last executing test programs:

7m9.536483732s ago: executing program 32 (id=713):
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0xc, 0x100008b}, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
syz_open_dev$video(0x0, 0xfffffffd, 0x10bd00)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
connect$can_bcm(0xffffffffffffffff, &(0x7f00000005c0), 0x10)
sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={0x0, 0x48}}, 0x0)
r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
syz_genetlink_get_family_id$netlbl_cipso(&(0x7f00000001c0), r1)
r2 = socket$nl_generic(0x10, 0x3, 0x10)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f00000003c0)={[], [], 0x2f})
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000a00)='dir0/per_cpu/cpu0/trace\x00', 0x0, 0x0)
read(r3, &(0x7f0000000180)=""/4, 0x1)
sendmsg$nl_generic(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000002c0)=ANY=[@ANYBLOB="5407000044000701fefffffffcdbdf25037c0000040045803c0701"], 0x754}}, 0xc000)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r2)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x2, 0x0)
write(r4, &(0x7f0000000300)='sub:evt:mod:syz_mod_123\n', 0x18)
write(r4, &(0x7f0000000400)='!sub:evt:mod:syz_mod_123\n', 0x19)
r5 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x802, 0x0)
write$uinput_user_dev(r5, &(0x7f0000000a00)={'syz0\x00', {0x6ec9, 0x7, 0x5, 0x5}, 0x3e, [0x9, 0x5, 0x8, 0x2, 0x5338, 0x400, 0x80000000, 0x8ef7, 0x8, 0x0, 0x6, 0xf5, 0x5, 0x39, 0x2, 0x8, 0xfffffb9a, 0xfffffffc, 0x4, 0xfffffffb, 0x4, 0x3, 0x4, 0xf252, 0x4, 0x800, 0x300000, 0x7, 0xe, 0x5, 0x0, 0x2, 0x1ff, 0xf1, 0x3ff, 0x3, 0xd, 0x3, 0xba55, 0x1000, 0x2, 0x200, 0x2, 0x400008, 0x8, 0x4, 0x2, 0x0, 0x8, 0x1009, 0x1, 0x19a3, 0x8, 0x2, 0x9, 0x1, 0x4, 0x6, 0x1000, 0x5, 0x40, 0x9, 0x402, 0x5], [0x391, 0x1e, 0x3, 0x8000, 0xfffffffe, 0x3, 0x0, 0x5, 0x27, 0xfffffffc, 0x4, 0x7fff, 0x72c, 0x1c32, 0x3, 0x9, 0x10000, 0x400, 0x8001, 0x3, 0x1, 0x297, 0x6, 0x0, 0x981, 0x4, 0x104, 0x3ff, 0x0, 0xfffffffe, 0x0, 0x1000001, 0x10, 0xfffffff9, 0x0, 0x5, 0x1, 0xffffffff, 0x6, 0x5, 0x800, 0xffff, 0x6, 0x8000, 0x7c4, 0x101, 0x0, 0x2, 0xffffffff, 0xc, 0x3, 0x379, 0x9, 0xe, 0x5, 0xb, 0x6, 0x2, 0x1, 0x1, 0x8, 0x6, 0x200, 0x3], [0x401, 0xc584, 0x34711b8a, 0xcd4, 0xffff, 0x20, 0x7, 0x4, 0x8, 0x10, 0x7, 0x9, 0xe8b, 0x5, 0x80000001, 0x8, 0x3, 0x1000, 0x2, 0xe, 0x1, 0xfffffff9, 0xe55, 0x10, 0x80000001, 0x4, 0x4, 0x7, 0x9, 0x2, 0x20000005, 0xca, 0x9, 0xb, 0x47, 0x2, 0x3, 0x7, 0x7, 0x100, 0x3, 0x8, 0x8001, 0xbf23, 0x6, 0x6, 0xa, 0xffffffff, 0x40004, 0x3, 0x6, 0x100fffe, 0x2005, 0x7, 0x4, 0xea, 0x9, 0x9, 0x2, 0xd9, 0x0, 0x7ff, 0x401, 0x5], [0x108e, 0x7fff, 0x3, 0x3, 0x88, 0x2, 0x6, 0x4, 0x40, 0x2, 0x763, 0xb, 0x402, 0x800, 0x2, 0x1000, 0x7f, 0x5, 0x3fa6, 0x4, 0x8e8, 0x5, 0x6, 0x4, 0xe47, 0x4, 0x0, 0x4, 0x200, 0x1000, 0x3a, 0x2, 0x5, 0x800, 0xa80a, 0x65f413f9, 0x4, 0x8, 0x8a8, 0x2, 0x40, 0x7, 0x2, 0x4, 0x4, 0x1000010, 0xf, 0x0, 0x7fff, 0x1, 0xfffffff8, 0x401, 0x1, 0x200, 0x7, 0x4edf, 0xfffffffd, 0x7, 0xe, 0x2, 0xe, 0x0, 0x135, 0x6]}, 0x45c)
ioctl$UI_DEV_CREATE(r5, 0x5501)

3m57.63874002s ago: executing program 33 (id=1483):
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000080)={0xffffffffffffffff, <r0=>0xffffffffffffffff})
signalfd4(0xffffffffffffffff, &(0x7f0000000d40)={[0x8]}, 0x8, 0x800)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x2840, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil})
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text64={0x40, 0x0}], 0x1, 0x64, 0x0, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000180))
setns(0xc9, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f00000000c0)='./nfsd\x00', &(0x7f0000000100)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000140)='./nfsd/portlist\x00', 0x1, 0x0)
write(r4, &(0x7f0000000180)='3', 0x1)
ioctl$KVM_RUN(r3, 0xae80, 0x0)
ioctl$KVM_SET_SREGS(r3, 0x4138ae84, &(0x7f0000000500)={{0xeeee8000, 0x41000, 0x8, 0x9, 0xb9, 0x40, 0x40, 0x9, 0x0, 0x2e, 0x10}, {0x2000, 0x1, 0xf, 0xc, 0x2, 0x4, 0x7d, 0x7, 0x58, 0x1, 0x3}, {0x50000, 0xeeee8000, 0xe, 0x5, 0x3, 0x7, 0xfe, 0x9, 0x1, 0xab, 0x5, 0x81}, {0xffff1000, 0x26000, 0x3, 0x5d, 0x4, 0x42, 0x9, 0x2, 0x26, 0x7, 0xe, 0xff}, {0x0, 0x9000, 0xb, 0x3, 0x3, 0x7, 0xab, 0x7f, 0x7, 0x83, 0xf7, 0x83}, {0x1000, 0x1000, 0x0, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x80, 0xf, 0x1, 0xff}, {0x40000, 0x2, 0x3, 0x0, 0x7, 0x2, 0x5, 0x2, 0x1, 0x82, 0xff}, {0x41000, 0x80a0000, 0xa, 0x5, 0xf, 0x8, 0x1, 0x18, 0x2, 0x3, 0x7, 0x9}, {0xeeef0000, 0x30}, {0x7000, 0x86}, 0x80000031, 0x0, 0x50000, 0x42004, 0xb, 0x0, 0x3000, [0xd, 0xd, 0x5e, 0x102]})
socket$nl_generic(0x10, 0x3, 0x10)
syz_usb_connect$uac3(0x3, 0x80, &(0x7f0000000000)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x20, 0x763, 0x2030, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x6e, 0x3, 0x1, 0x7f, 0x0, 0x6, {0x8, 0xb, 0x0, 0x2, 0x1, 0x20, 0x30, 0x23}, {{{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x30, 0x0, {{0xa, 0x24, 0x1, 0x10, 0xa, 0xb}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x60, 0x25, 0x10, 0x5, {0xa, 0x25, 0x25, 0x800, 0x5, 0x5}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x30, 0x0, {}, {{0x9, 0x5, 0x82, 0x9, 0x200, 0x74, 0x9, 0xc0, {0xa, 0x25, 0x25, 0xfb63, 0xff, 0xbe1}}}}}}}}]}}, 0x0)
pselect6(0x40, &(0x7f0000000180)={0xa, 0x2, 0x0, 0x1, 0x4000000000010001, 0x8, 0x1000000000938f, 0xfffffffffffffffa}, &(0x7f0000000080)={0x209, 0x40, 0x100000004010001, 0x5, 0x11, 0x4, 0x8, 0x1004}, 0x0, 0x0, 0x0)
ioctl$SIOCSIFHWADDR(r0, 0x8b26, &(0x7f0000000000)={'wlan1\x00', @random="19ff00ff0300"})

2m40.138082368s ago: executing program 3 (id=1850):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000380)=@newsa={0x13c, 0x10, 0x401, 0x2000, 0x0, {{@in=@multicast2, @in6=@remote, 0x0, 0x0, 0x0, 0x0, 0xa, 0x80, 0x0, 0x2f}, {@in6=@local, 0x1234, 0x33}, @in6=@mcast2, {0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff}, {}, {}, 0x0, 0x0, 0xa, 0x2}, [@algo_auth_trunc={0x4c, 0x1, {{'sha1\x00'}, 0x0, 0x60}}]}, 0x13c}}, 0x0)
r1 = socket$inet6(0xa, 0x2, 0x0)
setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000040)=0x5, 0x4)
connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e20, 0x8000, @empty, 0x3}, 0x1c)

2m39.991927745s ago: executing program 3 (id=1852):
semop(0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
syz_clone(0x8202000, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mbind(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4001, 0x0, 0x7, 0x0)
semtimedop(0x0, &(0x7f0000000180), 0x0, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
r3 = io_uring_setup(0x3eae, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x0, 0x1a1})
io_uring_register$IORING_REGISTER_BUFFERS(r3, 0x0, &(0x7f0000000400)=[{&(0x7f0000000180)=""/90, 0x5a}, {&(0x7f0000000300)=""/231, 0xe7}], 0x2)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15)
socket$netlink(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_procfs(r0, &(0x7f0000000100)='net/netfilter\x00')
r4 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90)

2m39.136819734s ago: executing program 3 (id=1856):
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001080)=[{&(0x7f0000000040)="a72d11a15c048c0a7d63aebc5cea1f815108f6091475aeec60", 0x19}], 0x1}, 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$netlink(r0, &(0x7f00000047c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000340)={0x74, 0x77, 0x2, 0x70bd2d, 0x3, "", [@generic="83a0ffd4c6ae72c67dba50ec552e8e9c4c93f7f2fa2177bb0f4fdc7c9488ae2546d70d696133733ca43ea33602a4c36d69e055b2f0bc5e23061900d86acc1e2fdd0de1a5b96747dcecc2f109bc0e556c992841f8ecf10ae0bb0822b4a51489d9e947886b"]}, 0x83}], 0x1, 0x0, 0x0, 0x2004c091}, 0xc5)
r1 = creat(&(0x7f0000000200)='./file0\x00', 0x109)
close(r1)
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="1b000000000000ff010000000000000000000000539bc2e61eb8dd46c8e7dccd8cee3d3b3f0f26e937914f7e3742559a05506875e5f99294aad26eda3d6841f4b701408a6d1da53e5af6e720e3f31f557c9289a4eeea77f1e453a59ababa8b374816347199797ad58045492b492e96e97c9f14ddcb36657f479e1044157ec62c280dce335d8e2aa6e886a3f0b05b1c565caa90427cb886bb0986a4862e543ecb9542", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50)
mount$9p_fd(0x0, &(0x7f0000000300)='./sys\x00', &(0x7f00000002c0), 0x100000, &(0x7f0000000480)={'trans=fd,', {'rfdno', 0x3d, r1}, 0x2c, {'wfdno', 0x3d, r2}})
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
read$char_usb(0xffffffffffffffff, 0x0, 0x0)
syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$TCGETS2(r1, 0x802c542a, &(0x7f0000000400))
mount(0x0, &(0x7f0000000080)='./sys\x00', &(0x7f00000000c0)='sysfs\x00', 0x0, 0x0)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
timer_settime(0x0, 0x1, &(0x7f00000004c0)={{0x77359400}}, &(0x7f0000000500))
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000600)={&(0x7f0000000180)={0x4c, 0x2, 0x6, 0x801, 0x0, 0x0, {0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_HASHSIZE={0x8, 0x12, 0x1, 0x0, 0xfffffffe}]}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_TYPENAME={0xd, 0x3, 'hash:net\x00'}]}, 0x4c}, 0x1, 0x0, 0x0, 0x4028055}, 0x0)
sendmsg$nl_generic(r3, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=ANY=[@ANYBLOB="4800000041000501010000000000000001010000000000001c0001000600060008000000100007007f0000017f000001910040001400020010000c0005"], 0x48}, 0x1, 0x0, 0x0, 0x4044850}, 0xc040)
openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/usb/devices/usb1/1-0:1.0/usb1-port1/disable\x00', 0x1, 0x0)
sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x8012, 0x0, 0x0)
r4 = syz_open_dev$tty1(0xc, 0x4, 0x1)
ioctl$KDGETMODE(r4, 0x4b3b, &(0x7f00000017c0))
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000540)={0x1b, 0x3, 0x0, 0x0, 0x9, 0x0, 0xffffffffffffffff, 0x0, 0x3a}, 0x94)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000240)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
r7 = socket$nl_netfilter(0x10, 0x3, 0xc)
splice(r7, 0x0, 0xffffffffffffffff, 0x0, 0x6, 0x0)
sendfile(r4, 0xffffffffffffffff, &(0x7f0000000040)=0x3, 0xac5)
syz_clone3(&(0x7f0000000900)={0x23800000, &(0x7f0000000040)=<r8=>0xffffffffffffffff, 0x0, 0x0, {0x27}, 0x0, 0x0, 0x0, 0x0}, 0x58)
io_setup(0x8, &(0x7f0000000280)=<r9=>0x0)
io_submit(r9, 0x1, &(0x7f0000001300)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x6, r8, 0x0}])
sendmsg$NFNL_MSG_CTHELPER_GET(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRES16=r5], 0x14}}, 0x10)
ioctl$sock_SIOCETHTOOL(r6, 0x8946, &(0x7f0000000080)={'netdevsim0\x00', &(0x7f0000000540)=@ethtool_sfeatures={0x11}})

2m38.347372659s ago: executing program 3 (id=1860):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
getpeername(r2, &(0x7f00000003c0)=@l2tp6={0xa, 0x0, 0x0, @local}, &(0x7f0000000440)=0x80)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x20008811)
socket$kcm(0x29, 0x2, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x1a, 0x28, 0x66, 0x0, 0x3, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x23}}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x4ede, 0x0, 0xec6}}}}}}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x89f6, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0xb, "2a16561edfd2f20ab3ed4a"}})
syz_emit_ethernet(0x4a, &(0x7f0000000440)=ANY=[], 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x2f, &(0x7f0000001f40)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32], 0xfc}}, 0x0)
sendmsg$nl_xfrm(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x0)

2m32.891023987s ago: executing program 4 (id=1891):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
openat$kvm(0x0, &(0x7f0000000100), 0x0, 0x0)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000080), 0x101302, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
ioctl$KVM_CREATE_DEVICE(r2, 0xc00caee0, &(0x7f0000000100)={0x4})
sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x0, 0x0, {{@in6=@rand_addr=' \x01\x00', @in=@local, 0x4e20, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa9, 0x800000000000, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xa00, 0x40800000000000, 0x800000000000000}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, [@tmpl={0x44, 0x5, [{{@in=@local, 0x8000, 0x3c}, 0x0, @in=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x20000, 0x0, 0x3}]}]}, 0xfc}}, 0x0)
r3 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r3, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f00000005c0)=@migrate={0xec, 0x21, 0x1, 0x0, 0x4, {{@in6=@private1, @in6=@dev={0xfe, 0x80, '\x00', 0x8}, 0x4e22, 0x5, 0x0, 0x0, 0xa}}, [@migrate={0x9c, 0x11, [{@in6=@remote, @in6=@local, @in=@loopback, @in6=@private2, 0x32, 0x5, 0x0, 0x3501, 0x2, 0x2}, {@in6=@private1={0xfc, 0x1, '\x00', 0x1}, @in6=@private1, @in6=@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, 0x3c, 0x0, 0x0, 0x0, 0xa, 0xa}]}]}, 0xec}}, 0x0)
r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000002c0), 0x2, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000004c0)=ANY=[], 0x18}}, 0x0)
ioctl$VHOST_SET_OWNER(r4, 0xaf01, 0x0)
r5 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x110, 0x0, 0x0, 0x0, 0x10, 0x1038, 0x12c2, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x80, 0x3, "", [{{0x9, 0x4, 0x0, 0xb, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0xc259, 0xf8, 0x1, {0x22, 0x28}}, {{{0x9, 0x5, 0x81, 0x3, 0x10, 0x0, 0xfd, 0xfe}}}}}]}}]}}, 0x0)
syz_usb_control_io$hid(r5, 0x0, 0x0)
syz_usb_control_io(r5, &(0x7f00000003c0)={0x2c, &(0x7f0000000040)=ANY=[@ANYBLOB="202328010000280583efb930f0187ff0"], 0x0, 0x0, 0x0, 0x0}, 0x0)
r6 = openat$nvme_fabrics(0xffffffffffffff9c, &(0x7f0000000040), 0x281, 0x0)
ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000500)={0x9, 0x0, [{0x1f7, 0x0, 0x9}, {0xd90, 0x0, 0x74c}, {0xa07, 0x0, 0x3e}, {0x40000070, 0x0, 0x3}, {0x936, 0x0, 0x7ff}, {0x9b0, 0x0, 0xd00a}, {0x25d, 0x0, 0x2}, {0x64c, 0x0, 0x7fffffff}, {0x95a, 0x0, 0x800000000}]})
clock_gettime(0x6, &(0x7f0000000080))
ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000300)={0x1, 0x0, 0x0, &(0x7f0000000480)=""/74, 0x0})
r7 = socket(0x10, 0x3, 0x0)
r8 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', <r9=>0x0})
sendmsg$nl_route_sched(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000280)=@newqdisc={0x2c4, 0x24, 0x3fe3aa0262d8c783, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x8}}, [@qdisc_kind_options=@q_choke={{0xa}, {0x294, 0x2, [@TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x2}}, @TCA_CHOKE_PARMS={0x5, 0x1, {0x64, 0x2, 0x3, 0x17, 0x11, 0x8, 0x4}}, @TCA_CHOKE_MAX_P={0x0, 0x3, 0x2}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_STAB={0x104, 0x2, "dc542b4e237011fb38ddb228806571a8633206e26df63a43bbc516382325dedd79c1cf0a26379dfaf72cb5ab9ab7efe16f312ee9ab598d1ac0d7903ac69c51f1b6842ebecf00dec5deff737b59f0c1f0b57cc6c2b7b8c5b2c527aafa57222f4bd2355ccab39fa20d4033b6b687491532080101805feb9c6fa8a56a77186efcb394ce1a1cd7f2130835e3bf9e3ac25d0a102a808be13beb51f37da6d10046f131834545ee5013f43e41e91eb18a12c28540ab4106286e0f7568f6a9cd0c0da51df08e42848096b25d455ebec9adfd6e493d8c9725bc2d49bbbae0a5375b359f91d9dad20ed109ffbc52469cffd2cf5df7773f7a4c72ae167485315c326281efc4"}, @TCA_CHOKE_MAX_P={0x8}, @TCA_CHOKE_PARMS={0x14, 0x1, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, @TCA_CHOKE_PARMS={0x14}, @TCA_CHOKE_STAB={0x104, 0x2, "554b956aa3fcfbc4a187baf0437163b5d33108db016465f92a93480d2c246d90f03741da6ee916f7c9917dbd81da67d6150151679559af8402b932745d19fbfbd679c133c4714565f91cd05790d990818bac85598b6a844cb2c2d277aaca9a88ee0e6a834ba02b4e549f11fb13e9fe33730c55997f2d3b7e6469210db81587fc522295f49a78f4e08ddfb01172b12a19b303a0c47fa3500cdc3e6725a79dcd3731c37083c3bbe73c43e7e2ea82c72986a1499c677c565ea1cfc874e7e978e4ebe8d338f0b37807d40333ee570133982998623ec809826f1009856a9d9d8e839c65d3ead78c6b3cb8f7beee8e59f19de93d06628a2cdfa4333d96882b96c36cc3"}]}}, @TCA_STAB={0x0, 0x8, 0x0, 0x1, [{{0x0, 0x1, {0x40, 0x26, 0xffff, 0x8, 0x2, 0x2, 0x8}}, {0x0, 0x2, [0x6, 0x6]}}, {{0x0, 0x1, {0x4, 0xc, 0x7f, 0x8, 0x0, 0x10, 0x3}}, {0x0, 0x2, [0x5fd]}}, {{0x0, 0x1, {0x7, 0x80, 0x0, 0x1000, 0x2, 0x7fffffff, 0x10088}}, {0x0, 0x2, [0x4, 0xffff, 0xff52, 0x9]}}]}, @TCA_RATE={0x0, 0x5, {0x2, 0x2}}, @TCA_RATE={0x0, 0x5, {0x10, 0x2}}]}, 0x2c4}}, 0x0)
ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x0, 0x1, 0x0, &(0x7f00000006c0)=""/190, &(0x7f0000000140)=""/92, 0x2})
ioctl$VHOST_VSOCK_SET_RUNNING(r4, 0x4004af61, &(0x7f00000000c0)=0x1)
pipe2$9p(&(0x7f0000000000)={<r10=>0xffffffffffffffff}, 0x0)
io_setup(0x9, &(0x7f0000000240)=<r11=>0x0)
r12 = eventfd2(0x7, 0x0)
io_submit(r11, 0x3, &(0x7f0000000800)=[&(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0xff45, r10, &(0x7f0000000340)="d100", 0x2, 0x6, 0x0, 0x5, r12}, 0x0, 0x0])
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fffffff}]})

2m29.717114867s ago: executing program 4 (id=1916):
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d)
openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0)
r0 = socket$nl_route(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6tnl0\x00'})
munmap(&(0x7f0000001000/0x3000)=nil, 0x3000)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f0000001f40)={'NETMAP\x00'}, &(0x7f0000006300)=0x1e)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1)
prlimit64(0x0, 0xe, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x4000000004002, 0x0)
r4 = dup(r3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0)
read$msr(r5, &(0x7f0000019300)=""/102392, 0x18ff8)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

2m28.810421535s ago: executing program 4 (id=1918):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
socket$inet6_udp(0xa, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./debug\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./debug\x00', &(0x7f0000000040)='debugfs\x00', 0x0, 0x0)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x24, 0x24, 0x4ee4e6a52ff5644d, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, {}, {0xe, 0x8}, {0xf, 0xb}}}, 0x24}, 0x1, 0x0, 0x0, 0x801}, 0x24008000)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60)
r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
ioctl$KVM_SET_REGS(r1, 0x4090ae82, &(0x7f0000000440)={[0x3ff, 0x2, 0x3, 0x80000004, 0x9f5, 0x0, 0x7f, 0x80000005, 0x9, 0x2, 0x1fd, 0x1, 0x2, 0x4, 0x8, 0x1], 0x60000, 0x110696})
ioctl$KVM_RUN(r1, 0xae80, 0x0)
r2 = openat(0xffffffffffffff9c, &(0x7f0000000500)='./debug/lru_gen\x00', 0x2, 0x0)
write(r2, &(0x7f0000000800)='+ 1 0 0', 0x7)
prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000000, 0x0, &(0x7f0000000240))
bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty, 0x7}, 0x1c)
futimesat(r2, &(0x7f0000000080)='./debug/lru_gen\x00', &(0x7f0000000200)={{}, {0x0, 0xea60}})
listen(r0, 0xc)
r3 = syz_open_procfs(0x0, &(0x7f00000000c0)='net/ip6_tables_matches\x00')
socket(0x2, 0x80805, 0x0)
r4 = socket$inet6_tcp(0xa, 0x1, 0x0)
setsockopt$inet6_tcp_int(r4, 0x6, 0x2000000000000020, &(0x7f0000000040)=0xa, 0x1959cc36)
ioctl$BTRFS_IOC_BALANCE_PROGRESS(r4, 0x84009422, &(0x7f0000001300)={0x0, 0x0, {0x0, @struct}, {0x0, @usage, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @struct}, {0x0, @struct}})
pread64(r3, &(0x7f0000000300)=""/4092, 0xffc, 0x37a)
connect$inet(0xffffffffffffffff, &(0x7f0000000000)={0x2, 0x4e22, @local}, 0x10)
bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000e40)={0x0, 0x0, 0x26, 0x0, 0x1, 0xff}, 0x28)
close(0x3)

2m28.654360454s ago: executing program 4 (id=1921):
syz_emit_ethernet(0x83, &(0x7f0000000040)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaf9ff030486"], 0x0) (async)
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000180)=ANY=[@ANYRES32], 0x0) (async)
r1 = memfd_create(&(0x7f0000000000)='/dev/sda1\x00', 0x1)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) (async)
fchdir(r1)
quotactl$Q_GETQUOTA(0xffffffff80000702, &(0x7f0000000080)=@sr0, 0xee01, 0x0)
write$tun(r1, &(0x7f0000000100)={@val={0x0, 0x60}, @val={0x1, 0x4, 0x80, 0x0, 0xffff, 0x6}, @arp=@generic={0x30a, 0xf5, 0x6, 0xa, 0xa, @empty, "c45213e7d81f23d62dd1", @local, "81d2df6509b2"}}, 0x32) (async)
syz_usb_control_io$hid(r0, 0x0, 0x0) (async)
syz_usb_control_io$hid(r0, &(0x7f0000000240)={0x24, 0x0, 0x0, &(0x7f0000000040)=ANY=[@ANYBLOB='\x00\"\a\x00\x00\x00_'], 0x0}, 0x0)

2m25.595583911s ago: executing program 4 (id=1935):
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)='1', 0x1)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='mpol=interleave=relative:,0'])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/exports\x00', 0x2, 0x0)
write(r4, &(0x7f00000000c0)='/ 127.0.0.1(rw,sync,no_root_squash)\n\x00', 0x24)
r5 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
pipe2$9p(&(0x7f00000000c0)={<r6=>0xffffffffffffffff}, 0x80000)
mount$9p_fd(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000340), 0x0, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}})
r7 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0)
write$snapshot(r7, &(0x7f00000003c0)="1e8f194d159d122deda87e732f5230186340f285c3", 0x15)

2m24.587006216s ago: executing program 4 (id=1939):
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6tnl0\x00'})
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f0000001f40)={'NETMAP\x00'}, &(0x7f0000006300)=0x1e)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1)
prlimit64(0x0, 0xe, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x4000000004002, 0x0)
r4 = dup(r3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0)
read$msr(r5, &(0x7f0000019300)=""/102392, 0x18ff8)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

2m23.211636911s ago: executing program 34 (id=1860):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7)
r0 = getpid()
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0)
recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
getpeername(r2, &(0x7f00000003c0)=@l2tp6={0xa, 0x0, 0x0, @local}, &(0x7f0000000440)=0x80)
sendmsg$inet(0xffffffffffffffff, 0x0, 0x20008811)
socket$kcm(0x29, 0x2, 0x0)
syz_emit_ethernet(0x36, &(0x7f0000000440)={@local, @random="429e82211cf8", @void, {@ipv4={0x800, @tcp={{0x5, 0x4, 0x2, 0x1a, 0x28, 0x66, 0x0, 0x3, 0x6, 0x0, @remote, @dev={0xac, 0x14, 0x14, 0x23}}, {{0x4e23, 0x4e22, 0x41424344, 0x41424344, 0x0, 0x0, 0x5, 0x10, 0x4ede, 0x0, 0xec6}}}}}}, 0x0)
socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000140)={0xffffffffffffffff, <r3=>0xffffffffffffffff})
ioctl$sock_SIOCETHTOOL(r3, 0x89f6, &(0x7f0000000080)={'bridge0\x00', &(0x7f0000000000)=@ethtool_regs={0x4, 0x0, 0xb, "2a16561edfd2f20ab3ed4a"}})
syz_emit_ethernet(0x4a, &(0x7f0000000440)=ANY=[], 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r4 = socket$nl_xfrm(0x10, 0x3, 0x6)
sendmsg$nl_xfrm(r4, &(0x7f0000000480)={0x0, 0x2f, &(0x7f0000001f40)={&(0x7f0000000840)=ANY=[@ANYBLOB="fc00000019000100000000000000000020010000000000000000000000000000ac1414aa00000000000000000000000000000005000000000a00000000000000", @ANYRES32=0x0, @ANYRES32], 0xfc}}, 0x0)
sendmsg$nl_xfrm(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={0x0}, 0x1, 0x0, 0x0, 0x800}, 0x0)

2m12.655778282s ago: executing program 35 (id=1925):
r0 = syz_open_dev$video4linux(&(0x7f0000000180), 0x5, 0x40)
ioctl$VIDIOC_ENUM_DV_TIMINGS(r0, 0xc0945662, &(0x7f00000001c0)={0x9, 0x0, '\x00', {0x0, @reserved}})
socket$nl_generic(0x10, 0x3, 0x10)
socket$nl_generic(0x10, 0x3, 0x10)
socket(0xa, 0x3, 0x3a)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$nl_xfrm(0x10, 0x3, 0x6)
socket$nl_netfilter(0x10, 0x3, 0xc)
mmap$IORING_OFF_SQ_RING(0x0, 0x8000002, 0x2000007, 0x401d031, 0xffffffffffffffff, 0x0)
socket$inet6_tcp(0xa, 0x1, 0x0)
sendmsg$inet(0xffffffffffffffff, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[@ANYBLOB="28010000000000000100000001"], 0x128}, 0x4004000)
r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x101000, 0x0)
r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0)
ioctl$KVM_CREATE_IRQCHIP(r2, 0xae60)
r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0)
ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil})
ioctl$KVM_SET_IRQCHIP(r2, 0x8208ae63, &(0x7f0000000280)={0x0, 0x0, @pic={0x3, 0x7, 0xe1, 0x81, 0x9, 0xf9, 0x40, 0x42, 0xfb, 0x0, 0xc, 0x0, 0xfb, 0x4, 0xfc, 0x38}})
ioctl$KVM_SET_GSI_ROUTING(r2, 0x4008ae6a, &(0x7f00000000c0))
ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f0000000000)={[0x6e, 0x0, 0x100000000005, 0x20, 0x3, 0x2, 0x80000000106c, 0x100, 0x8000000000000, 0x80000004000080, 0x1c00000, 0x8, 0x0, 0x4, 0x0, 0x7], 0xa000, 0x3c4210})
ioctl$KVM_RUN(r3, 0xae80, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000100)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
sendmsg$inet(r5, &(0x7f0000001b00)={0x0, 0x0, 0x0, 0x0, &(0x7f0000001d80)=ANY=[], 0x128}, 0x0)
recvmsg$unix(r4, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000340)=[@cred={{0x1c}}, @rights={{0x2c, 0x1, 0x1, [0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff, 0xffffffffffffffff]}}, @rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}, @rights={{0x10}}, @rights={{0x10}}], 0x88}, 0x80)
socketpair$unix(0x1, 0x2, 0x0, 0x0)
syz_ublk_add_dev(0xffffffffffffffff, 0x0, 0x0, 0x0, &(0x7f0000000200)={0x2e, 0x0, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x4, 0x3c9, 0x0, 0x0, 0x1000, 0xffffffff, 0x0, 0x0, 0x40}}}, &(0x7f0000000300))
r6 = fsopen(&(0x7f0000000000)='nfsd\x00', 0x1)
fsconfig$FSCONFIG_CMD_CREATE(r6, 0x6, 0x0, 0x0, 0x0)
fsmount(r6, 0x1, 0x82)
r7 = socket$inet6_tcp(0xa, 0x1, 0x0)
dup(r7)

2m9.480880674s ago: executing program 36 (id=1939):
openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0)
sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d)
r0 = socket$nl_route(0x10, 0x3, 0x0)
socket$netlink(0x10, 0x3, 0x0)
r1 = socket(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'ip6tnl0\x00'})
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
getsockopt$ARPT_SO_GET_REVISION_TARGET(r2, 0x0, 0x63, &(0x7f0000001f40)={'NETMAP\x00'}, &(0x7f0000006300)=0x1e)
syz_genetlink_get_family_id$ethtool(&(0x7f0000000200), r1)
prlimit64(0x0, 0xe, 0x0, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
r3 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000140), 0x4000000004002, 0x0)
r4 = dup(r3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r4, 0x2000)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
r5 = syz_open_dev$MSR(&(0x7f0000000040), 0x0, 0x0)
read$msr(r5, &(0x7f0000019300)=""/102392, 0x18ff8)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x1)
mlock(&(0x7f0000000000/0x800000)=nil, 0x800000)

2m7.800010079s ago: executing program 1 (id=2031):
r0 = syz_open_dev$loop(&(0x7f0000000440), 0x81, 0x2a82)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000400)='cpuset.effective_cpus\x00', 0x275a, 0x0)
r2 = socket$kcm(0x2, 0xa, 0x2)
r3 = socket$nl_generic(0x10, 0x3, 0x10)
r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r3)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000007c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x58, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @xfrm={{0x9}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_XFRM_DREG={0x8, 0x1, 0x1, 0x0, 0x16}, @NFTA_XFRM_SPNUM={0x8, 0x4, 0x1, 0x0, 0x5}, @NFTA_XFRM_DIR={0x5, 0x3, 0x1}, @NFTA_XFRM_KEY={0x8, 0x2, 0x1, 0x0, 0x2}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xcc}}, 0x0)
r6 = socket$key(0xf, 0x3, 0x2)
r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x2, 0x7fff7ffc}]})
close_range(r7, r7, 0x200000000000000)
syz_open_procfs$namespace(0x0, &(0x7f0000000300)='ns/net\x00')
r8 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f00000003c0)=@bpf_lsm={0x1e, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000280)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x24}, 0x80)
syz_emit_ethernet(0x106, &(0x7f00000002c0)={@link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}, @empty, @void, {@ipv6={0x86dd, @icmpv6={0x0, 0x6, '\x00', 0xd0, 0x3a, 0xff, @initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @mcast2, {[], @ndisc_redir={0x89, 0x0, 0x0, '\x00', @dev, @dev, [{0x2, 0x15, "2eb7f26ce4f6e2e6782d7affc771df67f2733c5a58bf3d2462689219ab1aa005de27e7cb0ccb6c86ec43f54adda87747d698f07fa8cd6c4cf252f4ff8d87327d2d9811c4866d79592b9f191a0f85fe887ef68afe46c97e4c171d91bdc438e0812acc2ea006aae7162d486fec964ddd8db85c1c702f22033f023ea107e2cbf6ca49c2d855d18eaab59d1e8633f55c7aa08013742d53494653b1837976081e661acdd962a7d6de"}]}}}}}}, 0x0)
bpf$BPF_PROG_TEST_RUN(0x1c, &(0x7f00000005c0)={r8, 0x0, 0x24, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0xa)
r9 = syz_open_procfs$namespace(0x0, &(0x7f0000000280)='ns/net\x00')
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000480)={@cgroup=<r10=>r9, 0x11, 0x0, 0x0, 0x0, 0x1000000, 0x0, 0x0, 0x0, 0x0}, 0x40)
bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000640)={@cgroup=r10, 0x24, 0x0, 0xffff, &(0x7f0000000000)=[0x0], 0x40e8, 0x0, 0x0, 0x0, 0x0}, 0x40)
sendmsg$key(r6, &(0x7f0000000040)={0x3, 0x0, &(0x7f0000000340)={&(0x7f0000000e80)=ANY=[], 0x80}, 0x1, 0x7}, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r11=>0x0})
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB, @ANYBLOB], 0x0, 0x2, 0xde, &(0x7f0000000340)=""/222}, 0x94)
sendmsg$NL80211_CMD_FRAME(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r4, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r11, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0)
ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local})
splice(r2, &(0x7f0000000040)=0x9, r0, &(0x7f0000000080)=0x5, 0x1ff, 0x0)
r12 = syz_open_dev$loop(&(0x7f0000000000), 0x83, 0x1)
ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f00000005c0)={r12, 0x800, {0x2a00, 0x80010000, 0x0, 0x5, 0x0, 0x0, 0x0, 0x20, 0x1c, "fee8a2ab78fc179fd1f8a0e91ddaaca7bd6447a4b4e00d9693dda1af1ea09de2b7fb0a0100000000000000000300", "2809e8dbe108598927875397bab22d0000b420a9c81f40f05f819e01177d3d458dac00000000000000000000010000000000008000000200", "90be8b1c5512406c7f00", [0x4, 0x40000000000000]}})
write$binfmt_script(r1, &(0x7f00000001c0)={'#! ', './file0', [{0x20, '/dev/kvm\x00'}, {0x20, 'cpuset.effective_cpus\x00'}, {0x20, '\'*&'}, {0x20, '/dev/kvm\x00'}, {0x20, '/dev/loop#\x00'}], 0xa, "a7bdeb633f14b657bdc0323a5d2740f9c75af57799961f4a912598615e5a10c5bb29c9b389c6a06b4ebe6bba61126a99e97b4e7f073f485f3723ef55ac78cabee2c604d8dee8c8c8e06e3e0b81029e1085b74ce372b3f2d3ef2eee618037bd2c4467b34047c93570867493f62bfadaa1334c55d2b532fcb77fe293cabbbf9b06efa638d13709c16d7b30476a24ee06db3f86f45490fa916428cef9c3bfdd45d33c71975b64ed515d89d7552ea5d38613"}, 0xf6)
syz_open_dev$loop(&(0x7f0000000180), 0x3, 0xa8503)
syz_open_dev$tty1(0xc, 0x4, 0x1)

2m7.039030856s ago: executing program 1 (id=2035):
mkdir(&(0x7f0000000000)='dir0\x00', 0x1ff)
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000480)={'wlan1\x00', <r2=>0x0})
sendmsg$NL80211_CMD_SET_WIPHY(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000040)={0x24, r1, 0x0, 0x70bd2b, 0x2, {}, [@NL80211_ATTR_WIPHY_RETRY_LONG={0x5}, @NL80211_ATTR_WIPHY_FRAG_THRESHOLD={0x8, 0x3f, 0xfffffffd}]}, 0x24}, 0x1, 0x0, 0x0, 0x200088c9}, 0x20000000)
sendmsg$NL80211_CMD_SET_COALESCE(r0, &(0x7f0000000200)={0x0, 0xffffffffffffff8c, &(0x7f0000000b00)={&(0x7f0000000040)={0x28, r1, 0x1, 0x0, 0x0, {{0x2}, {@val={0x8, 0x3, r2}, @void}}}, 0x28}}, 0x0)
mount(0x0, &(0x7f0000000000)='dir0\x00', &(0x7f0000000100)='ext4\x00', 0x0, 0x0)
lsetxattr$trusted_overlay_redirect(&(0x7f0000000040)='dir0\x00', &(0x7f00000000c0), &(0x7f0000000140)='dir0/trace_marker\x00', 0x12, 0x2)
lchown(&(0x7f0000000080)='dir0/trace_marker\x00', 0x0, 0x0)
sendmsg$NL80211_CMD_FLUSH_PMKSA(r0, &(0x7f00000002c0)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000240)={&(0x7f00000001c0)={0x1c, r1, 0x2, 0x70bd28, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}, ["", "", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0xc000}, 0x20008004)

2m6.759895046s ago: executing program 1 (id=2036):
r0 = socket(0xa, 0x3, 0x3a)
setsockopt$inet6_IPV6_ADDRFORM(r0, 0x3a, 0x1, 0x0, 0x30) (fail_nth: 2)

2m6.679048435s ago: executing program 1 (id=2037):
r0 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x1f, 0x4, &(0x7f0000000480)=@framed={{0x18, 0x0, 0x0, 0x0, 0xfffffffd}, [@call={0x85, 0x0, 0x0, 0x5}]}, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x30, '\x00', 0x0, @fallback=0x1c, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_LOAD_XDP(0x5, &(0x7f00000006c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb7030000000000008500000059"], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x28}, 0x94)
r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={r1, 0x2000000, 0xe, 0x0, &(0x7f0000000200)="63eced8e46dc3f0adf33c9f7b986", 0x0, 0x3800, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50)

2m6.372773349s ago: executing program 1 (id=2040):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a140000ff0f0000000000000000000000000000081400000011"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40080)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084)
rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00')
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900b4170e7e08006140fb0100000051"], 0x28}, 0x1, 0x0, 0x0, 0x4c854}, 0x20040880)
add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe)
mount$fuse(0x0, 0x0, 0x0, 0x1000430, &(0x7f0000000780)=ANY=[@ANYRESDEC=0x0, @ANYBLOB=',', @ANYBLOB="58e1a192964f91b2b2b082e5b2d36bfb79"])
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c235aa9c5", 0x5)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0x10}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb0958730", 0x4c}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11", 0xce}], 0x3, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, &(0x7f00000005c0)={0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000000c0)=""/81, 0x7ffff000}, {&(0x7f0000000200)=""/83, 0x20000253}], 0x2}, 0x0)
r2 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0)
syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, &(0x7f0000000dc0)=ANY=[])

2m4.943267547s ago: executing program 1 (id=2044):
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)='1', 0x1)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='mpol=interleave=relative:,0'])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/exports\x00', 0x2, 0x0)
write(r4, &(0x7f00000000c0)='/ 127.0.0.1(rw,sync,no_root_squash)\n\x00', 0x24)
r5 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
pipe2$9p(&(0x7f00000000c0)={<r6=>0xffffffffffffffff}, 0x80000)
mount$9p_fd(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000340), 0x0, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}})
openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0)

1m56.042204959s ago: executing program 7 (id=2068):
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x90, 0x3f, 0x1, 0x70bd29, 0x4, {0x1}, [@nested={0x4, 0x48}, @nested={0x8, 0x1, 0x0, 0x1, [@nested={0x4, 0x10}]}, @typed={0x70, 0x2, 0x0, 0x0, @binary="81555deb70e322dba3c4afe1ae79032cc6c36fc4cb4a1350b9c3f8c13ae137b68f208281adeb8de1c7ad7ad6b43fc11d9c099de7629664655ef4572ee56ef1845ed045baa652898ac9ee3060e9fee8e4759060d9ed32ba00362963f5f6c10fc1d1aa12dd21d19ca1749d8aa2"}]}, 0x90}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008094)
ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4058587a, &(0x7f0000000340)={{<r0=>0xffffffffffffffff, &(0x7f0000000000)='syz2\x00', 0x0, &(0x7f0000000200)={@_ha_fsid={[0x918e, 0x8]}, {0x2, 0x5, 0x1, 0x3}}, 0x1, &(0x7f0000000240)={@_ha_fsid}, &(0x7f0000000280)=0xfffffffc}, {[0x5, 0x88, 0x8000, 0xab6]}, 0x2, 0x6f, &(0x7f00000002c0)=""/111})
r1 = socket$nl_generic(0x10, 0x3, 0x10)
symlink(&(0x7f0000000000)='.\x00', &(0x7f0000000040)='./file0\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
mknodat(0xffffffffffffff9c, &(0x7f0000000140)='./file1/file2\x00', 0x1000, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x13, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000000000000000000002000000851000000600000018020000", @ANYRES32, @ANYBLOB="00000000000000ffe500020000000000180000000000000000000000000000009500040000000000360a020000000000180100002020782500000000002020207b1a00fe00000000bfa100000000000007010000f8ffffffb702000008000000b50a000000000000850000000600000095"], &(0x7f0000000280)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x48}, 0x94)
r2 = landlock_create_ruleset(&(0x7f0000000240)={0x2001}, 0x18, 0x0)
r3 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x202000, 0x13b)
landlock_add_rule$LANDLOCK_RULE_PATH_BENEATH(r2, 0x1, &(0x7f0000000340)={0x2001, r3}, 0x0)
landlock_restrict_self(r2, 0x0)
renameat2(0xffffffffffffff9c, &(0x7f0000000480)='./file1/file2\x00', 0xffffffffffffff9c, &(0x7f00000004c0)='./file0\x00', 0x2)
r4 = syz_genetlink_get_family_id$tipc2(&(0x7f00000001c0), 0xffffffffffffffff)
sendmsg$TIPC_NL_MEDIA_SET(r1, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000040)={0x2c, r4, 0x801, 0x70bd28, 0x25dfdbff, {}, [@TIPC_NLA_MEDIA={0x18, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x401}]}]}]}, 0x2c}, 0x1, 0x0, 0x0, 0x24008000}, 0x2400c000)
sendmsg$TIPC_NL_BEARER_DISABLE(r0, &(0x7f0000000640)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x40}, 0xc, &(0x7f0000000600)={&(0x7f0000000400)={0x1dc, r4, 0x20, 0x70bd2d, 0x25dfdbfc, {}, [@TIPC_NLA_SOCK={0x28, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xd5fd}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0xf}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x101}]}, @TIPC_NLA_NODE={0x54, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_ADDR={0x8, 0x1, 0x5}, @TIPC_NLA_NODE_KEY={0x48, 0x4, {'gcm(aes)\x00', 0x20, "0d83c385febe79ab47eb71770e17c73eba4a9e3f7ba56cb5c18381231e38104a"}}]}, @TIPC_NLA_NODE={0x114, 0x6, 0x0, 0x1, [@TIPC_NLA_NODE_REKEYING={0x8, 0x6, 0x3}, @TIPC_NLA_NODE_UP={0x4}, @TIPC_NLA_NODE_KEY_MASTER={0x4}, @TIPC_NLA_NODE_ID={0x71, 0x3, "f59b9237e81475e43b77e03c91e4ad53f9eea6f954edfedce20242db6b1708e5dadf1f14fbebd649524487bacbfb2f5c6981d58e89bf6aa474858616f4ab0bc04ce2920cba9290912ea1e6bf2388971c1de902923770149d95c7720cbf044edf4d61f09ffd30cdeca152da1579"}, @TIPC_NLA_NODE_ID={0x40, 0x3, "26b216cba876c53dae7fb26ef4edb1844c0e4bce78174c774ee25956c69f407204dedb8a04f02be4868b9a3886a03d0cb701dacd8cc808261c5324ed"}, @TIPC_NLA_NODE_KEY={0x45, 0x4, {'gcm(aes)\x00', 0x1d, "511f41b5d4cdf9cb4a7380aaadb9b9bf8cf84bdca3b0f62bddf1ca1ac1"}}, @TIPC_NLA_NODE_KEY_MASTER={0x4}]}, @TIPC_NLA_SOCK={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x6}, @TIPC_NLA_CON_NODE={0x8, 0x2, 0x5}]}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x8}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x1}]}, @TIPC_NLA_NODE={0x4}]}, 0x1dc}, 0x1, 0x0, 0x0, 0x4000000}, 0x10000)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0xa)
r5 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000100)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x301, 0x0, 0x0, {0x1}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x201, 0x0, 0x0, {0x1}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz2\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x60, 0x6, 0xa, 0x401, 0x0, 0x0, {0x1}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_EXPRESSIONS={0x38, 0x4, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, @limit={{0xa}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_LIMIT_UNIT={0xc, 0x2, 0x1, 0x0, 0x80000001}, @NFTA_LIMIT_RATE={0xc, 0x1, 0x1, 0x0, 0x8}, @NFTA_LIMIT_BURST={0x8, 0x3, 0x1, 0x0, 0x300}]}}}]}]}], {0x14}}, 0xd4}}, 0x0)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$NL80211_CMD_SET_INTERFACE(r6, &(0x7f0000000100)={0x0, 0x0, 0x0}, 0x0)
syz_usb_connect$uac2(0xb180ef922c7c6e37, 0x82, &(0x7f0000000000)=ANY=[], 0x0)

1m55.378394476s ago: executing program 7 (id=2071):
mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0)
r0 = userfaultfd(0x801)
ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f0000000140)={0xaa, 0x700})
ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000400000/0xc00000)=nil, 0xc00000}, 0x4})
ioctl$UFFDIO_COPY(r0, 0xc028aa03, &(0x7f0000000000)={&(0x7f0000800000/0x800000)=nil, &(0x7f0000199000/0x800000)=nil, 0x800000})

1m55.313569681s ago: executing program 7 (id=2072):
r0 = io_uring_setup(0x1, &(0x7f0000000000)={0x0, 0xf9c5, 0x400, 0x0, 0x0, 0x0, 0xffffffff})
socket(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
setsockopt$XDP_UMEM_REG(0xffffffffffffffff, 0x11b, 0x4, &(0x7f0000000080)={&(0x7f0000000000)=""/5, 0x214000, 0x800}, 0x20)
setsockopt$XDP_TX_RING(0xffffffffffffffff, 0x11b, 0x3, &(0x7f0000000180)=0x800, 0x4)
r3 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$XDP_UMEM_COMPLETION_RING(0xffffffffffffffff, 0x11b, 0x6, &(0x7f0000000040)=0x20000, 0x4)
ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000400)={'dummy0\x00', <r4=>0x0})
setsockopt$XDP_UMEM_FILL_RING(0xffffffffffffffff, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4)
bind$xdp(0xffffffffffffffff, &(0x7f0000000100)={0x2c, 0x0, r4}, 0x10)
sched_setattr(0x0, &(0x7f00000002c0)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0)
syz_open_procfs(0x0, &(0x7f0000000040))
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0)
setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, 0x0, 0x0)
ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0)
getpriority(0x2, 0x0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=ANY=[@ANYBLOB="a013000040000701fcffffff00000100017c0000040042800c00018006000600801c00007c13028078131480731306806f13"], 0x13a0}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000)
setsockopt$inet_mreqn(0xffffffffffffffff, 0x0, 0x23, &(0x7f0000000740)={@multicast2, @loopback}, 0xc)
io_uring_register$IORING_REGISTER_MEM_REGION(r0, 0x22, &(0x7f0000003000)={&(0x7f0000002000)={0x0, 0x1000}}, 0x1)
mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x1000, 0x3, 0x13, r0, 0x20000000)

1m54.385185999s ago: executing program 7 (id=2075):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4000840}, 0x0)

1m54.281739031s ago: executing program 7 (id=2076):
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)='1', 0x1)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='mpol=interleave=relative:,0'])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/exports\x00', 0x2, 0x0)
write(r4, &(0x7f00000000c0)='/ 127.0.0.1(rw,sync,no_root_squash)\n\x00', 0x24)
r5 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
mount$9p_fd(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000340), 0x0, &(0x7f0000000000)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r5}})
openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0)

1m53.301575078s ago: executing program 7 (id=2080):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000240)='devices.allow\x00', 0x2, 0x0)
write$cgroup_devices(r0, 0x0, 0x9)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340))
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x16, 0x0, 0x104, 0xff, 0x0, 0x1}, 0x48)
close(r1)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0x1, "1f"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac2(r2, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f00000016c0)={0x44, &(0x7f0000001400)={0x0, 0xf, 0xe1, "455acb0a55f076ae37e92aefde11b529503da2c5994c15bc141ff0b771922f602cc95f62f0af3959dea0f22e96858261c357a45880aaa2b4fd20497f6e4084157a106f09ca7e749a472109ad3ebb8fecfa4254324aca4c4c562ee7ebd6ce32e0527489dd798f64a7aece0f1a53b669208d50b02467c7f2856675b75be7325da9661f9a09bae49d795a4204e1263950d627a978d240453326b632f4757f7a0412ea395ebeb48da33768f645311608e7e49d9efdcc9b86cc140df8e91b598b8a0d6c410d6899e8fadae348bcbe5f89c7c772fe7dd0bcc460f2cf5938662351a8eeab"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000001600)={0x20, 0x83, 0x2}, &(0x7f0000001640)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000001680)={0x20, 0x89, 0x2}})
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x8, &(0x7f0000000d40)=ANY=[@ANYBLOB="b4000000000000001e1000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500050000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f0000000040)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51, 0x0, 0xffffffffffffffff, 0x6}, 0x22)

1m51.379599257s ago: executing program 9 (id=2090):
r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3)
r1 = add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x31, 0x0, 0x34]}, &(0x7f00000000c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00"}, 0x48, 0xfffffffffffffffe)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2400000002060300000040"], 0x24}}, 0x0)
pipe2$watch_queue(&(0x7f0000000300)={0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x80)
ioctl$IOC_WATCH_QUEUE_SET_FILTER(r2, 0x5761, &(0x7f00000001c0)=ANY=[@ANYBLOB="01000000000000"])
r3 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3)
bind$bt_rfcomm(r3, &(0x7f00000000c0)={0x1f, @none, 0xf8}, 0xa)
keyctl$KEYCTL_WATCH_KEY(0x20, r1, r2, 0x0)
add_key$fscrypt_v1(&(0x7f0000000440), &(0x7f0000000480)={'fscrypt:', @auto=[0x0, 0x36, 0x36, 0x0, 0x0, 0x64]}, &(0x7f00000004c0)={0x0, "3e82554dc8ccfbc2e85ec82d4ee9df60f6ae16b1a5f2c848722ba3b132e4fde178c945bd950b0477e801fc8a1be9b4ebbe9c2289a6b0aa00", 0xfffffffc}, 0x48, 0xfffffffffffffffe)
bind$bt_l2cap(r0, 0x0, 0x0)

1m51.341785888s ago: executing program 9 (id=2091):
r0 = socket$inet(0x2, 0x4000000000000001, 0x0)
bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000000c0)='dctcp', 0x5)
sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10)
setsockopt$inet_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='yeah', 0x4)
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2800000010000108fdffffff0800000800000000", @ANYRES32=0x0, @ANYBLOB="00000000a304040008001b"], 0x28}, 0x1, 0x0, 0x0, 0x4040000}, 0x0)
sendto$inet(r0, 0x0, 0x0, 0x4044880, 0x0, 0x0)

1m50.693000209s ago: executing program 9 (id=2096):
r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000180)='.\x00', 0x0, 0x15e)
r1 = openat$ptp0(0xffffffffffffff9c, &(0x7f00000003c0), 0x40001, 0x0)
r2 = dup(r1)
ioctl$PTP_EXTTS_REQUEST2(r2, 0x40603d10, &(0x7f00000002c0)={0x1, 0x9})
r3 = inotify_init1(0x0)
bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="020000000400000006000000450000000010"], 0x48)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48)
r5 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000280)=ANY=[@ANYBLOB="18000000080000000000000000000080850000000f00000018110000", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400000000725e850000000100000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f0000000680)={r5, 0xffffffffffffffff, 0x6000}, 0xc)
inotify_add_watch(r3, &(0x7f00000006c0)='.\x00', 0x40001a2)
r6 = fanotify_init(0x10, 0x800)
fanotify_mark(r6, 0x105, 0x5000003a, r0, 0x0)
open(&(0x7f0000000380)='./bus\x00', 0x105040, 0x145)
creat(&(0x7f0000000200)='./bus\x00', 0x84)

1m50.552230402s ago: executing program 9 (id=2097):
socket$key(0xf, 0x3, 0x2)
syz_emit_vhci(0x0, 0xf8)
r0 = socket$can_bcm(0x1d, 0x2, 0x2)
connect$can_bcm(r0, &(0x7f0000000080), 0x10)
sendmsg$can_bcm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="05"], 0x48}, 0x1, 0x0, 0x0, 0x48850}, 0x0)
sendmsg$can_bcm(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x7, 0x0, 0x0, {}, {0x77359400}, {}, 0x1, @can={{}, 0x3, 0x2}}, 0x48}, 0x1, 0x0, 0x0, 0x4}, 0x0)
r1 = socket$netlink(0x10, 0x3, 0x0)
r2 = socket(0x10, 0x803, 0x0)
sendmsg$IPVS_CMD_SET_INFO(r2, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000ac0)={0x0, 0x14}}, 0x0)
getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, <r3=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000880)=ANY=[@ANYBLOB="3c0000001000850600"/20, @ANYRES32=r3, @ANYBLOB="01000000000000001c0012000c000100626f6e64000000000c00020008000100", @ANYRES16=r2], 0x3c}}, 0x0)
sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newlink={0x3c, 0x10, 0xffffff1f, 0x0, 0x1, {}, [@IFLA_LINKINFO={0x14, 0x12, 0x0, 0x1, @veth={{0x9}, {0x4, 0x2, 0x0, 0x1, @void}}}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}, 0x1, 0x0, 0x0, 0x40000}, 0x0)
r4 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000440)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x428a4}, [@IFLA_ALT_IFNAME={0x14, 0x35, 'dummy0\x00'}, @IFLA_MASTER={0x8, 0xa, r3}]}, 0x3c}}, 0x8000)
sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000100)=[{&(0x7f0000000680)="5c00000013006bcd9e3fe3dceb48aa31086b8703110000001fa1ff0000000000040014020d000a00000000009ee517d34460bc24eab556a705251e6182949a3651f60a84c9f5d1938037e786a6d00d00000000000000bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0)

1m50.276413033s ago: executing program 9 (id=2098):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r0)
sendmsg$NL80211_CMD_START_AP(r0, &(0x7f00000003c0)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000500)=ANY=[@ANYBLOB="cc000000", @ANYRES16, @ANYBLOB="080025bd7000fcdbdf250f0000000c009900030000002c0000001c0017800500010007000000000000000500010004000000000000000400050134001780050002000200000000000000050002000f00000000000000050003000500000000000000050003000b0000000000000010001b8004000300050001001200000008000c006400000006009600ff0300000800a10001010000080026006c090000080026006c0900000800a000000000000800a000080000000800270003000000080034e69580bef8ae60f3bd29"], 0xcc}, 0x1, 0x0, 0x0, 0x4004003}, 0x24004010)
ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan0\x00', <r2=>0x0})
sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000280)=@newlink={0x28, 0x66, 0xffffff1f, 0x70bd29, 0x0, {}, [@IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}]}, 0x28}}, 0x0)
mount$9p_virtio(0x0, 0x0, 0x0, 0x0, 0x0)
sendmsg$NL80211_CMD_FRAME(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000640)={&(0x7f0000000000)=ANY=[@ANYBLOB="88020000", @ANYRES16=r1, @ANYBLOB="010000000000000000003b00000008000300", @ANYRES32=r2, @ANYBLOB="6102330050300100080211000001080211000000505050505050"], 0x288}, 0x1, 0x0, 0x0, 0x800}, 0x0)

1m50.182886139s ago: executing program 9 (id=2099):
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)='1', 0x1)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='mpol=interleave=relative:,0'])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/exports\x00', 0x2, 0x0)
write(r4, &(0x7f00000000c0)='/ 127.0.0.1(rw,sync,no_root_squash)\n\x00', 0x24)
r5 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
mount$9p_fd(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000340), 0x0, &(0x7f0000000000)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r5}})
openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0)

1m49.460734542s ago: executing program 37 (id=2044):
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)='1', 0x1)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='mpol=interleave=relative:,0'])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/exports\x00', 0x2, 0x0)
write(r4, &(0x7f00000000c0)='/ 127.0.0.1(rw,sync,no_root_squash)\n\x00', 0x24)
r5 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
pipe2$9p(&(0x7f00000000c0)={<r6=>0xffffffffffffffff}, 0x80000)
mount$9p_fd(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000340), 0x0, &(0x7f0000000000)={'trans=fd,', {'rfdno', 0x3d, r6}, 0x2c, {'wfdno', 0x3d, r5}})
openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0)

1m37.271785247s ago: executing program 38 (id=2080):
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff)
r0 = openat$cgroup_devices(0xffffffffffffffff, &(0x7f0000000240)='devices.allow\x00', 0x2, 0x0)
write$cgroup_devices(r0, 0x0, 0x9)
bpf$ENABLE_STATS(0x20, 0x0, 0x0)
bpf$MAP_CREATE(0x0, 0x0, 0x48)
bpf$PROG_LOAD(0x5, 0x0, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340))
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x16, 0x0, 0x104, 0xff, 0x0, 0x1}, 0x48)
close(r1)
r2 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="12010800d972a440b72040155ab7010203010902120001000000000904000000ff"], 0x0)
syz_usb_control_io(r2, 0x0, 0x0)
syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000440)={0x2c, &(0x7f0000000c40)={0x40, 0x17, 0x1, "1f"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$uac2(r2, 0x0, &(0x7f0000000bc0)={0x44, &(0x7f0000000900)=ANY=[@ANYBLOB="e01506"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$rtl8150(r2, 0x0, &(0x7f0000000500)={0x2c, &(0x7f0000000240)={0x40, 0x5, 0x1, "03"}, 0x0, 0x0, 0x0, 0x0})
syz_usb_control_io$cdc_ncm(r2, 0x0, &(0x7f00000016c0)={0x44, &(0x7f0000001400)={0x0, 0xf, 0xe1, "455acb0a55f076ae37e92aefde11b529503da2c5994c15bc141ff0b771922f602cc95f62f0af3959dea0f22e96858261c357a45880aaa2b4fd20497f6e4084157a106f09ca7e749a472109ad3ebb8fecfa4254324aca4c4c562ee7ebd6ce32e0527489dd798f64a7aece0f1a53b669208d50b02467c7f2856675b75be7325da9661f9a09bae49d795a4204e1263950d627a978d240453326b632f4757f7a0412ea395ebeb48da33768f645311608e7e49d9efdcc9b86cc140df8e91b598b8a0d6c410d6899e8fadae348bcbe5f89c7c772fe7dd0bcc460f2cf5938662351a8eeab"}, &(0x7f0000001500)={0x0, 0xa, 0x1, 0x1}, 0x0, 0x0, 0x0, &(0x7f0000001600)={0x20, 0x83, 0x2}, &(0x7f0000001640)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000001680)={0x20, 0x89, 0x2}})
bpf$MAP_CREATE_TAIL_CALL(0x0, &(0x7f0000000740)={0x3, 0x4, 0x4, 0xa, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0}, 0x48)
openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000140)='./cgroup.net/syz1\x00', 0x200002, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x13, 0x8, &(0x7f0000000d40)=ANY=[@ANYBLOB="b4000000000000001e1000000000000018120000", @ANYRES32=r1, @ANYBLOB="0000000000000000b703000000000000850000000c000000b7000000000000009500050000000000"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f0000000040)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f2, 0x10, &(0x7f0000000000), 0xfffffe51, 0x0, 0xffffffffffffffff, 0x6}, 0x22)

1m34.827542162s ago: executing program 39 (id=2099):
socket$nl_generic(0x10, 0x3, 0x10)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x1, &(0x7f0000000300)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./sys\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./sys\x00', &(0x7f0000000100)='sysfs\x00', 0x0, 0x0)
r3 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./sys/bus/pci/devices/0000:00:00.0/remove\x00', 0x1, 0x0)
write(r3, &(0x7f0000000300)='1', 0x1)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./trace\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./trace\x00', &(0x7f0000000100)='tracefs\x00', 0x0, 0x0)
mount$tmpfs(0x0, &(0x7f0000000540)='./cgroup\x00', &(0x7f0000000580), 0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='mpol=interleave=relative:,0'])
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./nfsd\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./nfsd\x00', &(0x7f0000000040)='nfsd\x00', 0x0, 0x0)
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./nfsd/exports\x00', 0x2, 0x0)
write(r4, &(0x7f00000000c0)='/ 127.0.0.1(rw,sync,no_root_squash)\n\x00', 0x24)
r5 = syz_open_dev$ttys(0xc, 0x2, 0x0)
ioctl$TIOCVHANGUP(r5, 0x5437, 0x0)
mount$9p_fd(0x0, &(0x7f0000000080)='./cgroup\x00', &(0x7f0000000340), 0x0, &(0x7f0000000000)={'trans=fd,', {}, 0x2c, {'wfdno', 0x3d, r5}})
openat(0xffffffffffffff9c, &(0x7f0000000200)='./trace/set_event\x00', 0x121302, 0x0)

1m16.061378217s ago: executing program 3 (id=2142):
r0 = syz_open_dev$media(&(0x7f00000012c0), 0x66, 0x180502)
ioctl$MEDIA_IOC_SETUP_LINK(r0, 0xc0347c03, 0x0) (fail_nth: 2)

1m15.85214741s ago: executing program 3 (id=2207):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_usb_connect$uac2(0x5, 0x83, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100020000002082052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708240a00000b7f00090401efff01022000090401010101022000090501"], 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090)

1m0.473826687s ago: executing program 40 (id=2207):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
syz_usb_connect$uac2(0x5, 0x83, &(0x7f00000002c0)=ANY=[@ANYBLOB="120100020000002082052500400001020301090271000301f81005080b020001052008090400000001012000092401fdff0a11004708240a00000b7f00090401efff01022000090401010101022000090501"], 0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x12, 0xb, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, @fallback=0x1a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x18, 0x27, 0x1, 0x7fffd, 0x1000, {0xc}, [@nested={0x4, 0x1}]}, 0x18}, 0x1, 0x0, 0x0, 0x400c801}, 0x4008090)

9.055273674s ago: executing program 0 (id=2673):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='attr/prev\x00')
r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10)
bind$llc(r1, 0x0, 0x0)
writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000080)='8', 0x20000081}], 0x300)
r2 = syz_ublk_setup_io_uring(0x64d, &(0x7f0000000240)={0x0, 0xd58c, 0x1000, 0x1, 0x138}, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0, &(0x7f0000000100)=<r5=>0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x1ff)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_MEDIA_SET(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="323700db5180db34ab7c7bb23b", @ANYRES16=r7, @ANYBLOB="0100283d7000fddbdf250c000000"], 0x14}, 0x1, 0x0, 0x0, 0x24000881}, 0x24004084)
syz_open_procfs(0xffffffffffffffff, 0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xffffffffffffffff, &(0x7f00000000c0), 0x1, 0x40, 0x1})
r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00')
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000180)={@host, 0x2})
ioctl$sock_inet6_udp_SIOCINQ(r8, 0xc02063a1, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000040)=r8, 0x1)
r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ptrace(0x10, r9)
ptrace$setregs(0xd, r9, 0x0, &(0x7f00000003c0))
ptrace$getregset(0x4205, r9, 0x2, &(0x7f00000002c0)={0x0})
syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x3, 0x5f8, 0x0, 0x0, 0x1000, 0xffffffff, r9}}}, &(0x7f0000000440))
prlimit64(r9, 0x6, &(0x7f0000000300)={0xc}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0)
mremap(&(0x7f00009d1000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f00002a0000/0x4000)=nil)
r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r10, 0x0, 0x0}, 0x10)

8.03896398s ago: executing program 0 (id=2676):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
r1 = socket$can_raw(0x1d, 0x3, 0x1)
setxattr$system_posix_acl(&(0x7f00000001c0)='.\x00', &(0x7f0000000200)='system.posix_acl_default\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="020000000100000000000015010000000400000008000000", @ANYRES32=0x0, @ANYBLOB="10000000000000002000000000000000"], 0x2c, 0x3)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_int(r2, 0x29, 0x10, 0x0, &(0x7f0000000040))
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c)
r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, &(0x7f0000000780)={{0xa}, 0x0, [0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffd, 0x0, 0x20000000000, 0x3123, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffff9, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x3, 0xd451, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x1, 0x2000000000, 0x0, 0x0, 0x80, 0x3, 0x0, 0x0, 0x10000, 0x7785, 0x8000000000, 0x0, 0x0, 0x0, 0x2, 0xdf, 0x4, 0x1, 0x2, 0x0, 0x80000000000, 0x0, 0xd7, 0xffffffffffffffff, 0x6, 0x0, 0x3, 0x0, 0xfffffffffffffffd, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x4a, 0x20000000000, 0x0, 0x0, 0x200, 0x0, 0x0, 0x5, 0xffffffffffffffff, 0x0, 0x3, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x3, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x4, 0x10004, 0x5, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0x0, 0x3843, 0x0, 0xfffffffffffffffc, 0x5, 0x80004001, 0x0, 0x0, 0xac]})
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000ffffffff00000000000000001801000011646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xba03d6b623375271, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8d90}, 0x94)
bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0), 0xc)
setsockopt(r1, 0xfffffff9, 0xd, 0x0, 0x0)
r7 = syz_open_dev$video(&(0x7f00000008c0), 0x8, 0x400)
ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r7, 0xc0945662, &(0x7f0000000900)={0x9, 0x0, '\x00', {0x0, @bt={0x3, 0x7, 0x1, 0x0, 0x2, 0x6, 0x8, 0xc537, 0x8000, 0x200, 0x8, 0x5, 0xf73, 0x6, 0x1, 0x10, {0x9, 0x80000001}, 0x3, 0x1}}})
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}, 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4, 0x4, @remote, 0x8}, 0x1c)

6.948048642s ago: executing program 0 (id=2684):
r0 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), 0xffffffffffffffff)
sendmsg$NLBL_MGMT_C_ADD(0xffffffffffffffff, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000c80)={0x2c, r0, 0x1, 0x70bd2d, 0xa000000, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_IPV4ADDR={0x8, 0x7, @initdev={0xac, 0x1e, 0x0, 0x0}}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}]}, 0x2c}, 0x1, 0x2000000}, 0x0)

6.402256207s ago: executing program 0 (id=2685):
r0 = socket$inet_tcp(0x2, 0x1, 0x0)
r1 = openat$null(0xffffffffffffff9c, &(0x7f0000000080), 0x8000, 0x0)
r2 = socket$packet(0x11, 0x3, 0x300)
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000180)=0x100000001, 0x4)
mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1)
setsockopt$packet_add_memb(r2, 0x107, 0x1, &(0x7f0000000180)={0x0, 0x1, 0x6}, 0x10)
bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @rand_addr=0x10}, 0x10)
setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000380)=ANY=[@ANYBLOB="3400000010000d042abd70000000000000000000d8a54d2f342b097783062ee038de9a4544cd883e8ffc724f1f339ad2123c33658cd4aadf06991a12bfcbfc3d3b53e65e9e06913c0a8116e8c091dea419ff0cbefaffdca705bf1bfe558dce556315f8f213c679310fed5ca381304ff2ce8bacc48c48c4af96284b872c4dbbc6b9bfbf264abbde121b8e22400406547c52846f858f09259c", @ANYRES32=0x0, @ANYBLOB="0040000004000000140012800a000100767863616e00000004000280"], 0x34}, 0x1, 0x0, 0x0, 0x24000081}, 0x4000000)
setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f0000000000)=0x2, 0x4)
connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000540), r0)
sendto$inet(r0, &(0x7f0000000240)='D', 0x1, 0x2004c015, 0x0, 0x0)
setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r0, 0x6, 0x16, &(0x7f0000000340)=[@window={0x3, 0x1, 0x8}, @window={0x3, 0x6, 0x7}, @sack_perm, @window={0x3, 0x0, 0x4}, @mss={0x2, 0x4}, @timestamp, @window={0x3, 0x1, 0x10}, @sack_perm], 0x20000000000002a1)
setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f00000001c0), 0x4)
sendto$inet(r0, &(0x7f00000004c0)='<', 0x381, 0x805, 0x0, 0x0)

6.112413248s ago: executing program 2 (id=2688):
semop(0x0, 0x0, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000040)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x2, 0x0)
sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x651, 0x0)
syz_clone(0x8202000, 0x0, 0x0, 0x0, 0x0, 0x0)
recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
mbind(&(0x7f0000bde000/0x2000)=nil, 0x2000, 0x4001, 0x0, 0x7, 0x0)
semtimedop(0x0, 0x0, 0x0, 0x0)
madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x8)
syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x15)
socket$netlink(0x10, 0x3, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
syz_open_procfs(0x0, 0x0)
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000200)=ANY=[@ANYBLOB="600000000206010800000000000000000000000005000400000000000900020073797a31000000001400078008001240000000000500140008000000050005000a000000050001000600000011000300686173683a69702c706f7274"], 0x60}}, 0x0)
r1 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000c80)=ANY=[@ANYBLOB="5c000000090601080000000000000000070000000900020073797a31000000000500010007000000340007801800018014000240fe8000000000000000000000000000bb060004400e1f00cd050007008800000006000540"], 0x5c}, 0x1, 0x0, 0x0, 0x10000042}, 0x90)

6.111773512s ago: executing program 0 (id=2689):
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000a40)={0x0, 0x0, &(0x7f0000000a00)={&(0x7f0000000840)=ANY=[@ANYBLOB="140000001000010000000000000000000200000a140000ff0f0000000000000000000000000000081400000011"], 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x40080)
prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000fe4000/0x11000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68)
sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004084)
rename(0x0, &(0x7f00000000c0)='./file0/../file0/file0\x00')
sendmsg$NL80211_CMD_FRAME(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f00000002c0)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="010025bd7000000000000200000008000300", @ANYRES32=0x0, @ANYBLOB="0c009900b4170e7e08006140fb0100000051"], 0x28}, 0x1, 0x0, 0x0, 0x4c854}, 0x20040880)
add_key$fscrypt_provisioning(&(0x7f0000000340), 0x0, 0x0, 0x0, 0xfffffffffffffffe)
mount$fuse(0x0, 0x0, 0x0, 0x1000430, &(0x7f0000000780)=ANY=[@ANYRESDEC=0x0, @ANYBLOB=',', @ANYBLOB="58e1a192964f91b2b2b082e5b2d36bfb79"])
r0 = socket$alg(0x26, 0x5, 0x0)
bind$alg(r0, &(0x7f0000000380)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc-cast5-avx\x00'}, 0x58)
setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000280)="2c235aa9c5", 0x5)
r1 = accept4(r0, 0x0, 0x0, 0x800)
sendmmsg$alg(r1, &(0x7f0000000040)=[{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000080)="f78d9ca38fff48f3be52163448412ba8", 0xfffffe3f}, {&(0x7f0000000140)="ebe3a0e9796cfd1647e299f4e376fdba128280b372219d205e81f4a7f71c1926aae1efd7e0054a863f3d5cfe6cb55b5bb9fa6935849e6098ed884e7cb51726b360fbb37b4fe035bbb095873048", 0xff31}, {&(0x7f00000003c0)="e8700e444d50a969ff67347cff6127e6ef12ee3819271482a4975a52c1ab9b8b4db3945d1032005eabe97b4dc33a47d3a158da988456d30026b433186f53cdcdb93a4722bf306a10470d50f5cb1ece9ead3459bab1cf1538cd0b157653c5e892962c80f158c443e9c6ad7d2a8103ef2f4b93766b9a21501f94c1568b13756b66f74f46cf801704d2da8b96c34070b233af0afcc436712e58ed25e721193af05a045ad3fdc928f02f3dbad19d3e66eebda2e63f3f46ef4511cee26d7b48241847bf9e343ef4674c45e2a085060f11"}], 0x1, &(0x7f0000000380)=[@op={0x18, 0x117, 0x3, 0x1}], 0x18}], 0x1, 0x40800)
recvmsg(r1, 0x0, 0x0)
r2 = syz_usb_connect(0x0, 0x4a, &(0x7f0000000040)=ANY=[@ANYBLOB="120100005520f010402038b1420104000001090238000100000000090400000371055900090582eb1000000001020009050276"], 0x0)
syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000140)={0x14, 0x0, &(0x7f0000000100)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
syz_usb_ep_write$ath9k_ep1(r2, 0x82, 0xc38, &(0x7f0000000dc0)=ANY=[])

5.878723269s ago: executing program 2 (id=2692):
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180), 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b0000001d00010000000000ffdbdf252d"], 0x1c}}, 0x0)
remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="0900000004000000040000000700000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r2, @ANYBLOB="0200000001"], 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, 0x0, &(0x7f0000000240), 0xfff, r3, 0x0, 0x300}, 0x38)
syz_emit_vhci(0x0, 0x14)
r4 = socket$kcm(0xa, 0x2, 0x0)
r5 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @private=0xa010100, 0x4e22, 0x3, 'sh\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010103, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0x6, 0x1}}, 0x44)
sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15)

5.442544427s ago: executing program 8 (id=2695):
r0 = socket$nl_rdma(0x10, 0x3, 0x14)
sendmsg$RDMA_NLDEV_CMD_PORT_GET(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000003c0)={0x20, 0x1405, 0x621, 0x70bd27, 0x0, "", [{{0x8}, {0x8}}]}, 0x20}}, 0x0)
recvmmsg(r0, &(0x7f0000003500), 0x0, 0x100, 0x0)

4.843317528s ago: executing program 2 (id=2696):
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180), 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b0000001d00010000000000ffdbdf252d"], 0x1c}}, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0)
remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB, @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r2, @ANYBLOB="0200000001"], 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r3, 0x0, 0x300}, 0x38)
syz_emit_vhci(0x0, 0x14)
r4 = socket$kcm(0xa, 0x2, 0x0)
r5 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @private=0xa010100, 0x4e22, 0x3, 'sh\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010103, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0x6, 0x1}}, 0x44)
sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)

4.692706754s ago: executing program 8 (id=2698):
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x8, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000085000000070000001801000020756c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000a5df850000002d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_skb, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90)
r0 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='attr/prev\x00')
r1 = syz_init_net_socket$llc(0x1a, 0x801, 0x0)
bind$llc(r1, &(0x7f0000000000)={0x1a, 0x0, 0x0, 0x0, 0x81, 0x42}, 0x10)
bind$llc(r1, 0x0, 0x0)
writev(r0, &(0x7f00000003c0)=[{&(0x7f0000000080)='8', 0x20000081}], 0x300)
r2 = syz_ublk_setup_io_uring(0x64d, &(0x7f0000000240)={0x0, 0xd58c, 0x1000, 0x1, 0x138}, &(0x7f0000000000)=<r3=>0x0, &(0x7f0000000140)=<r4=>0x0, &(0x7f0000000100)=<r5=>0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./mnt\x00', 0x1ff)
r6 = socket$nl_generic(0x10, 0x3, 0x10)
r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000400), 0xffffffffffffffff)
sendmsg$TIPC_NL_MEDIA_SET(r6, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="323700db5180db34ab7c7bb23b", @ANYRES16=r7, @ANYBLOB="0100283d7000fddbdf250c000000"], 0x14}, 0x1, 0x0, 0x0, 0x24000881}, 0x24004084)
syz_open_procfs(0xffffffffffffffff, 0x0)
syz_io_uring_submit(r3, r4, r5, &(0x7f0000000980)=@IORING_OP_TIMEOUT={0xb, 0x12, 0x0, 0x0, 0xffffffffffffffff, &(0x7f00000000c0), 0x1, 0x40, 0x1})
r8 = syz_open_procfs(0x0, &(0x7f00000001c0)='fd/3\x00')
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000180)={@host, 0x2})
ioctl$sock_inet6_udp_SIOCINQ(r8, 0xc02063a1, 0x0)
io_uring_register$IORING_REGISTER_EVENTFD(r2, 0x4, &(0x7f0000000040)=r8, 0x1)
r9 = syz_clone(0x0, 0x0, 0x0, 0x0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
ptrace(0x10, r9)
ptrace$setregs(0xd, r9, 0x0, &(0x7f00000003c0))
ptrace$getregset(0x4205, r9, 0x2, &(0x7f00000002c0)={0x0})
syz_ublk_add_dev(r2, r3, r4, r5, &(0x7f00000003c0)={0x2e, 0x5, 0x0, 0xffffffffffffffff, 0xc0207504, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, '\x00', {0xffffffff, 0xffff, 0x40, &(0x7f0000000200)=@new_dev={0x3, 0x5f8, 0x0, 0x0, 0x1000, 0xffffffff, r9}}}, &(0x7f0000000440))
prlimit64(r9, 0x6, &(0x7f0000000300)={0xc}, 0x0)
mmap(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0)
mremap(&(0x7f00009d1000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f00002a0000/0x4000)=nil)
r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$BPF_GET_PROG_INFO(0xa, &(0x7f0000000740)={r10, 0x0, 0x0}, 0x10)

3.826157179s ago: executing program 2 (id=2700):
r0 = socket(0x10, 0x803, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000380)={0x0, 0x4076cbba9945d516, &(0x7f0000000340)={0x0, 0x14}}, 0x0)
getsockname$packet(r0, &(0x7f0000000280)={0x11, 0x0, <r1=>0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14)
r2 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x0)
sendmsg$nl_route(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=@newlink={0x44, 0x10, 0x439, 0x70bd25, 0x0, {0x0, 0x0, 0x0, r1, 0x1040, 0x44100}, [@IFLA_LINKINFO={0x18, 0x12, 0x0, 0x1, @gre={{0x8}, {0xc, 0x2, 0x0, 0x1, [@IFLA_GRE_IGNORE_DF={0x5, 0x13, 0x1}]}}}, @IFLA_ADDRESS={0xa, 0x1, @random="977774604b7e"}]}, 0x44}, 0x1, 0x0, 0x0, 0x1}, 0x4004000)

3.554067235s ago: executing program 2 (id=2702):
r0 = socket$nl_xfrm(0x10, 0x3, 0x6)
syz_emit_ethernet(0x86, &(0x7f00000010c0)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb08004500007800000000000190780a010102ac1414aa050090780100000047000000000000000011040000000101ac1e000144670101ac1414bb4e210000443c0001e53d0001000000000000000000000000ac1414000000000000000000000000060000000000000000ac1e000102000000ac1414000000"], 0x0)
sendmsg$nl_xfrm(r0, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000640)=ANY=[@ANYBLOB="680000001400010000000000fbdbdf25e00000010000000000000000000000000000000000000000000000000000000100000080000700000000800000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="00000000000000000c0008000800d41a605f4d"], 0x68}}, 0x4004040)
ioctl$AUTOFS_DEV_IOCTL_PROTOVER(0xffffffffffffffff, 0xc0189372, &(0x7f0000000000)={{0x1, 0x1, 0x18, <r1=>r0, {0x7}}, './file0\x00'})
r2 = socket$nl_generic(0x10, 0x3, 0x10)
r3 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000500), 0xffffffffffffffff)
r4 = socket$can_bcm(0x1d, 0x2, 0x2)
ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000280)={'vcan0\x00', <r5=>0x0})
connect$can_bcm(r4, &(0x7f0000000bc0)={0x1d, r5}, 0x10)
sendmsg$can_bcm(r4, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[@ANYBLOB="05"], 0x48}}, 0x0)
sendmsg$can_bcm(r4, &(0x7f0000000380)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB="06"], 0x48}, 0x1, 0x0, 0x0, 0x4000011}, 0x800)
socket$nl_netfilter(0x10, 0x3, 0xc)
r6 = socket$inet6_tcp(0xa, 0x1, 0x0)
bind$inet6(r6, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c)
capset(0x0, 0x0)
fchown(0xffffffffffffffff, 0xee00, 0x0)
listen(r6, 0x9)
r7 = socket$inet_mptcp(0x2, 0x1, 0x106)
r8 = socket(0x2, 0x80805, 0x0)
ioctl$SIOCGSTAMP(r8, 0x8906, 0x0)
connect$inet(r7, &(0x7f0000000000)={0x2, 0x4e22, @empty}, 0x10)
r9 = accept(r6, 0x0, 0x0)
sendmsg$TEAM_CMD_OPTIONS_SET(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000080)=ANY=[], 0xfffffdef}}, 0x0)
recvfrom(r7, &(0x7f0000000180)=""/60, 0xfffffffffffffecb, 0x500, 0x0, 0x0)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x200000d, 0x4008031, 0xffffffffffffffff, 0x0)
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x14, 0x0, 0x0)
setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x8, &(0x7f0000000000)=0x8000, 0x4)
sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, 0x0, 0x800)
sendmsg$TIPC_NL_LINK_RESET_STATS(r2, 0x0, 0x20000010)
sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000b00)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x1000000}, 0xc, &(0x7f0000000ac0)={&(0x7f00000006c0)={0x3d8, r3, 0x300, 0x70bd28, 0x25dfdbfb, {}, [@TIPC_NLA_LINK={0x8c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_PROP={0xc, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}]}, @TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffff}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz1\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_MTU={0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xfffffff8}]}]}, @TIPC_NLA_MEDIA={0x94, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x4c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x40}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1e}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x467}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1d}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xffffff81}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_MEDIA_PROP={0x14, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0xc}]}, @TIPC_NLA_MEDIA_PROP={0xc, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}]}]}, @TIPC_NLA_MON={0x24, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_REF={0x8, 0x2, 0x8}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x7a}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x8}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x800}]}, @TIPC_NLA_LINK={0x68, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x14, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}]}, @TIPC_NLA_LINK_PROP={0x24, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x12}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}]}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}]}, @TIPC_NLA_MEDIA={0x14, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'eth\x00'}, @TIPC_NLA_MEDIA_NAME={0x8, 0x1, 'udp\x00'}]}, @TIPC_NLA_NET={0x38, 0x7, 0x0, 0x1, [@TIPC_NLA_NET_ID={0x8, 0x1, 0x7}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x1}, @TIPC_NLA_NET_NODEID_W1={0xc, 0x4, 0x834}, @TIPC_NLA_NET_NODEID={0xc, 0x3, 0x6}, @TIPC_NLA_NET_ID={0x8, 0x1, 0x5}]}, @TIPC_NLA_LINK={0x184, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x13, 0x1, 'broadcast-link\x00'}, @TIPC_NLA_LINK_NAME={0x9, 0x1, 'syz0\x00'}, @TIPC_NLA_LINK_PROP={0x44, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x14}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xffffffff}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xf}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x101}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x30da}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x5}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x4f}]}, @TIPC_NLA_LINK_PROP={0x54, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfff}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x1}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x75}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x100}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xc}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x9e5}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xe7f2}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}]}, @TIPC_NLA_LINK_PROP={0x2c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_MTU={0x8, 0x4, 0xaa}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x2}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x2}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x18}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x17}]}, @TIPC_NLA_LINK_PROP={0x1c, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x5}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x15}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x8}]}]}, @TIPC_NLA_BEARER={0x48, 0x1, 0x0, 0x1, [@TIPC_NLA_BEARER_UDP_OPTS={0x44, 0x4, {{0x20, 0x1, @in6={0xa, 0x4e22, 0x4, @remote, 0x6}}, {0x20, 0x2, @in6={0xa, 0x4e21, 0xd, @mcast2, 0x4}}}}]}]}, 0x3d8}, 0x1, 0x0, 0x0, 0x4008000}, 0x4000040)

3.437385286s ago: executing program 6 (id=2703):
sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x400c4)
r0 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r0, 0x0, 0x0)
syz_emit_ethernet(0x74, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0xfffffe9a, 0x0, @gue={{0x2}}}}}}}, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0)
recvfrom$inet(r0, &(0x7f00000002c0)=""/137, 0x89, 0x10000, 0x0, 0x0)

3.375102266s ago: executing program 8 (id=2704):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000080)=ANY=[@ANYBLOB="50000000090601020000ffff00000000020000000900020073797a31000000000500010007000000280007800c00018008000140ffffffff0500070011000000060004404e2200000600"], 0x50}, 0x1, 0x0, 0x0, 0x10000082}, 0x20000880)

3.315949169s ago: executing program 8 (id=2706):
r0 = socket$inet6_mptcp(0xa, 0x1, 0x106)
r1 = socket$can_raw(0x1d, 0x3, 0x1)
setxattr$system_posix_acl(&(0x7f00000001c0)='.\x00', &(0x7f0000000200)='system.posix_acl_default\x00', &(0x7f0000000040)=ANY=[@ANYBLOB="020000000100000000000015010000000400000008000000", @ANYRES32=0x0, @ANYBLOB="10000000000000002000000000000000"], 0x2c, 0x3)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
getsockopt$inet6_int(r2, 0x29, 0x10, 0x0, &(0x7f0000000040))
socket$inet6_tcp(0xa, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6)
connect$inet6(0xffffffffffffffff, &(0x7f0000000240)={0xa, 0x6e23, 0x2, @mcast1, 0x9}, 0x1c)
r6 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0)
ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r6, 0xc4c85512, &(0x7f0000000780)={{0xa}, 0x0, [0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x800000000, 0x0, 0x0, 0x5, 0x0, 0xfffffffffffffffd, 0x0, 0x20000000000, 0x3123, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x9, 0x0, 0xfffffffffffffff9, 0x1, 0x0, 0x0, 0x2, 0x0, 0x0, 0xffffffffffffffff, 0x3, 0xd451, 0x0, 0x0, 0x0, 0x0, 0x100000000000, 0x1, 0x2000000000, 0x0, 0x0, 0x80, 0x3, 0x0, 0x0, 0x10000, 0x7785, 0x8000000000, 0x0, 0x0, 0x0, 0x2, 0xdf, 0x4, 0x1, 0x2, 0x0, 0x80000000000, 0x0, 0xd7, 0xffffffffffffffff, 0x6, 0x0, 0x3, 0x0, 0xfffffffffffffffd, 0x0, 0x3, 0x2, 0x0, 0x0, 0x0, 0x4a, 0x20000000000, 0x0, 0x0, 0x200, 0x0, 0x0, 0x5, 0xffffffffffffffff, 0x0, 0x3, 0xfffffffffffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x3, 0x0, 0x4, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x1, 0x4, 0x10004, 0x5, 0x0, 0xfffffffffffffffe, 0x0, 0x3, 0x0, 0x0, 0x3843, 0x0, 0xfffffffffffffffc, 0x5, 0x80004001, 0x0, 0x0, 0xac]})
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="160000000000000004000000ff"], 0x48)
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[], 0x48)
bpf$PROG_LOAD(0x5, &(0x7f0000000340)={0x7, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18020000ffffffff00000000000000001801000011646c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000000008500000006000000850000007d00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0xba03d6b623375271, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8d90}, 0x94)
r7 = bpf$PROG_LOAD(0x5, &(0x7f0000000680)={0x11, 0x14, &(0x7f0000000400)=ANY=[@ANYBLOB="180000000000000000000000000000001801000020646c2100000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b7030000000007008500000073"], &(0x7f0000000000)='GPL\x00', 0x7, 0x0, 0x0, 0x40f00, 0x1a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94)
bpf$PROG_BIND_MAP(0xa, &(0x7f00000004c0)={r7}, 0xc)
setsockopt(r1, 0xfffffff9, 0xd, 0x0, 0x0)
r8 = syz_open_dev$video(&(0x7f00000008c0), 0x8, 0x400)
ioctl$VIDIOC_SUBDEV_ENUM_DV_TIMINGS(r8, 0xc0945662, &(0x7f0000000900)={0x9, 0x0, '\x00', {0x0, @bt={0x3, 0x7, 0x1, 0x0, 0x2, 0x6, 0x8, 0xc537, 0x8000, 0x200, 0x8, 0x5, 0xf73, 0x6, 0x1, 0x10, {0x9, 0x80000001}, 0x3, 0x1}}})
bind$inet6(r0, &(0x7f0000000000)={0xa, 0x3, 0x0, @private0={0xfc, 0x0, '\x00', 0x1}, 0x8}, 0x1c)
connect$inet6(r0, &(0x7f0000000080)={0xa, 0x4, 0x4, @remote, 0x8}, 0x1c)

3.092500781s ago: executing program 5 (id=2708):
r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10)
r1 = syz_genetlink_get_family_id$netlbl_mgmt(&(0x7f0000000780), r0)
sendmsg$NLBL_MGMT_C_ADD(r0, &(0x7f0000000d80)={0x0, 0x0, &(0x7f0000000d40)={&(0x7f0000000c80)={0x2c, r1, 0x1, 0x70bd2d, 0xa000000, {}, [@NLBL_MGMT_A_IPV4MASK={0x8, 0x8, @multicast1}, @NLBL_MGMT_A_DOMAIN={0x5, 0x1, '\x00'}, @NLBL_MGMT_A_PROTOCOL={0x8, 0x2, 0x5}]}, 0x2c}, 0x1, 0x2000000}, 0x0)

2.593381805s ago: executing program 5 (id=2709):
r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000100)={0x1, "5660359c3245d1c42317afad7d48ed51000000000000000100"})
ioctl$SW_SYNC_IOC_CREATE_FENCE(0xffffffffffffffff, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27"})
r1 = gettid()
timer_create(0xb, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r1}, &(0x7f0000bbdffc))
openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0)
mq_open(0x0, 0x42, 0x0, 0x0)
syz_open_dev$dri(0x0, 0x1, 0x400)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r2 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r2, 0xaf01, 0x0)
r3 = eventfd(0xfffffff9)
ioctl$VHOST_SET_LOG_FD(r2, 0x4004af07, &(0x7f0000000240)=r3)
ioctl$VHOST_SET_VRING_KICK(r2, 0x4008af20, &(0x7f0000000040)={0x1, r3})
ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r2, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000})
ioctl$VHOST_SET_MEM_TABLE(r2, 0x4008af03, &(0x7f0000000680))
ioctl$VHOST_SET_VRING_ERR(r2, 0x4008af22, &(0x7f00000002c0)={0x1, r3})
ioctl$VHOST_VSOCK_SET_RUNNING(r2, 0x4004af61, &(0x7f0000000000)=0x1)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r4 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r4, 0x0)
r5 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581)
ioctl$CEC_RECEIVE(r5, 0xc0386106, &(0x7f0000000000)={0x4, 0xb, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000000000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9d})
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
ppoll(0x0, 0x0, 0x0, 0x0, 0x0)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0)

2.53328471s ago: executing program 6 (id=2710):
write$cgroup_subtree(0xffffffffffffffff, &(0x7f0000000180), 0x0)
r0 = socket$netlink(0x10, 0x3, 0x0)
sendmsg$nl_route(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="1b0000001d00010000000000ffdbdf252d"], 0x1c}}, 0x0)
mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0xb, 0x31, 0xffffffffffffffff, 0x0)
remap_file_pages(&(0x7f00006ca000/0x4000)=nil, 0x4000, 0x0, 0x3, 0x20000)
madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x19)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
r2 = bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000380)={&(0x7f0000000080)=ANY=[@ANYBLOB="9feb010018000000000000001c0000001c00000003000000010000000000000e0200000000000000000000000000000504000000002e"], 0x0, 0x37}, 0x20)
r3 = bpf$MAP_CREATE(0x0, &(0x7f0000004440)=ANY=[@ANYBLOB="09000000040000000400", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32=r2, @ANYBLOB="0200000001"], 0x48)
bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000001c0), &(0x7f0000000240), 0xfff, r3, 0x0, 0x300}, 0x38)
syz_emit_vhci(0x0, 0x14)
r4 = socket$kcm(0xa, 0x2, 0x0)
r5 = socket(0x2, 0x80002, 0x0)
setsockopt$IP_VS_SO_SET_ADD(r5, 0x0, 0x482, &(0x7f0000000040)={0x84, @private=0xa010100, 0x4e22, 0x3, 'sh\x00', 0x8, 0x3, 0x6f}, 0x2c)
setsockopt$IP_VS_SO_SET_ADDDEST(r5, 0x0, 0x487, &(0x7f0000000000)={{0x84, @private=0xa010103, 0x4e21, 0x3, 'lblcr\x00', 0x5, 0x8, 0x77}, {@remote, 0x4e20, 0x0, 0x6, 0x1}}, 0x44)
sendmsg$sock(r4, &(0x7f0000000400)={&(0x7f0000000580)=@in6={0x2, 0x15, 0x0, @dev={0xfe, 0x80, '\x00', 0x4}}, 0x80, 0x0, 0x0, &(0x7f0000000000)=[@mark={{0x14, 0x1, 0x24, 0x3}}], 0x18}, 0x0)

2.36608011s ago: executing program 8 (id=2711):
setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x4)
connect$inet6(0xffffffffffffffff, &(0x7f0000000100)={0xa, 0x0, 0x7, @ipv4={'\x00', '\xff\xff', @local}, 0x1}, 0x1c)
setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4)
setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000400)=0x1, 0x4)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000000)=@ccm_128={{0x303}, "0e57b3d487e2db32", "a9df7ccffde8899f914d4f2c3e263509", "3c36a51c", "6775c975b6b15e11"}, 0x28)
setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x1, &(0x7f0000000080)=@ccm_128={{0x303}, "f64e40992f79ecf0", "53c272d8b763f690b35605dff8a4a8d2", "021000", "72392a24199b5903"}, 0x28)
writev(0xffffffffffffffff, &(0x7f00000000c0)=[{&(0x7f0000000700)="bdc99118158ffb3222a77dce29e913c7fa56753b708da3c283982b260ce5abd73c63ebd0b452b90f91943532f9d9b862c0ea33a403e4296db241fea24984873479c48ab65e8a04715da0a09b9100da082e1ef81b1b2e9c09b2cdf5c8b51d073cb8d0b31622fbdfa82a7f4098302d956b7b9603b9119bd83b0ae863bf29bfb5ff0fdec352e751f2002915b9a97ccb11880df592aa6e77c60a33c8", 0x9a}], 0x1)
readv(0xffffffffffffffff, &(0x7f0000000500)=[{&(0x7f0000000440)=""/153, 0x99}, {&(0x7f0000003a00)=""/4115, 0x1013}], 0x2)

1.825210966s ago: executing program 0 (id=2712):
mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1c0)
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x1c}}, 0x4000074)
socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000002c0)={<r0=>0xffffffffffffffff})
pipe2$9p(&(0x7f00000001c0)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff}, 0x0)
mount$9p_fd(0x0, &(0x7f0000002200)='./file0\x00', &(0x7f0000000100), 0x0, &(0x7f0000000440)=ANY=[@ANYBLOB="74070000000000f5bd686a0f7266646d3d4b5ce3fdc9acf42857f4e02178066f10b47354e13ccfbd5f7997e9278e71405a5738783713eba88e87ec1262085a91511d75a39071f1b25c1f9f7cec51761f7d4f79b55572ae967b00d3ef7e82f066e7fdcb6ab47e032448074fbd3b680690e4779290b0315efb7360014189abebf7ebed1b", @ANYRESHEX=r1, @ANYBLOB=',wfdno=', @ANYRESHEX=r0, @ANYBLOB=',version=9p2000.u,\x00'])
syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="053e1301002a376c13c1568824ae0000000000000010"], 0x16)
r3 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000c40)=@newlink={0x3c, 0x10, 0x1, 0x70bd29, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0x2b24d, 0x11a24}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x8, 0x16, 0x0, 0x1, [{0x4}]}]}, 0x3c}, 0x1, 0x0, 0x0, 0x408c1}, 0x0)
r4 = socket(0x2b, 0x80801, 0x1)
connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x10000, @loopback, 0x1}, 0x1c)
syz_usb_connect$uac1(0x5, 0x81, &(0x7f0000000000)=ANY=[@ANYBLOB="12010002000000106307012040000102030109026f0003010300050904000000010100000a240100000a0002010209040100000102000009040101010102000009050109080002fc0a072501000e060009ffffffff0102000009040201010102000008240201f9033c7f072401070402100905822940"], 0x0)
setsockopt$bt_l2cap_L2CAP_LM(r4, 0x6, 0x3, &(0x7f0000000040)=0x25, 0x4)
nanosleep(&(0x7f0000000300)={0x0, 0x5f5e100}, 0x0)
syz_emit_vhci(&(0x7f0000000100)=ANY=[@ANYBLOB="022a000a0006000500180102000000"], 0xf)
nanosleep(&(0x7f0000000300)={0x0, 0x1dcd6500}, 0x0)
write$P9_RVERSION(r2, &(0x7f0000000080)=ANY=[@ANYBLOB="150000006bffff"], 0x15)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = socket$kcm(0x23, 0x5, 0x0)
ioctl$sock_kcm_SIOCKCMATTACH(r6, 0x89ee, &(0x7f0000000100))
sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c00000047000701ec560dbbffffffff017c0000080003"], 0x1c}, 0x1, 0x0, 0x0, 0x4048011}, 0x80)

1.703994903s ago: executing program 8 (id=2713):
r0 = openat(0xffffffffffffff9c, &(0x7f0000000100)='./sys/bus/i2c/devices/i2c-0/new_device\x00', 0x1, 0x0)
write(r0, &(0x7f0000000300)='rt1719 0x49\x00', 0xc)
ioctl$SNDRV_PCM_IOCTL_START(r0, 0x4142, 0x0)
syz_usb_connect(0x2, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000c41f4040110f00107f00000000010902120001000000000904"], 0x0)

1.699765564s ago: executing program 6 (id=2714):
bpf$MAP_CREATE(0x0, &(0x7f0000000640)=ANY=[@ANYBLOB="17000000000000000400000003"], 0x48)
r0 = syz_open_dev$sndctrl(&(0x7f0000000580), 0x0, 0x0)
ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, 0x0)
ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(0xffffffffffffffff, 0xc0045516, 0x0)
socket$packet(0x11, 0x3, 0x300)
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x2, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5)
openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0)
r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102)
writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2)
pselect6(0x40, &(0x7f0000000240)={0x0, 0x0, 0xd0, 0x7d, 0x0, 0x8000, 0x4, 0x1}, 0x0, &(0x7f00000002c0)={0x3ff, 0x6, 0xffffffffffffffff, 0x9, 0x0, 0xa, 0x80000006, 0x400}, 0x0, 0x0)
ioctl$XFS_IOC_ATTRLIST_BY_HANDLE(0xffffffffffffffff, 0x4038587a, &(0x7f00000002c0)={{<r2=>0xffffffffffffffff, &(0x7f0000000040)=',}#})$\x00', 0x440400, &(0x7f00000000c0)={@align=0x80000000, {0xd7, 0x8, 0x8, 0x8000000000000001}}, 0x2, &(0x7f0000000100)={@_ha_fsid}, 0x0}, {[0xffffffff, 0x5, 0x6, 0x5]}, 0x800000, 0xd0, &(0x7f0000000180)=""/208})
r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000140)={0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, r2}, 0x94)
bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000003c0)={r3, 0x0, 0x0, 0x0, &(0x7f0000000100), 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50)
sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000037c0)={0x0, 0x0, &(0x7f0000003780)={0x0}}, 0x0)
r4 = socket$kcm(0x10, 0x2, 0x0)
sendmsg$kcm(r4, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000340)="2e00000010008188e6b62aa73772cc9f1ba1f848110000005e140602000000000e000a001000000002900000121f", 0x2e}], 0x1}, 0x8044)

1.384401723s ago: executing program 2 (id=2715):
r0 = openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000040), 0x80001, 0x0)
openat$sw_sync(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
ioctl$SW_SYNC_IOC_CREATE_FENCE(r0, 0xc0285700, &(0x7f0000000000)={0x5, "340b7832ceefd131b8e6498c25f58fad9987ffe93bbabd18cf501922de974a27", <r1=>0xffffffffffffffff})
r2 = gettid()
timer_create(0xb, &(0x7f00000000c0)={0x0, 0x21, 0x800000000004, @tid=r2}, &(0x7f0000bbdffc))
openat$rfkill(0xffffffffffffff9c, 0x0, 0x801, 0x0)
mq_open(0x0, 0x42, 0x0, 0x0)
syz_open_dev$dri(0x0, 0x1, 0x400)
close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2)
r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000580), 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0)
r4 = eventfd(0xfffffff9)
ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4)
ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4})
ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0})
ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/70, 0x100000})
ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, 0x0)
ioctl$VHOST_SET_VRING_ERR(r3, 0x4008af22, &(0x7f00000002c0)={0x1, r4})
ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x1)
syz_usb_control_io(0xffffffffffffffff, 0x0, &(0x7f0000000980)={0x84, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0})
r5 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0)
mmap(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x27ffff7, 0x4012011, r5, 0x0)
r6 = syz_open_dev$cec(&(0x7f0000000240), 0x0, 0x22581)
ioctl$CEC_RECEIVE(r6, 0xc0386106, &(0x7f0000000000)={0x4, 0xb, 0x80005, 0xfffffffe, 0x8, 0x16, "260000000000000754439400", 0xc, 0x0, 0x5, 0x2, 0x0, 0x0, 0x9d})
setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x1f, 0x6, 0x390, 0x0, 0x98, 0x130, 0x1c8, 0x2f8, 0x0, 0x98, 0x130, 0x260, 0x2f8, 0x6, 0x0, {[{{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}, {{@ip={@empty, @empty, 0x0, 0x0, '\x00', '\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98}, @ECN={0x28, 'ECN\x00', 0x0, {0x30, 0x0, 0x3}}}, {{@uncond, 0x0, 0x70, 0x98}, @common=@unspec=@STANDARD={0x28, '\x00', 0x0, 0xfffffffe}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x3f0)
ioctl$SYNC_IOC_MERGE(0xffffffffffffffff, 0xc0303e03, &(0x7f0000000180)={"2486910284ed923431d4c5d5fbf514fd00", r1})
r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x2}]})
ppoll(0x0, 0x0, 0x0, 0x0, 0x0)
close_range(r7, 0xffffffffffffffff, 0x0)

542.955886ms ago: executing program 6 (id=2716):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)={0x34, 0x41, 0x107, 0xfffffefe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x18, 0x1, 0x0, 0x1, [@typed={0x6, 0x6, 0x0, 0x0, @str='\x80\n'}, @typed={0xc, 0x15, 0x0, 0x0, @u64=0xfffffffffffffffa}]}, @nested={0x4, 0x2}]}, 0x34}, 0x1, 0x0, 0x0, 0x48815}, 0xc010) (fail_nth: 2)

539.83331ms ago: executing program 5 (id=2717):
r0 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0)
sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000110001"], 0x84}, 0x1, 0x0, 0x0, 0x200280d0}, 0x40)
syz_emit_ethernet(0x9e, &(0x7f0000000480)={@local, @empty, @void, {@ipv6={0x86dd, @tcp={0x0, 0x6, "000001", 0x68, 0x6, 0x40, @remote, @local, {[], {{0x4e22, 0x4e24, 0x0, 0x41424344, 0x0, 0x0, 0x1a, 0x18, 0x4, 0x0, 0x0, {[@timestamp={0x8, 0xa, 0x3c0000, 0x1}, @exp_fastopen={0xfe, 0x9, 0xf989, "65fac247c9"}, @generic={0x22, 0x8, "823bb105876f"}, @md5sig={0x13, 0x12, "dfd68b801c2f872422520e7824fd6953"}, @mss={0x2, 0x4, 0xe}, @generic={0xfe, 0xfffffffffffffcc9, "473fd72953"}, @exp_fastopen={0xfe, 0xd, 0xf989, "148511d78ea8cb1d40"}, @fastopen={0x22, 0x4, "1315"}, @mss={0x2, 0x4, 0x7ff}, @fastopen={0x22, 0x4, "678d"}]}}}}}}}}, 0x0)

477.886812ms ago: executing program 6 (id=2718):
r0 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r0, 0x7a7, &(0x7f0000000040)=0x90000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r0, 0x7a0, &(0x7f0000000000)={@local})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r0, 0x7a8, &(0x7f0000000540)={{@hyper, 0x1}, @hyper, 0x0, 0x0, 0x5e})
r1 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0)
ioctl$IOCTL_VMCI_VERSION2(r1, 0x7a7, &(0x7f0000000040)=0xb0000)
ioctl$IOCTL_VMCI_INIT_CONTEXT(r1, 0x7a0, &(0x7f0000000240)={@hyper})
ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r1, 0x7a8, &(0x7f0000000540)={{@hyper, 0x2}, @hyper, 0x0, 0x0, 0x5e, 0xfffffffffffffff9, 0x10000000})

476.577406ms ago: executing program 5 (id=2719):
r0 = openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x141201, 0x0)
ioctl$SNAPSHOT_SET_SWAP_AREA(r0, 0x400c330d, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./cgroup.cpu/syz2\x00', 0x1ff)
r1 = getpid()
r2 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./cgroup.cpu/syz2/cgroup.procs\x00', 0x2, 0x0)
write$cgroup_pid(r2, &(0x7f0000000100)=r1, 0x12)
r3 = openat$kvm(0x0, &(0x7f0000000140), 0x0, 0x0)
r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0)
syz_kvm_setup_syzos_vm$x86(r4, &(0x7f0000c00000/0x400000)=nil)
sendmsg$netlink(0xffffffffffffffff, 0x0, 0x0)
mmap$KVM_VCPU(&(0x7f0000009000/0x1000)=nil, 0x0, 0x3, 0x11, 0xffffffffffffffff, 0x0)
madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x19)
madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x9)
munlockall()
r5 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./cgroup.cpu/syz2/memory.limit_in_bytes\x00', 0x2, 0x0)
write(r5, &(0x7f0000000280)='40', 0x2)
r6 = socket(0xa, 0x1, 0x0)
getsockopt$inet_tcp_TCP_ZEROCOPY_RECEIVE(r6, 0x6, 0x13, 0x0, &(0x7f0000000180))
mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff)
mount(0x0, &(0x7f0000000000)='./config\x00', &(0x7f0000000040)='configfs\x00', 0x0, 0x0)
syz_open_dev$loop(0x0, 0xfffffbff7ffffffb, 0x1222e2)
socket$nl_xfrm(0x10, 0x3, 0x6)
r7 = socket$inet_udp(0x2, 0x2, 0x0)
bind$inet(r7, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10)
connect$inet(r7, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10)
sendmmsg(r7, &(0x7f0000007fc0), 0x0, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000580)='./config/cluster/mycluster/heartbeat/myregion/dev\x00', 0x2, 0x0)

431.758303ms ago: executing program 6 (id=2720):
sendmsg$NL80211_CMD_DEL_PMKSA(0xffffffffffffffff, &(0x7f0000000140)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x2000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x40}, 0x400c4)
r0 = socket$l2tp(0x2, 0x2, 0x73)
bind$inet(r0, 0x0, 0x0)
syz_emit_ethernet(0x74, &(0x7f0000000000)={@link_local, @empty, @void, {@ipv4={0x800, @udp={{0x5, 0x4, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0x73, 0x0, @private=0x300, @multicast1}, {0x0, 0x0, 0xfffffe9a, 0x0, @gue={{0x2}}}}}}}, 0x0)
r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='cgroup.controllers\x00', 0x275a, 0x0)
mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x10012, r1, 0x0)
recvfrom$inet(r0, &(0x7f00000002c0)=""/137, 0x89, 0x10000, 0x0, 0x0)

188.983709ms ago: executing program 5 (id=2721):
r0 = syz_open_dev$mtd(&(0x7f00000000c0), 0x260c, 0x8a42)
r1 = dup(r0)
ioctl$AUTOFS_DEV_IOCTL_REQUESTER(r1, 0xc018937b, 0x0) (fail_nth: 1)

0s ago: executing program 5 (id=2722):
r0 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0)
ioctl$BINDER_SET_CONTEXT_MGR_EXT(r0, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0xa, 0x8000000000002})
openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./file0\x00', 0x0)
mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='debugfs\x00', 0x1214040, 0x0)
mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f})
r1 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x4, 0x80)
getdents64(r1, &(0x7f0000000400)=""/4096, 0x1000)
mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x9)
write$USERIO_CMD_REGISTER(0xffffffffffffffff, &(0x7f00000000c0), 0x2)

kernel console output (not intermixed with test programs):

 USB device number 30 using dummy_hcd
[  606.022401][ T5778] usb 1-1: unable to get BOS descriptor or descriptor too short
[  606.047124][ T5778] usb 1-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00
[  606.071578][ T5778] usb 1-1: config 129 has an invalid interface number: 135 but max is 0
[  606.087067][   T30] audit: type=1400 audit(1786408122.932:1169): avc:  denied  { write } for  pid=14482 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  606.109363][ T5778] usb 1-1: config 129 has an invalid interface number: 5 but max is 0
[  606.124693][T13325] Bluetooth: hci8: command tx timeout
[  606.140736][ T5778] usb 1-1: config 129 has 2 interfaces, different from the descriptor's value: 1
[  606.151358][ T5778] usb 1-1: config 129 has no interface number 0
[  606.161075][ T5778] usb 1-1: config 129 has no interface number 1
[  606.167714][ T5778] usb 1-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5
[  606.181246][ T5778] usb 1-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30
[  606.192397][ T5778] usb 1-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37
[  606.212273][ T5778] usb 1-1: config 129 interface 135 has no altsetting 0
[  606.230677][ T5778] usb 1-1: config 129 interface 5 has no altsetting 0
[  606.243072][ T5778] usb 1-1: string descriptor 0 read error: -22
[  606.250158][ T5778] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  606.251838][T14468] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2164'.
[  606.302238][T14468] tipc: Invalid UDP bearer configuration
[  606.302267][T14468] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  606.345872][ T5778] usb 1-1: Quirk or no altset; falling back to MIDI 1.0
[  606.355286][ T5778] usb 1-1: MIDIStreaming interface descriptor not found
[  606.479134][T14340] team0: Port device team_slave_0 added
[  606.536966][T14340] team0: Port device team_slave_1 added
[  606.583779][T14278] netdevsim netdevsim2 netdevsim0: renamed from eth0
[  606.595048][T14460] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  606.646049][T14460] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  606.666099][T14278] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  606.706181][T14278] netdevsim netdevsim2 netdevsim1: renamed from eth1
[  606.735330][T14278] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  606.817433][ T5778] usb 1-1: USB disconnect, device number 30
[  606.897854][T14278] netdevsim netdevsim2 netdevsim2: renamed from eth2
[  606.921170][T13325] Bluetooth: hci9: command tx timeout
[  606.964650][T14278] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  606.986040][   T30] audit: type=1400 audit(1786408123.832:1170): avc:  denied  { write } for  pid=14491 comm="syz.8.2166" name="autofs" dev="devtmpfs" ino=98 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1
[  607.027595][T14278] netdevsim netdevsim2 netdevsim3: renamed from eth3
[  607.096522][T14278] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  607.132948][T14340] batman_adv: batadv0: Adding interface: batadv_slave_0
[  607.144394][T14340] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  607.149052][   T30] audit: type=1400 audit(1786408123.832:1171): avc:  denied  { ioctl } for  pid=14491 comm="syz.8.2166" path="/dev/autofs" dev="devtmpfs" ino=98 ioctlcmd=0x9371 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_device_t tclass=chr_file permissive=1
[  607.278955][T14340] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  607.364816][T14340] batman_adv: batadv0: Adding interface: batadv_slave_1
[  607.381030][T14340] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  607.392337][   T30] audit: type=1400 audit(1786408124.232:1172): avc:  denied  { write } for  pid=14484 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  607.468544][T14340] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  607.521016][T14506] netlink: 20 bytes leftover after parsing attributes in process `syz.6.2169'.
[  607.644361][T14340] hsr_slave_0: entered promiscuous mode
[  607.711726][T14340] hsr_slave_1: entered promiscuous mode
[  607.724343][T14340] debugfs: 'hsr0' already exists in 'hsr'
[  607.740659][T14340] Cannot create hsr debugfs directory
[  607.848886][   T30] audit: type=1400 audit(1786408124.692:1173): avc:  denied  { write } for  pid=14516 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  608.094419][T14524] netlink: 12 bytes leftover after parsing attributes in process `syz.8.2174'.
[  608.208220][T14531] FAULT_INJECTION: forcing a failure.
[  608.208220][T14531] name failslab, interval 1, probability 0, space 0, times 0
[  608.246377][T14278] 8021q: adding VLAN 0 to HW filter on device bond0
[  608.256573][T14531] CPU: 0 UID: 0 PID: 14531 Comm: syz.6.2176 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  608.256594][T14531] Tainted: [L]=SOFTLOCKUP
[  608.256599][T14531] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  608.256606][T14531] Call Trace:
[  608.256610][T14531]  <TASK>
[  608.256615][T14531]  dump_stack_lvl+0x100/0x190
[  608.256634][T14531]  should_fail_ex.cold+0x5/0xa
[  608.256650][T14531]  should_failslab+0xc2/0x120
[  608.256666][T14531]  __kmalloc_noprof+0xfc/0x820
[  608.256680][T14531]  ? tomoyo_encode2+0xfb/0x3c0
[  608.256694][T14531]  tomoyo_encode2+0xfb/0x3c0
[  608.256706][T14531]  tomoyo_encode+0x29/0x50
[  608.256717][T14531]  tomoyo_realpath_from_path+0x18c/0x690
[  608.256731][T14531]  tomoyo_path_number_perm+0x23c/0x580
[  608.256748][T14531]  ? tomoyo_path_number_perm+0x22e/0x580
[  608.256765][T14531]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  608.256795][T14531]  ? find_held_lock+0x2b/0x80
[  608.256806][T14531]  ? __fget_files+0x215/0x3d0
[  608.256818][T14531]  ? hook_file_ioctl_common+0x140/0x440
[  608.256831][T14531]  ? __fget_files+0x215/0x3d0
[  608.256845][T14531]  ? __fget_files+0x21f/0x3d0
[  608.256859][T14531]  security_file_ioctl+0xd3/0x230
[  608.256877][T14531]  __x64_sys_ioctl+0xb7/0x210
[  608.256896][T14531]  do_syscall_64+0x115/0x870
[  608.256911][T14531]  ? clear_bhb_loop+0x70/0xc0
[  608.256926][T14531]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  608.256938][T14531] RIP: 0033:0x7fdb4939e0d9
[  608.256948][T14531] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  608.256959][T14531] RSP: 002b:00007fdb4a18a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  608.256973][T14531] RAX: ffffffffffffffda RBX: 00007fdb49625fa0 RCX: 00007fdb4939e0d9
[  608.256985][T14531] RDX: 0000200000000080 RSI: 00000000c0845657 RDI: 0000000000000003
[  608.256993][T14531] RBP: 00007fdb4a18a090 R08: 0000000000000000 R09: 0000000000000000
[  608.257000][T14531] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  608.257006][T14531] R13: 00007fdb49626038 R14: 00007fdb49625fa0 R15: 00007fffc3495768
[  608.257021][T14531]  </TASK>
[  608.257032][T14531] ERROR: Out of memory at tomoyo_realpath_from_path.
[  608.370803][T14278] 8021q: adding VLAN 0 to HW filter on device team0
[  608.693774][ T5903] bridge0: port 1(bridge_slave_0) entered blocking state
[  608.700930][ T5903] bridge0: port 1(bridge_slave_0) entered forwarding state
[  608.771050][T14536] netlink: 76 bytes leftover after parsing attributes in process `syz.0.2177'.
[  608.787738][ T5907] bridge0: port 2(bridge_slave_1) entered blocking state
[  608.794899][ T5907] bridge0: port 2(bridge_slave_1) entered forwarding state
[  608.854159][T14539] bond5 (unregistering): Released all slaves
[  608.856189][T14544] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2178'.
[  609.001333][T13325] Bluetooth: hci9: command tx timeout
[  609.212121][T14552] vhci_hcd vhci_hcd.0: pdev(0) rhport(0) sockfd(7)
[  609.218649][T14552] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed)
[  609.226392][T14552] vhci_hcd vhci_hcd.0: Device attached
[  609.257229][T14553] vhci_hcd: connection closed
[  609.257602][ T5912] vhci_hcd vhci_hcd.0: stop threads
[  609.270578][ T5778] usb 7-1: new high-speed USB device number 15 using dummy_hcd
[  609.277817][ T5912] vhci_hcd vhci_hcd.0: release socket
[  609.292528][ T5912] vhci_hcd vhci_hcd.0: disconnect device
[  609.347604][T14340] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  609.372579][   T30] audit: type=1400 audit(1786408126.212:1174): avc:  denied  { write } for  pid=14543 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  609.442856][ T5778] usb 7-1: unable to get BOS descriptor or descriptor too short
[  609.460993][ T5778] usb 7-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00
[  609.489342][T14561] netlink: 'syz.8.2180': attribute type 4 has an invalid length.
[  609.505096][   T30] audit: type=1400 audit(1786408126.352:1175): avc:  denied  { write } for  pid=14562 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  609.541091][ T5778] usb 7-1: config 129 has an invalid interface number: 135 but max is 0
[  609.542149][T14561] netlink: 'syz.8.2180': attribute type 4 has an invalid length.
[  609.578230][ T5778] usb 7-1: config 129 has an invalid interface number: 5 but max is 0
[  609.609330][T14564] netlink: 24 bytes leftover after parsing attributes in process `syz.8.2180'.
[  609.628907][T14340] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  609.641385][ T5778] usb 7-1: config 129 has 2 interfaces, different from the descriptor's value: 1
[  609.669798][ T5778] usb 7-1: config 129 has no interface number 0
[  609.684942][ T5778] usb 7-1: config 129 has no interface number 1
[  609.692577][ T5778] usb 7-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5
[  609.706790][ T5778] usb 7-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30
[  609.732924][T14570] netlink: 20 bytes leftover after parsing attributes in process `syz.8.2180'.
[  609.735157][ T5778] usb 7-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37
[  609.767824][ T5778] usb 7-1: config 129 interface 135 has no altsetting 0
[  609.783338][ T5778] usb 7-1: config 129 interface 5 has no altsetting 0
[  609.814672][ T5778] usb 7-1: string descriptor 0 read error: -22
[  609.823355][ T5778] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  609.846805][T14340] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  610.001984][ T5778] usb 7-1: Quirk or no altset; falling back to MIDI 1.0
[  610.008982][ T5778] usb 7-1: MIDIStreaming interface descriptor not found
[  610.095471][T14539] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  610.200307][T14539] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  610.483300][T14340] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0
[  610.502116][    C0] Unknown status report in ack skb
[  610.511308][   T29] usb 7-1: USB disconnect, device number 15
[  610.617098][   T30] audit: type=1400 audit(1786408127.462:1176): avc:  denied  { write } for  pid=14566 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  610.747782][   T30] audit: type=1400 audit(1786408127.592:1177): avc:  denied  { write } for  pid=14597 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  610.973232][T14278] 8021q: adding VLAN 0 to HW filter on device batadv0
[  611.111142][T14340] netdevsim netdevsim3 netdevsim0: renamed from eth0
[  611.158646][T14340] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  611.199628][T14340] netdevsim netdevsim3 netdevsim1: renamed from eth1
[  611.224642][T14340] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  611.250348][T14278] veth0_vlan: entered promiscuous mode
[  611.266843][T14340] netdevsim netdevsim3 netdevsim2: renamed from eth2
[  611.283756][T14340] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  611.305013][T14340] netdevsim netdevsim3 netdevsim3: renamed from eth3
[  611.335938][T14340] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  611.387698][T14278] veth1_vlan: entered promiscuous mode
[  611.395205][   T30] audit: type=1400 audit(1786408128.242:1178): avc:  denied  { write } for  pid=14603 comm="dhcpcd-run-hook" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  611.618084][T14278] veth0_macvtap: entered promiscuous mode
[  611.672760][   T30] audit: type=1400 audit(1786408128.512:1179): avc:  denied  { write } for  pid=14625 comm="rm" name="hook-state" dev="tmpfs" ino=1774 scontext=system_u:system_r:dhcpc_t tcontext=system_u:object_r:tmpfs_t tclass=dir permissive=1
[  611.727971][T14278] veth1_macvtap: entered promiscuous mode
[  611.814523][T14278] batman_adv: batadv0: Interface activated: batadv_slave_0
[  611.878401][ T5786] kernel read not supported for file task/64/net/mcfilter (pid: 5786 comm: kworker/0:8)
[  611.881938][T14278] batman_adv: batadv0: Interface activated: batadv_slave_1
[  611.995582][ T5913] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  612.159165][ T5903] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  612.291051][ T5786] usb 9-1: new full-speed USB device number 6 using dummy_hcd
[  613.185401][T14340] 8021q: adding VLAN 0 to HW filter on device bond0
[  613.251468][ T5913] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  613.282035][T14340] 8021q: adding VLAN 0 to HW filter on device team0
[  613.317098][ T5907] bridge0: port 1(bridge_slave_0) entered blocking state
[  613.324196][ T5907] bridge0: port 1(bridge_slave_0) entered forwarding state
[  613.335009][ T5786] usb 9-1: unable to get BOS descriptor or descriptor too short
[  613.351992][ T5786] usb 9-1: not running at top speed; connect to a high speed hub
[  613.369167][ T5786] usb 9-1: New USB device found, idVendor=0ccd, idProduct=0013, bcdDevice= 0.40
[  613.391523][ T5913] bridge0: port 2(bridge_slave_1) entered blocking state
[  613.398578][ T5913] bridge0: port 2(bridge_slave_1) entered forwarding state
[  613.416615][ T5786] usb 9-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid maxpacket 24099, setting to 1023
[  613.433641][ T5786] usb 9-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 4
[  613.444848][ T5907] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  613.514516][ T5786] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  613.527436][ T5786] usb 9-1: Product: syz
[  613.532166][ T5786] usb 9-1: Manufacturer: syz
[  613.538326][ T5786] usb 9-1: SerialNumber: syz
[  613.646819][ T5907] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  613.659859][ T5907] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  613.776334][ T5907] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  613.801761][ T5907] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  613.839916][T14646] netlink: 12 bytes leftover after parsing attributes in process `syz.6.2188'.
[  613.966849][T14651] binder: 14649:14651 ioctl 40047459 200000000140 returned -22
[  613.997902][T14651] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  614.044966][T14653] binder: 14652:14653 ioctl 40047459 200000000140 returned -22
[  614.055033][T14653] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  614.096027][T14653] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  614.107673][T14653] overlayfs: failed to look up (tracing) for ino (-66)
[  614.466355][T14662] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2191'.
[  614.498366][   T30] audit: type=1400 audit(1786408131.342:1180): avc:  denied  { sqpoll } for  pid=14661 comm="syz.0.2191" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=io_uring permissive=1
[  615.069228][T14340] 8021q: adding VLAN 0 to HW filter on device batadv0
[  615.148757][ T5786] usb 9-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  615.168373][ T5786] usb 9-1: 2:1 : UAC_AS_GENERAL descriptor not found
[  615.212212][T14340] veth0_vlan: entered promiscuous mode
[  615.253978][T14340] veth1_vlan: entered promiscuous mode
[  615.437141][ T5786] usb 9-1: USB disconnect, device number 6
[  615.475732][   T30] audit: type=1400 audit(1786408132.312:1181): avc:  denied  { setopt } for  pid=14676 comm="syz.6.2194" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=rxrpc_socket permissive=1
[  615.523364][T14340] veth0_macvtap: entered promiscuous mode
[  615.548284][T14679] netlink: 60 bytes leftover after parsing attributes in process `syz.0.2193'.
[  615.554408][ T6328] udevd[6328]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:1.0/sound/card4/controlC4/../uevent} for writing: No such file or directory
[  615.595040][T14340] veth1_macvtap: entered promiscuous mode
[  615.652368][T14340] batman_adv: batadv0: Interface activated: batadv_slave_0
[  615.746090][T14685] netlink: 'syz.6.2195': attribute type 10 has an invalid length.
[  615.921762][ T5716] usb 1-1: new high-speed USB device number 31 using dummy_hcd
[  616.139219][ T5716] usb 1-1: unable to get BOS descriptor or descriptor too short
[  616.208014][ T5716] usb 1-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00
[  616.342026][ T5716] usb 1-1: config 129 has an invalid interface number: 135 but max is 0
[  616.416583][T14689] FAULT_INJECTION: forcing a failure.
[  616.416583][T14689] name failslab, interval 1, probability 0, space 0, times 0
[  616.442453][T14687] netlink: 'syz.8.2197': attribute type 10 has an invalid length.
[  616.528886][ T5716] usb 1-1: config 129 has an invalid interface number: 5 but max is 0
[  616.567071][T14687] dummy0: entered promiscuous mode
[  616.572381][T14687] dummy0: entered allmulticast mode
[  616.578123][T14687] team0: Port device dummy0 added
[  616.586495][T14340] batman_adv: batadv0: Interface activated: batadv_slave_1
[  616.594472][ T5716] usb 1-1: config 129 has 2 interfaces, different from the descriptor's value: 1
[  616.604997][T14689] CPU: 1 UID: 0 PID: 14689 Comm: syz.2.2196 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  616.605015][T14689] Tainted: [L]=SOFTLOCKUP
[  616.605019][T14689] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  616.605026][T14689] Call Trace:
[  616.605030][T14689]  <TASK>
[  616.605034][T14689]  dump_stack_lvl+0x100/0x190
[  616.605054][T14689]  should_fail_ex.cold+0x5/0xa
[  616.605068][T14689]  should_failslab+0xc2/0x120
[  616.605085][T14689]  kmem_cache_alloc_node_noprof+0x94/0x6b0
[  616.605099][T14689]  ? preempt_schedule_thunk+0x16/0x40
[  616.605111][T14689]  ? __alloc_skb+0x140/0x710
[  616.605128][T14689]  __alloc_skb+0x140/0x710
[  616.605140][T14689]  ? __alloc_skb+0x5b7/0x710
[  616.605154][T14689]  ? __pfx___alloc_skb+0x10/0x10
[  616.605171][T14689]  netlink_alloc_large_skb+0x69/0x150
[  616.605186][T14689]  netlink_sendmsg+0x680/0xda0
[  616.605200][T14689]  ? __pfx_netlink_sendmsg+0x10/0x10
[  616.605214][T14689]  ? selinux_socket_sendmsg+0x198/0x2f0
[  616.605233][T14689]  ____sys_sendmsg+0xa4d/0xbe0
[  616.605250][T14689]  ? __pfx_netlink_sendmsg+0x10/0x10
[  616.605264][T14689]  ? __pfx_____sys_sendmsg+0x10/0x10
[  616.605297][T14689]  ___sys_sendmsg+0x190/0x1e0
[  616.605310][T14689]  ? __pfx____sys_sendmsg+0x10/0x10
[  616.605321][T14689]  ? __lock_acquire+0x49f/0x1a40
[  616.605350][T14689]  __sys_sendmsg+0x160/0x210
[  616.605366][T14689]  ? __pfx___sys_sendmsg+0x10/0x10
[  616.605388][T14689]  do_syscall_64+0x115/0x870
[  616.605403][T14689]  ? clear_bhb_loop+0x70/0xc0
[  616.605417][T14689]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  616.605434][T14689] RIP: 0033:0x7f7fa1f9e0d9
[  616.605444][T14689] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  616.605455][T14689] RSP: 002b:00007f7fa2df5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  616.605466][T14689] RAX: ffffffffffffffda RBX: 00007f7fa2225fa0 RCX: 00007f7fa1f9e0d9
[  616.605474][T14689] RDX: 0000000000000000 RSI: 0000200000000000 RDI: 0000000000000003
[  616.605480][T14689] RBP: 00007f7fa2df5090 R08: 0000000000000000 R09: 0000000000000000
[  616.605487][T14689] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  616.605493][T14689] R13: 00007f7fa2226038 R14: 00007f7fa2225fa0 R15: 00007ffcaf193258
[  616.605507][T14689]  </TASK>
[  616.836338][ T5716] usb 1-1: config 129 has no interface number 0
[  616.843132][ T5716] usb 1-1: config 129 has no interface number 1
[  616.849362][ T5716] usb 1-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5
[  616.862597][ T5716] usb 1-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30
[  616.873445][ T5716] usb 1-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37
[  616.886577][ T5716] usb 1-1: config 129 interface 135 has no altsetting 0
[  616.894006][ T5716] usb 1-1: config 129 interface 5 has no altsetting 0
[  616.911963][ T5735] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  616.915187][ T5716] usb 1-1: string descriptor 0 read error: -22
[  616.926914][ T5716] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  616.940211][ T5716] usb 1-1: Quirk or no altset; falling back to MIDI 1.0
[  616.947174][ T5716] usb 1-1: MIDIStreaming interface descriptor not found
[  617.011125][ T5912] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  617.021492][ T5912] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  617.090946][ T3301] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  617.201130][T14694] FAULT_INJECTION: forcing a failure.
[  617.201130][T14694] name failslab, interval 1, probability 0, space 0, times 0
[  617.233347][   T29] usb 1-1: USB disconnect, device number 31
[  617.257171][T14694] CPU: 1 UID: 0 PID: 14694 Comm: syz.2.2198 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  617.257197][T14694] Tainted: [L]=SOFTLOCKUP
[  617.257203][T14694] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  617.257211][T14694] Call Trace:
[  617.257217][T14694]  <TASK>
[  617.257224][T14694]  dump_stack_lvl+0x100/0x190
[  617.257248][T14694]  should_fail_ex.cold+0x5/0xa
[  617.257267][T14694]  should_failslab+0xc2/0x120
[  617.257287][T14694]  __kmalloc_cache_noprof+0x91/0x6c0
[  617.257302][T14694]  ? sctp_has_association+0xdd/0x270
[  617.257323][T14694]  ? sctp_association_new+0xbb/0x2990
[  617.257345][T14694]  sctp_association_new+0xbb/0x2990
[  617.257367][T14694]  sctp_connect_new_asoc+0x1a8/0x770
[  617.257389][T14694]  ? __pfx_sctp_connect_new_asoc+0x10/0x10
[  617.257409][T14694]  ? selinux_sctp_bind_connect+0xe0/0x230
[  617.257448][T14694]  sctp_sendmsg+0x1743/0x22e0
[  617.257473][T14694]  ? __pfx_sctp_sendmsg+0x10/0x10
[  617.257490][T14694]  ? sock_has_perm+0x25a/0x2f0
[  617.257508][T14694]  ? __pfx_sock_has_perm+0x10/0x10
[  617.257533][T14694]  ? __might_fault+0xc5/0x140
[  617.257554][T14694]  ? __pfx_sctp_sendmsg+0x10/0x10
[  617.257572][T14694]  inet_sendmsg+0x11c/0x140
[  617.257595][T14694]  __sys_sendto+0x453/0x4e0
[  617.257613][T14694]  ? __pfx_inet_sendmsg+0x10/0x10
[  617.257634][T14694]  ? __pfx___sys_sendto+0x10/0x10
[  617.257657][T14694]  ? __pfx___mutex_unlock_slowpath+0x10/0x10
[  617.257686][T14694]  ? ksys_write+0x1ac/0x250
[  617.257700][T14694]  ? __pfx_ksys_write+0x10/0x10
[  617.257716][T14694]  __x64_sys_sendto+0xe0/0x1c0
[  617.257732][T14694]  ? do_syscall_64+0x90/0x870
[  617.257750][T14694]  ? lockdep_hardirqs_on+0x78/0x100
[  617.257769][T14694]  do_syscall_64+0x115/0x870
[  617.257788][T14694]  ? clear_bhb_loop+0x70/0xc0
[  617.257806][T14694]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  617.257820][T14694] RIP: 0033:0x7f7fa1f9e0d9
[  617.257834][T14694] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  617.257848][T14694] RSP: 002b:00007f7fa2df5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  617.257864][T14694] RAX: ffffffffffffffda RBX: 00007f7fa2225fa0 RCX: 00007f7fa1f9e0d9
[  617.257873][T14694] RDX: 0000000000000001 RSI: 0000200000000080 RDI: 0000000000000003
[  617.257882][T14694] RBP: 00007f7fa2df5090 R08: 0000200000000100 R09: 000000000000001c
[  617.257892][T14694] R10: 0000000000040810 R11: 0000000000000246 R12: 0000000000000001
[  617.257902][T14694] R13: 00007f7fa2226038 R14: 00007f7fa2225fa0 R15: 00007ffcaf193258
[  617.257924][T14694]  </TASK>
[  617.580019][T14699] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  617.588602][T14699] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  617.685304][T14700] IPVS: sh: FWM 3 0x00000003 - no destination available
[  618.234587][ T5912] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  618.270470][ T5912] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  618.368695][T14709] FAULT_INJECTION: forcing a failure.
[  618.368695][T14709] name failslab, interval 1, probability 0, space 0, times 0
[  618.481914][   T59] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  618.497836][T14722] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2203'.
[  618.512757][   T59] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  618.536204][T14709] CPU: 0 UID: 0 PID: 14709 Comm: syz.2.2204 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  618.536233][T14709] Tainted: [L]=SOFTLOCKUP
[  618.536239][T14709] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  618.536250][T14709] Call Trace:
[  618.536256][T14709]  <TASK>
[  618.536264][T14709]  dump_stack_lvl+0x100/0x190
[  618.536291][T14709]  should_fail_ex.cold+0x5/0xa
[  618.536315][T14709]  should_failslab+0xc2/0x120
[  618.536339][T14709]  __kmalloc_noprof+0xfc/0x820
[  618.536361][T14709]  ? tomoyo_encode2+0xfb/0x3c0
[  618.536383][T14709]  tomoyo_encode2+0xfb/0x3c0
[  618.536404][T14709]  tomoyo_encode+0x29/0x50
[  618.536420][T14709]  tomoyo_realpath_from_path+0x18c/0x690
[  618.536446][T14709]  tomoyo_path_number_perm+0x23c/0x580
[  618.536471][T14709]  ? tomoyo_path_number_perm+0x22e/0x580
[  618.536498][T14709]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  618.536547][T14709]  ? find_held_lock+0x2b/0x80
[  618.536564][T14709]  ? __fget_files+0x215/0x3d0
[  618.536582][T14709]  ? hook_file_ioctl_common+0x140/0x440
[  618.536602][T14709]  ? __fget_files+0x215/0x3d0
[  618.536624][T14709]  ? __fget_files+0x21f/0x3d0
[  618.536647][T14709]  security_file_ioctl+0xd3/0x230
[  618.536675][T14709]  __x64_sys_ioctl+0xb7/0x210
[  618.536705][T14709]  do_syscall_64+0x115/0x870
[  618.536727][T14709]  ? clear_bhb_loop+0x70/0xc0
[  618.536750][T14709]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.536768][T14709] RIP: 0033:0x7f7fa1f9e0d9
[  618.536783][T14709] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  618.536799][T14709] RSP: 002b:00007f7fa2df5028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  618.536817][T14709] RAX: ffffffffffffffda RBX: 00007f7fa2225fa0 RCX: 00007f7fa1f9e0d9
[  618.536828][T14709] RDX: 0000200000000100 RSI: 00000000c0386105 RDI: 0000000000000003
[  618.536839][T14709] RBP: 00007f7fa2df5090 R08: 0000000000000000 R09: 0000000000000000
[  618.536849][T14709] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  618.536859][T14709] R13: 00007f7fa2226038 R14: 00007f7fa2225fa0 R15: 00007ffcaf193258
[  618.536884][T14709]  </TASK>
[  618.536914][T14709] ERROR: Out of memory at tomoyo_realpath_from_path.
[  618.771916][ T1301] ieee802154 phy0 wpan0: encryption failed: -22
[  618.778358][ T1301] ieee802154 phy1 wpan1: encryption failed: -22
[  618.830593][ T5694] usb 7-1: new full-speed USB device number 16 using dummy_hcd
[  618.854356][T14726] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  618.864137][T14726] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  618.966060][T14728] FAULT_INJECTION: forcing a failure.
[  618.966060][T14728] name failslab, interval 1, probability 0, space 0, times 0
[  618.981475][ T5694] usb 7-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  618.992211][T14728] CPU: 1 UID: 0 PID: 14728 Comm: syz.3.2142 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  618.992238][T14728] Tainted: [L]=SOFTLOCKUP
[  618.992244][T14728] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  618.992254][T14728] Call Trace:
[  618.992260][T14728]  <TASK>
[  618.992267][T14728]  dump_stack_lvl+0x100/0x190
[  618.992294][T14728]  should_fail_ex.cold+0x5/0xa
[  618.992317][T14728]  should_failslab+0xc2/0x120
[  618.992341][T14728]  __kmalloc_noprof+0xfc/0x820
[  618.992363][T14728]  ? tomoyo_encode2+0xfb/0x3c0
[  618.992386][T14728]  tomoyo_encode2+0xfb/0x3c0
[  618.992414][T14728]  tomoyo_encode+0x29/0x50
[  618.992430][T14728]  tomoyo_realpath_from_path+0x18c/0x690
[  618.992454][T14728]  tomoyo_path_number_perm+0x23c/0x580
[  618.992479][T14728]  ? tomoyo_path_number_perm+0x22e/0x580
[  618.992505][T14728]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  618.992553][T14728]  ? find_held_lock+0x2b/0x80
[  618.992570][T14728]  ? __fget_files+0x215/0x3d0
[  618.992588][T14728]  ? hook_file_ioctl_common+0x140/0x440
[  618.992608][T14728]  ? __fget_files+0x215/0x3d0
[  618.992631][T14728]  ? __fget_files+0x21f/0x3d0
[  618.992653][T14728]  security_file_ioctl+0xd3/0x230
[  618.992682][T14728]  __x64_sys_ioctl+0xb7/0x210
[  618.992711][T14728]  do_syscall_64+0x115/0x870
[  618.992733][T14728]  ? clear_bhb_loop+0x70/0xc0
[  618.992755][T14728]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  618.992773][T14728] RIP: 0033:0x7fe1ab79e0d9
[  618.992789][T14728] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  618.992806][T14728] RSP: 002b:00007fe1ac6cc028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  618.992823][T14728] RAX: ffffffffffffffda RBX: 00007fe1aba25fa0 RCX: 00007fe1ab79e0d9
[  618.992835][T14728] RDX: 0000000000000000 RSI: 00000000c0347c03 RDI: 0000000000000003
[  618.992846][T14728] RBP: 00007fe1ac6cc090 R08: 0000000000000000 R09: 0000000000000000
[  618.992856][T14728] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  618.992867][T14728] R13: 00007fe1aba26038 R14: 00007fe1aba25fa0 R15: 00007fffdb9e76e8
[  618.992892][T14728]  </TASK>
[  618.992908][T14728] ERROR: Out of memory at tomoyo_realpath_from_path.
[  619.006120][ T5694] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  619.231724][ T5694] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  619.244581][ T5694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  619.264534][ T5694] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  619.278549][ T5694] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  619.295799][ T5694] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  619.304131][ T5694] usb 7-1: Product: syz
[  619.308324][ T5694] usb 7-1: Manufacturer: syz
[  619.313289][ T5694] usb 7-1: SerialNumber: syz
[  619.330945][ T5716] usb 4-1: new high-speed USB device number 73 using dummy_hcd
[  619.371237][ T5694] usb 7-1: config 0 descriptor??
[  619.582643][ T5716] usb 4-1: Using ep0 maxpacket: 32
[  619.855911][ T5716] usb 4-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40
[  619.901741][ T5694] radio-si470x 7-1:0.0: si470x_get_report: usb_control_msg returned -110
[  619.928362][ T5694] radio-si470x 7-1:0.0: probe with driver radio-si470x failed with error -5
[  619.976665][ T5716] usb 4-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  619.989617][ T5716] usb 4-1: config 1 has 2 interfaces, different from the descriptor's value: 3
[  619.999702][ T5716] usb 4-1: too many endpoints for config 1 interface 1 altsetting 239: 255, using maximum allowed: 30
[  620.037819][ T5716] usb 4-1: config 1 interface 1 altsetting 239 has 0 endpoint descriptors, different from the interface descriptor's value: 255
[  620.051972][ T5716] usb 4-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0
[  620.065712][ T5716] usb 4-1: config 1 interface 1 has no altsetting 0
[  620.086227][ T5716] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  620.094535][ T5716] usb 4-1: Product: syz
[  620.098745][ T5716] usb 4-1: Manufacturer: syz
[  620.104934][ T5716] usb 4-1: SerialNumber: syz
[  620.373605][ T5687] usb 7-1: USB disconnect, device number 16
[  620.975935][T14781] netlink: 4 bytes leftover after parsing attributes in process `syz.6.2221'.
[  622.619852][T14792] block nbd2: not configured, cannot reconfigure
[  622.640193][T14794] netlink: 'syz.8.2223': attribute type 2 has an invalid length.
[  622.678422][T14794] netlink: 'syz.8.2223': attribute type 1 has an invalid length.
[  622.891706][   T30] audit: type=1400 audit(1786408139.732:1182): avc:  denied  { setopt } for  pid=14806 comm="syz.0.2230" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_generic_socket permissive=1
[  622.911462][T14811] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2233'.
[  622.971262][T14808] mac80211_hwsim hwsim23 wlan0: entered promiscuous mode
[  623.216760][T14825] netlink: 'syz.0.2239': attribute type 1 has an invalid length.
[  623.300630][T14825] 8021q: adding VLAN 0 to HW filter on device bond1
[  623.323177][T14829] netlink: zone id is out of range
[  623.334831][T14829] netlink: del zone limit has 8 unknown bytes
[  623.356858][T14827] bond1: (slave geneve2): making interface the new active one
[  623.381440][T14827] bond1: (slave geneve2): Enslaving as an active interface with an up link
[  623.501099][   T30] audit: type=1400 audit(1786408140.342:1183): avc:  denied  { read } for  pid=14830 comm="syz.2.2241" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_rdma_socket permissive=1
[  623.930124][T14859] netlink: 52 bytes leftover after parsing attributes in process `syz.8.2250'.
[  623.941396][T14859] netlink: 6 bytes leftover after parsing attributes in process `syz.8.2250'.
[  623.950319][T14859] netlink: 52 bytes leftover after parsing attributes in process `syz.8.2250'.
[  623.968002][T14859] netlink: 6 bytes leftover after parsing attributes in process `syz.8.2250'.
[  623.977192][T14859] netlink: 52 bytes leftover after parsing attributes in process `syz.8.2250'.
[  624.442310][T14838] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  624.897995][   T59] nci: nci_rf_intf_activated_ntf_packet: unsupported activation_rf_tech_and_mode 0xff
[  625.187824][ T5716] usb 4-1: selecting invalid altsetting 0
[  625.194509][ T5716] usb 4-1: 1:1: cannot get freq (v2/v3): err -32
[  625.202484][ T5716] usb 4-1: 1:1: cannot set freq 44100 (v2/v3): err -32
[  625.218050][T14899] syz_tun: entered allmulticast mode
[  625.600662][T14885] nci: __nci_request: wait_for_completion_interruptible_timeout failed -512
[  625.805719][   T30] audit: type=1400 audit(1786408142.652:1184): avc:  denied  { ioctl } for  pid=14914 comm="syz.0.2269" path="socket:[52777]" dev="sockfs" ino=52777 ioctlcmd=0x8933 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=icmp_socket permissive=1
[  625.832190][T14915] syzkaller0: entered promiscuous mode
[  625.846085][T14915] syzkaller0: entered allmulticast mode
[  625.961550][T14923] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  625.980253][T14923] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  626.076808][T14927] netlink: 32 bytes leftover after parsing attributes in process `syz.8.2275'.
[  626.086962][T14927] tipc: Invalid UDP bearer configuration
[  626.087002][T14927] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  626.692396][ T5687] usb 7-1: new high-speed USB device number 17 using dummy_hcd
[  626.715560][T14932] netlink: 'syz.0.2276': attribute type 10 has an invalid length.
[  626.753430][T14932] team0: Port device dummy0 added
[  626.870626][ T5687] usb 7-1: Using ep0 maxpacket: 32
[  626.877218][ T5687] usb 7-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b
[  626.893737][ T5687] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  626.902342][ T5687] usb 7-1: Product: syz
[  626.906573][ T5687] usb 7-1: Manufacturer: syz
[  626.994862][ T5687] usb 7-1: SerialNumber: syz
[  627.034026][ T5687] usb 7-1: config 0 descriptor??
[  627.380811][T14639] usb 1-1: new full-speed USB device number 32 using dummy_hcd
[  627.488317][ T5687] peak_usb 7-1:0.0 can0: unable to request usb[type=0 value=0] err=-71
[  627.541192][T14639] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  627.752947][ T5687] peak_usb 7-1:0.0: unable to read PCAN-USB Pro bootloader info (err -71)
[  627.801325][T14639] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  627.818888][T14639] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  627.832145][T14639] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  627.844027][ T5687] peak_usb 7-1:0.0: probe with driver peak_usb failed with error -71
[  627.860035][T14639] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  627.870753][ T5687] usb 7-1: USB disconnect, device number 17
[  627.879963][T14639] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  627.896762][T14639] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  627.908459][T14639] usb 1-1: Product: syz
[  627.915407][T14639] usb 1-1: Manufacturer: syz
[  627.920085][T14639] usb 1-1: SerialNumber: syz
[  627.934603][T14639] usb 1-1: config 0 descriptor??
[  628.101701][T14960] netlink: 40 bytes leftover after parsing attributes in process `syz.2.2287'.
[  628.208626][T14962] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  628.252891][T14962] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  628.462152][T14639] radio-si470x 1-1:0.0: si470x_get_report: usb_control_msg returned -110
[  628.489343][T14639] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -5
[  628.545297][T14971] IPVS: sh: FWM 3 0x00000003 - no destination available
[  629.363451][T14973] binder: 14972:14973 ioctl 40047459 200000000140 returned -22
[  629.421741][   T10] usb 1-1: USB disconnect, device number 32
[  629.435439][T14973] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  629.509083][T14973] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  629.541949][T14973] overlayfs: failed to look up (tracing) for ino (-66)
[  629.762273][ T5687] IPVS: starting estimator thread 0...
[  629.873950][T14987] IPVS: using max 40 ests per chain, 96000 per kthread
[  630.355193][T14989] netlink: 52 bytes leftover after parsing attributes in process `syz.0.2299'.
[  630.710250][T14998] bridge0: port 2(bridge_slave_1) entered disabled state
[  630.717785][T14998] bridge0: port 1(bridge_slave_0) entered disabled state
[  630.784569][T14998] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  630.805181][T14998] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  630.847707][T14998] mac80211_hwsim hwsim23 wlan0: left promiscuous mode
[  630.867322][T14639] usb 7-1: new high-speed USB device number 18 using dummy_hcd
[  630.900626][ T3301] netdevsim netdevsim0 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  630.920146][ T3301] netdevsim netdevsim0 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  630.932777][  T160] netdevsim netdevsim0 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  630.951170][ T3301] netdevsim netdevsim0 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  631.013111][T14639] usb 7-1: device descriptor read/64, error -71
[  631.816178][T14639] usb 7-1: new high-speed USB device number 19 using dummy_hcd
[  631.988084][T14639] usb 7-1: device descriptor read/64, error -71
[  632.181788][T15035] netlink: 'syz.8.2316': attribute type 10 has an invalid length.
[  632.219794][T14639] usb usb7-port1: attempt power cycle
[  632.803037][T15037] netlink: 620 bytes leftover after parsing attributes in process `syz.0.2317'.
[  633.300578][ T5687] usb 1-1: new full-speed USB device number 33 using dummy_hcd
[  633.464082][ T5687] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a
[  633.478759][ T5694] usb 9-1: new high-speed USB device number 7 using dummy_hcd
[  633.503315][T15053] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2324'.
[  633.515146][ T5687] usb 1-1: config 0 has an invalid interface number: 41 but max is 0
[  633.531353][ T5687] usb 1-1: config 0 has no interface number 0
[  633.548333][ T5687] usb 1-1: config 0 interface 41 has no altsetting 0
[  633.569117][ T5687] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  633.588808][ T5687] usb 1-1: Product: syz
[  633.608771][ T5687] usb 1-1: Manufacturer: syz
[  633.629476][ T5687] usb 1-1: SerialNumber: syz
[  633.654370][ T5687] usb 1-1: config 0 descriptor??
[  633.672705][ T5694] usb 9-1: New USB device found, idVendor=174c, idProduct=55aa, bcdDevice= 1.00
[  633.713129][ T5694] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  633.739816][ T5694] usb 9-1: Product: syz
[  633.761372][ T5694] usb 9-1: Manufacturer: syz
[  633.784014][ T5694] usb 9-1: SerialNumber: syz
[  633.828840][ T5694] usb 9-1: UAS is ignored for this device, using usb-storage instead
[  633.864039][ T5694] usb 9-1: UAS is ignored for this device, using usb-storage instead
[  633.881748][ T5694] usb-storage 9-1:1.0: USB Mass Storage device detected
[  633.918662][ T5694] usb-storage 9-1:1.0: Quirks match for vid 174c pid 55aa: 400000
[  633.951306][ T5694] scsi host1: usb-storage 9-1:1.0
[  634.245446][T15048] IPVS: Error connecting to the multicast addr
[  634.332989][ T5687] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -32
[  634.380246][ T5687] usb 1-1: USB disconnect, device number 33
[  634.641783][T15071] netlink: 620 bytes leftover after parsing attributes in process `syz.6.2328'.
[  634.769758][ T4912] Bluetooth: hci10: unexpected cc 0x0c03 length: 249 > 1
[  634.784948][ T4912] Bluetooth: hci10: unexpected cc 0x1003 length: 249 > 9
[  634.794475][ T4912] Bluetooth: hci10: unexpected cc 0x1001 length: 249 > 9
[  634.802410][ T4912] Bluetooth: hci10: unexpected cc 0x0c23 length: 249 > 4
[  634.812100][ T4912] Bluetooth: hci10: unexpected cc 0x0c38 length: 249 > 2
[  634.816842][T15081] misc userio: No port type given on /dev/userio
[  634.934406][T15086] IPVS: sh: FWM 3 0x00000003 - no destination available
[  635.046792][T15088] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15088 comm=syz.0.2332
[  635.913473][   T29] usb 9-1: USB disconnect, device number 7
[  635.942189][   T30] audit: type=1400 audit(1786408152.782:1185): avc:  denied  { read write } for  pid=15098 comm="syz.2.2335" name="btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[  636.110227][   T30] audit: type=1400 audit(1786408152.782:1186): avc:  denied  { open } for  pid=15098 comm="syz.2.2335" path="/dev/btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[  636.520634][  T981] usb 7-1: new full-speed USB device number 21 using dummy_hcd
[  636.681455][  T981] usb 7-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a
[  636.709053][T15117] netlink: 620 bytes leftover after parsing attributes in process `syz.8.2340'.
[  636.719744][  T981] usb 7-1: config 0 has an invalid interface number: 41 but max is 0
[  636.730989][  T981] usb 7-1: config 0 has no interface number 0
[  636.764232][  T981] usb 7-1: config 0 interface 41 has no altsetting 0
[  636.793846][  T981] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  636.815077][  T981] usb 7-1: Product: syz
[  636.829085][  T981] usb 7-1: Manufacturer: syz
[  636.840825][  T981] usb 7-1: SerialNumber: syz
[  636.863497][  T981] usb 7-1: config 0 descriptor??
[  636.877471][T15121] misc userio: No port type given on /dev/userio
[  636.920801][T13325] Bluetooth: hci10: command tx timeout
[  637.147507][T15131] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=0 sclass=netlink_route_socket pid=15131 comm=syz.0.2345
[  637.227669][T15133] syzkaller0: entered promiscuous mode
[  637.247618][T15133] syzkaller0: entered allmulticast mode
[  637.338574][T15133] tipc: Started in network mode
[  637.359619][T15133] tipc: Node identity 7e8191455de, cluster identity 4711
[  637.402912][T15133] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  637.413469][T15132] tipc: Resetting bearer <eth:syzkaller0>
[  637.441420][T15132] tipc: Disabling bearer <eth:syzkaller0>
[  637.515156][  T981] CoreChips 7-1:0.41: probe with driver CoreChips failed with error -32
[  637.686736][T15074] bridge0: port 1(bridge_slave_0) entered blocking state
[  637.699442][T15074] bridge0: port 1(bridge_slave_0) entered disabled state
[  637.708474][T15074] bridge_slave_0: entered allmulticast mode
[  637.726168][T15074] bridge_slave_0: entered promiscuous mode
[  637.746043][T15074] bridge0: port 2(bridge_slave_1) entered blocking state
[  637.754639][T15074] bridge0: port 2(bridge_slave_1) entered disabled state
[  637.763152][T15074] bridge_slave_1: entered allmulticast mode
[  637.782640][T15074] bridge_slave_1: entered promiscuous mode
[  637.904501][T15074] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[  637.956715][T15074] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[  638.034714][T15074] team0: Port device team_slave_0 added
[  638.043702][T15074] team0: Port device team_slave_1 added
[  638.063056][T15074] batman_adv: batadv0: Adding interface: batadv_slave_0
[  638.069981][T15074] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  638.097741][T15074] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[  638.109610][T15074] batman_adv: batadv0: Adding interface: batadv_slave_1
[  638.116729][T15074] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  638.143926][T15074] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[  638.240606][T14639] usb 9-1: new high-speed USB device number 8 using dummy_hcd
[  638.241259][T15074] hsr_slave_0: entered promiscuous mode
[  638.243480][T15074] hsr_slave_1: entered promiscuous mode
[  638.288377][T15074] debugfs: 'hsr0' already exists in 'hsr'
[  638.295426][T15074] Cannot create hsr debugfs directory
[  638.331922][T15157] misc userio: No port type given on /dev/userio
[  638.401158][T14639] usb 9-1: Using ep0 maxpacket: 16
[  638.416648][T14639] usb 9-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  638.436047][T14639] usb 9-1: config 0 has an invalid descriptor of length 41, skipping remainder of the config
[  638.501869][T14639] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  638.554981][T14639] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  638.600163][T14639] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  638.622680][T14639] usb 9-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  638.637401][T14639] usb 9-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  638.648528][T14639] usb 9-1: Manufacturer: syz
[  638.663419][T14639] usb 9-1: config 0 descriptor??
[  639.000610][T13325] Bluetooth: hci10: command tx timeout
[  639.050593][T14639] rc_core: IR keymap rc-hauppauge not found
[  639.062466][T14639] Registered IR keymap rc-empty
[  639.068010][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.092638][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.147029][T14639] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0
[  639.176257][T14639] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.8/usb9/9-1/9-1:0.0/rc/rc0/input63
[  639.197569][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.235046][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.275114][   T10] usb 7-1: USB disconnect, device number 21
[  639.281312][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.327346][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.370898][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.402013][T15178] binder: 15176:15178 ioctl 40047459 200000000140 returned -22
[  639.402027][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.421462][T15179] netlink: 32 bytes leftover after parsing attributes in process `syz.6.2361'.
[  639.424570][T15178] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  639.430621][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.446856][T15179] tipc: Invalid UDP bearer configuration
[  639.446915][T15179] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  639.581334][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.600643][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.746801][T14639] mceusb 9-1:0.0: Error: mce write submit urb error = -90
[  639.773238][T14639] mceusb 9-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  639.783040][T14639] mceusb 9-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  639.803756][T14639] usb 9-1: USB disconnect, device number 8
[  640.767797][T15074] netdevsim netdevsim5 netdevsim0: renamed from eth0
[  640.795217][T15074] 8021q: adding VLAN 0 to HW filter on device netdevsim0
[  640.816353][T15074] netdevsim netdevsim5 netdevsim1: renamed from eth1
[  640.848330][T15074] 8021q: adding VLAN 0 to HW filter on device netdevsim1
[  640.865252][T15074] netdevsim netdevsim5 netdevsim2: renamed from eth2
[  640.877974][T15074] 8021q: adding VLAN 0 to HW filter on device netdevsim2
[  640.888648][T15195] syz_tun: entered allmulticast mode
[  640.899528][T15074] netdevsim netdevsim5 netdevsim3: renamed from eth3
[  640.941706][T15074] 8021q: adding VLAN 0 to HW filter on device netdevsim3
[  641.007542][T15200] syzkaller0: entered promiscuous mode
[  641.036773][T15200] syzkaller0: entered allmulticast mode
[  641.085759][T13325] Bluetooth: hci10: command tx timeout
[  641.102905][T15200] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  641.136934][T15199] tipc: Resetting bearer <eth:syzkaller0>
[  641.169020][T15199] tipc: Disabling bearer <eth:syzkaller0>
[  641.257606][T15074] 8021q: adding VLAN 0 to HW filter on device bond0
[  641.311001][ T5694] usb 1-1: new full-speed USB device number 34 using dummy_hcd
[  641.329845][T15074] 8021q: adding VLAN 0 to HW filter on device team0
[  641.390562][ T5905] bridge0: port 1(bridge_slave_0) entered blocking state
[  641.397684][ T5905] bridge0: port 1(bridge_slave_0) entered forwarding state
[  641.460797][ T5905] bridge0: port 2(bridge_slave_1) entered blocking state
[  641.467891][ T5905] bridge0: port 2(bridge_slave_1) entered forwarding state
[  641.523147][ T5694] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a
[  641.584540][ T5694] usb 1-1: config 0 has an invalid interface number: 41 but max is 0
[  641.633951][ T5694] usb 1-1: config 0 has no interface number 0
[  641.676690][ T5694] usb 1-1: config 0 interface 41 has no altsetting 0
[  641.717825][T15218] netlink: 'syz.2.2364': attribute type 1 has an invalid length.
[  641.738426][ T5694] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  641.759018][T15218] netlink: 224 bytes leftover after parsing attributes in process `syz.2.2364'.
[  641.770763][ T5694] usb 1-1: Product: syz
[  641.781312][ T5694] usb 1-1: Manufacturer: syz
[  641.799063][ T5694] usb 1-1: SerialNumber: syz
[  641.874841][ T5694] usb 1-1: config 0 descriptor??
[  642.109724][T15227] netlink: 32 bytes leftover after parsing attributes in process `syz.2.2375'.
[  642.119146][T15227] tipc: Invalid UDP bearer configuration
[  642.119183][T15227] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  642.871057][   T10] usb 9-1: new high-speed USB device number 9 using dummy_hcd
[  642.878867][ T5694] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -32
[  642.921442][T15236] IPVS: sh: FWM 3 0x00000003 - no destination available
[  643.070237][   T10] usb 9-1: Using ep0 maxpacket: 32
[  643.110359][   T10] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79
[  643.180178][T13325] Bluetooth: hci10: command tx timeout
[  643.218385][   T10] usb 9-1: config 0 interface 0 altsetting 0 bulk endpoint 0x85 has invalid maxpacket 1024
[  643.305997][   T10] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2
[  643.346872][   T10] usb 9-1: Product: syz
[  643.375717][   T10] usb 9-1: Manufacturer: syz
[  643.394619][   T10] usb 9-1: SerialNumber: syz
[  643.489236][   T10] usb 9-1: config 0 descriptor??
[  643.527159][T15230] raw-gadget.3 gadget.8: fail, usb_ep_enable returned -22
[  643.559081][   T10] hub 9-1:0.0: bad descriptor, ignoring hub
[  643.588663][   T10] hub 9-1:0.0: probe with driver hub failed with error -5
[  644.015058][   T30] audit: type=1400 audit(1786408160.862:1187): avc:  denied  { getopt } for  pid=15249 comm="syz.6.2381" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=vsock_socket permissive=1
[  644.055706][T15074] 8021q: adding VLAN 0 to HW filter on device batadv0
[  644.087973][   T10] usb 1-1: USB disconnect, device number 34
[  644.431355][T14639] usb 7-1: new full-speed USB device number 22 using dummy_hcd
[  644.611491][T14639] usb 7-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f
[  644.643597][T14639] usb 7-1: config 0 has an invalid interface number: 8 but max is 0
[  644.670176][T14639] usb 7-1: config 0 has no interface number 0
[  644.681836][   T10] usb 9-1: USB disconnect, device number 9
[  644.701150][T14639] usb 7-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x57, changing to 0x7
[  644.815400][T14639] usb 7-1: config 0 interface 8 altsetting 0 endpoint 0x7 has an invalid bInterval 0, changing to 10
[  644.839473][T15074] veth0_vlan: entered promiscuous mode
[  644.857220][T14639] usb 7-1: config 0 interface 8 altsetting 0 endpoint 0x7 has invalid wMaxPacketSize 0
[  644.876614][T15074] veth1_vlan: entered promiscuous mode
[  644.893475][T14639] usb 7-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3
[  644.917149][T14639] usb 7-1: Product: syz
[  644.934486][T14639] usb 7-1: SerialNumber: syz
[  644.962236][T14639] usb 7-1: config 0 descriptor??
[  644.984885][T14639] usbhid 7-1:0.8: couldn't find an input interrupt endpoint
[  645.135620][T15074] veth0_macvtap: entered promiscuous mode
[  645.157955][T15074] veth1_macvtap: entered promiscuous mode
[  645.202949][T15074] batman_adv: batadv0: Interface activated: batadv_slave_0
[  645.333130][T15074] batman_adv: batadv0: Interface activated: batadv_slave_1
[  645.488223][T15278] binder: 15277:15278 ioctl 40047459 200000000140 returned -22
[  645.524934][T15278] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  645.543310][  T160] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[  645.607472][  T160] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[  646.452388][T15268] batman_adv: batadv0: Adding interface: veth0
[  646.458631][T15268] batman_adv: batadv0: The MTU of interface veth0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem.
[  646.484483][T15268] batman_adv: batadv0: Interface activated: veth0
[  646.503611][T14719] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[  646.714577][T15283] binder: 15282:15283 ioctl 40047459 200000000140 returned -22
[  646.731941][T15283] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  646.735022][   T48] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  646.741145][   T59] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[  646.751693][   T48] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  646.786510][T15283] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  646.807662][T14719] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[  646.808002][T15283] overlayfs: failed to look up (tracing) for ino (-66)
[  646.822872][T14719] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[  646.959389][T15285] bond1 (unregistering): Released all slaves
[  646.977499][T15289] netlink: 60 bytes leftover after parsing attributes in process `syz.8.2390'.
[  647.102807][T15291] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  647.119035][T15291] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  647.284626][T15303] syzkaller0: entered promiscuous mode
[  647.291983][T15303] syzkaller0: entered allmulticast mode
[  647.340647][ T5716] usb 9-1: new high-speed USB device number 10 using dummy_hcd
[  647.359764][T15307] binder: 15306:15307 ioctl 40047459 200000000140 returned -22
[  647.372142][T15307] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  647.393938][T15307] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  647.405216][T15307] overlayfs: failed to look up (tracing) for ino (-66)
[  647.504575][ T5716] usb 9-1: unable to get BOS descriptor or descriptor too short
[  647.516482][ T5716] usb 9-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00
[  647.527757][ T5716] usb 9-1: config 129 has an invalid interface number: 135 but max is 0
[  647.536536][ T5716] usb 9-1: config 129 has an invalid interface number: 5 but max is 0
[  647.545142][ T5716] usb 9-1: config 129 has 2 interfaces, different from the descriptor's value: 1
[  647.554934][ T5716] usb 9-1: config 129 has no interface number 0
[  647.562029][ T5716] usb 9-1: config 129 has no interface number 1
[  647.585069][ T5716] usb 9-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5
[  647.619236][ T5716] usb 9-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30
[  647.636064][ T5716] usb 9-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37
[  647.669340][ T5716] usb 9-1: config 129 interface 135 has no altsetting 0
[  647.684167][ T5716] usb 9-1: config 129 interface 5 has no altsetting 0
[  647.700788][ T5716] usb 9-1: string descriptor 0 read error: -22
[  647.713441][ T5716] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  647.763829][ T5716] usb 9-1: Quirk or no altset; falling back to MIDI 1.0
[  647.788554][ T5716] usb 9-1: MIDIStreaming interface descriptor not found
[  647.883083][T14639] usb 7-1: USB disconnect, device number 22
[  647.989642][T15285] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  648.057509][T15285] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  648.176949][ T5716] usb 9-1: USB disconnect, device number 10
[  648.188217][T15321] syz_tun: entered allmulticast mode
[  648.904645][   T30] audit: type=1400 audit(1786408165.752:1188): avc:  denied  { listen } for  pid=15340 comm="syz.8.2407" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1
[  649.188634][T15356] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2411'.
[  649.220307][T15358] netlink: 32 bytes leftover after parsing attributes in process `syz.0.2414'.
[  649.245303][T15358] tipc: Invalid UDP bearer configuration
[  649.245349][T15358] tipc: Enabling of bearer <udp:syz0> rejected, failed to enable media
[  649.471971][T15362] netlink: 'syz.5.2416': attribute type 1 has an invalid length.
[  649.484980][T15362] netlink: 224 bytes leftover after parsing attributes in process `syz.5.2416'.
[  650.222256][T15376] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2417'.
[  650.482220][T15383] binder: 15382:15383 ioctl 40047459 200000000140 returned -22
[  650.529860][T15383] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  650.655618][T15383] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  650.732027][T15383] overlayfs: failed to look up (tracing) for ino (-66)
[  650.780920][T15390] syzkaller0: entered promiscuous mode
[  650.849707][T15390] syzkaller0: entered allmulticast mode
[  651.539550][T15404] syzkaller0: entered promiscuous mode
[  651.552955][T15404] syzkaller0: entered allmulticast mode
[  651.577312][T15404] tipc: Started in network mode
[  651.591176][T15404] tipc: Node identity a292710449ad, cluster identity 4711
[  651.610435][T15404] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  651.633067][T15403] tipc: Resetting bearer <eth:syzkaller0>
[  651.709745][T15403] tipc: Disabling bearer <eth:syzkaller0>
[  652.103430][T15418] syzkaller0: entered promiscuous mode
[  652.115167][T15418] syzkaller0: entered allmulticast mode
[  652.139091][T15418] tipc: Started in network mode
[  652.154097][T15418] tipc: Node identity 7eebe6d1ed87, cluster identity 4711
[  652.168944][T15418] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  652.180121][T15417] tipc: Resetting bearer <eth:syzkaller0>
[  652.231601][T15417] tipc: Disabling bearer <eth:syzkaller0>
[  652.340583][T14639] usb 1-1: new full-speed USB device number 35 using dummy_hcd
[  652.430676][ T5687] usb 7-1: new high-speed USB device number 23 using dummy_hcd
[  652.501919][T14639] usb 1-1: New USB device found, idVendor=10c5, idProduct=819a, bcdDevice=e4.46
[  652.522528][T14639] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  652.541273][T14639] usb 1-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xBE, changing to 0x8E
[  652.570587][T14639] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has an invalid bInterval 0, changing to 10
[  652.590651][T14639] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x8E has invalid wMaxPacketSize 0
[  652.650573][ T5687] usb 7-1: Using ep0 maxpacket: 16
[  652.655780][T14639] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3
[  652.670650][ T5687] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  652.799896][T15430] Can't find a SQUASHFS superblock on nullb0
[  653.114909][T14639] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=35
[  653.123386][ T5687] usb 7-1: config 0 has an invalid descriptor of length 42, skipping remainder of the config
[  653.135881][T14639] usb 1-1: Product: syz
[  653.141071][ T5687] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  653.152419][T14639] usb 1-1: Manufacturer: syz
[  653.162357][T14639] usb 1-1: SerialNumber: syz
[  653.167550][ T5687] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  653.179640][T14639] usb 1-1: config 0 descriptor??
[  653.192560][ T5687] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  653.220442][ T5687] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  653.247943][ T5687] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  653.261367][ T5687] usb 7-1: Manufacturer: syz
[  653.269456][ T5687] usb 7-1: config 0 descriptor??
[  653.630596][ T5687] rc_core: IR keymap rc-hauppauge not found
[  653.674840][ T5687] Registered IR keymap rc-empty
[  653.701398][T14639] radio-si470x 1-1:0.0: si470x_get_report: usb_control_msg returned -110
[  653.719893][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  653.759990][T14639] radio-si470x 1-1:0.0: probe with driver radio-si470x failed with error -5
[  653.790830][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  653.841535][ T5687] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0
[  653.928953][ T5687] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input64
[  653.960419][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  653.981221][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.031141][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.091390][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.130677][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.154758][   T29] usb 1-1: USB disconnect, device number 35
[  654.163536][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.220934][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.251034][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.283365][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.310629][ T5687] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  654.365716][ T5687] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  654.401656][ T5687] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  654.491011][ T5687] usb 7-1: USB disconnect, device number 23
[  654.790375][T15451] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2443'.
[  654.870272][T15458] netlink: 'syz.0.2445': attribute type 1 has an invalid length.
[  654.894612][T15458] netlink: 224 bytes leftover after parsing attributes in process `syz.0.2445'.
[  656.739126][T15505] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  656.782680][T15505] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  656.985973][T15513] binder: 15512:15513 ioctl 40047459 200000000140 returned -22
[  657.023552][T15513] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  657.056364][T15511] bridge0: port 2(bridge_slave_1) entered disabled state
[  657.063715][T15511] bridge0: port 1(bridge_slave_0) entered disabled state
[  657.384337][T15511] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  657.407273][T15511] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  657.592615][T15523] netlink: 8 bytes leftover after parsing attributes in process `syz.8.2469'.
[  657.612569][ T5778] usb 7-1: new high-speed USB device number 24 using dummy_hcd
[  657.634004][ T3301] netdevsim netdevsim5 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  657.667346][ T3301] netdevsim netdevsim5 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  657.716385][ T3301] netdevsim netdevsim5 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  657.776628][T15529] netlink: 12 bytes leftover after parsing attributes in process `syz.5.2470'.
[  657.791233][ T5778] usb 7-1: device descriptor read/64, error -71
[  657.799481][ T3301] netdevsim netdevsim5 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  658.070624][ T5778] usb 7-1: new high-speed USB device number 25 using dummy_hcd
[  658.243113][ T5778] usb 7-1: device descriptor read/64, error -71
[  658.330947][T15538] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2473'.
[  658.370735][ T5778] usb usb7-port1: attempt power cycle
[  658.604770][T15547] syzkaller0: entered promiscuous mode
[  658.616567][T15547] syzkaller0: entered allmulticast mode
[  658.731425][ T5778] usb 7-1: new high-speed USB device number 26 using dummy_hcd
[  658.780795][ T5778] usb 7-1: device descriptor read/8, error -71
[  658.882807][T15559] binder: 15558:15559 ioctl 40047459 200000000140 returned -22
[  658.896551][T15559] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  658.930267][T15559] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  658.941156][T15559] overlayfs: failed to look up (tracing) for ino (-66)
[  659.040693][ T5778] usb 7-1: new high-speed USB device number 27 using dummy_hcd
[  659.071552][ T5778] usb 7-1: device descriptor read/8, error -71
[  659.097158][   T30] audit: type=1400 audit(1786408175.942:1189): avc:  denied  { setopt } for  pid=15564 comm="syz.5.2481" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=phonet_socket permissive=1
[  659.200791][ T5778] usb usb7-port1: unable to enumerate USB device
[  659.843247][T15589] syzkaller0: entered promiscuous mode
[  659.855052][T15589] syzkaller0: entered allmulticast mode
[  659.874782][T15589] tipc: Started in network mode
[  659.885397][T15589] tipc: Node identity de5672032cf4, cluster identity 4711
[  659.900673][T15589] tipc: Enabled bearer <eth:syzkaller0>, priority 0
[  659.922604][T15588] tipc: Resetting bearer <eth:syzkaller0>
[  659.971629][T15588] tipc: Disabling bearer <eth:syzkaller0>
[  660.393413][T15601] netlink: 'syz.5.2492': attribute type 10 has an invalid length.
[  660.419063][T15601] team0: Port device dummy0 added
[  663.132418][T15620] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2501'.
[  663.141454][T15620] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2501'.
[  663.168991][T15620] bridge1: entered promiscuous mode
[  663.186680][T15620] bridge1: entered allmulticast mode
[  663.258383][T15624] syzkaller0: entered promiscuous mode
[  663.280549][T15624] syzkaller0: entered allmulticast mode
[  663.347708][T15629] netlink: 'syz.5.2502': attribute type 1 has an invalid length.
[  663.468039][T15632] netlink: 8 bytes leftover after parsing attributes in process `syz.5.2503'.
[  663.656052][T15634] bridge0: port 2(bridge_slave_1) entered disabled state
[  663.665683][T15634] bridge0: port 1(bridge_slave_0) entered disabled state
[  663.735144][T15634] batman_adv: batadv0: Interface deactivated: batadv_slave_0
[  663.759310][T15634] batman_adv: batadv0: Interface deactivated: batadv_slave_1
[  663.846720][T15640] IPVS: sh: FWM 3 0x00000003 - no destination available
[  664.599360][   T30] audit: type=1400 audit(1786408181.442:1190): avc:  denied  { unmount } for  pid=13589 comm="syz-executor" scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:unlabeled_t tclass=filesystem permissive=1
[  664.664308][T15647] FAULT_INJECTION: forcing a failure.
[  664.664308][T15647] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  664.677548][T15647] CPU: 0 UID: 0 PID: 15647 Comm: syz.5.2509 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  664.677574][T15647] Tainted: [L]=SOFTLOCKUP
[  664.677581][T15647] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  664.677591][T15647] Call Trace:
[  664.677597][T15647]  <TASK>
[  664.677605][T15647]  dump_stack_lvl+0x100/0x190
[  664.677632][T15647]  should_fail_ex.cold+0x5/0xa
[  664.677655][T15647]  _copy_to_iter+0x1f3/0x1720
[  664.677680][T15647]  ? traverse.part.0.constprop.0+0x2c0/0x650
[  664.677700][T15647]  ? traverse.part.0.constprop.0+0x2c0/0x650
[  664.677720][T15647]  ? __pfx__copy_to_iter+0x10/0x10
[  664.677746][T15647]  ? traverse.part.0.constprop.0+0x2c5/0x650
[  664.677773][T15647]  seq_read_iter+0x691/0x1270
[  664.677799][T15647]  ? __pfx_seq_read_iter+0x10/0x10
[  664.677818][T15647]  vfs_read+0x82e/0xb40
[  664.677849][T15647]  ? __pfx_vfs_read+0x10/0x10
[  664.677875][T15647]  ? find_held_lock+0x2b/0x80
[  664.677909][T15647]  __x64_sys_pread64+0x1eb/0x250
[  664.677928][T15647]  ? __pfx___x64_sys_pread64+0x10/0x10
[  664.677953][T15647]  do_syscall_64+0x115/0x870
[  664.677978][T15647]  ? clear_bhb_loop+0x70/0xc0
[  664.678000][T15647]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  664.678018][T15647] RIP: 0033:0x7f3c82f9e0d9
[  664.678033][T15647] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  664.678050][T15647] RSP: 002b:00007f3c811f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000011
[  664.678068][T15647] RAX: ffffffffffffffda RBX: 00007f3c83225fa0 RCX: 00007f3c82f9e0d9
[  664.678080][T15647] RDX: 000000000000fdef RSI: 0000200000002240 RDI: 0000000000000003
[  664.678091][T15647] RBP: 00007f3c811f6090 R08: 0000000000000000 R09: 0000000000000000
[  664.678102][T15647] R10: 00000000000004eb R11: 0000000000000246 R12: 0000000000000001
[  664.678123][T15647] R13: 00007f3c83226038 R14: 00007f3c83225fa0 R15: 00007ffcbd3398a8
[  664.678148][T15647]  </TASK>
[  664.681906][ T5907] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0
[  664.939357][ T5907] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0
[  664.948303][ T5907] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0
[  664.957396][ T5907] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0
[  664.968268][T15655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2512'.
[  665.060802][T15655] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2512'.
[  665.088463][T15655] bridge1: entered promiscuous mode
[  665.117747][T15655] bridge1: entered allmulticast mode
[  665.137940][T15662] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2513'.
[  665.809339][T15672] netlink: 'syz.8.2514': attribute type 10 has an invalid length.
[  666.030959][T15666] input: Bluetooth HID Boot Protocol Device as /devices/virtual/bluetooth/hci10/hci10:200/input65
[  666.898630][   T30] audit: type=1400 audit(1786408183.742:1191): avc:  denied  { append } for  pid=15686 comm="syz.5.2522" name="btrfs-control" dev="devtmpfs" ino=1313 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:lvm_control_t tclass=chr_file permissive=1
[  666.913880][T15685] vlan2: entered allmulticast mode
[  666.927811][T13325] Bluetooth: hci1: command 0x0406 tx timeout
[  666.965405][T15685] bond0: entered allmulticast mode
[  666.988027][T15685] bond_slave_0: entered allmulticast mode
[  666.994002][T15685] bond_slave_1: entered allmulticast mode
[  667.011602][T15691] netlink: 28 bytes leftover after parsing attributes in process `syz.8.2523'.
[  667.075470][   T30] audit: type=1400 audit(1786408183.922:1192): avc:  denied  { mounton } for  pid=15693 comm="syz.6.2525" path="/proc/654/cgroup" dev="proc" ino=55213 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=file permissive=1
[  667.103264][T15700] netlink: 60 bytes leftover after parsing attributes in process `syz.8.2523'.
[  667.113195][T15691] bond1 (unregistering): Released all slaves
[  667.116431][   T30] audit: type=1400 audit(1786408183.952:1193): avc:  denied  { mount } for  pid=15693 comm="syz.6.2525" name="/" dev="autofs" ino=55214 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:autofs_t tclass=filesystem permissive=1
[  667.580911][T14639] usb 9-1: new high-speed USB device number 11 using dummy_hcd
[  667.933543][T14639] usb 9-1: unable to get BOS descriptor or descriptor too short
[  667.963278][T14639] usb 9-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00
[  667.992428][T15716] syzkaller0: entered promiscuous mode
[  668.008885][T14639] usb 9-1: config 129 has an invalid interface number: 135 but max is 0
[  668.023084][T15716] syzkaller0: entered allmulticast mode
[  668.057695][T14639] usb 9-1: config 129 has an invalid interface number: 5 but max is 0
[  668.078781][T14639] usb 9-1: config 129 has 2 interfaces, different from the descriptor's value: 1
[  668.106251][T14639] usb 9-1: config 129 has no interface number 0
[  668.122170][T14639] usb 9-1: config 129 has no interface number 1
[  668.137235][T14639] usb 9-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5
[  668.166373][T14639] usb 9-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30
[  668.206157][T14639] usb 9-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37
[  668.233244][T14639] usb 9-1: config 129 interface 135 has no altsetting 0
[  668.248284][T14639] usb 9-1: config 129 interface 5 has no altsetting 0
[  668.266583][T14639] usb 9-1: string descriptor 0 read error: -22
[  668.277197][T14639] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  668.312831][T14639] usb 9-1: Quirk or no altset; falling back to MIDI 1.0
[  668.330560][T14639] usb 9-1: MIDIStreaming interface descriptor not found
[  668.387872][T15723] syzkaller0: entered promiscuous mode
[  668.410078][T15723] syzkaller0: entered allmulticast mode
[  668.526132][T15691] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  668.538497][T15691] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  668.548709][T14639] usb 9-1: USB disconnect, device number 11
[  668.741232][  T981] usb 1-1: new full-speed USB device number 36 using dummy_hcd
[  668.901589][  T981] usb 1-1: New USB device found, idVendor=0fe6, idProduct=9800, bcdDevice=d1.9a
[  668.913547][  T981] usb 1-1: config 0 has an invalid interface number: 41 but max is 0
[  668.927082][  T981] usb 1-1: config 0 has no interface number 0
[  668.933520][  T981] usb 1-1: config 0 interface 41 has no altsetting 0
[  668.944194][  T981] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  668.953348][  T981] usb 1-1: Product: syz
[  668.957611][  T981] usb 1-1: Manufacturer: syz
[  668.962859][  T981] usb 1-1: SerialNumber: syz
[  668.975891][  T981] usb 1-1: config 0 descriptor??
[  669.427853][T15736] binder: 15735:15736 ioctl 40047459 200000000140 returned -22
[  669.443210][T15736] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  669.481346][T15736] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  669.497396][T15736] overlayfs: failed to look up (tracing) for ino (-66)
[  669.616027][  T981] CoreChips 1-1:0.41: probe with driver CoreChips failed with error -22
[  670.281323][T14639] usb 7-1: new high-speed USB device number 28 using dummy_hcd
[  670.300681][ T5687] usb 9-1: new high-speed USB device number 12 using dummy_hcd
[  670.340662][  T981] usb 6-1: new high-speed USB device number 53 using dummy_hcd
[  670.962643][ T5687] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[  670.976456][T14639] usb 7-1: Using ep0 maxpacket: 8
[  670.991077][T14639] usb 7-1: New USB device found, idVendor=04f2, idProduct=1123, bcdDevice= 0.00
[  671.000163][ T5687] usb 9-1: config 0 has no interfaces?
[  671.006148][ T5687] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  671.017907][T14639] usb 7-1: config index 0 descriptor too short (expected 128, got 36)
[  671.031504][  T981] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[  671.045099][T14639] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  671.051333][  T981] usb 6-1: config 0 has no interfaces?
[  671.061239][  T981] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  671.072734][ T5687] usb 9-1: config 0 descriptor??
[  671.084295][  T981] usb 6-1: config 0 descriptor??
[  671.102974][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000000: 0x4255 instead
[  671.114082][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000004: 0x0001 instead
[  671.116995][T14639] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  671.124591][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000018: 0x8330 instead
[  671.124616][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000003c: 0x3b8d instead
[  671.124633][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000040: 0x4255 instead
[  671.124649][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000044: 0x0101 instead
[  671.124665][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000048: 0xff7f instead
[  671.188310][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000007c: 0xb365 instead
[  671.198911][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00000128: 0x16f1 instead
[  671.211398][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000001d4: 0x16f1 instead
[  671.223517][T15777] jffs2: Further such events for this erase block will not be printed
[  671.223796][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001000: 0x4255 instead
[  671.244333][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001004: 0x0001 instead
[  671.256534][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001018: 0x8330 instead
[  671.272291][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000103c: 0x3b8d instead
[  671.272309][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001040: 0x4255 instead
[  671.272323][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001044: 0x0101 instead
[  671.272336][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001048: 0xff7f instead
[  671.272354][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000107c: 0xef7b instead
[  671.330196][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00001128: 0x16f1 instead
[  671.331441][T14639] usb 7-1: config 0 descriptor??
[  671.341619][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x000011d4: 0x16f1 instead
[  671.357598][T15777] jffs2: Further such events for this erase block will not be printed
[  671.367675][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002000: 0x4255 instead
[  671.415651][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002004: 0x0001 instead
[  671.415667][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00002018: 0x8330 instead
[  671.415678][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000203c: 0x3b8d instead
[  671.415709][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003000: 0x4255 instead
[  671.415719][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003004: 0x0001 instead
[  671.415729][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00003018: 0x8330 instead
[  671.415740][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000303c: 0x3b8d instead
[  671.415765][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004000: 0x4255 instead
[  671.415775][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004004: 0x0001 instead
[  671.415785][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00004018: 0x8330 instead
[  671.415796][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000403c: 0x3b8d instead
[  671.415823][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005000: 0x4255 instead
[  671.415832][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005004: 0x0001 instead
[  671.415842][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00005018: 0x8330 instead
[  671.415853][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000503c: 0x3b8d instead
[  671.415880][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006000: 0x4255 instead
[  671.415890][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006004: 0x0001 instead
[  671.415900][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00006018: 0x8330 instead
[  671.415910][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000603c: 0x3b8d instead
[  671.415941][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007000: 0x4255 instead
[  671.415951][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007004: 0x0001 instead
[  671.415961][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00007018: 0x8330 instead
[  671.415976][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000703c: 0x3b8d instead
[  671.416007][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008000: 0x4255 instead
[  671.416017][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008004: 0x0001 instead
[  671.416027][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00008018: 0x8330 instead
[  671.416038][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000803c: 0x3b8d instead
[  671.416064][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009000: 0x4255 instead
[  671.416074][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009004: 0x0001 instead
[  671.416084][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00009018: 0x8330 instead
[  671.416095][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000903c: 0x3b8d instead
[  671.416122][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a000: 0x4255 instead
[  671.416131][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a004: 0x0001 instead
[  671.416141][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a018: 0x8330 instead
[  671.416152][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000a03c: 0x3b8d instead
[  671.416179][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b000: 0x4255 instead
[  671.416189][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b004: 0x0001 instead
[  671.416199][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b018: 0x8330 instead
[  671.416210][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000b03c: 0x3b8d instead
[  671.416236][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c000: 0x4255 instead
[  671.416245][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c004: 0x0001 instead
[  671.416256][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c018: 0x8330 instead
[  671.416266][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000c03c: 0x3b8d instead
[  671.416293][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d000: 0x4255 instead
[  671.416302][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d004: 0x0001 instead
[  671.416312][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d018: 0x8330 instead
[  671.416323][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000d03c: 0x3b8d instead
[  671.416350][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e000: 0x4255 instead
[  671.416359][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e004: 0x0001 instead
[  671.416369][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e018: 0x8330 instead
[  671.416380][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000e03c: 0x3b8d instead
[  671.416407][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f000: 0x4255 instead
[  671.416416][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f004: 0x0001 instead
[  671.416426][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f018: 0x8330 instead
[  671.416439][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0000f03c: 0x3b8d instead
[  671.416466][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010000: 0x4255 instead
[  671.416476][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010004: 0x0001 instead
[  671.416486][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00010018: 0x8330 instead
[  671.416497][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001003c: 0x3b8d instead
[  671.416523][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011000: 0x4255 instead
[  671.416533][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011004: 0x0001 instead
[  671.416543][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00011018: 0x8330 instead
[  671.416554][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001103c: 0x3b8d instead
[  671.416581][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012000: 0x4255 instead
[  671.416590][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012004: 0x0001 instead
[  671.416600][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00012018: 0x8330 instead
[  671.416611][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001203c: 0x3b8d instead
[  671.416646][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013000: 0x4255 instead
[  671.536421][T14639] usb 1-1: USB disconnect, device number 36
[  672.122638][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013004: 0x0001 instead
[  672.154866][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00013018: 0x8330 instead
[  672.154892][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001303c: 0x3b8d instead
[  672.154947][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014000: 0x4255 instead
[  672.154963][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014004: 0x0001 instead
[  672.154980][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00014018: 0x8330 instead
[  672.154996][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001403c: 0x3b8d instead
[  672.155144][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015000: 0x4255 instead
[  672.155163][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015004: 0x0001 instead
[  672.155179][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00015018: 0x8330 instead
[  672.155197][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001503c: 0x3b8d instead
[  672.155242][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016000: 0x4255 instead
[  672.155258][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016004: 0x0001 instead
[  672.155274][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00016018: 0x8330 instead
[  672.155292][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001603c: 0x3b8d instead
[  672.155336][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017000: 0x4255 instead
[  672.155352][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017004: 0x0001 instead
[  672.155368][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00017018: 0x8330 instead
[  672.155386][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001703c: 0x3b8d instead
[  672.155428][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018000: 0x4255 instead
[  672.155443][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018004: 0x0001 instead
[  672.155460][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00018018: 0x8330 instead
[  672.155477][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001803c: 0x3b8d instead
[  672.155521][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019000: 0x4255 instead
[  672.155535][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019004: 0x0001 instead
[  672.155551][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x00019018: 0x8330 instead
[  672.155569][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001903c: 0x3b8d instead
[  672.155613][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a000: 0x4255 instead
[  672.155628][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a004: 0x0001 instead
[  672.155645][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a018: 0x8330 instead
[  672.155663][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001a03c: 0x3b8d instead
[  672.155707][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b000: 0x4255 instead
[  672.155723][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b004: 0x0001 instead
[  672.155740][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b018: 0x8330 instead
[  672.155757][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001b03c: 0x3b8d instead
[  672.155802][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c000: 0x4255 instead
[  672.155817][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c004: 0x0001 instead
[  672.155834][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c018: 0x8330 instead
[  672.155851][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001c03c: 0x3b8d instead
[  672.155896][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d000: 0x4255 instead
[  672.155912][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d004: 0x0001 instead
[  672.155933][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d018: 0x8330 instead
[  672.155951][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001d03c: 0x3b8d instead
[  672.155996][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e000: 0x4255 instead
[  672.156011][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e004: 0x0001 instead
[  672.156027][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e018: 0x8330 instead
[  672.156044][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001e03c: 0x3b8d instead
[  672.156088][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f000: 0x4255 instead
[  672.156105][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f004: 0x0001 instead
[  672.156122][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f018: 0x8330 instead
[  672.156140][T15777] jffs2: jffs2_scan_eraseblock(): Magic bitmask 0x1985 not found at 0x0001f03c: 0x3b8d instead
[  672.156187][T15777] jffs2: Cowardly refusing to erase blocks on filesystem with no valid JFFS2 nodes
[  672.156197][T15777] jffs2: empty_blocks 0, bad_blocks 0, c->nr_blocks 32
[  672.321714][   T29] usb 9-1: USB disconnect, device number 12
[  672.323567][   T10] usb 6-1: USB disconnect, device number 53
[  672.416468][T15782] syzkaller0: entered promiscuous mode
[  672.820316][T15785] binder: 15784:15785 ioctl 40047459 200000000140 returned -22
[  672.821168][T15782] syzkaller0: entered allmulticast mode
[  673.219055][T15802] netlink: 8 bytes leftover after parsing attributes in process `syz.2.2561'.
[  673.240321][T15802] bridge2: entered promiscuous mode
[  673.261416][T15802] bridge2: entered allmulticast mode
[  673.268894][T15803] syzkaller0: entered promiscuous mode
[  673.276785][T15803] syzkaller0: entered allmulticast mode
[  673.331649][T15811] binder: 15810:15811 ioctl 40047459 200000000140 returned -22
[  673.356360][   T10] usb 7-1: USB disconnect, device number 28
[  673.459503][T15817] netlink: 8 bytes leftover after parsing attributes in process `syz.6.2564'.
[  673.589449][T15826] FAULT_INJECTION: forcing a failure.
[  673.589449][T15826] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  673.604708][T15826] CPU: 0 UID: 0 PID: 15826 Comm: syz.2.2570 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  673.604735][T15826] Tainted: [L]=SOFTLOCKUP
[  673.604742][T15826] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  673.604752][T15826] Call Trace:
[  673.604758][T15826]  <TASK>
[  673.604765][T15826]  dump_stack_lvl+0x100/0x190
[  673.604791][T15826]  should_fail_ex.cold+0x5/0xa
[  673.604813][T15826]  _copy_from_user+0x2e/0xd0
[  673.604837][T15826]  ____sys_sendmsg+0x1d1/0xbe0
[  673.604867][T15826]  ? __pfx_____sys_sendmsg+0x10/0x10
[  673.604903][T15826]  ___sys_sendmsg+0x190/0x1e0
[  673.604921][T15826]  ? __pfx____sys_sendmsg+0x10/0x10
[  673.604937][T15826]  ? __lock_acquire+0x49f/0x1a40
[  673.604959][T15826]  ? get_pid_task+0x106/0x250
[  673.604999][T15826]  __sys_sendmsg+0x160/0x210
[  673.605021][T15826]  ? __pfx___sys_sendmsg+0x10/0x10
[  673.605055][T15826]  do_syscall_64+0x115/0x870
[  673.605077][T15826]  ? clear_bhb_loop+0x70/0xc0
[  673.605099][T15826]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  673.605116][T15826] RIP: 0033:0x7f7fa1f9e0d9
[  673.605130][T15826] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  673.605147][T15826] RSP: 002b:00007f7fa2df5028 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  673.605163][T15826] RAX: ffffffffffffffda RBX: 00007f7fa2225fa0 RCX: 00007f7fa1f9e0d9
[  673.605175][T15826] RDX: 0000000000000000 RSI: 0000200000001580 RDI: 0000000000000003
[  673.605185][T15826] RBP: 00007f7fa2df5090 R08: 0000000000000000 R09: 0000000000000000
[  673.605195][T15826] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  673.605205][T15826] R13: 00007f7fa2226038 R14: 00007f7fa2225fa0 R15: 00007ffcaf193258
[  673.605228][T15826]  </TASK>
[  673.878275][T15834] syzkaller0: entered promiscuous mode
[  673.886895][T15834] syzkaller0: entered allmulticast mode
[  674.050638][   T10] usb 7-1: new full-speed USB device number 29 using dummy_hcd
[  674.656226][   T10] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[  674.682334][   T10] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 4
[  674.713986][   T10] usb 7-1: config 0 interface 0 has no altsetting 0
[  674.722665][   T10] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[  674.731199][   T10] usb 7-1: Product: syz
[  674.736167][   T10] usb 7-1: Manufacturer: syz
[  674.741853][   T10] usb 7-1: SerialNumber: syz
[  674.752669][   T10] usb 7-1: config 0 descriptor??
[  674.761959][   T10] usb 7-1: selecting invalid altsetting 0
[  674.797089][T15844] binder: 15843:15844 ioctl 40047459 200000000140 returned -22
[  674.806363][T15844] overlayfs: "xino=on" is useless with all layers on same fs, ignore.
[  674.822531][T15844] overlayfs: overlapping lowerdir path
[  675.002625][T15830] usb 3-1: Can't get UAC3 power state for id 10
[  675.010516][T15830] usb 3-1: Cannot change Power Domain ID: 10 to state: 0. Err: -32
[  675.022160][T15830] usb 3-1: Can't get UAC3 power state for id 10
[  675.028523][T15830] usb 3-1: Cannot change Power Domain ID: 10 to state: 0. Err: -32
[  675.043235][T15830] usb 3-1: Can't get UAC3 power state for id 10
[  675.050871][T15830] usb 3-1: Cannot change Power Domain ID: 10 to state: 1. Err: -32
[  675.061258][   T10] usb 7-1: USB disconnect, device number 29
[  675.073011][   T30] audit: type=1400 audit(1786408191.912:1194): avc:  denied  { setopt } for  pid=15849 comm="syz.8.2580" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=kcm_socket permissive=1
[  675.394765][   T29] usb 1-1: new high-speed USB device number 37 using dummy_hcd
[  676.101801][   T29] usb 1-1: Using ep0 maxpacket: 32
[  676.108512][   T29] usb 1-1: New USB device found, idVendor=0c72, idProduct=000d, bcdDevice=27.9b
[  676.196430][   T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  676.205181][   T29] usb 1-1: Product: syz
[  676.209513][   T29] usb 1-1: Manufacturer: syz
[  676.227831][   T29] usb 1-1: SerialNumber: syz
[  676.239653][   T29] usb 1-1: config 0 descriptor??
[  676.512230][T15892] netlink: 60 bytes leftover after parsing attributes in process `syz.5.2593'.
[  676.620605][ T5778] usb 7-1: new full-speed USB device number 30 using dummy_hcd
[  676.680050][   T29] peak_usb 1-1:0.0 can0: unable to request usb[type=0 value=0] err=-71
[  676.691689][   T29] peak_usb 1-1:0.0: unable to read PCAN-USB Pro bootloader info (err -71)
[  676.741107][   T10] usb 9-1: new full-speed USB device number 13 using dummy_hcd
[  676.741844][   T29] peak_usb 1-1:0.0: probe with driver peak_usb failed with error -71
[  676.763018][   T29] usb 1-1: USB disconnect, device number 37
[  676.791560][ T5778] usb 7-1: New USB device found, idVendor=045e, idProduct=0283, bcdDevice=99.0b
[  676.809825][ T5778] usb 7-1: config 0 interface 0 altsetting 255 endpoint 0x4 has an invalid bInterval 0, changing to 4
[  676.821633][ T5778] usb 7-1: config 0 interface 0 has no altsetting 0
[  676.830725][ T5778] usb 7-1: New USB device strings: Mfr=1, Product=228, SerialNumber=2
[  676.839034][ T5778] usb 7-1: Product: syz
[  676.843994][ T5778] usb 7-1: Manufacturer: syz
[  676.848597][ T5778] usb 7-1: SerialNumber: syz
[  676.854908][ T5778] usb 7-1: config 0 descriptor??
[  676.865268][ T5778] usb 7-1: selecting invalid altsetting 0
[  676.890595][   T10] usb 9-1: device descriptor read/64, error -71
[  677.085533][T15884] netlink: 16 bytes leftover after parsing attributes in process `syz.6.2591'.
[  677.099881][T14639] usb 7-1: USB disconnect, device number 30
[  677.165714][ T4912] Bluetooth: hci6: command 0x0406 tx timeout
[  677.563602][   T10] usb 9-1: new full-speed USB device number 14 using dummy_hcd
[  677.705456][   T10] usb 9-1: device descriptor read/64, error -71
[  677.784575][T15908] TC_ACT_REPEAT abuse ?
[  677.830846][   T10] usb usb9-port1: attempt power cycle
[  677.931891][T15919] FAULT_INJECTION: forcing a failure.
[  677.931891][T15919] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  677.945041][T15919] CPU: 1 UID: 0 PID: 15919 Comm: syz.2.2603 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  677.945068][T15919] Tainted: [L]=SOFTLOCKUP
[  677.945074][T15919] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  677.945084][T15919] Call Trace:
[  677.945091][T15919]  <TASK>
[  677.945097][T15919]  dump_stack_lvl+0x100/0x190
[  677.945124][T15919]  should_fail_ex.cold+0x5/0xa
[  677.945145][T15919]  _copy_to_user+0x32/0xd0
[  677.945170][T15919]  simple_read_from_buffer+0xcb/0x170
[  677.945191][T15919]  proc_fail_nth_read+0x1af/0x230
[  677.945219][T15919]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  677.945246][T15919]  ? rw_verify_area+0xce/0x6d0
[  677.945270][T15919]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  677.945298][T15919]  vfs_read+0x1e4/0xb40
[  677.945329][T15919]  ? __pfx_vfs_read+0x10/0x10
[  677.945355][T15919]  ? __fget_files+0x215/0x3d0
[  677.945380][T15919]  ? __fget_files+0x21f/0x3d0
[  677.945406][T15919]  ksys_read+0x12a/0x250
[  677.945422][T15919]  ? __pfx_ksys_read+0x10/0x10
[  677.945447][T15919]  do_syscall_64+0x115/0x870
[  677.945470][T15919]  ? clear_bhb_loop+0x70/0xc0
[  677.945492][T15919]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  677.945511][T15919] RIP: 0033:0x7f7fa1f5e90e
[  677.945526][T15919] Code: 08 0f 85 a5 a8 ff ff 49 89 fb 48 89 f0 48 89 d7 48 89 ce 4c 89 c2 4d 89 ca 4c 8b 44 24 08 4c 8b 4c 24 10 4c 89 5c 24 08 0f 05 <c3> 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 80 00 00 00 00 48 83 ec 08
[  677.945543][T15919] RSP: 002b:00007f7fa2df4fe8 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  677.945561][T15919] RAX: ffffffffffffffda RBX: 00007f7fa2df56c0 RCX: 00007f7fa1f5e90e
[  677.945572][T15919] RDX: 000000000000000f RSI: 00007f7fa2df50a0 RDI: 0000000000000003
[  677.945583][T15919] RBP: 00007f7fa2df5090 R08: 0000000000000000 R09: 0000000000000000
[  677.945593][T15919] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  677.945603][T15919] R13: 00007f7fa2226038 R14: 00007f7fa2225fa0 R15: 00007ffcaf193258
[  677.945628][T15919]  </TASK>
[  678.200998][   T10] usb 9-1: new full-speed USB device number 15 using dummy_hcd
[  678.218070][T15927] binder: 15926:15927 ioctl 40047459 200000000140 returned -22
[  678.227419][   T10] usb 9-1: device descriptor read/8, error -71
[  678.280958][   T30] audit: type=1400 audit(1786408195.132:1195): avc:  denied  { read } for  pid=15928 comm="syz.6.2607" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=key_socket permissive=1
[  678.335966][   T30] audit: type=1400 audit(1786408195.182:1196): avc:  denied  { bind } for  pid=15928 comm="syz.6.2607" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_netfilter_socket permissive=1
[  678.349586][T15932] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  678.367928][T15932] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  678.470786][   T10] usb 9-1: new full-speed USB device number 16 using dummy_hcd
[  678.491198][   T10] usb 9-1: device descriptor read/8, error -71
[  678.582162][ T5687] usb 6-1: new high-speed USB device number 54 using dummy_hcd
[  678.602066][   T10] usb usb9-port1: unable to enumerate USB device
[  678.664614][T15937] netlink: 8 bytes leftover after parsing attributes in process `syz.0.2610'.
[  678.740573][ T5687] usb 6-1: Using ep0 maxpacket: 16
[  678.746370][ T5687] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  678.756746][ T5687] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  678.766968][ T5687] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  678.777172][ T5687] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  678.785800][ T5687] usb 6-1: Manufacturer: syz
[  678.803799][ T5687] usb 6-1: config 0 descriptor??
[  679.246342][T15959] binder: 15958:15959 ioctl 40047459 200000000140 returned -22
[  680.212154][ T1301] ieee802154 phy0 wpan0: encryption failed: -22
[  680.218524][ T1301] ieee802154 phy1 wpan1: encryption failed: -22
[  681.066101][T15992] binder: 15990:15992 ioctl 40047459 200000000140 returned -22
[  681.383240][   T29] usb 6-1: USB disconnect, device number 54
[  681.451194][   T10] usb 9-1: new high-speed USB device number 17 using dummy_hcd
[  681.471628][T16013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  681.513820][T16013] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  681.614062][   T10] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00
[  681.648779][   T10] usb 9-1: config index 0 descriptor too short (expected 45, got 36)
[  681.683861][   T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  681.706236][   T10] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  681.717214][   T10] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21
[  681.733814][   T10] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  681.746706][T16028] FAULT_INJECTION: forcing a failure.
[  681.746706][T16028] name failslab, interval 1, probability 0, space 0, times 0
[  681.753798][   T10] usb 9-1: config 0 descriptor??
[  681.766340][T16028] CPU: 1 UID: 0 PID: 16028 Comm: syz.6.2641 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  681.766367][T16028] Tainted: [L]=SOFTLOCKUP
[  681.766373][T16028] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  681.766384][T16028] Call Trace:
[  681.766390][T16028]  <TASK>
[  681.766397][T16028]  dump_stack_lvl+0x100/0x190
[  681.766425][T16028]  should_fail_ex.cold+0x5/0xa
[  681.766448][T16028]  should_failslab+0xc2/0x120
[  681.766474][T16028]  __kmalloc_noprof+0xfc/0x820
[  681.766497][T16028]  ? tomoyo_encode2+0xfb/0x3c0
[  681.766519][T16028]  tomoyo_encode2+0xfb/0x3c0
[  681.766539][T16028]  tomoyo_encode+0x29/0x50
[  681.766556][T16028]  tomoyo_realpath_from_path+0x18c/0x690
[  681.766579][T16028]  tomoyo_path_number_perm+0x23c/0x580
[  681.766604][T16028]  ? tomoyo_path_number_perm+0x22e/0x580
[  681.766631][T16028]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  681.766681][T16028]  ? find_held_lock+0x2b/0x80
[  681.766698][T16028]  ? __fget_files+0x215/0x3d0
[  681.766716][T16028]  ? hook_file_ioctl_common+0x140/0x440
[  681.766735][T16028]  ? __fget_files+0x215/0x3d0
[  681.766757][T16028]  ? __fget_files+0x21f/0x3d0
[  681.766779][T16028]  security_file_ioctl+0xd3/0x230
[  681.766808][T16028]  __x64_sys_ioctl+0xb7/0x210
[  681.766836][T16028]  do_syscall_64+0x115/0x870
[  681.766859][T16028]  ? clear_bhb_loop+0x70/0xc0
[  681.766881][T16028]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  681.766899][T16028] RIP: 0033:0x7fdb4939e0d9
[  681.766914][T16028] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  681.766931][T16028] RSP: 002b:00007fdb4a18a028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  681.766949][T16028] RAX: ffffffffffffffda RBX: 00007fdb49625fa0 RCX: 00007fdb4939e0d9
[  681.766960][T16028] RDX: 0000200000000c00 RSI: 00000000c0306201 RDI: 0000000000000004
[  681.766972][T16028] RBP: 00007fdb4a18a090 R08: 0000000000000000 R09: 0000000000000000
[  681.766982][T16028] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  681.766993][T16028] R13: 00007fdb49626038 R14: 00007fdb49625fa0 R15: 00007fffc3495768
[  681.767018][T16028]  </TASK>
[  681.767034][T16028] ERROR: Out of memory at tomoyo_realpath_from_path.
[  682.210098][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.228439][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.237013][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.246669][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.258886][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.277756][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.299246][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.328030][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.337160][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.344846][   T10] plantronics 0003:047F:FFFF.0007: unknown main item tag 0x0
[  682.364035][T16046] input: syz1 as /devices/virtual/input/input66
[  682.416240][   T10] plantronics 0003:047F:FFFF.0007: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0
[  682.476833][   T29] usb 9-1: USB disconnect, device number 17
[  682.503087][T14639] usb 6-1: new high-speed USB device number 55 using dummy_hcd
[  682.582690][T16053] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  682.601381][T16053] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  682.670523][T14639] usb 6-1: Using ep0 maxpacket: 16
[  682.676709][T14639] usb 6-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  682.687193][T14639] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  682.698818][T14639] usb 6-1: config 0 has 0 interfaces, different from the descriptor's value: 1
[  682.767107][T16060] IPVS: sh: FWM 3 0x00000003 - no destination available
[  682.901637][T14639] usb 6-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  683.542324][T14639] usb 6-1: Manufacturer: syz
[  683.549364][T14639] usb 6-1: config 0 descriptor??
[  683.603382][T16062] netlink: 556 bytes leftover after parsing attributes in process `syz.8.2656'.
[  683.849755][T16079] usb usb8: usbfs: process 16079 (syz.2.2662) did not claim interface 0 before use
[  683.863026][T16079] binder: 16078:16079 ioctl c04064a0 200000000240 returned -22
[  683.871486][T16079] binder: 16078:16079 ioctl c01064c8 2000000002c0 returned -22
[  683.879480][T16079] binder: 16078:16079 ioctl c02064b6 200000000480 returned -22
[  684.081129][T16090] netlink: 12 bytes leftover after parsing attributes in process `syz.0.2667'.
[  684.400852][   T10] usb 7-1: new high-speed USB device number 31 using dummy_hcd
[  684.610559][   T10] usb 7-1: Using ep0 maxpacket: 16
[  684.620246][   T10] usb 7-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  684.639342][   T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  684.659958][   T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  684.683380][   T10] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  684.703384][   T10] usb 7-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  684.713137][   T10] usb 7-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  684.727382][   T10] usb 7-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  684.738257][   T10] usb 7-1: Manufacturer: syz
[  684.758367][   T10] usb 7-1: config 0 descriptor??
[  685.040913][T16107] IPVS: sh: FWM 3 0x00000003 - no destination available
[  685.741780][   T10] rc_core: IR keymap rc-hauppauge not found
[  685.804611][   T10] Registered IR keymap rc-empty
[  685.849323][ T5786] usb 6-1: USB disconnect, device number 55
[  685.855535][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  685.913295][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  685.953591][T16114] netlink: 556 bytes leftover after parsing attributes in process `syz.2.2671'.
[  685.982083][   T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0
[  686.034355][   T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.0/rc/rc0/input67
[  686.103543][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.151420][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.185102][T16123] IPVS: sh: FWM 3 0x00000003 - no destination available
[  686.195406][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.241184][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.302636][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.370907][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.459078][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.561206][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.632779][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.692961][   T10] mceusb 7-1:0.0: Error: mce write submit urb error = -90
[  686.839317][   T10] mceusb 7-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  686.874957][   T10] mceusb 7-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  686.986945][   T10] usb 7-1: USB disconnect, device number 31
[  687.401048][ T4912] Bluetooth: hci3: command 0x0406 tx timeout
[  687.905273][T16142] bond5 (unregistering): Released all slaves
[  687.919675][T16148] netlink: 60 bytes leftover after parsing attributes in process `syz.6.2679'.
[  687.970239][T16150] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  687.982797][T16150] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  688.083338][   T10] IPVS: starting estimator thread 0...
[  688.180970][T16152] IPVS: using max 41 ests per chain, 98400 per kthread
[  688.990558][ T5778] usb 7-1: new high-speed USB device number 32 using dummy_hcd
[  689.172462][ T5778] usb 7-1: unable to get BOS descriptor or descriptor too short
[  689.180653][   T10] usb 1-1: new high-speed USB device number 38 using dummy_hcd
[  689.194120][T16176] IPVS: sh: FWM 3 0x00000003 - no destination available
[  689.391089][   T10] usb 1-1: Using ep0 maxpacket: 16
[  689.437399][   T10] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42
[  689.476412][   T10] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config
[  689.538418][   T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  689.655280][ T5778] usb 7-1: New USB device found, idVendor=2040, idProduct=721f, bcdDevice=f2.00
[  689.669084][   T10] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0
[  689.728396][   T10] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0
[  689.783416][   T10] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  689.934717][   T10] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0
[  689.999102][   T10] usb 1-1: Manufacturer: syz
[  690.101416][ T5778] usb 7-1: config 129 has an invalid interface number: 135 but max is 0
[  690.103476][   T10] usb 1-1: config 0 descriptor??
[  690.110515][ T5778] usb 7-1: config 129 has an invalid interface number: 5 but max is 0
[  690.123313][ T5778] usb 7-1: config 129 has 2 interfaces, different from the descriptor's value: 1
[  690.132469][ T5778] usb 7-1: config 129 has no interface number 0
[  690.138713][ T5778] usb 7-1: config 129 has no interface number 1
[  690.145039][ T5778] usb 7-1: config 129 interface 135 altsetting 6 has 0 endpoint descriptors, different from the interface descriptor's value: 5
[  690.158298][ T5778] usb 7-1: too many endpoints for config 129 interface 5 altsetting 7: 37, using maximum allowed: 30
[  690.169217][ T5778] usb 7-1: config 129 interface 5 altsetting 7 has 0 endpoint descriptors, different from the interface descriptor's value: 37
[  690.185206][ T5778] usb 7-1: config 129 interface 135 has no altsetting 0
[  690.192239][ T5778] usb 7-1: config 129 interface 5 has no altsetting 0
[  690.201937][ T5778] usb 7-1: string descriptor 0 read error: -22
[  690.208923][ T5778] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  690.224860][ T5778] usb 7-1: Quirk or no altset; falling back to MIDI 1.0
[  690.231905][ T5778] usb 7-1: MIDIStreaming interface descriptor not found
[  690.391737][T16192] IPVS: sh: FWM 3 0x00000003 - no destination available
[  690.733933][   T29] usb 7-1: USB disconnect, device number 32
[  691.260537][   T10] rc_core: IR keymap rc-hauppauge not found
[  691.270546][   T10] Registered IR keymap rc-empty
[  691.280671][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.330588][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.371782][   T10] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0
[  691.423300][   T10] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/rc/rc0/input68
[  691.470409][T16204] netlink: 12 bytes leftover after parsing attributes in process `syz.2.2702'.
[  691.487063][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.551600][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.592617][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.623494][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.653962][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.691611][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.721535][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.750789][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.780603][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.815214][   T10] mceusb 1-1:0.0: Error: mce write submit urb error = -90
[  691.893641][   T10] mceusb 1-1:0.0: Registered 424242424242 with mce emulator interface version 1
[  691.928215][   T10] mceusb 1-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active)
[  692.089824][   T10] usb 1-1: USB disconnect, device number 38
[  692.581645][T13325] Bluetooth: hci5: command 0x0406 tx timeout
[  692.600356][T16229] IPVS: sh: FWM 3 0x00000003 - no destination available
[  693.249490][ T4912] Bluetooth: hci7: ISO packet for unknown connection handle 830
[  693.254108][T16234] netdevsim netdevsim0 netdevsim0: entered allmulticast mode
[  693.418885][T16239] netlink: 'syz.6.2714': attribute type 10 has an invalid length.
[  693.852755][ T5778] usb 9-1: new full-speed USB device number 18 using dummy_hcd
[  693.992078][   T29] usb 1-1: new high-speed USB device number 39 using dummy_hcd
[  694.542306][T16251] random: crng reseeded on system resumption
[  694.553419][   T29] usb 1-1: Using ep0 maxpacket: 16
[  694.559770][ T5778] usb 9-1: New USB device found, idVendor=0f11, idProduct=1000, bcdDevice= 0.7f
[  694.573411][   T29] usb 1-1: New USB device found, idVendor=0763, idProduct=2001, bcdDevice= 0.40
[  694.584145][ T5778] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  694.594504][   T29] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config
[  694.605487][ T5778] usb 9-1: config 0 descriptor??
[  694.611313][   T29] usb 1-1: config 1 interface 2 altsetting 1 endpoint 0x82 has an invalid bInterval 0, changing to 7
[  694.622585][   T29] usb 1-1: config 1 interface 2 has no altsetting 0
[  694.635683][   T29] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  694.643909][   T29] usb 1-1: Product: syz
[  694.648095][   T29] usb 1-1: Manufacturer: syz
[  694.652990][   T29] usb 1-1: SerialNumber: syz
[  694.799008][   T30] audit: type=1400 audit(1786408211.642:1197): avc:  denied  { read } for  pid=16254 comm="syz.5.2721" name="mtd0" dev="devtmpfs" ino=702 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:fixed_disk_device_t tclass=chr_file permissive=1
[  694.799613][T16255] FAULT_INJECTION: forcing a failure.
[  694.799613][T16255] name failslab, interval 1, probability 0, space 0, times 0
[  694.833373][ T5778] usb 9-1: string descriptor 0 read error: -71
[  694.837961][T16255] CPU: 0 UID: 0 PID: 16255 Comm: syz.5.2721 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  694.837985][T16255] Tainted: [L]=SOFTLOCKUP
[  694.837991][T16255] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  694.838000][T16255] Call Trace:
[  694.838006][T16255]  <TASK>
[  694.838012][T16255]  dump_stack_lvl+0x100/0x190
[  694.838037][T16255]  should_fail_ex.cold+0x5/0xa
[  694.838057][T16255]  should_failslab+0xc2/0x120
[  694.838079][T16255]  __kmalloc_noprof+0xfc/0x820
[  694.838097][T16255]  ? rcu_is_watching+0x12/0xc0
[  694.838124][T16255]  ? tomoyo_realpath_from_path+0xb6/0x690
[  694.838146][T16255]  tomoyo_realpath_from_path+0xb6/0x690
[  694.838167][T16255]  tomoyo_path_number_perm+0x23c/0x580
[  694.838188][T16255]  ? tomoyo_path_number_perm+0x22e/0x580
[  694.838211][T16255]  ? __pfx_tomoyo_path_number_perm+0x10/0x10
[  694.838259][T16255]  ? find_held_lock+0x2b/0x80
[  694.838274][T16255]  ? __fget_files+0x215/0x3d0
[  694.838290][T16255]  ? hook_file_ioctl_common+0x140/0x440
[  694.838307][T16255]  ? __fget_files+0x215/0x3d0
[  694.838327][T16255]  ? __fget_files+0x21f/0x3d0
[  694.838347][T16255]  security_file_ioctl+0xd3/0x230
[  694.838372][T16255]  __x64_sys_ioctl+0xb7/0x210
[  694.838397][T16255]  do_syscall_64+0x115/0x870
[  694.838418][T16255]  ? clear_bhb_loop+0x70/0xc0
[  694.838438][T16255]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  694.838455][T16255] RIP: 0033:0x7f3c82f9e0d9
[  694.838468][T16255] Code: ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 44 00 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 e8 ff ff ff f7 d8 64 89 01 48
[  694.838483][T16255] RSP: 002b:00007f3c811f6028 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  694.838499][T16255] RAX: ffffffffffffffda RBX: 00007f3c83225fa0 RCX: 00007f3c82f9e0d9
[  694.838510][T16255] RDX: 0000000000000000 RSI: 00000000c018937b RDI: 0000000000000004
[  694.838519][T16255] RBP: 00007f3c811f6090 R08: 0000000000000000 R09: 0000000000000000
[  694.838528][T16255] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  694.838538][T16255] R13: 00007f3c83226038 R14: 00007f3c83225fa0 R15: 00007ffcbd3398a8
[  694.838559][T16255]  </TASK>
[  694.838573][T16255] ERROR: Out of memory at tomoyo_realpath_from_path.
[  694.843317][ T5778] ldusb 9-1:0.0: Interrupt in endpoint not found
[  694.952406][   T31] INFO: task syz-executor:5593 blocked for more than 143 seconds.
[  694.960810][ T5778] usb 9-1: USB disconnect, device number 18
[  694.968142][   T31]       Tainted: G             L      syzkaller #0
[  694.980860][T16257] overlayfs: "xino" feature enabled using 3 upper inode bits.
[  694.983060][   T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  695.047142][ T4912] Bluetooth: hci7: ACL packet for unknown connection handle 42
[  695.051733][   T31] task:syz-executor    state:D
[  695.075748][T16257] overlayfs: failed lookup in lower (/, name='tracing', err=-66): unsupported object type
[  695.104201][   T31]  stack:22712 pid:5593  tgid:5593  ppid:1      task_flags:0x400140 flags:0x00080002
[  695.111859][T16257] overlayfs: failed to look up (tracing) for ino (-66)
[  695.116787][   T31] Call Trace:
[  695.147513][   T31]  <TASK>
[  695.152369][   T31]  __schedule+0x125c/0x6730
[  695.156970][   T31]  ? do_raw_spin_lock+0x128/0x260
[  695.164356][   T31]  ? __pfx___schedule+0x10/0x10
[  695.169281][   T31]  ? find_held_lock+0x2b/0x80
[  695.174225][   T31]  ? schedule+0x225/0x2c0
[  695.178670][   T31]  schedule+0xdd/0x2c0
[  695.182993][   T31]  schedule_preempt_disabled+0x13/0x30
[  695.188458][   T31]  __mutex_lock+0xccc/0x1bd0
[  695.194325][   T31]  ? nfsd_shutdown_threads+0x5b/0xf0
[  695.199635][   T31]  ? __lock_acquire+0x49f/0x1a40
[  695.204705][   T31]  ? __pfx___mutex_lock+0x10/0x10
[  695.209761][   T31]  ? net_generic+0xea/0x2a0
[  695.214382][   T31]  ? net_generic+0xea/0x2a0
[  695.218949][   T31]  ? nfsd_shutdown_threads+0x5b/0xf0
[  695.225230][   T31]  nfsd_shutdown_threads+0x5b/0xf0
[  695.230367][   T31]  nfsd_umount+0x3b/0x60
[  695.234855][   T31]  deactivate_locked_super+0xc1/0x1b0
[  695.240249][   T31]  deactivate_super+0xe7/0x110
[  695.246516][   T31]  cleanup_mnt+0x21f/0x450
[  695.251586][   T31]  task_work_run+0x150/0x240
[  695.256182][   T31]  ? __pfx_task_work_run+0x10/0x10
[  695.261955][   T31]  exit_to_user_mode_loop+0x1d8/0x6f0
[  695.267341][   T31]  ? rcu_is_watching+0x12/0xc0
[  695.272446][   T31]  do_syscall_64+0x666/0x870
[  695.277056][   T31]  ? clear_bhb_loop+0x70/0xc0
[  695.281780][   T31]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  695.287702][   T31] RIP: 0033:0x7f018059f317
[  695.292580][   T31] RSP: 002b:00007ffeaee72588 EFLAGS: 00000246 ORIG_RAX: 00000000000000a6
[  695.301098][   T31] RAX: 0000000000000000 RBX: 00007f0180634474 RCX: 00007f018059f317
[  695.309071][   T31] RDX: 0000000000000000 RSI: 0000000000000009 RDI: 00007ffeaee72640
[  695.317260][   T31] RBP: 00007ffeaee72640 R08: 00007ffeaee73640 R09: 00000000ffffffff
[  695.325444][   T31] R10: 0000000000000000 R11: 0000000000000246 R12: 00007ffeaee736d0
[  695.333912][   T31] R13: 00007f0180634474 R14: 0000000000086431 R15: 00007ffeaee73710
[  695.341996][   T31]  </TASK>
[  695.345102][   T31] INFO: task syz.5.1925:13308 blocked for more than 143 seconds.
[  695.355705][   T31]       Tainted: G             L      syzkaller #0
[  695.362295][   T31]       Blocked by coredump.
[  695.366892][   T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message.
[  695.375637][   T31] task:syz.5.1925      state:D stack:25688 pid:13308 tgid:13304 ppid:8662   task_flags:0x40054c flags:0x00080001
[  695.387744][   T31] Call Trace:
[  695.391180][   T31]  <TASK>
[  695.394116][   T31]  __schedule+0x125c/0x6730
[  695.398619][   T31]  ? do_raw_spin_lock+0x128/0x260
[  695.405382][   T31]  ? __pfx___schedule+0x10/0x10
[  695.420654][   T31]  ? find_held_lock+0x2b/0x80
[  695.425358][   T31]  ? schedule+0x225/0x2c0
[  695.439148][   T31]  schedule+0xdd/0x2c0
[  695.450247][   T31]  schedule_preempt_disabled+0x13/0x30
[  695.456102][   T31]  __mutex_lock+0xccc/0x1bd0
[  695.460887][   T31]  ? nfsd_shutdown_threads+0x5b/0xf0
[  695.466198][   T31]  ? __pfx___mutex_lock+0x10/0x10
[  695.471635][   T31]  ? net_generic+0xea/0x2a0
[  695.476166][   T31]  ? net_generic+0xea/0x2a0
[  695.480828][   T31]  ? nfsd_shutdown_threads+0x5b/0xf0
[  695.486122][   T31]  nfsd_shutdown_threads+0x5b/0xf0
[  695.491535][   T31]  nfsd_umount+0x3b/0x60
[  695.495801][   T31]  deactivate_locked_super+0xc1/0x1b0
[  695.501225][   T31]  deactivate_super+0xe7/0x110
[  695.505999][   T31]  cleanup_mnt+0x21f/0x450
[  695.510440][   T31]  task_work_run+0x150/0x240
[  695.515257][   T31]  ? __pfx_task_work_run+0x10/0x10
[  695.520397][   T31]  ? do_raw_spin_unlock+0x145/0x1e0
[  695.525633][   T31]  do_exit+0x951/0x2ae0
[  695.529790][   T31]  ? __pfx_do_exit+0x10/0x10
[  695.535035][   T31]  ? do_raw_spin_lock+0x128/0x260
[  695.540080][   T31]  ? find_held_lock+0x2b/0x80
[  695.544815][   T31]  ? get_signal+0x7e0/0x21e0
[  695.549418][   T31]  do_group_exit+0xd5/0x2a0
[  695.554109][   T31]  get_signal+0x1ec7/0x21e0
[  695.558626][   T31]  ? __lock_acquire+0x49f/0x1a40
[  695.567945][   T31]  ? __pfx_get_signal+0x10/0x10
[  695.572905][   T31]  ? do_futex+0x190/0x440
[  695.577436][   T31]  arch_do_signal_or_restart+0x91/0x7e0
[  695.583191][   T31]  ? __pfx_arch_do_signal_or_restart+0x10/0x10
[  695.589364][   T31]  ? fd_install+0x223/0x580
[  695.594058][   T31]  exit_to_user_mode_loop+0x139/0x6f0
[  695.599447][   T31]  ? rcu_is_watching+0x12/0xc0
[  695.604834][   T31]  do_syscall_64+0x666/0x870
[  695.609437][   T31]  ? clear_bhb_loop+0x70/0xc0
[  695.614176][   T31]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  695.620084][   T31] RIP: 0033:0x7fad6c99e0d9
[  695.624514][   T31] RSP: 002b:00007fad6d8c70e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca
[  695.633085][   T31] RAX: fffffffffffffe00 RBX: 00007fad6cc25fa8 RCX: 00007fad6c99e0d9
[  695.641547][   T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fad6cc25fa8
[  695.649533][   T31] RBP: 00007fad6cc25fa0 R08: 0000000000000000 R09: 0000000000000000
[  695.657589][   T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  695.665620][   T31] R13: 00007fad6cc26038 R14: 00007ffe0a202650 R15: 00007ffe0a202738
[  695.673859][   T31]  </TASK>
[  695.676963][   T31] 
[  695.676963][   T31] Showing all locks held in the system:
[  695.709546][   T31] 6 locks held by kworker/1:1/29:
[  695.710329][   T29] usb 1-1: 1:1 : UAC_AS_GENERAL descriptor not found
[  695.719866][   T31] 1 lock held by khungtaskd/31:
[  695.726289][   T29] usb 1-1: selecting invalid altsetting 0
[  695.732963][   T29] usb 1-1: 2:1 : no or invalid class specific endpoint descriptor
[  695.741999][   T29] usb 1-1: 2:1: invalid format type 0x1002 is detected, processed as PCM
[  695.749243][   T31]  #0: ffffffff8ebe8200 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x3d/0x184
[  695.750714][   T29] usb 1-1: 2:1 : sample bitwidth 60 in over sample bytes 3
[  695.768006][   T31] 2 locks held by kworker/u8:4/59:
[  695.768284][   T29] usb 1-1: 2:1 : invalid UAC_FORMAT_TYPE desc
[  695.773204][   T31]  #0: ffff88801bc44140 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_one_work+0x12b1/0x1940
[  695.779498][   T29] usb 1-1: selecting invalid altsetting 0
[  695.790633][   T31]  #1: ffff8880b8424568 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2e8e/0x6730
[  695.806116][   T31] 2 locks held by getty/5350:
[  695.811515][   T31]  #0: ffff8880341d40a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x24/0x80
[  695.822551][   T31]  #1: ffffc900032332e8 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x419/0x14e0
[  695.829362][   T29] usb 1-1: USB disconnect, device number 39
[  695.832813][   T31] 2 locks held by syz-executor/5593:
[  695.848845][   T31]  #0: ffff88802b3680d8 (&type->s_umount_key#86){++++}-{4:4}, at: deactivate_super+0xdf/0x110
[  695.861270][   T31]  #1: ffffffff8f0724c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0
[  695.871097][   T31] 4 locks held by kworker/1:7/5778:
[  695.876458][   T31]  #0: ffff8880b853b520 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0x2c/0x140
[  695.890002][   T31]  #1: ffff8880b8524568 (psi_seq){-.-.}-{0:0}, at: __schedule+0x2e8e/0x6730
[  695.898914][   T31]  #2: ffff88802a5d3070 (&group->avgs_lock){+.+.}-{4:4}, at: psi_avgs_work+0x84/0x200
[  695.908917][   T31]  #3: ffff8880b8526298 (&base->lock){-.-.}-{2:2}, at: lock_timer_base+0x124/0x1d0
[  695.922878][   T31] 1 lock held by udevd/6328:
[  695.927491][   T31] 3 locks held by syz.2.1483/11644:
[  695.933610][   T31]  #0: ffff88807a58b430 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380
[  695.943311][   T31]  #1: ffff888032038450 (sb_writers#25){.+.+}-{0:0}, at: ksys_write+0x12a/0x250
[  695.952515][   T31]  #2: ffffffff8f0724c0 (nfsd_mutex){+.+.}-{4:4}, at: write_ports+0xa5/0xcc0
[  695.961450][   T31] 2 locks held by syz.5.1925/13308:
[  695.966647][   T31]  #0: ffff8880558c80d8 (&type->s_umount_key#86){++++}-{4:4}, at: deactivate_super+0xdf/0x110
[  695.976980][   T31]  #1: ffffffff8f0724c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0
[  695.986628][   T31] 2 locks held by syz-executor/13382:
[  695.992130][   T31]  #0: ffff88802b7c80d8 (&type->s_umount_key#86){++++}-{4:4}, at: deactivate_super+0xdf/0x110
[  696.002455][   T31]  #1: ffffffff8f0724c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0
[  696.012133][   T31] 2 locks held by syz.1.2044/13765:
[  696.017326][   T31]  #0: ffff8880379060d8 (&type->s_umount_key#86){++++}-{4:4}, at: deactivate_super+0xdf/0x110
[  696.027820][   T31]  #1: ffffffff8f0724c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0
[  696.037574][   T31] 2 locks held by syz.9.2099/13993:
[  696.042980][   T31]  #0: ffff88802d6e60d8 (&type->s_umount_key#86){++++}-{4:4}, at: deactivate_super+0xdf/0x110
[  696.053782][   T31]  #1: ffffffff8f0724c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_shutdown_threads+0x5b/0xf0
[  696.063415][   T31] 2 locks held by syz.3.2207/14731:
[  696.068603][   T31]  #0: ffffffff90b48088 (cb_lock){++++}-{4:4}, at: genl_rcv+0x19/0x40
[  696.076900][   T31]  #1: ffffffff8f0724c0 (nfsd_mutex){+.+.}-{4:4}, at: nfsd_nl_svc_export_set_reqs_doit+0x8a/0x2f0
[  696.087611][   T31] 
[  696.089939][   T31] =============================================
[  696.089939][   T31] 
[  696.103699][   T31] NMI backtrace for cpu 0
[  696.103715][   T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  696.103737][   T31] Tainted: [L]=SOFTLOCKUP
[  696.103742][   T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  696.103751][   T31] Call Trace:
[  696.103757][   T31]  <TASK>
[  696.103764][   T31]  dump_stack_lvl+0x100/0x190
[  696.103787][   T31]  nmi_cpu_backtrace.cold+0x12d/0x151
[  696.103811][   T31]  ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10
[  696.103836][   T31]  nmi_trigger_cpumask_backtrace+0x21c/0x2a0
[  696.103859][   T31]  sys_info+0x141/0x190
[  696.103874][   T31]  watchdog+0xcb1/0x1030
[  696.103898][   T31]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[  696.103920][   T31]  ? __pfx_watchdog+0x10/0x10
[  696.103942][   T31]  ? __kthread_parkme+0x18c/0x230
[  696.103973][   T31]  ? kthread+0x13a/0x450
[  696.103989][   T31]  ? __pfx_watchdog+0x10/0x10
[  696.104010][   T31]  kthread+0x370/0x450
[  696.104026][   T31]  ? __pfx_kthread+0x10/0x10
[  696.104043][   T31]  ret_from_fork+0x72b/0xd50
[  696.104063][   T31]  ? __pfx_ret_from_fork+0x10/0x10
[  696.104081][   T31]  ? __switch_to+0x800/0x10f0
[  696.104093][   T31]  ? __pfx_kthread+0x10/0x10
[  696.104105][   T31]  ret_from_fork_asm+0x1a/0x30
[  696.104128][   T31]  </TASK>
[  696.104133][   T31] Sending NMI from CPU 0 to CPUs 1:
[  696.235319][    C1] NMI backtrace for cpu 1
[  696.235335][    C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  696.235354][    C1] Tainted: [L]=SOFTLOCKUP
[  696.235359][    C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  696.235368][    C1] RIP: 0010:pv_native_safe_halt+0xf/0x20
[  696.235389][    C1] Code: 55 8c 02 e9 83 4b 03 00 0f 1f 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 83 cf 10 00 fb f4 <c3> cc cc cc cc 66 2e 0f 1f 84 00 00 00 00 00 66 90 90 90 90 90 90
[  696.235403][    C1] RSP: 0018:ffffc90000197e00 EFLAGS: 00000242
[  696.235415][    C1] RAX: 0000000002164bfb RBX: ffff88801eac2540 RCX: ffffffff8bbad335
[  696.235424][    C1] RDX: 0000000000000000 RSI: ffffffff8e1a9419 RDI: ffffffff8c400480
[  696.235433][    C1] RBP: ffffed1003d584a8 R08: 0000000000000001 R09: ffffed10170a678d
[  696.235442][    C1] R10: ffff8880b8533c6b R11: 0000000000000000 R12: 0000000000000000
[  696.235451][    C1] R13: 0000000000000000 R14: 1ffff92000032fc4 R15: dffffc0000000000
[  696.235460][    C1] FS:  0000000000000000(0000) GS:ffff888123eec000(0000) knlGS:0000000000000000
[  696.235474][    C1] CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
[  696.235483][    C1] CR2: 0000001b2fcf3ff8 CR3: 000000002659c000 CR4: 00000000003526f0
[  696.235492][    C1] Call Trace:
[  696.235496][    C1]  <TASK>
[  696.235501][    C1]  default_idle+0x9/0x10
[  696.235519][    C1]  default_idle_call+0x6c/0xb0
[  696.235537][    C1]  do_idle+0x3a7/0x5b0
[  696.235556][    C1]  ? __pfx_do_idle+0x10/0x10
[  696.235575][    C1]  ? do_idle+0x12/0x5b0
[  696.235594][    C1]  cpu_startup_entry+0x4f/0x60
[  696.235612][    C1]  start_secondary+0x21d/0x2d0
[  696.235630][    C1]  ? __pfx_start_secondary+0x10/0x10
[  696.235649][    C1]  common_startup_64+0x13e/0x158
[  696.235667][    C1]  </TASK>
[  696.412024][   T31] Kernel panic - not syncing: hung_task: blocked tasks
[  696.418853][   T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Tainted: G             L      syzkaller #0 PREEMPT(full) 
[  696.429515][   T31] Tainted: [L]=SOFTLOCKUP
[  696.433817][   T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/16/2026
[  696.443857][   T31] Call Trace:
[  696.447132][   T31]  <TASK>
[  696.450054][   T31]  dump_stack_lvl+0x100/0x190
[  696.454727][   T31]  vpanic+0x552/0x970
[  696.458686][   T31]  ? __pfx_vpanic+0x10/0x10
[  696.463165][   T31]  ? nmi_trigger_cpumask_backtrace+0x1c7/0x2a0
[  696.469295][   T31]  panic+0xd1/0xe0
[  696.472993][   T31]  ? __pfx_panic+0x10/0x10
[  696.477403][   T31]  ? nmi_trigger_cpumask_backtrace+0x1fa/0x2a0
[  696.483537][   T31]  ? nmi_trigger_cpumask_backtrace+0x260/0x2a0
[  696.489682][   T31]  ? nmi_trigger_cpumask_backtrace+0x26a/0x2a0
[  696.495814][   T31]  ? watchdog.cold+0x1ec/0x234
[  696.500566][   T31]  ? watchdog+0xcc1/0x1030
[  696.504969][   T31]  watchdog.cold+0x1fd/0x234
[  696.509543][   T31]  ? _raw_spin_unlock_irqrestore+0x52/0x80
[  696.515333][   T31]  ? __pfx_watchdog+0x10/0x10
[  696.519995][   T31]  ? __kthread_parkme+0x18c/0x230
[  696.525009][   T31]  ? kthread+0x13a/0x450
[  696.529235][   T31]  ? __pfx_watchdog+0x10/0x10
[  696.533894][   T31]  kthread+0x370/0x450
[  696.537942][   T31]  ? __pfx_kthread+0x10/0x10
[  696.542511][   T31]  ret_from_fork+0x72b/0xd50
[  696.547089][   T31]  ? __pfx_ret_from_fork+0x10/0x10
[  696.552188][   T31]  ? __switch_to+0x800/0x10f0
[  696.556846][   T31]  ? __pfx_kthread+0x10/0x10
[  696.561417][   T31]  ret_from_fork_asm+0x1a/0x30
[  696.566178][   T31]  </TASK>
[  696.569368][   T31] Kernel Offset: disabled
[  696.573666][   T31] Rebooting in 86400 seconds..