63bbcce229a5939bd12dc4ce0ec913f91bc07bf538293bf0607140e6765f0069d859dd97841659dcf893f314a6c1bde1672a4b7d39127d109291b2e4caa616cfe617600f709b1f7ea91c8e5d87197e5bf7135c1427f4d8e"}, {@device_b, @device_a, 0x11, "01b6035c9eacfabb844c1b4343a889d4b0"}]}, 0x2ac) sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000001380)={0x0, 0x0, &(0x7f0000001340)={&(0x7f0000000000)=ANY=[@ANYBLOB="f4060000", @ANYRES16=r1, @ANYBLOB="01000000000000e14f003b00000008000300", @ANYRES32=r2, @ANYBLOB="d506330080000000ffffffffffff080211000001"], 0x6f4}}, 0x0) executing program 2: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000, 0x0, 0xffffffffffffffff, 0xffff}, 0x50) r1 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="9feb01001800000000000000180000001800000004000000020000000100000c02000000000000000000000d0000000000005f"], 0x0, 0x34}, 0x20) unshare(0x8040480) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x3, &(0x7f0000000100)=ANY=[@ANYBLOB="180000000100000000000000801800009500000000000000"], &(0x7f0000000000)='GPL\x00', 0xc, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r1, 0x8, &(0x7f00000000c0)={0x0, 0x1}, 0x1}, 0x94) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_ext={0x1a, 0xf, &(0x7f00000002c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8792}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000180)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x20, '\x00', 0x0, 0x3a, r1, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x1, r2, 0x0, 0x0, 0x0, 0x10, 0x4a6}, 0x94) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f00000006c0)={r3, 0x132, &(0x7f00000005c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, &(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x5, 0x9, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x67, &(0x7f0000000880)=[{}, {}], 0x10, 0x10, &(0x7f0000000280), &(0x7f00000002c0), 0x8, 0x8e, 0x8, 0x8, &(0x7f0000000400)}}, 0x10) executing program 2: r0 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000100)=ANY=[], 0x24}, 0x1, 0x0, 0x0, 0x4000800}, 0x20004000) ptrace(0x10, r0) ptrace$setregset(0x4205, r0, 0x1, &(0x7f0000000100)={&(0x7f0000000040)="dcef58b7f29c1f7c93d183044aedba283413e674c7719c33a4b17f028f68610a6c55bb2bf8282853f3e16f8394a8676ff55a3507e2ad50248c6130863b0f7433c7fbc9b978a39eae88bffd05d139cedbee444f7c98e1f92b0f64462b4b470bedced2125e0b1f38fbaa348c6d75aa1a4011e9cdae15ecb9309b0101edbf6dd6d111d6132f1821a4e4cbec8438c571a70e7ca7b0451a6cc55c", 0x98}) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x4) ptrace$setregset(0x4205, r0, 0x1, &(0x7f00000001c0)={0x0}) executing program 3: r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) r1 = eventfd(0xffffffff) ioctl$VHOST_SET_VRING_KICK(r0, 0x4008af20, &(0x7f0000000040)={0x1, r1}) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x0) executing program 7: r0 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x82) fchdir(r1) r2 = openat(0xffffffffffffff9c, &(0x7f0000004280)='.\x00', 0x0, 0x0) getdents64(r2, &(0x7f00000001c0)=""/44, 0x2c) executing program 2: r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000580)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0xea, 0x440, 0x0, 0x32}, 0x9c) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f0000000200)={0x0, @in6={{0xa, 0x0, 0x0, @empty, 0x6}}, 0x0, 0x0, 0x0, 0x0, 0x8a}, 0x9c) bind$inet6(r0, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r0, &(0x7f0000847fff)='X', 0x34000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) shutdown(r0, 0x1) executing program 5: r0 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r0, &(0x7f0000001040)={0x27, 0x0, 0xfffffffe, 0x4, 0x0, 0x1, "d92984bd1ca44c226af5160e961711a077609475b78411e88509de050000000000f2170e65e3f50327e422000000000000000000000200000000001900", 0x3f}, 0x60) r1 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r1, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x10000000000001}, 0x60) r2 = syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) bind$nfc_llcp(r2, &(0x7f0000000080)={0x27, 0x0, 0x0, 0x7, 0x0, 0x6, "750538d1ee602ec4802a04ea7cdcd151bb2cd9893bc31f80718336d9bd3517076db9ad1f6a120d8be6d7f81cd81ec275000386e7d95f0669b740a5418d69d0", 0x1000000000003f}, 0x60) executing program 3: r0 = socket$inet_sctp(0x2, 0x1, 0x84) sendmsg$IPVS_CMD_SET_INFO(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0) sendmmsg$inet(r0, &(0x7f0000000e00)=[{{&(0x7f0000000180)={0x2, 0x4e23, @rand_addr=0x64010101}, 0x10, &(0x7f0000000080)=[{&(0x7f0000000040)="d9", 0x1}], 0x1}}], 0x1, 0x2004c044) setsockopt$inet_sctp_SCTP_EVENTS(r0, 0x84, 0xb, &(0x7f0000000300)={0x3c, 0x8, 0x2, 0xfc, 0x0, 0xfa, 0x3b, 0x6, 0x4, 0x82, 0x3, 0x8, 0x5, 0x8}, 0xe) recvmmsg(r0, &(0x7f0000000780)=[{{0x0, 0x1b, 0x0}, 0x2}], 0x88, 0x20, 0x0) shutdown(r0, 0x1) executing program 5: bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xa, 0xc, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x9, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe8c}, 0x94) openat$ppp(0xffffffffffffff9c, &(0x7f0000000100), 0x801a01, 0x0) r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000540)={0x3, 0x0, 0x0, 'queue1\x00'}) write$sndseq(r0, &(0x7f0000000000)=[{0x84, 0x77, 0x0, 0x0, @tick, {}, {}, @raw32}], 0xffc8) ioctl$SNDRV_SEQ_IOCTL_REMOVE_EVENTS(r0, 0x4040534e, &(0x7f0000000140)={0x14f, @tick=0x7, 0x0, {}, 0x0, 0x0, 0xc}) executing program 7: r0 = bpf$MAP_CREATE(0x0, &(0x7f00000002c0)=@base={0x5, 0x3, 0x1, 0x3, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) close(0x3) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1, 0xffffffffffffffff, 0xfffffffc}, 0x50) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000001400)={0x11, 0x15, &(0x7f0000000800)=@framed={{0x18, 0x0, 0x0, 0x0, 0x2}, [@ringbuf_output={{0x18, 0x1, 0x1, 0x0, r1}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r0}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x1000009}, {}, {}, {}, {}, {}, {0x85, 0x0, 0x0, 0x3}}]}, &(0x7f00000007c0)='GPL\x00', 0x0, 0x0, 0x0, 0x61800, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r2, r1}, 0xc) executing program 3: socket(0x10, 0x3, 0x0) ioctl$MON_IOCX_GETX(0xffffffffffffffff, 0x4018920a, &(0x7f0000000140)={&(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @iso}, 0x0}) r0 = socket(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="4800e80010000d0428bd7000fcdbff2500008000", @ANYRES32=r0, @ANYBLOB="1000000000000000280012800b00010062726964676500001800028005001900840000000c001e"], 0x48}}, 0x4084) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="500000001000010425bbe5ad600027842cf52300", @ANYRES32=0x0, @ANYBLOB="0300000000000000280012800a00010076786c616e00"], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) executing program 2: socket$netlink(0x10, 0x3, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000140)=ANY=[@ANYBLOB="7400000002060104000000000000000006000002050005000200000005000400000000001400078008001240001000000800134000005bad050001000700000005000100070000000900020073"], 0x74}}, 0x4000004) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a3c000000090a010400000000000000000a0000040900010073797a310000000008000540000000020900020073797a310000000008000a40fffffffc400000000c0a010100000000000000000a0000060900020073797a31000000000900010073797a310000000014000380100000800c00018006"], 0xa4}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)=ANY=[@ANYBLOB="500000000001010400000000141a000002000010240001801400018008000100e000000108000200e00000010c00028005000100000000001800028014000180080001"], 0x50}}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f000000c280)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000050000080900010073797a30000000005c000000030a03000000000000000000050000000900010073797a30000000000900030073797a300000000008000a40000000032800048008000240000000120800014000000000140004"], 0xa4}}, 0x0) executing program 7: r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-serpent-avx2\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, 0x0, 0x0) r1 = accept4(r0, 0x0, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000006800)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}, {0x0, 0x0, 0x0, 0x0, 0x0, 0xe0, 0x20004804}], 0x2, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x51}], 0x1}, 0x0) executing program 3: r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x1c, &(0x7f0000000040)=[@in6={0xa, 0x4e20, 0x0, @private2}]}, &(0x7f0000000080)=0x10) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000140)={0x0, 0x10, &(0x7f0000000100)=[@in={0x2, 0x4e24, @private=0xa010101}]}, &(0x7f0000000180)=0x10) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r1, 0x84, 0x1d, &(0x7f0000000200)={0x1, [0x0]}, &(0x7f0000000080)=0x8) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r0, 0x84, 0x85, &(0x7f00000001c0)={r2, @in6={{0xa, 0x4e20, 0x3, @private2, 0xffffffff}}}, 0x90) executing program 2: r0 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, 0x0) mkdirat(0xffffffffffffff9c, 0x0, 0x1e0) ioctl$BTRFS_IOC_GET_SUPPORTED_FEATURES(0xffffffffffffffff, 0x80489439, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0000000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) executing program 5: r0 = socket$nl_xfrm(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x10000000000041}, 0xc) r1 = socket$inet6(0xa, 0x3, 0x87) connect$inet(0xffffffffffffffff, 0x0, 0x0) setsockopt$inet6_IPV6_XFRM_POLICY(r1, 0x29, 0x23, &(0x7f0000000280)={{{@in6=@local, @in=@local, 0x0, 0x0, 0x4e20, 0x0, 0x2}, {0x0, 0x4, 0x1, 0x0, 0x0, 0xb}, {0x1fd, 0x200000ffffffffe, 0x4053e5, 0x20}, 0x6, 0x80001, 0x1, 0x0, 0x2, 0x1}, {{@in=@local, 0x4d4, 0x32}, 0x2, @in=@local, 0x3502, 0x1, 0x0, 0x0, 0x6, 0xfffffffd}}, 0xe8) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}, 0x9df}, 0x1c) executing program 7: r0 = fsopen(&(0x7f0000000200)='proc\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r1, 0xe) fsmount(r0, 0x0, 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) executing program 3: r0 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000580), 0xaad80) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f00000002c0)={0x0, 0x0, 0x0, 'queue0\x00'}) r1 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_SEQ_IOCTL_UNSUBSCRIBE_PORT(r1, 0x40045304, &(0x7f0000000100)={{}, {0x0, 0x3}, 0x2}) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_QUEUE_TEMPO(r1, 0x402c5342, &(0x7f0000000240)={0x0, 0x9, 0x5, {0x6}, 0x7fdf}) executing program 5: r0 = syz_usb_connect(0x3, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12014101175129205705092006c70102030109022400010200100009045807028ab53800090506020001000006090582020002"], 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$printer(r0, 0x0, 0x0) executing program 3: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) executing program 7: r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@deltclass={0x24, 0x29, 0x800, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x5, 0xfff2}, {0x3, 0xb}, {0xf, 0x1}}}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5400000010000104000000000300000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000340012800b000100697036746e6c000024000280040013"], 0x54}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010000104002000"/20, @ANYRES32=r2, @ANYBLOB="02000000ac0e0000280012800b000100697036746e6c00001800020003006714e112"], 0x48}, 0x1, 0x0, 0x0, 0x240440c0}, 0x810) program did not crash replaying the whole log did not cause a kernel crash single: executing 11 programs separately with timeout 1m40s testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): socket-socket-sendmsg$nl_route_sched-getsockname$packet-sendmsg$nl_route-sendmsg$nl_route detailed listing: executing program 0: r0 = socket(0x10, 0x803, 0x0) r1 = socket(0x10, 0x803, 0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000003c0)=@deltclass={0x24, 0x29, 0x800, 0x70bd25, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x5, 0xfff2}, {0x3, 0xb}, {0xf, 0x1}}}, 0x24}}, 0x0) getsockname$packet(r0, &(0x7f0000000400)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000900)=0x14) sendmsg$nl_route(r1, &(0x7f0000000640)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="5400000010000104000000000300000000000000", @ANYRES32=r2, @ANYBLOB="0000000000000000340012800b000100697036746e6c000024000280040013"], 0x54}}, 0x0) sendmsg$nl_route(r0, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000010000104002000"/20, @ANYRES32=r2, @ANYBLOB="02000000ac0e0000280012800b000100697036746e6c00001800020003006714e112"], 0x48}, 0x1, 0x0, 0x0, 0x240440c0}, 0x810) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$rtl8150-syz_usb_control_io$cdc_ecm-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free Read in v4l2_open single: successfully extracted reproducer found reproducer with 6 syscalls minimizing guilty program testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$rtl8150-syz_usb_control_io$cdc_ecm detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r0, 0x0, 0x0) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: WARNING: kobject bug in v4l2_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free Read in v4l2_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program crashed: KASAN: use-after-free in v4l2_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: syz_usb_control_io$rtl8150(0xffffffffffffffff, 0x0, 0x0) syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, &(0x7f00000010c0)={0x84, &(0x7f0000000000)={0x0, 0x14}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) program did not crash testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: KASAN: use-after-free Read in v4l2_open extracting C reproducer testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: KASAN: use-after-free Read in v4l2_open simplifying C reproducer testing compiled C program (duration=1m40s, {Threaded:false Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program did not crash testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:1 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:true NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program did not crash testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox: SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:false Cgroups:false BinfmtMisc:false CloseFDs:false KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:false UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program did not crash testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: KASAN: use-after-free Read in v4l2_open testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:false NetReset:true Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program did not crash testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:false Cgroups:true BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program did not crash testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:false BinfmtMisc:true CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program did not crash testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:true VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: KASAN: use-after-free Read in v4l2_open testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:true Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: KASAN: use-after-free Read in v4l2_open testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:true IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: WARNING: kobject bug in v4l2_open testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: KASAN: use-after-free Read in v4l2_open testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:false Sysctl:true Swap:true UseTmpDir:true HandleSegv:true Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program did not crash testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:true Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: KASAN: use-after-free Read in v4l2_open testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:true UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: WARNING: kobject bug in v4l2_open testing compiled C program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io program crashed: KASAN: use-after-free Read in v4l2_open testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: KASAN: use-after-free Read in v4l2_open validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program crashed: KASAN: use-after-free Read in v4l2_open validation run: crashed=true testing program (duration=1m40s, {Threaded:true Repeat:true RepeatTimes:0 Procs:5 Slowdown:1 Sandbox:none SandboxArg:0 Leak:false NetInjection:false NetDevices:true NetReset:true Cgroups:true BinfmtMisc:false CloseFDs:true KCSAN:false DevlinkPCI:false NicVF:false USB:false VhciInjection:false Wifi:false IEEE802154:true Sysctl:false Swap:false UseTmpDir:true HandleSegv:false Trace:false CallComments:true LegacyOptions:{Collide:false Fault:false FaultCall:0 FaultNth:0}}): syz_usb_connect-syz_usb_control_io$rtl8150-syz_usb_control_io detailed listing: executing program 0: r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000d00)=ANY=[@ANYBLOB="120100021982302013042360e5ec0102030109021b0001000060020904840001ee48b100090582"], 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) syz_usb_control_io(r0, 0x0, 0x0) program did not crash validation run: crashed=false reproducing took 1h46m2.51160532s repro crashed as (corrupted=false): =========================[ 190.898870][ T6090] ================================================================== BUG: KASAN: use-after-free in v4l2_open+0x398/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444 Read of size 4 at addr ffff888038f3c9d0 by task v4l_id/6090 CPU: 1 UID: 0 PID: 6090 Comm: v4l_id Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 v4l2_open+0x398/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444 chrdev_open+0x4d0/0x5f0 fs/char_dev.c:411 do_dentry_open+0x83d/0x13e0 fs/open.c:947 vfs_open+0x3b/0x350 fs/open.c:1079 do_open fs/namei.c:4699 [inline] path_openat+0x2e43/0x38a0 fs/namei.c:4858 do_file_open+0x23e/0x4a0 fs/namei.c:4887 do_sys_openat2+0x113/0x200 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f42d9cf6407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc90f09060 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f42d9c08880 RCX: 00007f42d9cf6407 RDX: 0000000000000000 RSI: 00007ffc90f09f1b RDI: ffffffffffffff9c RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007ffc90f092b0 R14: 00007f42da48c000 R15: 000055f1bf9fe4d8 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888038f3c340 pfn:0x38f3c flags: 0x80000000000000(node=0|zone=1) raw: 0080000000000000 ffffea0000c82f08 ffff8880b8842f00 0000000000000000 raw: ffff888038f3c340 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 5990, tgid 5990 (kworker/0:7), ts 190519440188, free_ts 190897156515 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x22d/0x280 mm/page_alloc.c:1853 prep_new_page mm/page_alloc.c:1861 [inline] get_page_from_freelist+0x28b2/0x2930 mm/page_alloc.c:3941 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5221 alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2490 ___kmalloc_large_node+0x4e/0x120 mm/slub.c:5237 __kmalloc_large_noprof+0x1a/0x90 mm/slub.c:5258 kmalloc_noprof include/linux/slab.h:947 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] em28xx_v4l2_init+0xe7/0x2f50 drivers/media/usb/em28xx/em28xx-video.c:2707 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page last free pid 5990 tgid 5990 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0xfe5/0x10d0 mm/page_alloc.c:2938 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2287 [inline] kref_put include/linux/kref.h:65 [inline] em28xx_v4l2_init+0x16c5/0x2f50 drivers/media/usb/em28xx/em28xx-video.c:3078 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff888038f3c880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888038f3c900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888038f3c980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888038f3ca00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888038f3ca80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ================================================================== final repro crashed as (corrupted=false): =========================[ 190.898870][ T6090] ================================================================== BUG: KASAN: use-after-free in v4l2_open+0x398/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444 Read of size 4 at addr ffff888038f3c9d0 by task v4l_id/6090 CPU: 1 UID: 0 PID: 6090 Comm: v4l_id Not tainted syzkaller #0 PREEMPT_{RT,(full)} Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 04/18/2026 Call Trace: dump_stack_lvl+0xe8/0x150 lib/dump_stack.c:120 print_address_description+0x55/0x1e0 mm/kasan/report.c:378 print_report+0x58/0x70 mm/kasan/report.c:482 kasan_report+0x117/0x150 mm/kasan/report.c:595 v4l2_open+0x398/0x3a0 drivers/media/v4l2-core/v4l2-dev.c:444 chrdev_open+0x4d0/0x5f0 fs/char_dev.c:411 do_dentry_open+0x83d/0x13e0 fs/open.c:947 vfs_open+0x3b/0x350 fs/open.c:1079 do_open fs/namei.c:4699 [inline] path_openat+0x2e43/0x38a0 fs/namei.c:4858 do_file_open+0x23e/0x4a0 fs/namei.c:4887 do_sys_openat2+0x113/0x200 fs/open.c:1364 do_sys_open fs/open.c:1370 [inline] __do_sys_openat fs/open.c:1386 [inline] __se_sys_openat fs/open.c:1381 [inline] __x64_sys_openat+0x138/0x170 fs/open.c:1381 do_syscall_x64 arch/x86/entry/syscall_64.c:63 [inline] do_syscall_64+0x174/0x580 arch/x86/entry/syscall_64.c:94 entry_SYSCALL_64_after_hwframe+0x77/0x7f RIP: 0033:0x7f42d9cf6407 Code: 48 89 fa 4c 89 df e8 38 aa 00 00 8b 93 08 03 00 00 59 5e 48 83 f8 fc 74 1a 5b c3 0f 1f 84 00 00 00 00 00 48 8b 44 24 10 0f 05 <5b> c3 0f 1f 80 00 00 00 00 83 e2 39 83 fa 08 75 de e8 23 ff ff ff RSP: 002b:00007ffc90f09060 EFLAGS: 00000202 ORIG_RAX: 0000000000000101 RAX: ffffffffffffffda RBX: 00007f42d9c08880 RCX: 00007f42d9cf6407 RDX: 0000000000000000 RSI: 00007ffc90f09f1b RDI: ffffffffffffff9c RBP: 0000000000000002 R08: 0000000000000000 R09: 0000000000000000 R10: 0000000000000000 R11: 0000000000000202 R12: 0000000000000000 R13: 00007ffc90f092b0 R14: 00007f42da48c000 R15: 000055f1bf9fe4d8 The buggy address belongs to the physical page: page: refcount:0 mapcount:0 mapping:0000000000000000 index:0xffff888038f3c340 pfn:0x38f3c flags: 0x80000000000000(node=0|zone=1) raw: 0080000000000000 ffffea0000c82f08 ffff8880b8842f00 0000000000000000 raw: ffff888038f3c340 0000000000000000 00000000ffffffff 0000000000000000 page dumped because: kasan: bad access detected page_owner tracks the page as freed page last allocated via order 2, migratetype Unmovable, gfp_mask 0x40dc0(GFP_KERNEL|__GFP_ZERO|__GFP_COMP), pid 5990, tgid 5990 (kworker/0:7), ts 190519440188, free_ts 190897156515 set_page_owner include/linux/page_owner.h:32 [inline] post_alloc_hook+0x22d/0x280 mm/page_alloc.c:1853 prep_new_page mm/page_alloc.c:1861 [inline] get_page_from_freelist+0x28b2/0x2930 mm/page_alloc.c:3941 __alloc_frozen_pages_noprof+0x18d/0x380 mm/page_alloc.c:5221 alloc_pages_mpol+0xd1/0x380 mm/mempolicy.c:2490 ___kmalloc_large_node+0x4e/0x120 mm/slub.c:5237 __kmalloc_large_noprof+0x1a/0x90 mm/slub.c:5258 kmalloc_noprof include/linux/slab.h:947 [inline] kzalloc_noprof include/linux/slab.h:1188 [inline] em28xx_v4l2_init+0xe7/0x2f50 drivers/media/usb/em28xx/em28xx-video.c:2707 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 page last free pid 5990 tgid 5990 stack trace: reset_page_owner include/linux/page_owner.h:25 [inline] __free_pages_prepare mm/page_alloc.c:1397 [inline] __free_frozen_pages+0xfe5/0x10d0 mm/page_alloc.c:2938 em28xx_free_v4l2 drivers/media/usb/em28xx/em28xx-video.c:2287 [inline] kref_put include/linux/kref.h:65 [inline] em28xx_v4l2_init+0x16c5/0x2f50 drivers/media/usb/em28xx/em28xx-video.c:3078 em28xx_init_extension+0x120/0x1c0 drivers/media/usb/em28xx/em28xx-core.c:1248 process_one_work kernel/workqueue.c:3314 [inline] process_scheduled_works+0xb5d/0x1860 kernel/workqueue.c:3397 worker_thread+0xa53/0xfc0 kernel/workqueue.c:3478 kthread+0x388/0x470 kernel/kthread.c:436 ret_from_fork+0x514/0xb70 arch/x86/kernel/process.c:158 ret_from_fork_asm+0x1a/0x30 arch/x86/entry/entry_64.S:245 Memory state around the buggy address: ffff888038f3c880: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888038f3c900: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff >ffff888038f3c980: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ^ ffff888038f3ca00: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ffff888038f3ca80: ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ==================================================================