last executing test programs: 19m16.066746649s ago: executing program 2 (id=242): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0x1, &(0x7f0000000140)={0x4000000000008, 0xfffffffffffff959}, 0x0) timer_create(0xc, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() r1 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r1, &(0x7f0000001600)=""/4103, 0x1007, 0x97) syz_emit_ethernet(0x76, &(0x7f0000000a40)=ANY=[@ANYBLOB], 0x0) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000000c0)='./bus\x00', 0x4) mount$bind(&(0x7f00000002c0)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) pipe2$9p(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x4880) write$P9_RREADDIR(r4, &(0x7f0000000580)={0x90, 0x29, 0x1, {0x7fff, [{{0x2, 0x3}, 0x6, 0x10, 0xffffffffffffffbe, './file1'}, {{0x0, 0x2}, 0x810, 0x4, 0x10, './file0/../file1'}, {{0x40, 0x0, 0x2}, 0x80000000, 0x1, 0x7, './file0'}, {{0x0, 0x3, 0x1}, 0x1, 0x96, 0x7, './file1'}]}}, 0x90) mkdir(&(0x7f0000000440)='./file1\x00', 0x0) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000a00)={[{@workdir={'workdir', 0x3d, './bus'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@upperdir={'upperdir', 0x3d, './file1'}}]}) chdir(&(0x7f00000001c0)='./bus\x00') newfstatat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', &(0x7f0000000480), 0x100) rmdir(&(0x7f0000000380)='./file0/../file0\x00') sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000180)=0x7) 19m14.996238532s ago: executing program 2 (id=246): prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeea, 0x8031, 0xffffffffffffffff, 0x28f43000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="190000000400"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0) ioctl$IOMMU_OPTION$IOMMU_OPTION_RLIMIT_MODE(r3, 0x3b87, &(0x7f00000003c0)={0x18}) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='net/fib_trie\x00') read$FUSE(r4, &(0x7f0000006180)={0x2020}, 0x2020) lseek(r4, 0xfffffffffffffffd, 0x1) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000440)={&(0x7f00000003c0)='kmem_cache_free\x00', r5}, 0x10) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) timer_create(0xb, 0x0, &(0x7f0000000400)=0x0) timer_getoverrun(r6) 19m13.946357487s ago: executing program 2 (id=248): r0 = syz_open_dev$sg(&(0x7f00000003c0), 0x0, 0x101005) add_key$keyring(&(0x7f0000000000), 0x0, 0x0, 0x0, 0xfffffffffffffffe) writev(r0, &(0x7f0000000400)=[{&(0x7f0000000000)="ae", 0x1}], 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000280), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r1, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESHEX=0x0]) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x2}]}, 0x24}}, 0x0) sendmsg$NL80211_CMD_CONNECT(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000540)={0x48, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_SSID={0xa, 0x34, @default_ap_ssid}, @NL80211_ATTR_MAC={0xa, 0x6, @from_mac}, @NL80211_ATTR_PREV_BSSID={0xa}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}]]}, 0x48}}, 0x0) mknod(&(0x7f0000000000)='./bus\x00', 0x1000, 0x0) openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) mount(&(0x7f00000000c0), &(0x7f0000000440)='./bus\x00', 0x0, 0x8c7c88, 0x0) open(&(0x7f00000002c0)='./bus\x00', 0x42203, 0x13d) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_MESH(r5, &(0x7f0000000300)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={&(0x7f0000000100)={0xd8, r6, 0x400, 0x70bd27, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r7}, @val={0xc, 0x99, {0x1e, 0x23}}}}, [@NL80211_ATTR_MESH_ID={0xa}, @NL80211_ATTR_BEACON_INTERVAL={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8}], @NL80211_ATTR_BEACON_INTERVAL={0x8, 0xc, @random=0x100}, @NL80211_ATTR_HANDLE_DFS={0x4}, @NL80211_ATTR_MESH_CONFIG={0x24, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_MAX_RETRIES={0x5, 0x5, 0x2}, @NL80211_MESHCONF_HWMP_PREQ_MIN_INTERVAL={0x6, 0xc, 0x6}, @NL80211_MESHCONF_HWMP_PATH_TO_ROOT_TIMEOUT={0x8, 0x17, 0x646}, @NL80211_MESHCONF_RETRY_TIMEOUT={0x6, 0x1, 0xd1}]}, @NL80211_ATTR_MESH_CONFIG={0x3c, 0x23, 0x0, 0x1, [@NL80211_MESHCONF_HOLDING_TIMEOUT={0x6, 0x3, 0xd7}, @NL80211_MESHCONF_CONFIRM_TIMEOUT={0x6, 0x2, 0xa9}, @NL80211_MESHCONF_HT_OPMODE={0x6, 0x16, 0x10}, @NL80211_MESHCONF_POWER_MODE={0x8, 0x1a, 0x2}, @NL80211_MESHCONF_FORWARDING={0x5, 0x13, 0x1}, @NL80211_MESHCONF_ELEMENT_TTL={0x5, 0xf, 0x80}, @NL80211_MESHCONF_CONNECTED_TO_GATE={0x5}]}, @NL80211_ATTR_MESH_SETUP={0x28, 0x70, [@NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_USERSPACE_MPM={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}, @NL80211_MESH_SETUP_USERSPACE_AMPE={0x4}, @NL80211_MESH_SETUP_ENABLE_VENDOR_PATH_SEL={0x5, 0x1, 0x1}, @NL80211_MESH_SETUP_ENABLE_VENDOR_SYNC={0x5}]}]}, 0xd8}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) syz_fuse_handle_req(r1, &(0x7f00000041c0)="7ed2c42ad1b04ce3792cda19c56ce9c81ae16fb01de77f95f775f064b2d612b46878f0f4a0a6f2849f980da1b22329cba96651402f92b1a1e6a59690f7d3c2b83f46342ce56b30111f6dfd123712c00727f907272fce27d40232206a8a7e8fcc150d5a765bac8a3782c384442eaf7db71af25f723953337cf47202b7f3024c9806c0e34f946fbe2bfc8704eebd86cb87c064db095bc2992179479f918597c51ec08d10ddc4297e5b2393283743ae791551e1b69baec8ff6eb755ac3651f92ab58fcd167b7572856cda043426b0fc8900e72cbe576d3888cc8e8c60b97c72fb16860da7fd00bd9fdf528cf0feaf4b51d8234c9a6d629c66b9ea5cf119c2b84f819d3d1a8cf75b9983e5e8fcc9dfe0d68ad096b651d07eaa7ab1a7aae8fc5731c0b24949a8387809114b4001656bf23ee28e639c5adcc443cf2b596030964214c56ffd72725893cfa5ddf147110bd0d5faccf7458dc39569439a2a0cdb82854883999424c5b100acf18d8b473efdc9601165ef1de86b3aa4803e9c9b9a5b7626b3cffe385fbfd19980423e93ebb380ae39aecc96cd32082fd30aeda93f84e216708c76af3a75818ea3d0ef0df84a9ec975e71bdc891f73e71fad39230a72f9f9ab536e935b7e512ecc2d8a3856758eb14133334a1cc9b2656e352855ecdf29ce6598e5365c22beb2000004a740354ce862ccf59e33a2d0f2a3b8ee3679610bc0546ac9f7e9d1a73bfbc27907165f4cbdce5e89ac865c5d249b68a1747c992eb2aecc3abdec090b8803f647788987a1e049b458bff0931e4d438de03a775407096b7a4a8c9f4bd2101beab30240ee86f8e67d210bc3bb1b5cd82892c7853bf1b453cc9021163e0f79e26f7544d2476b4d6264094441ad3195a4667ef0fa150f7dc88956e4bd8f5ebe44194c3e4dbe8442d01a213e68f171737f25d9cf8abe7539ed80e3f87c3863194f4107ffe05244e93d69949edf089d5691d5f15a9777d96bdf8241923736aaaa69e3317e51b9f0b1149eb2e1ccaeb2cd233e30422b58c227b8021782de8c88dd62f53a171372abb08ec973ef911ebbe02b48a0952cd8fb6ba9efddd3625c202b1636e1257927da2111352164a6b1d115f2516faf580f89024c9c740421f9e2caffa09dc82478232e9adb8b922b2491d7168f5600f5fc83b766565c56bfad32fe9fd07edfeac3a6df2db815b7ef3bb18bfb78dbccc5f83e08952397ad031e549f41c1255ca666117c85ea82e2f294e88a2b8a1a5d4029792b00acaeb17cbab642e1e467e45bec53f20c2c26b0c082d32de99e797cd490d24ab2ce8c9397fcc01750716deada5b937005e5c570bc12a1a6b37a4ee281669ac783d18d5950dfb58ee31c1c305761d7ead0cea02afd72db2ae9067eccdac7e0a48112d612a19d47321062d11bf5ab06fcd68499e5b5e6bc5ce84f9e799bf5881b3d0479ae6513ad5eb11a5598dfcba17053c4cb67f3d54340d9505aeb987321857480c87ce3f7e09d437c89c525e7c1cb367fe791ced45e500028f589a74d4688c78011e7b4ead692d81a37973642e5e6845bf48ff98f9fd5b78e06f740f583fa49f6affe889776ad4e7480f12b12b60c661fcf1e0a6143ef08e335a1f5d519c048c0a86eebfe1dec807203a3e5e10ac2e0586b9e459b08f9d0c21fde3962f6bf6d56b8c5fc9292ee189da1ba6b5a88b8c7d3d94f4fb3589940e238f226cb0fe73c9606dcafcb8c841529be202aedb4fd2c8c16cf06817559f5620c174567de9f7427b25eba5c301f433644cc8a5e0ab0bea2513f031310c757e9315bd96be4f47db97d151d18000b9df04e7fcbe0dfc684d1a259b702693e34a274ed0fb93781f39456039d9d80ad240acfaba4892535242761942b95c503db73beb41de80f79ce4d02c51d57b2c0463a3f09fc53fed5523b70a30670ca02da78b0647031ae8ed5612f56eb1abbb50c98b4801f1b17942f6b5a56af59ad68febd24d901b51403a9db23f017ec2b428fa5ab591a1904b49bd452d3937dd6347cd773f9a0699970193daf2b4c7899a8c94ea109a1df422477820da801ae1d8e67f36966b3a9631edc5f81dd6ea3529a5a653edf59374895d1be79f9719856b70f2f86fe4aa419b4a9db3e928abcc4573e5c4668049959ebcb9bd773e08d8a1abdbcb2195c5da9bc7e4a36e83bc42a6139c4d40bb66ddbead9432a3927bfbeb485ecd3d0e666a86398122bf2386c914d5b51d2cc4ee6a3085094bf547678c76ab4a3d7a973852da647fb39023272c7d665ad8eb46024e5e5fe6732b7acd9b39a0fe5b4dbff846e3bd9cbe9d5b6b3ce7b1d3011902f12a20153a1c8222c2f5a940667834cf440a08b14f8e73e4e8ff7f0e588824ac0c2804a83906cf2c5763d2c6a852f53a761a1cb34acbb07bd6a0fae4fb36fa93b854f1dcc0ecca8bbeb4e5036d045e2ff24d98c1a2780963f775c6c02e7e5947869b5c93dab7e8b3eb2935b7d8f0734b472f89155792d65f78e84d72912d36ce05466fa0d1579832e92b6941a5e3b7fcbfa58c6418461d406737ca2b75e771d73e516718f589a859c935d6b4372b7fad7c6541781e01fd905b343d4dd430cfdbd9a63d4f0aee13174aec686af676818332d86182f02f279b1a6980ba0f86f62087d35eb48983a3d16433a1fc09609681f4418629f7b7c50d0ade5518a5d657fbbdf4bf30c7c24a1d81ff2031d921d214966939595aaa566bfaddd7f9fd51228d51976c5b3758d12d31393d263a43ca033cf3b4e9885568a4977368467aa8f2ba6a536f307a550c277886cea27ff17dfdbe914257ffb65b8c276a15be8ea5165fd16b909f7757e30f0ece05a2927c0e7498d6d5ea5619c96786af5230029e9214db8269365a84dc0e2cec200ae9c0b74d579c48037bc40c5fcc73b80e3bc67dd5e0d1ed0484f2c62822401e39621c52ac6d603f2d111350928ee2eb8d0825110321f5c26d6fada90725c6b5204644256a1d74f0daf2e416bee390605e3f6d06cb18c1852b30776d2073bc156c85311ccbfb139b4367f81750140a474e494a1c0d5fa2ff2a6c9b5a40f8f616b3d5e2e4be56442e305376f5d0e6a6c4d54f05e6c08ed6ee32955ff1bdf87189122767e85ad03bfbec0ec78bf859beaf880f2589cc418b53ab5cb3d0264fc11456a1b868fb014e010bff07a07754603891a399047f17dea68c6481d91e71d0aa8c26b3745a69ea2cd02deb3ccc0e7ddc6e3ac7180a9cad8f0ef1253610cb6965fa9307c9082ee845b4021af0a2af27d12b41e4647f92497918e0365fbb14a177150299e6702389939f8c9e66cdade9004ca7bb53e947ca0409d4f9d74bcbc49ac48d7b706832ab0b19f045fd21ff6339565d8d022ab08d15c2229b26ffea5ce20631e759c66095359d614db7c4683de79b53f7185b1d523c90cd1041d095face8e69c8f79862a12b0d2c5a3bb5853643faf495bece649383391e769e40cd4f11cb5bc0891998e059ee61cceb0c27792b88a92d88603e3ee0857fa2a8e03c0bbaa8f895a78e1dc7b54b5321b0db04a4e9ca3cf9a426efb08ed8de49253276849211b385ad9ae841380136caedd3fc49daa7dd4930d5e1c6355438ff086e054ba406a1f4ca450e5197076459c9dd9433bfe0a385b2236b9e28b0091e3269297dca512cbfd21300e49178cf3bc287153a5005ca28e9c7dbb4291ae76fad759ba39ba2b8a63ffcc01db45a13ae616deb1df4ad532f905beaabe165aedc442a0e2f7e232714ca59b7089081963efaf363925b1ddcbfcd4aa85da9ba903765ea04766749a7a69375cb5c7f4da42db2d0c38187c6b37adc198e350e8abac561517c3a668a3f1a0fdc33557e862d252581d13dad4128628b91eb1e1b9a55ceed5ec83ce5b0c9c5f98383c972587d9702bcfa7349f3f3049307210cf211e6bd62b9d11b58bfad21b80a6b1de0d25fc42a0bd94b69d127aa563c61d673dd512878e655756bf20fb5a41101edb2342bc4f7522ca4c3a33c3bc10bd061fce3bb4480199ea88a51990c70b3716c9a17c7b98596d9621f7dea213ef9f1b77105faa85a4467cfb676c94e7343a2089446f6243bbbf36811c669d0b0ccaa4f2ca57f59cf2cc7511887a51c37bf44306ff3709f7ef341df4ab0078b846ca3301170c7f5ea1f94eab76da7b32fe0d44bed365906f513d314b30f050b9fdb4fdf6654378b697e956e46054223d30ec4994f0ec0a7e750c4a580c4174134c0695927a12144151fdeb343df388228fc3710bb7cd80d93458cafd839a7d21116e5b06a4f68bf67a8b7b8f1a3ccea9d05a85c1a2e6c1272f7f015164d556be02cadee46ff48ee04e75aeb06b5a1a0c3ef1ccbb4d59a4c34a05f810e052f9825d24ff27321e6c4b5235dd74dbc48d3c9eed385ad50157c2f84be8872c75b4d236063f0356860ecebfc1b6b83d30397bc174b29b8a7c0d88c468e326783c00a146509e75ccd460e9230f7977ec3cb2425bf2e314680ff492753607731bc1d674f935d6ce06901a308a8711c20677fe9ae855144a8e0bc9a7d0f49f4f08186817b0b94fd56d496067c80b76eb77bb534f85ff8f4397a02a8e9448c9a1b9924d27fcdbab5feeddb14d1f57032d8a7d8e1aafbc8f9eacdd01c4788a239c1108ef5ccc159e0db4ba44de7a7cbf3f97fe03b57ec6364fe0e7d2b903b2a3f8fb52e99042b3ab6d6c4e3dd73ef2256af4567554823821c7464247e6fe624f83c2f282d42aefd38560aa4879afcdd4531c7cb192bb9abc24af0b8f981af96a7db30c0ebdaeaebc5a7841d7825f0a017382fe903478e7e54d2953c8ae8c537754cab7d59c42dedcef719c049bed1cbea347749741b2652cc1b88923d50bee5cb4aaaff9c2ff6111b2501c58f62c60bead8cac89e1ab10ff784b8228739d20a808a1a88aed3904cc25a938906ded4cf007bb9c009c52d0439444d08d1b26ff8c935115c6601a29f15a9b8d3c1c5b0959521c0a55c91b40e1aa96f8d5a1813c4baf2d0335d5e5e2bea7aa2b3ba2bdc7369a768c3bed6a11d47173442a961babc8f02fe7b701697cbc9c93599d69a25a96044c1d901a7c8b489b5a77cdb2e3894b31ab6969c25b17ca9bd95b8399e4e9968c764a1512989cfb8a53e1837cd27acb58ed999ec20016a0601b3a020924968984b982b6de1734705e413a680702605b6648d9bc93ff57cc5541b73317233b04e3aee4c3138e0f9a2a49155f4ea1e62d9ff541f7f566b18c5ee024d4750be962377937ec97b038bce7b3a7de504214e7eb22407fc0e8eb1455fe5951e83553d8e538db244b62ec9f56a1b7c155d5d1736944bb3e46edf0461068a4b9b02ba07679d003572252fd3d596a9020b153637c7513f27f4efef20ee83ab0285f2892ff52262b9d1e2bf92c4cb273d20b975d163eb2dfa4eba7b9e642bbd3acf3a192963fab83373d00f9bf543cbde732b16bfb4f9699458df528ea37790cc4ec09e7b6d6ae3a83187eebb57678da1ffc230786a79566a7e22836aab04598c0fdf991b96256f14e1d8936668147edf405bbc88e84d7a312f892c3a1dcad7e11a7fa27ca50bcbe2e3fcb201f1297899e327972bec7d631b9ee036194fad4918f0f1c7639491ba7d3b29022d53b6a6fbdef6f7566164487f59b466c9235288a2a3d5a44886ae9b375f8a7cd383da9c607dd3bada8a29d0d77672a3edc11f3a653ae729474bbdedbfcf0ab19b2fe998b7ac59e87552028c9c6578464af8e76c2864c11121009219dd32a5efd6a596b6324c680d19ba0fbb019d722f71fd68443e0c0588764d1dab37cf7bceb4e2b1248efd3f22e26e75472e35166f1545ae178da423c0bbd175aec6360cdd7d2812f4fae46295596e4d9e40f68fb3c9360a2b47dddc35aa2fd34d05411f3fca71df5702edba8c182e94a0ef2b89945d2f9dae556965f52ccdba267bd8f84db5ffc537b30f431455976b92680895695bcf86e1b22821b0fff3511eb44518afeece8dc580e6189e7ce26e3ba6ad4c93083f0766c79e185f8fa2099fa660dcfb6cbd36f91922c9eb6aad143a646744f73237af4dddd2b184091568760210676c468252653f4f5949f346afcd5d062a1387892236d0186ae01bfcf5814617790414b62355513c961f9fd324aa05dbc16725368b3bc4b591a58b7d47c1ffb7bc4c24ec18e4598b692cbf0a88c18f969e702fbb7d0ccf81a7468a7f7ebac94364fa44bbeeb022a2da5b980d109d93b6252dcc00c3158aed7d928a8bc1077023a62288845d474c0143ada9854dcd9bcfbcbd93e62f1a163d06e3f012d6c814cf3b2589a0fb7c21708025ba26375e7f5b3b76e12d90918683adbe81c08b03c3fff740c0c35d38d17468aa1b7959bb9cd6c8735ae32819c5607f34249251832d7f30b30b2cbde6a7235a9137dd1c3abf3f8d07192795280388c546806678f71e511956e86ba03930f579ed7076787404f24680bbf3cb6b562106bcee85012d08861857673e202e05c70fb151803564dafa7e4237674ed5f936e0dea63e7e5bf98058a4eaffc2eba998707c2fb54e1f38626b9a0d34267e1f40a4b0787ce848909a583990194434a9197a1c989d0c0b204199bfe32c281714e3c3fb6c2a26fdd049a5fbd352b6f561e2fa874c9a36c294f253281ff0d89b535189b9fab730858d078e71a0451abe07455ff9527569f50d3b2e406b37b8891045413c072fc4fd848c28b89ef4228b85e919072ccf6ecc0a53a3b086caeea506bdba02c9eeb66efcbc0682e52a3a2b078ffc9752b93330bea7039de2a8db03401d28775ef1f39803b77d42f6de6f482756ad1addebf8d10fa3ca75267f4d526162a669d0d1952cb91da2354f39b95c417ebf83af5cb0a7ca452910867ea4f7cc2e268f635b1febc5b7f5daff7e5057f8b3124b8bba68e2b34e879adc8a4da0ce6b2c7981883b403fafdea21c6f9955bd789a9807183a455ecaaddfc2c250244d040996098e1e5222a945ae7616817953bb0353ce90c42cc991a0db325e8e7bbb039885f4845c368a513e781428d53226cc7e48b48388c02c2b77be2d1d51da3fbe8bda78c12023487225730c59e7db2bfaa0d94917cd68b3a9b9e4b96219bd68f37ba382edc6eeffb0763c44e4023aa64a5b539817bc522eb969aa79143450580e73ecaa398157ffe9dc9d3ede14fc83d032d29d964072e34f2e6e60877fe5dbd5152edb58ffccc0f6f48b4873a82ed6ca0cc1e32a8d21f38180fd2877538ebcc0a2e415f0dfde170b08244d34554c1b26bf6e6c8f85df2b52bf0f02949663e0bdf9a2b1f4b18743dca57ff68cc37e963848ace00a0c304276208aa5e7caff86c435792d084542cb6712151de2f065fb4cc55b164ef2f95c90eb7d05b4ec7ab03489a9924ceccdbd12469bcb054a38142b7fb83b42a394a8e5eb4bbc3a96f482db8cf6b5acdc295a746517d77141faf3b9cb247774dc5064e22218af24610cceefe61cf360059db259a58d4760678ba0638ac84dc9a06bd142e8862d2d7f659c2004561ad89d4959bd2b09ff93c24ba5b807c652043e8e832e3a37c4f7573541c50c3a026283c4ff1bf7cd629302f5def4dc31ee4a24fa1074b77b563728bedc90dcd6b0a99989de0a04761762925b1ea95805ad59218e852aa8eacd1847a559339e1e5050279986a8a5b5dd71ecbdba8dd8d79eaac5b13b0e41cbef43ef24d14ca2197e7526c55de4bb7fc45f341c6e4647d4c5eda01f97e4879883b2dacc8411dc38a6362ac8a1426beafb561ce53dd28005540b2fa00c34bd132618a61893409501407692d344779807ab5590546d1d73840effe22ae3f85427ea37958f0efd4fd4b295d6fef9aa80982f30adb4b7d243b4adc78cdf2f6324d7ebc5ec128f38e98f4ca9f03abd1fcafcbef25f96221a78c8e9a3a8c974d17b5827416e01fa3192708782278700b8a13681bcd2832ff2ae5551cfdb477ea8f0b13f8c507be94aa86f1fb52924ba96b10c5f5861cf0937e474fe7cfbb84347a48d9a5bb2fa698286023f2ea1216851b7d7b8e204db759c163ba490c31ae8b517163d5d57b882dfacb4308e7796b83f998a4f8762b5eeee0e85440b972a46eed1e3e717ede0dd112a6dc5a5cbc71a9018c4dce90ef5e3437038b83c05562b60417e7f81ca0d93377531fa0582638ca1a4a39fe9973c40ebeee50b5cb6d55974f23dff764517289296908c5432bd92060d721ada9d90dbd4485613a58f338fd527965d1bab5df9317bd6019a8549f175feffed260df04e0ee114c1f04e9920a85b872745e6d261af012e65b5ccf34dd9f942c9693c51bbc56609f563e29c6922c1505af2b9a173160fa1b5575d8d91143638219707f0df7402e638c010fa77932cde29dece0dff0d8e0f4d9bb645757e4194115ca768b26148e8066dbd345f92997cdf1017469081c618ae3855c226e07289a9404326ad6f019afe5588981b7fbaefb168363f46cbc4cf3edd8575245b64f9468972fc9a3516d7b6f72450e1c37ae5dd248e58398151c098efd59bfec1162ee05c4f748b7c0f13eccfc6bd71ce7d93f77f0e6878f2f55bea321204ba04e4b69d2382b35d60676c8e3c63ca92199e9134f59721a2a80cee9c4e7e3075fbc012fc69f0e9307946dfd1214a918eae892508833ea130d300319b54c38310b8a006dcc79a53ffd523101e57e0b0fb9201d37a6ef84b4f0b9a189fdc52dc46f9cae08108b76173c6daad6942268cf0b5fc120e0db99729b8f35f9038fade1a328fdbd08964e01867c667a2e6553b26e0c678d58f6e919a44e1d06a3df4bdecf0c92b29a1a347394ed717d8797fc47b2791a205f9cc3c7145de2150177a432ecc7c1a4823274f773b30b33c2a95d8bcc8e8ff550983dc7f103745f668189ca299ab33c7e1f003f44fbcf6616bfabe4105d7537c4814d24438203fa254668efd0b58bd2b5a34fd5687884967815c68f39be8dbde7b146fc487de3d0249f38e5abaee7b8a33eb8a6522e0c52a91a49990c77a3fa4b6679410b5bb40e56394c7433352290e9fcf8f8d2e581b8e422a1d0802e69f7d21deb2e68675bf64410572b709141cbe17ffc41f9761bdce2f0fe2b17e90280c3c56b0a2ff9cdc47fe8c17f2ffb5d9481c0df7961addc54feec21b7675c9b711c75bd69f29863c2d7fe9930510338fd211e12a56f05ed7444cca5de0be51241de353166d38e08c7f260700e8a16fb3491dfaaba0843c06f17111e1d64baaa5e90631164cf53a7e5ee2701b470e5d0a5bfc62364dc8083db3b39c683f4c167a53ef289085ba686b2ec72e119ec38f8093cf7eb23155d31e852aec81fea7eb1a1551998bb91b46b726fcf670c458853f655167be94db5f9524369ad541d590cb90089c150bb6f379a4f03d935ab6e65a9be43af3001fc99800bc210695b0c749a80d084882827a324da046e421fcc973c2ffe53c235de2f3ebc81ba79c55aa49125539927c2c85fe0c3c6f85ee71818c81fd159739e9df7dfd82900ac67c14ce6c86bd3edaa64c691a0371d2d4167ca68ebc1b4bbbc23994840e20e53516e3bdeeda5d3025f118fea3a7291157bb9ed22cd544c6dd37e649de95b307c6d4c37dc102b51464a3d3cc3ffc4f3c2466278b2f5de6597e136ced64a41d96fc1d773289ba9e0c8b2fa8627ba87189690867402bf73661df6cd230e4ae9b99392075957a5ffbeff81f8723360f6e1b5e7ab2234d4ca100b6f9ce72d1ccc5b349bd47ea38f92de6decc2155fd4cc34d7eed0968ad901c8064c8bd54e59fae7ea9320a6292a0b68f2b204f6bfc773b1e01fe7de2a3dd0a5ec00adbe1c39a193a701ac897fee76fa9c3f18ae53def4676527ac1247cfddfaec56ce1a09fa0d6004d58b13642f981264ce52ac4e19259d34e18a5136e2c064a5d22b1cabb442079e5bab5f9c85d7f01c22171ade59970d7fe593391c5ee9e7cc787bed72da399ea8fe7d39b0e8385f7c67a043e485abda5f77cbe0b89cf0a5b3f326913ab0217b5a1fe2d39427b348573044f8a5d5e4722a73f9d49447ae4f50cea06ecbf46065237ca2c75237f0d93aabff94166ebbf744aa8e3ceb3750bac643416789457f14466f910ab297e62ee05f1782d6541d81cb196b7a3d6ab3f7bbed709e50999b4f28995576d47c620a24acd23ec1c03b14d4238b29e220152f7e4fe4ed496e8f939c5ed0893443d58c37a16b1f2deca1add92f54a3de96695f4852386bf1bd8b4984bf336613d1912db65b8d69690cd4420b733b34d1a7dfc8136068d3b710298ff9405524d20666488ccd7650f6b02285266af3e88f9ad99a26fb5256d7601310d2da89245e70f811a994d85bb138d29786c11746598141abfd195f801c0d86584221c4b1a82470dd4f17bab73271ce4ebdc2e94abf56dc6e047bca8d3988e337c499aed8c1391ab1af615d8ba93e8575e1dd69c595a7835eacb8109c7e719e376590e16a4c16889604047f04674e38425ba8e743ff91fc7e0f172eedcc182e8d42a28c9416e74b7caab5749859d7b231dfae0d573547e27f00f1d0e088aa7acfa6db7de3cfe2df15b076c2174e3f50447a4881045dfe54e1fbd489993bf947d549adadf8337174d64c0a67983fbef163375555bd3f159998794231dbc264f4bfd52b1a655fdd0fd27b1857279a2bc209aee01e8062a2ac5349398c92899744c986d3f472d6059575da3fa9a634ccc778387fecd1f43c6be46777afe156be99d76d11d47b76f194a67a50c5ad9941aaba39cc72fa93698916af7b34656c75796caa682185d09747f9911c95a8e6d095631c58d3cb37ab20e6292a4fd065e2dc2d745e171aaecd0600c54dfcf4212a4bfeaf307099063cbb3b892b96bab588c992613d7c7c6bb3d953ae5410d4c3b18b59003c7721dbc4379b4a4a243f8cb93dd5ad8276608f26201c2bff86e64f43a2bf793517681a1f9ca659f1de4b5ccd5496b40c52349c442c354112565fee597b12efb427eb63e6692fc3bda9b831da0e1afc8dcb2a3aa21fbd444c80f39cfd78c8e26155fd86740c8e225f06a0962abe5f687e6953c3382ee3f4b559b97f2a451df9db76d3084065ddc713aa9b63c0154b386be600a285692140f5e019ed2b01a44ba946a52355baa806e2247dbec3d0a4fb8ff14500fab216e425cb2a158efa9fd79e50b020a9316ef4e3726d08fae1683da67c323c2fbdc97b01860109387a62ef8ba4709cf079041925ce1801a8828d1f73e119be76190b5344e3c82c83d787544a883cd34721dece78e2495ca7e850f2af14395af675e6fda7d5cd7e122f1eb317480c071284cdd53b9c0457ed7b074f5a9f647fa3b5a1aad9f6459a9510af3f9c4f52c698c23c4c6f0022781ce7bdb57c493ed3ae6213e437560290e30cedc90ae400711c2220ae142c099d17cd1fa45f4424df658abc04e47754e0e66f38a7ea83c751181a2ab77d4e95b3c6008ecba7d4aa457d16b2e82fabea5a55244da18d2926153b1ee36471d1a37de2ead7d0650ea582332735c05d0abfa881cd7e841a0f53e8ad4dfb4f70b855c259588172cb1027b5b51f0cad9e89a739d07319e82977716ea71325412ae3ddc0a210e774c3061a623096f354dfd36759ac63bb5a926e7582478cc987", 0x2000, &(0x7f0000000a00)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 19m13.178259531s ago: executing program 2 (id=251): mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x200422, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=0000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f00000041c0)={0x2020}, 0x2020) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) getpid() pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = socket$igmp6(0xa, 0x3, 0x2) getsockopt$inet6_int(r3, 0x29, 0x24, &(0x7f0000000040), 0x0) write$P9_RVERSION(r2, 0x0, 0x15) r4 = dup(r2) write$FUSE_BMAP(r4, &(0x7f0000000100)={0x18}, 0x18) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000180)={'wg2\x00'}) prlimit64(0x0, 0xe, &(0x7f0000000180)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r5 = getpid() sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) prctl$PR_SET_VMA(0x53564d41, 0x0, &(0x7f0000ffc000/0x2000)=nil, 0x2000, &(0x7f0000000280)='/q5\x80;\x98\x8cT\xceg\x00') syz_open_procfs(0xffffffffffffffff, &(0x7f0000000500)='status\x00') setgroups(0x0, 0x0) 19m12.228801048s ago: executing program 2 (id=255): mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = socket$nl_generic(0x11, 0x3, 0x10) syz_emit_ethernet(0x2a, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @igmp={{0x5, 0x4, 0x0, 0x0, 0x1c, 0xffff, 0x0, 0x0, 0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @multicast1}, {0x22, 0x0, 0x0, @empty}}}}}, 0x0) sendmsg(r1, &(0x7f0000000640)={&(0x7f00000000c0)=@caif=@dgm={0x25, 0xd}, 0x80, &(0x7f00000005c0)=[{&(0x7f0000000000)="4ba72c4cfd81685544f46c3f0800", 0x36}], 0x2, 0x0, 0x0, 0x11000000}, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) listen(r2, 0x145e) setsockopt$inet6_tcp_int(r0, 0x6, 0xa, &(0x7f0000000040), 0x4) socketpair$unix(0x1, 0x5, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) socket$xdp(0x2c, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x8000000004) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000001c0)={&(0x7f0000000000)='sched_switch\x00', r3, 0x0, 0xfff7fffffffffff5}, 0x18) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000300)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) 19m11.178088043s ago: executing program 2 (id=260): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x50) syz_usb_connect(0x5, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090491000003e102"], 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80000) epoll_create1(0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x3, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b000000000000000000000000ed030000000000", @ANYRES64=r0, @ANYBLOB="8d380000000000000007251b0000000000000000", @ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="ba09ae7f9840ef4ad33241935919172303482ade60b207c92008bb9577b332e45edc81c8deb8bad8ffb86ee87253b60a6306b0c2f3c52acd6edec0e678bebffbc10bae95b0f7e3d88333badc8e1ca01e21a6aa6ca76eb548a955507a9d82b0fac356a303a2fe8dbce9568bfcaa5fe2502cd491a8be3ea635a679c638fe01070d53db94c27222e4f9361701d4c7a9155923bc0d37cd8c7f0b509d22457c1fe6ddf7139950ac5663f0edac24bb95cd37b7a26305aa08c52fdd37070e982d153c3804d8a24c0c3a1f7e6d10248a100e317f7bd58b358a427bd413fc6d670fcc6e02e199c5b9bda1540477516f559ade2933d7de23af27"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x19, 0x1c, &(0x7f0000001840)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1b}}, {}, [@snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x5}, {0x3, 0x3, 0x6, 0xa, 0xa}, {0x5, 0x1, 0xb, 0x8, 0xa, 0x4}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x0}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x2}, {0x46, 0x0, 0x0, 0x76}}], {{}, {0x6, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x3, 0xffffffffffffff0a, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x480, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, &(0x7f0000000340)={{0x8, @loopback, 0x4e2c, 0x1, 'ovf\x00', 0x14, 0x2, 0x19}, {@empty, 0x4e22, 0x3, 0x10001, 0x400fc1a, 0x8}}, 0x44) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) shmget$private(0x0, 0x400000, 0x0, &(0x7f000000e000/0x400000)=nil) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x8010800) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="200000006800e97800000000ffdbdf250a0000000000000008000500", @ANYRES32=r5, @ANYBLOB="92f962c1816647b58e11ceeec1c29d444bf4dbe65c420c229d780541c4f3e2fb66de3db8a22904555a89a0a12229bd7054c3962fb9bc6ec9ae5844ccdbd6b3662106fa82e808d6023ccc1f5ce01b61850af597e27ab1b4ae7f690bdd6ad8fac2dac5cf9885b7480e224eefab484c95"], 0x20}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x3fd4}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newlink={0x20, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x192}}, 0x20}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x0) 19m10.444134811s ago: executing program 32 (id=260): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1900000004000000040000000c"], 0x50) syz_usb_connect(0x5, 0x24, &(0x7f0000000140)=ANY=[@ANYBLOB="120110010928fc10ac059102254301020301090212000100004000090491000003e102"], 0x0) openat$mice(0xffffffffffffff9c, &(0x7f0000000080), 0x80000) epoll_create1(0x0) socket$inet6_sctp(0xa, 0x1, 0x84) r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000680)={0x2, 0x4, 0x8, 0x1, 0x80, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x1, 0x2, 0x3, 0x0, @void, @value, @void, @value}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="1b000000000000000000000000ed030000000000", @ANYRES64=r0, @ANYBLOB="8d380000000000000007251b0000000000000000", @ANYRES32=r0, @ANYRES32=0x0, @ANYBLOB="ba09ae7f9840ef4ad33241935919172303482ade60b207c92008bb9577b332e45edc81c8deb8bad8ffb86ee87253b60a6306b0c2f3c52acd6edec0e678bebffbc10bae95b0f7e3d88333badc8e1ca01e21a6aa6ca76eb548a955507a9d82b0fac356a303a2fe8dbce9568bfcaa5fe2502cd491a8be3ea635a679c638fe01070d53db94c27222e4f9361701d4c7a9155923bc0d37cd8c7f0b509d22457c1fe6ddf7139950ac5663f0edac24bb95cd37b7a26305aa08c52fdd37070e982d153c3804d8a24c0c3a1f7e6d10248a100e317f7bd58b358a427bd413fc6d670fcc6e02e199c5b9bda1540477516f559ade2933d7de23af27"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x19, 0x1c, &(0x7f0000001840)=@ringbuf={{}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {0x7, 0x0, 0xb, 0x3, 0x0, 0x0, 0x1b}}, {}, [@snprintf={{}, {0x3, 0x3, 0x3, 0xa, 0x9}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x5}, {0x3, 0x3, 0x6, 0xa, 0xa}, {0x5, 0x1, 0xb, 0x8, 0xa, 0x4}, {0x7, 0x0, 0x0, 0x8}, {}, {0x7, 0x0, 0x0, 0x0}, {}, {0x18, 0x2, 0x2, 0x0, r0}, {0x7, 0x0, 0xb, 0x2}, {0x46, 0x0, 0x0, 0x76}}], {{}, {0x6, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x3, 0xffffffffffffff0a, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x480, @void, @value}, 0x94) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000400)={0x18, 0x3, 0x0, &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) setsockopt$IP_VS_SO_SET_DELDEST(0xffffffffffffffff, 0x0, 0x488, &(0x7f0000000340)={{0x8, @loopback, 0x4e2c, 0x1, 'ovf\x00', 0x14, 0x2, 0x19}, {@empty, 0x4e22, 0x3, 0x10001, 0x400fc1a, 0x8}}, 0x44) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) shmget$private(0x0, 0x400000, 0x0, &(0x7f000000e000/0x400000)=nil) socket$nl_generic(0x10, 0x3, 0x10) unshare(0x8010800) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'batadv_slave_0\x00', 0x0}) sendmsg$nl_route(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="200000006800e97800000000ffdbdf250a0000000000000008000500", @ANYRES32=r5, @ANYBLOB="92f962c1816647b58e11ceeec1c29d444bf4dbe65c420c229d780541c4f3e2fb66de3db8a22904555a89a0a12229bd7054c3962fb9bc6ec9ae5844ccdbd6b3662106fa82e808d6023ccc1f5ce01b61850af597e27ab1b4ae7f690bdd6ad8fac2dac5cf9885b7480e224eefab484c95"], 0x20}}, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=@newnexthop={0x38, 0x68, 0x1, 0x100003, 0x7ffffffd, {}, [@NHA_GROUP={0xc, 0x2, [{0x1, 0x15}]}, @NHA_RES_GROUP={0xc, 0xc, 0x0, 0x1, [@NHA_RES_GROUP_BUCKETS={0x6, 0x1, 0x3fd4}]}, @NHA_GROUP_TYPE={0x6, 0x3, 0x1}]}, 0x38}, 0x1, 0x0, 0x0, 0x4008018}, 0x4000080) sendmsg$nl_route(r3, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000003c0)=@newlink={0x20, 0x10, 0x437, 0x0, 0x0, {0x0, 0x0, 0x0, r5, 0x192}}, 0x20}}, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) mknodat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x81c0, 0x0) 18m54.194399101s ago: executing program 1 (id=315): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0xe22, 0x0, @rand_addr, 0x99f}, 0x1c) connect$inet6(r0, &(0x7f0000000340)={0x2, 0x4e21, 0x0, @private2}, 0x1c) r1 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r1, &(0x7f0000000000)=[{&(0x7f0000000080)="580000001500add427323b472545b45602117fffffff81000e224e217f000001925aa80020007b00090080005e000001e809000000ff0000f03ac710060000f0ffffffffffffffffffe7ee00000000000000000200000000", 0x58}], 0x1) 18m54.053646892s ago: executing program 1 (id=316): r0 = fanotify_init(0x81, 0x40000) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = dup(r2) ioctl$F2FS_IOC_DEFRAGMENT(r3, 0xc010f508, &(0x7f0000000080)={0x4, 0x4}) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000840)={0x1fe, 0x2, 0x2000, 0x1000, &(0x7f0000003000/0x1000)=nil}) socket$nl_generic(0x10, 0x3, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) msgrcv(0x0, 0x0, 0x0, 0x0, 0x86b1b18158a7cb82) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x1c3302) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r5 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mq_notify(r5, &(0x7f00000000c0)={0x0, 0xc, 0x1}) readv(r5, &(0x7f0000000540)=[{&(0x7f00000003c0)=""/18, 0x12}], 0x1) r6 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) syz_kvm_setup_cpu$x86(r3, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000100)=[@textreal={0x8, 0x0}], 0x1, 0x42, 0x0, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r6, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000040)=[@text64={0x40, 0x0}], 0x1, 0x11, 0x0, 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x1000000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) fanotify_mark(r0, 0x105, 0x40001032, 0xffffffffffffffff, 0x0) syz_clone(0x0, 0x0, 0xfffffffffffffe7b, 0x0, 0x0, 0x0) wait4(0x0, 0x0, 0x4000000a, 0x0) read$FUSE(r0, &(0x7f0000002300)={0x2020}, 0x2020) 18m51.123563055s ago: executing program 1 (id=317): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) (async) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) (async) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee6, 0x8031, 0xffffffffffffffff, 0x6770c000) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) (async) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) recvmmsg(r3, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) (async) recvmmsg(r3, &(0x7f0000000080)=[{{0x0, 0x0, 0x0}}], 0x40000000000012d, 0x2, 0x0) setsockopt$inet_int(r3, 0x0, 0x7, &(0x7f0000000140)=0x30, 0x4) bind$inet(r3, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) syz_emit_ethernet(0x2e, &(0x7f0000002840)={@broadcast, @link_local, @void, {@ipv4={0x800, @udp={{0x6, 0x4, 0x0, 0x3, 0x20, 0x68, 0x0, 0x0, 0x11, 0x0, @empty, @empty, {[@rr={0x7, 0x3, 0xc7}]}}, {0x0, 0x4e20, 0x8}}}}}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) (async) bpf$PROG_LOAD(0x5, 0x0, 0x0) io_uring_register$IORING_REGISTER_EVENTFD_ASYNC(0xffffffffffffffff, 0x21, 0x0, 0x1) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff) openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) (async) r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz1\x00', 0x200002, 0x0) r5 = openat$cgroup_int(r4, &(0x7f0000000240)='cgroup.clone_children\x00', 0x2, 0x0) syslog(0x9, &(0x7f00000001c0), 0x0) sendfile(r5, r5, 0x0, 0x9) 18m50.461604345s ago: executing program 1 (id=319): socketpair$unix(0x1, 0x5, 0x0, 0x0) mkdir(0x0, 0x40) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x5, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) r1 = fsopen(&(0x7f0000000280)='ceph\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r1, 0x2, &(0x7f0000000c00)='source', &(0x7f0000000c40)="1c", 0x1) read$msr(r0, &(0x7f0000032680)=""/102392, 0x18ff8) r2 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc)) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x40, &(0x7f0000000700)=0xd8, 0x0, 0x4) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000080)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x4000) sendmsg$NFT_BATCH(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a78000000060a090400000000000000000200fffe0900020073797a32000000000900010073797a30000000004c00048024000180090001006d65746100000000140002800800014000000001080002400000001724000180090001006d6173710000000014000280080002"], 0xa0}, 0x1, 0x0, 0x0, 0x24040800}, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000001ec0), 0xffffffffffffffff) sendmsg$TIPC_CMD_SHOW_NAME_TABLE(r4, &(0x7f0000001f80)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000001f00)={0x30, r5, 0x1, 0x0, 0x0, {{}, {}, {0x14, 0x19, {0x80000000, 0x1, 0x1, 0x5}}}}, 0x30}}, 0x0) r6 = syz_init_net_socket$llc(0x1a, 0x801, 0x0) bind$llc(r6, &(0x7f0000000080), 0x10) listen(r6, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x84, @private=0xa010102, 0x4e22, 0x1, 'lblcr\x00', 0x0, 0x2, 0x5f}, 0x2c) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000003c0)={0x18, 0x10, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x8, 0xb3, &(0x7f0000000140)=""/179, 0x41000, 0x3, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000200)='hugetlb.2MB.rsvd.usage_in_bytes\x00', 0x275a, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) r7 = getpid() r8 = getgid() keyctl$chown(0x4, 0x0, 0x0, r8) sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x4) 18m49.660339908s ago: executing program 1 (id=321): r0 = socket$nl_generic(0x10, 0x3, 0x10) mkdir(&(0x7f0000000100)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000200)='./file0\x00', &(0x7f0000000000)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) r1 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file0\x00', 0x0, 0x0) openat$cgroup_ro(r1, &(0x7f0000000040)='cpu.stat\x00', 0xf000, 0x0) r2 = syz_init_net_socket$x25(0x9, 0x5, 0x0) ioctl$SIOCX25SENDCALLACCPT(r2, 0x89e9) r3 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x0, 0x0) ioctl$FS_IOC_SETFLAGS(r3, 0x40086602, &(0x7f00000002c0)=0x20) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) pipe2$watch_queue(&(0x7f0000001180)={0xffffffffffffffff}, 0x80) r6 = add_key(&(0x7f0000000000)='id_resolver\x00', &(0x7f0000000100)={'syz', 0x3}, &(0x7f0000000080)="f8", 0x1, 0xfffffffffffffffe) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r5, 0x0) pipe2$watch_queue(&(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) keyctl$KEYCTL_WATCH_KEY(0x20, r6, r7, 0x0) close_range(r4, 0xffffffffffffffff, 0x0) r8 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000280)='/sys/power/pm_print_times', 0x2, 0xa2) write$P9_RLERRORu(r8, &(0x7f00000001c0)={0x1a, 0x7, 0x1, {{0xd, 'sched_switch\x00'}, 0xf2bd}}, 0x1a) open(&(0x7f0000000080)='./bus\x00', 0x169242, 0x10) r9 = openat$cuse(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) r10 = syz_open_dev$video(&(0x7f00000024c0), 0x8, 0x20100) ioctl$VIDIOC_S_SELECTION(r10, 0xc040565f, &(0x7f0000000240)={0xa, 0x0, 0x7, {0x8000, 0x1000, 0x7, 0x6}}) ioctl$TIOCGPTPEER(r3, 0x5441, 0x8000000000000000) ioctl$TIOCVHANGUP(r7, 0x5437, 0x0) write$FUSE_GETXATTR(r9, &(0x7f0000000180)={0x18}, 0x18) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000040)={'wlan0\x00', 0x0}) r12 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) sendmsg$NL80211_CMD_REGISTER_BEACONS(r0, &(0x7f0000003900)={0x0, 0x0, &(0x7f00000038c0)={&(0x7f0000000300)=ANY=[@ANYRES64=r6, @ANYRES16=r12, @ANYBLOB="010007bd7000fddbdf2555000000080001006400000008000300", @ANYRES32=r11], 0x30}, 0x1, 0x0, 0x0, 0x40000a0}, 0x810) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) 18m47.192592486s ago: executing program 1 (id=325): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440), 0x0, 0x40008004) syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50020082180e6cfc84849acfe586a97bf762e6cffaff2b3b18b62707446e87ced6fe1d1aea63f22cb573c5cb49637048dbd2cafd70b7e70f7acc0206bd758c938b7b760d2614937640c0ecc0b8a15be759e2"], 0x0) socket(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) get_mempolicy(0x0, 0xfffffffffffffffe, 0x80, &(0x7f0000ffb000/0x3000)=nil, 0x2) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_MSRS(r5, 0xc048aeca, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r7, 0x0, 0x20004081) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0) sendmsg$IPSET_CMD_HEADER(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) write$binfmt_misc(r1, &(0x7f0000000300), 0xfdef) 18m31.736591796s ago: executing program 33 (id=325): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0x2c}}, 0x10) sendmmsg$inet(0xffffffffffffffff, &(0x7f0000000440), 0x0, 0x40008004) syz_emit_ethernet(0x4a, &(0x7f0000000080)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="50020082180e6cfc84849acfe586a97bf762e6cffaff2b3b18b62707446e87ced6fe1d1aea63f22cb573c5cb49637048dbd2cafd70b7e70f7acc0206bd758c938b7b760d2614937640c0ecc0b8a15be759e2"], 0x0) socket(0x10, 0x3, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) get_mempolicy(0x0, 0xfffffffffffffffe, 0x80, &(0x7f0000ffb000/0x3000)=nil, 0x2) openat$ipvs(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r2 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, &(0x7f0000000080)=ANY=[], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r2}, 0x10) r3 = openat$kvm(0xffffffffffffff9c, 0x0, 0x100, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_GET_MSRS(r5, 0xc048aeca, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) getpid() r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r7, 0x0, 0x20004081) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x46, 0x0, 0x0) sendmsg$IPSET_CMD_HEADER(r7, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000300)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x8000}, 0x4000000) write$binfmt_misc(r1, &(0x7f0000000300), 0xfdef) 6m48.81026864s ago: executing program 6 (id=2616): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000fe07124081173809499b0102030109022400010000000009040000028b8647000905e8ff000900000009050a", @ANYRES32=r0], 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000001c0)={0x3, 0x6, &(0x7f0000000040)=ANY=[@ANYBLOB="180000000000000000000000ffffff851000000200000020000200000000009500007b0000000095000000000d"], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1f00, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r1 = syz_io_uring_setup(0x3380, &(0x7f0000000180)={0x0, 0x0, 0x10100}, &(0x7f0000000380)=0x0, &(0x7f00000000c0)=0x0) r4 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cpu.stat\x00', 0x275a, 0x0) write$UHID_CREATE2(r4, &(0x7f0000000040)=ANY=[@ANYBLOB='5'], 0x118) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x5, 0x12, r4, 0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000000)=@IORING_OP_RECVMSG={0xa, 0x0, 0x2, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x1}) io_uring_enter(r1, 0x2d3e, 0x0, 0x0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000380)=ANY=[], 0xf) r5 = openat$selinux_validatetrans(0xffffffffffffff9c, &(0x7f00000002c0), 0x1, 0x0) pwritev(r5, &(0x7f0000004240)=[{&(0x7f0000002fc0)='v', 0x1}], 0x1, 0x4, 0x4) syz_usb_connect(0x2, 0x36, &(0x7f00000000c0)=ANY=[@ANYBLOB="120100008010bd40820514009dbb0003000109022400011b00000009040000022a3e740009058bff7f0000100109050b362f"], 0x0) r6 = socket$inet_mptcp(0x2, 0x1, 0x106) r7 = syz_open_dev$I2C(&(0x7f0000000080), 0x18, 0x200042) ioctl$I2C_RDWR(r7, 0x707, &(0x7f0000001b00)={&(0x7f0000000280)=[{0x0, 0xc11, 0x3, &(0x7f00000000c0)="6c0604"}], 0x1}) write$selinux_validatetrans(r5, &(0x7f0000000000)={'system_u:object_r:auditd_etc_t:s0', 0x20, 'system_u:object_r:hald_sonypic_exec_t:s0', 0x20, 0x2, 0x20, 'unconfined\x00'}, 0xfffffffffffffd8e) writev(r6, &(0x7f0000000300), 0x0) 6m45.897652435s ago: executing program 6 (id=2627): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller0\x00', 0x84aebfbd6349b7f2}) ioctl$SIOCSIFHWADDR(r0, 0x8914, &(0x7f0000000640)={'\x00', @multicast}) bpf$MAP_CREATE(0x0, &(0x7f00000008c0)=ANY=[@ANYBLOB="0a00000002000000ff0f000007"], 0x48) r1 = syz_usb_connect(0x2, 0x36, &(0x7f0000000d00)=ANY=[@ANYBLOB="130100005612f220fd070400f6d2010203010902240001000010000904d4fd02ff441d0009050302ff030000000905820208000000008bf91cd3a95cdb698f9c701dc2fadc4efdcd1d6933546cdadeb46a350bba99313909164358e8504bdeec7a98343985becf50faac513cd6a435c939caf9f532f94f57bb186add5ba43763ee51185c981b0e88a4cc1cdead825cc16119977c6f652aca3425c03b1ae770d283cd020000000000000048a1203e28e8d93f6026e8bf5fc236f2953cefb550fcded4ac18b9159407b45290d50d5651ef8316e588df00e39579f3d9640982258d57c738f65c237f9b091673ac5a2ea698cfd3c53b9938873d19a542d52d1b92ae3ae4f3b26f162969aeb3c2c85495f7624fc9b4980240dd33335561de24f7a7ed1329bd2ff560b6fc0b9d1ab5074b9c92b1bec2e024a4e4cec185c293a9814dabc46d1dd1b36f610fb5c62de1591c95e238b7c47d1195ed7aee7a930ade3b658d1b99187aacd52c1555e4d205585cb1830ad6a1f7fc48984713d235cdbb4d233f7b87c6e41ce6a3ca5ee46d2bf238b0a8566c9cc6f0d08706fcbe1d510587415b949b47ac97d553c747e6a457bb6064a193b359afb227a4a1a856c93cf18c9b9e2fd79c1d90412171845bc72cf8a0efd9c2367fd89731041da69769e9538436b01d7de68b0152fe9a82a299be02e7797ba8a7fe80e5398b3d9cd2728ff18c50ede1e6cce0f773c41d0d70f4122b0f663c5725b9e29cf1"], 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000940)=ANY=[@ANYBLOB="b4050000200080066110000000000000c6000000000000009500d800000000009f33ef60916e55893f1eeb0b2ae13d922e6235592ce847e2566c43d72918a897323fd0723043c47c896ce0bce66a245ad9d6817fd98cd824498949714ffaac8a6f77ef0000ca5d82054d54d53cd2b6db714e75d9bdae214fa68a0557eb2c5ca683a4b6fcfcff0bffffffffffd47042eaebfa6fa26fa7a347c7faa8e700458c60897d4a6148a1c11428427c40de60beacf871ab5c2ff88a02084e5b5271e45f00003826fb8579c1fb01d2c5553d2ccb5fc5b51fe6b174ebd9907dcff414ed55b0c20cdbe7009a6fe7cc78762f1d4dcdbca64920db9a50f86c21632f7a4bd344e0bd74ff05d37ef68e3b9db863c758ffffffffabe90ac5d08dd9d4e0359c41cf3626e1230bc1cd4c02c460ceb44276e9bd94d1c2e6d17dc5c2edf332a62f5fe68fbbbbfcfd00000000000fbf940e6652d357474ed5f816f66ac3027460ae66317f83cdd7a7eb2a7003d1a6cf5478533584961c329fcf5a43e05c92bfef0dcd28000000003f2915a3039c9a78f63b8ec7e60a0000fed7d67c440e23d130e51eea1e085bebabe7059de9cbfc5117c024185a062acb6b8eec31c21b3af8b9eedb4660ed2deb7acf2a33a376a5cb7d4266d5b0be14488d14b473502486ad8dd600000000000000000000c7766ea7c581782c0d90f42a85303835fc291c25d29e6bead5d7360f2e1929d7736ebc8558c4506407d3046022bdf25485bd5442169e9b4c1278343581b7a06f65e8ea6b042c4fd08381e5000000000000006398d6480000001a723b91030000006480304c66b217aea0156ce9eef911fe5b7370f79987303ecb3aabc53c60014a0101ab766754f596b41da9534d12b8306a1b36cf3b03f0d790879f523eabfbee83d8bd472ef69660cf6ec897106c51e54a17497f384c4956b41f3843e7c878b1e11316d8ddae1c6c3b85aaf7a9fcaf8f5d6186c42542d68ba72682c938d3c0a2e6e10eed71b1d31c9f300b41745329bf34495c63e43fb896e4903fb0fae54a8f0fe3b48a5b29d279070647e65097c8ecf32a15080000000000000001007ba4a70a084bd994ac5e00000000000000000000000000351a30cd97f83d72631d0fe92efa974a53f4dc1eb9a86df632a6d463688123f64d42a919bcfc44a90ffd680200000091f842a91c977f6075d07e39e669b0713af0498a99bf5261cb3269d499a5202d7a08b33ade7b38829b9bd39619688d5e9af22170ef83e5b92cbb32b655c45de1c154aad81bf64351668a3f76d5afa958aff76249e0ffdf8e45155536a1a44bfcbfbfd232af000052f9002a"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb=0x26, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x0, 0xffffffff}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r3 = bpf$MAP_CREATE(0x0, &(0x7f0000000700)=ANY=[@ANYBLOB="12000000040000000400000012"], 0x50) r4 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000002c40)={0x11, 0xf, &(0x7f00000006c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xfffeffff, 0x0, 0x0, 0x0, 0x101}, {{0x18, 0x1, 0x1, 0x0, r4}, {}, {}, {0x85, 0x0, 0x0, 0x5}, {0x7, 0x1, 0xb, 0x9, 0x0, 0x20}}, {{0x5, 0x0, 0x6}, {0x66, 0x0, 0x0, 0x80ffffff}}, [], {{0x4, 0x1, 0x2, 0x3}, {0x5, 0x0, 0xb, 0x3}, {0x85, 0x0, 0x0, 0x76}}}, &(0x7f0000000040)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback=0x24, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, @void, @value}, 0x94) ioctl$sock_ipv6_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000200)={'ip6_vti0\x00', &(0x7f0000000340)={'syztnl1\x00', 0x0, 0x2f, 0x3, 0xa, 0x8, 0x24, @empty, @mcast2, 0x20, 0x20, 0x5, 0x6}}) syz_open_dev$evdev(&(0x7f0000000080), 0x2, 0x842) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') mount$9p_fd(0x0, &(0x7f0000000340)='.\x00', &(0x7f0000000040), 0x10, &(0x7f0000000440)=ANY=[@ANYBLOB="f1ce47929a592053951586212f7b0d2592a507e8c11be30e600613ecf85242f8ad1409a9799678a60466f60854afdec75454c609c573438788721a48054ee0e42e8b5c9781cc20a9", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRES16=r1]) bpf$MAP_CREATE(0x0, &(0x7f00000003c0)=@bloom_filter={0x1e, 0x7, 0x7f, 0x3ff, 0x44000, r4, 0x8420, '\x00', r5, r6, 0x3, 0x0, 0x3, 0x0, @void, @value, @void, @value}, 0x50) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000080)=ANY=[@ANYRES32=r3, @ANYRES32=r2, @ANYBLOB="05"], 0x10) close(r2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000080)) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000580)={{r3}, &(0x7f0000000500), &(0x7f0000000540)=r2}, 0x20) 6m42.229154365s ago: executing program 6 (id=2636): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_PARTIAL_DELIVERY_POINT(r0, 0x84, 0x13, &(0x7f0000000280)={0x0, 0xe31c}, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r0, 0x84, 0x22, 0x0, 0x0) 6m42.086323276s ago: executing program 6 (id=2639): capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)={0x200000, 0x200000}) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f0000000080)='/proc/mdstat\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000000180)={0x2020}, 0x2024) r1 = socket$rxrpc(0x21, 0x2, 0xa) io_uring_setup(0x7d9e, &(0x7f00000003c0)={0x0, 0xfdcf, 0x800, 0x1, 0x24}) r2 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r2, 0x11b, 0x6, &(0x7f0000000280)=0x20, 0x4) ioctl$int_in(r1, 0x5452, 0x0) io_uring_enter(0xffffffffffffffff, 0x48e9, 0x0, 0x2, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(0xffffffffffffffff, 0x6, 0xd, 0x0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r3 = socket$nl_crypto(0x10, 0x3, 0x15) sendmsg$nl_crypto(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="e8000000110001"], 0xe8}}, 0x0) ioctl$IOMMU_TEST_OP_ADD_RESERVED(0xffffffffffffffff, 0x3ba0, 0x0) 6m41.825406503s ago: executing program 6 (id=2641): mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) ioctl$vim2m_VIDIOC_S_CTRL(0xffffffffffffffff, 0xc008561c, &(0x7f00000000c0)={0x101, 0x6925}) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000080)='./file0\x00', &(0x7f0000000040)='cgroup2\x00', 0x0, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000001c0)={[{@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) 6m41.753864484s ago: executing program 6 (id=2643): socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x6c3, 0x9}, 0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000001880)={0x0, 0xf5, &(0x7f0000001600)=[{&(0x7f0000001a00)="e8a472", 0x3}, {&(0x7f00000000c0)="bcc9b1557de1fad1f955144629ed4dcf3c33679ea22502e3cff8923bf5d43921bc111a262f295a8eb540", 0x7fffeffd}, {&(0x7f0000001680)="094fb143daa9baa36aaa2cca06886c533118e056", 0x14}], 0x3}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="1400000036000b63717a3c4a0ed8985b0808aa78", 0x14}], 0x1}, 0x0) 6m27.496347915s ago: executing program 4 (id=2687): r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/secure_tcp\x00', 0x2, 0x0) write$cgroup_int(r0, &(0x7f0000000040)=0x3, 0x12) write$cgroup_int(r0, &(0x7f0000000080)=0x4e7, 0x12) 6m27.408968534s ago: executing program 4 (id=2688): r0 = openat$khugepaged_scan(0xffffffffffffff9c, &(0x7f0000000140), 0x1, 0x0) write$khugepaged_scan(r0, &(0x7f0000000080), 0x8) write$khugepaged_scan(r0, &(0x7f0000000000), 0x8) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x1b, 0x5, &(0x7f0000000240)=ANY=[@ANYBLOB="180200000000020000000000000000008500000017000000850000000700000095", @ANYBLOB="e6bea0752ff603f23161f4440e107f8b39593dd6722e1a885c8d3cd4b7ea0307cb9227a155023d5aeb9bf513fb439771ec8211a25e83963f9b96c959064e209708b1718445dbcb82942545bd8cd240a932c48f845fd2ce8611f8e24c6e3cc91b56646c55c6a633642bc61f3efc72fa3e27ae52ee75a518467e3dff4255c18d140507e8c57e7e5a9be949da1b307ffb9bd14aabbeffe9e0dd487502c1d550e0a9af488436520e273405ca5aa96d730531975ca9a08791cf34eda1b02055bf134b92225489a55805621b0a926ae630374ad82f50928c561e96e34109729899cb8a518bffad4af9", @ANYRES16], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r1, 0x0, 0xe, 0x0, &(0x7f0000000900)="e02742e8680d85ff9782762f0800", 0x0, 0xda, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) r2 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mq_notify(r2, &(0x7f00000000c0)={0x0, 0xc, 0x0, @thr={0x0, 0x0}}) readv(r1, &(0x7f0000000480)=[{&(0x7f0000000380)=""/87, 0x57}, {&(0x7f0000000100)=""/232, 0xe8}, {&(0x7f0000000400)=""/61, 0x87}, {&(0x7f0000000440)=""/44, 0x2c}], 0x4) ioctl$AUTOFS_IOC_FAIL(r2, 0x9361, 0x4) r3 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.io_wait_time\x00', 0x0, 0x0) write$khugepaged_scan(r0, &(0x7f00000004c0), 0x8) write$khugepaged_scan(r3, &(0x7f0000000580), 0x8) socket$inet6_sctp(0xa, 0x1, 0x84) r4 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) read$msr(r4, &(0x7f00000000c0)=""/8, 0x8) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000540)=@generic={&(0x7f0000000500)='./file0\x00', 0x0, 0x10}, 0x18) 6m27.273051882s ago: executing program 4 (id=2690): fsopen(&(0x7f0000000100)='vfat\x00', 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_audit(0x10, 0x3, 0x9) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="06000000040000000800000008"], 0x48) socket$packet(0x11, 0x3, 0x300) bpf$BPF_BTF_LOAD(0x12, &(0x7f00000003c0)={&(0x7f0000000540)=ANY=[@ANYBLOB="9feb010018000000000000000c0000000c000000020000000000000000000004"], 0x0, 0x26, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x20) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_generic(0x10, 0x3, 0x10) socket$netlink(0x10, 0x3, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socket$packet(0x11, 0x2, 0x300) socket(0x1, 0x803, 0x0) socket(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socketpair(0x1, 0x100000005, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) getpeername$packet(r1, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000040)=0x14) sendmmsg(r0, &(0x7f0000000440)=[{{&(0x7f0000000700)=@xdp={0x2c, 0x0, r2, 0x8000000}, 0x80, &(0x7f00000004c0)=[{&(0x7f0000000180)='O', 0x36}], 0x1}}], 0x1, 0x0) 6m27.158275261s ago: executing program 4 (id=2692): syz_init_net_socket$nfc_llcp(0x27, 0x3, 0x1) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000240)={0x11, 0x3, &(0x7f0000000180)=@framed, &(0x7f00000000c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) syz_open_dev$cec(&(0x7f0000000000), 0xffffffffffffffff, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) dup(r0) pselect6(0x40, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x2}, 0x0, &(0x7f0000000140)={0x1ff, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0xffffffffffffffff}, 0x0, 0x0) 6m27.148869062s ago: executing program 4 (id=2693): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x4, &(0x7f0000000180)=ANY=[@ANYBLOB="18010000002306000000000000030000850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x62, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000880)={&(0x7f0000000340)='sys_enter\x00', r0}, 0x4b) timer_create(0x0, 0x0, &(0x7f0000bbdffc)=0x0) timer_getoverrun(0x0) prlimit64(0x0, 0xe, 0x0, 0x0) mkdir(&(0x7f0000000040)='./file1\x00', 0x0) mount$fuse(0x0, 0x0, 0x0, 0x1a3089, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0]) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000300)={0x68, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_TYPENAME={0x12, 0x3, 'bitmap:ip,mac\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0x1c, 0x7, 0x0, 0x1, [@IPSET_ATTR_IP={0x18, 0x1, 0x0, 0x1, @IPSET_ATTR_IPADDR_IPV6={0x14, 0x2, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}}}]}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}]}, 0x68}}, 0x0) mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400)) chdir(&(0x7f0000000080)='./file1\x00') r3 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0) symlink(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000100)='./file1\x00') timer_gettime(r1, &(0x7f0000000140)) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) setpgid(r3, 0x0) setpgid(0x0, r3) mount(0x0, &(0x7f0000000300)='./file1\x00', &(0x7f0000000080)='tmpfs\x00', 0x800, 0x0) openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x42, 0x0) 6m26.942163879s ago: executing program 4 (id=2695): socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x4e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x35, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[], 0x180}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = getpid() getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) ioctl$sock_SIOCADDRT(r0, 0x890b, &(0x7f0000000400)={0x0, @vsock={0x28, 0x0, 0x2710, @my=0x0}, @phonet={0x23, 0xf, 0x7, 0x1}, @can={0x1d, r2}, 0x1010, 0x0, 0x0, 0x0, 0x3, &(0x7f00000003c0)='batadv0\x00', 0x5, 0x401, 0x9}) sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000009780)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0xb0) r5 = dup(0xffffffffffffffff) write$6lowpan_enable(r5, 0x0, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000004000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) mount$9p_fd(0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766646e6f3dfcc4764084a74429c4185bf3857e52258b9788abc4467090d7ad", @ANYRESHEX, @ANYBLOB=',\x00']) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) sendmsg$RDMA_NLDEV_CMD_DELLINK(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0xf00000000000000, 0x0, 0x671ec167a4b72164}, 0x0) ioctl$sock_ifreq(r7, 0x8922, &(0x7f00000000c0)={'batadv_slave_0\x00', @ifru_flags=0x1}) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) sendto$inet(r6, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) 6m26.614138649s ago: executing program 34 (id=2643): socket$nl_route(0x10, 0x3, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER_VALUE(0xffffffffffffffff, 0x84, 0x7c, &(0x7f0000000000)={0x0, 0x6c3, 0x9}, 0x8) setsockopt$inet_sctp6_SCTP_MAXSEG(0xffffffffffffffff, 0x84, 0xd, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, 0x0, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f0000000240)={0x26, 'hash\x00', 0x0, 0x0, 'sm3\x00'}, 0x58) r2 = accept4(r1, 0x0, 0x0, 0x0) sendmsg$kcm(r2, &(0x7f0000001880)={0x0, 0xf5, &(0x7f0000001600)=[{&(0x7f0000001a00)="e8a472", 0x3}, {&(0x7f00000000c0)="bcc9b1557de1fad1f955144629ed4dcf3c33679ea22502e3cff8923bf5d43921bc111a262f295a8eb540", 0x7fffeffd}, {&(0x7f0000001680)="094fb143daa9baa36aaa2cca06886c533118e056", 0x14}], 0x3}, 0x0) prctl$PR_SET_IO_FLUSHER(0x43, 0x1) sendmsg$kcm(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="1400000036000b63717a3c4a0ed8985b0808aa78", 0x14}], 0x1}, 0x0) 6m11.611112332s ago: executing program 35 (id=2695): socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000300)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x4e, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x35, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000540)=ANY=[], 0x180}, 0x1, 0x0, 0x0, 0x20000000}, 0x0) r1 = getpid() getsockname$packet(0xffffffffffffffff, &(0x7f0000000180)={0x11, 0x0, 0x0}, &(0x7f00000001c0)=0x14) ioctl$sock_SIOCADDRT(r0, 0x890b, &(0x7f0000000400)={0x0, @vsock={0x28, 0x0, 0x2710, @my=0x0}, @phonet={0x23, 0xf, 0x7, 0x1}, @can={0x1d, r2}, 0x1010, 0x0, 0x0, 0x0, 0x3, &(0x7f00000003c0)='batadv0\x00', 0x5, 0x401, 0x9}) sched_setscheduler(r1, 0x2, &(0x7f0000000280)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) read$FUSE(0xffffffffffffffff, &(0x7f0000009780)={0x2020}, 0x2020) write$FUSE_DIRENTPLUS(0xffffffffffffffff, 0x0, 0xb0) r5 = dup(0xffffffffffffffff) write$6lowpan_enable(r5, 0x0, 0x0) r6 = socket$inet_smc(0x2b, 0x1, 0x0) connect$inet(r6, &(0x7f0000000000)={0x2, 0x4001, @remote}, 0x10) r7 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_NEWLINK(r7, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)=ANY=[@ANYBLOB="38000000031401002cbd7000fcdbdf250900020073797a32000004000800410073697700140033006c6f"], 0x38}, 0x1, 0x0, 0x0, 0x44}, 0x810) mount$9p_fd(0x0, 0x0, 0x0, 0x0, &(0x7f0000000480)=ANY=[@ANYBLOB='trans=fd,rfdno=', @ANYRESHEX, @ANYBLOB="2c7766646e6f3dfcc4764084a74429c4185bf3857e52258b9788abc4467090d7ad", @ANYRESHEX, @ANYBLOB=',\x00']) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) sendmsg$RDMA_NLDEV_CMD_DELLINK(r7, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000100)={0x18, 0x1404, 0x1, 0x70bd2d, 0x25dfdbfe, "", [@RDMA_NLDEV_ATTR_DEV_INDEX={0x8}]}, 0x18}, 0x1, 0xf00000000000000, 0x0, 0x671ec167a4b72164}, 0x0) ioctl$sock_ifreq(r7, 0x8922, &(0x7f00000000c0)={'batadv_slave_0\x00', @ifru_flags=0x1}) setsockopt$SO_BINDTODEVICE_wg(r6, 0x1, 0x19, &(0x7f0000000080)='wg1\x00', 0x4) sendto$inet(r6, &(0x7f0000000040)="e5", 0xffffffe4, 0x0, 0x0, 0x0) 4m11.538466417s ago: executing program 3 (id=3096): r0 = bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x0) mmap(&(0x7f0000002000/0x3000)=nil, 0x3000, 0x1000001, 0x12, r0, 0x0) socket$inet6(0xa, 0x1, 0x0) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="180100"/16], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x9, 0x84}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e21}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mount$cgroup(0x0, 0x0, &(0x7f0000000040), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f00000001c0)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000200000008000300", @ANYBLOB="0c009985f2330fd547793c000800a0003a0900080500390104000000080026"], 0x40}}, 0x0) mount(&(0x7f0000000180)=@sr0, &(0x7f00000002c0)='./file0\x00', &(0x7f00000000c0)='ext3\x00', 0x4000, 0x0) 4m10.363955175s ago: executing program 3 (id=3098): sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000940)={0x0, 0x0, &(0x7f0000000080)=[{&(0x7f0000000000)="d8000000580081044e81f782db44b904021d0800090003", 0x17}], 0x1}, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r0) socket$kcm(0x10, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r0, 0x8b32, &(0x7f0000000000)={'ip6gre0\x00', @random="f757349e7240"}) 4m10.269369015s ago: executing program 3 (id=3099): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x3, 0x0, &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f0000000140)='contention_end\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) setrlimit(0x5, &(0x7f0000000200)={0x8, 0x5}) syz_open_procfs(0x0, 0x0) r2 = socket$kcm(0x10, 0x2, 0x0) r3 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000280)=@bpf_lsm={0x6, 0x3, &(0x7f00000003c0)=ANY=[@ANYBLOB="18000000003f000000000000000000"], &(0x7f0000000140)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$MAP_CREATE(0x0, 0x0, 0x0) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f0000000240)={r3, 0xf, 0x25, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x40) sendmsg$kcm(r2, &(0x7f0000000600)={0x0, 0x0, &(0x7f0000000080)}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x3, 0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r4 = syz_open_procfs(0x0, &(0x7f0000000380)='net/wireless\x00') preadv(r4, &(0x7f0000000540)=[{&(0x7f00000003c0)=""/165, 0xa5}], 0x10000000000002f1, 0x4, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x14, &(0x7f0000000200)=ANY=[@ANYBLOB="1802000000000000000000000000000018010000786c6c3a00000000070000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000080000850000002d00000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0xe) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r5, 0x29, 0x40, &(0x7f0000000640)=@raw={'raw\x00', 0x3c1, 0x3, 0x308, 0x0, 0x111, 0x4b4, 0x0, 0xd4feffff, 0x238, 0x20a, 0x278, 0x238, 0x278, 0x3, 0x0, {[{{@ipv6={@private2, @empty, [], [], 'veth1\x00', 'team_slave_0\x00', {}, {}, 0x6, 0x0, 0x0, 0x22}, 0x0, 0x118, 0x140, 0x0, {}, [@inet=@rpfilter={{0x28}}, @common=@hbh={{0x48}, {0x5, 0x1, 0x1, [0x3, 0xfffb, 0xd27f, 0xb, 0x8000, 0x7, 0x8, 0x200, 0x8000, 0xffff, 0xfff9, 0x6, 0x2, 0x5, 0xa37, 0x9], 0xd}}]}, @common=@inet=@TCPMSS={0x28, 'TCPMSS\x00', 0x0, {0xffff}}}, {{@uncond, 0x0, 0xd0, 0xf8, 0x0, {}, [@inet=@rpfilter={{0x28}, {0x4}}]}, @common=@inet=@SYNPROXY={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x368) r6 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_int(r6, 0x29, 0x31, 0x0, 0x0) mbind(&(0x7f0000001000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0, 0x2) 4m9.822214458s ago: executing program 3 (id=3101): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) syz_usb_connect(0x0, 0x2d, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000050cb5340450c10108e492940a80909021b00090000000009040002010035040009058dff86"], 0x0) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r1, 0x0, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000280)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='.\x00', &(0x7f0000000200)='./file0/../file0\x00', 0x0, 0x101091, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) mount$bind(&(0x7f0000000100)='./file0/../file0\x00', &(0x7f00000000c0)='./file0/file0\x00', 0x0, 0x8b101a, 0x0) mount$bind(0x0, &(0x7f0000000240)='./file0/file0\x00', 0x0, 0x80000, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) ioctl$TUNSETIFINDEX(r3, 0x400454da, 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000080)='./file0/../file0\x00', 0x0, 0x2125099, 0x0) r4 = syz_open_procfs(0x0, &(0x7f00000000c0)='mountinfo\x00') sendfile(r4, r4, &(0x7f0000000000)=0x2eb4, 0x2000007ff) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r5 = fcntl$dupfd(r2, 0x0, r0) write$RDMA_USER_CM_CMD_LEAVE_MCAST(r5, &(0x7f0000000200)={0x11, 0x10, 0xfa00, {0x0}}, 0x18) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(r7, 0x6, 0x1d, &(0x7f0000000280)={0x4, 0x0, 0x0, 0x5, 0x6f}, 0x14) r8 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f00000004c0)="d8000000180081064e81f782db4cb904021d0800fd007c05e8fe50a10a000600014002020c600e41b0000900ac000a0501000000160012000a00ff120048035c3b61c1d67f6f94007134cf6efb8007a007a290457f01a7cee4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5ae24e25ccca9e00360db79826835d3a71d95667daffffffffff1f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5b7276505de6ccd40dd6e4edef3d93452a92954b43370e9703920723f9000001008af26c8b7b55f4d2a6823a45", 0xd8}], 0x1}, 0x0) r9 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000140), r6) syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) openat$cgroup_ro(r5, &(0x7f0000000080)='blkio.bfq.time\x00', 0x0, 0x0) sendmsg$ETHTOOL_MSG_FEATURES_SET(r5, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000240)={0xe4, r9, 0x1, 0x0, 0xffffffff, {}, [@ETHTOOL_A_FEATURES_WANTED={0xcc, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_MASK={0xc8, 0x5, "3b5ff66c25806fe3019a7264d0a52f80e27deecf0bfbed75039d7e013358b874776d7489fb2ec9c2d0991e20e0d1d7e1225c71596d83d6bf80792f629fb0f889a39192af0ffa338966c63c42a8dbb5f2f75d9aaf9efe2cecd5869cd25b1046de2860e5972aa2519018f3f103a4aaa6554b93738d600925a030c4eb0b3a4e7757e1c55d7f41e008b8b4b087e0bbc77e3961410c4eb5e7e7e8ac91270182a15ab5314cbddf7a53cabd24be62a1af6321c074ff5d603e68891ad41196740a7940cbdce324f0"}]}, @ETHTOOL_A_FEATURES_WANTED={0x4}]}, 0xe4}}, 0x40804) 4m4.598249939s ago: executing program 3 (id=3114): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x11, 0x2e, &(0x7f0000000500)=ANY=[@ANYBLOB="180000000200000000000000900a000018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000180018110000", @ANYRES32=0x1, @ANYBLOB="0000000000000000b7080000010000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000020000008500000082000000851000000400000007a8f4ff0800000018350000050000000000000000000000180100002020752500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000040000008500000006000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000060000008500000006000000bf91000000000000b7020000010000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000340)='GPL\x00', 0x2, 0xb1, &(0x7f0000000680)=""/177, 0x41000, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000380)={0x3, 0x1}, 0x8, 0x10, &(0x7f00000003c0)={0x5, 0x1, 0x4, 0x5}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000740)=[0xffffffffffffffff, 0x1, 0xffffffffffffffff, 0x1, 0xffffffffffffffff], 0x0, 0x10, 0x9, @void, @value}, 0x94) r1 = openat$cgroup(0xffffffffffffffff, &(0x7f0000000780)='syz1\x00', 0x200002, 0x0) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000900)={r0, r1, 0x19, 0x0, @void}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r2 = openat$ptp0(0xffffffffffffff9c, &(0x7f0000000080), 0x1a3302, 0x0) ioctl$PTP_ENABLE_PPS(r2, 0x40043d04, 0x0) madvise(&(0x7f0000c00000/0x400000)=nil, 0x400000, 0xe) r3 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r3, 0x3b81, &(0x7f0000000040)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r3, 0x3ba0, &(0x7f00000007c0)={0x52, 0x2, r4}) ioctl$IOMMU_IOAS_MAP$PAGES(r3, 0x3b85, &(0x7f0000000000)={0x28, 0x6, r4, 0x0, &(0x7f0000c00000/0x400000)=nil, 0x400000, 0x51e}) syz_clone(0x25000000, 0x0, 0x0, 0x0, 0x0, 0x0) 4m4.127450943s ago: executing program 3 (id=3117): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x101301) ioctl$USBDEVFS_ALLOC_STREAMS(r0, 0x8008551c, &(0x7f0000000000)={0xd616, 0x1, [{0x1, 0x1}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000002600000000c0a010300000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800600010063"], 0xe4}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r2) sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010029bd700002000000000000b9212d02c227a8000800f253a90cf046ce2101483bb40200020000000852314874ef3882f04c26420f58755c78cffc8e52963b5bfc99e314e3aa0b3cc47a60af7535b78277182515881de88e57c4c5d41a882a33f10911d4ce485c441b7c64f29be85efdc826c300d69dabe094a10b9e1c0ee382abebb982e2a209cd3c9767f7f02f038d86f17c425ca9a19cdd4626bf8d24d88a2a5ded5489770c"], 0x24}, 0x1, 0x0, 0x0, 0x24000801}, 0x4040054) 4m3.017588999s ago: executing program 36 (id=3117): r0 = syz_open_dev$usbfs(&(0x7f0000000080), 0x76, 0x101301) ioctl$USBDEVFS_ALLOC_STREAMS(r0, 0x8008551c, &(0x7f0000000000)={0xd616, 0x1, [{0x1, 0x1}]}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000003c000000090a010400000000000000000100000008000a40000000000900020073797a32000000000900010073797a30000000000800054000000002600000000c0a010300000000000000000100000008000440000000000900010073797a300000000038000380340000800400018004000680140007800c000100636f756e7465720004000280140001800600010063"], 0xe4}}, 0x0) r2 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x0) r3 = syz_genetlink_get_family_id$netlbl_calipso(&(0x7f0000000140), r2) sendmsg$NLBL_CALIPSO_C_ADD(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000180)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="010029bd700002000000000000b9212d02c227a8000800f253a90cf046ce2101483bb40200020000000852314874ef3882f04c26420f58755c78cffc8e52963b5bfc99e314e3aa0b3cc47a60af7535b78277182515881de88e57c4c5d41a882a33f10911d4ce485c441b7c64f29be85efdc826c300d69dabe094a10b9e1c0ee382abebb982e2a209cd3c9767f7f02f038d86f17c425ca9a19cdd4626bf8d24d88a2a5ded5489770c"], 0x24}, 0x1, 0x0, 0x0, 0x24000801}, 0x4040054) 9.982867932s ago: executing program 5 (id=3845): r0 = socket$inet6_sctp(0xa, 0x5, 0x84) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = getpid() r2 = socket$inet6_tcp(0xa, 0x1, 0x0) close(r2) r3 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r2, &(0x7f0000000000)={0xa, 0x4e22, 0x0, @mcast1, 0xb}, 0x1c) listen(r2, 0x0) syz_emit_ethernet(0x5a, &(0x7f00000000c0)=ANY=[@ANYBLOB="aaaaaaaa0600fe8000000000000000000011000000aafe8000000000000000000000000000aa0000000086039808fdacdef6b0088175fa0f01ca424d721074d6b1aff5216dce", @ANYRES32=0x41424344, @ANYRES32=0x41424344, @ANYBLOB="90c20000907810001e10296db90000000000000001000000"], 0x0) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000003080)=[{{&(0x7f0000002200)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e, &(0x7f00000025c0)=[{&(0x7f0000002640)="45914eff8a403c5fab06cbd3344b0abbefc6db6bab94ab672d2186d55f2391447d2e867cb1c13936fd65751eedecf8fdbac6439a776b6bd10c8afacd6345259e98a131d8fc44652431118160a7f43a5809b66e9cfa35c7674f0cf2ed6990933046f4f239c97979b13fcdb4a73dea84f9f188ea9f11867ad1c0d0aa337ef43e65c42cf52878438773fd38e3375d425fd8ddeebfd35d27ae07fc031f226a10afc4a3ee7e1a392f3106f5bf84043cea3c3eb5a11cb6c6", 0x83}, {&(0x7f0000002280)="af8f1922383a17097e14fd6f25ccd3793b628eed35ea1648d2cc3f2115b9c8bcbc764aaa31395e09391fec3bf3d29f9cf06a508d22e66e36e04f2b206b1b3881ddefb6cf57a44b607d27b1b12056ba69a8ee37932dcce196bb70aef268758b9852d2422ae2093b98342c4e51c86b66a3b21296", 0x73}, {&(0x7f0000002400)="a6ea08640f83537d13aa2c2e1256fccbc507b237d06959e57fa7a6816e27023b5d28e5766cc69b1cc14564dfc1add961ff8912c5efbbb46cccd034ab5e037e319192d444a89068e5319a04bb25016cd21c4c96724442383b0efa9f4494080343", 0x60}, {&(0x7f0000002480)="060388da31c8e126eadf13925528843450452eba2473dfe50ff0cbbd16f05ddb74d7cc8e4025019d70ac331606a4a9b4561d18d0962b2fc4bc4c43d08d77f934fbb771a01630ceb551c856da7b1ad03f55b140f5086e26dc8a5b14d41edc924fe20e867b82a21d69117661ebbf4e17c1332cd556303afacd5ff9487ebfc39c6930fecc11f7", 0x85}, {&(0x7f0000002540)="d2bdee2f24c4b3637e449d199f1d0a9042cc2719e2cf4d2a67e338a71692576c4f0a021f4fb1eecc747546a331106efddcc1985994d4c3b3912e8172da5b7ab6a74bb074754cd2ff972561e709ea5e32974bb45326ed43ba3fb7c87986", 0x5d}], 0x5, &(0x7f00000028c0)=[@rights={{0x34, 0x1, 0x1, [r5, r2, r2, r4, r0, r4, r4, r3, r5]}}, @rights={{0x18}}, @cred={{0x1c, 0x1, 0x2, {r1}}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r5, r2]}}, @rights={{0x24, 0x1, 0x1, [r3, r5, r3, r3, r0]}}, @rights={{0x14, 0x1, 0x1, [r3]}}, @cred={{0x1c, 0x1, 0x2, {r1}}}, @rights={{0x1c, 0x1, 0x1, [r5, r4, 0xffffffffffffffff]}}], 0x110, 0x40c0}}, {{&(0x7f0000002a00)=@abs={0x1, 0x0, 0x4e23}, 0x6e, &(0x7f0000002c40)=[{&(0x7f0000002a80)="86923df795e062dcb2ee5eb3ac183da5f551ea64434fd72c430368ee3a787c550b0842ad898ed773a13d3174c22ebe8fbe227008917f33df2ab844dcaa8252b9cea0ca7640dedaa8fae2d7b4306d6cdc022ab5a1455d78c26a22cdc7714c9b39617443523a68fbb4cb2a530a01e5c7e97b8b7fb96d3238773c1a5874e6f2967c3dd72d0326a200989fb04cf8ab67", 0x24}, {&(0x7f0000002b40)="e23d8d90308affc67ad6e7fed01165a207b854c68b57d67c72e11519f00f6dc840fd46b404daee9e6724aebed54cedb17303a9e924f6e867a40cbb25121c171bef75f4a9aef696f868a6d62a52bffb8ffd3d69d8413bc8b4262ad4429b6ff316abed31e39662c4083764ddefc01c3d0a3bea7b9c1f59ac631b94381ec7ec37a547c56acceb109cd77f4d57fb2ad800425e82e930544675d6a1d626dc6a9d40096e87874aa32df47d317ffd9cdb108ddce98954403896c53797084edecad204a79a153fbce310", 0xc6}], 0x2, 0x0, 0x0, 0x8000}}, {{&(0x7f0000002c80)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e, &(0x7f0000000180)=[{&(0x7f0000002d00)="e6c2e70c600b68b32272e513fdc19fbf540bb52d36cb3681e7b93fa9829bd666f9d62fe2a494b85fbbf3b741428abd98c263f19b97be4121d2f3074b20c52047da09a132877c8533b9111d4ac5c6ed7b02e3882792f27b116070c09bb44a9813a8804fd70b093dc4502aa2793a4e0762258c68e1633c6d", 0x77}, {&(0x7f0000002d80)="d1274c5d73a4cdca41ade03bee8fe6dc87c0ea2b888f87df7ba1173236e85e55e4d9c6297c12ec14b4cbdb57803260856048720d904e913926567cd9a4ca36b5b3866166cf897fc1a042f3c5220ec93ab64fe28d9619b5af09d8891127e1a08589ceff0d6cfafd53fb9549ff2d2b4b7e4848f954e57bc7585896", 0x7a}], 0x2, &(0x7f0000002f80)=[@rights={{0x2c, 0x1, 0x1, [r2, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0]}}, @rights={{0x28, 0x1, 0x1, [r3, 0xffffffffffffffff, 0xffffffffffffffff, r5, 0xffffffffffffffff, r4]}}, @rights={{0x2c, 0x1, 0x1, [r4, 0xffffffffffffffff, 0xffffffffffffffff, r5, r0, 0xffffffffffffffff, r0]}}, @rights={{0x1c, 0x1, 0x1, [r3, r0, r2]}}, @cred={{0x1c, 0x1, 0x2, {r1}}}, @rights={{0x30, 0x1, 0x1, [r2, 0xffffffffffffffff, 0xffffffffffffffff, r3, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, r0]}}], 0xf8, 0x4000000}}], 0x3, 0x0) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) bind$netlink(r6, &(0x7f0000000200)={0x10, 0x0, 0x0, 0x80065c9}, 0xc) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000780)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01040000000000000000010000000900010073797a3100000000e8010000030a01020000000000000000010000000900030073797a3200000000280004800800024000000000080001400000000514000300626174616476300000000000000000000900010073797a31000000000900010073797a3100000000340008800c00024000000000000080010c00024000000000000000040c00014000000000000000000c00014000000000000000014c000480080002404c82f47c080001400000000008000140000000010800014000000003080002404f32945f080001400000000308000140000000020800024019885f270800014000000003fd000c00a03ac330bf11a2145946e6d945deece8485ee69dbc29a8dd5dbce127f829a3adf5c4171b4bedbbc9b913a67b9ee679020f0200000064419faae0136b893d91d95b1174f115798a1abfdc06983fb83f2116a85a00dd35cdf9d8f81683e5e2ebcca132a712e0be44c12c02ac92fbbb86ed717ce0cbd6a0134f899e23ca6d2f063d26be86555cc0e9c7a25d77e6c0f4217794be96b5d797e3116d874c3adfb096e0567ec28bd1e4d8d6713109695f1f3a877d89d20e19304501aeb851d14c4f9b2d769d554fe5308810d19bb040c1977bce50b894f2c45a1f0e80c8256b6dcb072f9d91d94a67bba9f62eb2f192fa4b3786d9a774b99aa332dfbb000000080007006e6174002c000000050a01020000000000000000010020000c00024000000000000000010900010073797a310000000014000000110001"], 0x25c}}, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r8 = syz_open_procfs(0x0, &(0x7f0000000080)='net/igmp\x00') read$FUSE(r8, &(0x7f00000001c0)={0x2020}, 0x2020) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r0, 0x84, 0x9, &(0x7f00000001c0)={0x0, @in={{0x2, 0x0, @empty}}, 0x0, 0x0, 0x0, 0x0, 0x90}, 0x9c) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) r9 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x60240) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) chdir(&(0x7f0000002300)='./file0\x00') stat(&(0x7f0000000700)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(r9, 0xc0a85320, &(0x7f0000001400)={{0x80}, 'port1\x00', 0xe3, 0x1b1c07}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000000), 0x4b7f, 0x0) 9.002220715s ago: executing program 5 (id=3850): r0 = syz_open_dev$vbi(&(0x7f0000000b80), 0x2, 0x2) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000004b00)={0x4, @pix_mp={0x86f9, 0xffffc000, 0x56555959, 0x0, 0x9, [{0x1, 0x3}, {0xfffffffb, 0x3399}, {0xfff, 0x6}, {0x2, 0x5}, {0x7, 0x80000001}, {0x1, 0x6}, {0x40008000, 0xfffffff9}, {0x800, 0x200}], 0xfd, 0x0, 0x2, 0x0, 0x4}}) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() bpf$PROG_LOAD(0x5, &(0x7f0000000640)={0x19, 0x4, &(0x7f0000000000)=ANY=[@ANYBLOB="18000000000000000000000000000000611214000000000095"], &(0x7f0000000600)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) r3 = syz_usb_connect$hid(0x0, 0x0, 0x0, 0x0) syz_open_procfs(r2, &(0x7f0000000040)='net/ip_tables_matches\x00') syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f0000000000)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x58, 0x16, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x2c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}, @NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}, @NFT_MSG_DELFLOWTABLE={0x48, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}], {0x14, 0x10}}, 0xe8}}, 0x0) 7.694426942s ago: executing program 7 (id=3854): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-twofish-3way\x00'}, 0x58) sendmsg$netlink(0xffffffffffffffff, &(0x7f0000000340), 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r1 = accept4(r0, 0x0, 0x0, 0x80800) sendmsg$nl_crypto(0xffffffffffffffff, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8a}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x8000002000000, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, 0x0) write$sndseq(r3, 0x0, 0x0) sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0x4d}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3}], 0x1, 0x40800) recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2, 0x0, 0x0, 0x2b010000}, 0x0) 6.422040551s ago: executing program 9 (id=3860): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000100)={&(0x7f0000000640)={{0xeb9f, 0x1, 0x0, 0x18, 0xef, 0x34, 0x34, 0x6, [@typedef={0x4, 0x0, 0x0, 0x7}, @int={0x0, 0x0, 0x0, 0x1, 0x5, 0x0, 0x0, 0x8, 0x4}, @union={0x0, 0x1, 0x0, 0x5, 0x0, 0x4, [{0x0, 0x2}]}]}, {0x0, [0x0, 0x0, 0x0, 0xda]}}, 0x0, 0x52, 0x0, 0x4, 0x7, 0x0, @void, @value}, 0x28) 6.338235631s ago: executing program 0 (id=3861): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0xfffffffffffffffd, &(0x7f0000000280)) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) openat$procfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0xa, 0x8d}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = creat(0x0, 0x10) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, 0x0) ioctl$VIDIOC_G_EXT_CTRLS(r2, 0xc0205647, &(0x7f00000001c0)={0x0, 0x8bc, 0x10001, 0xffffffffffffffff, 0x0, &(0x7f0000000180)={0x9b0907, 0x2, '\x00', @value64=0x4}}) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=@newlink={0x50, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x5b5d}, [@IFLA_AF_SPEC={0x1c, 0x1a, 0x0, 0x1, [@AF_INET6={0x18, 0xa, 0x0, 0x1, [@IFLA_INET6_TOKEN={0x14, 0x7, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}]}]}, @IFLA_ALT_IFNAME={0x14, 0x35, 'batadv0\x00'}]}, 0x50}, 0x1, 0x300}, 0x0) 5.794996179s ago: executing program 5 (id=3862): r0 = syz_open_dev$vbi(&(0x7f0000000b80), 0x2, 0x2) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000004b00)={0x4, @pix_mp={0x86f9, 0xffffc000, 0x56555959, 0x0, 0x9, [{0x1, 0x3}, {0xfffffffb, 0x3399}, {0xfff, 0x6}, {0x2, 0x5}, {0x7, 0x80000001}, {0x1, 0x6}, {0x40008000, 0xfffffff9}, {0x800, 0x200}], 0xfd, 0x0, 0x2, 0x0, 0x4}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc20e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xb}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000000)={0x81, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0xb, {[@main=@item_012={0x0, 0x0, 0xa, "02"}, @global=@item_012={0x0, 0x1, 0x3}, @global=@item_4={0x3, 0x1, 0xa, "a27dd0e2"}]}}, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x48, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}], {0x14, 0x10}}, 0xd0}}, 0x0) 5.659370924s ago: executing program 9 (id=3863): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000f40)=ANY=[@ANYBLOB="12010000dc3f6e4013080100083a000000010902120001000000000904"], 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) 5.568704762s ago: executing program 0 (id=3864): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) write$qrtrtun(r0, &(0x7f0000000300)="ca0e808bb35bdabb", 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], &(0x7f0000000240)=[0x2], 0x0, 0x1}}, 0x40) 5.419391806s ago: executing program 0 (id=3865): io_setup(0x7, &(0x7f0000000280)=0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x92, 0xdf, 0x55, 0x10, 0x5ac, 0x9226, 0xb289, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0x3, 0xe9}}]}}]}}, 0x0) syz_usb_control_io(r1, &(0x7f0000000100)={0x2c, &(0x7f00000002c0)={0x40, 0x22, 0xfe, {0xfe, 0xf, "3b2c6b45c4d96cbe47fa42f7f6082f22c51061886a21b8250a7f06fbc0c5695a34140b41a54b33aab603f0e801d202bafadb31d29309868a0e06e97f4e59bcfecec1cce16f9afe33d3ea85743f2166054c829952ef08c7cea4ae629584a955ea6fb686130ed8ef64e51009923fb5881c6c706f26ed1c27388669221a76d537759bb7a8ca3142963f633eeb38a8ac621eca293e7584c5b1e00786082151114a7769f0249ee81efeab13d865c79b825b52a610dbd7116a101fb67e495f233646c7995344447a24da19db9dc4b08a24aee5257838d56d497d4413aa1eec5e323e5c6dc24c222e00766c6ef2a8669532c0a169345129e9517496251ef11f"}}, &(0x7f0000000400)={0x0, 0x3, 0xf5, @string={0xf5, 0x3, "b1dd3dbb886223642d9f12340e0168afcf5966659c4d3675897a9acd5ea2f8409cf8aefcedc2d8bc784c46ceabe74d8d2668a7f09ae44b0f6ff51d3e56346ba92c0febb57749e4bbf0b0ee6ab85b9315944f8b67e6ea44bb28425ea741af1bda9e32f10be09200d113eed514a628ca65f98b28de383be6da1aa932fb593d7bf7e15458c23d8ef0521985c3bb7ae54d36c0b184bdc259d2e22a1ddd8827da09430dec37839d8e0ca3ccde54889df498ed52c0dbc2be8347143bbc626db4e0b7169655c0398e73aa8c512282c5c19c81dcb9d06ecd3cc870e1d8f041c6449e02dfbd065f9eb6fd8b7c57502f60809db1dc08a3b1"}}, &(0x7f0000000540)={0x0, 0xf, 0x22c, {0x5, 0xf, 0x22c, 0x6, [@ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0xb8, 0xf, 0x7}, @ss_cap={0xa, 0x10, 0x3, 0x2, 0x0, 0x6, 0x7f, 0x1}, @ss_container_id={0x14, 0x10, 0x4, 0x9, "6033fd9907bea97838f131bc190b60a0"}, @ssp_cap={0x20, 0x10, 0xa, 0x89, 0x5, 0x0, 0x0, 0xfff, [0x3f00, 0xff00, 0xc00f, 0xc0, 0xc0]}, @generic={0xe1, 0x10, 0x4, "dd60dc3f4a6c33bb056162fede88634f7465ceb3b22268571ecdfb18f5d14c2785bc43dd61c6f914af6b9958fd373739858301b0647c2baecc1199ed2963682b1d338b244f9605118478a140abf706a100a78cd0a2cf792d2c0ed5ff2b99a39e1fb01eda6f7e28ce555e0eea455b969bb5abcbd45f6d6c9adca10ef17e0daeed3bcc91beaa8896b5d23460cbd5d0981f574438753f3299b5ae071408f1d35e8497a726c090bd1268e60525f452a09b4be5fc65009b1596e9b81e94afb2a4dc6619e73fb0b20a1bbbb899ed9709cfa31024e9238bd59cc215cb1ddd5a82cb"}, @generic={0xfe, 0x10, 0x2, "f261dfe741013969bd6466146860ab2c838ca72b038d790a8e495f8e090709ffb15500c5469dad0a06c5bece6bbcd24a3d46a9db750926a8ed5ddb9d4407ef99fc830150c9555571c82e7cde7f816b5218129a7226133d4a6df8ea0a41c40a375f56cba99ac0c832a7761855b629b35c39d1f0d9003f3544e55961dc694a53eae4b4e98e7b8adfe2af3af3e0eaac4d1a0b7af1d723d086c7384f6b2479089ccf4e458b1e67538f80ed6cf49a6a47bc3504ed050195e06986aca1c209e85cdb93f9e0f02bd75b057e18379106068533e0c911539a05b8f19a10029c9580b992982e876d85edbc3826a8d38a8f148333bdbe62bd513061c265dac51b"}]}}, &(0x7f0000000000)={0x20, 0x29, 0xf, {0xf, 0x29, 0x7, 0x80, 0x8, 0x7, "d86a8a48", "717b0edf"}}, &(0x7f0000000080)={0x20, 0x2a, 0xc, {0xc, 0x2a, 0x8, 0x0, 0x3, 0x3, 0xe3, 0x7, 0xfe01}}}, &(0x7f0000000b00)={0x84, &(0x7f0000000780)={0x0, 0x1, 0x7e, "e183c786ac55c7698dc8f1e16541c749074955ab6e909d8cf15a709a0b28fcba38f5c6f527a889ecf0be84d6f4950196e6173f3252d7dfc8989459bf308f1c6dbc410282e5a7715b2c0a35f736bd4b72462fbae58a302007be01bed36dd5de84c87e1a56240c91b6f8ac0a9f7fbfbadec1478965a74240d76f28ad484ed9"}, &(0x7f0000000140)={0x0, 0xa, 0x1, 0xfb}, &(0x7f0000000180)={0x0, 0x8, 0x1, 0xf9}, &(0x7f0000000200)={0x20, 0x0, 0x4, {0x1, 0x1}}, &(0x7f0000000240)={0x20, 0x0, 0x8, {0x21, 0x40, [0x7700]}}, &(0x7f0000000840)={0x40, 0x7, 0x2, 0xfe00}, &(0x7f0000000880)={0x40, 0x9, 0x1, 0x4}, &(0x7f00000008c0)={0x40, 0xb, 0x2, "39dd"}, &(0x7f0000000900)={0x40, 0xf, 0x2, 0x7}, &(0x7f0000000940)={0x40, 0x13, 0x6, @random="e8702852ffad"}, &(0x7f0000000980)={0x40, 0x17, 0x6}, &(0x7f00000009c0)={0x40, 0x19, 0x2, "f663"}, &(0x7f0000000a00)={0x40, 0x1a, 0x2, 0x3ff}, &(0x7f0000000a40)={0x40, 0x1c, 0x1, 0x7}, &(0x7f0000000a80)={0x40, 0x1e, 0x1, 0x4}, &(0x7f0000000ac0)={0x40, 0x21, 0x1, 0x8}}) r2 = openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/power/wakeup_count', 0x42, 0x0) io_submit(r0, 0x1, &(0x7f0000000500)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x1, 0x0, r2, &(0x7f00000001c0)='7', 0x1, 0x4}]) 5.312764898s ago: executing program 7 (id=3866): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) socket$tipc(0x1e, 0x2, 0x0) syz_emit_ethernet(0x11ab, &(0x7f0000000c40)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa08004a74119d00670000002f9078ac1414aaac141432820e7b7c05d0e3bc52c922c171768923fdac1414aaffffffffac141426ac1414bbac1414bb00000000e0000001ac1414aa00890bdf0a010102ffffffff44244a800000000800000006000000060000057600000000fffff800000000050000000d4424ac910a01010000000006ac1e0001ffffffffac1414aa000000cb0a010100fffff7e0890f237f000001ffffffffac1e01010421880b00790003f7b1564728be7df697935316f0fe9cdf07b84488d2a6e46834e0f2b6c59e25ba759148378c2faf71b610512aea7360b1d3d6221df1efbbf717acc94c95cca8dde32b43904dea5d2a93476ccd6fd5c77cbc3edfb83702fce48ae2d52dd968f03b1f35f1f984041375cd8cd40234b832015f90602af46a172c730000080000060001917fdd8e868a601b95359b39e9581f26b3970583bfe7bf8144f84c0431b76c0975bfb651abbe241f624188ca24272237258f3da25d0a14e560d5b68570acd314afc1f85aa979ab0e6d941c7954386be3ee91baf0372e4d9e7754425dce58ee6f1ad3011c4b13e0548cfa7b3c6391cf39559456f72367685353adc8626ddcf540a64a475a6f17225a35be7f36aa7c5a96fcc3135267101529605a1b19da19ecbd2dfe708684b8fc55d18f67df1d269b68f30039e176ea88238dbfb016cf744135ecca43a389dbf47c647afb49644c44b64a4ea927529446cb0bb4e9e1f94a2eec5e1add4b7028a27a0435e734ae072f741d7cbe8cd89dea406fdc4474cc809699bc1aa8f9625fbb930c504d62c843ec219bc1d83fe83ec436a232df2fb5f7616ee31573990846cbef63053847b0916bd53cb323f5133e4d38fff5a8d8290974bd76155d2d116ad6fb1ce6a41b8a45a3c4df072fb69c76c9c447a5b44a2f02fedca32cf1ab6df9397388999ff776d5d20da042415d30a1697a06bf17d31ea53897aab20c54b4d14e3906b9cde1ec10afb77dd5ca13191ef6e6c5f7546dacc23edcdcb06d301720291cbeb603c4c3233c9275f0f010e47840c76da702e46f13f5b4d134c9ceaf10f945f9a7942a0d81ca885daa48393b1c2f0b6d6316da511c91cd88f032125b3387fd90a9daa4568a9265798dc94e018179cd657796980884294d650c38b5a4856736d63b842158f8c426e7a777d38caacb8902e117c91e0723a5589dbebcc9ca13f20f0b231a4eebe85bf3e828e867951bcd241b383aa740f296caa7ca506902b33d13672f2ddb3c5b90bba6e0a08ce8a362d5af175a1089f43444bc95b540fc925ef9e2df9da24e28b273a8afb1932d7a7e6bd59dd1afe3de48cc5793ec1c55c0cbbc8f893cfb40dd5d27e854695fc8b7af0ebd3e3e8dbf255e787630748dc42d637ae170a9a618a62c6d97a0a45e65bfa1710013d21db2925666770c3b24c4cccdc2e9e465753f4c4a49272cec3518634df3c20a020603c171d2a505b7515d7764caec99c157acb38e909c429a22715de757abc3b5bd4348c063e9144e07fed74a5dcc56b3bfa3ed1c4d9feeafa02da8f5f5875254969a2db0f02a4a00af81263003fd2b7c1663bd6df401c5105110951fa7f9ec1c647dd84675d0339811090f1f030c4fe741d7b410138834a3ed5343231957dcfbae72d618ab649f43ff487bb0b22212df9dfdaa8ff61cfc7df405323491d912959504bd0bc7e642b8f85f1ddd84a41d4e631ab91bfbf04ca72b698dbfc06468b24570fe5473841666d435c4d395b2d9c98430830466a82ccceb568974092e2b9faba5f449595f420e9e98d9483a11f88aa7f0bf3398a7d53ddc8d3fd38cd9bd020badd6f7fd567ce1be84516a06c0a3f712b6ba3f469db81fd647443d5c1f5a46839588903efdcc5aba4c8e1b9e5b7087d8f9d6bdb054faf8c748c644f25fb0c5c6b458be51176e9ebf9972a29c8ab15fd560228b5b3864851dde8d949319d87d98a730465e27132044d80d26c9819d43a6f7e251d43f1f341a8ad7749799a5576b6a241a1c4c3ed829558a195e9e7934f47298bdbf22372cedcbd17e91caec30e7c0a2022db4d8c64808f74140b4f361807e60b1f3efcfa94e132d42f9bddec48e55b184c2c640b6aadea6a126ef9244efa001bafb5325a24f78979983ac0ce9527865c8c1fb5e6dc87db58357e9ccceeed45768f20811d53c1917451ed8e3a76e86388c8a2c94f1929c58fb621616b843e90afedf51c0dcaa75335f2745ff31b6381433b5761145e403abbe1eccc9005e2ac1f627dfa22bc07aeeff1cb22d8d396b503c35bc8f1ebd9316882ed6c5260513ffa2e67e04a3b623e66564a78cb86396d1f53161f0b6e2954258802dda2f294c35c1e3a0c13692a1c065d28c375a86eeb8463be88e2733f1d53541ed4d64fb598772ba0bfbde06d24a80a0b0f20fce212388e80923e6ae14fbd47bbd460294a42e9604f2c52ad6de279e3b2cd158de59c5d6822788e0b35e33304e49a41f9b4365c40cf66a2e0aed02c0f802eb40b6c5b8ac1e9a9624eacb284abb958caae7fc085be4be795272fbb1465c697e62d3ace01f4f35c1093459f79ce93b2646c227a1347dd6d3bf5b205c1860cac85b29423e7e83f5b894116e48c911000f83623a3d7adbe142fc9c6d78b5ed4a6c75a553731a5569ed41c399c22811153dd57ef99ee8e40bfa6cacfd67a261ebd9d0d3dc0afcf9635fc228088ded26089e9f6e1ed51892ea80c6fd26d29e77db735ec5b1dc74beaffb7b8320bd5fc0421310545dac689a36e15570f936c794f2b314195418d88928aaba787874e70a5110c770f1ad7fc14d8f40c53ba88eed543adfaac4ea8cbd17120902e404f020d8707750c0ab9a15a25ba26b8bd2cacaf3a01089c05e82114bcf93849506615e7237dfb24e8278ce56c784f0bb49ba15a8c5736b89ff3510bd84c15b693df2fb4fcaffe0335dd40f1edf0f1d619bf059c7ffb59c74ac64fbbd8d7d9e02c18308f20eb8fc2bfc39d1a898080da907cb761eea61fcc702fe763a4e0b7951f0cf9fba195a49fdbb6623663f2a5adbdee000f4bdab5bb685281479fc8c0904f9cab877a41cbadedae94eb93f0a385b67b533263955d783528b8fa43064c9a9e5f16b41dbd28887a7045361dbbbf67120d911eed04c7ca499e2252a549fe98681649e5a18b82718f7ff578ecc60de5fded98e9709745e42e6dee0b10372d6079428bcc883632ce086cd2d7e4ea5abc34ad67c5733f7660807e682a4c98f9440c014b818589c691032188e0c29d566ce15a61151820601d6d76b82f13d7598eb90c5775baa591899200327d5e75b9f8208781ecca8a959a509dffb97ff936d5192ea39fee69bf80239b85a65ec976aa1c2ba86f332c57db5d71ad468cd82d335f3c36003c8d15e0423e7bdef8cc1062b984d391d1cec072a1c0a9ce57074845277c71c273a80d3fdea03ffe83957ac651d5a9581d3cd5ef85c5edf064e5178802579b642a99c9014fe2e6cd2a0ccd2425fd33bd7b68125fca2fd6e41a29f54b89931ef4ec44e461b8d7eed1f96019d5029e34f772aec953215f062b751f4686c4d05e22d367892345b79c860770199a9a60b042f2649150955447d28fad1c568220b18906887541370a11c64f93a88ca0755076c2c71f182e9bc4038c7a24edab620f72218f3f8ae5598b8113202b1407a7e19b13b551e0226de1b3adfea40a37328508f44f869043f1f81573a6a1e401c5dddda0e6f5b56854a042af9702c7102212dbdd3e513002da6719becbd3e1df0096b2676335b5d3933a441b0e82a431d939d041dfd1f64fe2b297bf48ed62042d18e1bdcd7f47f62e5c08d66d8596de8254ca33ad0f85b312e06770f5bfa7f4c9b97a0a3a66393137468bbdd1a1ec311fe8d5432007ee063c564ae6bfd7a33999a25acfa2005cc44a2f7eaab9f05961ae25bf394e5cb6f1b63aaa2c1894fd021802b1b830efbe4bfea1df8c541aa7f9a124ddf01afd0bd0da8a659e4f142e54234f9e9dde42ceef596cb7104e2c00a2ea5af2025548ae881414b0c99a6012cb445b701967735df8d354abb84090a456936469d156736a4d0535d69df8bad8a7af0808386aa0071ebc2c34be6ceabdf55d475367778808e6e13562eff5f3f42171372afc4d4bceb6baf98ae1184a9cfe3676516808ecd7b6161098c9d506a32bb3c6045ad76a32944fac3290f62df690a7ccf75b7d4d92d38bd4bad24d0791c286e197f69b785d0750696d3fae391ee43ad9e5f7102aa877ad164f57de346b6104b1baa41392a9bebffabd422ef4ff1fab5c1602cce1defcf438a3142580423f0af642ec1f2dd27cdfb6af8f3390a7549d7c2d5b81323f9122cbcbec597830952d6e9036127ac72ba7bea48f838aadc173283bd3723ffba6ce3b56173a133eaed7e1dda0cba869fd9e4f89c0002124f329672ee7929ab91595696c2bc1db2b1516d666de72a708be94e7c583ba5f4d0959380e80bdabd71120827bc856f99b3345c41a2a868fa6a4aaf4b1ed04d3af5630f368ba2bd83118324c1cab0c2c4234dfc18a06b9e91f3597c9ce976ddf4de5b0bcba43e177ae348c651fe942ea3fbc6e857dde5122b5e773ce7451d51427b3e552cec657cb8b276e7a28291390081f7aed31593cc5fe4bb1f1215dda727644aad5039a7619e29c7157ba063f90f91c389d19d37214e80d590d0f0099cc6ed483d539efeba4d0f56d4727954edb95710e178657b1ca6376e7ae79ad9e35b9508e02b1b03e0070f381e2a5645726c43763cde7ddd3cef445c64cd610178384dcc4871b1bfd82aa2028386b92650d234cf5db2f5fd750e6a7b764f5c03679c4cc39e4d681db7e77e348fa760497d8b36048e7c5dcd38c8b307de7a2b9f4679c758e47c66f732517bab95bbe5c4d27aee3a1b10cd02d89c1047cedf45d3ba082d5a939a2d08a1436147b7e67c7524676ecedb8f524f3e8866a50b1138cc3f0df8cf3c1ece5665a09972ce6ae7a45d94598fb105f1c1216724620e95b3063a08e3e95cc453a36048c146c4abb06547dae2a1aaf3fdaf4a8ae2238b3f8a0242621a0e92fe8872114f873d213df5c182b8ee5b62bdbc55848ac315eca86d5ce6dbfc04af41ea6825a32108d26f657e1f996be0238a6c542d7bf30fe3f34c46946467f9389d0b4cfb2cbe88e7950fba069c29fd317733a49d00f79d6d7b7af230c51c0c91326a09206e2096383514f48771ee23aca1ae8fc92aa1fa1ed89f99f359a268874cb481cdf23596bd40edcdd231664576bf89217ed22a60a332bce7d621ad85ad098af6ae6af667de909c62856b599bc0018158792d2db0c30f212169f4fd024fc49b2d0cb09b6ecdc797a765f2425411dec73750d0eb48bded3b35df52f768c63ca8ae4432eb4823d94676cb5d55e001fd30f23554a23de2ae228d5a2635ee6d4f31152a2dd2a97589d3b8a63d28026670e39b9d6fc7c324665b4703fef744884e22390e3601aab76f39a65c68d3aad7c4d4b7c80a5e411be74c0ca584e419315d32cdf25743098a845646552627f0cbd6d52d9a7b024f58d89eab80f3e46650cf76edf2ac56cc10e6d068ac87d6fd84f7ae86af57dd9b7ed30ef74f1c79cf4ec7a58e97d862c024741e110536d0df47052af170114e99631f41660520feafb7277e614b20d5ade65d580db90bf00a37a206ff0418e66cb63a9403ffd22ff7e8291e393ff761bc5723589fac9ff88c7ead91d4f6c0b879e8f967de212d4b27d178d5f988cc7b8004a2b10dafce8c1279933f804b557aba2869ad017ef9b8e97b2f05d235979b59245f2346f5c8f4117ebf9e709e90d3ddbaae5613c69e0d642135c6493b37e2952e0b0bb8db5d8da849791044a1329910406b7673ae40512f6f2b6835ff895023eccb4d94e787258e0c2f0d7c57d57bce48158699a87035baef5348e67c21b9248c4e9921646f4f47240d25fa78b6c142747d43b644a88b853e6e5fd42ad160af0be3512e91bbfd9d59ba1cd20a8be746b471bab2766c30087c5351261e2f99362e72d948022e1d2f27eacc1b6143be4229614f88d3d517823da2ab276e25af1ea2ca2f1b75eef5db9996b9e763e1f17f95f6bc4bf84f087fd8332e5ec62b5675b9d5c63a0f8873c2e65a9954ccb32c1fb2c18a882f5d533a1c0489edeb41bc584ac4cc336dd89479eafd877eff62475e6845808c3af2cb44d519ecab203affa0a55256bc0609f31e43e86c171a267fa083050086dd040021522c9f080088be000000021506744001000000000001ff080022eb000000032200890a02000000000000030000920c08006558000000044f8403249f7015c5b995fb3bcb5a0d372be965bbe575a160137c0bce43931f688bdc23048e06d1ae7293dec8cb05990d3177e95230c49619e2f5e495a784423478f0b997e540e7247273a9f147a2269788613b89ed9c823271533425fbeb92f5544e70af2ef4517cade3c87d08399fad3094cbe43694d0f11d2a1d38d914e996a071fbad03fc51a68be765ca89a1e52720d2e06f46c28fb24925b12eacff46e4edd87dd804e05e0708e0e5a51bdd8751a45f800e584c4f2637fc0d5b450b41a8ef82c98b2eba7b239850748afa834c6cb00ea49c2f120ad8c0532ddffbcc1143e05339368b16febf112fdca70d5687ae667f2eb2d1aaa3d62942cf0a"], 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000b80)={0x6, 0x3, &(0x7f0000000680)=ANY=[@ANYBLOB="1800000002000000000000000000000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) r0 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000480)={0x6, 0x3, &(0x7f0000000680)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x5, 0xb68, 0x1300, &(0x7f0000000000)='%', 0x0, 0xd01, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x48) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(0xffffffffffffffff, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f0000000680)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) socket$netlink(0x10, 0x3, 0x0) unshare(0x22020600) fallocate(0xffffffffffffffff, 0x48, 0xfea000, 0x2000402) r2 = getpid() syz_pidfd_open(r2, 0x0) r3 = syz_open_procfs$namespace(r2, &(0x7f0000000400)='ns/uts\x00') setns(r3, 0x0) readv(0xffffffffffffffff, 0x0, 0x0) r4 = syz_io_uring_setup(0x111, &(0x7f0000000140)={0x0, 0xcd34, 0x1, 0x0, 0x34}, &(0x7f0000000280), &(0x7f0000000100)) io_uring_register$IORING_REGISTER_SYNC_CANCEL(r4, 0x18, &(0x7f0000000300)={0x4, 0xffffffffffffffff, 0x2a, {0xffff, 0x1}, 0xae}, 0x1) sendmsg$key(0xffffffffffffffff, 0x0, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000005"], 0x48) ioctl$sock_ipv4_tunnel_SIOCGETTUNNEL(0xffffffffffffffff, 0x89f0, &(0x7f0000000180)={'ip_vti0\x00', 0x0}) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x0, 0x0, &(0x7f0000000080)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000003c0)={{r5}, &(0x7f0000000340), &(0x7f0000000380)=r6}, 0x20) 4.478408481s ago: executing program 7 (id=3867): setgroups(0xefff, 0x0) socket(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000000)={'lo\x00'}) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)={0x4c, r2, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0xffff}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x40800) 3.882522933s ago: executing program 7 (id=3868): syz_usb_connect(0x5, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="1201000064f1f440cf1065807991010203010902240001000000000904ff00022047380009050602000200000009058202"], 0x0) times(0x0) fsopen(&(0x7f00000004c0)='gfs2\x00', 0x0) 3.165832373s ago: executing program 9 (id=3872): syz_usb_connect(0x2, 0x10e, &(0x7f00000047c0)=ANY=[@ANYBLOB="120100006a249f08ec1888323a3f010203010902fc0001870000000904e600030e01000006240600011005240008000d240f01000000000000a0010606241a0000000c241b000000000000ff0100042402", @ANYBLOB="7e943709a26e0512574b35a82af516647900665043e2091a17b3cd926b0824fbbe25bc1c509edcf4108f5e351df1758952ab7601229730888a3c08c12d1c0d73cc7f598da3"], 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) dup(r0) 3.010238414s ago: executing program 8 (id=3874): r0 = syz_open_dev$vbi(&(0x7f00000028c0), 0x2, 0x2) r1 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000900)=@newtaction={0x18, 0x31, 0x53b, 0x0, 0x0, {0x9}, [{0x4}]}, 0x18}}, 0x0) ioctl$VIDIOC_S_INPUT(r0, 0xc0045627, &(0x7f0000000100)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r0, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2, 0x640, 0x1, 0x3, 0xe8b0, 0x19ef, 0x4042, 0x9, 0x7, 0x3, 0x33, 0x2800, 0x2, 0x8, 0x9, 0x0, {0xc, 0xfffffffb}, 0xd0, 0x9}}) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) removexattr(0x0, &(0x7f0000000240)=@known='user.incfs.metadata\x00') prlimit64(0x0, 0xe, 0x0, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000002180)=ANY=[@ANYBLOB="20b93d7a28b749315800000000000000070000000cdf00800600000088480000"], 0x20}}, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, &(0x7f0000000080)=ANY=[@ANYBLOB="18eaffffffffffffff000000000020009500000000000000"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0xf, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_emit_ethernet(0x4e, &(0x7f0000000b40)={@local, @link_local={0x3, 0x80, 0xc2, 0x0, 0x0, 0xe}, @void, {@ipv4={0x800, @tcp={{0xb, 0x4, 0x0, 0x0, 0x40, 0xfffc, 0x0, 0x0, 0x6, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@rr={0x44, 0xb, 0x8, [@initdev={0xac, 0x1e, 0x1, 0x0}, @empty]}, @ssrr={0x89, 0x7, 0xd5, [@multicast1]}, @timestamp={0x44, 0x4, 0xdf}]}}, {{0x0, 0x0, 0x41424344, 0x41424344, 0x0, 0x0, 0x5}}}}}}, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00', r3}, 0x10) bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x19, 0x4, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000084000000000000d80002000085000000390000009500000000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r5 = syz_open_dev$dri(&(0x7f0000000180), 0x0, 0x0) r6 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_GET_MAGIC(r6, 0x80046402, 0x0) close_range(r5, 0xffffffffffffffff, 0x0) ioctl$HCIINQUIRY(r4, 0x800448d4, &(0x7f0000000000)={0x3, 0x200, "fe0140", 0x0, 0x12}) r7 = socket$nl_generic(0x10, 0x3, 0x10) capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x3, 0xffffffff}) r8 = syz_open_dev$sg(&(0x7f0000000000), 0xfffffffffffffffb, 0x181000) r9 = socket$nl_generic(0x10, 0x3, 0x10) r10 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_MEDIA_GET(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f0000000200)=ANY=[@ANYBLOB='l\x00\x00\x00', @ANYRES16=r10, @ANYBLOB="01000000000000000000030000005800018044000400200001000a00000000000000fe800000000000000000000000000010f8000000200002000a00000000000000ff160000000000000000000000000001000000000d0001007564703a73"], 0x6c}}, 0x0) ioctl$SG_IO(r8, 0x2285, &(0x7f0000000100)={0x53, 0xfffffffffffffffc, 0x6, 0x0, @buffer={0x20, 0x0, 0x0}, &(0x7f00000002c0)=']V+Z,i', 0x0, 0xfff, 0x10000, 0x0, 0x0}) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="2000000044000701fcffff7c00000c0004"], 0x20}, 0x1, 0x0, 0x0, 0x488c0}, 0xc000) r11 = openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000100), 0x40200, 0x0) ioctl$PPPOEIOCDFWD(r11, 0xb101, 0x0) 2.952626954s ago: executing program 8 (id=3875): setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, &(0x7f0000000000)=0x9, 0x4) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'xfrm0\x00'}) r0 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x101000) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r0, 0xc01864b0, &(0x7f0000000480)={0x0, 0x0, 0x0, 0xf29, 0x3}) setsockopt$SO_TIMESTAMPING(0xffffffffffffffff, 0x1, 0x25, &(0x7f0000001040)=0x108, 0x4) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$KVM_CAP_EXIT_ON_EMULATION_FAILURE(r1, 0x4068aea3, &(0x7f0000000280)) r2 = getpgid(0x0) timer_create(0x2, &(0x7f0000000200)={0x0, 0x0, 0x2, @tid=r2}, &(0x7f0000000240)) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) fsopen(&(0x7f00000000c0)='bfs\x00', 0x0) socket$rds(0x15, 0x5, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) openat$loop_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$inet(r4, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x0) recvmsg$unix(r3, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140), 0x100}, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file1\x00', 0xc01c2, 0x1fe) write$binfmt_script(r5, &(0x7f0000000040)={'#! ', '', [{0x20, '\xf1IrQQa\xb8\xd4\t\x89Z\xa5!\xfe\xdd\xb3\xb5\x8e<\xb0j{y\xfb\xbf\x8f\xdc\xabKrF%\xb5\xb9\xd0u\xa7\xb7*\xce\x02\xc0\xc1CM|(\xa9\xe7\x17\x92)\xb2\xb5\xa8\xd4q,\xc3_\xf4\xf7o\x10Q\x82\x8e\xa9o\xa3Ei\xc0p\x16\x8e\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x15\xb0\x848a^]6\x0f\xcf\x12\xd3\xb3s\x1d\xa2\x88\x06\xda\xd5urD\xf7\x11{l_q\x06\xc9\xd4\xe8Z\x14\b\xa6t\xee\v\xe4W\xdb0\x8e\x93\xef\x837h\xc1U\xa7^g\xfb\xe9g\xdej\xd6}`-\xc0\'\xb4z\x10\xac\x05\x16\xe4O\x05b\x02\xa0\xaa@\x87\x0fr\xbc1\x00\x12\xda<\x05M\xb1\xd7\xe1W\x94#\xd5\xa3\xf5\x05\x00\x00\x00\x00\x00\x00\x00\x99N\xf1\x7f\xf7\x00\x00\x00'}]}, 0xd4) close(r5) execveat(0xffffffffffffff9c, &(0x7f0000000140)='./file1\x00', 0x0, 0x0, 0x0) r6 = syz_io_uring_setup(0x10d2, &(0x7f0000000540)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f0000000600)=0x0, &(0x7f00000005c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r7, r8, &(0x7f00000001c0)=@IORING_OP_SYNC_FILE_RANGE={0x8, 0x18, 0x0, @fd_index=0x9, 0xd, 0x0, 0x1, 0x4}) io_uring_enter(r6, 0x47bc, 0x0, 0x0, 0x0, 0x0) 2.793128057s ago: executing program 8 (id=3876): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) write$qrtrtun(r0, &(0x7f0000000300)="ca0e808bb35bdabb", 0x8) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x7], &(0x7f0000000240)=[0x2], 0x0, 0x1}}, 0x40) 2.586023723s ago: executing program 5 (id=3877): r0 = syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) unshare(0x68060200) ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000040)={0xa, 0x0, 0xc, {0x5, 0x4, 0x4, 0x8000}}) symlink(&(0x7f0000000000)='./file0\x00', &(0x7f0000000080)='./file0\x00') 2.585363487s ago: executing program 8 (id=3878): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$devlink(&(0x7f0000000200), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_SB_PORT_POOL_GET(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)={0x4c, r1, 0x1, 0x70bd2a, 0x25dfdbfb, {}, [{{@nsim={{0xe}, {0xf, 0x2, {'netdevsim', 0x0}}}, {0x8, 0x3, 0x2}}, {0x8, 0xb, 0x9}, {0x6, 0x11, 0xffff}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x8000}, 0x40800) 2.43145357s ago: executing program 7 (id=3879): syz_io_uring_submit(0x0, 0x0, 0x0) ioctl$VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x30dd3000) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt(r0, 0x84, 0x81, &(0x7f00000002c0)="1a00000002000000", 0x8) setsockopt$inet_sctp6_SCTP_AUTH_KEY(r0, 0x84, 0x17, &(0x7f0000000080)=ANY=[@ANYRES32=0x0, @ANYBLOB=' '], 0x9) setsockopt$inet_sctp6_SCTP_AUTH_ACTIVE_KEY(r0, 0x84, 0x23, &(0x7f0000000340)={0x0, 0x5}, 0x8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x19) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x14) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f00000002c0), 0xffffffffffffffff) sendmsg$TIPC_NL_NET_SET(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)={0xf4, r2, 0x1, 0x80, 0x25dfdbfe, {}, [@TIPC_NLA_NET={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0x7}]}, @TIPC_NLA_NET={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ADDR={0x8, 0x2, 0xb}, @TIPC_NLA_NET_ADDR={0x8, 0x2, 0x71ad}]}, @TIPC_NLA_MEDIA={0x30, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1000}]}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_LINK={0x90, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x10}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6a61b249}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xe}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffff79a1}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x3}]}]}]}, 0xf4}, 0x1, 0x0, 0x0, 0x2805}, 0x0) 2.348311348s ago: executing program 8 (id=3880): r0 = socket$alg(0x26, 0x5, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000040)='contention_end\x00'}, 0x10) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, 0x0, &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, &(0x7f0000000200)={0x5, 0x4}, 0x8, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) listen(0xffffffffffffffff, 0x3) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f05ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x10) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=@newlink={0x24, 0x10, 0x801, 0x0, 0x4, {0x0, 0x0, 0x0, 0x0, 0x4000, 0x4a080}, [@IFLA_XDP={0x4}]}, 0x24}}, 0x0) ioctl$VHOST_VSOCK_SET_GUEST_CID(0xffffffffffffffff, 0x4008af60, 0x0) sendmsg$DEVLINK_CMD_RATE_SET(r1, 0x0, 0x20048844) r5 = fsopen(&(0x7f0000000000)='devtmpfs\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) fsmount(r5, 0x0, 0x1) fsconfig$FSCONFIG_CMD_RECONFIGURE(r5, 0x7, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000000), 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) 2.090367801s ago: executing program 0 (id=3881): r0 = openat$selinux_load(0xffffffffffffff9c, &(0x7f0000000380), 0x2, 0x0) r1 = openat$selinux_policy(0xffffff9c, &(0x7f0000001040), 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x12, r1, 0x0) connect$unix(r1, &(0x7f0000000280)=@abs={0x1, 0x0, 0x4e20}, 0x6e) bpf$MAP_LOOKUP_ELEM(0x2, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0}, 0x20) mkdir(&(0x7f0000000000)='./file0\x00', 0x0) mount(0x0, &(0x7f0000000040)='./file0\x00', &(0x7f0000000000)='devpts\x00', 0x0, 0x0) r2 = openat$dir(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x18000, 0x2) lseek(r2, 0x3, 0x1) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) getsockopt$inet_buf(r1, 0x0, 0x2f, &(0x7f0000000080)=""/67, &(0x7f0000000000)=0x43) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x3, 0x0, 0x0, {0x7}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0x7}, [@NFTA_SET_ID={0x8}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2f}, @NFTA_SET_EXPRESSIONS={0x4}, @NFTA_SET_FLAGS={0x8, 0x3, 0x1, 0x0, 0x110}]}], {0x14, 0x10, 0x1, 0x0, 0x0, {0x0, 0x84}}}, 0x90}}, 0x20050800) write$selinux_load(r0, &(0x7f0000000000)=ANY=[], 0x4c) 2.070661808s ago: executing program 5 (id=3882): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) io_submit(0x0, 0x1, &(0x7f0000001600)=[&(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x6, 0xffffffffffffffff, 0x0, 0x0, 0x8f}]) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_NESTED_STATE(r2, 0xc080aebe, &(0x7f0000001600)={{0x0, 0x0, 0x80}}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = creat(&(0x7f0000000000)='./file0\x00', 0xd931d3864d39ddd8) r5 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x1) r6 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x0) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r6, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1a, 0x4, &(0x7f0000000200)=ANY=[@ANYRESDEC=r6], &(0x7f0000000440)='syzkaller\x00', 0x0, 0x0, 0x0, 0x100, 0x2, '\x00', 0x0, @fallback=0x14, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94) write$qrtrtun(r4, &(0x7f0000000300)="0000000000feff00", 0x8) r8 = socket$inet6_mptcp(0xa, 0x1, 0x106) bind$inet6(r8, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c) listen(r8, 0xfffffffc) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_TCP_MD5SIG(r9, 0x6, 0xe, &(0x7f0000000200)={@in={{0x2, 0x4e23, @empty}}, 0x0, 0x0, 0x22, 0x0, "43cad7b04bde5bbd8035d89034a56bad61a87c614899a37c5d0d7da4d7fc948375f3593dbd21eb7618ffb4ff4984e01eedc37998dd16526edb40eaadabe6cd2bd9f9dfeade7787ea64309c01ae05fb70"}, 0xd8) setsockopt$inet_tcp_int(r9, 0x6, 0x20, &(0x7f0000000040)=0x2, 0xf6) connect$inet(r9, &(0x7f00000000c0)={0x2, 0x4e22, @dev={0xac, 0x14, 0x14, 0x23}}, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r7, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f00000001c0)=[0x4], &(0x7f0000000340), 0x0, 0x1}}, 0x40) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1f, 0x12, r5, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000900)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a2c000000060a0b04000000000000000002"], 0x54}}, 0x0) r10 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r10, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000900)=ANY=[@ANYBLOB="1c0100002b00010000000000fcdbdf250a01f2800c00090008ac0f0000000000140001"], 0x11c}], 0x1, 0x0, 0x0, 0x1}, 0x0) sendmsg$nl_generic(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r3, &(0x7f00000006c0)=[{{0x0, 0x0, &(0x7f0000002e40)=[{&(0x7f0000000000)=""/23, 0x17}, {&(0x7f0000000240)=""/91, 0x5b}, {&(0x7f0000001b00)=""/4081, 0xff1}], 0x3}, 0xd}, {{0x0, 0x0, 0x0}, 0x24c9ddb}, {{0x0, 0x0, 0x0}, 0xf04}, {{0x0, 0x0, 0x0}, 0xa8fd}], 0x4, 0x40000020, 0x0) socket(0x2b, 0x800, 0x2a) 1.514911293s ago: executing program 9 (id=3883): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000003c0)={0x0, r0, 0x0, 0x1}, 0x18) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1a00000007"], 0x50) r1 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r1, &(0x7f0000000100)={0x1f, 0xffff, 0x3}, 0x6) writev(0xffffffffffffffff, &(0x7f0000000100)=[{&(0x7f0000000000)='4', 0x1}], 0x1) write$binfmt_misc(r1, &(0x7f0000000000), 0xd) 1.422151642s ago: executing program 0 (id=3884): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002040)={0x18, 0x3, &(0x7f00000001c0)=ANY=[@ANYBLOB="1800000000000010000000000000005f77009500006a5f9b54cd04ae26607670994fe9c4e7000000"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5ee, @void, @value}, 0x94) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) write$dsp(0xffffffffffffffff, 0x0, 0x0) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="1b0000000000b756c7c069939a0000000400000000000000000000000000f600", @ANYRES32=0x0, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x1a, 0xf, &(0x7f0000000340)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x8001, 0x0, 0x0, 0x0, 0x1ff}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000001dc0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x996e05f434aae48e, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, @void, @value}, 0x94) socket$nl_rdma(0x10, 0x3, 0x14) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x2d) dup(r1) r3 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) fchdir(r3) syz_open_procfs$namespace(0x0, &(0x7f0000000000)='ns/pid\x00') mount(&(0x7f0000000000), &(0x7f0000000040)='./cgroup\x00', 0x0, 0x1001, 0x0) mount$overlay(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f00000000c0), 0x800, &(0x7f0000000100)={[{@userxattr}]}) prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x88}, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000180)=@bridge_delneigh={0x1b, 0x1c, 0x1, 0x70bd28, 0x0, {0x7, 0x0, 0x0, 0x0, 0x1, 0x64, 0x6}, [@NDA_LLADDR={0xa, 0x2, @dev={'\xaa\xaa\xaa\xaa\xaa', 0xc}}]}, 0x28}, 0x1, 0x0, 0x0, 0x20040051}, 0x4048080) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x4000003, 0x50032, 0xffffffffffffffff, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) syz_clone(0x100, 0x0, 0x0, 0x0, 0x0, 0x0) mlock(&(0x7f00007d8000/0x800000)=nil, 0x800000) r6 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r7 = memfd_create(&(0x7f00000003c0)='\x9d#\x00\xe6Z\x00\xafq%\xa5\x83\xa6\xb5\x00\x83y\xf3\xb2\xe6b\x00\x00\x00\x00\x00\x00\x00\x01\x00\x00\x00\x00\x00\x00\x17?&^\xe1Ob\xe1Y\xd6\xeb\x91\x83;\xeb\xf1\xd0\xe3\xe5\x19T\xff\x01\x00\x00\xe2\x9f\x00\x00\x00\x15\x00\x00\x00\xa1\xa2\xe0g\x98\xbf*\xa2c\x12.\xb7\xbe`\'\xcb\xb6\xaf\xdc\xa0D\x93.\xf25\x957\xec\xfb\xe6|\\\xe4h\xfc\x14\x06\xb5\xaa\xe6\x05\xe4\xc3\x90\x91\x98\x15\xec\xdb\xaa\t9\x11\xb4\x84$&0\xdd\x19\x86\x90\xbe\xd7\xdc\n\xcbC\x15\xfcp\x11\xdai\f{a?\xd0\xe1{\x84\xb5\x82q\x19\xacS\x88|\x99\xfd\x9eS\x80\xcb\x14G\xfa\xff\xff\xff\xff\xff\xff\xff\xcd\xf0%\x97!\x97.A\x84\x1d\xc2\x86\x89{\xba\xe3J\xc2t\x96\xf8\xb1\xd2\x168\xbf`$\xbf\xca\xea\xa3\x83\x8e/\x85c\xae\x9c\xe9\xc4\xd2\xf3\x9f\n-k\x12\xdf\xb9q\xb6Pr\xd4\xb5X\\\xdbD\n\x03G\x00\x04\x00\x00\xbc\xac\x18\xba\xce\xb3%QF\x03\x12\x00\x00\x00\x00\x00\x00\x00[\xf9\r\t\xef{h\xb0\xc0\x00\x00\x00\x00\x06\xf8\x83\x87+nM\x11\x1c\xb0*8\v\x1e\xcf\x03\xd3\xe8,?\x87\x84\\/y\xed\x01#?\xab\x1c\x11\x00\xc5\x8d\x82\x9c\xd6B[\xc9\x00\xf5]\x81\xf3\xfd\x06M\xbe\xf9\xba\x9em\xe9\"\x03\x933P\xa3\xcc\x9b\f\xa7\x8f\x91O\xc9\xb9\x10M\x8b\xd0\xc0\xb8Fb\x1c4\xb59\x988\tgC\xbc\xe0\xc5\xf4\xe0E%\xd9\xd8w\x00k\x042Y\xdc\xc5\xe59\xa95\xd1m\xd8hCuZYi\x10D\xb9\xe6\xff\x04K%yH\xe5W\xfb\x82\xac\x19,\\D\x91T\xfd\x9c\xb8\x8b\x88\xa5O\x8fI\x00\xf0\xc9%\n\xa7\x0f:\xb0\xf5?\xc3\x88\x1e\xbb-\xa6\xecA\x92\xaf\xa4Xl\v\xa5\xca\v|\xe2N\xac\x80\xc7\x15\x96fh\x83\x15\xc7\xea\xd5\xe8\x89W\x11\xd7oC\xe4\x06\xa8[O\xe6\x1d=\x87\x93\x0f\x87I\xdf\xb1\xeb\x89\x11.\x01\x00\r`\x1e8\x94\xb7\xbc\xc3\xad\xf1\x92\xaf(A=A\x8b\xa5\xb0\x89\x9e5\x12\xa4\x9a\va\xdf\xf4\xea\xc6\xc7\x10g\x1d\xd5\xb0\x9d\xd2\xfc]fC\x8d\x0f\xa6q\x0f\xef\x90\xfe\x94k\xf1\xb8\xfa\xbbb\xb1\x00\x99\xf7\xfd\'\xae\x906\xe0\xaa\xdbtWWH\xa4L\xb5pe,\xdfN\x0f\x00\x01\x00\x00_H\xd4\xe3\xb2,oj\xac\xd7\xbd\xd0\xadW\x1f<\xd0s\xa8\x1f(\x00/ \xe4]@\xf7mA\xe8\xd1\xf4:\xb3\xeb\x81\xb9\x018\x1c\x95%o\x05x\x1a\x90\xf4\x03\xe7\xe9\xa9\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x84\xe38\xac>\xbbqJ\x8f\x8cmu\x12\x1d\x9a\xd7\x1c}\x8a]1\x8a\x84\xedo\t*77\xbb0\x8b\xe5R\xc8\t\x94\xbc\x95\xc0\x92\xfc^e\x15\x10\x96\x18\'\xfa\x8e\x81\x03)3\xbf\xa6|\x88\x1f\xfb\xf0\xa3\xd2\x99\x06\xb1\x15\xc4\xe9\x80\xfb\xcfD\xe3\xff\xc1V\x00\xc4\xd1\xa1\xa6\xba\x9a\x91\xdb\x0f\xb6\xb9&\xf5\x05\x9b_\xde\xc6\xc4P\xf9,\xab\x13\xd0+*\xa3\x002\x19Z\x0e\xa7\xb9\xf2\xed\xd7#\b0\xba\xaa\x93\xf6\xef-\x1fL\xc6\xdc\xa7?\xf9\xbcdI\xca_\xa3\xbd\xe6,\xe6\x87$\xe8W8\xa6Zb\x1a7\xd7\x86\xe5\v\xa5\xaf\x8b\xd8t\x9fk\xee#\"\xa4\x96\xd5m\xdb\xb0\xdf\xa8\xb9{\xca\xea\nD|+;\x14\xc4\xe5\x9c\xebDJ\xf4\x19PFi\xce\xd6E9\x18\x1d~\x17\x06\xe9iDu:ou\a<\xaf\x8f0v\x81\xb1HC\xf3\x96\x96]bp\a\xdf7\xcb\x10x\xff\x17L\xde\xff\b\fm\a\x1b\x13\xe2[\xea,\xfc\x8ep<\xa4gq\xf4\xb4\xd7\x1d\'\xd6\xb5\xa3\x90\xf9\xf2\x1a\xaa\xb0\b\x7f\x89\xf7\x9e\x89\x85O\xe6U\x9fO\xa5\x8dfO\x11S\x00\xb6\x809\r\x96\xf2\xb8,\xe1N\xa1\xfd\xaa\x99\xe9\xb4\t\xf1(>\xf8fLBQ\xcf\x9c\xd4\x88\x96\xbc\xf0\xa4\xeb\x92\xd7\xc1\xef\x13\xc7U\x9b\xa8r\xc1_\x11<\x19?)\xb3\xfdf\xc3\xba\x1e\xbaY\xea|~^\x00\x1e\xea/\x1e\xd2&1Z@\xa50\x06s\xf2PP\xf9\xdcv\xc6\xaf\x12M\x8b\x12\xdbf\xb2r\x1a\x84\b\xde\b5\xdb[ruJ\xa0\xa9Nj\xd5<\xcc\xdeA4|1Ye\xd7\xf3\x1b\xedq)\xab_\xc1\aR\xef%\xfb\x9c\x18<\xa3\x133T\x89\xff\x99S\xb7n\xe3%\x05g*X\xe5\xfc\x97\x01\xec\xeb\xd6\rf\xbdl\xee\xca\x1c\xa2{\x98v\xcc\x8a\xcc\xa1\xf1\xb4\xf6\xe1\xc0\x96\xc8\x1c\x05C\x93\x1c\x89e\xc1~\xf3\xc8\xe8\xe6]S\xbd\xbe\xb3M\xc1\x9b\x05\x12\xe9C\x11\xbb\x03U\x80KRd\x14c3I\xa0\xc7\x8a\xba9\xfeH\x94\xb2\xe7h\xb1\x02\xf6\x0f\x02\xb0\xc3\xd8\x02\r\v\xfa\xc7\xbdE\xf6b\xde\xbeJ\x9509\xe8\x18\x05\x15zi\xba\tf7\x9b,\xa3\xa5\xa1\xc1|\xd2:D3z\x8f\x19\xa8\xe1d\xedk\xe8\xa2/\x95`$\x81\xc2g\x04u\x16\xbc{\xb7\x90\xbe\xeb\x85 \f ^I\xd5\x0e\r\xdf4\xd0\x95d\xe4\xaf\x83\x88\xd8l\xae\"\xef\xe5\xfc\x01\x15\xb5\x99U\x1c\xb1\x9c \xe7\xa6\x8fv\xfe\xea\x9a\x11\xe2-', 0x4) ioctl$FS_IOC_RESVSP(r7, 0x4030582b, &(0x7f0000000080)={0x0, 0x2, 0x9, 0x5}) ioctl$KVM_CREATE_DEVICE(r6, 0xc00caee0, &(0x7f0000000140)={0x4, 0xffffffffffffffff}) close(r8) 1.417050505s ago: executing program 9 (id=3885): r0 = eventfd2(0x0, 0x0) poll(&(0x7f0000000080)=[{r0}], 0x1, 0xda90) (async) r1 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_OWNER(r1, 0xaf01, 0x0) ioctl$VHOST_SET_VRING_ERR(r1, 0x4008af22, &(0x7f00000001c0)) writev(r0, &(0x7f0000000400)=[{&(0x7f00000008c0)="eebd73c460f8a4a8", 0x8}], 0x1) (async) ioctl$VIDIOC_CREATE_BUFS(0xffffffffffffffff, 0xc100565c, &(0x7f00000000c0)={0x400, 0x8, 0x1, {0x5, @raw_data="ff12acf504f74dced1caa9f9280becad5206f6b4ce532f004bf89d77f01032f2d614342cd8e47dbb173ce450f6996e88d71bde58ceca3a23c40f37fc27f07cffd1a1cdaa3351679f03f58cf3dd4fdde72bdc46377344981c9aee18238af5c7d929b5de4c92b6a2024651368448b28d2ad77569c733804f772504225573de705f3a5fa5b94d26a09eac6a851d58a861b90bba9e0edfb631c953714aa47680714470f8121dd81eceff51b637886864c8f6eef95b605e58d857225e9c80810379723c4cd21fc8948045"}, 0x1}) 1.330677149s ago: executing program 8 (id=3886): socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=ANY=[@ANYBLOB="0f000000040000000400000012"], 0x48) r3 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000340)={0xe, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="18020000801004800000000004000000850000002700000095"], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) (async) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000280)=ANY=[@ANYRES32=r2, @ANYRES32=r3, @ANYBLOB="05"], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) (async) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000740)={{r2}, &(0x7f00000006c0), &(0x7f0000000700)=r1}, 0x20) sendmsg$inet(r0, &(0x7f0000000980)={0x0, 0x6000, &(0x7f0000000900)=[{&(0x7f0000000640)='U', 0xa00120}], 0x1}, 0x3) r4 = gettid() timer_create(0x0, &(0x7f00000003c0)={0x0, 0x21, 0x800000000004, @tid=r4}, &(0x7f0000000380)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) (async) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) (async) r5 = open(&(0x7f00009e1000)='./file0\x00', 0x60840, 0x0) fcntl$setlease(r5, 0x400, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x0) (async) bpf$MAP_CREATE(0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000340)={0x0}, 0x18) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f0000000000)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) (async) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x1e, 0x3, &(0x7f0000000000)=@framed, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) (async) r6 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1801000021000000000000003b810000850000006d000000070000000000000095"], &(0x7f00000001c0)='syzkaller\x00', 0x4, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000000c0)='rpc_buf_alloc\x00', r7, 0x0, 0x1}, 0x18) sendmsg$netlink(r6, &(0x7f0000000040)={0x0, 0x2f, &(0x7f0000002580)=[{&(0x7f0000000000)=ANY=[@ANYBLOB="140000002500010000000000f100000006"], 0x14}], 0x1, 0x0, 0x0, 0x400048c0}, 0x0) truncate(&(0x7f0000000040)='./file0\x00', 0x0) fcntl$setlease(r5, 0x400, 0x2) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x100000}, 0xc, &(0x7f0000000080)={&(0x7f0000000400)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x1}}, [@NFT_MSG_NEWSETELEM={0x11c4, 0xc, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x1}, [@NFTA_SET_ELEM_LIST_SET_ID={0x8}, @NFTA_SET_ELEM_LIST_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x3}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xf4, 0x3, 0x0, 0x1, [{0xf0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_USERDATA={0xdf, 0x6, 0x1, 0x0, "49d165af74fc7022b4105bcbcb3497898d55aa387b0841c34c3a53dd428a8c19aef05c60f8d05a210cda4ae5224fffeab7831d83c33f7294fce038883b277ab2eabca0c12c57fe85049f78297595746e53aae9ebba6d8a67ffb5deedcf796a1d8d9b58f2880c67d7a4513c60e1ce7abb728f0f34fb33dd016cfa126a40ae551e32d5bb7f023d6135f55dfe9eee6cf667c6fbc882a4e7cbc5de4141c3335e5bacf12bb64be517017039b2decaeea59294d21d3fbe1704f77f847a02c98f3460bdc5f2dd7d0e9013b3816bb6693d1a849b0f4b25c94cde59af64345c"}, @NFTA_SET_ELEM_TIMEOUT={0xc}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0xaf8, 0x3, 0x0, 0x1, [{0x4a4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_KEY={0x118, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x81, 0x1, "d3812d052b09b9346ef966900fc422aa83fd561f00394a981e6e0b5b0b24fb59e1fbba222f6ec774a2c06ab2ee5534d3f2a292d4b86a4ba7bdd3579afefdb52f75cad445b54664d1d22e540c563ffd003c71b19749e089fb757a19fcf9f05b065ef2028ed0c21225915776c08672f8f4af29a55ffb87d72fc6ad687f90"}, @NFTA_DATA_VERDICT={0x30, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VERDICT={0x60, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}]}, @NFTA_SET_ELEM_DATA={0xe4, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x3c, 0x1, "c0912ffb05111387b5a77880c5d56dada11339cf9e27a1cfac9ea14868ea4672332b214509758c43b58d8db5e79dc0a1c0166fa7bb7b5e40"}, @NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VALUE={0x97, 0x1, "66a8a4ac54300c04a651a328d60fa0b64ec9249f55af1d7025b0e2d2f0c50a4bb239466cf97fc6972003ae455526a342604ff9d9e3b6723e4168b3d8b0a8c9484b58c6a7a2b480542b6550106fab4cd288e897daecdc70152f7217dfef962fe0ba3b356d9bc8e388c3948c6da7648660998dc7b10e248950c038d8ef148f417febaa025ce8254053ec3f033bf1d182f1410cee"}]}, @NFTA_SET_ELEM_KEY_END={0x26c, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VALUE={0x2d, 0x1, "04a4df5669ff082ce5d731c416bb7ad8b769ec13cbd28ded7d607746fda476fb6c168aad22d3da71c4"}, @NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}, @NFTA_DATA_VALUE={0xf1, 0x1, "1817de582efd6ef25d62ff65716f53cc939ff23ccac23b670fca4cfd0ad2c9c2e5bd919942151ad05f7ae5b6c49257de041c84ed29ccd660951db9ddbb20fae9f7a7b3caab120a7e948165b415215961922ce1c21d1dcd7c4e1bc1576f62addba34afbbc6c4352319ba16a0c8e193b8edc42126433493063198526739e55c8f620ea3556a99a7a3664d7bc29bad7d6fbcd6ad72167cefcfbba11f441fd5b5ab5aa2e2851ac58dc07d16bc9f45f9e62347801346d92d1f5e4d3a2ab39d54504c37a5d89f00ce9f74e303be4dfcec756c44abb9e2f45583bcee7db20c428efc2e932b40fdb5fec2c19d626b2fbd8"}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0xa5, 0x1, "5d85ed089b9e6253f99e1a8b2ba8a52b17bdef0f239ca30d090e1b67b7d10e60a85c4f6fd7b0c2b5c00937d836f2292173cdf24497660f18fca5c7ea506c8ab478e17e735ad19864edc722ae0ce3f9e05066c7cb7c994297284519c3180c1cd8bc9e17b06cd18320225493127ad6e72327610b2263ed4a2ee29e4109152e1d6d0b7ae94bb98a8e7f1d70ae6ed036755ab879600f529d5ca59e51410e9814953ab7"}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}]}, @NFTA_SET_ELEM_EXPR={0x10, 0x7, 0x0, 0x1, @numgen={{0xb}, @void}}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x100}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x7ff}]}, {0xa0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_KEY={0x90, 0x1, 0x0, 0x1, [@NFTA_DATA_VALUE={0x18, 0x1, "3d0dda3e3ee66f4879db9e71924dd61c3c9fc6ee"}, @NFTA_DATA_VALUE={0x23, 0x1, "1480fa7cf27c560e27c6d60f89902620ec7495b43f01bd0b5cb5e147048f49"}, @NFTA_DATA_VALUE={0x32, 0x1, "91313e1aef4e6a2fd2fdba36602d65865a13f2c73438ed297768094b0fd8d9ba59766e1fa5869c942b8fd0f9e36f"}, @NFTA_DATA_VALUE={0x8, 0x1, "cbc58e2b"}, @NFTA_DATA_VALUE={0x4}, @NFTA_DATA_VERDICT={0x10, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}]}]}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xf0}]}, {0x10, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0x9}]}, {0xc4, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPR={0x3c, 0x7, 0x0, 0x1, @lookup={{0xb}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz0\x00'}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz0\x00'}]}}}, @NFTA_SET_ELEM_EXPR={0x1c, 0x7, 0x0, 0x1, @redir={{0xa}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x17}]}}}, @NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz2\x00'}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x52b}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x6}, @NFTA_SET_ELEM_DATA={0x44, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x3c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}]}]}]}, {0x204, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_SET_ELEM_EXPRESSIONS={0x18, 0xb, 0x0, 0x1, [{0x14, 0x1, 0x0, 0x1, @queue={{0xa}, @val={0x4}}}]}, @NFTA_SET_ELEM_KEY_END={0x1d4, 0xa, 0x0, 0x1, [@NFTA_DATA_VALUE={0x1b, 0x1, "657e43412aa99d3aaa37b1b57d8abff7bcaddc7c8743eb"}, @NFTA_DATA_VERDICT={0x2c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}]}, @NFTA_DATA_VALUE={0xe, 0x1, "4c6ab63fb00369f16860"}, @NFTA_DATA_VERDICT={0x4}, @NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}]}, @NFTA_DATA_VALUE={0xef, 0x1, "ff2a140b65e08d81cf92fa6afd28c2b30f87da6566f132e63837efa870b654c6c026fade4a70a6291ebc615d204b38522b23071e397ff48d901e4b91add4d4027d76a5c49574517024a772d14f94f4191b7956fab4cfdb7962761ab6bbc3f9ff2c3a86bc2bf4d2e86823981f0ca89b47811de896c58cfc4666802c5bd9014382a6ef0c7c4d6f09422a0390f4aafa5ae03e2c5452cbbbd0bd261ecd66f57e48ca53718f2381178c4bea5dc96677eaea554c53d624f874dc5202f9444ef05921ecf7bc592defe99fbd308de669b1f570265fe091b7011bcf5f91c4bbc9bb6f77896f82043f2f4ea3b796feee"}, @NFTA_DATA_VERDICT={0x48, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VERDICT={0x1c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_SET_ELEM_DATA={0xc, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x6, 0x1, "d5d2"}]}]}, {0x1f8, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_OBJREF={0x9, 0x9, 'syz0\x00'}, @NFTA_SET_ELEM_DATA={0x1ac, 0x2, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x64, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}]}, @NFTA_DATA_VALUE={0xab, 0x1, "643debeb0ffc2a55d33922e65a8ff36e12002253a746646d830cd6a4a222bb619e557996427a39547a6633374bff8c821b3c8ddd0346461100fc4f42be9c910c4c5205168034b09a1ba2c7cc3575ae083aae4035db91ae6421089542a640c8fc004f8762a70b1f3745347d90a944d69c15d3af9eeeec1dc071d48dec30089b03a1a9c8147b32e7604fc7d5b29820f0539259e1685f5f87becd0b731ad7f7e5c14047d167cde40c"}, @NFTA_DATA_VERDICT={0x5c, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x2}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffe}]}, @NFTA_DATA_VALUE={0x15, 0x1, "e7e9936ea6a4aba46b186bd52c9956df11"}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xffffffffffffffff}]}]}, @NFTA_SET_ELEM_EXPR={0x34, 0x7, 0x0, 0x1, @redir={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_REDIR_FLAGS={0x8}, @NFTA_REDIR_REG_PROTO_MAX={0x8, 0x2, 0x1, 0x0, 0xc}]}}}, @NFTA_SET_ELEM_FLAGS={0x8, 0x3, 0x1, 0x0, 0x1}]}, {0xe0, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x72}, @NFTA_SET_ELEM_TIMEOUT={0xc, 0x4, 0x1, 0x0, 0xe2}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x5}, @NFTA_SET_ELEM_EXPRESSIONS={0xb8, 0xb, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, @last={{0x9}, @void}}, {0x2c, 0x1, 0x0, 0x1, @masq={{0x9}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x9}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0x16}, @NFTA_MASQ_REG_PROTO_MAX={0x8, 0x3, 0x1, 0x0, 0xa}]}}}, {0x58, 0x1, 0x0, 0x1, @lookup={{0xb}, @val={0x48, 0x2, 0x0, 0x1, [@NFTA_LOOKUP_FLAGS={0x8}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz1\x00'}, @NFTA_LOOKUP_FLAGS={0x8, 0x5, 0x1, 0x0, 0x1}, @NFTA_LOOKUP_DREG={0x8, 0x3, 0x1, 0x0, 0xb}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz0\x00'}, @NFTA_LOOKUP_SET={0x9, 0x1, 'syz2\x00'}, @NFTA_LOOKUP_SREG={0x8, 0x2, 0x1, 0x0, 0x14}]}}}, {0x20, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_OSF_TTL={0x5}, @NFTA_OSF_TTL={0x5, 0x2, 0x42}]}}}]}]}]}, @NFTA_SET_ELEM_LIST_ELEMENTS={0x598, 0x3, 0x0, 0x1, [{0x594, 0x0, 0x0, 0x1, [@NFTA_SET_ELEM_DATA={0x4}, @NFTA_SET_ELEM_DATA={0xa8, 0x2, 0x0, 0x1, [@NFTA_DATA_VALUE={0x32, 0x1, "6ec1c656454b338af943d48a64fb8625f843deeef41219d17897ca4b861480b2c7b0abec0a998fc0e03945f624c5"}, @NFTA_DATA_VERDICT={0x34, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz0\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffb}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VALUE={0x2f, 0x1, "2dea58ae483d87bc9169ecf0b8f643d131240acf7fd02e1c1d397ca89c2f8606d8c89887b2324f044fc479"}, @NFTA_DATA_VERDICT={0xc, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x9}, @NFTA_SET_ELEM_USERDATA={0xdd, 0x6, 0x1, 0x0, "bbb536f4b1190b337026e4afa5cc9fa22101d2a8714d42be57585bf81d44d34e64b240863a293257d059840dde8b789a09b42ba78f5755ae623e1d60a3d8427816e5cc24cc61131e967ad9638512d1635ecdedc00e366ff9c735ed2dd5752cce77352a0596510b8f66d2ae3fd8bada2ea4e740a2cfd0b2be4f23efe1cbef7d4accc2f12f2204de7b2bfcade4008706f33cb6de5acd350f6287af87ce5c7fc678f488b950d7b104542b2e9f8879937253a8c8751391eb805e7895eaee5460341ad847230cc551cf0232c0241d9cc9a05cc8ce3cd6670a60e0f4"}, @NFTA_SET_ELEM_EXPRESSIONS={0x12c, 0xb, 0x0, 0x1, [{0x1c, 0x1, 0x0, 0x1, @exthdr={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_EXTHDR_OFFSET={0x8, 0x3, 0x1, 0x0, 0x75}]}}}, {0x20, 0x1, 0x0, 0x1, @dup={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xe}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x7}]}}}, {0x1c, 0x1, 0x0, 0x1, @target={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_TARGET_REV={0x8}]}}}, {0x38, 0x1, 0x0, 0x1, @rt={{0x7}, @val={0x2c, 0x2, 0x0, 0x1, [@NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x15}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0x65118f5fdb9cb32b}, @NFTA_RT_DREG={0x8, 0x1, 0x1, 0x0, 0xb}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_RT_KEY={0x8, 0x2, 0x1, 0x0, 0x4}]}}}, {0x10, 0x1, 0x0, 0x1, @tunnel={{0xb}, @void}}, {0x40, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0x34, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x10}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xc}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x39}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_DUP_SREG_ADDR={0x8}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xc}]}}}, {0x48, 0x1, 0x0, 0x1, @dup_ipv6={{0x8}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_DUP_SREG_DEV={0x8}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x12}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0x13}, @NFTA_DUP_SREG_DEV={0x8, 0x2, 0x1, 0x0, 0xb}, @NFTA_DUP_SREG_ADDR={0x8, 0x1, 0x1, 0x0, 0xe}]}}}]}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x1}, @NFTA_SET_ELEM_USERDATA={0x99, 0x6, 0x1, 0x0, "812d4cbe46887decd3450232b920b4fa2ca26940464d03f2413c9121c29991aac4388cefc993048da21c7d2b92b4460aa37306b94257f0e61aeeae6a8a5e803bc3c14f9efe94d107dd7d3364f1b29612b70e204d3aaeac42e1d6de51b46954acc781d31b504e6eb67e5d489ca83a61bdfe74731a56a99039f433cfc7a345a0cd67fc3926f185c3c7f4e4f5a2ef74a351b769486cf0"}, @NFTA_SET_ELEM_EXPIRATION={0xc, 0x5, 0x1, 0x0, 0x8000000000000001}, @NFTA_SET_ELEM_TIMEOUT={0xc}, @NFTA_SET_ELEM_KEY_END={0x20c, 0xa, 0x0, 0x1, [@NFTA_DATA_VERDICT={0x20, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}]}, @NFTA_DATA_VALUE={0x92, 0x1, "d653ef3c6bf4457b5c03cb45b350e6908018c0383e8ed2054bcaf94efd9c252ce5002bfc00245b041fec827a6c4fbe62ac310e90ad541387b7605803a65da0c1dd88469d54fcf0dca64be987e6e546bb101c693c1901a8a9fbb822e288ab08d99765087db21e861bacc61dfcef54694780d3d055881aef1c4b48d7a153bb7ce657497a3d4e31654afa4b47b3fe77"}, @NFTA_DATA_VERDICT={0x24, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffc}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x4}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}]}, @NFTA_DATA_VERDICT={0x38, 0x2, 0x0, 0x1, [@NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CHAIN_ID={0x8, 0x3, 0x1, 0x0, 0x3}, @NFTA_VERDICT_CHAIN={0x9, 0x2, 'syz1\x00'}, @NFTA_VERDICT_CODE={0x8, 0x1, 0x0, 0x1, 0xfffffffffffffffd}]}, @NFTA_DATA_VALUE={0xf7, 0x1, "40c2742304258e4747fec015adebf78f0785edd493f243d4d53a59d4b4c4efac75550b6b468c9f9d9489756464b475f8a88329623a658b362a18a3b0e97b620a2e994f9fca180cd57c9f03833755321cc63fdd780aa787072177f1901ccbc57472917b10b5687edb7342c48f1514bfb7d4aa0fa864f84730c08804ad124b96876fc5a446c9ef45122cd7b82de161d8ad879fea2493c01912898a87c42400c5f07ae86220eeba1968cd74f866a3cf73fc6ab29397b891cf31eb4ba415fe1e42a8db3b5c13097e9e1aa38889369f5538ac70691292570fab5ff147b567ffe5ea7a695d616331a2d329c91b8f94bed5d0e9a2da8c"}]}]}]}, @NFTA_SET_ELEM_LIST_SET_ID={0x8, 0x4, 0x1, 0x0, 0x1}]}, @NFT_MSG_DELCHAIN={0x2c, 0x5, 0xa, 0x801, 0x0, 0x0, {0xa, 0x0, 0x3}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_CHAIN_HANDLE={0xc, 0x2, 0x1, 0x0, 0x5}]}, @NFT_MSG_DELFLOWTABLE={0x40, 0x18, 0xa, 0x801, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_HANDLE={0xc, 0x5, 0x1, 0x0, 0x4}, @NFTA_FLOWTABLE_FLAGS={0x8, 0x7, 0x1, 0x0, 0x3}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz1\x00'}]}, @NFT_MSG_NEWOBJ={0x20, 0x12, 0xa, 0x5, 0x0, 0x0, {0x0, 0x0, 0x9}, @NFT_OBJECT_CT_TIMEOUT=@NFTA_OBJ_HANDLE={0xc, 0x6, 0x1, 0x0, 0x3}}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x7}}}, 0x1278}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 394.411268ms ago: executing program 5 (id=3887): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_CAP_X86_DISABLE_EXITS(r2, 0x4068aea3, &(0x7f0000000200)={0xc4, 0x0, 0x4}) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000600)=@newlink={0x3c, 0x10, 0x401, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x2000, 0x200}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @erspan={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_REMOTE={0x8, 0x7, @empty}]}}}]}, 0x3c}}, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000040), 0x1c1341, 0x0) r3 = socket$kcm(0xa, 0x5, 0x0) ioctl$sock_kcm_SIOCKCMCLONE(r3, 0x890c, &(0x7f0000000000)) 61.605071ms ago: executing program 7 (id=3888): r0 = syz_open_dev$vbi(&(0x7f0000000b80), 0x2, 0x2) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000004b00)={0x4, @pix_mp={0x86f9, 0xffffc000, 0x56555959, 0x0, 0x9, [{0x1, 0x3}, {0xfffffffb, 0x3399}, {0xfff, 0x6}, {0x2, 0x5}, {0x7, 0x80000001}, {0x1, 0x6}, {0x40008000, 0xfffffff9}, {0x800, 0x200}], 0xfd, 0x0, 0x2, 0x0, 0x4}}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) r2 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x46d, 0xc20e, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0xb}}}}]}}]}}, 0x0) syz_usb_control_io(r2, 0x0, 0x0) syz_usb_control_io$hid(r2, &(0x7f0000000000)={0x81, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0xb, {[@main=@item_012={0x0, 0x0, 0xa, "02"}, @global=@item_012={0x0, 0x1, 0x3}, @global=@item_4={0x3, 0x1, 0xa, "a27dd0e2"}]}}, 0x0}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWFLOWTABLE={0x40, 0x16, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x14, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_NUM={0x8}, @NFTA_FLOWTABLE_HOOK_PRIORITY={0x8}]}]}, @NFT_MSG_DELFLOWTABLE={0x48, 0x18, 0xa, 0x101, 0xb00, 0x0, {0x1}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOWTABLE_HOOK={0x1c, 0x3, 0x0, 0x1, [@NFTA_FLOWTABLE_HOOK_DEVS={0x18, 0x3, 0x0, 0x1, [{0x14, 0x1, 'geneve0\x00'}]}]}]}], {0x14, 0x10}}, 0xd0}}, 0x0) 61.277867ms ago: executing program 9 (id=3889): bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000d00), 0xf000, 0x10002, 0x0) recvmsg$kcm(0xffffffffffffffff, 0x0, 0x12000) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x98}, 0x1, 0x0, 0x0, 0x24044810}, 0x40804) syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000400)={'wlan0\x00'}) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e04026d320803d508e438694435c9f98d33b73cb527c6e668"], 0x7) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8c}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e23}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_init_net_socket$x25(0x9, 0x5, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x6) r6 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000006", @ANYBLOB], 0x66) r7 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0c000000040000000400000009"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000024c0), &(0x7f0000001280), 0xffffffff, r7, 0x0, 0x300}, 0x38) 0s ago: executing program 0 (id=3890): lstat(0x0, 0x0) mount$fuse(0x0, 0x0, 0x0, 0x2000000, 0x0) r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)={0x18, 0x14, 0x1, 0x70bd29, 0x0, "", [@typed={0x8, 0xae, 0x0, 0x0, @fd}]}, 0x18}], 0x1}, 0x0) r1 = socket$alg(0x26, 0x5, 0x0) accept4(r1, 0x0, 0x0, 0x80000) bind$alg(r1, 0x0, 0x0) write$FUSE_NOTIFY_STORE(0xffffffffffffffff, &(0x7f0000000000)={0x28, 0x4, 0x0, {0x1, 0xefff}}, 0x28) syz_open_dev$MSR(0x0, 0x0, 0x0) r2 = userfaultfd(0x801) r3 = bpf$MAP_CREATE(0x0, 0x0, 0x0) unshare(0x2c020400) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000040)=@base={0xd, 0x20000, 0x4, 0x3, 0x141, r3, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000001c0)={0x0, 0x0, 0x0, &(0x7f0000001280), 0x2, r4}, 0x38) ioctl$UFFDIO_API(r2, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x6b4}) ioctl$UFFDIO_REGISTER(r2, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x2}) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0x5, &(0x7f00000027c0)=ANY=[@ANYBLOB="180000000000000000000000ff000000850000000f00000085"], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x5, @void, @value}, 0x94) syz_genetlink_get_family_id$nfc(&(0x7f0000000200), 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000001a40)=""/102392, 0x18ff8) r6 = syz_init_net_socket$x25(0x9, 0x5, 0x0) listen(r6, 0x40000) setsockopt$sock_timeval(r6, 0x1, 0x42, &(0x7f0000000000)={0x0, 0xea60}, 0x10) sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000001700)={0x0, 0x0, &(0x7f00000016c0)={0x0}, 0x1, 0x0, 0x0, 0x4000841}, 0x1) accept(r6, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) kernel console output (not intermixed with test programs): sadm_r:sysadm_t tclass=io_uring permissive=1 [ 1171.881508][ T5896] usb 9-1: device descriptor read/64, error -71 [ 1171.909276][T18833] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3417'. [ 1171.975296][ T5138] Bluetooth: hci3: command tx timeout [ 1172.614019][ T5896] usb usb9-port1: attempt power cycle [ 1172.654981][T18761] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1172.669893][ T5931] usb 8-1: USB disconnect, device number 30 [ 1172.703392][T18761] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1172.755441][T18761] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1172.928478][T18761] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1174.006780][ T5138] Bluetooth: hci3: command tx timeout [ 1175.650133][T18761] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1175.672349][T18761] 8021q: adding VLAN 0 to HW filter on device team0 [ 1175.691027][T16434] bridge0: port 1(bridge_slave_0) entered blocking state [ 1175.698146][T16434] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1175.757490][T18866] binder: 18865:18866 ioctl c0306201 2000000003c0 returned -14 [ 1175.758689][ T8002] bridge0: port 2(bridge_slave_1) entered blocking state [ 1175.772192][ T8002] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1175.826566][T18866] binder: 18865:18866 ioctl c0306201 200000001440 returned -11 [ 1175.864344][T18761] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1175.897911][T18866] binder: 18865:18866 ioctl 40045010 2000000004c0 returned -22 [ 1175.911262][T18761] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1176.099300][T18761] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1176.246832][T13682] usb 8-1: new high-speed USB device number 31 using dummy_hcd [ 1176.274457][T18761] veth0_vlan: entered promiscuous mode [ 1176.284701][T18761] veth1_vlan: entered promiscuous mode [ 1176.308128][T18761] veth0_macvtap: entered promiscuous mode [ 1176.316320][T18761] veth1_macvtap: entered promiscuous mode [ 1176.333975][T18761] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1176.346405][T18761] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1176.363081][T18761] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1176.371948][T18761] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1176.381232][T18761] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1176.389994][T18761] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1176.417216][T13682] usb 8-1: Using ep0 maxpacket: 8 [ 1176.437000][T13682] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1176.481297][T13682] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1176.493527][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1176.504932][T13682] usb 8-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1176.519681][T13682] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1176.520286][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1176.533966][T13682] usb 8-1: config 0 descriptor?? [ 1176.593675][ T8405] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1176.611391][ T8405] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1176.890992][T18891] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1177.031778][T13682] logitech 0003:046D:C20E.0053: rdesc size test failed for formula gp [ 1177.112543][T13682] logitech 0003:046D:C20E.0053: unknown main item tag 0x0 [ 1177.147478][T13682] logitech 0003:046D:C20E.0053: reserved main item tag 0xe [ 1177.172364][T13682] logitech 0003:046D:C20E.0053: unknown main item tag 0x0 [ 1177.189917][T13682] logitech 0003:046D:C20E.0053: unbalanced collection at end of report description [ 1177.362415][T13682] logitech 0003:046D:C20E.0053: parse failed [ 1178.368867][T13682] logitech 0003:046D:C20E.0053: probe with driver logitech failed with error -22 [ 1178.924827][T18903] FAULT_INJECTION: forcing a failure. [ 1178.924827][T18903] name failslab, interval 1, probability 0, space 0, times 0 [ 1178.969259][T18903] CPU: 0 UID: 0 PID: 18903 Comm: syz.9.3432 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1178.969286][T18903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1178.969297][T18903] Call Trace: [ 1178.969303][T18903] [ 1178.969310][T18903] dump_stack_lvl+0x16c/0x1f0 [ 1178.969343][T18903] should_fail_ex+0x512/0x640 [ 1178.969366][T18903] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1178.969392][T18903] should_failslab+0xc2/0x120 [ 1178.969417][T18903] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1178.969437][T18903] ? __alloc_skb+0x166/0x380 [ 1178.969459][T18903] ? netlink_alloc_large_skb+0x69/0x130 [ 1178.969477][T18903] ? __alloc_skb+0x2b2/0x380 [ 1178.969500][T18903] ? do_syscall_64+0xcd/0x4c0 [ 1178.969528][T18903] __alloc_skb+0x2b2/0x380 [ 1178.969550][T18903] ? __pfx___alloc_skb+0x10/0x10 [ 1178.969582][T18903] netlink_ack+0x15d/0xb80 [ 1178.969602][T18903] ? __lock_acquire+0x622/0x1c90 [ 1178.969634][T18903] rdma_nl_rcv_skb.constprop.0.isra.0+0x330/0x430 [ 1178.969665][T18903] ? __pfx_rdma_nl_rcv_skb.constprop.0.isra.0+0x10/0x10 [ 1178.969701][T18903] ? netlink_deliver_tap+0x1ae/0xd30 [ 1178.969718][T18903] ? is_vmalloc_addr+0x86/0xa0 [ 1178.969745][T18903] netlink_unicast+0x53d/0x7f0 [ 1178.969764][T18903] ? __pfx_netlink_unicast+0x10/0x10 [ 1178.969789][T18903] netlink_sendmsg+0x8d1/0xdd0 [ 1178.969810][T18903] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1178.969836][T18903] ____sys_sendmsg+0xa98/0xc70 [ 1178.969856][T18903] ? copy_msghdr_from_user+0x10a/0x160 [ 1178.969879][T18903] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1178.969908][T18903] ___sys_sendmsg+0x134/0x1d0 [ 1178.969934][T18903] ? __pfx____sys_sendmsg+0x10/0x10 [ 1178.969958][T18903] ? __lock_acquire+0x622/0x1c90 [ 1178.970013][T18903] __sys_sendmsg+0x16d/0x220 [ 1178.970040][T18903] ? __pfx___sys_sendmsg+0x10/0x10 [ 1178.970088][T18903] do_syscall_64+0xcd/0x4c0 [ 1178.970114][T18903] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1178.970131][T18903] RIP: 0033:0x7f0784b8e929 [ 1178.970147][T18903] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1178.970164][T18903] RSP: 002b:00007f0785982038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1178.970182][T18903] RAX: ffffffffffffffda RBX: 00007f0784db5fa0 RCX: 00007f0784b8e929 [ 1178.970194][T18903] RDX: 0000000000008050 RSI: 00002000000000c0 RDI: 0000000000000003 [ 1178.970208][T18903] RBP: 00007f0785982090 R08: 0000000000000000 R09: 0000000000000000 [ 1178.970219][T18903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1178.970230][T18903] R13: 0000000000000000 R14: 00007f0784db5fa0 R15: 00007ffeddfee3c8 [ 1178.970253][T18903] [ 1179.237180][ C0] vkms_vblank_simulate: vblank timer overrun [ 1179.447743][ T944] usb 8-1: USB disconnect, device number 31 [ 1179.888406][T18918] lo speed is unknown, defaulting to 1000 [ 1179.901675][T18918] lo speed is unknown, defaulting to 1000 [ 1180.253676][T18907] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1181.122349][T18938] gfs2: gfs2 mount does not exist [ 1181.702229][ T30] audit: type=1326 audit(1749594313.900:1395): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=18935 comm="syz.0.3441" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9dc4d8e929 code=0x7fc00000 [ 1181.920413][ T5138] Bluetooth: hci5: unexpected event for opcode 0x326d [ 1182.224286][T18950] netlink: 8 bytes leftover after parsing attributes in process `syz.9.3445'. [ 1182.417840][T18955] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1182.552913][T18950] dummy0: entered promiscuous mode [ 1182.571122][T18950] gretap0: entered promiscuous mode [ 1182.614117][T18956] bridge0: port 2(bridge_slave_1) entered disabled state [ 1182.821883][T18960] netlink: 72 bytes leftover after parsing attributes in process `syz.9.3448'. [ 1182.838145][T18960] delete_channel: no stack [ 1183.222720][T18964] syz.0.3449 (18964): drop_caches: 2 [ 1183.238383][T18968] netlink: 24 bytes leftover after parsing attributes in process `syz.7.3451'. [ 1183.396671][ T944] usb 9-1: new high-speed USB device number 35 using dummy_hcd [ 1184.196778][ T944] usb 9-1: device descriptor read/64, error -71 [ 1184.209673][T18964] syz.0.3449 (18964): drop_caches: 2 [ 1184.442279][T18964] tmpfs: Unknown parameter 'quota11' [ 1184.447770][ T944] usb 9-1: new high-speed USB device number 36 using dummy_hcd [ 1184.726684][ T30] audit: type=1400 audit(1749594316.630:1396): avc: denied { mount } for pid=18962 comm="syz.0.3449" name="/" dev="rpc_pipefs" ino=67158 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:rpc_pipefs_t tclass=filesystem permissive=1 [ 1184.893396][ T944] usb 9-1: device descriptor read/64, error -71 [ 1185.099736][ T944] usb usb9-port1: attempt power cycle [ 1185.132046][T10049] usb 8-1: new high-speed USB device number 32 using dummy_hcd [ 1185.179893][ T30] audit: type=1400 audit(1749594317.340:1397): avc: denied { write } for pid=18978 comm="syz.5.3456" lport=37282 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1185.366965][T10049] usb 8-1: Using ep0 maxpacket: 32 [ 1185.389674][T10049] usb 8-1: config 0 has an invalid interface number: 85 but max is 0 [ 1185.415776][ T30] audit: type=1400 audit(1749594317.340:1398): avc: denied { setopt } for pid=18978 comm="syz.5.3456" lport=37282 faddr=::ffff:172.20.255.187 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=sctp_socket permissive=1 [ 1185.486804][T10049] usb 8-1: config 0 has no interface number 0 [ 1185.540351][ T944] usb 9-1: new high-speed USB device number 37 using dummy_hcd [ 1185.562670][T10049] usb 8-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1185.663999][ T944] usb 9-1: device descriptor read/8, error -71 [ 1185.685631][T10049] usb 8-1: config 0 interface 85 has no altsetting 0 [ 1185.705008][ T30] audit: type=1400 audit(1749594317.340:1399): avc: denied { map } for pid=18978 comm="syz.5.3456" path="/4/file0" dev="tmpfs" ino=38 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=dir permissive=1 [ 1185.789900][T10049] usb 8-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1185.897671][T10049] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1186.006957][ T944] usb 9-1: new high-speed USB device number 38 using dummy_hcd [ 1186.035807][T10049] usb 8-1: Product: syz [ 1186.041337][T10049] usb 8-1: Manufacturer: syz [ 1186.136780][T10049] usb 8-1: SerialNumber: syz [ 1186.192450][T10049] usb 8-1: config 0 descriptor?? [ 1186.272345][ T944] usb 9-1: device descriptor read/8, error -71 [ 1186.300410][T18987] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1186.427042][ T944] usb usb9-port1: unable to enumerate USB device [ 1188.104455][T10049] appletouch 8-1:0.85: Geyser mode initialized. [ 1188.262475][T10049] input: appletouch as /devices/platform/dummy_hcd.7/usb8/8-1/8-1:0.85/input/input55 [ 1188.399098][ C0] appletouch 8-1:0.85: appletouch: OVERFLOW with data length 64, actual length is 64 [ 1188.410509][ T5138] Bluetooth: hci3: command tx timeout [ 1188.661019][T18981] netlink: 'syz.7.3454': attribute type 10 has an invalid length. [ 1189.140113][T18981] bridge0: port 2(bridge_slave_1) entered disabled state [ 1189.147465][T18981] bridge0: port 1(bridge_slave_0) entered disabled state [ 1189.216079][T18981] bridge0: port 2(bridge_slave_1) entered blocking state [ 1189.223209][T18981] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1189.230560][T18981] bridge0: port 1(bridge_slave_0) entered blocking state [ 1189.237636][T18981] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1189.254489][T18981] bridge0: entered promiscuous mode [ 1189.260949][T18981] bond0: (slave bridge0): Enslaving as an active interface with an up link [ 1189.409944][ T5931] usb 8-1: USB disconnect, device number 32 [ 1189.545352][ T5931] appletouch 8-1:0.85: input: appletouch disconnected [ 1190.274999][ T30] audit: type=1400 audit(1749594322.470:1400): avc: denied { setattr } for pid=19032 comm="syz.0.3472" name="RFCOMM" dev="sockfs" ino=67348 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=bluetooth_socket permissive=1 [ 1190.492377][T19036] ucma_write: process 356 (syz.0.3472) changed security contexts after opening file descriptor, this is not allowed. [ 1190.826697][ T5882] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 1190.856941][T19045] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1191.008195][ T5882] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 1191.025807][ T5882] usb 10-1: config 0 has no interface number 0 [ 1191.043800][ T5882] usb 10-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1191.053239][ T5882] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1191.061711][ T5882] usb 10-1: Product: syz [ 1191.066269][ T5882] usb 10-1: Manufacturer: syz [ 1191.077137][ T5882] usb 10-1: SerialNumber: syz [ 1191.084712][ T5882] usb 10-1: config 0 descriptor?? [ 1191.357597][ T5882] usb 10-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1191.498927][ T5882] usb 10-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1191.632326][ T5882] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1191.655198][T19061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3482'. [ 1191.675230][ T5882] usb 10-1: media controller created [ 1191.706316][ T5882] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1191.732156][T19061] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3482'. [ 1191.759545][T19061] nfs: Unknown parameter '$' [ 1191.783875][T19061] siw: device registration error -23 [ 1191.831994][ T30] audit: type=1400 audit(1749594324.030:1401): avc: denied { name_bind 0x1000000 } for pid=19065 comm="syz.7.3485" path="socket:[67469]" dev="sockfs" ino=67469 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=unix_dgram_socket permissive=1 [ 1191.857145][ C0] vkms_vblank_simulate: vblank timer overrun [ 1192.178388][ T944] usb 6-1: new high-speed USB device number 112 using dummy_hcd [ 1192.245744][ T5882] usb 10-1: USB disconnect, device number 8 [ 1192.325286][T19077] No source specified [ 1192.401526][T19065] fanotify: failed to encode fid (type=0, len=0, err=-2) [ 1192.411140][ T944] usb 6-1: New USB device found, idVendor=093a, idProduct=050f, bcdDevice=c2.b7 [ 1192.426778][ T944] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1192.447609][ T944] gspca_main: mars-2.14.0 probing 093a:050f [ 1193.480776][T19097] lo speed is unknown, defaulting to 1000 [ 1193.560134][T19099] CIFS: Unable to determine destination address [ 1193.667641][T19097] lo speed is unknown, defaulting to 1000 [ 1194.757024][T15315] usb 8-1: new high-speed USB device number 33 using dummy_hcd [ 1194.816127][T19110] FAULT_INJECTION: forcing a failure. [ 1194.816127][T19110] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1194.829610][T19110] CPU: 1 UID: 0 PID: 19110 Comm: syz.8.3495 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1194.829635][T19110] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1194.829646][T19110] Call Trace: [ 1194.829653][T19110] [ 1194.829660][T19110] dump_stack_lvl+0x16c/0x1f0 [ 1194.829692][T19110] should_fail_ex+0x512/0x640 [ 1194.829721][T19110] _copy_from_user+0x2e/0xd0 [ 1194.829748][T19110] copy_msghdr_from_user+0x98/0x160 [ 1194.829775][T19110] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1194.829823][T19110] ___sys_sendmsg+0xfe/0x1d0 [ 1194.829852][T19110] ? __pfx____sys_sendmsg+0x10/0x10 [ 1194.829876][T19110] ? __lock_acquire+0x622/0x1c90 [ 1194.829942][T19110] __sys_sendmsg+0x16d/0x220 [ 1194.829970][T19110] ? __pfx___sys_sendmsg+0x10/0x10 [ 1194.830016][T19110] do_syscall_64+0xcd/0x4c0 [ 1194.830047][T19110] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1194.830067][T19110] RIP: 0033:0x7eff0378e929 [ 1194.830081][T19110] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1194.830099][T19110] RSP: 002b:00007eff04598038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1194.830117][T19110] RAX: ffffffffffffffda RBX: 00007eff039b6080 RCX: 00007eff0378e929 [ 1194.830129][T19110] RDX: 0000000000000010 RSI: 0000200000000780 RDI: 0000000000000005 [ 1194.830140][T19110] RBP: 00007eff04598090 R08: 0000000000000000 R09: 0000000000000000 [ 1194.830151][T19110] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1194.830162][T19110] R13: 0000000000000000 R14: 00007eff039b6080 R15: 00007fff3f864778 [ 1194.830186][T19110] [ 1195.019085][T15320] Bluetooth: hci3: command 0x0405 tx timeout [ 1195.027749][T15315] usb 8-1: Using ep0 maxpacket: 8 [ 1195.044495][T15315] usb 8-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 131, changing to 11 [ 1195.064628][T15315] usb 8-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 1195.075042][T15315] usb 8-1: config 1 interface 0 altsetting 4 bulk endpoint 0x3 has invalid maxpacket 16 [ 1195.116722][T15315] usb 8-1: config 1 interface 0 has no altsetting 0 [ 1195.126237][T15315] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1195.148692][T15315] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1195.165119][T15315] usb 8-1: Product: 쮟밭羦äšè‹½èŽ¯ì¯³å¶€ë‹½âŠ—ìˆæ±­íŠ¯â‚©ê‹¸é ½ã§æ¿´à³í쳃ꃭ葦뒲Ꮂ宮ï’êªî¶ƒì£î ‰éˆ§æˆ»å¡«ç¢©ã”¨ç”¢é‡®é™¬æ¨‚勸 [ 1195.188320][T15315] usb 8-1: Manufacturer: ࡃ [ 1195.192939][T15315] usb 8-1: SerialNumber: syz [ 1195.286875][ T5882] usb 9-1: new high-speed USB device number 39 using dummy_hcd [ 1195.324084][T19104] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1195.331541][T19104] raw-gadget.0 gadget.7: fail, usb_ep_enable returned -22 [ 1195.402996][ T5931] usb 6-1: USB disconnect, device number 112 [ 1195.420922][T19116] SELinux: policydb magic number 0x8646e69 does not match expected magic number 0xf97cff8c [ 1195.437272][T19116] SELinux: failed to load policy [ 1195.471055][ T5882] usb 9-1: Using ep0 maxpacket: 8 [ 1195.478586][ T5882] usb 9-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 131, changing to 11 [ 1195.494249][ T5882] usb 9-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 1195.505959][ T5882] usb 9-1: config 1 interface 0 altsetting 4 bulk endpoint 0x3 has invalid maxpacket 16 [ 1195.520800][ T5882] usb 9-1: config 1 interface 0 has no altsetting 0 [ 1195.535883][ T5882] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1195.549162][ T5882] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1195.563048][ T5882] usb 9-1: Product: 쮟밭羦äšè‹½èŽ¯ì¯³å¶€ë‹½âŠ—ìˆæ±­íŠ¯â‚©ê‹¸é ½ã§æ¿´à³í쳃ꃭ葦뒲Ꮂ宮ï’êªî¶ƒì£î ‰éˆ§æˆ»å¡«ç¢©ã”¨ç”¢é‡®é™¬æ¨‚勸 [ 1195.587145][ T5882] usb 9-1: Manufacturer: ࡃ [ 1195.591820][ T5882] usb 9-1: SerialNumber: syz [ 1195.596774][T10049] usb 10-1: new high-speed USB device number 9 using dummy_hcd [ 1195.604919][T19110] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1195.612239][T19110] raw-gadget.2 gadget.8: fail, usb_ep_enable returned -22 [ 1195.719226][T13682] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 1195.862977][T10049] usb 10-1: Using ep0 maxpacket: 8 [ 1195.951193][T13682] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 2 [ 1195.986552][T13682] usb 1-1: config 1 has no interface number 0 [ 1196.033733][T13682] usb 1-1: config 1 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1196.126868][T13682] usb 1-1: Duplicate descriptor for config 1 interface 1 altsetting 0, skipping [ 1196.158295][T10049] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1196.182053][T10049] usb 10-1: config 1 interface 0 altsetting 4 endpoint 0x81 has an invalid bInterval 131, changing to 11 [ 1196.193916][T10049] usb 10-1: config 1 interface 0 altsetting 4 bulk endpoint 0x82 has invalid maxpacket 64 [ 1196.204139][T10049] usb 10-1: config 1 interface 0 altsetting 4 bulk endpoint 0x3 has invalid maxpacket 16 [ 1196.227670][T13682] usb 1-1: config 1 interface 1 altsetting 1 endpoint 0x3 has invalid maxpacket 28518, setting to 64 [ 1196.247349][T13682] usb 1-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1196.257307][T13682] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1196.268115][T13682] usb 1-1: Product: syz [ 1196.274992][T13682] usb 1-1: Manufacturer: syz [ 1196.281252][T13682] usb 1-1: SerialNumber: syz [ 1196.521923][T10049] usb 10-1: config 1 interface 0 has no altsetting 0 [ 1196.530992][T10049] usb 10-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1196.540264][T10049] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1196.548570][T10049] usb 10-1: Product: 쮟밭羦äšè‹½èŽ¯ì¯³å¶€ë‹½âŠ—ìˆæ±­íŠ¯â‚©ê‹¸é ½ã§æ¿´à³í쳃ꃭ葦뒲Ꮂ宮ï’êªî¶ƒì£î ‰éˆ§æˆ»å¡«ç¢©ã”¨ç”¢é‡®é™¬æ¨‚勸 [ 1196.563684][T10049] usb 10-1: Manufacturer: ࡃ [ 1196.570836][T10049] usb 10-1: SerialNumber: syz [ 1196.582712][T19114] raw-gadget.3 gadget.9: fail, usb_ep_enable returned -22 [ 1196.590148][T19114] raw-gadget.3 gadget.9: fail, usb_ep_enable returned -22 [ 1196.667451][T15315] cdc_ether 8-1:1.0: probe with driver cdc_ether failed with error -71 [ 1196.694015][T15315] usb 8-1: USB disconnect, device number 33 [ 1196.866821][ T5896] usb 6-1: new high-speed USB device number 113 using dummy_hcd [ 1197.105808][ T5896] usb 6-1: Using ep0 maxpacket: 8 [ 1197.164381][ T5896] usb 6-1: config 224 has an invalid interface number: 207 but max is 0 [ 1197.402464][ T5896] usb 6-1: config 224 has no interface number 0 [ 1197.411582][T13682] cdc_ncm 1-1:1.1: bind() failure [ 1197.428286][ T5896] usb 6-1: config 224 interface 207 has no altsetting 0 [ 1197.914142][ T5882] cdc_ether 9-1:1.0: probe with driver cdc_ether failed with error -71 [ 1197.929046][ T5882] usb 9-1: USB disconnect, device number 39 [ 1197.973633][ T5896] usb 6-1: New USB device found, idVendor=17ef, idProduct=721e, bcdDevice=b4.6f [ 1197.983255][T16634] usb 1-1: USB disconnect, device number 6 [ 1197.989256][ T5896] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1198.019856][ T5896] usb 6-1: Product: syz [ 1198.024085][ T5896] usb 6-1: Manufacturer: syz [ 1198.066784][ T5896] usb 6-1: SerialNumber: syz [ 1198.107569][ T5896] r8152-cfgselector 6-1: Unknown version 0x0000 [ 1198.213453][T10049] cdc_ether 10-1:1.0: probe with driver cdc_ether failed with error -71 [ 1198.231557][T10049] usb 10-1: USB disconnect, device number 9 [ 1198.308077][T19141] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1198.345029][ T5896] r8152-cfgselector 6-1: Unknown version 0x0000 [ 1198.351942][T19141] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1198.353850][ T5896] r8152-cfgselector 6-1: bad CDC descriptors [ 1198.372978][ T5896] r8152-cfgselector 6-1: USB disconnect, device number 113 [ 1198.469388][T19141] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1198.485816][T19141] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1198.512187][T19141] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 1198.638212][T19153] gfs2: gfs2 mount does not exist [ 1200.565557][T15320] Bluetooth: hci5: command 0x0c1a tx timeout [ 1200.571746][T15320] Bluetooth: hci2: command 0x0c1a tx timeout [ 1200.578229][ T5138] Bluetooth: hci3: command 0x0405 tx timeout [ 1200.834765][T19177] xt_l2tp: v2 sid > 0xffff: 262144 [ 1201.476666][T13682] usb 6-1: new full-speed USB device number 114 using dummy_hcd [ 1201.550281][T19189] netlink: 'syz.8.3517': attribute type 33 has an invalid length. [ 1201.662987][T13682] usb 6-1: config 0 has an invalid interface number: 41 but max is 0 [ 1201.774382][T13682] usb 6-1: config 0 has no interface number 0 [ 1201.851161][T19190] binder: 19186:19190 ioctl c0306201 200000000180 returned -22 [ 1201.864726][T13682] usb 6-1: config 0 interface 41 has no altsetting 0 [ 1202.041769][T13682] usb 6-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a [ 1202.054062][T13682] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1202.065253][T13682] usb 6-1: Product: syz [ 1202.071577][T13682] usb 6-1: Manufacturer: syz [ 1202.079325][T13682] usb 6-1: SerialNumber: syz [ 1202.646937][T15320] Bluetooth: hci3: command 0x0405 tx timeout [ 1202.653860][T13682] usb 6-1: config 0 descriptor?? [ 1202.672362][T19195] xt_connbytes: Forcing CT accounting to be enabled [ 1202.679044][T19195] set match dimension is over the limit! [ 1203.596762][T15320] Bluetooth: hci5: unexpected event for opcode 0x0413 [ 1204.477325][T19181] netlink: 12 bytes leftover after parsing attributes in process `syz.5.3514'. [ 1204.766786][T15320] Bluetooth: hci3: command 0x0405 tx timeout [ 1204.839707][T19181] netlink: 'syz.5.3514': attribute type 2 has an invalid length. [ 1204.847711][T19181] netlink: 36 bytes leftover after parsing attributes in process `syz.5.3514'. [ 1206.210900][T13682] CoreChips 6-1:0.41: probe with driver CoreChips failed with error -71 [ 1206.231244][T13682] usb 6-1: USB disconnect, device number 114 [ 1206.321671][T19234] netlink: 'syz.9.3531': attribute type 5 has an invalid length. [ 1206.497780][T19238] netlink: 28 bytes leftover after parsing attributes in process `syz.0.3532'. [ 1206.537521][T19238] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3532'. [ 1206.610363][ T30] audit: type=1400 audit(1749594338.800:1402): avc: denied { ioctl } for pid=19235 comm="syz.9.3533" path="socket:[67882]" dev="sockfs" ino=67882 ioctlcmd=0x9419 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=alg_socket permissive=1 [ 1206.915955][T19246] gfs2: gfs2 mount does not exist [ 1207.067029][T19250] SELinux: security_context_str_to_sid (staff_u) failed with errno=-22 [ 1207.611208][ T50] Bluetooth: hci5: Controller not accepting commands anymore: ncmd = 0 [ 1207.623800][ T50] Bluetooth: hci5: Injecting HCI hardware error event [ 1207.633757][ T50] Bluetooth: hci5: hardware error 0x00 [ 1207.656837][T13682] usb 8-1: new high-speed USB device number 34 using dummy_hcd [ 1207.673250][T19258] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1207.729845][ T5882] kernel read not supported for file /radio8 (pid: 5882 comm: kworker/1:5) [ 1207.741301][T19260] vivid-004: disconnect [ 1207.762904][T19257] vivid-004: reconnect [ 1207.819182][T13682] usb 8-1: Using ep0 maxpacket: 16 [ 1207.836372][T13682] usb 8-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1207.860637][T13682] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1207.896033][T13682] usb 8-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1207.910337][T13682] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1208.703885][T13682] usb 8-1: Product: syz [ 1208.716983][T13682] usb 8-1: Manufacturer: syz [ 1208.721608][T13682] usb 8-1: SerialNumber: syz [ 1208.770740][T19230] Process accounting resumed [ 1208.858031][T13682] usb 8-1: config 0 descriptor?? [ 1208.887267][T13682] em28xx 8-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1208.896531][T13682] em28xx 8-1:0.0: Audio interface 0 found (Vendor Class) [ 1209.006933][ T30] audit: type=1400 audit(1749594341.210:1403): avc: denied { accept } for pid=19272 comm="syz.5.3542" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=llc_socket permissive=1 [ 1209.166692][ T5882] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 1209.409604][T19281] batadv_slave_0: mtu less than device minimum [ 1209.696972][ T50] Bluetooth: hci5: Opcode 0x0c03 failed: -110 [ 1209.726668][ T5882] usb 10-1: Using ep0 maxpacket: 8 [ 1209.733379][ T5882] usb 10-1: config 0 has an invalid interface number: 226 but max is 0 [ 1209.745889][ T5882] usb 10-1: config 0 has no interface number 0 [ 1209.754750][ T5882] usb 10-1: New USB device found, idVendor=0e8d, idProduct=0033, bcdDevice=8e.9f [ 1209.765190][T13682] em28xx 8-1:0.0: unknown em28xx chip ID (0) [ 1209.772668][T16634] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1209.783764][T13682] em28xx 8-1:0.0: Config register raw data: 0x41 [ 1209.801855][ T5882] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1209.844761][ T5882] usb 10-1: Product: syz [ 1209.853140][ T5882] usb 10-1: Manufacturer: syz [ 1209.862662][ T5882] usb 10-1: SerialNumber: syz [ 1209.894899][ T5882] usb 10-1: config 0 descriptor?? [ 1209.913952][ T5882] option 10-1:0.226: GSM modem (1-port) converter detected [ 1209.939158][T16634] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1209.966712][T16634] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1209.977417][T16634] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1210.401742][T15315] usb 8-1: USB disconnect, device number 34 [ 1210.492585][T15315] em28xx 8-1:0.0: Disconnecting em28xx [ 1210.845751][T16634] usb 6-1: New USB device found, idVendor=056e, idProduct=00fd, bcdDevice=fc.00 [ 1210.857131][T16634] usb 6-1: New USB device strings: Mfr=148, Product=0, SerialNumber=0 [ 1210.865317][T16634] usb 6-1: Manufacturer: syz [ 1210.894940][T16634] usb 6-1: config 0 descriptor?? [ 1210.932940][T15315] em28xx 8-1:0.0: Freeing device [ 1210.982041][ T30] audit: type=1400 audit(1749594343.180:1404): avc: denied { shutdown } for pid=19266 comm="syz.9.3539" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1211.177210][T19276] netlink: 'syz.5.3543': attribute type 10 has an invalid length. [ 1211.185451][T19276] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3543'. [ 1211.200300][T19276] net veth1_virt_wifi virt_wifi0: entered promiscuous mode [ 1211.231069][T19276] net veth1_virt_wifi virt_wifi0: entered allmulticast mode [ 1211.338402][T19276] A link change request failed with some changes committed already. Interface virt_wifi0 may have been left with an inconsistent configuration, please check. [ 1211.356969][T19289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1211.417167][T19289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1211.698113][T19295] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1212.011337][T16634] elecom 0003:056E:00FD.0054: unknown main item tag 0x6 [ 1212.018816][T16634] elecom 0003:056E:00FD.0054: report_id 29495 is invalid [ 1212.029116][T16634] elecom 0003:056E:00FD.0054: item 0 2 1 8 parsing failed [ 1212.124708][T19290] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1212.168367][T16634] elecom 0003:056E:00FD.0054: probe with driver elecom failed with error -22 [ 1212.197109][T19290] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1213.047279][T19305] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1213.350828][T16634] usb 10-1: USB disconnect, device number 10 [ 1213.367887][T16634] option 10-1:0.226: device disconnected [ 1213.488595][T15315] usb 6-1: USB disconnect, device number 115 [ 1213.506688][T15320] Bluetooth: hci3: command 0x0405 tx timeout [ 1213.528997][ T30] audit: type=1400 audit(1749594345.730:1405): avc: denied { write } for pid=19312 comm="syz.9.3551" path="socket:[68052]" dev="sockfs" ino=68052 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1213.833155][T19318] gfs2: gfs2 mount does not exist [ 1214.176709][T15315] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 1214.346865][T15315] usb 1-1: Using ep0 maxpacket: 16 [ 1214.358558][T15315] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1214.379644][T15315] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1214.421799][T15315] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 1214.568808][T15315] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 1214.640858][T15315] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1214.696908][T16634] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 1214.699952][T19334] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1214.794728][T15315] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 1214.807423][T15315] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 1214.815445][T15315] usb 1-1: Manufacturer: syz [ 1214.828712][T15315] usb 1-1: config 0 descriptor?? [ 1214.888023][T16634] usb 10-1: config 0 has an invalid interface number: 69 but max is 0 [ 1214.916702][T16634] usb 10-1: config 0 has no interface number 0 [ 1214.923733][T16634] usb 10-1: config 0 interface 69 altsetting 0 bulk endpoint 0x8 has invalid maxpacket 1023 [ 1214.944431][T16634] usb 10-1: config 0 interface 69 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1214.972875][T16634] usb 10-1: New USB device found, idVendor=0c4b, idProduct=0100, bcdDevice=d7.ca [ 1214.983207][T19336] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1214.986104][T16634] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1215.307728][T16634] usb 10-1: Product: syz [ 1215.346687][T16634] usb 10-1: Manufacturer: syz [ 1215.356452][T16634] usb 10-1: SerialNumber: syz [ 1215.376458][T16634] usb 10-1: config 0 descriptor?? [ 1215.449850][T19332] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 1215.468482][T16634] cyberjack 10-1:0.69: Reiner SCT Cyberjack USB card reader converter detected [ 1215.489243][T16634] usb 10-1: Reiner SCT Cyberjack USB card reader converter now attached to ttyUSB0 [ 1215.510512][T19343] netdevsim netdevsim7 eth3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1215.582068][T19343] netdevsim netdevsim7 eth2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1216.532153][T19343] netdevsim netdevsim7 eth1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1216.727333][T19343] netdevsim netdevsim7 eth0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1216.819744][T19364] 9pnet_fd: p9_fd_create_tcp (19364): problem connecting socket to 127.0.0.1 [ 1216.820462][ T30] audit: type=1400 audit(1749594349.020:1406): avc: denied { mounton } for pid=19362 comm="syz.8.3566" path="/syzcgroup/cpu/syz8/cgroup.procs" dev="cgroup" ino=816 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cgroup_t tclass=file permissive=1 [ 1216.833281][T19343] netdevsim netdevsim7 eth0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1216.853347][ C1] vkms_vblank_simulate: vblank timer overrun [ 1216.936695][ T5882] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1216.952976][T19343] netdevsim netdevsim7 eth1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1217.015428][T19343] netdevsim netdevsim7 eth2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1217.048042][T15315] rc_core: IR keymap rc-hauppauge not found [ 1217.064669][T15315] Registered IR keymap rc-empty [ 1217.073411][T19343] netdevsim netdevsim7 eth3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1217.075343][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.117517][ T5882] usb 6-1: Using ep0 maxpacket: 32 [ 1217.117693][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.138834][ T5882] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1217.152973][ T5882] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1217.180642][T15315] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0 [ 1217.185147][ T5882] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1217.210739][T15315] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input57 [ 1217.250375][ T5882] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1217.257659][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.264188][ T5882] usb 6-1: SerialNumber: syz [ 1217.291527][T19376] batman_adv: batadv0: Adding interface: dummy0 [ 1217.303765][T19376] batman_adv: batadv0: The MTU of interface dummy0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1217.311091][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.348322][T19376] batman_adv: batadv0: Interface activated: dummy0 [ 1217.360807][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.389531][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.435779][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.467362][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.501532][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.508953][T10049] usb 8-1: new high-speed USB device number 35 using dummy_hcd [ 1217.620377][ T5896] usb 10-1: USB disconnect, device number 11 [ 1217.647124][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1217.661761][ T5896] cyberjack ttyUSB0: Reiner SCT Cyberjack USB card reader converter now disconnected from ttyUSB0 [ 1218.144761][ T5896] cyberjack 10-1:0.69: device disconnected [ 1218.156696][T10049] usb 8-1: Using ep0 maxpacket: 8 [ 1218.161830][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1218.173930][T10049] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1218.191532][T15315] mceusb 1-1:0.0: Error: mce write submit urb error = -90 [ 1218.207861][T10049] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1218.231878][T10049] usb 8-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1218.245142][T15315] mceusb 1-1:0.0: Registered with mce emulator interface version 1 [ 1218.266550][T10049] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1218.336873][T15315] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 1218.350954][T19390] netlink: 216 bytes leftover after parsing attributes in process `syz.9.3571'. [ 1218.367242][T10049] usb 8-1: config 0 descriptor?? [ 1218.391469][T15315] usb 1-1: USB disconnect, device number 7 [ 1219.027913][T10049] logitech 0003:046D:C20E.0055: rdesc size test failed for formula gp [ 1219.037811][T10049] logitech 0003:046D:C20E.0055: unknown main item tag 0x0 [ 1219.045046][T10049] logitech 0003:046D:C20E.0055: reserved main item tag 0xe [ 1219.052630][T10049] logitech 0003:046D:C20E.0055: unknown main item tag 0x0 [ 1219.059929][T10049] logitech 0003:046D:C20E.0055: unbalanced collection at end of report description [ 1219.069914][T10049] logitech 0003:046D:C20E.0055: parse failed [ 1219.076045][T10049] logitech 0003:046D:C20E.0055: probe with driver logitech failed with error -22 [ 1219.131328][T19401] macsec1: entered promiscuous mode [ 1219.141516][T19401] macsec1: entered allmulticast mode [ 1219.688748][T19361] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512 [ 1220.230363][ T5882] usb 6-1: USB disconnect, device number 116 [ 1220.302973][T19411] gfs2: gfs2 mount does not exist [ 1221.069964][T10049] usb 8-1: USB disconnect, device number 35 [ 1221.199618][T19413] netlink: 'syz.7.3576': attribute type 29 has an invalid length. [ 1221.225617][T19416] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3577'. [ 1221.325799][T19414] netlink: 'syz.7.3576': attribute type 29 has an invalid length. [ 1221.414542][T19413] netlink: 500 bytes leftover after parsing attributes in process `syz.7.3576'. [ 1221.554453][T19423] NILFS (nbd8): device size too small [ 1221.838100][ T5882] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 1222.105436][ T5882] usb 1-1: New USB device found, idVendor=0856, idProduct=ac31, bcdDevice=93.1e [ 1222.260158][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1222.365306][ T5882] usb 1-1: Product: syz [ 1222.423467][ T5882] usb 1-1: Manufacturer: syz [ 1222.490428][ T5882] usb 1-1: SerialNumber: syz [ 1222.695377][ T5882] usb 1-1: config 0 descriptor?? [ 1223.445911][T19421] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1223.471093][T19421] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1223.509474][ T5882] mos7840 1-1:0.0: required endpoints missing [ 1223.596632][ T30] audit: type=1400 audit(1749594355.720:1407): avc: denied { read } for pid=19430 comm="syz.7.3582" name="file0" dev="fuse" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 1223.616867][ T5882] usb 1-1: USB disconnect, device number 8 [ 1223.648529][ T30] audit: type=1400 audit(1749594355.720:1408): avc: denied { open } for pid=19430 comm="syz.7.3582" path="/178/file0/file0" dev="fuse" ino=3 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 1223.701519][ T30] audit: type=1400 audit(1749594355.720:1409): avc: denied { ioctl } for pid=19430 comm="syz.7.3582" path="/178/file0/file0" dev="fuse" ino=3 ioctlcmd=0x301 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fusefs_t tclass=blk_file permissive=1 [ 1223.762068][ T30] audit: type=1400 audit(1749594355.720:1410): avc: denied { setattr } for pid=19430 comm="syz.7.3582" name="fuse" dev="devtmpfs" ino=99 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fuse_device_t tclass=chr_file permissive=1 [ 1224.146772][ T5882] usb 8-1: new low-speed USB device number 36 using dummy_hcd [ 1224.337467][ T5882] usb 8-1: device descriptor read/64, error -71 [ 1224.732680][T19449] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1224.786654][ T944] usb 9-1: new high-speed USB device number 40 using dummy_hcd [ 1224.816775][ T5882] usb 8-1: new low-speed USB device number 37 using dummy_hcd [ 1225.076661][ T5882] usb 8-1: device descriptor read/64, error -71 [ 1225.100321][ T944] usb 9-1: Using ep0 maxpacket: 8 [ 1225.125503][ T944] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1225.172018][ T944] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1225.274308][ T944] usb 9-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1225.294160][ T5882] usb usb8-port1: attempt power cycle [ 1225.396217][T19466] gfs2: gfs2 mount does not exist [ 1225.834764][ T944] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1225.847845][ T944] usb 9-1: config 0 descriptor?? [ 1226.156652][ T5882] usb 8-1: new low-speed USB device number 38 using dummy_hcd [ 1226.256994][ T944] logitech 0003:046D:C20E.0056: rdesc size test failed for formula gp [ 1226.270840][ T944] logitech 0003:046D:C20E.0056: unknown main item tag 0x0 [ 1226.274043][ T5882] usb 8-1: device descriptor read/8, error -71 [ 1226.278044][ T944] logitech 0003:046D:C20E.0056: reserved main item tag 0xe [ 1226.278068][ T944] logitech 0003:046D:C20E.0056: unknown main item tag 0x0 [ 1226.278096][ T944] logitech 0003:046D:C20E.0056: unbalanced collection at end of report description [ 1226.355068][T19474] vcan0: tx drop: invalid da for name 0xffff030000000000 [ 1226.816272][ T944] logitech 0003:046D:C20E.0056: parse failed [ 1226.823005][ T944] logitech 0003:046D:C20E.0056: probe with driver logitech failed with error -22 [ 1227.245497][ T5882] usb 8-1: new low-speed USB device number 39 using dummy_hcd [ 1227.307140][ T5882] usb 8-1: device descriptor read/8, error -71 [ 1227.648708][ T5882] usb usb8-port1: unable to enumerate USB device [ 1228.162246][T19494] sp0: Synchronizing with TNC [ 1228.938397][ T5882] usb 9-1: USB disconnect, device number 40 [ 1229.883728][T19500] fuse: Bad value for 'fd' [ 1230.018996][T19499] netlink: 'syz.8.3598': attribute type 1 has an invalid length. [ 1230.543237][T19509] FAULT_INJECTION: forcing a failure. [ 1230.543237][T19509] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1230.556518][T19509] CPU: 1 UID: 0 PID: 19509 Comm: syz.5.3600 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1230.556542][T19509] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1230.556553][T19509] Call Trace: [ 1230.556562][T19509] [ 1230.556570][T19509] dump_stack_lvl+0x16c/0x1f0 [ 1230.556603][T19509] should_fail_ex+0x512/0x640 [ 1230.556631][T19509] _copy_to_user+0x32/0xd0 [ 1230.556658][T19509] iommufd_option+0x130/0x1d0 [ 1230.556683][T19509] iommufd_fops_ioctl+0x33f/0x4e0 [ 1230.556708][T19509] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1230.556744][T19509] ? selinux_file_ioctl+0x180/0x270 [ 1230.556767][T19509] ? selinux_file_ioctl+0xb4/0x270 [ 1230.556792][T19509] ? __pfx_iommufd_fops_ioctl+0x10/0x10 [ 1230.556818][T19509] __x64_sys_ioctl+0x18e/0x210 [ 1230.556841][T19509] do_syscall_64+0xcd/0x4c0 [ 1230.556870][T19509] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1230.556888][T19509] RIP: 0033:0x7f74fa78e929 [ 1230.556903][T19509] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1230.556920][T19509] RSP: 002b:00007f74f85f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1230.556939][T19509] RAX: ffffffffffffffda RBX: 00007f74fa9b6160 RCX: 00007f74fa78e929 [ 1230.556951][T19509] RDX: 00002000000003c0 RSI: 0000000000003b87 RDI: 0000000000000005 [ 1230.556962][T19509] RBP: 00007f74f85f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1230.556973][T19509] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1230.556984][T19509] R13: 0000000000000000 R14: 00007f74fa9b6160 R15: 00007ffc00668138 [ 1230.557008][T19509] [ 1230.810551][T19508] binder: 19507:19508 ioctl 400c620e 200000000100 returned -22 [ 1232.733810][T19521] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1233.003350][T19532] netlink: 12 bytes leftover after parsing attributes in process `syz.7.3607'. [ 1234.230144][T19544] netlink: 'syz.5.3612': attribute type 1 has an invalid length. [ 1234.356724][ T30] audit: type=1400 audit(1749594366.425:1411): avc: denied { ioctl } for pid=19541 comm="syz.9.3611" path="socket:[69807]" dev="sockfs" ino=69807 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1234.386957][T19544] netlink: 224 bytes leftover after parsing attributes in process `syz.5.3612'. [ 1235.026766][ T30] audit: type=1400 audit(1749594366.435:1412): avc: denied { getopt } for pid=19541 comm="syz.9.3611" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=caif_socket permissive=1 [ 1236.427205][T19569] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3617'. [ 1236.562571][T19569] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3617'. [ 1236.793183][T19569] nfs: Unknown parameter '$' [ 1237.123549][T19569] siw: device registration error -23 [ 1237.426747][T19576] ptm ptm2: ldisc open failed (-12), clearing slot 2 [ 1237.616773][ T24] usb 9-1: new high-speed USB device number 41 using dummy_hcd [ 1237.901573][ T24] usb 9-1: Using ep0 maxpacket: 8 [ 1237.964748][T19584] CIFS: Unable to determine destination address [ 1238.362528][ T24] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 1238.392479][ T24] usb 9-1: config 179 has no interface number 0 [ 1238.417066][ T24] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1238.466189][ T24] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1238.504167][ T24] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1238.553454][ T24] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1238.660828][ T24] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1238.687875][ T24] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1238.745580][ T24] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1239.426796][T16634] usb 6-1: new high-speed USB device number 117 using dummy_hcd [ 1239.541941][T19574] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1239.760714][T16634] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1239.774025][T16634] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1240.187929][T16634] usb 6-1: New USB device found, idVendor=04e7, idProduct=0030, bcdDevice= 0.00 [ 1240.214435][T16634] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1240.257980][ T24] usb 9-1: USB disconnect, device number 41 [ 1240.258042][ C1] xpad 9-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1240.258084][ C1] xpad 9-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1240.424531][T16634] usb 6-1: config 0 descriptor?? [ 1240.916314][T16634] elo 0003:04E7:0030.0057: item fetching failed at offset 3/7 [ 1240.966106][T16634] elo 0003:04E7:0030.0057: parse failed [ 1240.971882][T16634] elo 0003:04E7:0030.0057: probe with driver elo failed with error -22 [ 1242.386990][T16634] usb 6-1: USB disconnect, device number 117 [ 1244.734551][T13682] libceph: connect (1)[c::]:6789 error -101 [ 1244.790945][T13682] libceph: mon0 (1)[c::]:6789 connect error [ 1244.868267][T19651] ceph: No mds server is up or the cluster is laggy [ 1245.466232][T15315] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 1245.530360][T19664] lo speed is unknown, defaulting to 1000 [ 1245.671223][T19667] ptrace attach of ""[19668] was attempted by ""[19667] [ 1246.169906][T15315] usb 10-1: Using ep0 maxpacket: 8 [ 1246.182113][T19664] lo speed is unknown, defaulting to 1000 [ 1246.199435][T15315] usb 10-1: config 179 has an invalid interface number: 65 but max is 0 [ 1246.211693][T15315] usb 10-1: config 179 has no interface number 0 [ 1246.218413][T15315] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1246.229925][T15315] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1246.241881][T15315] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1246.253561][T15315] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1246.276025][T15315] usb 10-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1246.291542][T15315] usb 10-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1246.302363][T15315] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1246.333799][T19661] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1246.726732][T15315] usb 10-1: USB disconnect, device number 12 [ 1246.732795][ C0] xpad 10-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1246.732840][ C0] xpad 10-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1247.146665][T13682] usb 9-1: new full-speed USB device number 42 using dummy_hcd [ 1247.459567][T13682] usb 9-1: config 36 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1247.491256][T13682] usb 9-1: config 36 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1247.571668][T13682] usb 9-1: config 36 interface 0 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1247.601117][T13682] usb 9-1: New USB device found, idVendor=6993, idProduct=b001, bcdDevice=3d.29 [ 1247.610459][T13682] usb 9-1: New USB device strings: Mfr=244, Product=0, SerialNumber=16 [ 1247.619168][T13682] usb 9-1: Manufacturer: syz [ 1248.116770][T13682] usb 9-1: SerialNumber: syz [ 1248.136896][T19688] netlink: 8 bytes leftover after parsing attributes in process `syz.0.3648'. [ 1248.688216][ T30] audit: type=1400 audit(1749594380.885:1413): avc: denied { read write } for pid=19674 comm="syz.8.3646" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1248.769712][ T30] audit: type=1400 audit(1749594380.885:1414): avc: denied { open } for pid=19674 comm="syz.8.3646" path="/198/file0" dev="9p" ino=2 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=file permissive=1 [ 1249.010889][T19702] netlink: 'syz.7.3652': attribute type 11 has an invalid length. [ 1249.018819][T19702] netlink: 224 bytes leftover after parsing attributes in process `syz.7.3652'. [ 1249.808702][T13682] yealink 9-1:36.0: invalid payload size 0, expected 16 [ 1249.906226][T13682] input: Yealink usb-p1k as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:36.0/input/input58 [ 1250.044498][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.051675][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.058707][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.065647][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.072600][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.079536][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.086443][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.093405][ C1] yealink 9-1:36.0: urb_ctl_callback - urb status -71 [ 1250.100163][ C1] yealink 9-1:36.0: urb_ctl_callback - usb_submit_urb failed -90 [ 1250.471710][T13682] usb 9-1: USB disconnect, device number 42 [ 1250.566829][ T50] Bluetooth: hci4: Opcode 0x1003 failed: -110 [ 1251.132283][T19711] block device autoloading is deprecated and will be removed. [ 1251.518132][T19719] netlink: 'syz.7.3657': attribute type 14 has an invalid length. [ 1252.579831][T19727] netlink: 28 bytes leftover after parsing attributes in process `syz.5.3659'. [ 1252.608331][T19727] netlink: 'syz.5.3659': attribute type 7 has an invalid length. [ 1252.616163][T19727] netlink: 'syz.5.3659': attribute type 8 has an invalid length. [ 1252.624219][T19727] netlink: 4 bytes leftover after parsing attributes in process `syz.5.3659'. [ 1252.638320][T19727] ip6gretap0: entered promiscuous mode [ 1252.644598][T19727] syz_tun: entered promiscuous mode [ 1252.651628][T19727] erspan0: entered promiscuous mode [ 1252.657574][T19727] debugfs: Directory 'hsr1' with parent 'hsr' already present! [ 1252.666317][T19727] Cannot create hsr debugfs directory [ 1252.799063][T19734] FAULT_INJECTION: forcing a failure. [ 1252.799063][T19734] name failslab, interval 1, probability 0, space 0, times 0 [ 1252.812014][T19734] CPU: 0 UID: 0 PID: 19734 Comm: syz.9.3661 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1252.812040][T19734] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1252.812051][T19734] Call Trace: [ 1252.812057][T19734] [ 1252.812064][T19734] dump_stack_lvl+0x16c/0x1f0 [ 1252.812095][T19734] should_fail_ex+0x512/0x640 [ 1252.812118][T19734] ? __kmalloc_noprof+0xbf/0x510 [ 1252.812142][T19734] ? __keyctl_dh_compute+0x410/0x10e0 [ 1252.812168][T19734] should_failslab+0xc2/0x120 [ 1252.812193][T19734] __kmalloc_noprof+0xd2/0x510 [ 1252.812221][T19734] __keyctl_dh_compute+0x410/0x10e0 [ 1252.812248][T19734] ? get_pid_task+0xfc/0x250 [ 1252.812277][T19734] ? __pfx___keyctl_dh_compute+0x10/0x10 [ 1252.812304][T19734] ? get_pid_task+0x106/0x250 [ 1252.812330][T19734] ? proc_fail_nth_write+0x9f/0x250 [ 1252.812353][T19734] ? find_held_lock+0x2b/0x80 [ 1252.812383][T19734] ? ksys_write+0x190/0x250 [ 1252.812414][T19734] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1252.812446][T19734] keyctl_dh_compute+0xd2/0x140 [ 1252.812472][T19734] ? __pfx_keyctl_dh_compute+0x10/0x10 [ 1252.812504][T19734] ? xfd_validate_state+0x61/0x180 [ 1252.812527][T19734] ? __pfx_ksys_write+0x10/0x10 [ 1252.812552][T19734] __do_sys_keyctl+0x4df/0x590 [ 1252.812575][T19734] do_syscall_64+0xcd/0x4c0 [ 1252.812603][T19734] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1252.812621][T19734] RIP: 0033:0x7f0784b8e929 [ 1252.812635][T19734] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1252.812653][T19734] RSP: 002b:00007f0785961038 EFLAGS: 00000246 ORIG_RAX: 00000000000000fa [ 1252.812670][T19734] RAX: ffffffffffffffda RBX: 00007f0784db6080 RCX: 00007f0784b8e929 [ 1252.812683][T19734] RDX: 00002000000000c0 RSI: 0000200000000140 RDI: 0000000000000017 [ 1252.812694][T19734] RBP: 00007f0785961090 R08: 0000000000000000 R09: 0000000000000000 [ 1252.812705][T19734] R10: fffffffffffffe4f R11: 0000000000000246 R12: 0000000000000001 [ 1252.812716][T19734] R13: 0000000000000000 R14: 00007f0784db6080 R15: 00007ffeddfee3c8 [ 1252.812741][T19734] [ 1253.098635][ T944] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 1253.179787][T19744] syz.5.3664 (19744): drop_caches: 2 [ 1253.186161][T19744] syz.5.3664 (19744): drop_caches: 2 [ 1253.266533][ T944] usb 1-1: Using ep0 maxpacket: 8 [ 1253.379906][ T944] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 1253.850783][ T944] usb 1-1: config 179 has no interface number 0 [ 1253.858565][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1253.858598][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1253.858647][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1253.858669][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1253.858693][ T944] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1253.858731][ T944] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1253.945421][ T944] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1253.993639][T19731] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1254.221557][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1254.229886][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1254.245375][ T944] usb 1-1: USB disconnect, device number 9 [ 1254.556163][T19757] ALSA: mixer_oss: invalid OSS volume 'u' [ 1255.417553][T19767] netlink: 84 bytes leftover after parsing attributes in process `syz.0.3671'. [ 1255.645458][T19761] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1257.337901][ T30] audit: type=1400 audit(2000000006.680:1415): avc: denied { map } for pid=19778 comm="syz.0.3675" path="/dev/sg0" dev="devtmpfs" ino=778 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1257.361823][ C1] vkms_vblank_simulate: vblank timer overrun [ 1257.822516][ T30] audit: type=1400 audit(2000000006.680:1416): avc: denied { execute } for pid=19778 comm="syz.0.3675" path="/dev/sg0" dev="devtmpfs" ino=778 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:scsi_generic_device_t tclass=chr_file permissive=1 [ 1258.272838][T19787] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1258.329377][T19796] netlink: 'syz.8.3680': attribute type 1 has an invalid length. [ 1258.351692][T19796] Bluetooth: MGMT ver 1.23 [ 1258.845957][T19809] FAULT_INJECTION: forcing a failure. [ 1258.845957][T19809] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1258.949097][T19809] CPU: 1 UID: 0 PID: 19809 Comm: syz.8.3683 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1258.949124][T19809] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1258.949135][T19809] Call Trace: [ 1258.949141][T19809] [ 1258.949149][T19809] dump_stack_lvl+0x16c/0x1f0 [ 1258.949178][T19809] should_fail_ex+0x512/0x640 [ 1258.949205][T19809] core_sys_select+0x949/0xc10 [ 1258.949234][T19809] ? __pfx_core_sys_select+0x10/0x10 [ 1258.949258][T19809] ? __pfx___schedule+0x10/0x10 [ 1258.949309][T19809] do_pselect.constprop.0+0x19f/0x1e0 [ 1258.949333][T19809] ? __pfx_do_pselect.constprop.0+0x10/0x10 [ 1258.949364][T19809] __x64_sys_pselect6+0x182/0x240 [ 1258.949387][T19809] ? __pfx___x64_sys_pselect6+0x10/0x10 [ 1258.949416][T19809] do_syscall_64+0xcd/0x4c0 [ 1258.949443][T19809] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1258.949461][T19809] RIP: 0033:0x7eff0378e929 [ 1258.949474][T19809] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1258.949497][T19809] RSP: 002b:00007eff045b9038 EFLAGS: 00000246 ORIG_RAX: 000000000000010e [ 1258.949514][T19809] RAX: ffffffffffffffda RBX: 00007eff039b5fa0 RCX: 00007eff0378e929 [ 1258.949525][T19809] RDX: 0000000000000000 RSI: 0000200000000600 RDI: 0000000000000040 [ 1258.949535][T19809] RBP: 00007eff045b9090 R08: 0000000000000000 R09: 0000000000000000 [ 1258.949546][T19809] R10: 0000200000000680 R11: 0000000000000246 R12: 0000000000000001 [ 1258.949556][T19809] R13: 0000000000000000 R14: 00007eff039b5fa0 R15: 00007fff3f864778 [ 1258.949581][T19809] [ 1259.122302][ T944] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 1259.296174][ T944] usb 1-1: Using ep0 maxpacket: 8 [ 1260.111120][ T944] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 1260.121784][ T944] usb 1-1: config 179 has no interface number 0 [ 1260.128425][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1260.153159][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1260.242957][T19819] lo speed is unknown, defaulting to 1000 [ 1260.255793][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1260.316771][T19819] lo speed is unknown, defaulting to 1000 [ 1260.331464][ T944] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1260.377457][ T944] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1260.390800][T15315] usb 9-1: new full-speed USB device number 43 using dummy_hcd [ 1260.412285][ T944] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1260.530056][T19825] netlink: 161716 bytes leftover after parsing attributes in process `syz.9.3688'. [ 1260.539668][T19825] netlink: zone id is out of range [ 1260.546076][T19825] netlink: zone id is out of range [ 1260.551195][T19825] netlink: zone id is out of range [ 1260.557283][T19825] netlink: zone id is out of range [ 1260.557878][T15315] usb 9-1: config 135 has an invalid interface number: 230 but max is 0 [ 1260.571699][T19825] netlink: zone id is out of range [ 1260.577051][T19825] netlink: zone id is out of range [ 1260.582236][T19825] netlink: zone id is out of range [ 1260.587471][T19825] netlink: zone id is out of range [ 1260.592682][T19825] netlink: zone id is out of range [ 1260.597940][T19825] netlink: zone id is out of range [ 1260.918997][T19822] block device autoloading is deprecated and will be removed. [ 1261.194612][ T944] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1261.202906][T15315] usb 9-1: config 135 has an invalid descriptor of length 0, skipping remainder of the config [ 1261.224454][T15315] usb 9-1: config 135 has no interface number 0 [ 1261.231165][T19805] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22 [ 1261.242281][T15315] usb 9-1: config 135 interface 230 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1261.258907][T15315] usb 9-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=3f.3a [ 1261.260164][T19822] syz.7.3687: attempt to access beyond end of device [ 1261.260164][T19822] md0: rw=2048, sector=0, nr_sectors = 8 limit=0 [ 1261.268236][T15315] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1261.289684][T15315] usb 9-1: Product: syz [ 1261.293971][T15315] usb 9-1: Manufacturer: syz [ 1261.298721][T15315] usb 9-1: SerialNumber: syz [ 1261.480220][ T944] usb 1-1: USB disconnect, device number 10 [ 1261.486277][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1261.486332][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1261.531749][T19817] binder: BINDER_SET_CONTEXT_MGR already set [ 1261.539559][T19817] binder: 19816:19817 ioctl 4018620d 200000000040 returned -16 [ 1261.554291][T19817] binder: 19816:19817 ioctl c0306201 200000001440 returned -11 [ 1261.581696][T15315] usb 9-1: Found UVC 0.00 device syz (18ec:3288) [ 1261.588247][T15315] usb 9-1: No valid video chain found. [ 1261.608477][T15315] usb 9-1: USB disconnect, device number 43 [ 1261.901899][T19840] can: request_module (can-proto-0) failed. [ 1261.972360][T19843] netlink: 40 bytes leftover after parsing attributes in process `syz.5.3694'. [ 1262.056020][ T5882] usb 10-1: new full-speed USB device number 13 using dummy_hcd [ 1262.112991][T19847] netlink: 8 bytes leftover after parsing attributes in process `syz.5.3696'. [ 1262.287546][ T5882] usb 10-1: config 135 has an invalid interface number: 230 but max is 0 [ 1262.299141][ T5882] usb 10-1: config 135 has an invalid descriptor of length 0, skipping remainder of the config [ 1262.322004][ T5882] usb 10-1: config 135 has no interface number 0 [ 1262.336211][ T5882] usb 10-1: config 135 interface 230 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1262.379144][ T5882] usb 10-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=3f.3a [ 1262.425829][T15315] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 1262.427102][ T5882] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1262.442494][ T5882] usb 10-1: Product: syz [ 1262.519640][ T5882] usb 10-1: Manufacturer: syz [ 1262.539895][ T5882] usb 10-1: SerialNumber: syz [ 1262.899676][T15315] usb 6-1: Using ep0 maxpacket: 32 [ 1262.930494][T15315] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1262.943157][T15315] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1263.067145][T15315] usb 6-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40 [ 1263.079987][T19854] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1263.090039][T15315] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1263.109850][T15315] usb 6-1: config 0 descriptor?? [ 1263.120092][ T5882] usb 10-1: Found UVC 0.00 device syz (18ec:3288) [ 1263.126352][T15315] hub 6-1:0.0: USB hub found [ 1263.139727][ T5882] usb 10-1: No valid video chain found. [ 1263.176261][ T5882] usb 10-1: USB disconnect, device number 13 [ 1263.477897][T15315] hub 6-1:0.0: 1 port detected [ 1263.615156][T19861] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1263.967172][ T30] audit: type=1800 audit(2000000013.290:1417): pid=19870 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.0.3701" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 1264.213320][ T30] audit: type=1400 audit(2000000013.580:1418): avc: denied { name_bind } for pid=19851 comm="syz.5.3697" src=20001 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unreserved_port_t tclass=rawip_socket permissive=1 [ 1264.499197][T15315] hub 6-1:0.0: activate --> -90 [ 1264.548224][ T5882] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 1264.719744][ T5882] usb 10-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1264.740351][T16634] usb 8-1: new high-speed USB device number 40 using dummy_hcd [ 1264.779878][ T5882] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1264.810203][T10049] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 1264.817746][ T5882] usb 10-1: New USB device found, idVendor=08b7, idProduct=0000, bcdDevice= 0.00 [ 1264.822479][T19852] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3697'. [ 1264.834165][ T5882] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1264.902824][ T5882] usb 10-1: SerialNumber: syz [ 1264.917365][T19852] netlink: 16 bytes leftover after parsing attributes in process `syz.5.3697'. [ 1264.936006][T16634] usb 8-1: Using ep0 maxpacket: 8 [ 1264.970474][T16634] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1265.022640][T16634] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1265.035633][T16634] usb 8-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1265.047469][T16634] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1265.050933][T10049] usb 1-1: Using ep0 maxpacket: 8 [ 1265.076797][T16634] usb 8-1: config 0 descriptor?? [ 1265.117494][T10049] usb 1-1: config 179 has an invalid interface number: 65 but max is 0 [ 1265.150725][T10049] usb 1-1: config 179 has no interface number 0 [ 1265.175824][T10049] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1265.206789][T10049] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1265.271262][T10049] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1265.296955][T10049] usb 1-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1265.308874][T10049] usb 1-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1265.324029][T15315] usb 6-1-port1: cannot disable (err = -71) [ 1265.330224][ T944] usb 6-1: USB disconnect, device number 118 [ 1265.375138][T10049] usb 1-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1265.388146][T10049] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1265.400713][T19877] raw-gadget.3 gadget.0: fail, usb_ep_enable returned -22 [ 1265.492976][T16634] logitech 0003:046D:C20E.0058: rdesc size test failed for formula gp [ 1265.523041][T16634] logitech 0003:046D:C20E.0058: unknown main item tag 0x0 [ 1265.553529][T16634] logitech 0003:046D:C20E.0058: reserved main item tag 0xe [ 1265.576247][T16634] logitech 0003:046D:C20E.0058: unknown main item tag 0x0 [ 1265.599049][T16634] logitech 0003:046D:C20E.0058: unbalanced collection at end of report description [ 1265.645262][T16634] logitech 0003:046D:C20E.0058: parse failed [ 1265.666839][T10049] usb 1-1: USB disconnect, device number 11 [ 1265.672797][ C0] xpad 1-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1265.672845][ C0] xpad 1-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1265.685222][T16634] logitech 0003:046D:C20E.0058: probe with driver logitech failed with error -22 [ 1267.461726][ T5882] usb 10-1: 0:2 : does not exist [ 1267.477270][ T5882] usb 10-1: unit 5: unexpected type 0x03 [ 1267.572087][T16634] usb 8-1: USB disconnect, device number 40 [ 1267.597377][ T5882] usb 10-1: USB disconnect, device number 14 [ 1267.912984][ T5827] udevd[5827]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1267.960062][T19916] FAULT_INJECTION: forcing a failure. [ 1267.960062][T19916] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1268.027691][T19916] CPU: 1 UID: 0 PID: 19916 Comm: syz.7.3715 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1268.027719][T19916] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1268.027730][T19916] Call Trace: [ 1268.027736][T19916] [ 1268.027744][T19916] dump_stack_lvl+0x16c/0x1f0 [ 1268.027775][T19916] should_fail_ex+0x512/0x640 [ 1268.027805][T19916] _copy_to_user+0x32/0xd0 [ 1268.027833][T19916] video_usercopy+0xf3e/0x1720 [ 1268.027859][T19916] ? __pfx___video_do_ioctl+0x10/0x10 [ 1268.027881][T19916] ? selinux_kernel_read_file+0x70/0x130 [ 1268.027907][T19916] ? __pfx_video_usercopy+0x10/0x10 [ 1268.027947][T19916] v4l2_ioctl+0x1ba/0x250 [ 1268.027968][T19916] ? __pfx_v4l2_ioctl+0x10/0x10 [ 1268.027990][T19916] __x64_sys_ioctl+0x18e/0x210 [ 1268.028013][T19916] do_syscall_64+0xcd/0x4c0 [ 1268.028041][T19916] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1268.028059][T19916] RIP: 0033:0x7fc73f18e929 [ 1268.028074][T19916] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1268.028091][T19916] RSP: 002b:00007fc73ffd8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1268.028108][T19916] RAX: ffffffffffffffda RBX: 00007fc73f3b6080 RCX: 00007fc73f18e929 [ 1268.028120][T19916] RDX: 0000200000000240 RSI: 00000000c008561c RDI: 0000000000000009 [ 1268.028131][T19916] RBP: 00007fc73ffd8090 R08: 0000000000000000 R09: 0000000000000000 [ 1268.028141][T19916] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1268.028151][T19916] R13: 0000000000000000 R14: 00007fc73f3b6080 R15: 00007ffdb6c2ff28 [ 1268.028175][T19916] [ 1269.045895][ T5882] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 1269.215706][ T5882] usb 6-1: Using ep0 maxpacket: 8 [ 1269.229726][ T5882] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1269.239906][ T5882] usb 6-1: config 179 has no interface number 0 [ 1269.246867][ T5882] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1269.258700][ T5882] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1269.271283][ T5882] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1269.283965][ T5882] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1269.299851][ T5882] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1269.314304][ T5882] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1269.325951][ T5882] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1269.339876][T19925] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1269.557058][ T5882] usb 6-1: USB disconnect, device number 119 [ 1269.563107][ C1] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1269.563136][ C1] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1270.335882][ T944] usb 8-1: new high-speed USB device number 41 using dummy_hcd [ 1270.611346][ T944] usb 8-1: Using ep0 maxpacket: 16 [ 1270.641093][ T944] usb 8-1: config index 0 descriptor too short (expected 8192, got 68) [ 1270.674652][ T944] usb 8-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1270.699991][ T944] usb 8-1: config 0 has no interfaces? [ 1270.710878][ T944] usb 8-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1270.724427][ T944] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=1 [ 1270.738701][ T944] usb 8-1: SerialNumber: syz [ 1270.754105][ T944] usb 8-1: config 0 descriptor?? [ 1271.155395][T19801] tipc: Subscription rejected, illegal request [ 1271.519346][ T944] usb 8-1: USB disconnect, device number 41 [ 1272.058811][T19985] netlink: 200 bytes leftover after parsing attributes in process `syz.9.3733'. [ 1272.750143][T19984] bond0: (slave rose0): Error: Device is in use and cannot be enslaved [ 1272.955635][ T944] usb 9-1: new high-speed USB device number 44 using dummy_hcd [ 1274.185475][ T944] usb 9-1: Using ep0 maxpacket: 8 [ 1274.207836][ T944] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 1274.336445][ T944] usb 9-1: config 179 has no interface number 0 [ 1274.489136][ T944] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1274.575578][ T944] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1274.700677][T20006] FAULT_INJECTION: forcing a failure. [ 1274.700677][T20006] name failslab, interval 1, probability 0, space 0, times 0 [ 1274.713582][T20006] CPU: 0 UID: 0 PID: 20006 Comm: syz.5.3740 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1274.713606][T20006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1274.713614][T20006] Call Trace: [ 1274.713618][T20006] [ 1274.713623][T20006] dump_stack_lvl+0x16c/0x1f0 [ 1274.713645][T20006] should_fail_ex+0x512/0x640 [ 1274.713660][T20006] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1274.713677][T20006] should_failslab+0xc2/0x120 [ 1274.713693][T20006] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1274.713707][T20006] ? __pfx___might_resched+0x10/0x10 [ 1274.713721][T20006] ? alloc_vmap_area+0x645/0x29c0 [ 1274.713741][T20006] alloc_vmap_area+0x645/0x29c0 [ 1274.713765][T20006] ? __pfx_alloc_vmap_area+0x10/0x10 [ 1274.713786][T20006] __get_vm_area_node+0x1ca/0x330 [ 1274.713800][T20006] __vmalloc_node_range_noprof+0x271/0x14b0 [ 1274.713813][T20006] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 1274.713827][T20006] ? find_held_lock+0x2b/0x80 [ 1274.713841][T20006] ? avc_has_perm_noaudit+0x117/0x3b0 [ 1274.713853][T20006] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 1274.713869][T20006] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1274.713882][T20006] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 1274.713902][T20006] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 1274.713914][T20006] __vmalloc_node_noprof+0xad/0xf0 [ 1274.713925][T20006] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 1274.713939][T20006] bpf_prog_alloc_no_stats+0x54/0x630 [ 1274.713951][T20006] ? security_capable+0x7e/0x260 [ 1274.713965][T20006] bpf_prog_alloc+0x3b/0x230 [ 1274.713976][T20006] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1274.713989][T20006] bpf_prog_load+0x1a04/0x2490 [ 1274.714008][T20006] ? __pfx_bpf_prog_load+0x10/0x10 [ 1274.714021][T20006] ? avc_has_perm_noaudit+0x149/0x3b0 [ 1274.714042][T20006] ? selinux_bpf+0xde/0x130 [ 1274.714052][T20006] ? bpf_lsm_bpf+0x9/0x10 [ 1274.714065][T20006] __sys_bpf+0x433c/0x4d80 [ 1274.714082][T20006] ? __pfx___sys_bpf+0x10/0x10 [ 1274.714098][T20006] ? ksys_write+0x190/0x250 [ 1274.714114][T20006] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 1274.714141][T20006] ? fput+0x70/0xf0 [ 1274.714150][T20006] ? ksys_write+0x1ac/0x250 [ 1274.714163][T20006] ? __pfx_ksys_write+0x10/0x10 [ 1274.714179][T20006] __x64_sys_bpf+0x78/0xc0 [ 1274.714194][T20006] ? lockdep_hardirqs_on+0x7c/0x110 [ 1274.714212][T20006] do_syscall_64+0xcd/0x4c0 [ 1274.714230][T20006] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1274.714241][T20006] RIP: 0033:0x7f74fa78e929 [ 1274.714250][T20006] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1274.714261][T20006] RSP: 002b:00007f74f85f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1274.714272][T20006] RAX: ffffffffffffffda RBX: 00007f74fa9b6160 RCX: 00007f74fa78e929 [ 1274.714280][T20006] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 1274.714286][T20006] RBP: 00007f74f85f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1274.714293][T20006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1274.714299][T20006] R13: 0000000000000001 R14: 00007f74fa9b6160 R15: 00007ffc00668138 [ 1274.714313][T20006] [ 1274.714363][T20006] syz.5.3740: vmalloc error: size 4096, vm_struct allocation failed, mode:0x500dc0(GFP_USER|__GFP_ZERO|__GFP_ACCOUNT), nodemask=(null),cpuset=/,mems_allowed=0-1 [ 1275.042178][T20006] CPU: 0 UID: 0 PID: 20006 Comm: syz.5.3740 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1275.042208][T20006] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1275.042215][T20006] Call Trace: [ 1275.042220][T20006] [ 1275.042224][T20006] dump_stack_lvl+0x16c/0x1f0 [ 1275.042247][T20006] warn_alloc+0x248/0x3a0 [ 1275.042263][T20006] ? __pfx_warn_alloc+0x10/0x10 [ 1275.042278][T20006] ? kfree+0x2b4/0x4d0 [ 1275.042293][T20006] ? __get_vm_area_node+0x208/0x330 [ 1275.042308][T20006] __vmalloc_node_range_noprof+0xb2d/0x14b0 [ 1275.042321][T20006] ? find_held_lock+0x2b/0x80 [ 1275.042336][T20006] ? avc_has_perm_noaudit+0x117/0x3b0 [ 1275.042349][T20006] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 1275.042366][T20006] ? __pfx___vmalloc_node_range_noprof+0x10/0x10 [ 1275.042379][T20006] ? __pfx_cred_has_capability.isra.0+0x10/0x10 [ 1275.042398][T20006] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 1275.042410][T20006] __vmalloc_node_noprof+0xad/0xf0 [ 1275.042421][T20006] ? bpf_prog_alloc_no_stats+0x54/0x630 [ 1275.042435][T20006] bpf_prog_alloc_no_stats+0x54/0x630 [ 1275.042447][T20006] ? security_capable+0x7e/0x260 [ 1275.042461][T20006] bpf_prog_alloc+0x3b/0x230 [ 1275.042472][T20006] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1275.042486][T20006] bpf_prog_load+0x1a04/0x2490 [ 1275.042504][T20006] ? __pfx_bpf_prog_load+0x10/0x10 [ 1275.042518][T20006] ? avc_has_perm_noaudit+0x149/0x3b0 [ 1275.042539][T20006] ? selinux_bpf+0xde/0x130 [ 1275.042549][T20006] ? bpf_lsm_bpf+0x9/0x10 [ 1275.042562][T20006] __sys_bpf+0x433c/0x4d80 [ 1275.042579][T20006] ? __pfx___sys_bpf+0x10/0x10 [ 1275.042594][T20006] ? ksys_write+0x190/0x250 [ 1275.042611][T20006] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 1275.042638][T20006] ? fput+0x70/0xf0 [ 1275.042647][T20006] ? ksys_write+0x1ac/0x250 [ 1275.042660][T20006] ? __pfx_ksys_write+0x10/0x10 [ 1275.042676][T20006] __x64_sys_bpf+0x78/0xc0 [ 1275.042691][T20006] ? lockdep_hardirqs_on+0x7c/0x110 [ 1275.042707][T20006] do_syscall_64+0xcd/0x4c0 [ 1275.042726][T20006] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1275.042738][T20006] RIP: 0033:0x7f74fa78e929 [ 1275.042748][T20006] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1275.042759][T20006] RSP: 002b:00007f74f85f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1275.042769][T20006] RAX: ffffffffffffffda RBX: 00007f74fa9b6160 RCX: 00007f74fa78e929 [ 1275.042776][T20006] RDX: 0000000000000048 RSI: 00002000000054c0 RDI: 0000000000000005 [ 1275.042783][T20006] RBP: 00007f74f85f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1275.042789][T20006] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1275.042796][T20006] R13: 0000000000000001 R14: 00007f74fa9b6160 R15: 00007ffc00668138 [ 1275.042810][T20006] [ 1275.042827][T20006] Mem-Info: [ 1275.322596][T20006] active_anon:10596 inactive_anon:10 isolated_anon:0 [ 1275.322596][T20006] active_file:20970 inactive_file:4841 isolated_file:0 [ 1275.322596][T20006] unevictable:768 dirty:372 writeback:0 [ 1275.322596][T20006] slab_reclaimable:7795 slab_unreclaimable:109602 [ 1275.322596][T20006] mapped:31831 shmem:1426 pagetables:1168 [ 1275.322596][T20006] sec_pagetables:0 bounce:0 [ 1275.322596][T20006] kernel_misc_reclaimable:0 [ 1275.322596][T20006] free:1308845 free_pcp:21241 free_cma:0 [ 1275.368317][T20006] Node 0 active_anon:42384kB inactive_anon:40kB active_file:83872kB inactive_file:19228kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:127316kB dirty:1488kB writeback:0kB shmem:4168kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:12712kB pagetables:4540kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1275.402033][T20006] Node 1 active_anon:0kB inactive_anon:0kB active_file:8kB inactive_file:136kB unevictable:1536kB isolated(anon):0kB isolated(file):0kB mapped:8kB dirty:0kB writeback:0kB shmem:1536kB shmem_thp:0kB shmem_pmdmapped:0kB anon_thp:0kB writeback_tmp:0kB kernel_stack:80kB pagetables:132kB sec_pagetables:0kB all_unreclaimable? no Balloon:0kB [ 1275.433737][T20006] Node 0 DMA free:15360kB boost:0kB min:208kB low:260kB high:312kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:0kB inactive_file:0kB unevictable:0kB writepending:0kB present:15992kB managed:15360kB mlocked:0kB bounce:0kB free_pcp:0kB local_pcp:0kB free_cma:0kB [ 1275.462893][T20006] lowmem_reserve[]: 0 2481 2482 2482 2482 [ 1275.468909][T20006] Node 0 DMA32 free:1321452kB boost:0kB min:34076kB low:42592kB high:51108kB reserved_highatomic:0KB free_highatomic:0KB active_anon:42192kB inactive_anon:40kB active_file:83700kB inactive_file:18156kB unevictable:1536kB writepending:1492kB present:3129332kB managed:2540652kB mlocked:0kB bounce:0kB free_pcp:64908kB local_pcp:20780kB free_cma:0kB [ 1275.501516][T20006] lowmem_reserve[]: 0 0 1 1 1 [ 1275.506480][T20006] Node 0 Normal free:20kB boost:0kB min:16kB low:20kB high:24kB reserved_highatomic:0KB free_highatomic:0KB active_anon:96kB inactive_anon:0kB active_file:172kB inactive_file:1072kB unevictable:0kB writepending:0kB present:1048580kB managed:1388kB mlocked:0kB bounce:0kB free_pcp:28kB local_pcp:4kB free_cma:0kB [ 1275.536275][T20006] lowmem_reserve[]: 0 0 0 0 0 [ 1275.541128][T20006] Node 1 Normal free:3898600kB boost:0kB min:55804kB low:69752kB high:83700kB reserved_highatomic:0KB free_highatomic:0KB active_anon:0kB inactive_anon:0kB active_file:8kB inactive_file:136kB unevictable:1536kB writepending:0kB present:4194300kB managed:4111164kB mlocked:0kB bounce:0kB free_pcp:19956kB local_pcp:7584kB free_cma:0kB [ 1275.572538][T20006] lowmem_reserve[]: 0 0 0 0 0 [ 1275.577435][T20006] Node 0 DMA: 0*4kB 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 1*1024kB (U) 1*2048kB (M) 3*4096kB (M) = 15360kB [ 1275.590492][T20006] Node 0 DMA32: 1959*4kB (UME) 686*8kB (UME) 514*16kB (UME) 732*32kB (UME) 221*64kB (UME) 126*128kB (UME) 76*256kB (UME) 96*512kB (UME) 50*1024kB (UME) 10*2048kB (UM) 270*4096kB (UM) = 1321452kB [ 1275.611068][T20006] Node 0 Normal: 5*4kB (M) 0*8kB 0*16kB 0*32kB 0*64kB 0*128kB 0*256kB 0*512kB 0*1024kB 0*2048kB 0*4096kB = 20kB [ 1275.623526][T20006] Node 1 Normal: 178*4kB (UM) 54*8kB (UME) 37*16kB (UME) 271*32kB (UME) 93*64kB (UME) 22*128kB (UM) 14*256kB (UME) 6*512kB (UME) 0*1024kB 3*2048kB (ME) 944*4096kB (M) = 3898600kB [ 1275.641877][T20006] Node 0 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1275.651539][T20006] Node 0 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1275.660942][T20006] Node 1 hugepages_total=0 hugepages_free=0 hugepages_surp=0 hugepages_size=1048576kB [ 1275.670710][T20006] Node 1 hugepages_total=2 hugepages_free=2 hugepages_surp=0 hugepages_size=2048kB [ 1275.680117][T20006] 27224 total pagecache pages [ 1275.684830][T20006] 10 pages in swap cache [ 1275.689152][T20006] Free swap = 124956kB [ 1275.693383][T20006] Total swap = 124996kB [ 1275.697758][T20006] 2097051 pages RAM [ 1275.701650][T20006] 0 pages HighMem/MovableOnly [ 1275.706467][T20006] 429910 pages reserved [ 1275.710675][T20006] 0 pages cma reserved [ 1275.829612][ T944] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1275.845402][ T944] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1275.856948][ T944] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1275.875264][ T944] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1275.884368][ T944] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1275.934945][ T30] audit: type=1326 audit(2000000025.291:1419): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20007 comm="syz.0.3741" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9dc4d8e929 code=0x7ffc0000 [ 1275.935263][ T944] usb 9-1: can't set config #179, error -71 [ 1275.985919][ T944] usb 9-1: USB disconnect, device number 44 [ 1276.175480][ T30] audit: type=1326 audit(2000000025.291:1420): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20007 comm="syz.0.3741" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9dc4d8e929 code=0x7ffc0000 [ 1276.200520][ T30] audit: type=1326 audit(2000000025.291:1421): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20007 comm="syz.0.3741" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f9dc4d8e929 code=0x7ffc0000 [ 1276.224002][ T30] audit: type=1326 audit(2000000025.291:1422): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20007 comm="syz.0.3741" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9dc4d8e929 code=0x7ffc0000 [ 1276.295430][ T30] audit: type=1326 audit(2000000025.291:1423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20007 comm="syz.0.3741" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f9dc4d8e929 code=0x7ffc0000 [ 1276.298747][T20024] can0: slcan on ttyS3. [ 1276.571801][ T30] audit: type=1326 audit(2000000025.291:1424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20007 comm="syz.0.3741" exe="/root/syz-executor" sig=0 arch=c000003e syscall=307 compat=0 ip=0x7f9dc4d8e929 code=0x7ffc0000 [ 1276.605332][ T30] audit: type=1326 audit(2000000025.431:1425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=20008 comm="syz.9.3742" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f0784b8e929 code=0x0 [ 1276.648530][T20026] FAULT_INJECTION: forcing a failure. [ 1276.648530][T20026] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1276.661615][T20026] CPU: 1 UID: 0 PID: 20026 Comm: syz.8.3743 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1276.661631][T20026] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1276.661637][T20026] Call Trace: [ 1276.661641][T20026] [ 1276.661646][T20026] dump_stack_lvl+0x16c/0x1f0 [ 1276.661667][T20026] should_fail_ex+0x512/0x640 [ 1276.661686][T20026] _copy_to_user+0x32/0xd0 [ 1276.661703][T20026] simple_read_from_buffer+0xcb/0x170 [ 1276.661719][T20026] proc_fail_nth_read+0x197/0x270 [ 1276.661734][T20026] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1276.661749][T20026] ? rw_verify_area+0xcf/0x680 [ 1276.661762][T20026] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1276.661776][T20026] vfs_read+0x1e1/0xc60 [ 1276.661791][T20026] ? __pfx___mutex_lock+0x10/0x10 [ 1276.661809][T20026] ? __pfx_vfs_read+0x10/0x10 [ 1276.661826][T20026] ? __fget_files+0x20e/0x3c0 [ 1276.661846][T20026] ksys_read+0x12a/0x250 [ 1276.661859][T20026] ? __pfx_ksys_read+0x10/0x10 [ 1276.661877][T20026] do_syscall_64+0xcd/0x4c0 [ 1276.661895][T20026] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1276.661910][T20026] RIP: 0033:0x7eff0378d33c [ 1276.661919][T20026] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1276.661930][T20026] RSP: 002b:00007eff04577030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1276.661940][T20026] RAX: ffffffffffffffda RBX: 00007eff039b6160 RCX: 00007eff0378d33c [ 1276.661948][T20026] RDX: 000000000000000f RSI: 00007eff045770a0 RDI: 000000000000000b [ 1276.661954][T20026] RBP: 00007eff04577090 R08: 0000000000000000 R09: 0000000000000000 [ 1276.661961][T20026] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 1276.661967][T20026] R13: 0000000000000000 R14: 00007eff039b6160 R15: 00007fff3f864778 [ 1276.661982][T20026] [ 1276.916571][ T30] audit: type=1400 audit(2000000025.511:1426): avc: denied { read } for pid=20007 comm="syz.0.3741" path="socket:[72162]" dev="sockfs" ino=72162 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_fib_lookup_socket permissive=1 [ 1277.648035][T20008] can0 (unregistered): slcan off ttyS3. [ 1277.775338][ T944] usb 8-1: new high-speed USB device number 42 using dummy_hcd [ 1277.945255][ T944] usb 8-1: device descriptor read/64, error -71 [ 1278.355746][T20039] set match dimension is over the limit! [ 1278.734209][ T944] usb 8-1: new high-speed USB device number 43 using dummy_hcd [ 1278.935510][ T944] usb 8-1: device descriptor read/64, error -71 [ 1279.091599][ T944] usb usb8-port1: attempt power cycle [ 1279.145889][T16634] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 1279.295093][T16634] usb 9-1: Using ep0 maxpacket: 8 [ 1279.301974][T16634] usb 9-1: config 179 has an invalid interface number: 65 but max is 0 [ 1279.314333][T16634] usb 9-1: config 179 has no interface number 0 [ 1279.321002][T16634] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1279.342007][T16634] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1279.365082][T16634] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1279.376648][T16634] usb 9-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1279.388536][T16634] usb 9-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1279.402475][T16634] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1279.412460][T16634] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1279.520293][T20054] raw-gadget.1 gadget.8: fail, usb_ep_enable returned -22 [ 1279.535175][ T944] usb 8-1: new high-speed USB device number 44 using dummy_hcd [ 1279.567080][ T944] usb 8-1: device descriptor read/8, error -71 [ 1279.743337][T16634] usb 9-1: USB disconnect, device number 45 [ 1279.749299][ C1] xpad 9-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1279.749327][ C1] xpad 9-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1279.837615][ T944] usb 8-1: new high-speed USB device number 45 using dummy_hcd [ 1279.994453][ T944] usb 8-1: device descriptor read/8, error -71 [ 1280.721423][ T944] usb usb8-port1: unable to enumerate USB device [ 1282.029943][ T30] audit: type=1400 audit(2000000031.391:1427): avc: denied { write } for pid=20092 comm="syz.0.3766" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1282.051882][ T30] audit: type=1400 audit(2000000031.391:1428): avc: denied { ioctl } for pid=20092 comm="syz.0.3766" path="socket:[71389]" dev="sockfs" ino=71389 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=xdp_socket permissive=1 [ 1283.158390][T20103] netlink: 24 bytes leftover after parsing attributes in process `syz.8.3769'. [ 1284.159988][T20123] FAULT_INJECTION: forcing a failure. [ 1284.159988][T20123] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1284.252016][T20123] CPU: 1 UID: 0 PID: 20123 Comm: syz.7.3774 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1284.252052][T20123] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1284.252063][T20123] Call Trace: [ 1284.252069][T20123] [ 1284.252078][T20123] dump_stack_lvl+0x16c/0x1f0 [ 1284.252108][T20123] should_fail_ex+0x512/0x640 [ 1284.252136][T20123] _copy_to_user+0x32/0xd0 [ 1284.252162][T20123] simple_read_from_buffer+0xcb/0x170 [ 1284.252185][T20123] proc_fail_nth_read+0x197/0x270 [ 1284.252207][T20123] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1284.252229][T20123] ? rw_verify_area+0xcf/0x680 [ 1284.252248][T20123] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1284.252268][T20123] vfs_read+0x1e1/0xc60 [ 1284.252292][T20123] ? __pfx___mutex_lock+0x10/0x10 [ 1284.252317][T20123] ? __pfx_vfs_read+0x10/0x10 [ 1284.252344][T20123] ? __fget_files+0x20e/0x3c0 [ 1284.252374][T20123] ksys_read+0x12a/0x250 [ 1284.252393][T20123] ? __pfx_ksys_read+0x10/0x10 [ 1284.252414][T20123] ? fput+0x70/0xf0 [ 1284.252432][T20123] do_syscall_64+0xcd/0x4c0 [ 1284.252458][T20123] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1284.252476][T20123] RIP: 0033:0x7fc73f18d33c [ 1284.252490][T20123] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1284.252507][T20123] RSP: 002b:00007fc73fff9030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1284.252524][T20123] RAX: ffffffffffffffda RBX: 00007fc73f3b5fa0 RCX: 00007fc73f18d33c [ 1284.252536][T20123] RDX: 000000000000000f RSI: 00007fc73fff90a0 RDI: 0000000000000005 [ 1284.252546][T20123] RBP: 00007fc73fff9090 R08: 0000000000000000 R09: 0000000000000000 [ 1284.252556][T20123] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1284.252567][T20123] R13: 0000000000000000 R14: 00007fc73f3b5fa0 R15: 00007ffdb6c2ff28 [ 1284.252590][T20123] [ 1284.450140][T16634] usb 10-1: new high-speed USB device number 15 using dummy_hcd [ 1284.515314][ T5931] usb 1-1: new high-speed USB device number 12 using dummy_hcd [ 1284.620015][T16634] usb 10-1: Using ep0 maxpacket: 8 [ 1284.626931][T16634] usb 10-1: config 179 has an invalid interface number: 65 but max is 0 [ 1284.638049][T16634] usb 10-1: config 179 has no interface number 0 [ 1284.643743][T20134] netlink: 'syz.5.3778': attribute type 10 has an invalid length. [ 1284.644409][T16634] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1284.663203][T20134] bond0: (slave wlan1): Opening slave failed [ 1284.704926][ T5931] usb 1-1: Using ep0 maxpacket: 16 [ 1284.715137][T16634] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1284.744415][ T5931] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1284.769403][T16634] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1284.782039][ T5931] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1284.793506][T16634] usb 10-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1284.805849][T16634] usb 10-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1284.819968][T20134] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1284.830439][T16634] usb 10-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1284.841011][T20139] netlink: 52 bytes leftover after parsing attributes in process `syz.7.3779'. [ 1284.859187][ T5931] usb 1-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1284.878785][T16634] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1284.889182][T20135] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1284.914749][ T5931] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1285.084231][T20139] bridge0: port 2(bridge_slave_1) entered disabled state [ 1285.092509][T20139] bridge0: port 1(bridge_slave_0) entered disabled state [ 1285.124189][T20117] raw-gadget.0 gadget.9: fail, usb_ep_enable returned -22 [ 1285.134783][ T5931] usb 1-1: Product: syz [ 1285.138969][ T5931] usb 1-1: Manufacturer: syz [ 1285.227253][ T5931] usb 1-1: SerialNumber: syz [ 1285.390087][ T944] usb 10-1: USB disconnect, device number 15 [ 1285.390102][ C1] xpad 10-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1285.390139][ C1] xpad 10-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1285.711313][ T5931] usb 1-1: config 0 descriptor?? [ 1285.719710][ T5931] em28xx 1-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1285.742949][ T5931] em28xx 1-1:0.0: Audio interface 0 found (Vendor Class) [ 1286.286971][T20120] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1286.306965][T20154] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3782'. [ 1286.316234][T20154] netlink: 36 bytes leftover after parsing attributes in process `syz.8.3782'. [ 1286.319974][T20120] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1287.207987][T20163] netlink: 161716 bytes leftover after parsing attributes in process `syz.9.3784'. [ 1287.217600][T20163] net_ratelimit: 11 callbacks suppressed [ 1287.223336][T20163] netlink: zone id is out of range [ 1287.234986][T20163] netlink: zone id is out of range [ 1287.240434][T20163] netlink: zone id is out of range [ 1287.246230][T20163] netlink: zone id is out of range [ 1287.252910][T20163] netlink: zone id is out of range [ 1287.258373][T20163] netlink: zone id is out of range [ 1287.263610][T20163] netlink: zone id is out of range [ 1287.280656][T20163] netlink: zone id is out of range [ 1287.288663][T20163] netlink: zone id is out of range [ 1287.294122][T20163] netlink: zone id is out of range [ 1287.473424][ T5931] em28xx 1-1:0.0: unknown em28xx chip ID (0) [ 1287.489810][ T5931] em28xx 1-1:0.0: Config register raw data: 0xfffffffb [ 1287.716627][ T5931] em28xx 1-1:0.0: AC97 chip type couldn't be determined [ 1288.622528][ T5931] em28xx 1-1:0.0: No AC97 audio processor [ 1288.633091][ T5931] usb 1-1: USB disconnect, device number 12 [ 1288.640230][ T5931] em28xx 1-1:0.0: Disconnecting em28xx [ 1288.646934][ T5931] em28xx 1-1:0.0: Freeing device [ 1289.311161][T20180] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1289.619997][T20190] netlink: 'syz.7.3790': attribute type 4 has an invalid length. [ 1289.726860][T20192] netlink: 'syz.7.3790': attribute type 4 has an invalid length. [ 1290.539911][ T30] audit: type=1400 audit(2000000039.622:1429): avc: denied { listen } for pid=20191 comm="syz.5.3792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1290.836878][ T30] audit: type=1400 audit(2000000039.632:1430): avc: denied { setopt } for pid=20191 comm="syz.5.3792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1290.902980][ T30] audit: type=1400 audit(2000000039.652:1431): avc: denied { create } for pid=20191 comm="syz.5.3792" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netrom_socket permissive=1 [ 1291.366405][ T944] usb 6-1: new full-speed USB device number 120 using dummy_hcd [ 1291.567089][ T944] usb 6-1: config 0 has an invalid interface number: 31 but max is 0 [ 1291.579576][ T944] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1291.710289][ T24] usb 8-1: new high-speed USB device number 46 using dummy_hcd [ 1291.714074][T20209] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1291.791501][ T944] usb 6-1: config 0 has no interface number 0 [ 1291.855424][ T944] usb 6-1: New USB device found, idVendor=046d, idProduct=08c3, bcdDevice=6b.16 [ 1291.874334][ T944] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1291.900711][ T944] usb 6-1: Product: syz [ 1291.905347][ T944] usb 6-1: Manufacturer: syz [ 1291.909964][ T944] usb 6-1: SerialNumber: syz [ 1291.918051][ T944] usb 6-1: config 0 descriptor?? [ 1291.934137][ T944] hub 6-1:0.31: bad descriptor, ignoring hub [ 1291.940232][ T944] hub 6-1:0.31: probe with driver hub failed with error -5 [ 1291.954614][ T24] usb 8-1: Using ep0 maxpacket: 8 [ 1291.955033][ T944] usb 6-1: Found UVC 0.04 device syz (046d:08c3) [ 1291.961759][ T24] usb 8-1: config 179 has an invalid interface number: 65 but max is 0 [ 1291.976937][ T944] usb 6-1: No valid video chain found. [ 1291.977385][ T24] usb 8-1: config 179 has no interface number 0 [ 1291.999132][ T24] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1292.020673][ T24] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1292.042433][ T24] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1292.057692][ T24] usb 8-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1292.069531][ T24] usb 8-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1292.083988][ T24] usb 8-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1292.095832][ T24] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1292.220735][T10049] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 1292.221119][T20205] raw-gadget.1 gadget.7: fail, usb_ep_enable returned -22 [ 1292.556923][T20217] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3799'. [ 1292.587935][ T944] usb 6-1: USB disconnect, device number 120 [ 1292.615732][T10049] usb 9-1: Using ep0 maxpacket: 16 [ 1292.656564][T20217] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3799'. [ 1292.767328][T10049] usb 9-1: config 0 has an invalid interface number: 1 but max is 0 [ 1292.787580][T10049] usb 9-1: config 0 has no interface number 0 [ 1292.795267][ T5931] usb 8-1: USB disconnect, device number 46 [ 1292.801219][ C1] xpad 8-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1292.801249][ C1] xpad 8-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1292.967733][T10049] usb 9-1: New USB device found, idVendor=04fc, idProduct=1528, bcdDevice=6d.5d [ 1292.983574][T10049] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1293.001805][T10049] usb 9-1: Product: syz [ 1293.014253][T10049] usb 9-1: Manufacturer: syz [ 1293.018907][T10049] usb 9-1: SerialNumber: syz [ 1293.030350][T10049] usb 9-1: config 0 descriptor?? [ 1293.038668][T10049] gspca_main: spca1528-2.14.0 probing 04fc:1528 [ 1293.249011][ T30] audit: type=1400 audit(2000000042.612:1432): avc: denied { unmount } for pid=18761 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:hugetlbfs_t tclass=filesystem permissive=1 [ 1293.320685][T20230] bridge0: port 2(bridge_slave_1) entered disabled state [ 1293.328324][T20230] bridge0: port 1(bridge_slave_0) entered disabled state [ 1293.340523][T20230] bridge0: entered allmulticast mode [ 1293.359802][T20230] bridge_slave_1: left allmulticast mode [ 1293.366774][T20230] bridge_slave_1: left promiscuous mode [ 1293.374334][T20230] bridge0: port 2(bridge_slave_1) entered disabled state [ 1293.396841][T20230] bridge_slave_0: left allmulticast mode [ 1293.402743][T20230] bridge_slave_0: left promiscuous mode [ 1293.585170][T20230] bridge0: port 1(bridge_slave_0) entered disabled state [ 1294.632855][T10049] gspca_spca1528: reg_w err -71 [ 1294.642785][T10049] spca1528 9-1:0.1: probe with driver spca1528 failed with error -71 [ 1294.681543][ T30] audit: type=1400 audit(2000000044.042:1433): avc: denied { read write } for pid=20245 comm="syz.9.3804" name="video37" dev="devtmpfs" ino=1051 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1294.707488][T10049] usb 9-1: USB disconnect, device number 46 [ 1294.730332][ T30] audit: type=1400 audit(2000000044.042:1434): avc: denied { open } for pid=20245 comm="syz.9.3804" path="/dev/video37" dev="devtmpfs" ino=1051 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1295.108804][ T30] audit: type=1400 audit(2000000044.102:1435): avc: denied { ioctl } for pid=20245 comm="syz.9.3804" path="/dev/video37" dev="devtmpfs" ino=1051 ioctlcmd=0x5627 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:v4l_device_t tclass=chr_file permissive=1 [ 1295.361682][ T30] audit: type=1400 audit(2000000044.722:1436): avc: denied { getopt } for pid=20260 comm="syz.7.3809" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=ieee802154_socket permissive=1 [ 1295.427383][T20268] tipc: Enabled bearer , priority 0 [ 1295.445970][T20268] tipc: Disabling bearer [ 1295.804509][ T944] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 1296.004649][ T944] usb 6-1: Using ep0 maxpacket: 8 [ 1296.082569][ T944] usb 6-1: config 179 has an invalid interface number: 65 but max is 0 [ 1296.180437][ T944] usb 6-1: config 179 has no interface number 0 [ 1296.191922][ T944] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has an invalid bInterval 0, changing to 7 [ 1296.207911][ T944] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0xF has invalid maxpacket 1025, setting to 1024 [ 1296.222319][ T944] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1296.237306][ T944] usb 6-1: config 179 interface 65 altsetting 0 endpoint 0x83 has invalid maxpacket 41728, setting to 1024 [ 1296.249666][ T944] usb 6-1: config 179 interface 65 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1296.263828][ T944] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1296.273704][ T944] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1296.285572][T20279] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1296.369146][T20287] lo speed is unknown, defaulting to 1000 [ 1296.376298][T20287] lo speed is unknown, defaulting to 1000 [ 1296.565817][T10049] usb 6-1: USB disconnect, device number 121 [ 1296.571870][ C0] xpad 6-1:179.65: xpad_irq_in - usb_submit_urb failed with result -19 [ 1296.571913][ C0] xpad 6-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1296.697452][T16634] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 1297.286269][T16634] usb 1-1: Using ep0 maxpacket: 8 [ 1297.749301][T16634] usb 1-1: config 0 contains an unexpected descriptor of type 0x1, skipping [ 1297.999387][T16634] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1298.327620][T16634] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1298.363993][T14262] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 1298.370409][T16634] usb 1-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1299.347036][T16634] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1299.364600][T14262] usb 10-1: Using ep0 maxpacket: 8 [ 1299.371798][T14262] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1299.374356][T16634] usb 1-1: config 0 descriptor?? [ 1299.433898][T14262] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1299.460090][T14262] usb 10-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1299.564484][T14262] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1299.634468][T14262] usb 10-1: config 0 descriptor?? [ 1299.674397][T16634] usb 1-1: can't set config #0, error -71 [ 1299.682103][T16634] usb 1-1: USB disconnect, device number 13 [ 1299.786206][T14262] usbhid 10-1:0.0: can't add hid device: -71 [ 1299.792353][T14262] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1300.016964][T20320] Cannot find add_set index 0 as target [ 1300.037572][T20320] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 1300.045534][T20320] UDF-fs: Scanning with blocksize 512 failed [ 1300.055243][T20320] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 1300.062789][T20320] UDF-fs: Scanning with blocksize 1024 failed [ 1300.071263][T20320] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 1300.078888][T20320] UDF-fs: Scanning with blocksize 2048 failed [ 1300.086473][T20320] UDF-fs: warning (device nullb0): udf_load_vrs: No VRS found [ 1300.094030][T20320] UDF-fs: Scanning with blocksize 4096 failed [ 1300.358940][T14262] usb 10-1: USB disconnect, device number 16 [ 1300.369528][T20321] netlink: 40 bytes leftover after parsing attributes in process `syz.8.3827'. [ 1300.388167][T20322] afs: Unknown parameter 'dyn' [ 1300.860131][T20317] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1300.874401][T20317] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1300.977133][T20333] netlink: 'syz.0.3830': attribute type 1 has an invalid length. [ 1301.078979][T20339] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1301.323416][T20333] bond2: entered promiscuous mode [ 1301.330051][T20333] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1301.392241][T20340] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1301.414614][T20340] bond2: (slave ip6gre1): The slave device specified does not support setting the MAC address [ 1301.434108][T20340] bond2: (slave ip6gre1): Setting fail_over_mac to active for active-backup mode [ 1301.505464][T20347] loop2: detected capacity change from 0 to 7 [ 1301.513171][T20347] Dev loop2: unable to read RDB block 7 [ 1301.519033][T20347] loop2: unable to read partition table [ 1301.532347][T20347] loop2: partition table beyond EOD, truncated [ 1301.562394][T20347] loop_reread_partitions: partition scan of loop2 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1301.589659][T20340] bond2: (slave ip6gre1): making interface the new active one [ 1301.595703][T20351] netlink: 176 bytes leftover after parsing attributes in process `syz.5.3835'. [ 1301.607187][T20340] ip6gre1: entered promiscuous mode [ 1301.640272][T20340] bond2: (slave ip6gre1): Enslaving as an active interface with an up link [ 1302.318464][T20364] FAULT_INJECTION: forcing a failure. [ 1302.318464][T20364] name failslab, interval 1, probability 0, space 0, times 0 [ 1302.331303][T20364] CPU: 1 UID: 0 PID: 20364 Comm: syz.8.3839 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1302.331329][T20364] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1302.331340][T20364] Call Trace: [ 1302.331347][T20364] [ 1302.331354][T20364] dump_stack_lvl+0x16c/0x1f0 [ 1302.331386][T20364] should_fail_ex+0x512/0x640 [ 1302.331410][T20364] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1302.331437][T20364] should_failslab+0xc2/0x120 [ 1302.331463][T20364] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1302.331486][T20364] ? __alloc_skb+0x2b2/0x380 [ 1302.331516][T20364] __alloc_skb+0x2b2/0x380 [ 1302.331540][T20364] ? __pfx___alloc_skb+0x10/0x10 [ 1302.331568][T20364] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1302.331593][T20364] netlink_alloc_large_skb+0x69/0x130 [ 1302.331614][T20364] netlink_sendmsg+0x6a1/0xdd0 [ 1302.331639][T20364] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1302.331668][T20364] ____sys_sendmsg+0xa98/0xc70 [ 1302.331690][T20364] ? copy_msghdr_from_user+0x10a/0x160 [ 1302.331715][T20364] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1302.331738][T20364] ? __lock_acquire+0xb8a/0x1c90 [ 1302.331773][T20364] ___sys_sendmsg+0x134/0x1d0 [ 1302.331800][T20364] ? __pfx____sys_sendmsg+0x10/0x10 [ 1302.331824][T20364] ? __lock_acquire+0x622/0x1c90 [ 1302.331881][T20364] __sys_sendmsg+0x16d/0x220 [ 1302.331907][T20364] ? __pfx___sys_sendmsg+0x10/0x10 [ 1302.331950][T20364] do_syscall_64+0xcd/0x4c0 [ 1302.331985][T20364] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1302.332003][T20364] RIP: 0033:0x7eff0378e929 [ 1302.332018][T20364] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1302.332036][T20364] RSP: 002b:00007eff04577038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1302.332054][T20364] RAX: ffffffffffffffda RBX: 00007eff039b6160 RCX: 00007eff0378e929 [ 1302.332066][T20364] RDX: 0000000000000000 RSI: 0000200000000200 RDI: 0000000000000005 [ 1302.332077][T20364] RBP: 00007eff04577090 R08: 0000000000000000 R09: 0000000000000000 [ 1302.332088][T20364] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1302.332099][T20364] R13: 0000000000000000 R14: 00007eff039b6160 R15: 00007fff3f864778 [ 1302.332124][T20364] [ 1302.491120][T15320] Bluetooth: hci2: command 0x0c1a tx timeout [ 1302.923721][T15320] Bluetooth: hci3: command 0x0405 tx timeout [ 1303.603902][ T5882] usb 1-1: new full-speed USB device number 14 using dummy_hcd [ 1303.723042][T20375] ntfs3(nullb0): Primary boot signature is not NTFS. [ 1303.743936][T20375] ntfs3(nullb0): try to read out of volume at offset 0x3e7ffffe00 [ 1303.743937][T20378] netlink: 176 bytes leftover after parsing attributes in process `syz.8.3843'. [ 1303.778115][ T5882] usb 1-1: config 0 has no interfaces? [ 1303.789036][ T5882] usb 1-1: New USB device found, idVendor=a6da, idProduct=7458, bcdDevice=2d.4d [ 1303.801392][ T5882] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1303.820247][ T5882] usb 1-1: Product: syz [ 1303.828915][ T5882] usb 1-1: Manufacturer: syz [ 1303.837039][ T5882] usb 1-1: SerialNumber: syz [ 1303.847664][ T5882] usb 1-1: config 0 descriptor?? [ 1304.527875][T20387] vcan0: tx drop: invalid da for name 0xffff030000000000 [ 1305.902124][T20402] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=8192 sclass=netlink_route_socket pid=20402 comm=syz.7.3852 [ 1306.054547][T20399] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 1306.127578][ T5882] usb 1-1: USB disconnect, device number 14 [ 1306.161712][ T30] audit: type=1400 audit(2000000055.523:1437): avc: denied { read } for pid=20405 comm="syz.8.3853" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rds_socket permissive=1 [ 1306.254156][ T30] audit: type=1400 audit(2000000055.613:1438): avc: denied { audit_read } for pid=20409 comm="syz.0.3855" capability=37 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=capability2 permissive=1 [ 1307.109700][ T30] audit: type=1400 audit(2000000056.423:1439): avc: denied { connect } for pid=20415 comm="syz.9.3856" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rose_socket permissive=1 [ 1307.185964][T20418] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1307.356430][T14262] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 1307.546601][T14262] usb 9-1: Using ep0 maxpacket: 8 [ 1307.555342][T14262] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1307.565817][T14262] usb 9-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1307.576030][T14262] usb 9-1: config 0 interface 0 altsetting 2 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1307.779333][T20429] batadv0: entered promiscuous mode [ 1307.784691][T20429] batadv0: entered allmulticast mode [ 1307.994512][T14262] usb 9-1: config 0 interface 0 has no altsetting 0 [ 1308.014884][T14262] usb 9-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=d4.6e [ 1308.024067][T14262] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1308.033115][T14262] usb 9-1: Product: syz [ 1308.037989][T14262] usb 9-1: Manufacturer: syz [ 1308.052863][T14262] usb 9-1: SerialNumber: syz [ 1308.067955][T14262] usb 9-1: config 0 descriptor?? [ 1308.082533][T14262] snd_usb_toneport 9-1:0.0: Line 6 TonePort UX2 found [ 1308.278433][T14262] snd_usb_toneport 9-1:0.0: cannot get proper max packet size [ 1308.286137][T10049] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 1308.297865][T14262] snd_usb_toneport 9-1:0.0: Line 6 TonePort UX2 now disconnected [ 1308.319894][T14262] snd_usb_toneport 9-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 1308.405623][ T944] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 1308.443536][T10049] usb 6-1: Using ep0 maxpacket: 8 [ 1308.450473][T10049] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1308.465916][T10049] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1308.476901][T10049] usb 6-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1308.493765][T10049] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1308.505878][T10049] usb 6-1: config 0 descriptor?? [ 1308.753683][T14262] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 1308.798249][ T944] usb 10-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 1308.893673][T20441] Invalid source name [ 1308.901311][T20441] UBIFS error (pid: 20441): cannot open "./file0", error -22 [ 1308.906104][ T944] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1309.052589][T10049] logitech 0003:046D:C20E.0059: rdesc size test failed for formula gp [ 1309.078835][T10049] logitech 0003:046D:C20E.0059: unknown main item tag 0x0 [ 1309.088440][ T944] usb 10-1: config 0 descriptor?? [ 1309.101926][T10049] logitech 0003:046D:C20E.0059: reserved main item tag 0xe [ 1309.117128][ T944] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 1309.223373][T14262] usb 1-1: Using ep0 maxpacket: 16 [ 1309.229461][T10049] logitech 0003:046D:C20E.0059: unknown main item tag 0x0 [ 1309.248802][T10049] logitech 0003:046D:C20E.0059: unbalanced collection at end of report description [ 1309.260203][T14262] usb 1-1: New USB device found, idVendor=05ac, idProduct=9226, bcdDevice=b2.89 [ 1309.777072][T14262] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1309.785589][T10049] logitech 0003:046D:C20E.0059: parse failed [ 1309.791781][T14262] usb 1-1: Product: syz [ 1309.796226][T10049] logitech 0003:046D:C20E.0059: probe with driver logitech failed with error -22 [ 1309.805417][T14262] usb 1-1: Manufacturer: syz [ 1309.810030][T14262] usb 1-1: SerialNumber: syz [ 1309.851858][T14262] usb 1-1: config 0 descriptor?? [ 1309.884846][T14262] appledisplay 1-1:0.0: Could not find int-in endpoint [ 1309.903070][T14262] usbhid 1-1:0.0: couldn't find an input interrupt endpoint [ 1310.023476][ T944] gspca_cpia1: usb_control_msg 03, error -32 [ 1310.034619][ T944] gspca_cpia1: usb_control_msg 03, error -71 [ 1310.049652][ T944] gspca_cpia1: usb_control_msg 01, error -71 [ 1310.065034][ T944] cpia1 10-1:0.0: only firmware version 1 is supported (got: 0) [ 1310.089245][ T944] usb 10-1: USB disconnect, device number 17 [ 1310.149280][T10049] usb 9-1: USB disconnect, device number 47 [ 1310.233859][T14262] usb 8-1: new high-speed USB device number 47 using dummy_hcd [ 1310.261924][ T30] audit: type=1400 audit(2000000059.623:1440): avc: denied { sqpoll } for pid=20448 comm="syz.8.3869" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1 [ 1310.282205][ T30] audit: type=1400 audit(2000000059.633:1441): avc: denied { read } for pid=20448 comm="syz.8.3869" name="card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1310.306279][ T30] audit: type=1400 audit(2000000059.633:1442): avc: denied { open } for pid=20448 comm="syz.8.3869" path="/dev/dri/card1" dev="devtmpfs" ino=628 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1310.330925][ T30] audit: type=1400 audit(2000000059.633:1443): avc: denied { ioctl } for pid=20448 comm="syz.8.3869" path="/dev/dri/card1" dev="devtmpfs" ino=628 ioctlcmd=0x640d scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:dri_device_t tclass=chr_file permissive=1 [ 1310.425646][T20449] netlink: 4 bytes leftover after parsing attributes in process `syz.8.3869'. [ 1310.436343][T14262] usb 8-1: config 0 has an invalid interface number: 255 but max is 0 [ 1310.445242][T14262] usb 8-1: config 0 has no interface number 0 [ 1310.451601][T14262] usb 8-1: config 0 interface 255 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1310.462081][T14262] usb 8-1: config 0 interface 255 altsetting 0 bulk endpoint 0x82 has invalid maxpacket 0 [ 1310.475701][T14262] usb 8-1: New USB device found, idVendor=10cf, idProduct=8065, bcdDevice=91.79 [ 1310.499959][T14262] usb 8-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1310.509248][T14262] usb 8-1: Product: syz [ 1310.514220][T14262] usb 8-1: Manufacturer: syz [ 1310.518833][T14262] usb 8-1: SerialNumber: syz [ 1310.527355][T14262] usb 8-1: config 0 descriptor?? [ 1310.548153][T14262] vmk80xx 8-1:0.255: driver 'vmk80xx' failed to auto-configure device. [ 1310.566457][T14262] vmk80xx 8-1:0.255: probe with driver vmk80xx failed with error -22 [ 1310.771955][ T5931] usb 8-1: USB disconnect, device number 47 [ 1310.893297][T14262] usb 10-1: new full-speed USB device number 18 using dummy_hcd [ 1311.136987][T10049] usb 6-1: USB disconnect, device number 122 [ 1311.153423][T14262] usb 10-1: config 135 has an invalid interface number: 230 but max is 0 [ 1311.161892][T14262] usb 10-1: config 135 has an invalid descriptor of length 0, skipping remainder of the config [ 1311.179512][T14262] usb 10-1: config 135 has no interface number 0 [ 1311.186023][T14262] usb 10-1: config 135 interface 230 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 3 [ 1311.244491][T14262] usb 10-1: New USB device found, idVendor=18ec, idProduct=3288, bcdDevice=3f.3a [ 1311.259905][T14262] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1311.275357][T14262] usb 10-1: Product: syz [ 1311.279642][T14262] usb 10-1: Manufacturer: syz [ 1311.286166][T14262] usb 10-1: SerialNumber: syz [ 1311.365631][T20469] lo speed is unknown, defaulting to 1000 [ 1311.404793][T20469] lo speed is unknown, defaulting to 1000 [ 1311.518560][T14262] usb 10-1: Found UVC 0.00 device syz (18ec:3288) [ 1311.543964][T14262] usb 10-1: No valid video chain found. [ 1311.577212][T14262] usb 10-1: USB disconnect, device number 18 [ 1311.628337][T10049] usb 1-1: USB disconnect, device number 15 [ 1312.291457][T20484] SELinux: policydb magic number 0x70766564 does not match expected magic number 0xf97cff8c [ 1312.307066][T20484] SELinux: failed to load policy [ 1312.492269][T20493] overlayfs: missing 'lowerdir' [ 1312.492553][ T30] audit: type=1400 audit(2000000061.853:1444): avc: denied { mounton } for pid=20490 comm="syz.0.3884" path="/proc/662/cgroup" dev="nsfs" ino=4026533473 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:nsfs_t tclass=file permissive=1 [ 1312.520905][ C1] vkms_vblank_simulate: vblank timer overrun [ 1313.793472][T20512] netlink: 4 bytes leftover after parsing attributes in process `syz.0.3890'. [ 1313.836878][T15320] Bluetooth: hci2: unexpected event for opcode 0x326d [ 1314.093198][T14262] usb 8-1: new high-speed USB device number 48 using dummy_hcd [ 1314.493266][ T31] INFO: task kworker/u8:7:5926 blocked for more than 143 seconds. [ 1314.516104][ T31] Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 [ 1314.593992][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1314.602757][ T31] task:kworker/u8:7 state:D stack:23512 pid:5926 tgid:5926 ppid:2 task_flags:0x4208160 flags:0x00004000 [ 1314.615171][ T31] Workqueue: netns cleanup_net [ 1314.620011][ T31] Call Trace: [ 1314.627307][ T31] [ 1314.630302][ T31] __schedule+0x116a/0x5de0 [ 1314.636126][ T31] ? __lock_acquire+0x622/0x1c90 [ 1314.641183][ T31] ? __pfx___schedule+0x10/0x10 [ 1314.647461][ T31] ? find_held_lock+0x2b/0x80 [ 1314.664352][T14262] usb 8-1: Using ep0 maxpacket: 8 [ 1314.743366][ T31] ? schedule+0x2d7/0x3a0 [ 1314.747913][ T31] schedule+0xe7/0x3a0 [ 1314.748630][T14262] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1314.752082][ T31] afs_cell_purge+0x41f/0x4f0 [ 1314.768254][ T31] ? __try_to_del_timer_sync+0x115/0x170 [ 1314.778510][T14262] usb 8-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1314.778769][ T31] ? __pfx_afs_cell_purge+0x10/0x10 [ 1314.798396][ T31] ? __pfx_var_wake_function+0x10/0x10 [ 1314.804283][ T31] ? __timer_delete_sync+0x108/0x1b0 [ 1314.806086][T14262] usb 8-1: New USB device found, idVendor=046d, idProduct=c20e, bcdDevice= 0.00 [ 1314.809640][ T31] ? __pfx_afs_net_exit+0x10/0x10 [ 1314.824221][ T31] afs_net_exit+0x83/0x140 [ 1314.826932][T14262] usb 8-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1314.828727][ T31] ops_undo_list+0x2eb/0xab0 [ 1314.841754][ T31] ? __pfx_ops_undo_list+0x10/0x10 [ 1314.846422][T14262] usb 8-1: config 0 descriptor?? [ 1314.851480][ T31] ? __local_bh_enable_ip+0xa4/0x120 [ 1314.858098][ T31] cleanup_net+0x408/0x890 [ 1314.862658][ T31] ? __pfx_cleanup_net+0x10/0x10 [ 1314.869565][ T31] ? rcu_is_watching+0x12/0xc0 [ 1314.874710][ T31] process_one_work+0x9cf/0x1b70 [ 1314.879672][ T31] ? __pfx_nsim_dev_trap_report_work+0x10/0x10 [ 1314.886509][ T31] ? __pfx_process_one_work+0x10/0x10 [ 1314.891921][ T31] ? assign_work+0x1a0/0x250 [ 1314.896939][ T31] worker_thread+0x6c8/0xf10 [ 1314.901577][ T31] ? __kthread_parkme+0x19e/0x250 [ 1314.907379][ T31] ? __pfx_worker_thread+0x10/0x10 [ 1314.912499][ T31] kthread+0x3c5/0x780 [ 1314.916601][ T31] ? __pfx_kthread+0x10/0x10 [ 1314.922116][ T31] ? rcu_is_watching+0x12/0xc0 [ 1314.927489][ T31] ? __pfx_kthread+0x10/0x10 [ 1314.933248][ T31] ret_from_fork+0x5d4/0x6f0 [ 1314.938291][ T31] ? __pfx_kthread+0x10/0x10 [ 1314.943630][ T31] ret_from_fork_asm+0x1a/0x30 [ 1314.948605][ T31] [ 1314.966439][ T31] [ 1314.966439][ T31] Showing all locks held in the system: [ 1314.986792][ T31] 1 lock held by khungtaskd/31: [ 1314.991681][ T31] #0: ffffffff8e5c4840 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x36/0x1c0 [ 1315.005105][ T31] 2 locks held by kworker/u8:5/616: [ 1315.010344][ T31] #0: ffff8880b843bc98 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x7e/0x130 [ 1315.020837][ T31] #1: ffffc90003127d10 ((work_completion)(&(&kfence_timer)->work)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1315.033017][ T31] 2 locks held by getty/5575: [ 1315.037859][ T31] #0: ffff8880370d20a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80 [ 1315.050446][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x41b/0x14f0 [ 1315.061560][ T31] 3 locks held by kworker/u8:7/5926: [ 1315.069454][ T31] #0: ffff88801c6f3948 ((wq_completion)netns){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1315.081971][ T31] #1: ffffc9000bb47d10 (net_cleanup_work){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1315.092121][ T31] #2: ffffffff90336b90 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xad/0x890 [ 1315.101506][ T31] 5 locks held by kworker/0:0/14262: [ 1315.106835][ T31] #0: ffff88801bf5bd48 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_one_work+0x12a2/0x1b70 [ 1315.117679][ T31] #1: ffffc9000482fd10 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_one_work+0x929/0x1b70 [ 1315.132742][ T31] #2: ffff888029d9b198 (&dev->mutex){....}-{4:4}, at: hub_event+0x1c0/0x4fa0 [ 1315.141768][ T31] #3: ffff888062bdc198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1315.151094][ T31] #4: ffff88807a462160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x7e/0x4b0 [ 1315.160394][ T31] 2 locks held by syz.8.3886/20499: [ 1315.165646][ T31] #0: ffffffff903f1390 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40 [ 1315.173897][ T31] #1: ffffffff8e9de968 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_listener_set_doit+0xdd/0x1a40 [ 1315.184135][ T31] [ 1315.186461][ T31] ============================================= [ 1315.186461][ T31] [ 1315.196802][ T31] NMI backtrace for cpu 1 [ 1315.196816][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1315.196830][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1315.196837][ T31] Call Trace: [ 1315.196841][ T31] [ 1315.196845][ T31] dump_stack_lvl+0x116/0x1f0 [ 1315.196866][ T31] nmi_cpu_backtrace+0x27b/0x390 [ 1315.196885][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1315.196909][ T31] nmi_trigger_cpumask_backtrace+0x29c/0x300 [ 1315.196931][ T31] watchdog+0xf70/0x12c0 [ 1315.196953][ T31] ? __pfx_watchdog+0x10/0x10 [ 1315.196965][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1315.196982][ T31] ? __kthread_parkme+0x19e/0x250 [ 1315.196999][ T31] ? __pfx_watchdog+0x10/0x10 [ 1315.197010][ T31] kthread+0x3c5/0x780 [ 1315.197023][ T31] ? __pfx_kthread+0x10/0x10 [ 1315.197041][ T31] ? rcu_is_watching+0x12/0xc0 [ 1315.197061][ T31] ? __pfx_kthread+0x10/0x10 [ 1315.197077][ T31] ret_from_fork+0x5d4/0x6f0 [ 1315.197097][ T31] ? __pfx_kthread+0x10/0x10 [ 1315.197109][ T31] ret_from_fork_asm+0x1a/0x30 [ 1315.197132][ T31] [ 1315.197139][ T31] Sending NMI from CPU 1 to CPUs 0: [ 1315.316427][ C0] NMI backtrace for cpu 0 [ 1315.316441][ C0] CPU: 0 UID: 0 PID: 13 Comm: kworker/u8:1 Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1315.316459][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1315.316472][ C0] Workqueue: bat_events batadv_nc_worker [ 1315.316495][ C0] RIP: 0010:mark_lock+0xa7/0x610 [ 1315.316516][ C0] Code: 00 00 74 7f 48 8b 54 24 68 65 48 2b 15 9a 6f 34 12 0f 85 e8 04 00 00 48 8d 65 d8 5b 41 5c 41 5d 41 5e 41 5f 5d e9 59 52 ea 09 46 22 03 74 8d 41 bd 00 02 00 00 bb 09 00 00 00 eb 8e 44 8b 1d [ 1315.316530][ C0] RSP: 0018:ffffc90000127940 EFLAGS: 00000046 [ 1315.316541][ C0] RAX: 0000000000000000 RBX: 0000000000000008 RCX: ffffffff95d975c0 [ 1315.316550][ C0] RDX: 0000000000000008 RSI: ffff88801e2b8b40 RDI: ffff88801e2b8000 [ 1315.316560][ C0] RBP: ffffc900001279d8 R08: 0000000000000000 R09: 0000000000000000 [ 1315.316568][ C0] R10: 0000000000000050 R11: 0000000000000001 R12: ffff88801e2b8b40 [ 1315.316577][ C0] R13: ffff88801e2b8b40 R14: 0000000000000002 R15: ffff88801e2b8000 [ 1315.316587][ C0] FS: 0000000000000000(0000) GS:ffff888124754000(0000) knlGS:0000000000000000 [ 1315.316601][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1315.316611][ C0] CR2: 0000001b336f4ff8 CR3: 000000000e382000 CR4: 00000000003526f0 [ 1315.316620][ C0] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 1315.316629][ C0] DR3: 0000000000000000 DR6: 00000000fffe0ff0 DR7: 0000000000000400 [ 1315.316637][ C0] Call Trace: [ 1315.316643][ C0] [ 1315.316651][ C0] ? __lock_acquire+0xb8a/0x1c90 [ 1315.316671][ C0] __lock_acquire+0x3e9/0x1c90 [ 1315.316694][ C0] lock_acquire+0x179/0x350 [ 1315.316712][ C0] ? batadv_nc_worker+0x159/0x1030 [ 1315.316730][ C0] ? batadv_nc_worker+0x895/0x1030 [ 1315.316748][ C0] batadv_nc_worker+0x16a/0x1030 [ 1315.316764][ C0] ? batadv_nc_worker+0x159/0x1030 [ 1315.316787][ C0] ? __pollwait+0x179/0x490 [ 1315.316803][ C0] ? _raw_spin_unlock_irqrestore+0x3b/0x80 [ 1315.316824][ C0] ? __pfx_batadv_nc_worker+0x10/0x10 [ 1315.316843][ C0] ? rcu_is_watching+0x12/0xc0 [ 1315.316861][ C0] process_one_work+0x9cf/0x1b70 [ 1315.316878][ C0] ? __pfx_process_one_work+0x10/0x10 [ 1315.316894][ C0] ? assign_work+0x1a0/0x250 [ 1315.316915][ C0] worker_thread+0x6c8/0xf10 [ 1315.316932][ C0] ? __pfx_worker_thread+0x10/0x10 [ 1315.316945][ C0] kthread+0x3c5/0x780 [ 1315.316958][ C0] ? __pfx_kthread+0x10/0x10 [ 1315.316970][ C0] ? rcu_is_watching+0x12/0xc0 [ 1315.316985][ C0] ? __pfx_kthread+0x10/0x10 [ 1315.316997][ C0] ret_from_fork+0x5d4/0x6f0 [ 1315.317016][ C0] ? __pfx_kthread+0x10/0x10 [ 1315.317027][ C0] ret_from_fork_asm+0x1a/0x30 [ 1315.317046][ C0] [ 1315.581144][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1315.588017][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted 6.16.0-rc1-syzkaller-00003-gf09079bd04a9 #0 PREEMPT(full) [ 1315.599826][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1315.609878][ T31] Call Trace: [ 1315.613137][ T31] [ 1315.616064][ T31] dump_stack_lvl+0x3d/0x1f0 [ 1315.620641][ T31] panic+0x71c/0x800 [ 1315.624540][ T31] ? __pfx_panic+0x10/0x10 [ 1315.628960][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1315.634324][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1315.640283][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 1315.645641][ T31] ? watchdog+0xdda/0x12c0 [ 1315.650034][ T31] ? watchdog+0xdcd/0x12c0 [ 1315.654428][ T31] watchdog+0xdeb/0x12c0 [ 1315.658661][ T31] ? __pfx_watchdog+0x10/0x10 [ 1315.663327][ T31] ? lockdep_hardirqs_on+0x7c/0x110 [ 1315.668519][ T31] ? __kthread_parkme+0x19e/0x250 [ 1315.673546][ T31] ? __pfx_watchdog+0x10/0x10 [ 1315.678223][ T31] kthread+0x3c5/0x780 [ 1315.682273][ T31] ? __pfx_kthread+0x10/0x10 [ 1315.686843][ T31] ? rcu_is_watching+0x12/0xc0 [ 1315.691592][ T31] ? __pfx_kthread+0x10/0x10 [ 1315.696160][ T31] ret_from_fork+0x5d4/0x6f0 [ 1315.700731][ T31] ? __pfx_kthread+0x10/0x10 [ 1315.705298][ T31] ret_from_fork_asm+0x1a/0x30 [ 1315.710046][ T31] [ 1315.713256][ T31] Kernel Offset: disabled [ 1315.717558][ T31] Rebooting in 86400 seconds..