last executing test programs: 3.367867399s ago: executing program 0 (id=60): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$tipc(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_BEARER_NAMES(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000000c0)={0x1c, r1, 0x1, 0x70bd2a, 0x25dfdbfb}, 0x1c}, 0x1, 0xeaffffff, 0x0, 0x4}, 0x0) 3.288862765s ago: executing program 0 (id=62): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x8e, 0x88, 0x5, 0x20, 0x8086, 0x9500, 0xb6d8, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x1, 0x0, 0x0, 0x15, 0xcc, 0x1c}}]}}]}}, 0x0) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = socket(0xa, 0x3, 0x3a) (async) r4 = socket(0x840000000002, 0x3, 0xfa) connect$inet(r4, &(0x7f0000000140)={0x2, 0x4e22, @remote}, 0x10) (async) r5 = socket$inet6_sctp(0xa, 0x801, 0x84) (async) r6 = socket$rds(0x15, 0x5, 0x0) ioctl$sock_proto_private(r6, 0x89e0, 0x0) (async) recvmsg(r5, &(0x7f00000002c0)={&(0x7f0000000340)=@pppoe={0x18, 0x0, {0x0, @link_local}}, 0x80, &(0x7f0000000840)=[{&(0x7f0000000480)=""/129, 0x81}, {&(0x7f0000000540)=""/166, 0xa6}, {&(0x7f0000000600)=""/160, 0xa0}, {&(0x7f00000003c0)=""/75, 0x4b}, {&(0x7f00000006c0)=""/67, 0x43}, {&(0x7f0000000740)=""/250, 0xfa}, {&(0x7f0000000100)=""/32, 0x20}, {&(0x7f0000000240)=""/57, 0x39}], 0x8, &(0x7f0000000940)=""/238, 0xee}, 0x40000122) sendto$inet6(r5, &(0x7f0000000140)="96", 0x1, 0x0, &(0x7f0000000280)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @multicast2}}, 0x1c) setsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000180)=0x2, 0x4) (async) getsockopt$inet_sctp6_SCTP_AUTO_ASCONF(r5, 0x84, 0x1e, &(0x7f0000000000), &(0x7f0000000040)=0x4) (async) setsockopt$inet_int(r4, 0x0, 0x13, &(0x7f0000000080)=0x800, 0x4) sendmmsg$inet(r4, &(0x7f0000005240), 0x4000095, 0x0) (async) setsockopt$MRT6_ADD_MIF(r3, 0x29, 0xca, &(0x7f00000000c0)={0x0, 0x1, 0x26}, 0xc) (async) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) (async) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_START_AP(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000440)={0x24, r8, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r9}, @void}}, [@NL80211_ATTR_BEACON_INTERVAL={0x8}]}, 0x24}}, 0x40810) r10 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r10, 0x4008ae90, &(0x7f0000000300)=ANY=[@ANYBLOB="01000000000000000100000000000000000000000000000000000000ff"]) (async) ioctl$KVM_GET_NESTED_STATE(r10, 0xc080aebe, &(0x7f00000024c0)={{0x2, 0x0, 0x80, {0xdddd1000, 0x1000, 0x2}}, "000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dfff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f4ff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001700", "0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000500000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000"}) (async) syz_usb_control_io$printer(r0, 0x0, &(0x7f0000000b40)={0x34, &(0x7f0000000900)={0x20, 0x0, 0x1, "18"}, 0x0, 0x0, 0x0, 0x0, 0x0}) 3.00827446s ago: executing program 0 (id=63): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000000000fe0100", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 2.848324588s ago: executing program 0 (id=66): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4c, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000141200006c07010033d43afffe800000000000000000000000000010ff020000000011000000000000000001"], 0x340a) 2.708825684s ago: executing program 0 (id=68): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002000000090001"], 0x7c}}, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="0100009f88a8ffffffffffff88a8600081"], 0x3a) 2.565186914s ago: executing program 0 (id=70): sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440)=[{{0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000800)="21ae1baf930b4569b9ddef9797ffd935c7d80e6466b3e4e62dc9603583f5d4b61fbc65b6ac744d7319535e75bf552062e4cfde1ba7ce29263322e18ea9740aa82ca692f123993e57cda00d2b1f4e799bd41e3f76258180fa91a42aaa8b1ebc4e0ea8fb12f2c71e6e5bc57a8e91f254005514721d93c13c5606ae1fea7f31f558d562bd5a8dfb0b9fed873efa221fccffa847cd374c92e6cbb03e6a9de890ce323f000000abcc6c01326d588495b7c1a7db31ec4129e6336f26bb9e0b7552af3cd2d5dda16327", 0xc6}], 0x1, 0x0, 0x0, 0x900}}], 0x1, 0x0) r0 = syz_open_dev$evdev(&(0x7f0000000040), 0x0, 0x0) syz_usb_disconnect(r0) syz_usb_connect(0x6, 0x24, &(0x7f0000000140)=ANY=[], 0x0) ioctl$EVIOCRMFF(r0, 0x40085503, &(0x7f00000008c0)=0x2) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x200, 0xa, 0x86, 0xf3, 0x40, 0x1110, 0x9024, 0xdb24, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0xe9, 0x50, 0x9, [{{0x9, 0x4, 0x62, 0x4, 0x0, 0x6f, 0x6f, 0x49, 0x5}}]}}]}}, 0x0) syz_usb_disconnect(r1) syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000780)=ANY=[], 0x0) 2.522009724s ago: executing program 3 (id=71): socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000007c0)={0xffffffffffffffff}) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000f00)={'dummy0\x00', &(0x7f0000000f40)=@ethtool_gstrings={0x1b, 0x3}}) iopl(0x3) syz_clone3(&(0x7f0000000280)={0x4080, 0x0, 0x0, 0x0, {0x9}, 0x0, 0x0, 0x0, &(0x7f0000000240)=[0xffffffffffffffff], 0x1}, 0x58) (async) r1 = socket$inet6_udplite(0xa, 0x2, 0x88) fstat(r1, &(0x7f0000001980)={0x0, 0x0, 0x0, 0x0, 0x0}) setfsuid(r2) (async) setfsuid(r2) (async) syz_io_uring_setup(0xefe, &(0x7f0000000140)={0x0, 0xcc19, 0x10806}, &(0x7f0000000000), &(0x7f00000000c0)) ioctl$FAT_IOCTL_GET_VOLUME_ID(0xffffffffffffffff, 0x80047213, &(0x7f0000000000)) 2.40032187s ago: executing program 3 (id=72): writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000140)="8b5f47ee6f6b2684bced22a9cfb75fe0368d28a6b8e78d19aedf62a3084e1721213ae0baf603a3599d328130f6bdfd69e12a9c1d2dd7d21fc9cdd2072d5b0e6059fbcdc24da6de1bdb153ad26ff0fc720f5ca9b13ba01576561d3ceb7885740b01d72dbaef478b9cd201793a47585ab161e104dc631c12400d3142bb24178d67050b6744125ee31da47d98c9409fa34f18ee2c899b98361d8d4c36a0a6ff33a0f5cea1", 0xa3}], 0x1) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="021800001c000000000000000000000005000600000000000a00030000000000000000000000000000000000000000000000000000000000020012000000000000000000fcffffff0600ff0000000000000000000000000000000000050000000000000001000000fe8000000000002100000000000000bb050005002b0000000a00000000000000fc01000000020000000200000000000000000000000000000800"], 0xe0}}, 0x0) 2.341409081s ago: executing program 3 (id=74): unshare(0x6a040000) memfd_create(&(0x7f0000000300)='^-\x00', 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000000b00)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) syz_clone3(&(0x7f0000000080)={0x801400, 0x0, 0x0, 0x0, {0xa}, 0x0, 0x0, 0x0, 0x0}, 0x58) sched_setscheduler(r0, 0x3, &(0x7f0000000000)=0x3aef) syz_usb_connect(0x3, 0x2d, &(0x7f0000000ac0)=ANY=[@ANYBLOB="12011001c7af7320720c0d008f96010203010902"], 0x0) r1 = socket(0x10, 0x803, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_xfrm(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001e00010026bd706e6e24139e074c2100"], 0x40}}, 0x90) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000003c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x5c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz2\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0x20, 0x11, 0x0, 0x1, @connlimit={{0xe}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_CONNLIMIT_COUNT={0x8, 0x1, 0x1, 0x0, 0xfffff274}]}}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) socket$packet(0x11, 0xa, 0x300) r4 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r4, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000000100)=ANY=[@ANYBLOB="21000000000000000103000000000000f6dca170e4ef4fe334309f34572d8954ee452439bc070b0ba8110568db5e8371ba77905e86b79a9e04"], 0x10) sendmmsg$inet6(r4, &(0x7f0000003640)=[{{0x0, 0x0, 0x0}}], 0x1, 0x4040005) r5 = open(&(0x7f0000000000)='./file1\x00', 0x10f0c2, 0x0) r6 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f0000000bc0), r6) sendmsg$NLBL_CIPSOV4_C_ADD(r6, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000280)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000100000004000480080002000100000008000100000000000400088018000c8014000b80080009000000000008000a000009"], 0x44}}, 0x0) r8 = socket$packet(0x11, 0x2, 0x300) mmap(&(0x7f0000003000/0x2000)=nil, 0x2000, 0x0, 0x2000011, r5, 0xd3fc6000) ioctl$sock_SIOCETHTOOL(r8, 0x8946, &(0x7f0000000000)={'syz_tun\x00', &(0x7f0000002fc0)=@ethtool_link_settings={0x4d, 0x32, 0xf7, 0x3, 0x80, 0x7, 0xc2, 0xc, 0x66, 0x4, [0x40, 0x9, 0x10, 0x40, 0x6, 0x8, 0xfffffeff, 0x2174]}}) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'gre0\x00', @link_local}) 2.252247572s ago: executing program 1 (id=75): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d42bfffe800000000000000000000000000010ff020000000000000012000000000001"], 0x340a) 1.695641937s ago: executing program 1 (id=78): r0 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000180)=@ethtool_drvinfo={0x3, "73f0c351b8a0e7375288a7675433062487034d33b46bfd3c406777500a5c9596", "c228588101cad0591918a61e3f716ad1866c7b64c15666613584bd00", "015204d84ed9d4c55745118a38fcad54b9518d8bdffcdb58937f2f032368d622", "54446eeee75fd3f1d31f613c947240a26d56c0ba30f02bfa7cdad8f74614d80e", "31704466c0732ab891fd8acfe66e1e8ae3fcc2bc3b5773fe7e7ca45b0383c020", "20d39965be3beb2bc876cc3f", 0x9, 0x800, 0x78f6, 0x10000, 0x4}}) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000002c0), r1) sendmsg$NLBL_CIPSOV4_C_ADD(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000012c0)=ANY=[@ANYBLOB='K\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="01002dbd7000fedbdf250100000008000100ffffffff3400048005000300010000000500030002000000050003000500000005000300050000000500030080ff00008a55049d4983a6200800020002"], 0x58}, 0x1, 0x0, 0x0, 0x8000}, 0x0) r3 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000040)='/proc/partitions\x00', 0x0, 0x0) preadv(r3, &(0x7f0000000100)=[{&(0x7f00000002c0)=""/4084, 0xff4}, {&(0x7f00000000c0)=""/51, 0x33}], 0x2, 0x202, 0x0) r4 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x20000, 0x0) ioctl$IOMMU_IOAS_ALLOC(r4, 0x3b81, &(0x7f0000000100)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r4, 0x3ba0, &(0x7f0000000140)={0x48, 0x1, r5, 0x0, 0x6, 0x2000000000006}) r6 = openat$uinput(0xffffffffffffff9c, &(0x7f0000004380), 0x0, 0x0) ioctl$BTRFS_IOC_TREE_SEARCH_V2(r6, 0x5502, 0x0) r7 = syz_open_dev$dri(&(0x7f0000000000), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r7, 0xc04064a0, &(0x7f0000000500)={0x0, &(0x7f00000001c0)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r7, 0xc01864b0, &(0x7f0000000700)={r8, 0x0, 0x4, 0x8, 0xfa}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r4, 0x3ba0, &(0x7f0000000540)={0x48, 0x1, r5, 0x0, 0xd, 0x1}) munmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000) ioctl$IOMMU_IOAS_MAP$PAGES(r4, 0x3b85, &(0x7f0000000e00)={0x28, 0x4, r5, 0x0, &(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x7b}) syz_usb_connect(0x3, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x250, 0xb9, 0x5e, 0xb, 0x40, 0x3195, 0xf190, 0xc1fc, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x6, 0x5, 0x80, 0x7f}}]}}, &(0x7f0000000380)={0x23, 0x0, 0x0, 0x0, 0x18}) r9 = syz_open_dev$vim2m(&(0x7f0000000000), 0x800, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r9, 0xc008561c, &(0x7f0000000040)={0xf0f048}) r10 = syz_genetlink_get_family_id$mptcp(&(0x7f0000000140), r3) sendmsg$MPTCP_PM_CMD_ADD_ADDR(r3, &(0x7f0000000240)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f00000001c0)={&(0x7f0000000180)={0x24, r10, 0x20, 0x70bd27, 0x25dfdbfd, {}, [@MPTCP_PM_ATTR_RCV_ADD_ADDRS={0x8, 0x2, 0x4}, @MPTCP_PM_ATTR_TOKEN={0x8, 0x4, 0x7fff}]}, 0x24}, 0x1, 0x0, 0x0, 0x10000}, 0x2000880) 1.695346585s ago: executing program 2 (id=79): mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mkdir(&(0x7f0000000000)='./bus\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000140)='./bus\x00') r0 = syz_open_dev$loop(&(0x7f0000000480), 0xd76, 0x181400) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='cgroup.stat\x00', 0x275a, 0x0) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000002c0)={r1, 0x0, {0x2a00, 0x80010000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x2, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100000000000000040200", "2809e8dbe108598948224ad54afac11d875397bdb22d0000b420a1a93c5240f45f819e01177d3d458dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00"}}) 1.600392513s ago: executing program 2 (id=80): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) setreuid(0xee01, 0xffffffffffffffff) r1 = getuid() setfsuid(r1) sendmsg$netlink(r0, &(0x7f0000000040)={0x0, 0x20, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x2000000000000000) 1.50131118s ago: executing program 2 (id=81): r0 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_udp_int(r0, 0x11, 0x67, &(0x7f0000000040)=0x91, 0x4) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000180)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) write$UHID_INPUT(0xffffffffffffffff, &(0x7f0000000040)={0x8, {"cbe9f88dc436966861046be4526ad1b6606de57d4e48687c87976c9cc1366792adc0e119f87eaf903707fd42f61ea08fc60b1eabf9462c8a99613d6f1673a65219cc05c7831ed458254ed73d189a393d9b84fd8e4b81f6e4e52221903ab5dd6a668b8112d6a09638f9545c271d118b6ddb9cf8772129b7626a271c895b94e60be93d2afb3561ac06a899699ff33e51205099dc5528d33594ee58c21bda0324afa07735233137ea33d73885e4928f5065d08e0efb5330a2013169e2d98004d794f3d10f14d8cf5a6808e2ffb18b76fb498496c6c2432d4fc7bf3cf280ee302e753e5fd4e3e4846d1de4db6529a89e14903e8e265952c4f418b7025f201b3083167a3d9b396135c69632702ec612524683b162cea51b9c6ebca00e55127b7d4533263130b0572e60f76d71146a5af34e03205f47e5e4715d8ee719108a036f93a03a30be670ab1ac27b476acc959ee5be2cd5f382b6270a358d8bc810d05a60023aaa42e461c155f63f23c99b7e19ef61c2a145013aaec331db767b1b77a93e520fb81712ca167d1b193a6aad587a8259d1d52c92194acc7bbe750b6c26c6bf4f06afe381721cc7882ba2c467c811f6e39cf952c153494f1958e65d4165ade578671b9c52b4e570f3ae078a11275b55af0592a65c78ba91aed8d3680c56871644cbd5ed1845cd5312b57693f3c6403e875f4cb89c17572e35acce06922d6335a0e19324183659a6946c8cd2686cf2fbabb06585dbca2affcd72d6263613619c78add1a6caa7d36a03b04748d927fdc476559deb8206545840f9758032d33e5cef8d189e114933194163dde732ed4bb1df4a185a0e71a27b9d73927ad0a37d06326ccc5ecfd62f9d9055c44a0d377d75c61918f217c8f8592e6fb5fd95aee4931a4dc0c2e48915a7d6b24b5aaa7d51a23ab2b1a2d6b72cef26b13d115c1482efb3f6a231a4d406904ec09be8ece5da6a88f74688c839818b05da5dcbc81325e8ad5c450a703b5cbcdeaeaea8df128e54c32236930e75505b97a62fc01fda75bc0432d84269a2838afc287f6d67303ba91b5e599b4fa58916a20841a841a3f88b389ed29efbaf860a6bb9252c4fcb226982a9c272d94b3079b9bafaaa7a78ba6c4ae8d156d358bfd1805ba2d14efd831624b20a3dcb0d8ccfe6078f7f57cc3ad5185c52dc29ca5d26369eafc82abcb47760d86f8e334d988494b189dfe8e5e57d298323cbf011ce0beec4767edbf5c7d5415899b6b079ad0b57914b2561b51bd0a8292c23f79aaef7c00580fc9334e3d4c520324f212b9efe86484353fae1769ba5edcea81371d1ef5a7e1c09a6fafa410c89fa34e7dbde4c1dca98bcc94755ec95233a2afa999f77ba39a3f949d1f287ab5e9156352efe9e884529ba207850d0648b39596d24f27b74d200dd289a5ccf9dd96f7a6ba46eff497133db943dff7aafcb31db1d5c6d114244ccb960539aec1821e193f244eeaf5352167681eda09ad0ae462537bebc2427c1451bc1c5ce5961dd9f2dcf8dfa6eba53c3af27c613d7d20aaf22739860af856cab733597fac2346504eee380f882d2f49531e58de25568f3fc77b48ce43ce12193f24cebd1913d8f08ff862b119b8eb4eabc924d92408312ff545e83e3b0cbaeea245d6f8982263614ae2a5bf2ffe13595b3dfd181c351ddce53985434d052642f8631369345d5be37cd19c5fd6f62fce8ecad24013cadd8d8ba0b07696e91e214a5f436cd2bf5be2551f3e2e2bde7703739a82e651cd57c1185df5ac6c540d39fc437821a8b93262e00008a04192ca1f36ce1bb7a00c6300b144e6234bdcfe56a20c16e988871e6540a149ee772eba01084cc964c48386d3c51cf5ef1bd5df20ae589004273cd1741449a881a53ca479164e64781d29c4a2ff8d05318e68729c13aef537f3f263ba5eec80cbf02a7c704ed273e1323510704008e798b644c0810d50d17f7750f3b66d5b2e5069df7ebcc0e6af7482c8a0ee5ec5845fc91e7218639aa2563b6f29d40ca61eb43c9c84b1e31e08844a1ee89124e787782298e910dc0708458e29bc16bf19120e8d991ec44187c26b3ccd8f98a27eee7c1dc23e97bc4e274f94285478f8933a812c10fdd07766b1007755521d21cfca2dab2b3787cca6e8bf33a3d17cb32a17e595d1d94279aa5ae1db06951ce4181e2795e9738abaa67ebfc869ab064f2e02cbe527868922368174b3dbbbc114e93a41691ac9f995a56cf2de796d9b37170cded8a0277bc2b6de9e0a6fef660ae799cf38f35db14b9ff43172fbc0bb48bad3f525257baf55568dede1efa5816b34b251df15764807540b21a3b5532aaf6456d18deb6627e92c2ada2d81345509e947f192e6f3cf79dd43950b9fa193cb57a42a4b6e5aac0bdffcdfd45b191bfc452c28ad92663ce53c9db5a7906e367f5cf610a552e23d2e35e52e9b1d69839108e756dc9fb25ee91044dc7e15be1f91042f07350911e961e0274b57c55749bee1d2768de6fe9f164e5e4923dbb79d00c78ef92cbf8593c4c9be05f55180b6b5396e65ebbb14d2a68c148f3f37ea12ee8077f41dc5b702558ce6918aa5f637a700a498b40349d0e865a354330ebd11e052186620e11d3c93188cbdbf363a85f82cc37933e5da24be3ad786573cd2d0671287da620312947f6756953dd5fc71002fdd1ed2237c1dbc6b3f16740054e522b52229809a177f94d0b8d0a529881947a55472a66d0b14807a305217fef5499fb26aed2e375f091edd5660becf42a020d1883393bd0a6d5a0016efd1371578077c101d532903b40e581ed0eab700af3e67f5ac5565d3ef8d00b45c7f8ed4d6dfbf5851355a5c73449884c7a41f031ce41564f826a7227484033663bb809963efdd960e121198e2bd1fd2a8670b6cdb84883fb19215cf619acc0e4d2fb1673fd0c847fbfe0a80565968f7515ccecf8c90dcfd95b75c5c74507ddb7bb9de1eefcae281d0a8b2d4c03699661aa9862cdfe0aa7fc4925868eae37cd7bf6190b2eeb01012584a0d2854ce191cb38ded59b6e9853a1dc3d68ecc3afd261ffee8dc4b9f02fac34658ac9e543edff3f12fc168cf5cf68c444a93ad2500c2974912c4bf3153832c13cee8cdcb5e183bc20665ff303882a2e08be9aba8120ec85b7f8b8a5af4c6ad590f6d5fc4e8edf8df77b881adbacef032ca710a081a7ac1853ee2b01395398298bb8dbd1cb8dbe2deb3e3debf27b1eb38282ad551882e906645b3cf738940af6781532d5480e20abfd59b95a91c0643a1784e7d1f5bd47939d642ec387b99e4037452fe9680fba96b9835f847b81e239bb16869669e4476661bee6191c0e4329ec945bd5478c933401027ddd19c580eb7a752ea0f94e38af561232da66fa4ab8317eb2cb4a281cc11e14768271f76fd145fdfcee1e3a95beb77004837607a57e27bd8e358218fb0c5f51f844b449bafc68f289504f7921301af41a1bbe8c3176e628627c5b1be81cd8498bdecf4cdb711eef2a708a3e4707894d7cc12b813e4a5f21f6812ffa74b9e57f08bba381399d1d52d29ca03fe61f8345dda36d0e44f8a494906dac1ea1feb0e5829556708e0f0a3d00d384d0af2e1d4fd83902a14df23973148b3a7e8ec5fa9e6d3a0fcbcd46d72efae2d6b70b442d54ea312b939596da42c5cd53d2cbf31398680532d27ee4ad664dffe4bdd7a38406f15b8a009537ef724ac02ea65e9956a37d277f6b90bd9c13dcac08bdb84b4da7417ba67ab6a2050891009e13d4b96613ca8b5e62037c1537886f9c2efb07e782118306f1b750795b53936d834062aba04902535f631b33eef2961349c488ee3e5ea66cc1543619b505f2f6a113c992e8e214c3aad556fd64c69a39c7020127f7249cefe4d17c53a42c0c02557725dd14bc0524cd6d7bb34be5a66391ea6347ba3908eb4fc59f17e738167aaf7f091b99d2d372d5c29991ef66e079c583332afcd897dd9941caed8719b6b5088ccf946d42ebb13ccf46b0c43da5bc170446ceb3341c867aa15e3dad1b3971b634f2bfa56fb5ee1aa6c24dfae35764fffb2fe13ea9a168db0bfa9d7948097d92dbb2e1b1e2f3c6a8c427ca8cd7535307acc2e4839ab5bb7a6208c2def924ba3969a5a50701e34c0ab4ce26fcda86cde5a7622d84e75234eca23ac13520e06f46c5b49b37169d04f93b6266ffe1bd77b4f9a21181c95500a6795faf9fc44a12a67dd59b6c1b686bfdbcdebb4855ff412f4079dbd5b3590f1e6316c5b03000b246982025ae79a6844fb6277a50823a4698042e95d1a8321cca4b8529317177bf6eae49b53ffeed42963c2e91a137779f9bdf89fd25b5815fa44ca8b2045bc1fc61e26b7ca6dba7e4a91a50aa07f7a3f50c00061d013e6e7cef872e78b7556da030d0e9c5c76ed7adb007bea10039cb7957d5c8388d58ccb423134b56de589f6606feac0563d40011f6da0637ae5cccda1cb0e8f2b9faf59514ab0d9adf1801d1d1dda75151cdaa7188b13927bdc1dfebb57d970a8f383d86d1a18f10fcba3e6989d8bafa859a2a34b3d15fa10f35059e46ea49bb8c82909daa211ae4b1c01063c64e50458eb938c0915415638c4bcd07daf1bb8cece7c1e322afc1d75c48f41315d8a69da65111bb128a884e5e1fdc3fbd5e7fa2372180984ba02f72cde3ffcd86faafdedee3fb817fe58f742bc794b183e79c8803d65bbea6dc55d3a7a42e28a3557272df4a893c350b3a1d88ae85990e631a52a143bb8cb6256e04d61409f96c21ed2ac916533bda6b3a6a6e6dc90f9a941893fec05a27635f2fa5d916a47ae850e1520b50dba286bcb53acdced254f94a19a8edfbb19963b1b79d415501d566ec45563595ac22546b5bc1d884c418d6289c5a956e441512d6fee642f7338610a83d3c6a3516482da3ef7a04442f3e54b9b9f9a426f2f530be7ec8e918a2a879f9cc0b9e80593961c1eba7bc051318108932e3e03464a332aa16f45cb0f5f6718096c28ec033dc97f0c6bea1e316d9ba78063b74f8960e6d4d5bbd6f4e8f130561f9b6b8c43679d3ae072f647b5bb4b7291c219833f491facf952f3875ea3b3f6972f8936c42597b75879e39a6e55d691d3148363859979f4bc0fa5d8960dc212e98b8dc47d80b32ed9fbe87005aa1fd8ac7ced2fb332d876f846bebd62d27add4494882ec12e06381e0c0dd50a6404a724e17178cb08fef3f7eb9869fcb344754c6c07485d05aa3b45bcf94f55a1dd57cf95684a4029bb982d413273624f4f9cfee53c97d0c041cd177ff100e609b5be8d0ba9536f9495b790acdd293ba362d00cf1dcda448e9cf46e61d15b5e2cf6962fc860684157dd46f6ccacfbdd6f4e5b7da84a18ab5ed647bc1d4c62c9cbb74088b25fabc47157e1701c378d04c90b275728bc59f2d49dfbcfe5ae274ecd60d5f1d86495961d0aaee92c8ff74df11f3177e9adac0f485e61033217b058db53cfae66fe0554f64f93d4cd3e73db9fb361fbad7a947f36c22178a2f0a29c91e3aa0d0cfea6ce013ab62506da286ddd1acad5996a2ce7ca31316d3b0337097b10f3a5c5d2eee9ac9bcb96598750b7959a5cce52d6190b8e58b294cf7580c28d9a751b768043012968011c921d39eeeb64fb2a7c27ce7efecf6f3fd3270e035bf891253dd2413947f534c775105c48948fc4d3aec1b70d9700600a3d88cb4e8b37036b9bd198f4dac9b86d43772278b59bbbeb9322ba2b679d93031355f83d6bd1d72127ff2f59fd8c4535214cbf9a2bd53a144e56b110474b96d910617981ea15a6c7f16b2c8946df84e85e763952d56cfd96aac069", 0x1000}}, 0x1006) r2 = add_key$user(&(0x7f0000000380), &(0x7f0000000000)={'syz', 0x0}, &(0x7f0000000140)='_', 0x1, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f0000000200), &(0x7f00000005c0), &(0x7f00000000c0), 0x390, 0xfffffffffffffffd) r4 = add_key$user(&(0x7f0000006400), &(0x7f0000006c00)={'syz', 0x3}, &(0x7f0000006900)="3e12d23d346cfdeb1716f738274bc1c03bee4423fa20837e6e86b86592e9be8351aabbd6e24f37d5095f839fa4a3507df4f7526f2440e7988da94ccd868dd8741d1e43", 0x43, 0xfffffffffffffffe) keyctl$dh_compute(0x17, &(0x7f0000000100)={r2, r3, r4}, 0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={'sha3-512-generic\x00'}}) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$KVM_GET_SUPPORTED_CPUID(r5, 0x4018aee2, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000001400010076657468305f746f5f7465616d00000014000000110001"], 0xa8}}, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000002180)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$SIOCSIFHWADDR(r6, 0x8923, &(0x7f0000000140)={'wg2\x00', @local}) 1.435132932s ago: executing program 2 (id=82): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xa, 0x31, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x2) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/partitions\x00', 0x0, 0x0) r1 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/vm/drop_caches\x00', 0x1, 0x0) sendfile(r1, r0, &(0x7f0000002080)=0x3a, 0x23b) 724.324348ms ago: executing program 2 (id=83): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x4c, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000141200006c07010033d43afffe800000000000000000000000000010ff020000000012000000000000000001"], 0x340a) 612.69704ms ago: executing program 2 (id=84): r0 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000140)=ANY=[@ANYBLOB="12010000413f5f201d0650c16fce0102030109021b00010000100009043300011870f500090582020002"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), 0xffffffffffffffff) r2 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_RES_CM_ID_GET(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x10, 0x140b, 0x200, 0x70bd2a, 0x25dfdbfe}, 0x10}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) ioctl$AUTOFS_DEV_IOCTL_REQUESTER(0xffffffffffffffff, 0xc018937b, &(0x7f0000000000)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x0, 0xee01}}, './file0\x00'}) syz_usb_connect$hid(0x1, 0x3f, &(0x7f0000000180)={{0x12, 0x1, 0x201, 0x0, 0x0, 0x0, 0x8, 0x79, 0x1843, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x80, 0x50, 0x10, [{{0x9, 0x4, 0x0, 0x4, 0x2, 0x3, 0x1, 0x2, 0x8, {0x9, 0x21, 0x2, 0x9, 0x1, {0x22, 0x4b7}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x5, 0x1, 0x6}}, [{{0x9, 0x5, 0x2, 0x3, 0x400, 0xa, 0x8, 0x2}}]}}}]}}]}}, &(0x7f0000000380)={0xa, &(0x7f00000001c0)={0xa, 0x6, 0x0, 0x1, 0x2e, 0xf9, 0xff, 0x7}, 0x2f, &(0x7f0000000200)={0x5, 0xf, 0x2f, 0x3, [@wireless={0xb, 0x10, 0x1, 0xe, 0x8, 0x8, 0x64, 0x6, 0xe}, @ss_container_id={0x14, 0x10, 0x4, 0x6, "732ae8130419896228588c776fbd67a9"}, @wireless={0xb, 0x10, 0x1, 0x8, 0xd0, 0x8, 0xc, 0x2, 0x8}]}, 0x2, [{0xb2, &(0x7f0000000240)=@string={0xb2, 0x3, "89ec619a0ebf62192a3f90829579368ae45a4a9a98e9730a9e853f7904e573a66721418cdbecd82693b17301bb51afcf7991728c87f4519b1d3e1eaf06ce86d84233f09a578180439464e77e7af902a00158d921bab94d0fd818f1f611ed4d226450de6d30f6d69ad2ffc3ed3040211c8b6f056f7d25b440ec7c5396ca958dadebce7d3eeca60aab79c909c269ffe2f1170faa1ccb03cd3af655a33d8c3216e961a01da35e57e5b59e79810e96a4b251"}}, {0x4, &(0x7f0000000340)=@lang_id={0x4, 0x3, 0x418}}]}) write$uinput_user_dev(r3, &(0x7f0000000580)={'syz0\x00', {0x1a1, 0x2, 0x1, 0x7}, 0x15, [0x1, 0x0, 0x40, 0x1, 0x22, 0x0, 0x8, 0x7, 0x1, 0xed, 0x6, 0xa693, 0x2, 0x2, 0x16d4, 0x1, 0x0, 0x58c, 0xfffffeff, 0xef3, 0xbf, 0x9, 0x68e, 0x0, 0x20008, 0x6, 0x8, 0x1, 0x1, 0x5, 0x0, 0x10001, 0x284f3ce3, 0x2, 0x7f, 0x4, 0x3ff, 0x1, 0x0, 0x6f3, 0x8, 0x90000, 0x100, 0x101, 0x0, 0x2, 0xfffffffe, 0x3, 0x55, 0x8, 0x5, 0x7fffffff, 0x40, 0x2, 0x3ff, 0x4, 0x7, 0x5, 0x8, 0x0, 0xc, 0x80000001, 0x9, 0x1], [0x7f, 0x2, 0x40, 0xccc, 0x7, 0xd, 0xd20, 0xfffffff6, 0x5, 0x200, 0xe00000, 0x5, 0x8, 0x2, 0x8, 0x9, 0x0, 0x80000001, 0x80000000, 0x1, 0xb, 0x6, 0x3, 0x6, 0xc, 0x6, 0xa, 0x7f, 0x6, 0xc16b, 0x9, 0x10, 0x3, 0x81, 0x1, 0x0, 0x8, 0x4, 0x6, 0x7, 0x7fff, 0x80000001, 0x9, 0x3, 0xd, 0x7, 0x3800000, 0x5, 0x9, 0x5, 0x1, 0xfff, 0x80008, 0x2, 0x7, 0xcc, 0xef, 0x8, 0x4, 0x2, 0x9, 0x80000000, 0x4, 0x9], [0xf66, 0xffffffff, 0x5, 0x0, 0x8001, 0x10000, 0x3, 0x700, 0x5, 0x25, 0xfae, 0x6, 0x6, 0x4, 0xbe, 0x8001, 0x9, 0x7, 0x6, 0x5, 0xe, 0x8, 0x10001, 0x80, 0x2, 0xfff, 0x9, 0xfffffffc, 0x9, 0x9, 0x4, 0x6, 0x800, 0x0, 0x7f, 0x7, 0xc205, 0x4, 0x101, 0x10001, 0x8, 0xa, 0x3, 0x3, 0x4, 0x6, 0x4, 0x2, 0x9, 0x10, 0xe, 0x80000000, 0xb5a2, 0x8, 0x4, 0xffffffff, 0x10000, 0xc61, 0xda, 0xfffffff7, 0xd4, 0x80000001, 0x7, 0x7], [0x5b9f7d3d, 0x5, 0x2, 0xd, 0x621b, 0x8, 0x3052a98c, 0x3, 0x4, 0x2, 0x0, 0x9, 0x6, 0xffff, 0x1, 0xfffffff7, 0x5, 0x2, 0x9, 0x4, 0x6821, 0x1, 0x10000, 0x7, 0x4, 0x9, 0x1, 0x6, 0x1, 0x4, 0x5, 0x200000, 0xfff, 0x401, 0x1, 0x401, 0x2, 0x5, 0x3, 0x67ca3172, 0xa66, 0x4, 0x6, 0x1, 0x40, 0x81, 0x4c67dcc7, 0xfffffffb, 0x27, 0xf79, 0x4, 0x5, 0x382e, 0x6, 0x1, 0x79, 0x9, 0x8, 0x100, 0x3, 0xffff0001, 0x1, 0xa1d2, 0x10001]}, 0x45c) r4 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r3, &(0x7f0000000400)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB='L\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="010000000000000014cd9b78000008000300", @ANYRES32=r5, @ANYRESOCT=r2], 0x4c}, 0x1, 0x0, 0x0, 0x40040}, 0x4008884) syz_usb_ep_write$ath9k_ep1(r0, 0x82, 0xa8, &(0x7f0000000040)=ANY=[@ANYRES32]) 449.671334ms ago: executing program 3 (id=85): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r1 = socket$inet6_sctp(0xa, 0x5, 0x84) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r1, 0x84, 0x7c, &(0x7f0000000100)={0x0, 0x2, 0x8}, 0x8) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x42002) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r2, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue1\x00'}) openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0xe0c81) r3 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) getsockopt$inet_IP_IPSEC_POLICY(r3, 0x0, 0x10, &(0x7f0000009280)={{{@in=@empty, @in6=@loopback}}, {{@in=@remote}, 0x0, @in=@empty}}, &(0x7f0000009380)=0xe8) r4 = syz_open_dev$sndpcmc(&(0x7f00000007c0), 0x0, 0x0) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_DEFAULT_SEND_PARAM(r1, 0x84, 0xa, &(0x7f0000000600)={0x4, 0x1, 0x200, 0x101, 0x2d, 0x1, 0x51e3, 0x5, 0x0}, &(0x7f0000000640)=0x20) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(r5, 0x84, 0x7c, &(0x7f0000000780)={r6, 0x8, 0x9}, 0x8) close_range(r3, r0, 0x2) mmap$snddsp_control(&(0x7f0000ffc000/0x2000)=nil, 0x1000, 0x1000001, 0xb853, r4, 0x83000000) syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000005c0)={'wlan1\x00', 0x0}) r8 = socket(0x10, 0x3, 0x0) sendmsg$nl_generic(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)={0x14, 0x52, 0x1, 0xfffffffc, 0x0, {0xa}}, 0x14}}, 0x0) r9 = socket$netlink(0x10, 0x3, 0x9) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r10 = open(&(0x7f0000000000)='.\x00', 0x800000, 0x0) ioctl$AUTOFS_IOC_PROTOSUBVER(r10, 0xc0089364, 0x0) bind$netlink(r9, &(0x7f0000000000)={0x10, 0x0, 0x0, 0x2fffffef7}, 0xc) r11 = socket$nl_generic(0x10, 0x3, 0x10) r12 = syz_genetlink_get_family_id$ethtool(&(0x7f0000010180), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_EEE_SET(r11, &(0x7f00000102c0)={0x0, 0x0, &(0x7f0000010280)={&(0x7f00000101c0)={0x2c, r12, 0x1, 0x70bd25, 0x25dfdbfb, {}, [@ETHTOOL_A_EEE_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x10}, 0x844) sendmsg$NL80211_CMD_JOIN_MESH(r11, &(0x7f00000006c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f0000000680)={&(0x7f0000000880)=ANY=[@ANYBLOB='d\x00\x00\x00\x00\x00\x00\x00\x00\x00', @ANYRESDEC=0x0, @ANYBLOB="00022abd7000fedbdf124400000008000300", @ANYRES32=r7, @ANYRESDEC=r7], 0x64}, 0x1, 0x0, 0x0, 0xc051}, 0x20000000) 352.340255ms ago: executing program 3 (id=86): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff0000000002000000090001"], 0x7c}}, 0x0) r1 = socket$kcm(0x2, 0xa, 0x2) r2 = socket$igmp6(0xa, 0x3, 0x2) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r2, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000380)=ANY=[@ANYBLOB="0100009f86ddffffffffffff88a8600081"], 0x3a) 325.961773ms ago: executing program 1 (id=87): socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r0, &(0x7f0000000300)=ANY=[@ANYBLOB="000086dd03000a000000140000006c07010033d43afffe800000000000000000000500000010ff020000000000000000000000000001"], 0x340a) 228.036879ms ago: executing program 3 (id=88): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_CONNECT(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000003c0)={0x2c, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_WANT_1X_4WAY_HS={0x4}]}, 0x2c}}, 0x0) syz_genetlink_get_family_id$nl802154(&(0x7f0000000240), 0xffffffffffffffff) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000d40)={0x44, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x44}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x44, 0x9, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0xc, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @empty}}, @IPSET_ATTR_IP_TO={0xc, 0x2, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV4={0x8, 0x1, 0x1, 0x0, @multicast1=0xe0004001}}]}]}, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x40000) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a3100000000e8010000030a01020000000000000000010000000900030073797a3200000000280004800800024000000000080001400000000514000300626174616476300000000000000000000900010073797a31000000000900010073797a3100000000340008800c00024000000000000080010c00024000000000000000040c00014000000000000000000c00014000000000000000014c000480080002404c82f47c080001400000000008000140000000010800014000000003080002404f32945f080001400000000308000140000000020800024019885f270800014000000003fd000c00a03ac330bf11a2145946e6d945deece8485ee69dbc29a8dd5dbce127f829a3adf5c4171b4bedbbc9b913a67b9ee679020f0200000064419faae0136b893d91d95b1174f115798a1abfdc06983fb83f2116a85a00dd35cdf9d8f81683e5e2ebcca132a712e0be44c12c02ac92fbbb86ed717ce0cbd6a0134f899e23ca6d2f063d26be86555cc0e9c7a25d77e6c0f4217794be96b5d797e3116d874c3adfb096e0567ec28bd1e4d8d6713109695f1f3a877d89d20e19304501aeb851d14c4f9b2d769d554fe5308810d19bb040c1977bce50b894f2c45a1f0e80c8256b6dcb072f9d91d94a67bba9f62eb2f192fa4b3786d9a774b99aa332dfbb000000080007"], 0x25c}}, 0x0) sendmsg$IPSET_CMD_DESTROY(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000580)=ANY=[@ANYBLOB="1c000100030605000000000000000000050000040500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x4000080) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='./file1\x00', 0x221c0, 0xac) r7 = fanotify_init(0x200, 0x0) fanotify_mark(r7, 0x201, 0x800003f, r7, 0x0) fanotify_mark(r7, 0x1, 0x11, r6, 0x0) fanotify_mark(r7, 0x80, 0x800, 0xffffffffffffffff, 0x0) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) connect$inet6(r8, &(0x7f0000000100)={0xa, 0x4001, 0x0, @dev={0xfe, 0x80, '\x00', 0x1b}, 0xd}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r8, 0x6, 0xd, &(0x7f00000001c0)='yeah', 0x4) write$binfmt_script(r8, &(0x7f0000000200), 0xfffffd9d) r9 = openat$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r9, &(0x7f0000000180)={[{0x2b, 'perf_event'}, {0x2b, 'net_cls'}, {0x2b, 'net_cls'}]}, 0x1e) setsockopt$inet6_IPV6_XFRM_POLICY(0xffffffffffffffff, 0x29, 0x23, &(0x7f0000000000)={{{@in=@initdev={0xac, 0x1e, 0x0, 0x0}, @in6=@remote, 0x4e23, 0x6, 0x4e22, 0x0, 0x2, 0x20, 0x20, 0x1d}, {0x7, 0x7, 0x5, 0x95d, 0xfffffffffffffffb, 0x2, 0x40, 0x6}, {0xe, 0x5, 0xb1b}, 0x401, 0x0, 0x2, 0xffffffffffffffff, 0x2, 0x2}, {{@in6=@empty, 0x4d4, 0x2a}, 0x39573c4e467c4e, @in=@loopback, 0x3502, 0x3, 0x0, 0x40, 0x9, 0x30, 0x7}}, 0xe8) r10 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$netlink(r10, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)=ANY=[@ANYBLOB="280000002100010002000000000000000a00000000000001016200000c0018"], 0x28}], 0x1, 0x0, 0x0, 0x8000}, 0x0) r11 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) syz_pidfd_open(r11, 0x0) madvise(&(0x7f0000ffd000/0x1000)=nil, 0x1000, 0xc) 156.392448ms ago: executing program 1 (id=89): r0 = syz_open_dev$cec(&(0x7f0000000680), 0x0, 0x0) ioctl$CEC_ADAP_S_LOG_ADDRS(r0, 0xc05c6104, &(0x7f0000000000)={"f8ffffff", 0xfffd, 0x6, 0x2, 0x3, 0x0, "3377f877252800", "0240e3fe", '\x00', "be4da400", ["b3020000e1ffff06000000ff", "515356898800000000ab9300", "e100"]}) 138.201384ms ago: executing program 1 (id=90): writev(0xffffffffffffffff, &(0x7f0000000040)=[{&(0x7f0000000140)="8b5f47ee6f6b2684bced22a9cfb75fe0368d28a6b8e78d19aedf62a3084e1721213ae0baf603a3599d328130f6bdfd69e12a9c1d2dd7d21fc9cdd2072d5b0e6059fbcdc24da6de1bdb153ad26ff0fc720f5ca9b13ba01576561d3ceb7885740b01d72dbaef478b9cd201793a47585ab161e104dc631c12400d3142bb24178d67050b6744125ee31da47d98c9409fa34f18ee2c899b98361d8d4c36a0a6ff33a0f5cea1", 0xa3}], 0x1) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000100)={0x40000000, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="021800001c000000000000000000000005000600000000000a00030000000000000000000000000000000000000000000000000000000000020012000000000000000000fcffffff0600ff00000000000000000000000000000000ff800000000000000001000000fe8000000000002100000000000000bb050005002b0000000a00000000000000fc01000000020000000200000000000000000000000000000800"], 0xe0}}, 0x0) 0s ago: executing program 1 (id=91): r0 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000140)=ANY=[@ANYBLOB="1201000000000040bd28420000000000000109022400010000000009040100020300000009210000000122070009058103"], 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) r1 = userfaultfd(0x1) ioctl$UFFDIO_API(r1, 0xc018aa3f, &(0x7f0000000080)) r2 = socket$packet(0x11, 0x3, 0x300) setsockopt$SO_ATTACH_FILTER(r2, 0x1, 0x1a, &(0x7f0000000000)={0x1, &(0x7f0000000440)=[{0x6}]}, 0x10) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000a00)=@newsa={0x170, 0x10, 0x413, 0x0, 0x25dfdbfb, {{@in=@private=0xa010100, @in=@remote}, {@in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x0, 0x32}, @in6=@mcast2, {}, {0x9, 0x0, 0x0, 0x5}, {}, 0x0, 0x0, 0xa}, [@algo_aead={0x60, 0x12, {{'rfc4106(gcm(aes))\x00'}, 0xa0, 0x60, "25cac5216d1c8af0a976902918bf448c5d9f5459"}}, @replay_esn_val={0x20, 0x17, {0x1, 0x70bd27, 0x70bd2d, 0x70bd25, 0x70bd2d, 0x9, [0x8]}}]}, 0x170}}, 0x0) r5 = socket$kcm(0x2, 0xa, 0x2) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) writev(r3, &(0x7f00000006c0)=[{&(0x7f0000000080)="2e9b5b0007e03dd65193dfb6c575963f86dd", 0x12}], 0x1) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000ffa000/0x1000)=nil, 0x1000}, 0x2}) r6 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x0) ioctl$SCSI_IOCTL_GET_PCI(r6, 0x2271, &(0x7f0000000100)) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) bind$inet6(r7, &(0x7f00004b8fe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendto$inet6(r7, &(0x7f0000847fff)='X', 0x20000, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r7, 0x84, 0x1d, &(0x7f0000000180)={0x1, [0x0]}, &(0x7f0000000000)=0x8) getsockopt$inet_sctp6_SCTP_SOCKOPT_PEELOFF(r7, 0x84, 0x66, &(0x7f00000002c0)={r8, 0xa9ac}, &(0x7f0000000300)=0x8) r9 = socket$igmp6(0xa, 0x3, 0x2) setsockopt$inet6_IPV6_ADDRFORM(r9, 0x29, 0x1, &(0x7f0000000000), 0x4) ioctl$UFFDIO_REGISTER(r1, 0xc020aa00, &(0x7f00000000c0)={{&(0x7f0000ffa000/0x4000)=nil, 0x4000}, 0x1}) syz_usb_control_io$uac1(r0, &(0x7f0000000100)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB='\x00!\a'], 0x0}, 0x0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.145' (ED25519) to the list of known hosts. [ 68.363767][ T5852] cgroup: Unknown subsys name 'net' [ 68.453585][ T5852] cgroup: Unknown subsys name 'cpuset' [ 68.461800][ T5852] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 69.873883][ T5852] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 71.461272][ T1304] ieee802154 phy0 wpan0: encryption failed: -22 [ 71.467775][ T1304] ieee802154 phy1 wpan1: encryption failed: -22 [ 73.749988][ T5873] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 73.758587][ T5873] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 73.767061][ T5873] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 73.775758][ T5873] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 73.784527][ T5873] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 73.792287][ T5873] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 73.808481][ T5875] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 73.828123][ T5875] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 73.831145][ T5873] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 73.839488][ T5876] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 73.844400][ T5873] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 73.850439][ T5876] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 73.857699][ T5873] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 73.864560][ T5876] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 73.873442][ T5873] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 73.878805][ T5876] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 73.886534][ T5873] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 73.898599][ T5873] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 73.906624][ T5873] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 73.914408][ T5873] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 74.253410][ T5861] chnl_net:caif_netlink_parms(): no params data found [ 74.455769][ T5863] chnl_net:caif_netlink_parms(): no params data found [ 74.469162][ T5861] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.476352][ T5861] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.484231][ T5861] bridge_slave_0: entered allmulticast mode [ 74.491828][ T5861] bridge_slave_0: entered promiscuous mode [ 74.504232][ T5861] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.511483][ T5861] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.518744][ T5861] bridge_slave_1: entered allmulticast mode [ 74.525707][ T5861] bridge_slave_1: entered promiscuous mode [ 74.632577][ T5861] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 74.683201][ T5861] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 74.768452][ T5861] team0: Port device team_slave_0 added [ 74.774676][ T5865] chnl_net:caif_netlink_parms(): no params data found [ 74.796767][ T5862] chnl_net:caif_netlink_parms(): no params data found [ 74.808900][ T5861] team0: Port device team_slave_1 added [ 74.819560][ T5863] bridge0: port 1(bridge_slave_0) entered blocking state [ 74.826775][ T5863] bridge0: port 1(bridge_slave_0) entered disabled state [ 74.834151][ T5863] bridge_slave_0: entered allmulticast mode [ 74.841222][ T5863] bridge_slave_0: entered promiscuous mode [ 74.855535][ T5863] bridge0: port 2(bridge_slave_1) entered blocking state [ 74.862766][ T5863] bridge0: port 2(bridge_slave_1) entered disabled state [ 74.870020][ T5863] bridge_slave_1: entered allmulticast mode [ 74.877022][ T5863] bridge_slave_1: entered promiscuous mode [ 74.969011][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 74.975970][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.002358][ T5861] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.027014][ T5863] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.038564][ T5861] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.045551][ T5861] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.072380][ T5861] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.095313][ T5863] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.179909][ T5863] team0: Port device team_slave_0 added [ 75.186045][ T5862] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.193641][ T5862] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.201596][ T5862] bridge_slave_0: entered allmulticast mode [ 75.208896][ T5862] bridge_slave_0: entered promiscuous mode [ 75.251328][ T5863] team0: Port device team_slave_1 added [ 75.261725][ T5861] hsr_slave_0: entered promiscuous mode [ 75.269107][ T5861] hsr_slave_1: entered promiscuous mode [ 75.275741][ T5862] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.283174][ T5862] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.290445][ T5862] bridge_slave_1: entered allmulticast mode [ 75.298153][ T5862] bridge_slave_1: entered promiscuous mode [ 75.304972][ T5865] bridge0: port 1(bridge_slave_0) entered blocking state [ 75.312783][ T5865] bridge0: port 1(bridge_slave_0) entered disabled state [ 75.320201][ T5865] bridge_slave_0: entered allmulticast mode [ 75.327209][ T5865] bridge_slave_0: entered promiscuous mode [ 75.372474][ T5865] bridge0: port 2(bridge_slave_1) entered blocking state [ 75.383738][ T5865] bridge0: port 2(bridge_slave_1) entered disabled state [ 75.390997][ T5865] bridge_slave_1: entered allmulticast mode [ 75.398291][ T5865] bridge_slave_1: entered promiscuous mode [ 75.406583][ T5863] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.413628][ T5863] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.439535][ T5863] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.491899][ T5863] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.499282][ T5863] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.525429][ T5863] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.539077][ T5862] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.588582][ T5862] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.600531][ T5865] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 75.613937][ T5865] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 75.696481][ T5862] team0: Port device team_slave_0 added [ 75.732600][ T5863] hsr_slave_0: entered promiscuous mode [ 75.739234][ T5863] hsr_slave_1: entered promiscuous mode [ 75.745351][ T5863] debugfs: 'hsr0' already exists in 'hsr' [ 75.751697][ T5863] Cannot create hsr debugfs directory [ 75.759624][ T5862] team0: Port device team_slave_1 added [ 75.768482][ T5865] team0: Port device team_slave_0 added [ 75.810624][ T5865] team0: Port device team_slave_1 added [ 75.817212][ T5862] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 75.824783][ T5862] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.851244][ T5862] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 75.863279][ T5870] Bluetooth: hci1: command tx timeout [ 75.898137][ T5862] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 75.905105][ T5862] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 75.931671][ T5862] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 75.937606][ T5870] Bluetooth: hci0: command tx timeout [ 75.942425][ T5873] Bluetooth: hci3: command tx timeout [ 75.993880][ T5865] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 76.001240][ T5865] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.017949][ T5873] Bluetooth: hci2: command tx timeout [ 76.030357][ T5865] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 76.070726][ T5865] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 76.077897][ T5865] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 76.104519][ T5865] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 76.182080][ T5862] hsr_slave_0: entered promiscuous mode [ 76.189067][ T5862] hsr_slave_1: entered promiscuous mode [ 76.195136][ T5862] debugfs: 'hsr0' already exists in 'hsr' [ 76.201041][ T5862] Cannot create hsr debugfs directory [ 76.299002][ T5865] hsr_slave_0: entered promiscuous mode [ 76.305351][ T5865] hsr_slave_1: entered promiscuous mode [ 76.311761][ T5865] debugfs: 'hsr0' already exists in 'hsr' [ 76.317540][ T5865] Cannot create hsr debugfs directory [ 76.459765][ T5861] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 76.472945][ T5861] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 76.495338][ T5861] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 76.532159][ T5861] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 76.661127][ T5863] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 76.671890][ T5863] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 76.703776][ T5863] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 76.725860][ T5863] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 76.780072][ T5862] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 76.819697][ T5862] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 76.838843][ T5862] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 76.850608][ T5862] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 76.915410][ T5865] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 76.939995][ T5865] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 76.951416][ T5865] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 76.961763][ T5865] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 77.050025][ T5861] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.115750][ T5861] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.144620][ T74] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.151983][ T74] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.179695][ T5863] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.204302][ T74] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.211659][ T74] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.272896][ T5865] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.283586][ T5862] 8021q: adding VLAN 0 to HW filter on device bond0 [ 77.293673][ T5863] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.322156][ T5865] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.349761][ T5862] 8021q: adding VLAN 0 to HW filter on device team0 [ 77.362215][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.369452][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.402907][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.410141][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.429975][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.437173][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.492640][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.499868][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.511237][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 77.518468][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 77.530843][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 77.538056][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 77.675248][ T5862] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.721228][ T5865] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 77.786702][ T5861] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 77.915639][ T5861] veth0_vlan: entered promiscuous mode [ 77.944493][ T5873] Bluetooth: hci1: command tx timeout [ 77.990472][ T5861] veth1_vlan: entered promiscuous mode [ 78.019247][ T5873] Bluetooth: hci3: command tx timeout [ 78.025049][ T5873] Bluetooth: hci0: command tx timeout [ 78.061521][ T5863] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.099966][ T5873] Bluetooth: hci2: command tx timeout [ 78.120983][ T5861] veth0_macvtap: entered promiscuous mode [ 78.134654][ T5861] veth1_macvtap: entered promiscuous mode [ 78.156331][ T5862] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.191996][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.204562][ T5861] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.237012][ T1169] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.246921][ T1169] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.259549][ T5865] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 78.270510][ T5863] veth0_vlan: entered promiscuous mode [ 78.284265][ T1169] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.293894][ T1169] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.319771][ T5863] veth1_vlan: entered promiscuous mode [ 78.433564][ T5862] veth0_vlan: entered promiscuous mode [ 78.454739][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.467152][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.522222][ T5862] veth1_vlan: entered promiscuous mode [ 78.531069][ T5863] veth0_macvtap: entered promiscuous mode [ 78.556522][ T5865] veth0_vlan: entered promiscuous mode [ 78.564588][ T5863] veth1_macvtap: entered promiscuous mode [ 78.570564][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 78.581986][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 78.605993][ T5865] veth1_vlan: entered promiscuous mode [ 78.625620][ T5862] veth0_macvtap: entered promiscuous mode [ 78.650267][ T5863] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.670095][ T5862] veth1_macvtap: entered promiscuous mode [ 78.674689][ T5861] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 78.681356][ T5863] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.751509][ T5862] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 78.769491][ T1169] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.788244][ T1116] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.806025][ T1116] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.816915][ T30] audit: type=1800 audit(1758750872.752:2): pid=5952 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.2" name="file0" dev="overlay" ino=26 res=0 errno=0 [ 78.847161][ T5862] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 78.856834][ T1116] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.891391][ T1169] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.912964][ T1169] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.947952][ T1169] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.958165][ T1169] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 78.982683][ T5865] veth0_macvtap: entered promiscuous mode [ 79.012076][ T5865] veth1_macvtap: entered promiscuous mode [ 79.064005][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.073022][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.131592][ T5865] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 79.159647][ T1169] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.172715][ T1169] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.189271][ T5865] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 79.223820][ T1116] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.238581][ T1116] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.252391][ T12] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.268765][ T980] usb 2-1: new high-speed USB device number 2 using dummy_hcd [ 79.278263][ T12] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.320606][ T12] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.330599][ T12] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 79.353827][ T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.366146][ T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.439527][ T980] usb 2-1: Using ep0 maxpacket: 16 [ 79.465200][ T74] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.473234][ T980] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 79.487053][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 79.503864][ T74] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.512196][ T980] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 79.522912][ T980] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 79.533740][ T980] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 79.592173][ T980] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 79.597586][ T1116] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 79.608382][ T980] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 79.641679][ T980] usb 2-1: Manufacturer: syz [ 79.651067][ T1116] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 79.663076][ T980] usb 2-1: config 0 descriptor?? [ 79.721841][ T5965] syz.0.1 uses obsolete (PF_INET,SOCK_PACKET) [ 79.969300][ T10] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 80.019028][ T5873] Bluetooth: hci1: command tx timeout [ 80.024623][ T980] rc_core: IR keymap rc-hauppauge not found [ 80.034858][ T980] Registered IR keymap rc-empty [ 80.040802][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.067883][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.100110][ T5873] Bluetooth: hci0: command tx timeout [ 80.105558][ T5873] Bluetooth: hci3: command tx timeout [ 80.113504][ T980] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 80.127950][ T10] usb 4-1: Using ep0 maxpacket: 32 [ 80.141837][ T980] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input5 [ 80.154987][ T10] usb 4-1: config 9 has an invalid interface number: 103 but max is 0 [ 80.167495][ T10] usb 4-1: config 9 has no interface number 0 [ 80.174795][ T10] usb 4-1: config 9 interface 103 has no altsetting 0 [ 80.184058][ T5873] Bluetooth: hci2: command tx timeout [ 80.198399][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.207733][ T10] usb 4-1: New USB device found, idVendor=0d49, idProduct=7000, bcdDevice=97.b5 [ 80.216902][ T10] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 80.225741][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.237640][ T10] usb 4-1: Product: syz [ 80.242012][ T10] usb 4-1: Manufacturer: syz [ 80.248422][ T10] usb 4-1: SerialNumber: syz [ 80.259985][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.287553][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.308288][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.338012][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.358226][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.382312][ T5980] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 80.385640][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.418417][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.438248][ T980] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 80.473317][ T980] mceusb 2-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 80.508719][ T980] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 80.541603][ T5962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 80.574281][ T5962] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 80.853536][ T980] usb 2-1: USB disconnect, device number 2 [ 81.693943][ T6003] Zero length message leads to an empty skb [ 82.001067][ T30] audit: type=1800 audit(1758750875.912:3): pid=6006 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed(directio) comm="syz.1.13" name="file0" dev="overlay" ino=50 res=0 errno=0 [ 82.098122][ T5873] Bluetooth: hci1: command tx timeout [ 82.177554][ T5870] Bluetooth: hci0: command tx timeout [ 82.183056][ T5873] Bluetooth: hci3: command tx timeout [ 82.247475][ T9] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 82.257987][ T5873] Bluetooth: hci2: command tx timeout [ 82.382551][ T10] ums-onetouch 4-1:9.103: USB Mass Storage device detected [ 82.397455][ T9] usb 1-1: Using ep0 maxpacket: 8 [ 82.427204][ T9] usb 1-1: New USB device found, idVendor=0ccd, idProduct=0069, bcdDevice=6e.55 [ 82.436500][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 82.458379][ T9] usb 1-1: Product: syz [ 82.462590][ T9] usb 1-1: Manufacturer: syz [ 82.467209][ T9] usb 1-1: SerialNumber: syz [ 82.499658][ T9] usb 1-1: config 0 descriptor?? [ 82.504998][ T10] usb 4-1: USB disconnect, device number 2 [ 82.657087][ T6020] loop3: detected capacity change from 0 to 7 [ 82.685743][ T5864] Dev loop3: unable to read RDB block 7 [ 82.698338][ T5864] loop3: unable to read partition table [ 82.704867][ T5864] loop3: partition table beyond EOD, truncated [ 82.715043][ T6020] Dev loop3: unable to read RDB block 7 [ 82.719628][ T9] usb 1-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 82.721857][ T6020] loop3: unable to read partition table [ 82.735327][ T9] dvb_usb_af9015 1-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 82.744333][ T6020] loop3: partition table beyond EOD, truncated [ 82.780495][ T6020] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 82.918511][ T6008] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 82.923221][ T6022] netlink: 8 bytes leftover after parsing attributes in process `syz.1.18'. [ 82.929577][ T6008] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 82.969526][ T10] usb 1-1: USB disconnect, device number 2 [ 83.369218][ T5987] syz.2.9 (5987): drop_caches: 1 [ 83.567828][ T5956] usb 4-1: new full-speed USB device number 3 using dummy_hcd [ 83.718467][ T6045] capability: warning: `syz.2.26' uses 32-bit capabilities (legacy support in use) [ 83.720767][ T5956] usb 4-1: device descriptor read/64, error -71 [ 83.938049][ T5918] usb 1-1: new high-speed USB device number 3 using dummy_hcd [ 84.007495][ T5956] usb 4-1: new full-speed USB device number 4 using dummy_hcd [ 84.090519][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 84.117556][ T5918] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 84.137514][ T5918] usb 1-1: New USB device found, idVendor=1e7d, idProduct=2cf6, bcdDevice= 0.00 [ 84.151904][ T5918] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 84.167601][ T5956] usb 4-1: device descriptor read/64, error -71 [ 84.182827][ T5918] usb 1-1: config 0 descriptor?? [ 84.289461][ T5956] usb usb4-port1: attempt power cycle [ 84.587218][ T6058] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 84.650475][ T6058] netlink: 80 bytes leftover after parsing attributes in process `syz.1.30'. [ 84.666551][ T6059] netlink: 80 bytes leftover after parsing attributes in process `syz.1.30'. [ 84.674370][ T5918] pyra 0003:1E7D:2CF6.0001: hidraw0: USB HID v0.00 Device [HID 1e7d:2cf6] on usb-dummy_hcd.0-1/input0 [ 84.675858][ T5956] usb 4-1: new full-speed USB device number 5 using dummy_hcd [ 84.739207][ T5956] usb 4-1: device descriptor read/8, error -71 [ 84.855298][ T6048] ALSA: mixer_oss: invalid OSS volume '' [ 84.863773][ T5918] pyra 0003:1E7D:2CF6.0001: couldn't init struct pyra_device [ 84.875473][ T5918] pyra 0003:1E7D:2CF6.0001: couldn't install mouse [ 84.892005][ T5918] pyra 0003:1E7D:2CF6.0001: probe with driver pyra failed with error -71 [ 84.915013][ T5918] usb 1-1: USB disconnect, device number 3 [ 84.968025][ T983] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 85.010243][ T5956] usb 4-1: new full-speed USB device number 6 using dummy_hcd [ 85.039037][ T5956] usb 4-1: device descriptor read/8, error -71 [ 85.127430][ T983] usb 3-1: Using ep0 maxpacket: 16 [ 85.128929][ T6064] fido_id[6064]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.0/usb1/report_descriptor': No such file or directory [ 85.148143][ T983] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 85.148916][ T5956] usb usb4-port1: unable to enumerate USB device [ 85.167546][ T983] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 85.187484][ T983] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 85.209511][ T983] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 85.222893][ T983] usb 3-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 85.240121][ T983] usb 3-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 85.249452][ T983] usb 3-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 85.257556][ T983] usb 3-1: Manufacturer: syz [ 85.268402][ T983] usb 3-1: config 0 descriptor?? [ 85.637886][ T983] rc_core: IR keymap rc-hauppauge not found [ 85.647961][ T983] Registered IR keymap rc-empty [ 85.653037][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.687525][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.718586][ T983] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0 [ 85.739135][ T983] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/rc/rc0/input6 [ 85.755568][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.762496][ T6081] loop3: detected capacity change from 0 to 7 [ 85.772477][ T6081] Dev loop3: unable to read RDB block 7 [ 85.779203][ T6081] loop3: unable to read partition table [ 85.785139][ T6081] loop3: partition table beyond EOD, truncated [ 85.788260][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.800887][ T6081] loop_reread_partitions: partition scan of loop3 (þ被xü—ŸÑà– ) failed (rc=-5) [ 85.817568][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.849212][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.878074][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.897534][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.917518][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.937632][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.957508][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 85.977507][ T983] mceusb 3-1:0.0: Error: mce write submit urb error = -90 [ 86.002569][ T983] mceusb 3-1:0.0: Registered 424242424242 with mce emulator interface version 1 [ 86.013863][ T983] mceusb 3-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 86.127907][ T5918] usb 2-1: new high-speed USB device number 3 using dummy_hcd [ 86.286073][ T983] usb 3-1: USB disconnect, device number 2 [ 86.293401][ T5918] usb 2-1: device descriptor read/64, error -71 [ 86.557477][ T5918] usb 2-1: new high-speed USB device number 4 using dummy_hcd [ 86.600922][ T6091] FAULT_INJECTION: forcing a failure. [ 86.600922][ T6091] name fail_usercopy, interval 1, probability 0, space 0, times 1 [ 86.615689][ T6091] CPU: 1 UID: 0 PID: 6091 Comm: syz.0.42 Not tainted syzkaller #0 PREEMPT(full) [ 86.615714][ T6091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 86.615731][ T6091] Call Trace: [ 86.615738][ T6091] [ 86.615745][ T6091] dump_stack_lvl+0x189/0x250 [ 86.615780][ T6091] ? __pfx____ratelimit+0x10/0x10 [ 86.615802][ T6091] ? __pfx_dump_stack_lvl+0x10/0x10 [ 86.615823][ T6091] ? __pfx__printk+0x10/0x10 [ 86.615843][ T6091] ? __might_fault+0xb0/0x130 [ 86.615874][ T6091] should_fail_ex+0x414/0x560 [ 86.615902][ T6091] _copy_from_iter+0x1de/0x1790 [ 86.615920][ T6091] ? rcu_is_watching+0x15/0xb0 [ 86.615942][ T6091] ? trace_kmem_cache_alloc+0x1f/0xc0 [ 86.615961][ T6091] ? kmem_cache_alloc_node_noprof+0x483/0x710 [ 86.615982][ T6091] ? kmalloc_reserve+0xbd/0x290 [ 86.616010][ T6091] ? tcp_leave_memory_pressure+0xea/0x100 [ 86.616033][ T6091] ? __pfx__copy_from_iter+0x10/0x10 [ 86.616060][ T6091] ? __sk_mem_schedule+0x7f/0xf0 [ 86.616083][ T6091] tcp_sendmsg_locked+0x2347/0x5540 [ 86.616154][ T6091] ? __pfx_tcp_sendmsg_locked+0x10/0x10 [ 86.616174][ T6091] ? __local_bh_enable_ip+0x12d/0x1c0 [ 86.616197][ T6091] ? __local_bh_enable_ip+0x12d/0x1c0 [ 86.616229][ T6091] tcp_sendmsg+0x2f/0x50 [ 86.616249][ T6091] __sock_sendmsg+0xe5/0x270 [ 86.616273][ T6091] sock_write_iter+0x279/0x360 [ 86.616296][ T6091] ? __pfx_sock_write_iter+0x10/0x10 [ 86.616326][ T6091] ? bpf_lsm_file_permission+0x9/0x20 [ 86.616343][ T6091] ? security_file_permission+0x75/0x290 [ 86.616374][ T6091] vfs_write+0x5c9/0xb30 [ 86.616397][ T6091] ? __pfx_sock_write_iter+0x10/0x10 [ 86.616417][ T6091] ? __pfx_vfs_write+0x10/0x10 [ 86.616445][ T6091] ? __fget_files+0x2a/0x420 [ 86.616472][ T6091] ksys_write+0x145/0x250 [ 86.616492][ T6091] ? __pfx_ksys_write+0x10/0x10 [ 86.616513][ T6091] ? do_syscall_64+0xbe/0xfa0 [ 86.616533][ T6091] do_syscall_64+0xfa/0xfa0 [ 86.616548][ T6091] ? lockdep_hardirqs_on+0x9c/0x150 [ 86.616564][ T6091] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.616581][ T6091] ? clear_bhb_loop+0x60/0xb0 [ 86.616601][ T6091] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 86.616617][ T6091] RIP: 0033:0x7f9cd5f8eec9 [ 86.616638][ T6091] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 86.616650][ T6091] RSP: 002b:00007f9cd6e48038 EFLAGS: 00000246 ORIG_RAX: 0000000000000001 [ 86.616668][ T6091] RAX: ffffffffffffffda RBX: 00007f9cd61e5fa0 RCX: 00007f9cd5f8eec9 [ 86.616680][ T6091] RDX: 00000000fffffd9d RSI: 0000200000000200 RDI: 0000000000000003 [ 86.616691][ T6091] RBP: 00007f9cd6e48090 R08: 0000000000000000 R09: 0000000000000000 [ 86.616701][ T6091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002 [ 86.616711][ T6091] R13: 00007f9cd61e6038 R14: 00007f9cd61e5fa0 R15: 00007ffd9af1ef98 [ 86.616741][ T6091] [ 86.899835][ C1] vkms_vblank_simulate: vblank timer overrun [ 86.966315][ T1228] cfg80211: failed to load regulatory.db [ 87.040591][ T5918] usb 2-1: device descriptor read/64, error -71 [ 87.147814][ T5918] usb usb2-port1: attempt power cycle [ 87.166614][ T6105] syzkaller1: entered promiscuous mode [ 87.172855][ T6105] syzkaller1: entered allmulticast mode [ 87.407589][ T5978] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 87.466653][ T6117] comedi: No check for data length of config insn id 32768 is implemented [ 87.475496][ T6117] comedi: Add a check to check_insn_config_length in drivers/comedi/comedi_fops.c [ 87.486560][ T6117] comedi: Assuming n=15 is correct [ 87.491881][ T5918] usb 2-1: new high-speed USB device number 5 using dummy_hcd [ 87.528062][ T5918] usb 2-1: device descriptor read/8, error -71 [ 87.577608][ T5978] usb 3-1: Using ep0 maxpacket: 32 [ 87.585927][ T5978] usb 3-1: config 76 has an invalid descriptor of length 0, skipping remainder of the config [ 87.598446][ T5978] usb 3-1: New USB device found, idVendor=069a, idProduct=0001, bcdDevice=51.c5 [ 87.608205][ T5978] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.616219][ T5978] usb 3-1: Product: syz [ 87.620521][ T5978] usb 3-1: Manufacturer: syz [ 87.625159][ T5978] usb 3-1: SerialNumber: syz [ 87.636153][ T5978] pwc: Askey VC010 type 1 USB webcam detected. [ 87.649000][ T6121] tmpfs: Unknown parameter 'grpquota00000000002147483647:/_:\x@K-^{:./file0:' [ 87.650331][ T5956] usb 4-1: new high-speed USB device number 7 using dummy_hcd [ 87.777564][ T5918] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 87.811689][ T5918] usb 2-1: device descriptor read/8, error -71 [ 87.820356][ T5956] usb 4-1: Using ep0 maxpacket: 32 [ 87.827321][ T5956] usb 4-1: config 0 has no interfaces? [ 87.835277][ T5956] usb 4-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=96.8f [ 87.844833][ T5956] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 87.867448][ T5956] usb 4-1: Product: syz [ 87.871657][ T5956] usb 4-1: Manufacturer: syz [ 87.876275][ T5956] usb 4-1: SerialNumber: syz [ 87.883843][ T5956] usb 4-1: config 0 descriptor?? [ 87.928130][ T5918] usb usb2-port1: unable to enumerate USB device [ 88.127096][ T5956] usb 4-1: USB disconnect, device number 7 [ 88.666029][ T6136] FAULT_INJECTION: forcing a failure. [ 88.666029][ T6136] name failslab, interval 1, probability 0, space 0, times 0 [ 88.685864][ T6136] CPU: 0 UID: 0 PID: 6136 Comm: syz.3.58 Not tainted syzkaller #0 PREEMPT(full) [ 88.685889][ T6136] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 88.685900][ T6136] Call Trace: [ 88.685907][ T6136] [ 88.685914][ T6136] dump_stack_lvl+0x189/0x250 [ 88.685943][ T6136] ? __pfx____ratelimit+0x10/0x10 [ 88.685966][ T6136] ? __pfx_dump_stack_lvl+0x10/0x10 [ 88.685988][ T6136] ? __pfx__printk+0x10/0x10 [ 88.686024][ T6136] should_fail_ex+0x414/0x560 [ 88.686051][ T6136] should_failslab+0xa8/0x100 [ 88.686072][ T6136] __kmalloc_cache_noprof+0x6f/0x6f0 [ 88.686093][ T6136] ? __sctp_v6_cmp_addr+0x1e6/0x510 [ 88.686111][ T6136] ? sctp_add_bind_addr+0x8c/0x370 [ 88.686126][ T6136] ? sctp_add_bind_addr+0xb0/0x370 [ 88.686147][ T6136] sctp_add_bind_addr+0x8c/0x370 [ 88.686169][ T6136] sctp_copy_local_addr_list+0x30b/0x4e0 [ 88.686190][ T6136] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 88.686207][ T6136] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 88.686226][ T6136] ? sctp_v6_is_any+0x64/0x80 [ 88.686244][ T6136] ? sctp_copy_one_addr+0x93/0x360 [ 88.686264][ T6136] sctp_bind_addr_copy+0xb3/0x3c0 [ 88.686283][ T6136] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 88.686309][ T6136] sctp_connect_new_asoc+0x2e0/0x690 [ 88.686332][ T6136] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 88.686358][ T6136] ? sctp_inet6_send_verify+0x23a/0x300 [ 88.686373][ T6136] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 88.686396][ T6136] __sctp_connect+0x5ba/0xd50 [ 88.686422][ T6136] ? __pfx___sctp_connect+0x10/0x10 [ 88.686443][ T6136] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 88.686460][ T6136] ? security_sctp_bind_connect+0x7e/0x2e0 [ 88.686485][ T6136] sctp_getsockopt_connectx3+0x2c4/0x440 [ 88.686504][ T6136] ? __pfx_sctp_getsockopt_connectx3+0x10/0x10 [ 88.686522][ T6136] ? __local_bh_enable_ip+0x12d/0x1c0 [ 88.686541][ T6136] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 88.686570][ T6136] sctp_getsockopt+0x98a/0xb60 [ 88.686588][ T6136] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 88.686612][ T6136] do_sock_getsockopt+0x372/0x450 [ 88.686632][ T6136] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 88.686649][ T6136] ? do_syscall_64+0xa0/0xfa0 [ 88.686664][ T6136] ? __fget_files+0x2a/0x420 [ 88.686681][ T6136] ? __fget_files+0x3a0/0x420 [ 88.686698][ T6136] ? __fget_files+0x2a/0x420 [ 88.686722][ T6136] __x64_sys_getsockopt+0x1a5/0x250 [ 88.686739][ T6136] ? do_syscall_64+0xa0/0xfa0 [ 88.686757][ T6136] ? do_syscall_64+0xa0/0xfa0 [ 88.686776][ T6136] do_syscall_64+0xfa/0xfa0 [ 88.686799][ T6136] ? lockdep_hardirqs_on+0x9c/0x150 [ 88.686813][ T6136] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.686828][ T6136] ? clear_bhb_loop+0x60/0xb0 [ 88.686848][ T6136] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 88.686862][ T6136] RIP: 0033:0x7f8d0318eec9 [ 88.686878][ T6136] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 88.686889][ T6136] RSP: 002b:00007f8d04027038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 88.686906][ T6136] RAX: ffffffffffffffda RBX: 00007f8d033e5fa0 RCX: 00007f8d0318eec9 [ 88.686917][ T6136] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000003 [ 88.686926][ T6136] RBP: 00007f8d04027090 R08: 0000200000000140 R09: 0000000000000000 [ 88.686938][ T6136] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000002 [ 88.686948][ T6136] R13: 00007f8d033e6038 R14: 00007f8d033e5fa0 R15: 00007fff3a2bff48 [ 88.686974][ T6136] [ 89.487495][ T1228] usb 1-1: new high-speed USB device number 4 using dummy_hcd [ 89.642004][ T6157] netlink: 8 bytes leftover after parsing attributes in process `syz.3.65'. [ 89.996857][ T6168] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 90.197132][ T5978] pwc: send_video_command error -71 [ 90.218377][ T5978] pwc: Failed to set video mode CIF@30 fps; return code = -71 [ 90.225976][ T5978] Philips webcam 3-1:76.0: probe with driver Philips webcam failed with error -71 [ 90.251946][ T5978] usb 3-1: USB disconnect, device number 3 [ 90.283116][ T6181] FAULT_INJECTION: forcing a failure. [ 90.283116][ T6181] name failslab, interval 1, probability 0, space 0, times 0 [ 90.322271][ T6181] CPU: 1 UID: 0 PID: 6181 Comm: syz.2.76 Not tainted syzkaller #0 PREEMPT(full) [ 90.322296][ T6181] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 90.322306][ T6181] Call Trace: [ 90.322313][ T6181] [ 90.322321][ T6181] dump_stack_lvl+0x189/0x250 [ 90.322348][ T6181] ? __pfx____ratelimit+0x10/0x10 [ 90.322372][ T6181] ? __pfx_dump_stack_lvl+0x10/0x10 [ 90.322394][ T6181] ? __pfx__printk+0x10/0x10 [ 90.322430][ T6181] should_fail_ex+0x414/0x560 [ 90.322458][ T6181] should_failslab+0xa8/0x100 [ 90.322478][ T6181] __kmalloc_cache_noprof+0x6f/0x6f0 [ 90.322499][ T6181] ? __sctp_v6_cmp_addr+0x1dc/0x510 [ 90.322515][ T6181] ? sctp_v6_cmp_addr+0x15/0xd0 [ 90.322531][ T6181] ? sctp_add_bind_addr+0x8c/0x370 [ 90.322551][ T6181] sctp_add_bind_addr+0x8c/0x370 [ 90.322573][ T6181] sctp_copy_local_addr_list+0x30b/0x4e0 [ 90.322593][ T6181] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 90.322609][ T6181] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 90.322628][ T6181] ? sctp_v6_is_any+0x64/0x80 [ 90.322647][ T6181] ? sctp_copy_one_addr+0x93/0x360 [ 90.322668][ T6181] sctp_bind_addr_copy+0xb3/0x3c0 [ 90.322686][ T6181] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 90.322712][ T6181] sctp_connect_new_asoc+0x2e0/0x690 [ 90.322735][ T6181] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 90.322763][ T6181] ? sctp_inet6_send_verify+0x23a/0x300 [ 90.322778][ T6181] ? sctp_endpoint_lookup_assoc+0xd1/0x260 [ 90.322799][ T6181] __sctp_connect+0x5ba/0xd50 [ 90.322838][ T6181] ? __pfx___sctp_connect+0x10/0x10 [ 90.322862][ T6181] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 90.322878][ T6181] ? security_sctp_bind_connect+0x7e/0x2e0 [ 90.322904][ T6181] sctp_getsockopt_connectx3+0x2c4/0x440 [ 90.322926][ T6181] ? __pfx_sctp_getsockopt_connectx3+0x10/0x10 [ 90.322944][ T6181] ? __local_bh_enable_ip+0x12d/0x1c0 [ 90.322961][ T6181] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 90.322990][ T6181] sctp_getsockopt+0x98a/0xb60 [ 90.323009][ T6181] ? __pfx_sock_common_getsockopt+0x10/0x10 [ 90.323033][ T6181] do_sock_getsockopt+0x372/0x450 [ 90.323056][ T6181] ? __pfx_do_sock_getsockopt+0x10/0x10 [ 90.323073][ T6181] ? do_syscall_64+0xa0/0xfa0 [ 90.323089][ T6181] ? __fget_files+0x2a/0x420 [ 90.323107][ T6181] ? __fget_files+0x3a0/0x420 [ 90.323124][ T6181] ? __fget_files+0x2a/0x420 [ 90.323150][ T6181] __x64_sys_getsockopt+0x1a5/0x250 [ 90.323167][ T6181] ? do_syscall_64+0xa0/0xfa0 [ 90.323185][ T6181] ? do_syscall_64+0xa0/0xfa0 [ 90.323204][ T6181] do_syscall_64+0xfa/0xfa0 [ 90.323219][ T6181] ? lockdep_hardirqs_on+0x9c/0x150 [ 90.323236][ T6181] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.323252][ T6181] ? clear_bhb_loop+0x60/0xb0 [ 90.323273][ T6181] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 90.323289][ T6181] RIP: 0033:0x7f3cd3f8eec9 [ 90.323305][ T6181] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 90.323318][ T6181] RSP: 002b:00007f3cd4e75038 EFLAGS: 00000246 ORIG_RAX: 0000000000000037 [ 90.323336][ T6181] RAX: ffffffffffffffda RBX: 00007f3cd41e5fa0 RCX: 00007f3cd3f8eec9 [ 90.323348][ T6181] RDX: 000000000000006f RSI: 0000000000000084 RDI: 0000000000000003 [ 90.323358][ T6181] RBP: 00007f3cd4e75090 R08: 0000200000000140 R09: 0000000000000000 [ 90.323369][ T6181] R10: 0000200000000200 R11: 0000000000000246 R12: 0000000000000002 [ 90.323380][ T6181] R13: 00007f3cd41e6038 R14: 00007f3cd41e5fa0 R15: 00007ffe0fc813d8 [ 90.323410][ T6181] [ 90.767459][ T1228] usb 1-1: device descriptor read/64, error -71 [ 90.838108][ T6192] netlink: 47 bytes leftover after parsing attributes in process `syz.1.78'. [ 90.930985][ T6194] xs_local_setup_socket: unhandled error (13) connecting to /var/run/rpcbind.sock [ 90.968132][ T983] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 91.008369][ T1228] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 91.118456][ T983] usb 4-1: Using ep0 maxpacket: 32 [ 91.125883][ T983] usb 4-1: config 0 has no interfaces? [ 91.133331][ T5978] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 91.157557][ T983] usb 4-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=96.8f [ 91.167012][ T983] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.175986][ T983] usb 4-1: Product: syz [ 91.181838][ T1228] usb 1-1: config 0 has an invalid interface number: 98 but max is 0 [ 91.190722][ T1228] usb 1-1: config 0 has no interface number 0 [ 91.197008][ T983] usb 4-1: Manufacturer: syz [ 91.202324][ T1228] usb 1-1: config 0 interface 98 has no altsetting 0 [ 91.209847][ T983] usb 4-1: SerialNumber: syz [ 91.217112][ T1228] usb 1-1: New USB device found, idVendor=1110, idProduct=9024, bcdDevice=db.24 [ 91.234142][ T1228] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.244567][ T983] usb 4-1: config 0 descriptor?? [ 91.251349][ T1228] usb 1-1: Product: syz [ 91.256434][ T1228] usb 1-1: Manufacturer: syz [ 91.262806][ T1228] usb 1-1: SerialNumber: syz [ 91.272519][ T1228] usb 1-1: config 0 descriptor?? [ 91.310724][ T5978] usb 2-1: unable to get BOS descriptor or descriptor too short [ 91.320303][ T5978] usb 2-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 91.332761][ T5978] usb 2-1: config 6 has 0 interfaces, different from the descriptor's value: 1 [ 91.351376][ T5978] usb 2-1: string descriptor 0 read error: -22 [ 91.360048][ T5978] usb 2-1: New USB device found, idVendor=3195, idProduct=f190, bcdDevice=c1.fc [ 91.370830][ T5978] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 91.507122][ T1228] usb 1-1: [ueagle-atm] ADSL device founded vid (0X1110) pid (0X9024) Rev (0XDB24): Eagle II [ 91.511225][ T6199] syz.2.82 (6199): drop_caches: 1 [ 91.519824][ T5978] usb 4-1: USB disconnect, device number 8 [ 91.591842][ T983] usb 2-1: USB disconnect, device number 7 [ 91.671377][ T6199] syz.2.82 (6199): drop_caches: 1 [ 92.137869][ T10] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 92.157466][ T1228] usb 1-1: reset high-speed USB device number 5 using dummy_hcd [ 92.327624][ T10] usb 3-1: Using ep0 maxpacket: 32 [ 92.334557][ T10] usb 3-1: config 0 has an invalid interface number: 51 but max is 0 [ 92.358634][ T10] usb 3-1: config 0 has no interface number 0 [ 92.378179][ T10] usb 3-1: New USB device found, idVendor=061d, idProduct=c150, bcdDevice=ce.6f [ 92.387258][ T10] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 92.425508][ T10] usb 3-1: Product: syz [ 92.430798][ T10] usb 3-1: Manufacturer: syz [ 92.435510][ T10] usb 3-1: SerialNumber: syz [ 92.455203][ T10] usb 3-1: config 0 descriptor?? [ 92.471717][ T10] quatech2 3-1:0.51: Quatech 2nd gen USB to Serial Driver converter detected [ 92.547144][ T1228] usb 1-1: failed to restore interface 98 altsetting 4 (error=-71) [ 92.568969][ T1228] usb 1-1: [ueagle-atm] pre-firmware device, uploading firmware [ 92.591739][ T1228] usb 1-1: [ueagle-atm] loading firmware ueagle-atm/eagleII.fw [ 92.605720][ T1228] usb 1-1: USB disconnect, device number 5 [ 92.616224][ T5931] usb 1-1: Direct firmware load for ueagle-atm/eagleII.fw failed with error -2 [ 92.627457][ T5931] usb 1-1: Falling back to sysfs fallback for: ueagle-atm/eagleII.fw [ 92.652817][ T5931] ------------[ cut here ]------------ [ 92.658622][ T5931] WARNING: fs/kernfs/dir.c:537 at kernfs_get+0x72/0x90, CPU#1: kworker/1:5/5931 [ 92.668546][ T5931] Modules linked in: [ 92.672663][ T5931] CPU: 1 UID: 0 PID: 5931 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT(full) [ 92.682687][ T5931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 92.692862][ T5931] Workqueue: events request_firmware_work_func [ 92.699098][ T5931] RIP: 0010:kernfs_get+0x72/0x90 [ 92.704068][ T5931] Code: e8 73 05 5f ff 48 89 df be 04 00 00 00 e8 86 49 c4 ff f0 ff 03 eb 05 e8 5c 05 5f ff 5b 5d c3 cc cc cc cc cc e8 4f 05 5f ff 90 <0f> 0b 90 eb d6 89 d9 80 e1 07 80 c1 03 38 c1 7c b6 48 89 df e8 85 [ 92.724028][ T5931] RSP: 0018:ffffc900054ff5c0 EFLAGS: 00010293 [ 92.730180][ T5931] RAX: ffffffff82619181 RBX: ffff88807de2d780 RCX: ffff88802d430000 [ 92.739158][ T5931] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 92.747183][ T5931] RBP: 0000000000000000 R08: ffff88807de2d783 R09: 1ffff1100fbc5af0 [ 92.755335][ T5931] R10: dffffc0000000000 R11: ffffed100fbc5af1 R12: ffff888028e813a8 [ 92.763463][ T5931] R13: 1ffff110051d0276 R14: ffff888028e813b0 R15: 1ffff110051d0275 [ 92.772285][ T5931] FS: 0000000000000000(0000) GS:ffff8881258be000(0000) knlGS:0000000000000000 [ 92.782000][ T5931] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 92.788700][ T5931] CR2: 00007fa971d1995c CR3: 000000007de92000 CR4: 00000000003526f0 [ 92.796733][ T5931] Call Trace: [ 92.800072][ T5931] [ 92.803029][ T5931] kobject_add_internal+0x632/0xb40 [ 92.808345][ T5931] kobject_add+0x155/0x220 [ 92.812797][ T5931] ? __pfx_kobject_add+0x10/0x10 [ 92.817871][ T5931] ? __kasan_kmalloc+0x93/0xb0 [ 92.822672][ T5931] ? kobject_init+0x83/0x1e0 [ 92.827309][ T5931] get_device_parent+0x316/0x3a0 [ 92.832328][ T5931] device_add+0x2e1/0xb50 [ 92.836692][ T5931] firmware_fallback_sysfs+0x2e4/0x9b0 [ 92.842245][ T5931] ? kmem_cache_free+0x19b/0x690 [ 92.847294][ T5931] _request_firmware+0xf83/0x15b0 [ 92.852446][ T5931] ? __pfx__request_firmware+0x10/0x10 [ 92.858025][ T5931] ? process_scheduled_works+0x9ef/0x17b0 [ 92.863776][ T5931] request_firmware_work_func+0xaf/0x1c0 [ 92.870216][ T5931] ? process_scheduled_works+0x9ef/0x17b0 [ 92.876595][ T5931] process_scheduled_works+0xae1/0x17b0 [ 92.882281][ T5931] ? __pfx_process_scheduled_works+0x10/0x10 [ 92.885876][ T6203] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 92.888344][ T5931] worker_thread+0x8a0/0xda0 [ 92.888424][ T5931] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 92.888458][ T5931] ? __kthread_parkme+0x7b/0x200 [ 92.912825][ T5931] kthread+0x711/0x8a0 [ 92.916923][ T5931] ? __pfx_worker_thread+0x10/0x10 [ 92.922136][ T5931] ? __pfx_kthread+0x10/0x10 [ 92.926776][ T5931] ? _raw_spin_unlock_irq+0x23/0x50 [ 92.929614][ T6203] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 92.932053][ T5931] ? lockdep_hardirqs_on+0x9c/0x150 [ 92.944946][ T5931] ? __pfx_kthread+0x10/0x10 [ 92.949644][ T5931] ret_from_fork+0x4bc/0x870 [ 92.954264][ T5931] ? __pfx_ret_from_fork+0x10/0x10 [ 92.959598][ T5931] ? __switch_to_asm+0x39/0x70 [ 92.964385][ T5931] ? __switch_to_asm+0x33/0x70 [ 92.969227][ T5931] ? __pfx_kthread+0x10/0x10 [ 92.974468][ T5931] ret_from_fork_asm+0x1a/0x30 [ 92.980048][ T5931] [ 92.983093][ T5931] Kernel panic - not syncing: kernel: panic_on_warn set ... [ 92.990462][ T5931] CPU: 1 UID: 0 PID: 5931 Comm: kworker/1:5 Not tainted syzkaller #0 PREEMPT(full) [ 92.999838][ T5931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 93.009979][ T5931] Workqueue: events request_firmware_work_func [ 93.016163][ T5931] Call Trace: [ 93.019457][ T5931] [ 93.022399][ T5931] dump_stack_lvl+0x99/0x250 [ 93.027003][ T5931] ? __asan_memcpy+0x40/0x70 [ 93.031617][ T5931] ? __pfx_dump_stack_lvl+0x10/0x10 [ 93.036820][ T5931] ? __pfx__printk+0x10/0x10 [ 93.041462][ T5931] vpanic+0x237/0x6d0 [ 93.045453][ T5931] ? __pfx_vpanic+0x10/0x10 [ 93.049943][ T5931] ? is_bpf_text_address+0x292/0x2b0 [ 93.055226][ T5931] ? is_bpf_text_address+0x26/0x2b0 [ 93.060422][ T5931] panic+0xb9/0xc0 [ 93.064245][ T5931] ? __pfx_panic+0x10/0x10 [ 93.068675][ T5931] ? ret_from_fork_asm+0x1a/0x30 [ 93.073612][ T5931] __warn+0x334/0x4c0 [ 93.077600][ T5931] ? kernfs_get+0x72/0x90 [ 93.081937][ T5931] ? kernfs_get+0x72/0x90 [ 93.086271][ T5931] report_bug+0x2be/0x4f0 [ 93.090686][ T5931] ? kernfs_get+0x72/0x90 [ 93.095013][ T5931] ? kernfs_get+0x72/0x90 [ 93.099331][ T5931] ? kernfs_get+0x74/0x90 [ 93.103663][ T5931] handle_bug+0x84/0x160 [ 93.107909][ T5931] exc_invalid_op+0x1a/0x50 [ 93.112407][ T5931] asm_exc_invalid_op+0x1a/0x20 [ 93.117244][ T5931] RIP: 0010:kernfs_get+0x72/0x90 [ 93.122180][ T5931] Code: e8 73 05 5f ff 48 89 df be 04 00 00 00 e8 86 49 c4 ff f0 ff 03 eb 05 e8 5c 05 5f ff 5b 5d c3 cc cc cc cc cc e8 4f 05 5f ff 90 <0f> 0b 90 eb d6 89 d9 80 e1 07 80 c1 03 38 c1 7c b6 48 89 df e8 85 [ 93.141784][ T5931] RSP: 0018:ffffc900054ff5c0 EFLAGS: 00010293 [ 93.147937][ T5931] RAX: ffffffff82619181 RBX: ffff88807de2d780 RCX: ffff88802d430000 [ 93.155987][ T5931] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 93.163948][ T5931] RBP: 0000000000000000 R08: ffff88807de2d783 R09: 1ffff1100fbc5af0 [ 93.171916][ T5931] R10: dffffc0000000000 R11: ffffed100fbc5af1 R12: ffff888028e813a8 [ 93.179887][ T5931] R13: 1ffff110051d0276 R14: ffff888028e813b0 R15: 1ffff110051d0275 [ 93.187857][ T5931] ? kernfs_get+0x71/0x90 [ 93.192191][ T5931] kobject_add_internal+0x632/0xb40 [ 93.197387][ T5931] kobject_add+0x155/0x220 [ 93.201795][ T5931] ? __pfx_kobject_add+0x10/0x10 [ 93.206808][ T5931] ? __kasan_kmalloc+0x93/0xb0 [ 93.211566][ T5931] ? kobject_init+0x83/0x1e0 [ 93.216149][ T5931] get_device_parent+0x316/0x3a0 [ 93.221084][ T5931] device_add+0x2e1/0xb50 [ 93.225412][ T5931] firmware_fallback_sysfs+0x2e4/0x9b0 [ 93.230962][ T5931] ? kmem_cache_free+0x19b/0x690 [ 93.235901][ T5931] _request_firmware+0xf83/0x15b0 [ 93.240943][ T5931] ? __pfx__request_firmware+0x10/0x10 [ 93.246404][ T5931] ? process_scheduled_works+0x9ef/0x17b0 [ 93.252202][ T5931] request_firmware_work_func+0xaf/0x1c0 [ 93.257827][ T5931] ? process_scheduled_works+0x9ef/0x17b0 [ 93.263535][ T5931] process_scheduled_works+0xae1/0x17b0 [ 93.269095][ T5931] ? __pfx_process_scheduled_works+0x10/0x10 [ 93.275077][ T5931] worker_thread+0x8a0/0xda0 [ 93.279663][ T5931] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 93.286001][ T5931] ? __kthread_parkme+0x7b/0x200 [ 93.290947][ T5931] kthread+0x711/0x8a0 [ 93.295018][ T5931] ? __pfx_worker_thread+0x10/0x10 [ 93.300127][ T5931] ? __pfx_kthread+0x10/0x10 [ 93.304718][ T5931] ? _raw_spin_unlock_irq+0x23/0x50 [ 93.309912][ T5931] ? lockdep_hardirqs_on+0x9c/0x150 [ 93.315102][ T5931] ? __pfx_kthread+0x10/0x10 [ 93.319749][ T5931] ret_from_fork+0x4bc/0x870 [ 93.324340][ T5931] ? __pfx_ret_from_fork+0x10/0x10 [ 93.329451][ T5931] ? __switch_to_asm+0x39/0x70 [ 93.334298][ T5931] ? __switch_to_asm+0x33/0x70 [ 93.339048][ T5931] ? __pfx_kthread+0x10/0x10 [ 93.343634][ T5931] ret_from_fork_asm+0x1a/0x30 [ 93.348398][ T5931] [ 93.351782][ T5931] Kernel Offset: disabled [ 93.356105][ T5931] Rebooting in 86400 seconds..