last executing test programs: 12.839562348s ago: executing program 3 (id=1091): socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000040)=ANY=[@ANYBLOB="38000000180001000000000000000000020000000400000000000000060015000400000014001680100008800c000380080015"], 0x38}}, 0x0) r0 = syz_open_dev$video4linux(&(0x7f0000002f40), 0x303, 0x2000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x400000000000041, 0x0) socket(0xa, 0x3, 0x3a) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xffffffff7ffffffd]}, 0x0, 0x8) gettid() r4 = gettid() socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$int_in(r5, 0x5452, &(0x7f0000b28000)=0x3) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r7, &(0x7f00000047c0)={0x0, 0x0, &(0x7f00000005c0)=[{&(0x7f0000000040)={0x18, 0x7a, 0x601, 0x0, 0x0, "", [@typed={0x7, 0x0, 0x0, 0x0, @str='\x00\x00\x00'}]}, 0x18}], 0x1}, 0x0) fcntl$setsig(r5, 0xa, 0x12) poll(&(0x7f0000b2c000)=[{r6}], 0x2c, 0xffffffffffbffff8) dup2(r5, r6) timer_delete(0x0) tkill(r4, 0x13) ioctl$VIDIOC_SUBDEV_QUERY_DV_TIMINGS(r0, 0x80845663, 0x0) 12.380844883s ago: executing program 1 (id=1093): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040)='./cgroup.net/syz0\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000040), 0x200002, 0x0) r1 = openat$cgroup_devices(r0, &(0x7f0000000080)='devices.allow\x00', 0x2, 0x0) write$cgroup_devices(r1, &(0x7f00000000c0)={'b', ' *:* ', 'rw\x00'}, 0x9) 12.295258143s ago: executing program 1 (id=1095): bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x4e, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x90) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="01000000040000000800000005"], 0x50) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x29, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f00000003c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r1}, 0x18) r3 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x10, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4000000000000007910480000000000610400000000000095000080"], &(0x7f0000003ff6)='GPL\x00', 0x2, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_msg}, 0x48) close(r3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000029c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xe, 0x4, &(0x7f0000000540)=ANY=[@ANYBLOB="b4050000fdff7f006110580000000000c60000000000000095000000000000009f33ef60916e6e713f1eeb0b725ad99b817fd98cd8073a46b08b94214d816f770600dcca55f21f3ca9e822d182054d54d53cd2b6db714e4beb4147000001000000008f2b9000f22425e4097ed62cbc891061017cfa6f6148a1c1e43f00001bde60beac671e8e8fdecb03588aa623fa71f31bf0f871ab5c2ff88afc60027f4e5b5271ed58e835cf0d0000000098b51fe68db8d9dbe87dcff414ed000000000000000000000000000000000000000000000000000000b347abe6352a080f8140e5fd10747b6ecdb3542646bf636e3d6e700e5b0500000000000000eb9e1403e6c8f7a187eaf60f3a17f0f046a307a403c19d9829c90bd2114252581567acae715cbe1b57d5cda432c5b910400623d24195405f2e76ccb7b37b41215c184e731fb1"], &(0x7f0000003ff6)='GPL\x00', 0x4, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x366, 0x10, &(0x7f0000000000), 0x1dd}, 0x48) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000200)=@base={0xf, 0x4, 0x4, 0x12}, 0x48) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000340)=ANY=[@ANYRES32=r5, @ANYBLOB='&\x00\x00\x00\x00\x00\x00\x00', @ANYRES32], 0x10) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000000c0)={{r6, 0xffffffffffffffff}, &(0x7f0000000000), &(0x7f0000000080)=r3}, 0x20) sendmsg$inet(r4, &(0x7f0000000500)={0x0, 0x4003e80, &(0x7f0000001740)=[{&(0x7f0000000280)='>', 0x20000281}], 0x1}, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x1c, 0x10, &(0x7f0000000180)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3}, {{0x18, 0x1, 0x1, 0x0, r0}}, {}, [@generic={0x7, 0x5, 0x2, 0x4, 0x4}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x1}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f00000002c0)='syzkaller\x00', 0x3, 0xf9, &(0x7f0000000680)=""/249, 0x41000, 0x56, '\x00', 0x0, @fallback=0x36, 0xffffffffffffffff, 0x8, &(0x7f0000000300)={0x6, 0x4}, 0x8, 0x10, &(0x7f0000000380)={0x5, 0x10, 0x6, 0x6}, 0x10, 0xffffffffffffffff, 0xffffffffffffffff, 0x1, &(0x7f0000000400)=[r7, r7, r6, r6, r7, r0, r6], &(0x7f00000004c0)=[{0x4, 0x1, 0xe, 0xd}], 0x10, 0x3000000}, 0x94) bpf$BPF_PROG_QUERY(0x10, &(0x7f0000000940)={@map=0x1, 0x34, 0x1, 0x4db, &(0x7f0000000840)=[0x0, 0x0, 0x0], 0x3, 0x0, &(0x7f0000000880)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000008c0)=[0x0, 0x0, 0x0], &(0x7f0000000900)=[0x0]}, 0x40) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000a80)={0x0, r2, 0x0, 0xd, &(0x7f0000000a40)='sched_switch\x00'}, 0x30) 10.870927964s ago: executing program 1 (id=1101): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x14, 0x16, 0x0, &(0x7f0000000040)='syzkaller\x00', 0x10000, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xe}, 0x94) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x19}) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(r1, 0xc044565d, &(0x7f0000000080)=@mmap={0x0, 0x2, 0x4, 0x0, 0x51cf, {}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, "6b6ff202"}}) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x802, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='.\x00', 0x0, 0x0) renameat(r3, &(0x7f00000004c0)='./cgroup.net/devices.allow\x00', r3, &(0x7f0000000500)='./cgroup.net/cgroup.procs\x00') ioctl$KVM_S390_VCPU_FAULT(r3, 0x4004ae52, &(0x7f0000000080)=0xfffffffffffffffb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000340)={'\x00', 0x9, 0x9, 0xfffffffe, 0x2, 0x5}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x5}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) close(r0) 9.73781813s ago: executing program 4 (id=1103): socket$qrtr(0x2a, 0x2, 0x0) r0 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r0, 0x0, 0xf, &(0x7f0000d10ffc)=0xfffffffa, 0x4) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r0, 0x84, 0x64, &(0x7f00000000c0)=[@in6={0xa, 0x0, 0x0, @private0}, @in={0x2, 0x0, @multicast2}, @in6={0xa, 0x0, 0xd7d9, @loopback}, @in={0x2, 0x4e21, @dev}], 0x58) r1 = socket$caif_seqpacket(0x25, 0x5, 0x3) sched_setscheduler(0x0, 0x2, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x3f, 0x0, 0x0) ioctl$INCFS_IOC_FILL_BLOCKS(r1, 0x80106720, &(0x7f00000011c0)={0x2, &(0x7f0000001180)=[{0x0, 0x0, &(0x7f0000000080), 0x1, 0x1}, {0x0, 0x35, &(0x7f0000001080)="d84f2c038599cec2edab45544b0d858d813ebe290497b6f4935c82a814f21f2021edea8c751c674bd2b67df554a972eef2c33d68ff", 0x1}]}) prlimit64(0xffffffffffffffff, 0x0, &(0x7f0000000000)={0x200, 0x8ed}, &(0x7f0000000040)) mount(0x0, &(0x7f0000001240)='./file0\x00', &(0x7f0000001280)='fuseblk\x00', 0x28db800, &(0x7f00000012c0)='^@\'\x00\"#\x00') prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000000c0)={0x7, 0x100008b}, 0x0) openat$sw_sync_info(0xffffffffffffff9c, 0x0, 0x408040, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x1) r2 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r2, &(0x7f0000002700)=""/102392, 0x18ff8) r3 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) fchdir(0xffffffffffffffff) r4 = open(&(0x7f0000000040)='./bus\x00', 0x103a42, 0x80) ioctl$VIDIOC_S_DV_TIMINGS(0xffffffffffffffff, 0xc0845657, &(0x7f0000000240)={0x0, @reserved}) ftruncate(r4, 0x2007ffb) sendfile(r4, r4, 0x0, 0x1000000201005) ftruncate(r4, 0x30) 9.169911894s ago: executing program 3 (id=1104): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$loop(&(0x7f00000000c0), 0x3, 0x200) syz_genetlink_get_family_id$tipc2(0x0, 0xffffffffffffffff) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(0xffffffffffffffff, &(0x7f00000001c0)=ANY=[@ANYBLOB="00000000ffffffffffffaaaaaaaaaabb08001e00002c00000000002f9078ac1e0001e00000"], 0x3e) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0xd, 0x4, &(0x7f0000000040)=@framed={{0xffffffb4, 0x0, 0x0, 0x0, 0x0, 0x61, 0x14, 0x20}, [@ldst={0x5}]}, &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x48) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000700)={0x17, 0x4, &(0x7f0000000240)=ANY=[@ANYRES32=r1], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x13}, 0x94) socketpair(0x18, 0x0, 0x2, 0x0) sendmsg$TIPC_NL_MEDIA_SET(r0, 0x0, 0x8000) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, &(0x7f0000000000)=ANY=[@ANYBLOB="00020c0000000c0002"], 0x0, 0x0, 0x0}, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r4 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r4, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r4, &(0x7f0000000000), 0xd) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='net/l2cap\x00') read$FUSE(r5, &(0x7f0000012380)={0x2020}, 0x2020) ioctl$VIDIOC_S_FMT(r5, 0xc0d05605, &(0x7f0000000040)={0xc, @raw_data="44582894fbb882bef60d89e6441c4574cd1e6545b3c4591d0cc926f6c472c238401613f7b6c97665a076e0db6079383453d65c7f0e0a8a23b7f0934c9a24d936c694edd6843803e2f6d14e597a0c021533cd029689a3461f50a3d1243bc661a2adb768fc0c84f4925a42aa700f05dd9c15fb367023ca4658621b401c637169f3aaf4cf0101b9dcce2961206b62d0c5f9b0f3221a6b7b7b05fb30f5ab716fea715567416dc525a38bfd2b1d4622313d774993a76edd18067dea5462ea283e4a13d12b47bc895b6f06"}) bpf$PROG_LOAD(0x5, &(0x7f00002a0fb8)={0xd, 0x4, &(0x7f0000000280)=ANY=[@ANYBLOB="850000002e00000076000000000000666100000f000000009500000000000000e6b549e8a4871cb5b0766c167c4ba699444486d173e94e46b8d15de28680951105a8936e59522778fe06fc3ac40306d829ba509e1d19cd0993ce02c1f65840978cc138f0fb985e0f50e1520c4c5c8e91b959aa31545a26aa6ddddb5793e69b9f32efd86a2e9ed52674599ee3a6ffdf451e9567fae0b530d4246f510d4886996a47856f2b7da01e3d01bb4a06241b4c4e4f8ad0d4bcb755bc32ad21318351bb5c213ac0558db860f5b4689b4da22e483cf4388bc02d48"], &(0x7f0000000000)='GPL\x00', 0x4, 0x99, &(0x7f0000000180)=""/153, 0x0, 0x0, '\x00', 0x0, @sock_ops}, 0x94) 8.243445454s ago: executing program 4 (id=1106): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, 0x0, 0x0}, 0x94) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x41, 0x0) ioctl$TCSETAF(r0, 0x5408, &(0x7f0000000080)={0x49dd, 0xffff, 0x2, 0xc003, 0x0, "fa3d76170000001b"}) sendmmsg$inet_sctp(0xffffffffffffffff, &(0x7f00000032c0)=[{&(0x7f00000002c0)=@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, 0x0}], 0x1, 0x0) r1 = syz_io_uring_setup(0x1f87, &(0x7f0000000080)={0x0, 0x0, 0x13580}, &(0x7f0000000100)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r2, r3, &(0x7f0000000140)=@IORING_OP_MSG_RING={0x28, 0x0, 0x0, r1, 0x0, 0x0}) epoll_ctl$EPOLL_CTL_ADD(0xffffffffffffffff, 0x1, 0xffffffffffffffff, &(0x7f0000000100)={0x90000004}) bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x3, 0xc, &(0x7f0000000340)=ANY=[@ANYBLOB="0000000000000000b7"], 0x0, 0x1, 0x0, 0x0, 0x0, 0x24, '\x00', 0x0, @fallback=0x23, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0xa101, 0x0) ioctl$TCSETAF(r4, 0x5408, &(0x7f00000000c0)={0x4e00, 0x0, 0x730, 0xbdff, 0x10, "feeeff000000001b"}) write$binfmt_aout(r4, &(0x7f0000000100)=ANY=[], 0xff2e) ioctl$TCSETS(r4, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x3, 0x0, 0x0, "0062ba7d82000000000000000000f7fffeff00"}) r5 = syz_open_pts(r4, 0x8182) r6 = dup3(r5, r4, 0x0) ioctl$TIOCSTI(r6, 0x5412, &(0x7f0000000000)=0x17) io_uring_enter(r1, 0x14, 0xb9c, 0x3, 0x0, 0xffffffd5) write$binfmt_aout(r0, &(0x7f0000000240)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000180)={0x0, 0xfffffffe, 0x1000000b, 0x8, 0x4, "00000000000000000000c2041a02003d00"}) r7 = syz_open_pts(r0, 0x0) r8 = dup3(r7, r0, 0x0) ioctl$TIOCSTI(r8, 0x5412, &(0x7f0000000000)=0x17) syz_open_dev$evdev(&(0x7f00000000c0), 0x0, 0x200) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)={0xbc, 0x3e, 0x107, 0xfffffffe, 0x0, {0x1, 0x7c}, [@nested={0x4, 0x142}, @nested={0x91, 0x1, 0x0, 0x1, [@generic="e971721d7dcc99a91967d748fc4fcf4b032e799de2cdc1401ce2df33916d480d10091079382dc66b3ee2fd160648cf255a15fb3741bfc10bd3062e337f161124281157b3caae0436cbae864efb0b643aa0810b7474be56ad533153f2261300000029cd78295703bc4ce6b240c5611afe2fbcea151a024b0976c3f40638b6e90483d6fd54cf1f68aeaa740f0e84"]}, @nested={0x10, 0x2, 0x0, 0x1, [@nested={0xc, 0x17, 0x0, 0x1, [@typed={0x8, 0xb0, 0x0, 0x0, @fd=r8}]}]}]}, 0xbc}, 0x1, 0x0, 0x0, 0x404c0c0}, 0x2000c000) r10 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) setsockopt$ALG_SET_AEAD_AUTHSIZE(r6, 0x117, 0x5, 0x0, 0xffff) connect$bt_sco(r10, &(0x7f0000000040), 0x8) 8.057038333s ago: executing program 0 (id=1107): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) getpid() r0 = openat$uhid(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) write$UHID_CREATE(r0, &(0x7f0000000a00)={0x0, {'syz0\x00', 'syz1\x00', 'syz0\x00', &(0x7f0000000940)=""/3, 0x3, 0x0, 0x4, 0x0, 0x0, 0x4}}, 0x120) read$FUSE(r0, &(0x7f0000006b40)={0x2020}, 0x2020) socket(0x2, 0x3, 0xff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) sendmsg$AUDIT_SET(0xffffffffffffffff, 0x0, 0x8004) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_init_net_socket$nfc_llcp(0x27, 0x2, 0x1) r1 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r1, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) setsockopt$XDP_TX_RING(r1, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'veth1_to_batadv\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r1, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r1, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r1, &(0x7f00000001c0)={0x2c, 0x8, r3}, 0x10) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_REG(r4, 0x11b, 0x4, &(0x7f00000000c0)={&(0x7f0000000000), 0x101000, 0x800, 0x3, 0x1}, 0x20) setsockopt$XDP_TX_RING(r4, 0x11b, 0x3, &(0x7f00000003c0)=0x800, 0x4) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000300)={'veth1_to_batadv\x00', 0x0}) setsockopt$XDP_UMEM_COMPLETION_RING(r4, 0x11b, 0x6, &(0x7f0000000180)=0x20, 0x4) setsockopt$XDP_UMEM_FILL_RING(r4, 0x11b, 0x5, &(0x7f0000000140)=0x4000, 0x4) bind$xdp(r4, &(0x7f00000001c0)={0x2c, 0x8, r6}, 0x10) openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) 7.405243107s ago: executing program 3 (id=1109): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000040), r0) sendmsg$ETHTOOL_MSG_DEBUG_SET(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000001500)={&(0x7f0000000140)=ANY=[@ANYBLOB='D\x00\x00\x00', @ANYRES16=r1, @ANYBLOB="0100000000000000000008000000180001801400020073797a5f74756e00000000000000000018000280080002000a00000004000100080004"], 0x44}}, 0x10) 7.19695202s ago: executing program 4 (id=1110): r0 = socket(0x6, 0x4, 0x1ce5) bpf$PROG_LOAD(0x5, 0x0, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x20, 0x0) pipe2$9p(&(0x7f0000000240)={0xffffffffffffffff}, 0x4878869b198caffc) syz_emit_ethernet(0x2a, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f0000000240), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = syz_init_net_socket$netrom(0x6, 0x5, 0x0) r4 = shmget$private(0x0, 0x13000, 0x1, &(0x7f0000feb000/0x13000)=nil) shmat(r4, &(0x7f0000ff7000/0x3000)=nil, 0x400c) mremap(&(0x7f0000ff8000/0x3000)=nil, 0x3000, 0x4000, 0x0, &(0x7f0000ffc000/0x4000)=nil) connect$netrom(r3, &(0x7f0000000080)={{0x6, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, 0x8}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @default, @default, @rose={0xbb, 0xbb, 0xbb, 0x8, 0x0}, @default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}]}, 0x48) mount$9p_fd(0x0, &(0x7f0000000180)='./file0\x00', 0x0, 0x1854000, &(0x7f0000000380)=ANY=[@ANYRESHEX=r1, @ANYBLOB='\x00\x00\x00', @ANYRESHEX=r3, @ANYRES16=r0]) socket$inet6_udplite(0xa, 0x2, 0x88) r5 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f00000001c0)={'wlan0\x00'}) sendmsg$NL80211_CMD_FRAME(r5, 0x0, 0x200040b4) r6 = socket$alg(0x26, 0x5, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r8, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB], 0x64}}, 0x1) sendmsg$nl_generic(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4048011}, 0x48080) setsockopt$ALG_SET_KEY(r6, 0x117, 0x1, &(0x7f0000000180)="dd9d480e", 0x4) 7.18965222s ago: executing program 3 (id=1111): sendto$inet6(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) socket$nl_route(0x10, 0x3, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x7, 0x100}, 0x0) r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x6, 0xc, &(0x7f00000006c0)=ANY=[@ANYBLOB="1802000000000000000000000000000085000000bc00000018010000696c6c2500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000008850000000f00000095"], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000600)={r0, 0x0, 0xe, 0x0, &(0x7f0000000000)="feeae3a2b93f4fbc8d26fc0ed982", 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9}, 0x50) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) getsockopt$inet_sctp6_SCTP_PR_ASSOC_STATUS(0xffffffffffffffff, 0x84, 0x73, &(0x7f0000000180)={0x0, 0x7, 0x30, 0x90d, 0x10}, &(0x7f0000000100)=0x18) mbind(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0xc000, 0x0, 0x81, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x8031, 0xffffffffffffffff, 0x4000) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) r3 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOGETCMAP(r3, 0x4604, &(0x7f00000001c0)={0x2, 0x1, &(0x7f00000000c0)=[0x0], &(0x7f0000001280), &(0x7f0000001200), 0x0}) sendmsg$NFT_BATCH(r2, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000000740)={{0x14, 0x10, 0x1, 0x0, 0x6000, {0x5}}, [@NFT_MSG_NEWSET={0x3c, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}]}, @NFT_MSG_NEWSETELEM={0x14, 0xc, 0xa, 0x101, 0x0, 0x0, {0xa, 0x0, 0x6}}, @NFT_MSG_DELSET={0x1d4, 0xb, 0xa, 0x401, 0x0, 0x0, {0x3}, [@NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_DATA_TYPE={0x8}, @NFTA_SET_USERDATA={0xc3, 0xd, 0x1, 0x0, "de2afa69c2d2092b5c0d3cadef380d6cf5fb95f08b679d820168a42ae8eb31d33b803524b67230d5c5360308480f8db52dfeea23d993d753d2a6eb96ddeffb95cf5efd0cacfb9813eb01e766236a3a8e86b15c376fead09480b9cc27a86f03e122e8950529c927de9bf1631a21974b4d85049224120472430d78eedf84a850558c6e35779318f10df74a2b9f083e34bc75bb5f588442914b94ceffd43233634dac032a92de13ad3157fb812a782e10d10d91d9230a15c928771e179081c7a6"}, @NFTA_SET_USERDATA={0xe9, 0xd, 0x1, 0x0, "d52a6d2534ee64b95992f37d9ba2da6835a9c9d69033a895661ccd074ccae3a00f8776fc974b63a655c914803a3145d8e6d8dd9ded65828c950fbcb50e9af47512cdd2911424cd482496e3d73c05251e2a284ec326dab15ae265db71e6b5a0b069923e4a92efd346ff4a06bb0e0681aeade8e11911472a4ecc2352f2bb55b1817de9d63c2aa403169a42b313d5829b19862e4c105de9a7cfaa6807e923b00f74fbcfaf269e347a8c27bab3028ee3fdea7aac1a659481481aba4ee009c90313a5bb8316c9a0438cf0589d92739aeda9bb459762c6f137c2b368cad36d83ac05d137e25788af"}]}, @NFT_MSG_DELSET={0x310, 0xb, 0xa, 0x3, 0x0, 0x0, {0x1, 0x0, 0x6}, [@NFTA_SET_OBJ_TYPE={0x8, 0xf, 0x1, 0x0, 0xa}, @NFTA_SET_EXPR={0x34, 0x11, 0x0, 0x1, @socket={{0xb}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SOCKET_KEY={0x8}, @NFTA_SOCKET_LEVEL={0x8, 0x3, 0x7f}, @NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x17}]}}}, @NFTA_SET_KEY_TYPE={0x8, 0x4, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_SET_DESC={0x1ec, 0x9, 0x0, 0x1, [@NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_DESC_CONCAT={0x188, 0x2, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x461}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xc}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x200}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7fe00000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0xc, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa9}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x48c42f7a}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3ff}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x25}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1ff000}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x24, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x9}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}]}, {0x3c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x64}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}]}, {0x2c, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xca}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x4}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x8}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}]}, {0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x100}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xa3a0}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}]}]}, @NFTA_SET_DESC_SIZE={0x8, 0x1, 0x1, 0x0, 0x5}, @NFTA_SET_DESC_CONCAT={0x8, 0x2, 0x0, 0x1, [{0x4}]}, @NFTA_SET_DESC_CONCAT={0x48, 0x2, 0x0, 0x1, [{0x44, 0x1, 0x0, 0x1, [@NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x34}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xb53}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x7}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x6}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xfffffffe}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0xca}, @NFTA_SET_FIELD_LEN={0x8, 0x1, 0x1, 0x0, 0x5}]}]}]}, @NFTA_SET_EXPR={0x1c, 0x11, 0x0, 0x1, @numgen={{0xb}, @val={0xc, 0x2, 0x0, 0x1, [@NFTA_NG_MODULUS={0x8, 0x2, 0x1, 0x0, 0x8711}]}}}, @NFTA_SET_EXPR={0x4c, 0x11, 0x0, 0x1, @tproxy={{0xb}, @val={0x3c, 0x2, 0x0, 0x1, [@NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x1}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x11}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x10}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0xf}, @NFTA_TPROXY_REG_PORT={0x8, 0x3, 0x1, 0x0, 0x1}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x18}, @NFTA_TPROXY_REG_ADDR={0x8, 0x2, 0x1, 0x0, 0x3}]}}}, @NFTA_SET_EXPR={0x58, 0x11, 0x0, 0x1, @flow_offload={{0x11}, @val={0x40, 0x2, 0x0, 0x1, [@NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz1\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_FLOW_TABLE_NAME={0x9, 0x1, 'syz2\x00'}]}}}]}, @NFT_MSG_NEWTABLE={0x38, 0x0, 0xa, 0x101, 0x0, 0x0, {0x1, 0x0, 0x8}, [@NFTA_TABLE_HANDLE={0xc, 0x4, 0x1, 0x0, 0x1}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}, @NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x594}}, 0xfb165807ec25c809) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000340)={0x11, 0x3, &(0x7f0000001680)=ANY=[@ANYBLOB="1800000000030000000000000000000095"], &(0x7f0000001700)='GPL\x00', 0x0, 0x0, 0x0, 0x41000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000000c0)='contention_end\x00', r4}, 0x18) r5 = openat$vimc1(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VIDIOC_SUBSCRIBE_EVENT(r5, 0x4020565a, &(0x7f0000000040)={0x2, 0xdda, 0x1}) ioctl$VIDIOC_UNSUBSCRIBE_EVENT(r5, 0x4020565b, &(0x7f00000001c0)={0x2, 0x8, 0x2}) close(0x3) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) socket$nl_netfilter(0x10, 0x3, 0xc) 7.172061673s ago: executing program 0 (id=1112): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x102}, 0x0) getsockname$packet(0xffffffffffffffff, &(0x7f0000000240)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x40) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e25}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0x5, 0x16, &(0x7f0000000240)=ANY=[@ANYBLOB="61128c030018000061138c8800000000bf30000000000000070000000009240b2d03010000000000950000a7000000006916700000000000bf67000000000000b5070000fcff0304670600001f000000370390ff0ef90060bf050000000000007e650000000000006507f9ff01000000470700004c0000005f75000000000000bf54000000000000070400000400f9fead4301000000000095000000000000000500000000000000950000000000000032ed3c5be9529914953170d2d7ffffff8ecf264e9981db7d04df3244c7bd7e7e7f2f1754558f2278af6d71c19a5e12814cb1d8a5d4601d15871637b65f8903dc8700a0b9bdb7dd399700d6c4f6f3be4b369289aa6812b8e007e733a9a4f16d0a3e1282ee45a010fb94fc9de56c9d8a814261bd81762bab839dfa66810b5b40d893ea8fe0185473d51b546c087431d770000000767c955cfa1f6ab689fde4de5f832c8b664e73b99b6c2e0ab330e1c7feada70600000000000000b7010001000000009af619e3cca4d19e0dee5eb106774a8f3e6916df85aaf34c4756ad3a6d9fee0000000000000000c8fb735fd552bdc206004aeb0743eb3dc819b6cf5c8a0700000000000000a13d0045fb3cdaffa673a6bb55d8c85f21dce44aba5387e35350481aedac065b5031e56723888fb126a163f16fb2ad9bc1172bec63222d20cecac4d03723f1c932b3a6aa57f1ad2e99e0e67a993716dbf580469f11294b4800a045ea11b3566bf3a649878e582f2af97787f696649a462e7ee4bcf89cbf2f0800000000000000b2c4acb07a10d6732f54beb40000040000000000000000000000000200f674629709e7e78f4ddc211bc304f0bd9d42ca019dd5d022cf74686e9fbe2562671cd47840a7afaab43176e65ec1118d46e4e827f3477523dcfa17690884f8d2001e03a651bb96589a7eab010e861bbd0000000000000000c5904c647802cf86f1b4c3005f33d83f84e98a72fbbecd106425563d80bd0d0d703f37ca153f601ae899a53f6715a0080034b0c94cce69945205480a55c22fe394ac000000000000000000040000000000437d57defb79ea6a58b83eeed729a2f95e6a1fc3857fb51b324be00000000000000090867f7a3b9bc43717188cb8426286fc55fc57cc3c6de4aa67babf350709e282a4f2bf59f46e20465eae865dbfd533b1cb2d540d0490cd5248715c74b6bd0248a9a0b413bbdfb5351defc6e34a961f3593920411e112c9df23a29c072d3460eb37beb5bbc04600c64acad9a04ffe62875177b51d2f0c6d7194c26789d2bec2d0846831455b8fcd03beaeca2c1335d8a49a92f9d2bef5f485c4fff4cf710b7d00000000000000009d47d564a838bdf8901a719431a9b0ef918ec0ec79037cb61df16379e3bf2a8100000007e8512e21080315e62559e8dd67dae85177d899d9e078f80585837f0e943b8820b19c75d243a78d8c2093c59cbc4c55f1578cff737502ea2d8d0b9dc946dcb38692dcc8db84834cc7726429cb20603b5338184f9856eeaec437fc3446b6c5ffe5db28aa802e37d3c4f259d616307d8aa46ca094049c0ddc1caaed5485b4ff030000182620bcba2316f9e6df0c8647f6ff0000000000000000386096e4a4ff86042f0b42027ff933d2dfe2d5baffacc9dc2411302a185ea454af5839be28b7d040c1fe1ce0fd63fa7f32b8ab6cd6a8b8bf1b693e4ffeca635d84c376b03a58677dd9f8c2a6fa126c7dad3f9e939c92d63ab1cf2fbea26a60b951914aba5c0696cc64e66b9b0f2c4444f8c391c0d9b647a3be4885a055ce3879a91fb62ca97e6526286c14c80b6dc981c5ae6ebf0778ea01a3a44e01ab79bcddbb83266a1ce1a1dea83ebb89d07b4d05aa09ad2904040e7784e96cd66b04204d47b1c66d5a84e7c3de1d1062fd8a23d1b402003c177e76dbca599691164ade323ad4a17abe99975cba748bc2379eed5a83dc94947eb18976db6ca6d35bfb65a3d8b5129d5263b66dbae6c2baa9bbec017646569fa99537aa453f3e6b2acebeddb6c32a87455f351efcd8385100f33d6b0c3195e229bd30260941825ba884d7db07e1212033409e62d7154cc68a7ee910e393470cdb781817f85373a647fd1b626035b666f224a66c0e47e15c6b836b324318507501a0f4b2cc9153167fd839a483615cbc2ad1a7d1528f01bf91b950a9bcd7d06491e1a355e476365f653d2d94ba898ab8d64d70bdb364ef3adb5ba1e4d9d5002da76ccec5d5184e912aaf5a945ae062e670fafb8cf0afee51c851546bb38c5ef303000000000000002ecdc2b82059750f019a418e3e8d20b6bf768a7db1f8472713452553149a4634418de7eda7b2e682271c6e62f5dfaabba46560dfa410e1f334a5f60791b275368469ddc42f7712bff1689f2ffbf5268cc0572e23afd4c402b154ae94c1f65d7d4a79272945287c79b4b70183d2cde66c7225106a064a1800d777372b2b43326821d5c1c78fda699c7484f3e5fc8bbce6fb3039569646b0de22c431d90c12d48e314d8a5ef4db14a110da070000002c4f7bd7f36f814ed92197fe3eb0843c2681c609231825b8a27ba301142cec8a6fd85965f83ff4dd40296e5fb5678d93d0daee45c43bdb9bde9c1d1c988b909fdf78cfda5da3dc28792b10fb8f3f22ece745c074f86f471489337a9a8d9ad7f310aa50c983b490f561bc420289b6aa0fc3f43f8a4548aa9c723ce466287760f919afbb94b0410ff06071de3aa1c199f407347af666713096a422fbc70671ac08f9256ab0079c101a724136352af2895899effda7bcd127ba98521eb4b04b2a821935ee3b216190e21fb059f9519c4804283d2ce09977842ff7309ad2c4d8f0420dfc8cdb1b37ad52985a88ca4cdc1e37715362a59f7c9c7df793d69f974399859e622ec3a1bab735a1aa489fe50619fe399eddaf92f67755cb54824685444a58731ee166ae65412709b853a5df7ce44220fc188c00291843d66e69da3744f39f5f6113fbe390b22cdbefb90ca2a51b1ff21f384e7bf076825aadaf02da77eeefb8875d630b7575e661b90eb6cd98674c92f179b2675b1f6c86712846ddae87bb3a3887b56292356270e85888c25a1c8ae958906ef6b71e1b800107da1c5608fe05d2f4265a5300000000000000007c737c911c049ae7dc9d77edecaf9685c53ac264e9f02ffcf0318af80c99ea2020b1e1f47cfdd6097c49b5f4bb92bb9133df719f35d4bf730784f1caa8e4e16f4eeb535c059a700d57e4d6c83c4a35a6ef44f135657d3d41856235253326d937125b6f23af7eb95bac231b84c6935a3a6d24d18f7e379db2fd5e76d5ad0d5b4a6c155e8759eb0e7b39ef433861158bd496ecafb3d1c50294e43d5895df1a2de536f5d85e0a000049277bc09533ceead6812fdfb5ef59b15069ea0df6a3eee0484c848fe4e6e7461ffc3917e4e07d250d9459ebea5fd4e26fc04eb38e70597fcb693cb2f7506f5f50b9f73a25bb83b6c71240e5d725ff567d9745a3ba5462524648a93360fb2b9feb1401e30996e1e7d14bb8db59880cde130af0a6a0e6152a6e3a8a684cabf379d4aa33c896bca694ce0180000000000000041caca10fe3ce74f1b8156d8155a4e11d2f35674dff1aa5e749deffffffffb946192820d223f4f0a1a7a2be83872662477884d65af42bcac801d0c667fba32e16ead8f076eed944d5998bca285c25349c6f26485902316c156eee9dcaa64f8a889abb1a890b23c7de6b2b0a6128545efc3ee8e60ea8eafa617ec3f0bfb1e23c4f75bc2a649a886bf4d5378c58259fddea066f1d70df9633af91752bf41a0d4d0929c34472a6f7110de1420800000000000000ca07ba65ce67dd46909ed693d71a5de47fe26a4eb2f4d514029b11f3f0c3ccb2403db497a55d23c25003ba864cdaf6e732f74e11d1a58e89f60267e60d79f467b181d636c9300420b30760bf861195eeb74275e9c4ed71f0e9fda02bdbf8aaa3e23a6d22dd423541b6acdd386a686bc8b128f724567d4c4908391b979a1c7102f5be7ed9db7a36ecfc3b9e0ab0eedde34700000000bec5fbefb008005888ce01eb816f2873e4c59facc7be45b2ab04b1456da413e3f7cf345d6fed0bff0800f8c3018bd0ea78ed54c8b684c797390bf5cad492bff0d97e553e42aba229446354cb4f5825915eccc911e7deee66873c20ffd06e63c27b8a12d757210a43870a0ef4ba3bad01c492d792c1535aeff946f3415912b5abbff35d1cd17c842175357a4bc758b4a943e06a7569fa1e1e4e017e43e8e47914d1000000000000000000000000000cd6b36d72dbc0d8000000c95d5ccace09e52960dbdf13b62f586b47ade41458b77834a573687780117829310ece7950fabcb63c63e18b207cbe936ee9a9a37879d42c66c2a72dfef46013ada19eb8d7e9f35267d0b72d591d0c2f92e2e667eed068310056ec5682b4c2bd946e657f2d9bce51da84f1e3b7d073265f352481b81703e0ecb59f70daf545215151b2b01b2bba1545de5d785ce281000000000000000000000000000000af9637ac06897446708dda1bd7b91be06c3f66def98618eb55bd5652d2ae6036402d69db587e87d04b6e4b1c86328adfcc7a22d77e8db6b1024f6bf7aec85a7f4241fb6b326acae3d9a4f4a0e8b723c43aae4f909f40d7167d1afde58812163d292666cf967e16c25889683658fdc86c820246d4009b3c4e8db0fe57735fb577b9f8e9d5fd9843615ec7c7affa29c04a7e8ea439d4938710039a55da15142ed876e581b4760b3483367fd96f0531ea7f3c6bb4193a76ea6b805b45a74365c15f41b8b542f21a83cae1aff4a858d551b95a2ba77fc8a1109f11e7b18d6f825587bb986e13ff37f111329feb2a09ebc54f1ee1ccd056ff9ec0ff0ce1c1ec5bfab4119a452eef335c0fe2b6bfcd635ef5979352de3801bdba7c145cdfb3ab07b45f13b8f45772c9f9c8285bbe14605879e4ddd78bfb6aa3444b7b3ef1713c58d3d348ea764370002f393e10ec3cf3ef1ab0aa1cab9596fe467c7288893172cd97691a0f1d68ca0449f05902fb7f46f7d0e0d36a68abb3f075358cdb701eac9c3f7f19ab13a83314309861dfaa256ccb4400ffc2568b900be14d9e06b138daf2b41c38abba3b1b2de2f3a660af382b7bc0c1318c5cbdec02646f3e28d8eef763aac4a7fd39c15950764734b8d641e4d642e44c4e6b83d1c3dda34d7cda18c652a5d8d9b406d4df8554e2a5611023766c53e9b478d374112165480e887c923ff0a33551d8f270481230ef34d9168806d43278c977b77148371bd02ee1bcfd278a579be8cc6dc58f6e1f8ee7118ae792c30d4f76546a630f7859fd315513722a1b871d311dc28f40d15b7c631b81e58a6bf8891875fe21e8ebcf2925c2fb2b32dc8a0b1b5c7f806ba81a31b1eec700225a14ff8dc83b484ab80849558a0ffc1ab62b2a4545dbfee4d93ed5de4ffe4469ed88df341dc69ab8b1da80bc47cd127c9e1378020cf5d362819e42350f293dd305b4801932d9e07fc647628a8a84958319874295b3cab523b2f43704845d5785c6b3025fadd8442ab42ebfc3bc45efcf24396f1c2ce50ba96430f8feaa1f8bcd8635a4ce00209a8ebabfdf6f1b5129c0e2a40ba4d1b5e3d6249ee8fa5d2d77351b6fba38756dea4e35c8573eda42eac89b4c50b85346b5ede0ff4dca6a70b38177eb5cb8b8437bb533f6ea1de29e1f1fda88e3afe92482af05ed713dd00aa6a5f8381b5d421909462ac33dee4095afcc67a926e50d2cbe1507195b73f624349b132e7b6b339f9a41fad97f3b70e5808eb177c9e7cb154554644e960f29c5d56fd83d8530a6afc8924dcf01e4ef07e7d16bcef404af5ee3b7767dfbd45f0eee2b583d0159b45cca60a930f37d995b02701d2991761cab642165ed3e52961b7c612991c11028bd1d45ea3106018692facfa14996d3d26d5642566c2f592f67975ce3840131275ce29ed116b6f6eeae34aeae334250e7ae4e25e98cc63b4104fdc79ac676a3c11fd6e9a67dc134802d41c4b01a47e3ad5b6ecd6f4a05bf55c1756535374b7bc9e010966a1415a1e50b2fcb20f3d972d9d7a9f0baf841be4f514eb35c9edaac4b3ca7bfab8a53945d035019cf3321c9144961780413dbb21b89c01fe020bcbaa7fe6b4697b196cf7ac3aa014c48259f5b22b45b2ae023d6052644fa51fc0671d6c4e012607a2df05b6f444903ab3251bdd8d2c98adf9f77de7edbc9631b0e7283a5ce1130d99ae5697ce3ea41e3ba5394883c9899384208cba558d69afdc574cbf05a45ed56d07a41f75c55603561f0e8d54670a53e4b8162729bc34ab66babf31d2e86af5a72553ec045466678427ca42eb49b58c5e58980b73451029b88118d730cce2a48b5d6b9caa2c8fb7178ff90196bd1091568a70d1b7ac47585f6180767a2534401aaf0cda644a4c978b972e0bf7b156aa5d80aa1c3d70c0bcd25ab61122349dd78bc28c3e169adea7ac95e09b6a160204ac772f810193cecf495a9836e082b60626316c02dba83abb792422079947b0d887b87f4cd6bd7c82b00000000000000008207fc649dab3ec0be72d68e61c19c1943664bf9088981b19ebbd3f212a471c6b01d28c1f5a0e5d9e0b762f7cebc056ae8fdeb4448ecb291b08684de1ff1c209448223e3979469b18ea13d5d88532f5a45ae4a86d21bde29b472d65e77d5412dae907ffaca95182316d15dbf12b7d77dcf2154376ab3900ba7d8f026e8a566372cdae696cdec4baa7efcbfc3d250638ee391aa3ab3cdd0a3fc42b674e1943bd0a3e1d103fe00b8788dc5b8ba1602bbfd7ca2bf58c60790eddb10cfca9938e2cafce2"], &(0x7f0000001580)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4a, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x64, 0x0, 0xffffffffffffffff, 0x39}, 0x48) r3 = socket$inet6_sctp(0xa, 0x5, 0x84) shutdown(r3, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, 0x0, &(0x7f0000000180)) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r3, 0x84, 0x79, &(0x7f00000000c0)={0x0, 0x0, 0xb1}, 0x8) getsockopt$inet_sctp6_SCTP_PR_SUPPORTED(r3, 0x84, 0x71, &(0x7f0000000040)={0x0, 0xe6}, 0x0) getsockopt$inet_sctp6_SCTP_GET_ASSOC_STATS(r3, 0x84, 0x70, &(0x7f00000002c0)={r4, @in6={{0xa, 0x4e20, 0x4, @private1, 0x9}}, [0x1, 0x4, 0x8, 0x5, 0x8b0, 0x8000000000000000, 0x1, 0x4, 0x731, 0x101, 0xa77, 0x5, 0x4, 0x8, 0x1]}, &(0x7f00000001c0)=0x100) 5.512504463s ago: executing program 0 (id=1113): r0 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00', 0x0}) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000040)=0x1009110, 0x4) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="b4000000100009040000000000000000000022009c6b0eb6bc00a3b79f2084cc57420ea0b827c8a80209c4b20333624c8873aca9d12a7602fa0d5e39e7ce386cec49abcb1e075c9367066750b46bca9dc1e12c82c4ff615d7011a14d34b807df99c5308078195c06c30fa46594b99ee164e5a90e26a65ad7361b82495cd3e27a68ef981b09193342576ecf79ba708d48e12918fc1b5b28fab7c128344a7b2c97376537fe93bb74e88965a269108139184b1de51164c801d72676148433eb5b5f5587f995d452c22acbdc9f413699dcbda133c1fdb80a6ae554f840e94ebb712345eaa06e0e50b1fd4b0183e3e42ff7a8799a62", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT], 0xb4}}, 0x0) socket$packet(0x11, 0x2, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000000c0)={'bridge_slave_0\x00'}) (async) socket$nl_route(0x10, 0x3, 0x0) (async) socket$xdp(0x2c, 0x3, 0x0) (async) setsockopt$XDP_UMEM_COMPLETION_RING(r3, 0x11b, 0x6, &(0x7f0000000040)=0x1009110, 0x4) (async) sendmsg$nl_route(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="b4000000100009040000000000000000000022009c6b0eb6bc00a3b79f2084cc57420ea0b827c8a80209c4b20333624c8873aca9d12a7602fa0d5e39e7ce386cec49abcb1e075c9367066750b46bca9dc1e12c82c4ff615d7011a14d34b807df99c5308078195c06c30fa46594b99ee164e5a90e26a65ad7361b82495cd3e27a68ef981b09193342576ecf79ba708d48e12918fc1b5b28fab7c128344a7b2c97376537fe93bb74e88965a269108139184b1de51164c801d72676148433eb5b5f5587f995d452c22acbdc9f413699dcbda133c1fdb80a6ae554f840e94ebb712345eaa06e0e50b1fd4b0183e3e42ff7a8799a62", @ANYRES32=0x0, @ANYBLOB="fffffffed9526cfd8400128009000100766c616e000000007400028006000100000600000c000200367da1650e000000280003800c00010001800000002000000c000100a1000000c84200000c0001000800000008000000340004800c00010006000000ff0300000c00010004000000080000000c00010004000000020000000c000100050000000300000008000500", @ANYRES32=r1, @ANYBLOB='\b\x00\n\x00', @ANYRESOCT], 0xb4}}, 0x0) (async) 5.404758309s ago: executing program 2 (id=1114): socket$key(0xf, 0x3, 0x2) openat$rtc(0xffffff9c, &(0x7f0000000040), 0x0, 0x0) r0 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r0, &(0x7f0000000040)={0x2, 0x4e20, @broadcast}, 0x10) r1 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}}, 0x1c) syz_emit_ethernet(0x2e, &(0x7f0000000500)=ANY=[@ANYBLOB="bbbbbbbbbbbb000800240000200000000000119078ac1414bbe0d6e7010000000000000000fc7c7201a42f6df12b78433e30f36b0113ee0eef90f96324551dcdae5a2a79b3cea0bf26968f61c5ac941dcda624e28f3891ab8853334cfe972f1184349f03c8bf199ae81aefc3d4e156b954321e9471e4d2fc1afe8ef115d0a61ea31e73e367315096e422e6258d686cedbf122f6c0b2a96f24eea105336b48dc8616a67dbec02d557341f075e007ad2cac8f8626e3ada588f9cddae2a95a0eeaeb2127276162a994b5d5ab4170dfec20fc09ad1de8088867e0afbf07e701b7367d3e360069c6f9c11245da8f1"], 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000080)='contention_end\x00'}, 0x10) r2 = socket$vsock_stream(0x28, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0x12, 0x0, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="20000100000000000000000e7c00000400018008000280040072800000000000"], 0x20}, 0x1, 0x0, 0x0, 0xc000}, 0x8050) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x11, 0xb, &(0x7f0000000280)=ANY=[@ANYRES64=r3], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000000)={&(0x7f00000002c0)='contention_begin\x00', r4, 0x0, 0xb}, 0x18) r5 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000640)={0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000240)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20002801}}], 0x1, 0x4000000) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r7 = getpid() sched_setscheduler(r7, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r8, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x2000000}, 0x6e) sendmmsg$unix(r9, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r8, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r10 = openat$cachefiles(0xffffffffffffff9c, &(0x7f0000000140), 0x80000, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000000940)=ANY=[@ANYBLOB="611570000000000061136c0000000000bf3000000000000007000000ee0016055e03010000000000160500000000000069163e0000000000bf07000000000000260507000fff07206706000020000000140600000ee60060bf500000000000002f650000000000006507f9ff0100000007070000cddfffff1e75000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f1754558f2278af6d71d79a5e12814cb1d8a5d4601d295c45a6a0b9bdb7dd3997f9c9c4f6f3be4b369289aa6812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05002000c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ace0600006e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc0da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44e2a2235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d00c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20cecac4d03723f1c932fb3bba54b3a6aa57f1ad2e99e0e67ab9ff16d20000009f0f53acbb40b4f8e2738270001562ed834f2af97787f696649a462e7ee4bcf8b07a10d6735154beb4000000000000000000000000004000bc00f679629709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253880800000000000000690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43010000007b40407d000000210000000000000000005f37d83f84e98a523d80bd970d703f37ca364a601ae899a56715a0a62a34c6c94cce6994521629ab028acfc1d926a0f6a5489af8dc2f17923f3c40dfd1970a55c22fe3a5ac000000000000000000000000000000c1eb2d91fb79ea00000000815266b2c9e1bfadc7498e9dda5d000000bb0d00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e190deae46e26c596f84eba9000000000000003cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631822a11dc3c693962895496d4f6e9cc54db6c7205a6b26f92121ef53e553acdf42068fff496d2da7d6327f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a0337302f3b41eae59809fd05d12f6186f117b062df67d3a63f3265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089dad7a8710eec53f1b11cced7bc3c8da0c44d2fbf9f6f3ff3be4d1458077c2253b0c7c7a0a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631dbaa74f22bad050e9856b48ae3a03a497c37758537650fe6db80300c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0afa1e1c758a0079b747067312e9815a21cb3f1f8150d999d788535a4d3114dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f8709d87b27f8a5d9121fdc058447b728f134f72062fc4b1ca0780b1a7af137ff7b4ff139604faf0453b65586f65c7943d56b52f06c870edf0c5d744b5272b44c23480b2bdbff947c4dfa108cbb88202eeb81f428a5b3c299848649e1a6bff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee1562078fc524b3baf49a0be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2a3bc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca871073f6bd61940aabc86b94f8cbde4d47060400e722a6a2af483ad0d3415ed0f9db009acaba9eaea93f811d434e00000000000000000000d154672fea96aedf346279ec00000000000000000000d535d41b0067f01e2e54b9154d876020b669640ead4ca44631fadf7c4ac39a1b331dbdcd52b36df021b731ef1f92330d347f88ced5c1aaadbcdd8d2257e3a9a7c7494fadf9be36f7a2334ee6e9446fa1fd486f85d672a77dc5bd21463994d49f12016305a1e394d292b66840fe32b40ad665d241a8b8a32b3100450c32832789aa8a096f41201b585cd76631c88cf958e9e9047f5af1730c5e83db12460a0768fd4b62be6c41eed307048bac8d1f7f164574241e06027654b248dcc38749eee0c1ee7c61b3f6411a559c3d45637b11e440ed5a99109b8e71d28c3d677af5f0499c6d3fc6a129775056958c9df824ebe5fa9fb306b24a8a8334910627d03efe69d4b61c4345f048c5da8aca16cea848fa77d2507c920a6bd654b00e07789382ed902c80deeff2fd5c78f42e4353e5360c3e55962efd1331e6736eaf4ee27736fa54803ee8ec1a15266ffcd8b30368740b584c2559e691e542cab3d49db327db62328f159d1e0900b3e23e84dedcd1377aa15dbeab7db181bd66980c3557c7d9f7377fcb6023accb5c368a121acf70e5f4c3f2a0ea07011c7149ea979cab2ee65cf7ffa29152b7a8fed89575e6e6fd77d4d9463d21775abac886ee6a1f2d7d8523840438a73d6307a87e2f525867fc3af7ab74520a773ae26bae74cdd405a211e8833e1ba523cde51d04a7ca6732"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1c, r10, 0x8, &(0x7f0000000000), 0x8}, 0x94) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000180), 0x0, 0x0) ioctl$sock_inet_SIOCSIFDSTADDR(r5, 0x8918, &(0x7f00000000c0)={'dvmrp0\x00', {0x2, 0x4e23, @private=0xa010100}}) 5.403946489s ago: executing program 3 (id=1115): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = openat$vnet(0xffffffffffffff9c, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x880, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000200)={0x1, 0x0, [{0x400000f3, 0x0, 0x9}]}) sched_setscheduler(r1, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, 0x0, 0x0) sendmmsg$unix(r6, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$int_in(r0, 0x40000000af01, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) r7 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000040)={0x1f, 0x2, &(0x7f0000001c40)=ANY=[@ANYBLOB="85000000a800000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x13}, 0x90) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000500)={r7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000600000006"], 0x66) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000380)=ANY=[@ANYBLOB="0c000000040000000400000009"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000900)={0x0, 0x0, &(0x7f00000024c0), &(0x7f0000001280), 0xffffffff, r8}, 0x38) 5.353514051s ago: executing program 4 (id=1116): socketpair$unix(0x1, 0x2, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000002c0)=ANY=[@ANYBLOB=' \x00\x00\x00', @ANYRES16=r1, @ANYBLOB="79839674e88a58eddf253900000008000300", @ANYRES32, @ANYBLOB], 0x20}, 0x1, 0x0, 0x0, 0x4000}, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000180)={&(0x7f00000001c0)='afs_send_data\x00'}, 0x18) r4 = fsopen(&(0x7f0000000000)='cgroup2\x00', 0x0) r5 = fsmount(r4, 0x0, 0x8) r6 = openat$cgroup_subtree(r5, 0x0, 0x2, 0x0) write$cgroup_subtree(r6, 0x0, 0x5) syz_open_dev$swradio(&(0x7f0000000240), 0x0, 0x2) r7 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$sock_int(r7, 0x1, 0x3c, &(0x7f0000000040)=0x1, 0x4) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f00000000c0)=0x1, 0x4) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_TYPE(r8, &(0x7f0000000340)={&(0x7f0000000280)={0x10, 0x0, 0x0, 0x2000}, 0xc, &(0x7f00000002c0)={&(0x7f00000004c0)=ANY=[@ANYBLOB="4c0000000d0601020000000000000000050000070500010007000000050005000500000011000300686173683a69702c706f7274000000001300030068610002000000000000666163650000"], 0x4c}, 0x1, 0x0, 0x0, 0x4004}, 0x4800) connect$inet(r7, &(0x7f0000000080)={0x2, 0x0, @loopback}, 0x10) 3.514333331s ago: executing program 2 (id=1117): syz_open_dev$vbi(0x0, 0x3, 0x2) socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8010, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r3 = memfd_secret(0x0) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000000)={0x1, &(0x7f0000000040)=[{0x6, 0x0, 0x1, 0x7fff0000}]}) r5 = syz_init_net_socket$ax25(0x3, 0x5, 0x0) r6 = dup3(r4, r5, 0x0) mmap(&(0x7f00007be000/0x1000)=nil, 0x1000, 0xa, 0x64111, r3, 0x0) ftruncate(r3, 0x51a9497) sendmmsg(0xffffffffffffffff, &(0x7f0000000480), 0x2e9, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f00000004c0)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(cast6)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0xffffffffffffff3b) r8 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) syz_io_uring_setup(0x7fdc, &(0x7f0000000040)={0x0, 0x51b9, 0x1, 0x20040, 0x59, 0x0, r6}, &(0x7f0000000180), &(0x7f0000000100)) ioctl$TCSETSF(r8, 0x5404, &(0x7f00000001c0)={0x8, 0x4, 0x7fdfffff, 0x14, 0x14, "7125c7d095227c0c52ce9218789ed9c7ce039c"}) r9 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r9, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x10, &(0x7f00000000c0)=[@in={0x2, 0x4e20, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000240)=0x10) socket(0x3, 0x4, 0x4) socket$inet(0x2, 0x80001, 0x84) 3.389077558s ago: executing program 0 (id=1118): setfsgid(0xee00) r0 = syz_clone(0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0) r1 = syz_open_procfs(0x0, &(0x7f00000000c0)='task\x00') fchdir(r1) munmap(&(0x7f0000901000/0x3000)=nil, 0x3000) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r2 = gettid() sched_setscheduler(r2, 0x1, &(0x7f0000000080)=0x7) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r3, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ftruncate(r6, 0x10001) r7 = syz_open_dev$sndpcmc(&(0x7f0000000000), 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_SYNC_PTR(r7, 0xc0884123, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) keyctl$set_timeout(0xf, 0x0, 0x1) sendmsg$nl_route(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="400000001d00010001000000ffdbdf2500000000", @ANYRES32=0x0, @ANYBLOB="850b01000000000014000300766c616e3100000000000000000000000a000100aaaaaaaaaaaa0000"], 0x40}, 0x1, 0x0, 0x0, 0x90}, 0x0) mount(0x0, &(0x7f0000000080)='.\x00', &(0x7f0000000000)='proc\x00', 0x800000, 0x0) r9 = syz_open_procfs(r0, &(0x7f0000000100)='stack\x00') pread64(r9, &(0x7f0000000280)=""/3, 0x3, 0xfffffffa) 2.795103976s ago: executing program 1 (id=1119): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f00000001c0), 0x104140, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), r4) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB='@\x00\x00\x00', @ANYRES16=r5, @ANYBLOB="01022abd7001000000250f0000002a000e0068"], 0x40}, 0x1, 0x0, 0x0, 0x20000050}, 0x48000) r6 = openat$sndtimer(0xffffffffffffff9c, &(0x7f00000000c0), 0x200000) dup2(r0, r6) sendmsg$NL80211_CMD_GET_POWER_SAVE(r3, &(0x7f0000000180)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000140)={&(0x7f0000000100)={0x14, r5, 0x100, 0x70bd25, 0x25dfdbfd, {{}, {@void, @void}}, ["", "", "", ""]}, 0x14}, 0x1, 0x0, 0x0, 0x84}, 0x20041) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000040)={0x3, 0x2, 0x3000, 0x1000, &(0x7f0000feb000/0x1000)=nil}) r7 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x1) syz_kvm_setup_cpu$x86(r1, r7, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000080)=[@text64={0x40, &(0x7f0000000240)="bd66430f7ff4f46870cdd98541c03000660f3880ac4c0d0000000fc7777e3e3e470feb877c000000b9ce0800000f32b9e80b00000f32b805000000b94e00000064430f01d166b8e7008ee8", 0x4b}], 0x1, 0x20, 0x0, 0x0) syz_kvm_setup_cpu$x86(r1, r2, &(0x7f0000fe8000/0x18000)=nil, &(0x7f0000000200)=[@text64={0x40, 0x0}], 0x1, 0x0, 0x0, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.514873382s ago: executing program 4 (id=1120): syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000240)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) syz_io_uring_setup(0xa94, 0x0, 0x0, 0x0) r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x1}, 0x1c) r1 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r1, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) r2 = socket$inet6(0xa, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000f59ffc)=0x4, 0x4) bind$inet6(r2, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1, 0x2}, 0x1c) sched_setaffinity(0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000001b00)=""/102392, 0x18ff8) socket$inet_sctp(0x2, 0x5, 0x84) syz_open_dev$sndctrl(&(0x7f0000001440), 0x0, 0x141080) syz_open_dev$sndctrl(0x0, 0x0, 0x0) ioctl$SOUND_MIXER_WRITE_RECSRC(0xffffffffffffffff, 0xc0044dff, &(0x7f0000000080)=0x3ff) socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$int_in(0xffffffffffffffff, 0x5452, &(0x7f0000b28000)=0x20003) pause() fcntl$setsig(0xffffffffffffffff, 0xa, 0x12) r4 = openat$nci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) readv(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)=""/96, 0x60}], 0x1) dup2(0xffffffffffffffff, 0xffffffffffffffff) 2.413197084s ago: executing program 2 (id=1121): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000004c0)='dctcp\x00', 0x6) bind$inet6(r0, &(0x7f0000d84000)={0xa, 0x2, 0x0, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r0, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r0, &(0x7f0000000380)="e8", 0xff58, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty, 0x1}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r0, 0x6, 0xd, &(0x7f00000002c0)='reno\x00', 0x5) sendmmsg$inet6(r0, &(0x7f0000003900)=[{{0x0, 0x1802, &(0x7f0000000180)=[{&(0x7f00000000c0)="ba", 0x1}], 0x1}}], 0x1, 0x20000080) 2.21493723s ago: executing program 0 (id=1122): socket$inet6_sctp(0xa, 0x1, 0x84) (async) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) (async) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) (async) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) (async) openat(0xffffffffffffff9c, &(0x7f00000000c0)='./file1\x00', 0x105042, 0x1d3) (async) r2 = openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x129202, 0x0) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, &(0x7f0000000140)=0x2000) (async) r3 = syz_init_net_socket$ax25(0x3, 0x3, 0x0) ioctl$SIOCAX25CTLCON(r3, 0x89e8, &(0x7f0000000100)={@default, @rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, 0x63, 0xffffffffffff0004, 0x0, [@default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x1}, @null, @bcast, @bcast, @default, @bcast, @default]}) mmap$dsp(&(0x7f0000ff9000/0x2000)=nil, 0x2000, 0x100000f, 0x11, r2, 0x0) (async) ioctl$SNDCTL_DSP_SETFMT(r2, 0xc0045005, 0x0) (async) ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'wlan1\x00'}) ioctl$SOUND_PCM_READ_RATE(r2, 0x80045002, &(0x7f00000005c0)) (async) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, &(0x7f0000000100)={0x2f5, 0x1, 0xc7a, 0x2, 0x3}, 0x14) (async) r4 = socket$nl_generic(0x10, 0x3, 0x10) (async) r5 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_TX_BITRATE_MASK(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000040)={0x38, r5, 0x1, 0x0, 0x0, {{}, {@val={0x8, 0x3, r6}, @void}}, [@NL80211_ATTR_TX_RATES={0x1c, 0x5a, 0x0, 0x1, [@NL80211_BAND_5GHZ={0x18, 0x1, 0x0, 0x1, [@NL80211_TXRATE_VHT={0x14, 0x3, {[0x5, 0x5eaa, 0xfff0, 0x7, 0xa6b2, 0x10, 0x0, 0x7]}}]}]}]}, 0x38}}, 0x0) (async) r7 = syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x59c4, 0x8, 0x1000, 0x5cc}, &(0x7f0000000300)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) (async) io_uring_register$IORING_REGISTER_BUFFERS(r7, 0x0, &(0x7f0000000240)=[{&(0x7f00000003c0)=""/219, 0xdb}], 0x1) (async) setsockopt$SO_ATTACH_FILTER(0xffffffffffffffff, 0x1, 0x1a, &(0x7f00000000c0)={0x1, &(0x7f0000000200)=[{0x30, 0x4, 0x0, 0x2}]}, 0xffffffffffffff0e) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) (async) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x20, 0x0, 0x1000, 0x1, &(0x7f0000000000)="665a7787ae42f791d29ef5dfebb98d0f904a530bbbf29a26d8c61ce339e5a6b71b1354df9f0720695dc246740bb582be4305c597", 0xe1, 0x0, 0x0, {0xfffc}}) (async) io_uring_enter(r7, 0x749f, 0x4, 0x0, 0x0, 0xfffffffffffffef5) 2.104910148s ago: executing program 1 (id=1123): socket$nl_generic(0x10, 0x3, 0x10) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000300)={0x6, 0x3, &(0x7f00000000c0)=ANY=[@ANYBLOB="1800000002000000000000000008082295"], &(0x7f00000002c0)='GPL\x00'}, 0x94) r0 = socket$inet_sctp(0x2, 0x1, 0x84) r1 = socket$netlink(0x10, 0x3, 0xc) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX_80211(r4, 0x8933, &(0x7f00000000c0)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000480)=ANY=[@ANYBLOB='$\x00\x00\x00', @ANYRES16=r3, @ANYBLOB="050000000000000000000600000008000300", @ANYRES32=r5, @ANYBLOB="089a7d00b8d10000a9a58b2354be539ae8dc26c992116533eafa0825cf80340cc13e4b67bba6e6f9446d3a88ab8ef1177f78056e1c9337dc4d2db648a0e635b87e9507b401dc4dffe165e5094688532fc2065e3bcf01308a2d99de01ab77efea06f266b44ce60ceeb38f93d195f58fdf7279ef1cbe43badb55134d02e12976503eb0364cf2b3151676cf3c520236"], 0x24}}, 0x0) sendmsg$NL80211_CMD_START_AP(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000680)=ANY=[@ANYRESDEC=r0, @ANYRES16=r3, @ANYBLOB="050000000000000000000f00000008000300", @ANYRES32=r5, @ANYBLOB="47004e008000000008021100000008021100000150b94e57da50000000000000fb000000640000000006020202020202040600000000000006020000e7000000003c040106b80400080026006c09000008000c006400000008000d0000000000a2000f00323433fbd410889204fb668b06b19f305845876f9d9c5d1ecbad324eefa065b6"], 0x120}, 0x1, 0x0, 0x0, 0x90}, 0x0) bind$netlink(r1, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r6 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r6, &(0x7f0000000080)=@name={0x1e, 0x2, 0x0, {{0x42}}}, 0x10) bpf$ENABLE_STATS(0x20, 0xffffffffffffffff, 0x0) r7 = bpf$PROG_LOAD(0x5, &(0x7f00000003c0)={0x20, 0x3, &(0x7f0000000200)=ANY=[@ANYBLOB="186a00000100000000000000001000"/24], &(0x7f0000000000)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x99ec}, 0x94) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000240)={r7, 0x0, 0x2d, 0x0, @void}, 0x10) syz_emit_ethernet(0x46, &(0x7f0000000000)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780c206050086dd60"], 0x0) r8 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r8, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x2, {0x42, 0x4, 0xfffffffd}}, 0x10) r9 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r9, &(0x7f0000000180)=@name={0x1e, 0x2, 0x3, {{0x0, 0x2}, 0x1}}, 0x10) bind$tipc(r9, &(0x7f0000000140)=@name={0x1e, 0x2, 0x0, {{0x42, 0x2}}}, 0x10) setsockopt$TIPC_GROUP_JOIN(r9, 0x10f, 0x87, &(0x7f00000000c0)={0x42, 0x6}, 0x10) r10 = socket$tipc(0x1e, 0x5, 0x0) bind$tipc(r10, &(0x7f0000000040)=@name={0x1e, 0x2, 0x0, {{0x42, 0x3}}}, 0x10) r11 = socket$tipc(0x1e, 0x5, 0x0) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x1010, 0xffffffffffffffff, 0x0) times(&(0x7f0000002280)) sendmsg$tipc(r11, &(0x7f0000000380)={&(0x7f0000000140)=@nameseq={0x1e, 0x1, 0x0, {0x42, 0x3, 0x4}}, 0x10, 0x0}, 0x0) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x10811}, 0x8000080) 2.02515355s ago: executing program 2 (id=1124): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000280)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) setitimer(0x0, 0x0, &(0x7f0000000200)) r1 = syz_open_dev$vbi(&(0x7f0000000240), 0x2, 0x2) ioctl$BTRFS_IOC_GET_DEV_STATS(r1, 0xc4089434, 0x0) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r3, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000001f40)={&(0x7f00000004c0)=@updpolicy={0xfc, 0x19, 0x1, 0x70bd2b, 0x4, {{@in6=@loopback, @in=@rand_addr=0x64010102, 0x4e21, 0x0, 0x0, 0x0, 0xa, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}, {0x0, 0xc, 0x0, 0x200000, 0x20000000, 0xffffffffffffffff}, {0x0, 0xa00, 0x407ffffffffffe, 0x820000000000002}, 0x0, 0x0, 0x1}, [@tmpl={0x44, 0x5, [{{@in=@empty, 0x0, 0x32}, 0x2, @in=@multicast1, 0x6, 0x4, 0x3}]}]}, 0xfc}, 0x1, 0x0, 0x0, 0x1}, 0x0) sendto$inet6(r2, 0x0, 0x700, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x398, @empty}, 0x1c) 1.476075504s ago: executing program 3 (id=1125): r0 = bpf$PROG_LOAD(0x5, &(0x7f00000001c0)={0x11, 0xc, &(0x7f0000000300)=ANY=[@ANYBLOB="18010000120000000000000000000000850000006d000000180100002020642500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b70300000000000085000000"], &(0x7f0000000040)='GPL\x00', 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r0}, 0x18) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000000)=@base={0x11, 0x4, 0x4, 0xff}, 0x48) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000900)={r0, 0x0, 0x86, 0x62, &(0x7f0000000640)="7fadfef910ec4b15262c35b9739b3619753fabfc61820c415587d615713f1573e5eb582022233530915fcd0e5b824453ebe46daa2da0a41859009ae4e406b913ac216faad857b1fa10ff2c11a380e09bd565a81bd495931f40fc18222aef3a912a6489536f9bb3cd494ce43c7fde5896965758f161048733d1c534925650e09a9ed64e0a5729", &(0x7f0000000700)=""/98, 0x2, 0x0, 0x67, 0xcd, &(0x7f0000000780)="73266faadf89e94dfab3bf83d8ac211976ed27cf16568136c9e6c30ac7807d82b948dfa2594eef324d2a00169211dd24ce0e7c8b18fd7abc6a4d86411cc826209fbc73db193aaf7bbf06ae5265559eb688111d83f85369d8842cab2a0ee4c46c0ec164057ebcc7", &(0x7f0000000800)="bb4e6086a105cc73fa8cab040a22dac0d2b7a273eb499ecc2dfff6afa2be6deb09362741c08cd9736820c3df44bf2bedd93e76699647bc058e844ed8a4146d3d8939b23175e06bfe84b1d95d700da31692de1aee77314be3ac938f3f3ccab12afd61c38784f4d87ca8a0f2de8a89752f3550fa8201cc3c32d64cc6f3158091d9f2abda8af439b57f5fd48b968158efa29392b9709f42fffb99a8a53efd46d571f6aeda5f30b1d517312be275e730d0602c0afa6c65fe860d392a9a77b2144e1c6e5cc6f9ad06812892116c5643", 0x4, 0x0, 0xffff8001}, 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000000c0)={0x3, 0x8, &(0x7f0000000180)=@framed={{}, [@tail_call={{0x18, 0x2, 0x1, 0x0, r1}, {}, {0x85, 0x0, 0x0, 0x21}}]}, &(0x7f0000000080)='syzkaller\x00'}, 0x90) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000000), 0x1, 0x0) r3 = getpgrp(0xffffffffffffffff) ioctl$BLKTRACESETUP(r2, 0xc0481273, &(0x7f0000000100)={'\x00', 0x5, 0x7, 0x1, 0x9, 0x401, r3}) r4 = socket$alg(0x26, 0x5, 0x0) accept$alg(r4, 0x0, 0x0) r5 = socket$kcm(0x11, 0x200000000000002, 0x300) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) close(r7) recvmsg$unix(r6, &(0x7f0000000400)={0x0, 0xfffffffffffffc9a, 0x0, 0x0, &(0x7f00000003c0)=[@rights={{0x14, 0x1, 0x1, [0xffffffffffffffff]}}], 0x18}, 0x0) setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x107, 0x12, &(0x7f00000000c0)=r0, 0x4) r8 = syz_io_uring_setup(0x1108, &(0x7f0000000300)={0x0, 0x0, 0x80, 0x0, 0x21e}, &(0x7f00000003c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r9, r10, &(0x7f0000000380)=@IORING_OP_PROVIDE_BUFFERS={0x1f, 0x0, 0x0, 0x7, 0x0, 0x0, 0x200, 0x0, 0x1}) io_uring_enter(r8, 0x47fa, 0x0, 0x0, 0x0, 0x0) capset(&(0x7f0000000080)={0x20071026}, &(0x7f0000000040)) r11 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x42) ioctl$SCSI_IOCTL_SEND_COMMAND(r11, 0x1, &(0x7f0000000580)=ANY=[@ANYBLOB="0000000004000000bf00"]) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f00000001c0)={0xffffffffffffffff}) syz_io_uring_submit(r9, r10, &(0x7f00000001c0)=@IORING_OP_RECVMSG={0xa, 0x20, 0x2, r12, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0, 0x20042, 0x1}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000400)=@newqdisc={0x204, 0x24, 0x549, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, {}, {0xffff, 0xffff}, {0x0, 0x7}}, [@TCA_INGRESS_BLOCK={0x8, 0xd, 0x1}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0xc38}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0x3}, @TCA_STAB={0xac, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x8, 0x81, 0xbd7, 0x1e52, 0x0, 0x0, 0x3, 0x3}}, {0xa, 0x2, [0x6, 0xfffe, 0x1000]}}, {{0x1c, 0x1, {0x5, 0x2, 0x7, 0x1, 0x2, 0x7, 0x0, 0x1}}, {0x6, 0x2, [0x8000]}}, {{0x1c, 0x1, {0x6, 0x5, 0x2, 0x5, 0x0, 0x6, 0x4, 0x5}}, {0xe, 0x2, [0x8000, 0x8, 0xf878, 0xb, 0x7f]}}, {{0x1c, 0x1, {0xf, 0x2, 0x5, 0xde1, 0x2, 0x267, 0x6, 0x7}}, {0x12, 0x2, [0x1, 0x5e83, 0xc, 0x8, 0x101, 0x1, 0x9]}}]}, @qdisc_kind_options=@q_choke={{0xa}, {0x110, 0x2, [@TCA_CHOKE_MAX_P={0x8, 0x3, 0x32e5}, @TCA_CHOKE_STAB={0x104, 0x2, "a368625afc3945fa7e0d5d0144f5dcf3aeb03665b89aac1a208ba673249d611a165dc179aa26879552bb84e433b2899f9e13ccb70c732b7ea3b0972a7daf69e3455f0912f40978b6ed75dd80b2fe3813cd6c59ce405f0c37e4a20882b907333230dafc10016bf841c375f92daca2176cd8dda45662dadf6e5cf90bfa5fa5e6c18b36e03b3b5bef1ff841098492cc6ed41d7c3a02813b57f9d002b33b255ac74b515917441a8a76d13953e254682cfec296232a6d14f5a989465aa868774bb5709cce562c559516735c30b4b46b2158f9c5bfa6f07ab1b7082ab2ca10dd5734fff8c5b320395704320f54e32663984906c86808510d179a20fc9799699c4d0b6f"}]}}]}, 0x204}}, 0x0) close(r5) 1.417588712s ago: executing program 0 (id=1126): openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0}, 0x18) r0 = syz_io_uring_setup(0x497, &(0x7f0000000200)={0x0, 0x7278, 0x0, 0x3, 0x2f0}, &(0x7f00000000c0)=0x0, &(0x7f0000000100)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r3 = openat$userio(0xffffff9c, &(0x7f0000000040), 0x401, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x4007, @fd=r3, 0x2, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x7) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) io_uring_enter(r0, 0x26c8, 0x0, 0x1, 0x0, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, 0x0, 0x0) r6 = socket(0x11, 0x3, 0x0) setsockopt$SO_TIMESTAMPING(r6, 0x1, 0x41, &(0x7f0000000300)=0x16, 0x4) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, 0x0) bind$packet(r6, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, 0x14) setsockopt$packet_int(r6, 0x107, 0xf, &(0x7f0000000240)=0xe9, 0x4) sendmsg$netlink(r6, &(0x7f0000002ac0)={0x0, 0x0, &(0x7f0000000540)=[{&(0x7f0000000280)=ANY=[@ANYBLOB="02011400012918000e3580009f0001140000002f0600ac141414e0000003808a8972bd0b72e41082b1a3d2061fd7fdfe4b88942a31f48597e36e039b1c599db6e466749c2d4c8303a0f7fbda34fb8825f80200e3c0aba61f6304a80500ffffca88faca"], 0xdd12}], 0x1}, 0x0) 1.41517241s ago: executing program 4 (id=1127): r0 = creat(&(0x7f00000002c0)='./file0\x00', 0x1) fstat(r0, &(0x7f0000000300)) ioctl$NS_GET_USERNS(r0, 0xb701, 0x0) r1 = open$dir(&(0x7f0000000080)='./file0\x00', 0x0, 0x8) mmap$xdp(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x0, 0x12, r1, 0x0) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x2, 0x4, &(0x7f0000000200)=ANY=[@ANYBLOB="180000000300000000000000fe020010850000000700000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x100, 0x70, '\x00', 0x0, @fallback=0x30, r0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) write$qrtrtun(r0, &(0x7f0000000380)="ca091cc2e088", 0xffe3) process_vm_readv(0x0, 0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x0) socket$nl_generic(0x10, 0x3, 0x10) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f00000005c0)={r2, 0x0, 0x30, 0x0, @val=@uprobe_multi={&(0x7f0000000140)='./file0\x00', &(0x7f0000000180)=[0x7, 0x5], &(0x7f0000000240), 0x0, 0x2}}, 0x40) r3 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.swap.events\x00', 0x275a, 0x0) mmap(&(0x7f000048a000/0x1000)=nil, 0x1000, 0x6, 0x12, r3, 0x1b83c000) 1.329202941s ago: executing program 1 (id=1128): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = mq_open(&(0x7f0000000a00)='eth0\x00#\x13\xaeu\xe0\xfbu0*\xf3\x11i\xdd\xd9\xc6\x87\xde\xbf_\xa0\xf6\xdfk\xbf.\"\xa6\xc0#p\xcd\x1c/\xa6\xf2\xbcyL\x85a\xb5\xbb~+>\xbc\x93\xf8\xab\x9a3\x85l\x1d\x15\x11\x1a{@!2\xb6!\xae\xf79k\x90\x88\v8I$\xfdQ\x1d\x90=r\xd8\xc0\xd8\t/\x8dv\xd3\xa7\xd8J\xfd\x94#KT\xdd\x14\xd3\xe1\xbe_$A=z\xee\xbd/X\xbemOX)s\x94\xde\xbe_\x88N\xb8\xde\xeb)\xcd\xc56m\n\v\x01\xbe\xeb\xbb\x91\x11z\xc2|d\x1b\x04\xd2\xf9yx\xb2\x1b\bLTrw\x88|0\t\xc6\xe2\x9c\xed\\\xd8[\xc8\x04 \xf3\xac]V\x1d:\xfc\xc3\x9e\x02\ax\xef\xfe\x1c.TT\xcf\xbf\xf5\x80a%\xdcQ\xb3CuT\xcc\x02\xea\x91\xe8\xd8\x01YZy\xe6!\x89\x9c\xd1\xa6\x167\x8avs\xb2\a\xfe\xb3j*\xad\x18I\xcc\xe9\xaa{]\xef\xb7\xf2\xee*\xf95\bJt\xd0s\xc4\xaa\xc8\x13~\xb2\xf20\xbdf\xdb\xaeG\xe3\xfb\xef\x94\xef:Q\x1b\xe3\xa3\xa4}\xef`e\xcdL\xab\xdb\r\xf2y\x9fg1\xf4\t\x18i/!\x13\xf1,\x8cu\xaa\xbf~)\x94\x1b2\x93\x86\xe7\x9a\xf2j\xa8\x96\xa6\xa2\xfcN\x81\xafTh\xb3\x1bo:\xe8\vq7S\xe4H\xf3L\xa0\x9c\x97B\x12\x10\x9d\xaa\x7fq\x06\xb9(\xf6\x1c\x83\xb1[\x84\x10aF\x9b\xda\xeb\xc4*\x02q\xb2\x92\x00\x8cv\xac AN\xb9\xaa\x81W\x97Te\x81\x98L\xfe\x97+u\xd3^\xb1\xf0\xe0\x1f\xbd\a\xbb\xe5\x18\x9ds\x12ha\x00\xeb\x84\x99\xc6\x0f\xf1\xd5LD\xa87\xa0DQ\x8a2\x16!8,\xbc%$\xf1\xf2\xd6\x9cy\xecK\xda\xc5\xdc\xfa\xdd\xf6\b\xc6\xb4\x14\x16\x9c\x7f\x92\x85\xb0\xa2%:\xf0\xf4\x150\x0f\xb4\xa6d\xb4\xe4L\x19W\xd5\x90\xf7l\x1b\xfe\xde\vh\x97=m\x82.\xac\vh\xfe\x84Q}\x838/\x83\xebP\xbe\xd6+:\xceE\\\x95\xd4\xac\x92\x87\xd7\x98\x97\xe3\xec\xad\xd5\xac\x80C\x84R\x88r^g\xbaQ(\x9a>\xe2\xba\xa8=\x17\f04\x8f\x1f\xf2\x88*@v\xe7\xd1\xee\xb3\xc2\x8dT\xda\x81g\xd9\x1a:hzW6s)x\x06\xae\x11\xf2\x1e\xcd\v\xe5L\x19\x96s\xbc\x9e\xf4\x10$\r\xa4\xd8\xa2\xa2\xfcM\xc5R3~$\xc0\xa5n\x9a W\xb1e\xcc<$\xf5#G\xce\xaf\x88U\xfa\x80\xf24\xf6\xb5\xef\xe2z\xcf\x9eN\x92\xac\x81{\xe6\xbd\xd7\x16\xe6F\xe2\x9e\x91%\x94\v\xb9\xdc\xd6\x87\x8f\xcd\xc1\xb05\x81\x81\xf8\xe9X\xe8Kt9@\xf4\xe1\xa6=\xc9\xe1:p4\nP[f\x1d\xfd\xfa\x839\x8d\x0e\xd1\xf9\xa0\xd2^E\xe5\xedo.\xaa\xf2\xb4\xcdn\x14\f\xcd\x83_yk\xda\xc5\x89\xf0Z\xea\x1d\xbd\xc00\v\xa3\xb3\xbe\xe6\x8b\x18/\xa8\xaaY\xf2\x89\x0f\x9enOOr\x00\xb2\x01\x1f:Z\xb8\xee;\xe3;\x8aPV\xce\xee\xf8[\x16\n\xe6:z\xb8\x1dvk\a{\xc1\x14\xd9+\xdb\t\x11\x90y\xe8\\\xe6\xfc\xca\xb4\xcbC\xd6\xd0\xbeC\xce\xc0L\xdb\xcd\xb3\x907c\xb4\xa6\xce\xdb[\xce\x122N\xa3\xc7Q<\x1a\xa5\xb3)\xc5\x98\x84\x8a\x82\x19\xb0\t\xac\x10\\\x8c\xbe\xcb\raIYe[\xa8\xc4\xac\x0e\xbb\x0f\b^\xdag\xe2\xa9\"\xf5h\'\xcf\xd9\x1b\xef\xe3\xe7y\x82\x1e\xca\x7f\x02 \xcf\x9e\xe0\xd9TM\xb9\n\xa9\xad3\x91\xa5\xe6!\xcd\xa2\xa4\x14\x12\xf9\xbf\xa8b\xcec:\xd7\'\f\f\x957\xc9}\r\xa6\xaa\x0f\xca\x96\xeb\x00\x00\x00\x00\x00', 0x40, 0x1f0, 0x0) mq_timedsend(r2, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_generic(r1, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)={0x1c, 0x2d, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}, [@typed={0x5, 0xb, 0x0, 0x0, @str='\x00'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000000600)=[{{0x0, 0x0, 0x0}, 0x200001}, {{0x0, 0x0, 0x0}, 0x2046}, {{0x0, 0x0, 0x0}, 0x10000}, {{0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000340)=""/212, 0xd4}, {&(0x7f0000000900)=""/238, 0xee}, {&(0x7f0000003e00)=""/4098, 0x1002}, {&(0x7f0000000440)=""/234, 0xea}, {&(0x7f0000000000)=""/26, 0x1a}], 0x5}, 0xfff}], 0x4, 0x40010020, 0x0) 1.298362912s ago: executing program 2 (id=1129): r0 = syz_io_uring_setup(0x34b7, &(0x7f0000000000)={0x0, 0x0, 0x30c0, 0x0, 0x28}, &(0x7f00000001c0), &(0x7f0000000500)) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r0, 0xc, 0xf0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xf, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xa00}, 0x94) bpf$MAP_CREATE(0x1900000000000000, 0x0, 0x48) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r2 = socket$netlink(0x10, 0x3, 0x10) r3 = socket$netlink(0x10, 0x3, 0x10) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, &(0x7f0000000100)=0x80000001, 0x4) ioctl$SNDRV_SEQ_IOCTL_CREATE_PORT(0xffffffffffffffff, 0xc0a45320, 0x0) openat$sequencer(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) syz_genetlink_get_family_id$ethtool(&(0x7f0000000080), r2) syz_genetlink_get_family_id$nl80211(0x0, r3) r4 = socket$inet6_mptcp(0xa, 0x1, 0x106) connect$inet6(r4, &(0x7f0000000040)={0xa, 0x4001, 0x0, @loopback}, 0x1c) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) r5 = socket$kcm(0x10, 0x400000002, 0x0) sendmsg$inet(r5, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)}, 0x0) r6 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r6, &(0x7f0000000040)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0xb}, 0xe) sendmmsg$sock(r6, &(0x7f0000004100)=[{{0x0, 0x0, 0x0}}], 0xffffff80, 0x0) shutdown(r6, 0x1) 0s ago: executing program 2 (id=1130): socket$nl_generic(0x10, 0x3, 0x10) socket$inet6_tcp(0xa, 0x1, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2000003, 0x8031, 0xffffffffffffffff, 0x0) r0 = userfaultfd(0x80001) ioctl$UFFDIO_API(r0, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x19}) r1 = openat$vim2m(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) ioctl$vim2m_VIDIOC_REQBUFS(r1, 0xc0145608, 0x0) bind$alg(0xffffffffffffffff, 0x0, 0x0) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x802, 0x0) syz_genetlink_get_family_id$netlbl_unlabel(&(0x7f0000000140), 0xffffffffffffffff) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) syz_emit_ethernet(0x7a, 0x0, 0x0) writev(r2, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r3 = openat(0xffffffffffffff9c, 0x0, 0x0, 0x0) renameat(r3, &(0x7f00000004c0)='./cgroup.net/devices.allow\x00', r3, 0x0) ioctl$KVM_S390_VCPU_FAULT(r3, 0x4004ae52, &(0x7f0000000080)=0xfffffffffffffffb) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x3) ioctl$BLKTRACESETUP(0xffffffffffffffff, 0xc0401273, &(0x7f0000000340)={'\x00', 0x9, 0x9, 0xfffffffe, 0x2, 0x5}) ioctl$UFFDIO_REGISTER(r0, 0xc020aa00, &(0x7f0000000100)={{&(0x7f0000010000/0x1000)=nil, 0x1000}, 0x5}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) close(r0) kernel console output (not intermixed with test programs): Warning: Permanently added '10.128.1.217' (ED25519) to the list of known hosts. [ 81.176157][ T5822] cgroup: Unknown subsys name 'net' [ 81.324540][ T5822] cgroup: Unknown subsys name 'cpuset' [ 81.333975][ T5822] cgroup: Unknown subsys name 'rlimit' Setting up swapspace version 1, size = 127995904 bytes [ 82.812011][ T5822] Adding 124996k swap on ./swap-file. Priority:0 extents:1 across:124996k [ 85.461387][ T5845] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 85.462634][ T5844] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 85.477008][ T5854] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 85.484819][ T5855] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 85.485340][ T5844] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 85.500018][ T5856] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 85.501597][ T5855] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 85.507990][ T5856] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 85.528360][ T5853] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 85.536269][ T5855] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 85.544370][ T5856] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 85.545098][ T5855] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 85.559991][ T5855] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 85.567154][ T5856] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 85.568313][ T5855] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 85.581743][ T5856] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 85.581905][ T5853] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 85.593604][ T5844] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 85.597090][ T5853] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 85.603884][ T5844] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 85.611830][ T5853] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 85.617477][ T5844] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 85.625040][ T5853] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 85.637655][ T5847] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 85.639862][ T5845] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 86.169604][ T5848] chnl_net:caif_netlink_parms(): no params data found [ 86.393923][ T5835] chnl_net:caif_netlink_parms(): no params data found [ 86.414645][ T5851] chnl_net:caif_netlink_parms(): no params data found [ 86.476456][ T5837] chnl_net:caif_netlink_parms(): no params data found [ 86.539952][ T5848] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.548865][ T5848] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.556740][ T5848] bridge_slave_0: entered allmulticast mode [ 86.564817][ T5848] bridge_slave_0: entered promiscuous mode [ 86.574083][ T5848] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.581471][ T5848] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.588626][ T5848] bridge_slave_1: entered allmulticast mode [ 86.596438][ T5848] bridge_slave_1: entered promiscuous mode [ 86.604071][ T5836] chnl_net:caif_netlink_parms(): no params data found [ 86.755948][ T5848] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 86.837440][ T5848] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 86.873030][ T5835] bridge0: port 1(bridge_slave_0) entered blocking state [ 86.880232][ T5835] bridge0: port 1(bridge_slave_0) entered disabled state [ 86.888031][ T5835] bridge_slave_0: entered allmulticast mode [ 86.895646][ T5835] bridge_slave_0: entered promiscuous mode [ 86.908470][ T5835] bridge0: port 2(bridge_slave_1) entered blocking state [ 86.915983][ T5835] bridge0: port 2(bridge_slave_1) entered disabled state [ 86.923804][ T5835] bridge_slave_1: entered allmulticast mode [ 86.931516][ T5835] bridge_slave_1: entered promiscuous mode [ 87.000066][ T5851] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.007266][ T5851] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.014674][ T5851] bridge_slave_0: entered allmulticast mode [ 87.022398][ T5851] bridge_slave_0: entered promiscuous mode [ 87.068533][ T5848] team0: Port device team_slave_0 added [ 87.074878][ T5851] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.082699][ T5851] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.089831][ T5851] bridge_slave_1: entered allmulticast mode [ 87.097962][ T5851] bridge_slave_1: entered promiscuous mode [ 87.104915][ T5837] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.112214][ T5837] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.119415][ T5837] bridge_slave_0: entered allmulticast mode [ 87.126665][ T5837] bridge_slave_0: entered promiscuous mode [ 87.148032][ T5835] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.159202][ T5848] team0: Port device team_slave_1 added [ 87.200995][ T5837] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.208235][ T5837] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.215453][ T5837] bridge_slave_1: entered allmulticast mode [ 87.223661][ T5837] bridge_slave_1: entered promiscuous mode [ 87.230586][ T5836] bridge0: port 1(bridge_slave_0) entered blocking state [ 87.237693][ T5836] bridge0: port 1(bridge_slave_0) entered disabled state [ 87.247791][ T5836] bridge_slave_0: entered allmulticast mode [ 87.255084][ T5836] bridge_slave_0: entered promiscuous mode [ 87.263332][ T5836] bridge0: port 2(bridge_slave_1) entered blocking state [ 87.271205][ T5836] bridge0: port 2(bridge_slave_1) entered disabled state [ 87.278329][ T5836] bridge_slave_1: entered allmulticast mode [ 87.286009][ T5836] bridge_slave_1: entered promiscuous mode [ 87.299188][ T5835] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.322091][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.329066][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.355022][ T5848] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.426322][ T5848] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.433334][ T5848] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.459664][ T5848] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.481446][ T5851] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.494198][ T5851] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.505598][ T5837] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.518146][ T5837] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.554842][ T5835] team0: Port device team_slave_0 added [ 87.587436][ T5836] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 87.598235][ T5835] team0: Port device team_slave_1 added [ 87.630229][ T5836] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 87.641283][ T5845] Bluetooth: hci1: command tx timeout [ 87.668292][ T5851] team0: Port device team_slave_0 added [ 87.676465][ T5837] team0: Port device team_slave_0 added [ 87.718848][ T5851] team0: Port device team_slave_1 added [ 87.724590][ T5845] Bluetooth: hci2: command tx timeout [ 87.724621][ T5840] Bluetooth: hci4: command tx timeout [ 87.730147][ T5847] Bluetooth: hci3: command tx timeout [ 87.735592][ T5853] Bluetooth: hci0: command tx timeout [ 87.738448][ T5837] team0: Port device team_slave_1 added [ 87.768215][ T5836] team0: Port device team_slave_0 added [ 87.774879][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 87.782254][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.808834][ T5835] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 87.822094][ T5835] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 87.829050][ T5835] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 87.855022][ T5835] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 87.871202][ T5848] hsr_slave_0: entered promiscuous mode [ 87.877558][ T5848] hsr_slave_1: entered promiscuous mode [ 87.909974][ T5836] team0: Port device team_slave_1 added [ 87.994849][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.002029][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.028326][ T5851] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.040010][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.047245][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.073276][ T5837] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.084721][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 88.091966][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.118041][ T5836] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 88.130677][ T5836] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.137624][ T5836] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.163653][ T5836] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.199726][ T5835] hsr_slave_0: entered promiscuous mode [ 88.206314][ T5835] hsr_slave_1: entered promiscuous mode [ 88.212953][ T5835] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 88.220770][ T5835] Cannot create hsr debugfs directory [ 88.226831][ T5851] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.234192][ T5851] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.260869][ T5851] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.272285][ T5837] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 88.279235][ T5837] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 88.305404][ T5837] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 88.432011][ T5836] hsr_slave_0: entered promiscuous mode [ 88.438418][ T5836] hsr_slave_1: entered promiscuous mode [ 88.445059][ T5836] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 88.453016][ T5836] Cannot create hsr debugfs directory [ 88.495424][ T5851] hsr_slave_0: entered promiscuous mode [ 88.502195][ T5851] hsr_slave_1: entered promiscuous mode [ 88.508280][ T5851] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 88.516142][ T5851] Cannot create hsr debugfs directory [ 88.608382][ T5837] hsr_slave_0: entered promiscuous mode [ 88.614817][ T5837] hsr_slave_1: entered promiscuous mode [ 88.621398][ T5837] debugfs: Directory 'hsr0' with parent 'hsr' already present! [ 88.628970][ T5837] Cannot create hsr debugfs directory [ 89.008514][ T5848] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 89.038234][ T5848] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 89.072954][ T5848] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 89.085222][ T5848] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 89.134433][ T5851] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 89.146507][ T5851] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 89.156530][ T5851] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 89.190443][ T5851] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 89.255437][ T5835] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 89.270281][ T5835] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 89.282445][ T5835] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 89.294068][ T5835] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 89.397526][ T5836] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 89.438690][ T5836] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 89.471598][ T5836] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 89.484310][ T5836] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 89.553465][ T5851] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.561365][ T5837] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 89.575414][ T5837] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 89.585573][ T5837] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 89.602199][ T5837] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 89.627489][ T5848] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.680342][ T5848] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.693284][ T5851] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.718857][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.726068][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.734137][ T5847] Bluetooth: hci1: command tx timeout [ 89.767110][ T49] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.774251][ T49] bridge0: port 1(bridge_slave_0) entered forwarding state [ 89.800794][ T5847] Bluetooth: hci3: command tx timeout [ 89.801138][ T5835] 8021q: adding VLAN 0 to HW filter on device bond0 [ 89.806205][ T5847] Bluetooth: hci2: command tx timeout [ 89.817805][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.819326][ T5845] Bluetooth: hci4: command tx timeout [ 89.825662][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.831234][ T5847] Bluetooth: hci0: command tx timeout [ 89.848650][ T49] bridge0: port 2(bridge_slave_1) entered blocking state [ 89.855987][ T49] bridge0: port 2(bridge_slave_1) entered forwarding state [ 89.938282][ T5835] 8021q: adding VLAN 0 to HW filter on device team0 [ 89.979473][ T1326] bridge0: port 1(bridge_slave_0) entered blocking state [ 89.986648][ T1326] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.029274][ T1326] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.036484][ T1326] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.055545][ T5836] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.126661][ T5836] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.200220][ T63] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.207424][ T63] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.249822][ T63] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.257002][ T63] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.278454][ T5837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 90.358926][ T5837] 8021q: adding VLAN 0 to HW filter on device team0 [ 90.398582][ T5848] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.455291][ T1330] bridge0: port 1(bridge_slave_0) entered blocking state [ 90.462476][ T1330] bridge0: port 1(bridge_slave_0) entered forwarding state [ 90.473273][ T1330] bridge0: port 2(bridge_slave_1) entered blocking state [ 90.480445][ T1330] bridge0: port 2(bridge_slave_1) entered forwarding state [ 90.675858][ T5851] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.703662][ T5848] veth0_vlan: entered promiscuous mode [ 90.766063][ T5835] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 90.795809][ T5848] veth1_vlan: entered promiscuous mode [ 90.887440][ T5848] veth0_macvtap: entered promiscuous mode [ 90.914372][ T5848] veth1_macvtap: entered promiscuous mode [ 90.998292][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.018747][ T5848] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.053641][ T5848] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.072236][ T5848] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.082258][ T5848] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.091333][ T5848] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.118598][ T5835] veth0_vlan: entered promiscuous mode [ 91.165769][ T5836] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.226827][ T5835] veth1_vlan: entered promiscuous mode [ 91.255556][ T5837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 91.365122][ T5835] veth0_macvtap: entered promiscuous mode [ 91.374951][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.386866][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.429028][ T5835] veth1_macvtap: entered promiscuous mode [ 91.463272][ T5851] veth0_vlan: entered promiscuous mode [ 91.472483][ T5836] veth0_vlan: entered promiscuous mode [ 91.491161][ T1330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 91.499016][ T1330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 91.534116][ T5837] veth0_vlan: entered promiscuous mode [ 91.560194][ T5836] veth1_vlan: entered promiscuous mode [ 91.586487][ T5848] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality. [ 91.596517][ T5837] veth1_vlan: entered promiscuous mode [ 91.610260][ T5851] veth1_vlan: entered promiscuous mode [ 91.622184][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 91.643015][ T9] cfg80211: failed to load regulatory.db [ 91.658997][ T5835] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 91.738044][ T5835] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.748691][ T5835] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.757837][ T5835] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.767439][ T5835] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 91.820566][ T5847] Bluetooth: hci1: command tx timeout [ 91.881210][ T5847] Bluetooth: hci0: command tx timeout [ 91.881314][ T5845] Bluetooth: hci4: command tx timeout [ 91.886717][ T5840] Bluetooth: hci3: command tx timeout [ 91.892215][ T5845] Bluetooth: hci2: command tx timeout [ 92.083328][ T5851] veth0_macvtap: entered promiscuous mode [ 92.241501][ T5836] veth0_macvtap: entered promiscuous mode [ 92.250346][ T5837] veth0_macvtap: entered promiscuous mode [ 92.345737][ T5851] veth1_macvtap: entered promiscuous mode [ 92.393510][ T5836] veth1_macvtap: entered promiscuous mode [ 92.412953][ T5837] veth1_macvtap: entered promiscuous mode [ 92.425614][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.490144][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.513028][ T49] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 92.525523][ T49] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 92.596253][ T5956] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details. [ 92.637103][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 92.645839][ T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!! [ 92.693596][ T5851] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.701968][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 92.736761][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 92.752420][ T5836] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.774599][ T5836] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.784737][ T5836] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.794284][ T5836] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.803793][ T5836] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.816159][ T5851] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.825228][ T5851] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.844797][ T5851] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.865054][ T5851] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.896222][ T5837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 92.954977][ T5837] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.970588][ T5837] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.979401][ T5837] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 92.988731][ T5837] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 93.029332][ T63] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.072287][ T63] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.218523][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.262620][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 93.740932][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 93.750230][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 93.860798][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 93.890569][ T5845] Bluetooth: hci1: command tx timeout [ 93.960933][ T5845] Bluetooth: hci0: command tx timeout [ 93.966469][ T5845] Bluetooth: hci3: command tx timeout [ 93.970944][ T1330] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 93.973197][ T5845] Bluetooth: hci2: command tx timeout [ 93.979643][ T1330] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.037717][ T5845] Bluetooth: hci4: command tx timeout [ 94.277964][ T5967] veth1_macvtap: left promiscuous mode [ 94.284762][ T5967] macsec0: entered allmulticast mode [ 94.316964][ T63] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.328960][ T5967] veth1_macvtap: entered promiscuous mode [ 94.339163][ T5967] veth1_macvtap: entered allmulticast mode [ 94.347700][ T5967] macsec0: left allmulticast mode [ 94.352987][ T63] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.367060][ T5967] veth1_macvtap: left allmulticast mode [ 94.408610][ T36] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 94.442658][ T36] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 94.520777][ T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!! [ 94.530583][ T0] NOHZ tick-stop error: local softirq work is pending, handler #202!!! [ 95.036067][ T36] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.099636][ T36] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 95.241126][ T0] NOHZ tick-stop error: local softirq work is pending, handler #08!!! [ 95.299672][ T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!! [ 95.498839][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 95.521291][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 96.288277][ T5987] netlink: 8 bytes leftover after parsing attributes in process `syz.0.11'. [ 97.173708][ T5990] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 97.453083][ T5987] netdevsim netdevsim0 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.462043][ T5987] netdevsim netdevsim0 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.470752][ T5987] netdevsim netdevsim0 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.479432][ T5987] netdevsim netdevsim0 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 97.582910][ T5987] Zero length message leads to an empty skb [ 100.327124][ T6013] netlink: 8 bytes leftover after parsing attributes in process `syz.3.16'. [ 100.352452][ T6008] xt_CT: No such helper "pptp" [ 107.090868][ T6046] block nbd3: shutting down sockets [ 111.096734][ T6038] syz.4.22 (6038): drop_caches: 2 [ 112.816690][ T6088] netlink: 40 bytes leftover after parsing attributes in process `syz.0.33'. [ 112.834237][ T6088] netlink: 'syz.0.33': attribute type 10 has an invalid length. [ 112.856104][ T6088] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 112.870997][ T6088] bond0: (slave batadv0): Enslaving as an active interface with an up link [ 113.161933][ T6088] syz.0.33 (6088) used greatest stack depth: 20152 bytes left [ 114.625425][ T6107] ieee802154 phy0 wpan0: encryption failed: -22 [ 119.628623][ T6148] netlink: 4 bytes leftover after parsing attributes in process `syz.2.49'. [ 120.787648][ T6158] netlink: 40 bytes leftover after parsing attributes in process `syz.0.53'. [ 120.863279][ T6160] netlink: 'syz.0.53': attribute type 10 has an invalid length. [ 123.708014][ T6176] Can't find ip_set type ha [ 124.808416][ T6162] syz.1.54 (6162): drop_caches: 2 [ 128.645175][ T6222] input: syz1 as /devices/virtual/input/input5 [ 132.633104][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 132.639556][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 134.480043][ T5840] Bluetooth: hci4: link tx timeout [ 134.489097][ T5840] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 134.616564][ T5845] Bluetooth: hci4: link tx timeout [ 134.635380][ T5845] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 136.037867][ T5845] Bluetooth: hci4: link tx timeout [ 136.043108][ T5845] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 136.052986][ T5845] Bluetooth: hci4: link tx timeout [ 136.059585][ T5845] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 136.068944][ T5845] Bluetooth: hci4: link tx timeout [ 136.074195][ T5845] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 136.081983][ T5845] Bluetooth: hci4: link tx timeout [ 136.087212][ T5845] Bluetooth: hci4: killing stalled connection 11:aa:aa:aa:aa:aa [ 136.705859][ T5845] Bluetooth: hci4: command 0x0406 tx timeout [ 138.260786][ T6311] veth1_macvtap: left promiscuous mode [ 138.323197][ T6311] macsec0: entered allmulticast mode [ 138.988489][ T6318] Can't find ip_set type ha [ 139.534769][ T6311] veth1_macvtap: entered promiscuous mode [ 139.567475][ T6311] veth1_macvtap: entered allmulticast mode [ 139.620667][ T6311] macsec0: left allmulticast mode [ 139.625798][ T6311] veth1_macvtap: left allmulticast mode [ 145.929723][ T6375] input: syz1 as /devices/virtual/input/input6 [ 148.654587][ T6424] input: syz1 as /devices/virtual/input/input7 [ 149.107595][ T6430] mmap: syz.2.93 (6430) uses deprecated remap_file_pages() syscall. See Documentation/mm/remap_file_pages.rst. [ 149.650315][ T6429] Can't find ip_set type ha [ 152.265745][ T6439] binder: 6437:6439 ioctl 4018620d 0 returned -22 [ 152.654388][ T6439] binder: 6437:6439 ioctl c0306201 200000000240 returned -11 [ 154.158758][ T6485] netlink: 40 bytes leftover after parsing attributes in process `syz.3.100'. [ 156.909917][ T6496] sysfs: Unknown parameter 'tS' [ 158.441419][ T6502] input: syz1 as /devices/virtual/input/input8 [ 161.392933][ T6531] veth1_macvtap: left promiscuous mode [ 161.398437][ T6531] macsec0: entered allmulticast mode [ 161.584179][ T6531] veth1_macvtap: entered promiscuous mode [ 161.652757][ T6531] veth1_macvtap: entered allmulticast mode [ 161.801852][ T6531] macsec0: left allmulticast mode [ 161.806937][ T6531] veth1_macvtap: left allmulticast mode [ 162.294661][ T6561] netlink: 8 bytes leftover after parsing attributes in process `syz.0.108'. [ 162.385622][ T6560] veth1_macvtap: left promiscuous mode [ 162.457971][ T6557] netlink: 40 bytes leftover after parsing attributes in process `syz.4.107'. [ 162.529123][ T6560] macsec0: entered allmulticast mode [ 163.260588][ T6560] veth1_macvtap: entered promiscuous mode [ 163.273999][ T6560] veth1_macvtap: entered allmulticast mode [ 163.322869][ T6560] macsec0: left allmulticast mode [ 163.358457][ T6560] veth1_macvtap: left allmulticast mode [ 163.861140][ T6569] block nbd1: shutting down sockets [ 164.002475][ T6579] netlink: 40 bytes leftover after parsing attributes in process `syz.2.112'. [ 164.189887][ T6583] kvm: user requested TSC rate below hardware speed [ 164.819328][ T6584] sysfs: Unknown parameter 'tS' [ 165.214668][ T6580] xt_CT: No such helper "pptp" [ 165.693617][ T6592] netlink: 4 bytes leftover after parsing attributes in process `syz.1.117'. [ 167.411326][ T9] usb 4-1: new high-speed USB device number 2 using dummy_hcd [ 170.052583][ T9] usb 4-1: config index 0 descriptor too short (expected 23569, got 27) [ 170.061825][ T9] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 170.073357][ T9] usb 4-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 170.114230][ T9] usb 4-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 170.169478][ T9] usb 4-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 170.182379][ T6613] block nbd1: NBD_DISCONNECT [ 170.187278][ T6613] block nbd1: Disconnected due to user request. [ 170.224043][ T6613] block nbd1: shutting down sockets [ 170.270370][ T9] usb 4-1: Manufacturer: syz [ 170.297459][ T9] usb 4-1: config 0 descriptor?? [ 170.339572][ T9] usb 4-1: can't set config #0, error -71 [ 170.394716][ T9] usb 4-1: USB disconnect, device number 2 [ 171.760469][ T6620] Can't find ip_set type ha [ 178.211443][ T6670] block nbd0: NBD_DISCONNECT [ 178.216098][ T6670] block nbd0: Send disconnect failed -32 [ 178.240513][ T6670] block nbd0: Disconnected due to user request. [ 178.260497][ T6670] block nbd0: shutting down sockets [ 180.558426][ T6687] netlink: 40 bytes leftover after parsing attributes in process `syz.3.141'. [ 182.150143][ T6704] sysfs: Unknown parameter 'tS' [ 184.974046][ T6726] netlink: 40 bytes leftover after parsing attributes in process `syz.3.150'. [ 189.212875][ T6752] Can't find ip_set type ha [ 194.114284][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 194.321217][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 195.086858][ T6802] veth1_macvtap: left promiscuous mode [ 195.133129][ T6802] macsec0: entered allmulticast mode [ 195.202314][ T6802] veth1_macvtap: entered promiscuous mode [ 195.237058][ T6802] veth1_macvtap: entered allmulticast mode [ 195.269403][ T6807] netlink: 40 bytes leftover after parsing attributes in process `syz.2.171'. [ 195.803814][ T6802] macsec0: left allmulticast mode [ 195.857646][ T6802] veth1_macvtap: left allmulticast mode [ 199.299801][ T6833] netlink: 8 bytes leftover after parsing attributes in process `syz.2.177'. [ 199.336340][ T6833] netdevsim netdevsim2 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.346059][ T6833] netdevsim netdevsim2 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.355594][ T6833] netdevsim netdevsim2 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 199.364338][ T6833] netdevsim netdevsim2 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 200.442846][ T6828] netlink: 8 bytes leftover after parsing attributes in process `syz.3.179'. [ 200.455993][ T6828] netdevsim netdevsim3 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 200.466378][ T6828] netdevsim netdevsim3 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 200.475101][ T6828] netdevsim netdevsim3 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 200.483825][ T6828] netdevsim netdevsim3 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 203.377860][ T6865] netlink: 40 bytes leftover after parsing attributes in process `syz.0.184'. [ 204.770783][ T6871] 9pnet_fd: Insufficient options for proto=fd [ 209.530997][ T6904] ieee802154 phy0 wpan0: encryption failed: -22 [ 211.480615][ T5156] Bluetooth: hci1: command 0x0406 tx timeout [ 211.486759][ T5856] Bluetooth: hci3: command 0x0406 tx timeout [ 211.493093][ T5156] Bluetooth: hci0: command 0x0406 tx timeout [ 211.500066][ T5856] Bluetooth: hci2: command 0x0406 tx timeout [ 214.017975][ T6943] Can't find ip_set type ha [ 216.799433][ T6966] xt_CT: No such helper "pptp" [ 217.980369][ T6982] ieee802154 phy0 wpan0: encryption failed: -22 [ 218.516490][ T5952] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 219.050769][ T5952] usb 3-1: config index 0 descriptor too short (expected 23569, got 27) [ 219.059169][ T5952] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 219.091296][ T5952] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 219.207841][ T6994] sysfs: Unknown parameter 'tS' [ 219.607730][ T5952] usb 3-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 219.643987][ T5952] usb 3-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 219.782911][ T5952] usb 3-1: Manufacturer: syz [ 219.821477][ T5952] usb 3-1: config 0 descriptor?? [ 219.898983][ T5952] igorplugusb 3-1:0.0: incorrect number of endpoints [ 221.147675][ T7005] warning: `syz.2.211' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211 [ 223.447936][ T5897] usb 3-1: USB disconnect, device number 2 [ 224.185363][ T7013] xt_CT: No such helper "pptp" [ 225.060647][ T7030] ieee802154 phy0 wpan0: encryption failed: -22 [ 225.124094][ T5979] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 225.372665][ T5979] usb 5-1: config index 0 descriptor too short (expected 23569, got 27) [ 225.629447][ T5979] usb 5-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 225.817725][ T5979] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 225.836693][ T5979] usb 5-1: New USB device found, idVendor=03eb, idProduct=0002, bcdDevice=ba.c0 [ 225.850550][ T5979] usb 5-1: New USB device strings: Mfr=5, Product=0, SerialNumber=0 [ 225.858716][ T5979] usb 5-1: Manufacturer: syz [ 225.872811][ T5979] usb 5-1: config 0 descriptor?? [ 227.462414][ T5979] igorplugusb 5-1:0.0: incorrect number of endpoints [ 230.904679][ T9] usb 5-1: USB disconnect, device number 2 [ 232.523889][ T7063] netlink: 8 bytes leftover after parsing attributes in process `syz.4.234'. [ 232.734377][ T7063] netdevsim netdevsim4 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 232.743270][ T7063] netdevsim netdevsim4 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 232.752142][ T7063] netdevsim netdevsim4 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 232.760970][ T7063] netdevsim netdevsim4 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 234.613772][ T5845] Bluetooth: hci4: link tx timeout [ 234.618966][ T5845] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 235.345827][ T5840] Bluetooth: hci4: link tx timeout [ 235.351062][ T5840] Bluetooth: hci4: killing stalled connection 10:aa:aa:aa:aa:aa [ 235.898552][ T7090] kvm: user requested TSC rate below hardware speed [ 236.048937][ T7096] semctl(GETNCNT/GETZCNT) is since 3.16 Single Unix Specification compliant. [ 236.048937][ T7096] The task syz.4.238 (7096) triggered the difference, watch for misbehavior. [ 236.074519][ T7087] xt_CT: No such helper "pptp" [ 236.207940][ T7083] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.238' sets config #0 [ 237.483106][ T5840] Bluetooth: hci4: command 0x0406 tx timeout [ 238.858485][ T7122] sysfs: Unknown parameter 'tS' [ 239.731801][ T7133] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.245' sets config #0 [ 239.753358][ T7134] fuse: Bad value for 'fd' [ 240.165258][ T7137] netlink: 8 bytes leftover after parsing attributes in process `syz.2.251'. [ 241.912069][ T7168] input: syz1 as /devices/virtual/input/input9 [ 243.207330][ T7161] Can't find ip_set type ha [ 245.107954][ T7218] xt_CT: No such helper "pptp" [ 245.174108][ T7218] kvm: user requested TSC rate below hardware speed [ 245.310887][ T7224] ieee802154 phy0 wpan0: encryption failed: -22 [ 251.629430][ T7266] input: syz1 as /devices/virtual/input/input10 [ 255.484720][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 255.493106][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 256.165714][ T7328] ieee802154 phy0 wpan0: encryption failed: -22 [ 257.254128][ T5845] block nbd2: Receive control failed (result -32) [ 257.298178][ T7330] block nbd2: NBD_DISCONNECT [ 257.305127][ T7330] block nbd2: Send disconnect failed -32 [ 257.325515][ T7330] block nbd2: shutting down sockets [ 258.478883][ T9] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 258.796425][ T9] usb 5-1: Using ep0 maxpacket: 16 [ 258.839061][ T7355] netlink: 8 bytes leftover after parsing attributes in process `syz.3.285'. [ 259.100661][ T9] usb 5-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 259.120444][ T9] usb 5-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 259.178068][ T9] usb 5-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 259.260267][ T9] usb 5-1: config 1 interface 0 has no altsetting 0 [ 259.442657][ T9] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 259.870481][ T9] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 259.923198][ T9] usb 5-1: Product: syz [ 259.927402][ T9] usb 5-1: Manufacturer: syz [ 259.970455][ T9] usb 5-1: SerialNumber: syz [ 259.987688][ T7362] ieee802154 phy0 wpan0: encryption failed: -22 [ 261.492326][ T9] usb 5-1: can't set config #1, error -71 [ 261.661213][ T9] usb 5-1: USB disconnect, device number 3 [ 262.670584][ T7372] input: syz1 as /devices/virtual/input/input11 [ 266.366309][ T7410] xt_CT: No such helper "pptp" [ 266.414364][ T7417] block nbd2: NBD_DISCONNECT [ 266.440456][ T7417] block nbd2: Disconnected due to user request. [ 266.449070][ T7417] block nbd2: shutting down sockets [ 268.540600][ T9] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 269.023660][ T9] usb 4-1: Using ep0 maxpacket: 16 [ 269.141048][ T9] usb 4-1: config 1 interface 0 altsetting 255 endpoint 0x1 has invalid wMaxPacketSize 0 [ 269.490879][ T9] usb 4-1: config 1 interface 0 altsetting 255 bulk endpoint 0x1 has invalid maxpacket 0 [ 269.513217][ T9] usb 4-1: config 1 interface 0 altsetting 255 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 269.533717][ T9] usb 4-1: config 1 interface 0 has no altsetting 0 [ 269.613309][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 269.693235][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 269.701299][ T9] usb 4-1: Product: syz [ 269.706500][ T9] usb 4-1: Manufacturer: syz [ 270.078080][ T9] usb 4-1: SerialNumber: syz [ 270.516197][ T9] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 3 if 0 alt 255 proto 1 vid 0x0525 pid 0xA4A8 [ 271.053486][ T7462] usblp0:failed reading printer status (-32) [ 271.142038][ T5952] usb 4-1: USB disconnect, device number 3 [ 271.351601][ T5952] usblp0: removed [ 274.611134][ T7486] netlink: 8 bytes leftover after parsing attributes in process `syz.2.311'. [ 276.106013][ T7497] ieee802154 phy0 wpan0: encryption failed: -22 [ 277.704559][ T7507] ieee802154 phy0 wpan0: encryption failed: -22 [ 280.302119][ T7524] block nbd4: NBD_DISCONNECT [ 280.333400][ T7524] block nbd4: Disconnected due to user request. [ 280.388446][ T7524] block nbd4: shutting down sockets [ 287.132927][ T7570] Can't find ip_set type ha [ 287.409983][ T7576] 9pnet_fd: Insufficient options for proto=fd [ 290.250244][ T7599] netlink: 8 bytes leftover after parsing attributes in process `syz.2.340'. [ 291.587863][ T7620] veth1_macvtap: left promiscuous mode [ 291.620066][ T7620] macsec0: entered allmulticast mode [ 291.852807][ T7622] 9pnet_fd: Insufficient options for proto=fd [ 292.127241][ T7624] block nbd0: NBD_DISCONNECT [ 294.303598][ T7638] netlink: 8 bytes leftover after parsing attributes in process `syz.3.352'. [ 295.333435][ T7643] Can't find ip_set type ha [ 295.619458][ T7648] netlink: 8 bytes leftover after parsing attributes in process `syz.3.354'. [ 296.577825][ T7635] syz.4.351 (7635): drop_caches: 2 [ 296.831084][ T7654] 9pnet_fd: Insufficient options for proto=fd [ 296.875258][ T7658] veth1_macvtap: left promiscuous mode [ 296.884270][ T7658] macsec0: entered allmulticast mode [ 297.018619][ T7657] netlink: 8 bytes leftover after parsing attributes in process `syz.2.356'. [ 297.830561][ T7661] netlink: 8 bytes leftover after parsing attributes in process `syz.0.359'. [ 298.299148][ T7677] netlink: 8 bytes leftover after parsing attributes in process `syz.3.360'. [ 298.926685][ T7685] netlink: 8 bytes leftover after parsing attributes in process `syz.0.364'. [ 301.480988][ T7698] veth1_macvtap: left promiscuous mode [ 301.512381][ T7698] macsec0: entered allmulticast mode [ 301.527179][ T7698] veth1_macvtap: entered promiscuous mode [ 301.534258][ T7698] veth1_macvtap: entered allmulticast mode [ 301.540164][ T7698] macsec0: left allmulticast mode [ 301.545318][ T7698] veth1_macvtap: left allmulticast mode [ 301.835141][ T7705] netlink: 8 bytes leftover after parsing attributes in process `syz.3.368'. [ 302.219953][ T5845] block nbd0: Receive control failed (result -32) [ 302.537652][ T7699] block nbd0: shutting down sockets [ 305.472939][ T7724] 9pnet_fd: Insufficient options for proto=fd [ 307.246337][ T7727] syz.1.374 (7727): drop_caches: 2 [ 307.253290][ T7727] syz.1.374 (7727): drop_caches: 2 [ 307.676027][ T7732] netlink: 8 bytes leftover after parsing attributes in process `syz.0.376'. [ 307.744427][ T7709] syz.2.369 (7709): drop_caches: 2 [ 308.638754][ T7738] Can't find ip_set type ha [ 309.065126][ T7747] netlink: 8 bytes leftover after parsing attributes in process `syz.1.378'. [ 309.099643][ T7747] netdevsim netdevsim1 netdevsim0: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.108431][ T7747] netdevsim netdevsim1 netdevsim1: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.118252][ T7747] netdevsim netdevsim1 netdevsim2: set [0, 0] type 1 family 0 port 8472 - 0 [ 309.127797][ T7747] netdevsim netdevsim1 netdevsim3: set [0, 0] type 1 family 0 port 8472 - 0 [ 316.924578][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 316.931202][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 320.371658][ T7820] netlink: 8 bytes leftover after parsing attributes in process `syz.4.396'. [ 320.963384][ T7827] netlink: 40 bytes leftover after parsing attributes in process `syz.4.398'. [ 324.339823][ T7843] netlink: 8 bytes leftover after parsing attributes in process `syz.4.402'. [ 329.028512][ T7868] netlink: 8 bytes leftover after parsing attributes in process `syz.4.406'. [ 330.181253][ T7877] netlink: 8 bytes leftover after parsing attributes in process `syz.2.411'. [ 335.420762][ T7896] block nbd3: NBD_DISCONNECT [ 335.425563][ T7896] block nbd3: Disconnected due to user request. [ 335.445145][ T7896] block nbd3: shutting down sockets [ 342.466951][ T7929] xt_CT: No such helper "pptp" [ 342.498744][ T7931] kvm: user requested TSC rate below hardware speed [ 343.366722][ T7940] syz.3.427 (7940): drop_caches: 2 [ 343.403201][ T7940] syz.3.427 (7940): drop_caches: 2 [ 343.790976][ T7922] Can't find ip_set type ha [ 350.238623][ T7995] kvm: user requested TSC rate below hardware speed [ 350.332838][ T7990] block nbd4: NBD_DISCONNECT [ 350.338160][ T7990] block nbd4: Disconnected due to user request. [ 350.387374][ T7990] block nbd4: shutting down sockets [ 350.456211][ T7988] xt_CT: No such helper "pptp" [ 355.337255][ T8041] ieee802154 phy0 wpan0: encryption failed: -22 [ 356.695675][ T8050] 9pnet_fd: Insufficient options for proto=fd [ 358.653558][ T8070] kvm: user requested TSC rate below hardware speed [ 358.698833][ T8068] xt_CT: No such helper "pptp" [ 358.911493][ T8075] block nbd2: NBD_DISCONNECT [ 358.917276][ T8075] block nbd2: Disconnected due to user request. [ 358.946699][ T8075] block nbd2: shutting down sockets [ 359.723267][ T8082] syz.0.459 (8082): drop_caches: 2 [ 359.734698][ T8082] syz.0.459 (8082): drop_caches: 2 [ 361.329062][ T8093] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.461' sets config #0 [ 361.552013][ T8105] netlink: 8 bytes leftover after parsing attributes in process `syz.2.464'. [ 365.708325][ T8132] ieee802154 phy0 wpan0: encryption failed: -22 [ 367.443082][ T8140] syz.4.472 (8140): drop_caches: 2 [ 367.456379][ T8140] syz.4.472 (8140): drop_caches: 2 [ 370.513002][ T8171] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.478' sets config #0 [ 371.017121][ T8174] veth1_macvtap: left promiscuous mode [ 371.023659][ T8174] macsec0: entered allmulticast mode [ 377.445937][ T8162] sched: DL replenish lagged too much [ 377.848730][ T8197] capability: warning: `syz.0.487' uses 32-bit capabilities (legacy support in use) [ 378.373275][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 378.489519][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 379.721140][ T8212] netlink: 40 bytes leftover after parsing attributes in process `syz.1.488'. [ 379.817842][ T30] audit: type=1326 audit(1755603331.316:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10f4d8ebe9 code=0x7ffc0000 [ 379.861432][ T30] audit: type=1326 audit(1755603331.346:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10f4d8ebe9 code=0x7ffc0000 [ 379.945918][ T30] audit: type=1326 audit(1755603331.346:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7f10f4d8ebe9 code=0x7ffc0000 [ 380.180455][ T5953] usb 1-1: new high-speed USB device number 2 using dummy_hcd [ 380.781427][ T30] audit: type=1326 audit(1755603331.346:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10f4d8ebe9 code=0x7ffc0000 [ 380.864068][ T30] audit: type=1326 audit(1755603331.346:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f10f4d8ebe9 code=0x7ffc0000 [ 381.321082][ T30] audit: type=1326 audit(1755603331.346:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f10f4d8d550 code=0x7ffc0000 [ 381.461497][ T30] audit: type=1326 audit(1755603331.346:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f10f4d8e7eb code=0x7ffc0000 [ 381.490838][ T30] audit: type=1326 audit(1755603331.346:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f10f4d8e7eb code=0x7ffc0000 [ 381.516333][ T30] audit: type=1326 audit(1755603331.346:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f10f4d8e7eb code=0x7ffc0000 [ 381.544442][ T30] audit: type=1326 audit(1755603331.346:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8215 comm="syz.0.491" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f10f4d8e7eb code=0x7ffc0000 [ 381.570493][ T5953] usb 1-1: Using ep0 maxpacket: 16 [ 381.737723][ T5953] usb 1-1: descriptor type invalid, skip [ 381.750523][ T5953] usb 1-1: descriptor type invalid, skip [ 382.425052][ T8237] input: syz1 as /devices/virtual/input/input12 [ 383.196762][ T5953] usb 1-1: descriptor type invalid, skip [ 384.967280][ T5953] usb 1-1: unable to read config index 0 descriptor/start: -71 [ 385.097815][ T5953] usb 1-1: can't read configurations, error -71 [ 388.056247][ T8265] usb usb1: usbfs: interface 0 claimed by hub while 'syz.0.499' sets config #0 [ 392.591325][ T8326] usb usb1: usbfs: interface 0 claimed by hub while 'syz.3.516' sets config #0 [ 392.730425][ T5897] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 393.011935][ T5897] usb 5-1: config 0 has an invalid interface number: 217 but max is 0 [ 393.020148][ T5897] usb 5-1: config 0 has no interface number 0 [ 393.049519][ T5897] usb 5-1: New USB device found, idVendor=a168, idProduct=0618, bcdDevice=e3.a4 [ 393.087062][ T5897] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 393.110428][ T5897] usb 5-1: Product: syz [ 393.114626][ T5897] usb 5-1: Manufacturer: syz [ 393.141777][ T5897] usb 5-1: SerialNumber: syz [ 393.164199][ T5897] usb 5-1: config 0 descriptor?? [ 393.186295][ T5897] gspca_main: gspca_sn9c20x-2.14.0 probing a168:0618 [ 394.496939][ T5897] gspca_sn9c20x: Write register 1000 failed -110 [ 394.665250][ T5953] usb 2-1: new full-speed USB device number 2 using dummy_hcd [ 396.057718][ T5897] gspca_sn9c20x: Device initialization failed [ 396.080467][ T5897] gspca_sn9c20x 5-1:0.217: probe with driver gspca_sn9c20x failed with error -110 [ 396.086307][ T8324] ptm ptm0: ldisc open failed (-12), clearing slot 0 [ 396.174830][ T8342] tty tty2: ldisc open failed (-12), clearing slot 1 [ 396.280816][ T2153] usb 5-1: USB disconnect, device number 4 [ 396.543631][ T8358] block nbd2: NBD_DISCONNECT [ 396.571131][ T8359] netlink: 20 bytes leftover after parsing attributes in process `syz.1.525'. [ 396.582020][ T5953] usb 2-1: device not accepting address 2, error -71 [ 399.298681][ T8384] usb usb1: usbfs: interface 0 claimed by hub while 'syz.4.534' sets config #0 [ 399.780478][ T2153] usb 2-1: new full-speed USB device number 4 using dummy_hcd [ 399.960175][ T2153] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 399.977194][ T2153] usb 2-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 400.010710][ T2153] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 400.025342][ T8396] ptrace attach of "./syz-executor exec"[5848] was attempted by " [ 400.085942][ T8396] syz_tun: entered allmulticast mode [ 400.218268][ T2153] usb 2-1: config 0 descriptor?? [ 400.331218][ T8390] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 400.530879][ T8394] syz_tun: left allmulticast mode [ 401.391962][ T2153] usbhid 2-1:0.0: can't add hid device: -71 [ 401.455412][ T2153] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 401.556551][ T2153] usb 2-1: USB disconnect, device number 4 [ 402.833342][ T8419] netlink: 44 bytes leftover after parsing attributes in process `syz.1.544'. [ 403.135589][ T8419] netlink: 24 bytes leftover after parsing attributes in process `syz.1.544'. [ 403.147991][ T8433] FAULT_INJECTION: forcing a failure. [ 403.147991][ T8433] name failslab, interval 1, probability 0, space 0, times 1 [ 403.199749][ T8433] CPU: 0 UID: 0 PID: 8433 Comm: syz.0.547 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 403.199776][ T8433] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 403.199797][ T8433] Call Trace: [ 403.199814][ T8433] [ 403.199824][ T8433] dump_stack_lvl+0x189/0x250 [ 403.199854][ T8433] ? __pfx____ratelimit+0x10/0x10 [ 403.199877][ T8433] ? __pfx_dump_stack_lvl+0x10/0x10 [ 403.199902][ T8433] ? __pfx__printk+0x10/0x10 [ 403.199937][ T8433] ? __pfx___might_resched+0x10/0x10 [ 403.199960][ T8433] ? fs_reclaim_acquire+0x7d/0x100 [ 403.199992][ T8433] should_fail_ex+0x414/0x560 [ 403.200021][ T8433] should_failslab+0xa8/0x100 [ 403.200047][ T8433] __kmalloc_noprof+0xcb/0x4f0 [ 403.200066][ T8433] ? kfree+0x4d/0x440 [ 403.200096][ T8433] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 403.200131][ T8433] tomoyo_realpath_from_path+0xe3/0x5d0 [ 403.200162][ T8433] ? tomoyo_domain+0xda/0x130 [ 403.200197][ T8433] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 403.200221][ T8433] tomoyo_path_number_perm+0x1e8/0x5a0 [ 403.200260][ T8433] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 403.200299][ T8433] ? __lock_acquire+0xab9/0xd20 [ 403.200344][ T8433] ? __fget_files+0x2a/0x420 [ 403.200384][ T8433] ? __fget_files+0x2a/0x420 [ 403.200403][ T8433] ? __fget_files+0x3a0/0x420 [ 403.200422][ T8433] ? __fget_files+0x2a/0x420 [ 403.200447][ T8433] security_file_ioctl+0xcb/0x2d0 [ 403.200470][ T8433] __se_sys_ioctl+0x47/0x170 [ 403.200500][ T8433] do_syscall_64+0xfa/0x3b0 [ 403.200528][ T8433] ? lockdep_hardirqs_on+0x9c/0x150 [ 403.200547][ T8433] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.200566][ T8433] ? clear_bhb_loop+0x60/0xb0 [ 403.200589][ T8433] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 403.200606][ T8433] RIP: 0033:0x7f10f4d8ebe9 [ 403.200627][ T8433] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 403.200643][ T8433] RSP: 002b:00007f10f5b59038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 403.200667][ T8433] RAX: ffffffffffffffda RBX: 00007f10f4fb5fa0 RCX: 00007f10f4d8ebe9 [ 403.200681][ T8433] RDX: 0000200000000080 RSI: 0000000000004b72 RDI: 0000000000000003 [ 403.200692][ T8433] RBP: 00007f10f5b59090 R08: 0000000000000000 R09: 0000000000000000 [ 403.200703][ T8433] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 403.200714][ T8433] R13: 00007f10f4fb6038 R14: 00007f10f4fb5fa0 R15: 00007ffcdab792c8 [ 403.200742][ T8433] [ 403.458595][ T8433] ERROR: Out of memory at tomoyo_realpath_from_path. [ 403.634578][ T30] kauditd_printk_skb: 12 callbacks suppressed [ 403.634594][ T30] audit: type=1326 audit(1755603355.136:24): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8440 comm="syz.0.550" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f10f4d8ebe9 code=0x0 [ 403.918442][ T8443] usb usb1: usbfs: interface 0 claimed by hub while 'syz.1.549' sets config #0 [ 404.268187][ T8447] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list [ 404.295496][ T8447] xt_TCPMSS: path-MTU clamping only supported in FORWARD, OUTPUT and POSTROUTING hooks [ 404.356460][ T8455] ======================================================= [ 404.356460][ T8455] WARNING: The mand mount option has been deprecated and [ 404.356460][ T8455] and is ignored by this kernel. Remove the mand [ 404.356460][ T8455] option from the mount to silence this warning. [ 404.356460][ T8455] ======================================================= [ 404.418875][ T8455] affs: No valid root block on device nullb0 [ 404.425225][ T2153] usb 1-1: new full-speed USB device number 4 using dummy_hcd [ 404.437858][ T8455] affs: No valid root block on device nullb0 [ 404.451084][ T8455] affs: No valid root block on device nullb0 [ 404.472457][ T8455] affs: No valid root block on device nullb0 [ 404.487677][ T8455] affs: No valid root block on device nullb0 [ 404.498286][ T8455] affs: No valid root block on device nullb0 [ 404.522019][ T8455] affs: No valid root block on device nullb0 [ 404.536180][ T8455] affs: No valid root block on device nullb0 [ 404.721104][ T2153] usb 1-1: too many configurations: 227, using maximum allowed: 8 [ 404.737223][ T8455] affs: No valid root block on device nullb0 [ 405.175367][ T8455] affs: No valid root block on device nullb0 [ 405.242634][ T30] audit: type=1800 audit(1755603356.736:25): pid=8449 uid=0 auid=4294967295 ses=4294967295 subj=_ op=set_data cause=unavailable-hash-algorithm comm="syz.4.552" name="/virtual_nci" dev="devtmpfs" ino=698 res=0 errno=0 [ 405.374925][ T2153] usb 1-1: New USB device found, idVendor=055d, idProduct=9000, bcdDevice=31.44 [ 405.484519][ T2153] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 405.535447][ T2153] usb 1-1: config 0 descriptor?? [ 405.608725][ T2153] pwc: Samsung MPC-C10 USB webcam detected. [ 405.641078][ T2153] pwc: Warning: more than 1 configuration available. [ 406.842857][ T8474] FAULT_INJECTION: forcing a failure. [ 406.842857][ T8474] name failslab, interval 1, probability 0, space 0, times 0 [ 406.855874][ T8474] CPU: 1 UID: 0 PID: 8474 Comm: syz.3.557 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 406.855896][ T8474] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 406.855907][ T8474] Call Trace: [ 406.855914][ T8474] [ 406.855922][ T8474] dump_stack_lvl+0x189/0x250 [ 406.855947][ T8474] ? __pfx____ratelimit+0x10/0x10 [ 406.855970][ T8474] ? __pfx_dump_stack_lvl+0x10/0x10 [ 406.855990][ T8474] ? __pfx__printk+0x10/0x10 [ 406.856019][ T8474] ? __pfx___might_resched+0x10/0x10 [ 406.856044][ T8474] should_fail_ex+0x414/0x560 [ 406.856068][ T8474] should_failslab+0xa8/0x100 [ 406.856090][ T8474] kmem_cache_alloc_noprof+0x73/0x3c0 [ 406.856107][ T8474] ? mas_alloc_nodes+0x2e9/0x8e0 [ 406.856130][ T8474] mas_alloc_nodes+0x2e9/0x8e0 [ 406.856157][ T8474] mas_preallocate+0x3ad/0x6f0 [ 406.856180][ T8474] ? __pfx_mas_preallocate+0x10/0x10 [ 406.856209][ T8474] ? __mas_set_range+0x12f/0x3c0 [ 406.856241][ T8474] __split_vma+0x2fa/0xa00 [ 406.856277][ T8474] ? __pfx___split_vma+0x10/0x10 [ 406.856324][ T8474] vms_gather_munmap_vmas+0x4ab/0x12b0 [ 406.856369][ T8474] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 406.856414][ T8474] mmap_region+0x678/0x1f30 [ 406.856459][ T8474] ? __pfx_mmap_region+0x10/0x10 [ 406.856490][ T8474] ? is_bpf_text_address+0x26/0x2b0 [ 406.856526][ T8474] ? __lock_acquire+0xab9/0xd20 [ 406.856584][ T8474] ? mm_get_unmapped_area+0xa7/0xd0 [ 406.856606][ T8474] ? shmem_get_unmapped_area+0x2cf/0x910 [ 406.856637][ T8474] ? cap_mmap_addr+0xb0/0x100 [ 406.856659][ T8474] ? bpf_lsm_mmap_addr+0x9/0x20 [ 406.856678][ T8474] ? security_mmap_addr+0x71/0x270 [ 406.856707][ T8474] do_mmap+0xc45/0x10d0 [ 406.856747][ T8474] ? __pfx_do_mmap+0x10/0x10 [ 406.856772][ T8474] ? down_write_killable+0x178/0x230 [ 406.856796][ T8474] ? __pfx_vfs_write+0x10/0x10 [ 406.856813][ T8474] ? __pfx_down_write_killable+0x10/0x10 [ 406.856836][ T8474] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 406.856863][ T8474] vm_mmap_pgoff+0x31b/0x4c0 [ 406.856896][ T8474] ? __pfx_vm_mmap_pgoff+0x10/0x10 [ 406.856919][ T8474] ? ksys_write+0x22a/0x250 [ 406.856938][ T8474] ? __pfx_ksys_write+0x10/0x10 [ 406.856952][ T8474] ? rcu_is_watching+0x15/0xb0 [ 406.856974][ T8474] ? ksys_mmap_pgoff+0xf4/0x760 [ 406.856991][ T8474] ? __x64_sys_mmap+0x7f/0x140 [ 406.857014][ T8474] do_syscall_64+0xfa/0x3b0 [ 406.857033][ T8474] ? lockdep_hardirqs_on+0x9c/0x150 [ 406.857052][ T8474] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.857070][ T8474] ? clear_bhb_loop+0x60/0xb0 [ 406.857092][ T8474] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 406.857109][ T8474] RIP: 0033:0x7feb8738ebe9 [ 406.857125][ T8474] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 406.857140][ T8474] RSP: 002b:00007feb8826e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000009 [ 406.857159][ T8474] RAX: ffffffffffffffda RBX: 00007feb875b5fa0 RCX: 00007feb8738ebe9 [ 406.857172][ T8474] RDX: b635773f06ebbeef RSI: 0000000000b36000 RDI: 0000200000000000 [ 406.857184][ T8474] RBP: 00007feb8826e090 R08: ffffffffffffffff R09: 0000000000000000 [ 406.857196][ T8474] R10: 0000000000008031 R11: 0000000000000246 R12: 0000000000000001 [ 406.857207][ T8474] R13: 00007feb875b6038 R14: 00007feb875b5fa0 R15: 00007ffd7f5d9b28 [ 406.857236][ T8474] [ 407.182122][ T2153] pwc: send_video_command error -71 [ 407.187363][ T2153] pwc: Failed to set video mode VGA@30 fps; return code = -71 [ 407.196514][ T2153] Philips webcam 1-1:0.0: probe with driver Philips webcam failed with error -71 [ 407.218094][ T2153] usb 1-1: USB disconnect, device number 4 [ 408.422234][ T8488] tipc: Started in network mode [ 408.427222][ T8485] xt_CT: No such helper "pptp" [ 408.441737][ T8489] kvm: user requested TSC rate below hardware speed [ 408.447789][ T8488] tipc: Node identity fe80000000000000000000000000001, cluster identity 4711 [ 408.514279][ T8488] tipc: Enabled bearer , priority 10 [ 409.735422][ T8062] tipc: Node number set to 4269801488 [ 409.936922][ T8502] veth1_macvtap: left promiscuous mode [ 410.133956][ T8502] macsec0: entered allmulticast mode [ 411.420649][ T9] usb 1-1: new high-speed USB device number 5 using dummy_hcd [ 411.787487][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 411.863494][ T9] usb 1-1: New USB device found, idVendor=0d49, idProduct=7010, bcdDevice= c.90 [ 411.873175][ T9] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 411.895449][ T9] usb 1-1: Product: syz [ 411.899671][ T9] usb 1-1: Manufacturer: syz [ 411.904545][ T9] usb 1-1: SerialNumber: syz [ 411.931068][ T9] usb 1-1: config 0 descriptor?? [ 412.032270][ T9] ums-onetouch 1-1:0.0: USB Mass Storage device detected [ 412.072823][ T5897] usb 2-1: new full-speed USB device number 5 using dummy_hcd [ 412.460878][ T5897] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 412.485981][ T5897] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 412.508687][ T5897] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 412.520675][ T5897] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 412.528674][ T5897] usb 2-1: Product: syz [ 412.545324][ T9] usb 1-1: USB disconnect, device number 5 [ 412.588530][ T5897] usb 2-1: Manufacturer: syz [ 412.600764][ T5897] usb 2-1: SerialNumber: syz [ 413.863394][ T5897] usb 2-1: 0:2 : does not exist [ 413.876319][ T5897] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 413.902769][ T5897] usb 2-1: USB disconnect, device number 5 [ 414.026296][ T8325] udevd[8325]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 414.426803][ T8551] veth1_macvtap: left promiscuous mode [ 414.436686][ T8551] macsec0: entered allmulticast mode [ 414.478353][ T8553] genirq: Flags mismatch irq 4. 00200000 (pcl812) vs. 00200080 (ttyS0) [ 415.072369][ T5845] block nbd0: Receive control failed (result -32) [ 415.072431][ T8547] block nbd0: shutting down sockets [ 418.872910][ T8579] ptrace attach of "./syz-executor exec"[5835] was attempted by " [ 418.874806][ T8579] syz_tun: entered allmulticast mode [ 419.203458][ T2153] usb 5-1: new high-speed USB device number 5 using dummy_hcd [ 419.820413][ T2153] usb 5-1: Using ep0 maxpacket: 8 [ 419.831361][ T2153] usb 5-1: config 2 has an invalid interface number: 169 but max is 0 [ 419.858999][ T2153] usb 5-1: config 2 has no interface number 0 [ 419.870604][ T2153] usb 5-1: New USB device found, idVendor=1163, idProduct=0200, bcdDevice=b8.92 [ 419.886753][ T2153] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 419.898243][ T8575] syz_tun: left allmulticast mode [ 419.924920][ T2153] cypress_m8 5-1:2.169: DeLorme Earthmate USB converter detected [ 419.953071][ T8585] binder_alloc: 8584: binder_alloc_buf, no vma [ 419.955535][ T2153] earthmate ttyUSB0: required endpoint is missing [ 420.010870][ T8062] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 420.172896][ T8062] usb 4-1: Using ep0 maxpacket: 8 [ 420.197694][ T8062] usb 4-1: config index 0 descriptor too short (expected 30, got 18) [ 420.213011][ T8062] usb 4-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 420.261827][ T8062] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 420.278488][ T8062] usb 4-1: Product: syz [ 420.295414][ T8062] usb 4-1: Manufacturer: syz [ 420.330029][ T8062] usb 4-1: SerialNumber: syz [ 420.542140][ T8062] usb 4-1: config 0 descriptor?? [ 420.553681][ T8062] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 420.570887][ T8062] usb 4-1: setting power ON [ 420.575933][ T8062] dvb-usb: bulk message failed: -22 (2/0) [ 420.635985][ T8062] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 420.656235][ T8062] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 420.675391][ T8062] usb 4-1: media controller created [ 420.749583][ T8062] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 420.751271][ T9] usb 5-1: USB disconnect, device number 5 [ 420.765615][ T8582] dvb-usb: bulk message failed: -22 (3/0) [ 420.771484][ T8582] cxusb: i2c wr: len=80 is too big! [ 420.771484][ T8582] [ 420.779944][ T8582] netlink: 44 bytes leftover after parsing attributes in process `syz.3.589'. [ 420.834532][ T9] cypress_m8 5-1:2.169: device disconnected [ 420.843051][ T8596] JFS: charset not found [ 420.879229][ T8062] usb 4-1: selecting invalid altsetting 6 [ 420.899839][ T8062] usb 4-1: digital interface selection failed (-22) [ 420.911564][ T8062] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 420.938692][ T8062] usb 4-1: setting power OFF [ 420.948627][ T8062] dvb-usb: bulk message failed: -22 (2/0) [ 420.962485][ T8062] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 420.982114][ T8062] (NULL device *): no alternate interface [ 422.021494][ T8602] block nbd0: shutting down sockets [ 423.628104][ T8062] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 423.664549][ T8062] usb 4-1: USB disconnect, device number 4 [ 424.989227][ T8630] kvm: user requested TSC rate below hardware speed [ 425.114200][ T8626] xt_CT: No such helper "pptp" [ 425.380477][ T24] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 425.921985][ T24] usb 4-1: unable to get BOS descriptor or descriptor too short [ 426.296014][ T24] usb 4-1: unable to read config index 0 descriptor/start: -71 [ 426.303785][ T24] usb 4-1: can't read configurations, error -71 [ 426.444496][ T8638] netlink: 40 bytes leftover after parsing attributes in process `syz.0.605'. [ 429.513605][ T8652] block nbd1: shutting down sockets [ 430.195800][ T8665] FAULT_INJECTION: forcing a failure. [ 430.195800][ T8665] name failslab, interval 1, probability 0, space 0, times 0 [ 430.208653][ T8665] CPU: 1 UID: 0 PID: 8665 Comm: syz.0.614 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 430.208675][ T8665] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 430.208686][ T8665] Call Trace: [ 430.208693][ T8665] [ 430.208702][ T8665] dump_stack_lvl+0x189/0x250 [ 430.208722][ T8665] ? __pfx____ratelimit+0x10/0x10 [ 430.208737][ T8665] ? __pfx_dump_stack_lvl+0x10/0x10 [ 430.208751][ T8665] ? __pfx__printk+0x10/0x10 [ 430.208772][ T8665] ? __pfx___might_resched+0x10/0x10 [ 430.208786][ T8665] ? fs_reclaim_acquire+0x7d/0x100 [ 430.208805][ T8665] should_fail_ex+0x414/0x560 [ 430.208822][ T8665] should_failslab+0xa8/0x100 [ 430.208837][ T8665] __kmalloc_noprof+0xcb/0x4f0 [ 430.208848][ T8665] ? kfree+0x4d/0x440 [ 430.208872][ T8665] ? tomoyo_realpath_from_path+0xe3/0x5d0 [ 430.208893][ T8665] tomoyo_realpath_from_path+0xe3/0x5d0 [ 430.208911][ T8665] ? tomoyo_domain+0xda/0x130 [ 430.208932][ T8665] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 430.208946][ T8665] tomoyo_path_number_perm+0x1e8/0x5a0 [ 430.208961][ T8665] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 430.208996][ T8665] ? __lock_acquire+0xab9/0xd20 [ 430.209032][ T8665] ? __fget_files+0x2a/0x420 [ 430.209058][ T8665] ? __fget_files+0x2a/0x420 [ 430.209072][ T8665] ? __fget_files+0x3a0/0x420 [ 430.209086][ T8665] ? __fget_files+0x2a/0x420 [ 430.209104][ T8665] security_file_ioctl+0xcb/0x2d0 [ 430.209121][ T8665] __se_sys_ioctl+0x47/0x170 [ 430.209142][ T8665] do_syscall_64+0xfa/0x3b0 [ 430.209158][ T8665] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.209187][ T8665] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 430.209202][ T8665] ? clear_bhb_loop+0x60/0xb0 [ 430.209220][ T8665] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 430.209235][ T8665] RIP: 0033:0x7f10f4d8ebe9 [ 430.209248][ T8665] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 430.209261][ T8665] RSP: 002b:00007f10f5b17038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 430.209276][ T8665] RAX: ffffffffffffffda RBX: 00007f10f4fb6180 RCX: 00007f10f4d8ebe9 [ 430.209288][ T8665] RDX: 0000200000000140 RSI: 0000000040345410 RDI: 0000000000000004 [ 430.209297][ T8665] RBP: 00007f10f5b17090 R08: 0000000000000000 R09: 0000000000000000 [ 430.209307][ T8665] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 430.209315][ T8665] R13: 00007f10f4fb6218 R14: 00007f10f4fb6180 R15: 00007ffcdab792c8 [ 430.209339][ T8665] [ 430.209402][ T8665] ERROR: Out of memory at tomoyo_realpath_from_path. [ 431.190533][ T8676] ieee802154 phy0 wpan0: encryption failed: -22 [ 431.399516][ T8062] usb 5-1: new high-speed USB device number 6 using dummy_hcd [ 432.703784][ T2153] usb 1-1: new high-speed USB device number 6 using dummy_hcd [ 432.730845][ T8062] usb 5-1: Using ep0 maxpacket: 16 [ 432.744235][ T8062] usb 5-1: New USB device found, idVendor=04dd, idProduct=8002, bcdDevice=fc.b6 [ 432.762972][ T8062] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 432.784866][ T8062] usb 5-1: Product: syz [ 432.791711][ T8062] usb 5-1: Manufacturer: syz [ 432.796556][ T8062] usb 5-1: SerialNumber: syz [ 432.930526][ T2153] usb 1-1: Using ep0 maxpacket: 16 [ 432.936991][ T8062] usb 5-1: config 0 descriptor?? [ 432.954144][ T2153] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 432.966589][ T8062] safe_serial 5-1:0.0: safe_serial converter detected [ 432.975364][ T2153] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 432.990015][ T2153] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 433.002390][ T8062] usb 5-1: safe_serial converter now attached to ttyUSB0 [ 433.010721][ T2153] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 434.266455][ T8062] usb 5-1: USB disconnect, device number 6 [ 434.272539][ T2153] usb 1-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 434.320876][ T8062] safe_serial ttyUSB0: safe_serial converter now disconnected from ttyUSB0 [ 434.337211][ T8062] safe_serial 5-1:0.0: device disconnected [ 434.471556][ T2153] usb 1-1: string descriptor 0 read error: -71 [ 434.545572][ T2153] usb 1-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 434.598720][ T2153] usb 1-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 434.699613][ T2153] usb 1-1: config 0 descriptor?? [ 435.622294][ T2153] usb 1-1: can't set config #0, error -71 [ 436.345078][ T2153] usb 1-1: USB disconnect, device number 6 [ 436.689659][ T8706] block nbd3: shutting down sockets [ 438.344658][ T8731] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 438.547761][ T8736] FAULT_INJECTION: forcing a failure. [ 438.547761][ T8736] name failslab, interval 1, probability 0, space 0, times 0 [ 438.600553][ T8736] CPU: 0 UID: 0 PID: 8736 Comm: syz.4.632 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 438.600576][ T8736] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 438.600584][ T8736] Call Trace: [ 438.600590][ T8736] [ 438.600596][ T8736] dump_stack_lvl+0x189/0x250 [ 438.600614][ T8736] ? __pfx____ratelimit+0x10/0x10 [ 438.600628][ T8736] ? __pfx_dump_stack_lvl+0x10/0x10 [ 438.600643][ T8736] ? __pfx__printk+0x10/0x10 [ 438.600661][ T8736] ? __pfx___might_resched+0x10/0x10 [ 438.600676][ T8736] ? fs_reclaim_acquire+0x7d/0x100 [ 438.600694][ T8736] should_fail_ex+0x414/0x560 [ 438.600711][ T8736] should_failslab+0xa8/0x100 [ 438.600727][ T8736] __kmalloc_cache_noprof+0x70/0x3d0 [ 438.600739][ T8736] ? __vb2_init_fileio+0x1e8/0xff0 [ 438.600763][ T8736] __vb2_init_fileio+0x1e8/0xff0 [ 438.600782][ T8736] ? __might_fault+0xb0/0x130 [ 438.600795][ T8736] ? _parse_integer_limit+0x1ae/0x1f0 [ 438.600810][ T8736] ? vb2_fop_write+0x11a/0x340 [ 438.600832][ T8736] __vb2_perform_fileio+0x284/0x1600 [ 438.600858][ T8736] ? __asan_memset+0x22/0x50 [ 438.600879][ T8736] vb2_fop_write+0x22f/0x340 [ 438.600900][ T8736] v4l2_write+0x19c/0x2c0 [ 438.600923][ T8736] vfs_writev+0x4b3/0x960 [ 438.600940][ T8736] ? __pfx_v4l2_write+0x10/0x10 [ 438.600961][ T8736] ? __pfx_vfs_writev+0x10/0x10 [ 438.600986][ T8736] ? __fget_files+0x2a/0x420 [ 438.601004][ T8736] ? __fget_files+0x3a0/0x420 [ 438.601017][ T8736] ? __fget_files+0x2a/0x420 [ 438.601043][ T8736] do_writev+0x14d/0x2d0 [ 438.601060][ T8736] ? __pfx_do_writev+0x10/0x10 [ 438.601080][ T8736] ? do_syscall_64+0xbe/0x3b0 [ 438.601097][ T8736] do_syscall_64+0xfa/0x3b0 [ 438.601110][ T8736] ? lockdep_hardirqs_on+0x9c/0x150 [ 438.601125][ T8736] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.601137][ T8736] ? clear_bhb_loop+0x60/0xb0 [ 438.601153][ T8736] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 438.601166][ T8736] RIP: 0033:0x7fbede98ebe9 [ 438.601181][ T8736] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 438.601192][ T8736] RSP: 002b:00007fbedf8b9038 EFLAGS: 00000246 ORIG_RAX: 0000000000000014 [ 438.601206][ T8736] RAX: ffffffffffffffda RBX: 00007fbedebb5fa0 RCX: 00007fbede98ebe9 [ 438.601215][ T8736] RDX: 0000000000000003 RSI: 0000200000000240 RDI: 0000000000000003 [ 438.601223][ T8736] RBP: 00007fbedf8b9090 R08: 0000000000000000 R09: 0000000000000000 [ 438.601231][ T8736] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 438.601238][ T8736] R13: 00007fbedebb6038 R14: 00007fbedebb5fa0 R15: 00007ffe0bbad798 [ 438.601258][ T8736] [ 439.050439][ T5897] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 439.351106][ T5897] usb 4-1: config 0 has an invalid interface number: 128 but max is 0 [ 439.359377][ T5897] usb 4-1: config 0 has no interface number 0 [ 439.395206][ T5897] usb 4-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 439.412008][ T5897] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 439.466321][ T5897] usb 4-1: Product: syz [ 439.493002][ T5897] usb 4-1: Manufacturer: syz [ 439.518870][ T5897] usb 4-1: SerialNumber: syz [ 439.562637][ T5897] usb 4-1: config 0 descriptor?? [ 439.821122][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 439.828425][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 440.033155][ T5897] usb 4-1: Firmware: major: 230, minor: 61, hardware type: UNKNOWN (237) [ 440.243422][ T5897] usb 4-1: failed to fetch extended address, random address set [ 440.251317][ T5897] usb 4-1: atusb_probe: initialization failed, error = -524 [ 440.262642][ T5897] atusb 4-1:0.128: probe with driver atusb failed with error -524 [ 440.426935][ T5845] block nbd4: Receive control failed (result -32) [ 440.427517][ T8753] block nbd4: shutting down sockets [ 440.857795][ T8765] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 440.872647][ T8765] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 441.079446][ T8765] netdevsim netdevsim3 netdevsim0: entered promiscuous mode [ 442.070512][ T5979] usb 3-1: new full-speed USB device number 3 using dummy_hcd [ 442.233370][ T8734] netdevsim netdevsim3 netdevsim0: left promiscuous mode [ 442.302097][ T5979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 442.352902][ T5979] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 442.370419][ T5979] usb 3-1: New USB device found, idVendor=1e7d, idProduct=2d5a, bcdDevice= 0.00 [ 442.400422][ T5979] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 442.431465][ T5979] usb 3-1: config 0 descriptor?? [ 442.562160][ T2153] usb 4-1: USB disconnect, device number 7 [ 442.891470][ T5979] savu 0003:1E7D:2D5A.0001: hiddev0,hidraw0: USB HID v0.00 Device [HID 1e7d:2d5a] on usb-dummy_hcd.2-1/input0 [ 444.042426][ T8782] Driver unsupported XDP return value 0 on prog (id 95) dev N/A, expect packet loss! [ 444.204458][ T5979] usb 3-1: USB disconnect, device number 3 [ 444.557312][ T8817] netlink: 12 bytes leftover after parsing attributes in process `syz.4.648'. [ 445.846739][ T8819] block device autoloading is deprecated and will be removed. [ 449.197311][ T8825] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 449.207046][ T8825] iommufd_mock iommufd_mock1: Adding to iommu group 1 [ 449.385790][ T8820] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 449.871148][ T8837] sp0: Synchronizing with TNC [ 449.924810][ T8837] netlink: 12 bytes leftover after parsing attributes in process `syz.4.655'. [ 450.335486][ T8846] netlink: 8 bytes leftover after parsing attributes in process `syz.0.657'. [ 450.344419][ T8846] netlink: 24 bytes leftover after parsing attributes in process `syz.0.657'. [ 450.481680][ T5953] usb 2-1: new high-speed USB device number 6 using dummy_hcd [ 450.640406][ T5953] usb 2-1: Using ep0 maxpacket: 32 [ 450.647390][ T5953] usb 2-1: config 0 has an invalid interface number: 98 but max is 0 [ 451.193725][ T5953] usb 2-1: config 0 has no interface number 0 [ 451.212169][ T5953] usb 2-1: New USB device found, idVendor=11f5, idProduct=0005, bcdDevice=27.80 [ 451.221589][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 451.229692][ T5953] usb 2-1: Product: syz [ 451.247010][ T5953] usb 2-1: Manufacturer: syz [ 451.251878][ T5953] usb 2-1: SerialNumber: syz [ 451.259243][ T5953] usb 2-1: config 0 descriptor?? [ 451.268541][ T5953] pl2303 2-1:0.98: required interrupt-in endpoint missing [ 451.554097][ T8840] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 451.690970][ T8840] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 451.817943][ T8856] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 452.377805][ T9] usb 2-1: USB disconnect, device number 6 [ 453.212677][ T30] audit: type=1804 audit(1755603404.716:26): pid=8871 uid=0 auid=4294967295 ses=4294967295 subj=_ op=invalid_pcr cause=open_writers comm="syz.1.663" name="/newroot/125/file0" dev="tmpfs" ino=657 res=1 errno=0 [ 453.241478][ T8871] ref_ctr going negative. vaddr: 0x200000ffc002, curr val: -29824, delta: 1 [ 453.250506][ T8871] ref_ctr increment failed for inode: 0x291 offset: 0x7 ref_ctr_offset: 0x2 of mm: 0xffff88802a254600 [ 453.997798][ T8870] uprobe: syz.1.663:8870 failed to unregister, leaking uprobe [ 454.152111][ T8870] uprobe: syz.1.663:8870 failed to unregister, leaking uprobe [ 455.340850][ T5953] usb 2-1: new full-speed USB device number 7 using dummy_hcd [ 455.370583][ T2153] usb 1-1: new high-speed USB device number 7 using dummy_hcd [ 455.572248][ T2153] usb 1-1: device descriptor read/64, error -71 [ 455.582168][ T5953] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 455.630457][ T5953] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 455.694179][ T5953] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 455.755493][ T5953] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 455.851059][ T5953] usb 2-1: Product: syz [ 455.855287][ T5953] usb 2-1: Manufacturer: syz [ 455.860115][ T5953] usb 2-1: SerialNumber: syz [ 455.870549][ T2153] usb 1-1: new high-speed USB device number 8 using dummy_hcd [ 456.020394][ T2153] usb 1-1: device descriptor read/64, error -71 [ 456.213713][ T5953] usb 2-1: 0:2 : does not exist [ 456.270117][ T5953] usb 2-1: 5:0: failed to get current value for ch 0 (-22) [ 456.322771][ T2153] usb usb1-port1: attempt power cycle [ 456.628161][ T5953] usb 2-1: USB disconnect, device number 7 [ 456.723333][ T8325] udevd[8325]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 456.933518][ T2153] usb 1-1: new high-speed USB device number 9 using dummy_hcd [ 456.983560][ T2153] usb 1-1: device descriptor read/8, error -71 [ 457.310676][ T5897] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 457.395691][ T2153] usb 1-1: new high-speed USB device number 10 using dummy_hcd [ 457.460556][ T5897] usb 2-1: Using ep0 maxpacket: 8 [ 457.468749][ T5897] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 457.483667][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 457.528714][ T5897] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 457.562371][ T2153] usb 1-1: device descriptor read/8, error -71 [ 457.565707][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 457.590113][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 457.610124][ T5897] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 457.618277][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 457.630379][ T5897] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 457.642907][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 457.655125][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 457.673219][ T2153] usb usb1-port1: unable to enumerate USB device [ 457.683196][ T5897] usb 2-1: config 168 descriptor has 1 excess byte, ignoring [ 457.705690][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x3 has an invalid bInterval 255, changing to 11 [ 457.820510][ T5897] usb 2-1: config 168 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 457.860540][ T9] usb 1-1: new high-speed USB device number 11 using dummy_hcd [ 458.011584][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 458.026909][ T5897] usb 2-1: config 168 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 458.042382][ T5897] usb 2-1: string descriptor 0 read error: -22 [ 458.048664][ T5897] usb 2-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=40.6e [ 458.059239][ T5897] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 458.140419][ T9] usb 1-1: device descriptor read/64, error -71 [ 458.160222][ T5897] adutux 2-1:168.0: ADU100 now attached to /dev/usb/adutux0 [ 458.186539][ T8918] netlink: 12 bytes leftover after parsing attributes in process `syz.0.677'. [ 458.285719][ T5897] usb 2-1: USB disconnect, device number 8 [ 459.810534][ T2153] usb 2-1: new full-speed USB device number 9 using dummy_hcd [ 460.484159][ T8937] netlink: 4 bytes leftover after parsing attributes in process `syz.2.680'. [ 460.498585][ T8937] netlink: 'syz.2.680': attribute type 1 has an invalid length. [ 460.506796][ T8937] netlink: 12 bytes leftover after parsing attributes in process `syz.2.680'. [ 460.844202][ T8944] netlink: 'syz.1.683': attribute type 3 has an invalid length. [ 461.751839][ T8941] xt_CT: No such helper "pptp" [ 461.881743][ T8941] kvm: user requested TSC rate below hardware speed [ 462.345828][ T8962] ubi31: attaching mtd0 [ 462.373019][ T8962] ubi31: scanning is finished [ 462.377894][ T8962] ubi31: empty MTD device detected [ 463.863387][ T8962] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 463.952639][ T8961] ubi31: attaching mtd0 [ 463.989114][ T8961] ubi31: scanning is finished [ 464.347003][ T8961] ubi31 error: ubi_attach_mtd_dev: cannot spawn "ubi_bgt31d", error -4 [ 464.395630][ T8969] netlink: 8 bytes leftover after parsing attributes in process `syz.4.690'. [ 466.980102][ T8989] sctp: [Deprecated]: syz.2.696 (pid 8989) Use of int in max_burst socket option deprecated. [ 466.980102][ T8989] Use struct sctp_assoc_value instead [ 467.226234][ T8989] 9pnet_fd: Insufficient options for proto=fd [ 467.540403][ T8062] usb 2-1: new high-speed USB device number 10 using dummy_hcd [ 467.633711][ T24] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 467.754629][ T9006] netlink: 8 bytes leftover after parsing attributes in process `syz.2.701'. [ 467.801534][ T8062] usb 2-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 467.831479][ T24] usb 4-1: Using ep0 maxpacket: 8 [ 467.905549][ T24] usb 4-1: New USB device found, idVendor=0fe9, idProduct=db01, bcdDevice=e9.9b [ 467.917765][ T8062] usb 2-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 467.927698][ T24] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 467.937060][ T8062] usb 2-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 467.950336][ T24] usb 4-1: Product: syz [ 467.955889][ T24] usb 4-1: Manufacturer: syz [ 467.963352][ T8062] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 467.971740][ T24] usb 4-1: SerialNumber: syz [ 468.019346][ T24] usb 4-1: config 0 descriptor?? [ 468.030872][ T8999] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 468.084943][ T24] dvb-usb: found a 'DViCO FusionHDTV DVB-T USB (LGZ201)' in warm state. [ 468.105391][ T8062] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 468.133776][ T24] dvb-usb: bulk message failed: -22 (2/0) [ 468.181580][ T24] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 468.364214][ T24] dvbdev: DVB: registering new adapter (DViCO FusionHDTV DVB-T USB (LGZ201)) [ 468.388575][ T24] usb 4-1: media controller created [ 468.421235][ T24] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 469.354832][ T24] cxusb: set interface failed [ 469.359999][ T24] dvb-usb: bulk message failed: -22 (1/0) [ 469.381364][ T9013] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 469.494535][ T9013] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 469.529958][ T30] audit: type=1326 audit(1755603421.026:27): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 469.567936][ T24] DVB: Unable to find symbol mt352_attach() [ 469.600030][ T24] dvb-usb: no frontend was attached by 'DViCO FusionHDTV DVB-T USB (LGZ201)' [ 469.610520][ T30] audit: type=1326 audit(1755603421.066:28): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=289 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 469.850506][ T30] audit: type=1326 audit(1755603421.066:29): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 470.159206][ T30] audit: type=1326 audit(1755603421.066:30): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=439 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 470.486580][ T30] audit: type=1326 audit(1755603421.066:31): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 471.057258][ T30] audit: type=1326 audit(1755603421.066:32): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 471.091679][ T30] audit: type=1326 audit(1755603421.066:33): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 471.160570][ T24] rc_core: IR keymap rc-dvico-portable not found [ 471.183887][ T24] Registered IR keymap rc-empty [ 471.370620][ T30] audit: type=1326 audit(1755603421.086:34): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=436 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 471.422096][ T24] rc rc0: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0 [ 471.461773][ T24] input: DViCO FusionHDTV DVB-T USB (LGZ201) as /devices/platform/dummy_hcd.3/usb4/4-1/rc/rc0/input13 [ 471.685754][ T24] dvb-usb: schedule remote query interval to 100 msecs. [ 471.692870][ T30] audit: type=1326 audit(1755603421.086:35): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 471.692947][ T30] audit: type=1326 audit(1755603421.086:36): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=8994 comm="syz.1.698" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f72bcb8ebe9 code=0x7ffc0000 [ 471.799295][ T9030] openvswitch: netlink: IP tunnel attribute has 12 unknown bytes. [ 472.342172][ T24] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully initialized and connected. [ 472.387331][ T24] usb 4-1: USB disconnect, device number 8 [ 475.377235][ T24] dvb-usb: DViCO FusionHDTV DVB-T USB (LGZ201) successfully deinitialized and disconnected. [ 475.401370][ T2153] usb 2-1: USB disconnect, device number 10 [ 478.227599][ T9064] netlink: 'syz.0.714': attribute type 33 has an invalid length. [ 478.872292][ T9073] netlink: 20 bytes leftover after parsing attributes in process `syz.1.715'. [ 478.886895][ T9073] netlink: 20 bytes leftover after parsing attributes in process `syz.1.715'. [ 478.896869][ T9058] [U] [ 479.029263][ T9064] netlink: 152 bytes leftover after parsing attributes in process `syz.0.714'. [ 487.740939][ T5897] usb 2-1: new high-speed USB device number 11 using dummy_hcd [ 487.960796][ T5897] usb 2-1: device descriptor read/64, error -71 [ 488.262897][ T5897] usb 2-1: new high-speed USB device number 12 using dummy_hcd [ 488.471016][ T5897] usb 2-1: device descriptor read/64, error -71 [ 488.660734][ T5897] usb usb2-port1: attempt power cycle [ 489.124963][ T5897] usb 2-1: new high-speed USB device number 13 using dummy_hcd [ 489.293459][ T5897] usb 2-1: device descriptor read/8, error -71 [ 489.605867][ T5897] usb 2-1: new high-speed USB device number 14 using dummy_hcd [ 489.675889][ T5897] usb 2-1: device descriptor read/8, error -71 [ 489.801026][ T5897] usb usb2-port1: unable to enumerate USB device [ 490.672013][ T9165] netlink: 4 bytes leftover after parsing attributes in process `syz.1.740'. [ 494.491345][ T9195] ieee802154 phy0 wpan0: encryption failed: -22 [ 496.365801][ T9205] binder: 9202:9205 ioctl c018620c 200000000380 returned -1 [ 499.281790][ T9244] fuse: Invalid rootmode [ 501.244828][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.251488][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 501.817068][ T9254] ieee802154 phy0 wpan0: encryption failed: -22 [ 504.682981][ T9276] Can't find ip_set type ha [ 505.280380][ T9144] usb 2-1: new full-speed USB device number 15 using dummy_hcd [ 506.963155][ T9144] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 507.045408][ T9144] usb 2-1: New USB device found, idVendor=050d, idProduct=3201, bcdDevice= 0.00 [ 507.077121][ T9144] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 507.097754][ T9144] usb 2-1: config 0 descriptor?? [ 507.108438][ T9281] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 508.317313][ T9144] belkin 0003:050D:3201.0002: unknown main item tag 0x2 [ 508.337117][ T9311] input: syz1 as /devices/virtual/input/input15 [ 508.350400][ T9144] belkin 0003:050D:3201.0002: unknown main item tag 0x0 [ 508.416986][ T9144] belkin 0003:050D:3201.0002: hiddev0,hidraw0: USB HID v1.01 Device [HID 050d:3201] on usb-dummy_hcd.1-1/input0 [ 509.913707][ T9] usb 2-1: USB disconnect, device number 15 [ 511.920343][ T9371] netlink: 'syz.1.785': attribute type 39 has an invalid length. [ 512.328103][ T9378] Bluetooth: MGMT ver 1.23 [ 516.276279][ T9400] input: syz1 as /devices/virtual/input/input16 [ 522.381396][ T9475] netlink: 43 bytes leftover after parsing attributes in process `syz.3.809'. [ 522.421202][ T9476] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 524.420556][ T5953] usb 5-1: new high-speed USB device number 7 using dummy_hcd [ 524.621833][ T5953] usb 5-1: Using ep0 maxpacket: 8 [ 524.681503][ T2153] usb 4-1: new high-speed USB device number 9 using dummy_hcd [ 524.722355][ T5953] usb 5-1: config index 0 descriptor too short (expected 301, got 45) [ 524.738982][ T5953] usb 5-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 524.759973][ T5953] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 524.778129][ T5953] usb 5-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 524.868760][ T5953] usb 5-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 524.912773][ T2153] usb 4-1: New USB device found, idVendor=0cf3, idProduct=9271, bcdDevice= 1.08 [ 525.258369][ T2153] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 525.268512][ T2153] usb 4-1: Product: syz [ 525.272992][ T5953] usb 5-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 525.290013][ T2153] usb 4-1: Manufacturer: syz [ 525.296132][ T2153] usb 4-1: SerialNumber: syz [ 525.303487][ T5953] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 525.480187][ T2153] usb 4-1: ath9k_htc: Firmware ath9k_htc/htc_9271-1.4.0.fw requested [ 525.589212][ T9511] netlink: 8 bytes leftover after parsing attributes in process `syz.0.820'. [ 525.598226][ T9511] netlink: 24 bytes leftover after parsing attributes in process `syz.0.820'. [ 525.722120][ T5953] usb 5-1: usb_control_msg returned -32 [ 525.748342][ T5953] usbtmc 5-1:16.0: can't read capabilities [ 525.773028][ T5952] usb 4-1: ath9k_htc: Transferred FW: ath9k_htc/htc_9271-1.4.0.fw, size: 51008 [ 526.652087][ T9498] loop6: detected capacity change from 0 to 63 [ 526.659561][ T9518] workqueue: Failed to create a rescuer kthread for wq "nfc2_nci_tx_wq": -EINTR [ 527.072021][ T5858] Buffer I/O error on dev loop6, logical block 0, async page read [ 527.858155][ T9] usb 4-1: USB disconnect, device number 9 [ 527.868303][ T5858] Buffer I/O error on dev loop6, logical block 0, async page read [ 527.880146][ T5858] Buffer I/O error on dev loop6, logical block 0, async page read [ 527.889276][ T5858] Buffer I/O error on dev loop6, logical block 0, async page read [ 527.898328][ T5858] Buffer I/O error on dev loop6, logical block 0, async page read [ 528.040434][ T5953] usb 5-1: USB disconnect, device number 7 [ 528.140784][ T5952] ath9k_htc 4-1:1.0: ath9k_htc: Target is unresponsive [ 528.291070][ T5952] ath9k_htc: Failed to initialize the device [ 528.321866][ T9] usb 4-1: ath9k_htc: USB layer deinitialized [ 528.953296][ T9538] Can't find ip_set type ha [ 529.954544][ T9548] netlink: 40 bytes leftover after parsing attributes in process `syz.4.827'. [ 533.205817][ T9578] capability: warning: `syz.0.834' uses deprecated v2 capabilities in a way that may be insecure [ 533.286332][ T9578] tipc: Started in network mode [ 533.320435][ T9578] tipc: Node identity 0000000000005f000000000000000001, cluster identity 4711 [ 533.400669][ T9578] tipc: Enabling of bearer rejected, failed to enable media [ 534.438013][ T9591] Can't find ip_set type ha [ 534.607825][ T9595] ieee802154 phy0 wpan0: encryption failed: -22 [ 537.912636][ T9612] Can't find ip_set type ha [ 541.745594][ T9644] Can't find ip_set type ha [ 544.380586][ T9665] Can't find ip_set type ha [ 545.305813][ T9677] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 545.561975][ T9679] tipc: Enabling of bearer rejected, failed to enable media [ 545.752935][ T9681] usb usb1: check_ctrlrecip: process 9681 (syz.4.861) requesting ep 01 but needs 81 [ 545.777063][ T9681] usb usb1: usbfs: process 9681 (syz.4.861) did not claim interface 0 before use [ 545.904140][ T9681] tmpfs: Unknown parameter './file0' [ 548.853534][ T9703] Can't find ip_set type ha [ 549.650354][ T9144] usb 5-1: new high-speed USB device number 8 using dummy_hcd [ 549.822933][ T9144] usb 5-1: Using ep0 maxpacket: 32 [ 549.831853][ T9144] usb 5-1: config 1 has 2 interfaces, different from the descriptor's value: 3 [ 549.845738][ T9144] usb 5-1: config 1 has no interface number 1 [ 549.864297][ T9144] usb 5-1: config 1 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 0 [ 549.979700][ T9144] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 549.990330][ T9144] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 550.011322][ T9716] FAULT_INJECTION: forcing a failure. [ 550.011322][ T9716] name failslab, interval 1, probability 0, space 0, times 0 [ 550.034325][ T9144] usb 5-1: Product: syz [ 550.038530][ T9144] usb 5-1: Manufacturer: syz [ 550.050391][ T9144] usb 5-1: SerialNumber: syz [ 550.057036][ T9716] CPU: 0 UID: 0 PID: 9716 Comm: syz.0.871 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 550.057059][ T9716] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 550.057070][ T9716] Call Trace: [ 550.057078][ T9716] [ 550.057086][ T9716] dump_stack_lvl+0x189/0x250 [ 550.057112][ T9716] ? __pfx____ratelimit+0x10/0x10 [ 550.057132][ T9716] ? __pfx_dump_stack_lvl+0x10/0x10 [ 550.057153][ T9716] ? __pfx__printk+0x10/0x10 [ 550.057182][ T9716] ? __pfx___might_resched+0x10/0x10 [ 550.057207][ T9716] should_fail_ex+0x414/0x560 [ 550.057230][ T9716] ? udmabuf_create+0x47d/0xf70 [ 550.057250][ T9716] should_failslab+0xa8/0x100 [ 550.057271][ T9716] __kvmalloc_node_noprof+0x161/0x5f0 [ 550.057292][ T9716] ? udmabuf_create+0x47d/0xf70 [ 550.057317][ T9716] udmabuf_create+0x47d/0xf70 [ 550.057351][ T9716] ? __lock_acquire+0xab9/0xd20 [ 550.057379][ T9716] ? __pfx_udmabuf_create+0x10/0x10 [ 550.057417][ T9716] udmabuf_ioctl+0x1d1/0x2c0 [ 550.057437][ T9716] ? __pfx_smack_file_ioctl+0x10/0x10 [ 550.057472][ T9716] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 550.057502][ T9716] ? __fget_files+0x2a/0x420 [ 550.057531][ T9716] ? __fget_files+0x2a/0x420 [ 550.057555][ T9716] ? bpf_lsm_file_ioctl+0x9/0x20 [ 550.057578][ T9716] ? __pfx_udmabuf_ioctl+0x10/0x10 [ 550.057601][ T9716] __se_sys_ioctl+0xfc/0x170 [ 550.057632][ T9716] do_syscall_64+0xfa/0x3b0 [ 550.057653][ T9716] ? lockdep_hardirqs_on+0x9c/0x150 [ 550.057674][ T9716] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.057693][ T9716] ? clear_bhb_loop+0x60/0xb0 [ 550.057717][ T9716] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 550.057736][ T9716] RIP: 0033:0x7f10f4d8ebe9 [ 550.057753][ T9716] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 550.057769][ T9716] RSP: 002b:00007f10f5b59038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 550.057789][ T9716] RAX: ffffffffffffffda RBX: 00007f10f4fb5fa0 RCX: 00007f10f4d8ebe9 [ 550.057804][ T9716] RDX: 0000200000000040 RSI: 0000000040187542 RDI: 0000000000000004 [ 550.057816][ T9716] RBP: 00007f10f5b59090 R08: 0000000000000000 R09: 0000000000000000 [ 550.057828][ T9716] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 550.057839][ T9716] R13: 00007f10f4fb6038 R14: 00007f10f4fb5fa0 R15: 00007ffcdab792c8 [ 550.057869][ T9716] [ 550.575143][ T9711] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 550.613368][ T9144] usb 5-1: 2:1 : invalid UAC_FORMAT_TYPE desc [ 550.629743][ T9144] usb 5-1: 2:1 : invalid channels 0 [ 550.736185][ T9144] usb 5-1: USB disconnect, device number 8 [ 551.906581][ T8325] udevd[8325]: error opening ATTR{/sys/devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 552.110456][ T9] usb 1-1: new high-speed USB device number 13 using dummy_hcd [ 552.176992][ T9745] ieee802154 phy0 wpan0: encryption failed: -22 [ 552.270404][ T9] usb 1-1: Using ep0 maxpacket: 16 [ 552.277803][ T9] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 552.379614][ T9] usb 1-1: New USB device found, idVendor=05ac, idProduct=0244, bcdDevice= 0.00 [ 552.976308][ T9] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 552.990668][ T9] usb 1-1: config 0 descriptor?? [ 553.116159][ T9] input: bcm5974 as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/input/input17 [ 553.332895][ T5191] bcm5974 1-1:0.0: could not read from device [ 553.398910][ T5191] bcm5974 1-1:0.0: could not read from device [ 553.405468][ T9] usb 1-1: USB disconnect, device number 13 [ 558.852530][ T9787] netlink: 40 bytes leftover after parsing attributes in process `syz.1.888'. [ 560.283573][ T9800] netlink: 4 bytes leftover after parsing attributes in process `syz.2.893'. [ 560.767293][ T9811] fuse: Bad value for 'fd' [ 561.114312][ T9816] binder: BINDER_SET_CONTEXT_MGR already set [ 561.121406][ T9816] binder: 9814:9816 ioctl 4018620d 2000000002c0 returned -16 [ 561.129571][ T9816] binder: 9814:9816 unknown command 0 [ 561.135037][ T9816] binder: 9814:9816 ioctl c0306201 200000000240 returned -22 [ 561.938501][ T9825] qnx6: unable to set blocksize [ 562.614167][ T9839] netlink: 48 bytes leftover after parsing attributes in process `syz.3.901'. [ 562.694131][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.702669][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 563.063254][ T9] usb 4-1: new high-speed USB device number 10 using dummy_hcd [ 564.504031][ T9] usb 4-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 564.539239][ T9] usb 4-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 564.605817][ T9] usb 4-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 564.872399][ T9] usb 4-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.41 [ 564.947988][ T9] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=11 [ 565.020411][ T9] usb 4-1: Product: syz [ 565.054192][ T9] usb 4-1: Manufacturer: syz [ 565.081121][ T9] usb 4-1: SerialNumber: syz [ 565.466153][ T9858] xt_CT: No such helper "pptp" [ 565.951445][ T9] usblp 4-1:1.0: usblp0: USB Unidirectional printer dev 10 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 566.105623][ T9] usb 4-1: USB disconnect, device number 10 [ 566.396953][ T9] usblp0: removed [ 568.154332][ T8062] usb 1-1: new high-speed USB device number 14 using dummy_hcd [ 568.520002][ T8062] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 568.537647][ T8062] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 568.548333][ T8062] usb 1-1: New USB device found, idVendor=1e7d, idProduct=319c, bcdDevice= 0.00 [ 568.564798][ T8062] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 568.620933][ T9911] netlink: 8 bytes leftover after parsing attributes in process `syz.2.918'. [ 569.449247][ T8062] usb 1-1: config 0 descriptor?? [ 571.078001][ T9932] kvm: user requested TSC rate below hardware speed [ 571.091262][ T8062] usbhid 1-1:0.0: can't add hid device: -71 [ 571.107477][ T8062] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 571.169074][ T8062] usb 1-1: USB disconnect, device number 14 [ 571.335048][ T9920] xt_CT: No such helper "pptp" [ 571.798865][ T9952] input: syz1 as /devices/virtual/input/input18 [ 573.292363][ T9971] netlink: 8 bytes leftover after parsing attributes in process `syz.0.932'. [ 573.351203][ T9971] netlink: 24 bytes leftover after parsing attributes in process `syz.0.932'. [ 574.689005][T10003] netlink: 28 bytes leftover after parsing attributes in process `syz.0.936'. [ 574.728775][T10003] netlink: 24 bytes leftover after parsing attributes in process `syz.0.936'. [ 580.786130][T10057] ieee802154 phy0 wpan0: encryption failed: -22 [ 587.109540][T10111] netlink: 8 bytes leftover after parsing attributes in process `syz.2.965'. [ 589.422273][T10125] xt_CT: No such helper "pptp" [ 590.962911][T10135] qnx6: unable to set blocksize [ 591.738750][T10148] syz.3.975 uses obsolete (PF_INET,SOCK_PACKET) [ 593.986496][T10174] netlink: 8 bytes leftover after parsing attributes in process `syz.4.982'. [ 594.415991][ T24] usb 4-1: new high-speed USB device number 11 using dummy_hcd [ 594.915419][T10170] netlink: 40 bytes leftover after parsing attributes in process `syz.1.981'. [ 594.977524][ T24] usb 4-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 595.009882][ T24] usb 4-1: config 0 has 1 interface, different from the descriptor's value: 3 [ 595.035363][ T24] usb 4-1: New USB device found, idVendor=0489, idProduct=e057, bcdDevice= 0.00 [ 595.072579][T10186] tun0: tun_chr_ioctl cmd 1074025681 [ 595.099279][ T24] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 595.158727][ T24] usb 4-1: config 0 descriptor?? [ 595.901594][T10194] ieee802154 phy0 wpan0: encryption failed: -22 [ 596.093575][ T24] Bluetooth: Can't get state to change to load ram patch err [ 596.101317][ T24] Bluetooth: Loading patch file failed [ 596.106823][ T24] ath3k 4-1:0.0: probe with driver ath3k failed with error -121 [ 596.153766][T10199] netlink: 16 bytes leftover after parsing attributes in process `syz.0.990'. [ 597.409130][T10204] comedi comedi1: pcl816: I/O port conflict (0x4f27,16) [ 598.047738][ T5898] usb 4-1: USB disconnect, device number 11 [ 598.922761][T10209] netlink: 'syz.1.992': attribute type 10 has an invalid length. [ 599.056937][T10209] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.069489][T10209] bridge_slave_1: left allmulticast mode [ 599.076096][T10209] bridge_slave_1: left promiscuous mode [ 599.086564][T10209] bridge0: port 2(bridge_slave_1) entered disabled state [ 599.146572][T10209] bond0: (slave bridge_slave_1): Enslaving as an active interface with an up link [ 599.351084][T10225] program syz.0.996 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 599.563352][T10226] netlink: 40 bytes leftover after parsing attributes in process `syz.3.997'. [ 601.383510][T10238] netlink: 'syz.3.999': attribute type 10 has an invalid length. [ 601.430695][T10238] 8021q: adding VLAN 0 to HW filter on device team0 [ 601.467792][T10238] bond0: (slave team0): Enslaving as an active interface with an up link [ 601.732186][T10238] netlink: 8 bytes leftover after parsing attributes in process `syz.3.999'. [ 601.836188][T10241] ieee802154 phy0 wpan0: encryption failed: -22 [ 602.645130][T10242] mmap: syz.1.1000 (10242): VmData 37597184 exceed data ulimit 10. Update limits or use boot option ignore_rlimit_data. [ 602.921311][ T5840] Bluetooth: hci3: command 0x0406 tx timeout [ 603.894582][T10261] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1004'. [ 603.904932][T10261] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1004'. [ 608.818346][T10308] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1018'. [ 608.827804][T10308] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1018'. [ 612.583619][T10334] netlink: 4 bytes leftover after parsing attributes in process `syz.3.1024'. [ 614.118197][T10362] Can't find ip_set type ha [ 614.446847][T10369] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1033'. [ 614.455926][T10369] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1033'. [ 616.565939][T10379] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 621.897697][T10413] Can't find ip_set type ha [ 624.289310][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.296240][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 625.340357][ T5953] usb 5-1: new high-speed USB device number 9 using dummy_hcd [ 627.087383][T10438] syz.3.1051: attempt to access beyond end of device [ 627.087383][T10438] nbd3: rw=0, sector=2, nr_sectors = 2 limit=0 [ 627.101223][T10438] vxfs: unable to read disk superblock at 1 [ 627.151840][T10438] syz.3.1051: attempt to access beyond end of device [ 627.151840][T10438] nbd3: rw=0, sector=16, nr_sectors = 2 limit=0 [ 627.220519][T10438] vxfs: unable to read disk superblock at 8 [ 627.239273][ T30] audit: type=1326 audit(1755603578.716:37): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=10437 comm="syz.2.1052" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7efeb738ebe9 code=0x0 [ 627.314384][T10438] vxfs: can't find superblock. [ 627.462196][T10452] overlayfs: missing 'lowerdir' [ 631.296226][T10478] netlink: 40 bytes leftover after parsing attributes in process `syz.0.1059'. [ 632.884558][T10496] @ÿ: renamed from bond_slave_0 (while UP) [ 633.037382][T10502] xt_CT: No such helper "pptp" [ 633.045039][T10505] 9pnet_fd: Insufficient options for proto=fd [ 633.088937][T10502] kvm: user requested TSC rate below hardware speed [ 633.180336][ T8062] usb 2-1: new low-speed USB device number 17 using dummy_hcd [ 633.274331][T10509] netlink: 32 bytes leftover after parsing attributes in process `syz.3.1067'. [ 634.056519][ T8062] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 634.158692][ T8062] usb 2-1: config 0 interface 0 altsetting 6 endpoint 0x81 has invalid maxpacket 1024, setting to 8 [ 634.271852][ T8062] usb 2-1: config 0 interface 0 has no altsetting 0 [ 634.356353][ T8062] usb 2-1: New USB device found, idVendor=5543, idProduct=0005, bcdDevice= 0.00 [ 634.501677][ T8062] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 635.260970][ T8062] usb 2-1: config 0 descriptor?? [ 635.270660][T10499] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 635.402074][T10522] ieee802154 phy0 wpan0: encryption failed: -22 [ 636.899901][ T8062] uclogic 0003:5543:0005.0003: unknown main item tag 0x0 [ 637.299292][ T8062] uclogic 0003:5543:0005.0003: unknown main item tag 0x0 [ 637.307839][ T8062] uclogic 0003:5543:0005.0003: unknown main item tag 0x0 [ 637.315565][ T8062] uclogic 0003:5543:0005.0003: unknown main item tag 0x0 [ 637.326260][ T8062] uclogic 0003:5543:0005.0003: unknown main item tag 0x0 [ 637.336263][ T8062] uclogic 0003:5543:0005.0003: unknown main item tag 0x0 [ 637.411486][ T8062] uclogic 0003:5543:0005.0003: hidraw0: USB HID v0.00 Device [HID 5543:0005] on usb-dummy_hcd.1-1/input0 [ 637.458477][ T5897] usb 2-1: USB disconnect, device number 17 [ 637.560887][T10526] netlink: 40 bytes leftover after parsing attributes in process `syz.2.1073'. [ 637.780830][T10532] fido_id[10532]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.1/usb2/report_descriptor': No such file or directory [ 637.925842][T10539] netlink: 8 bytes leftover after parsing attributes in process `syz.3.1075'. [ 637.934961][T10539] netlink: 12 bytes leftover after parsing attributes in process `syz.3.1075'. [ 638.455288][ T2153] usb 1-1: new high-speed USB device number 15 using dummy_hcd [ 639.141084][T10550] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1079'. [ 639.150711][T10550] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1079'. [ 640.037420][ T2153] usb 1-1: config 0 has an invalid interface number: 6 but max is 0 [ 640.278451][ T2153] usb 1-1: config 0 has no interface number 0 [ 640.317971][T10555] netlink: 8 bytes leftover after parsing attributes in process `syz.2.1080'. [ 640.327073][T10555] netlink: 24 bytes leftover after parsing attributes in process `syz.2.1080'. [ 640.353740][ T2153] usb 1-1: config 0 interface 6 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 640.373597][ T2153] usb 1-1: New USB device found, idVendor=172f, idProduct=0032, bcdDevice= 0.00 [ 640.383887][ T2153] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 640.397631][ T2153] usb 1-1: config 0 descriptor?? [ 641.440856][T10568] usb usb6: usbfs: process 10568 (syz.2.1083) did not claim interface 46 before use [ 641.620282][T10567] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 644.091560][T10592] netlink: 40 bytes leftover after parsing attributes in process `syz.4.1089'. [ 644.382755][T10593] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1090'. [ 644.392092][T10593] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1090'. [ 644.634128][ T5898] usb 1-1: USB disconnect, device number 15 [ 646.530556][T10632] No such timeout policy "syz0" [ 648.973266][ T5953] hid-generic 0000:0004:0000.0004: unknown main item tag 0x0 [ 649.012151][ T5953] hid-generic 0000:0004:0000.0004: unknown main item tag 0x0 [ 649.019761][ T5953] hid-generic 0000:0004:0000.0004: unknown main item tag 0x0 [ 649.055812][T10650] openvswitch: netlink: Message has 141 unknown bytes. [ 649.070157][ T5953] hid-generic 0000:0004:0000.0004: hidraw0: HID v0.00 Device [syz0] on syz1 [ 649.849746][T10659] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 650.386365][T10659] ucma_write: process 782 (syz.2.1108) changed security contexts after opening file descriptor, this is not allowed. [ 651.563462][T10674] netlink: 148 bytes leftover after parsing attributes in process `syz.0.1113'. [ 654.990293][T10715] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1123'. [ 655.056981][T10719] syz.2.1124 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 655.482291][T10715] tipc: Can't bind to reserved service type 0 [ 655.984984][T10722] program syz.3.1125 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 656.944683][ T5847] non-paged memory [ 656.948743][ T5847] list_del corruption, ffff88802ff38780->next is LIST_POISON1 (dead000000000100) [ 657.010012][ T5847] ------------[ cut here ]------------ [ 657.015613][ T5847] kernel BUG at lib/list_debug.c:58! [ 657.049502][ T5847] Oops: invalid opcode: 0000 [#1] SMP KASAN PTI [ 657.055784][ T5847] CPU: 0 UID: 0 PID: 5847 Comm: kworker/u9:5 Not tainted 6.16.0-syzkaller #0 PREEMPT(full) [ 657.065871][ T5847] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 07/12/2025 [ 657.075955][ T5847] Workqueue: hci4 hci_conn_timeout [ 657.081099][ T5847] RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 [ 657.088159][ T5847] Code: c0 bd e1 8b 48 89 de e8 b0 1d 68 fc 90 0f 0b 4c 89 e7 e8 55 01 40 fd 48 c7 c7 20 be e1 8b 48 89 de 4c 89 e2 e8 93 1d 68 fc 90 <0f> 0b 4c 89 e7 e8 38 01 40 fd 48 c7 c7 80 be e1 8b 48 89 de 4c 89 [ 657.107801][ T5847] RSP: 0018:ffffc9000429f980 EFLAGS: 00010246 [ 657.113878][ T5847] RAX: 000000000000004e RBX: ffff88802ff38780 RCX: eff630f824383200 [ 657.121847][ T5847] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 657.129825][ T5847] RBP: ffffffff8a759c60 R08: ffffc9000429f6a7 R09: 1ffff92000853ed4 [ 657.137802][ T5847] R10: dffffc0000000000 R11: fffff52000853ed5 R12: dead000000000100 [ 657.145768][ T5847] R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 [ 657.153742][ T5847] FS: 0000000000000000(0000) GS:ffff888125c57000(0000) knlGS:0000000000000000 [ 657.162681][ T5847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 657.169273][ T5847] CR2: 0000001b3180eff8 CR3: 0000000032090000 CR4: 00000000003526f0 [ 657.177269][ T5847] Call Trace: [ 657.180633][ T5847] [ 657.183565][ T5847] hci_cmd_sync_dequeue_once+0x24a/0x370 [ 657.189207][ T5847] hci_cancel_connect_sync+0xc8/0x120 [ 657.194604][ T5847] hci_abort_conn+0x191/0x330 [ 657.199300][ T5847] ? process_scheduled_works+0x9ef/0x17b0 [ 657.205026][ T5847] process_scheduled_works+0xade/0x17b0 [ 657.210597][ T5847] ? __pfx_process_scheduled_works+0x10/0x10 [ 657.216593][ T5847] worker_thread+0x8a0/0xda0 [ 657.221209][ T5847] kthread+0x70e/0x8a0 [ 657.225302][ T5847] ? __pfx_worker_thread+0x10/0x10 [ 657.230439][ T5847] ? __pfx_kthread+0x10/0x10 [ 657.235044][ T5847] ? _raw_spin_unlock_irq+0x23/0x50 [ 657.240250][ T5847] ? lockdep_hardirqs_on+0x9c/0x150 [ 657.245457][ T5847] ? __pfx_kthread+0x10/0x10 [ 657.250066][ T5847] ret_from_fork+0x3fc/0x770 [ 657.254675][ T5847] ? __pfx_ret_from_fork+0x10/0x10 [ 657.259790][ T5847] ? __switch_to_asm+0x39/0x70 [ 657.264565][ T5847] ? __switch_to_asm+0x33/0x70 [ 657.269357][ T5847] ? __pfx_kthread+0x10/0x10 [ 657.273960][ T5847] ret_from_fork_asm+0x1a/0x30 [ 657.278734][ T5847] [ 657.281767][ T5847] Modules linked in: [ 657.287291][ T5847] ---[ end trace 0000000000000000 ]--- [ 657.487358][ T5847] RIP: 0010:__list_del_entry_valid_or_report+0x10e/0x190 [ 657.494499][ T5847] Code: c0 bd e1 8b 48 89 de e8 b0 1d 68 fc 90 0f 0b 4c 89 e7 e8 55 01 40 fd 48 c7 c7 20 be e1 8b 48 89 de 4c 89 e2 e8 93 1d 68 fc 90 <0f> 0b 4c 89 e7 e8 38 01 40 fd 48 c7 c7 80 be e1 8b 48 89 de 4c 89 [ 657.514242][ T5847] RSP: 0018:ffffc9000429f980 EFLAGS: 00010246 [ 657.520623][ T5847] RAX: 000000000000004e RBX: ffff88802ff38780 RCX: eff630f824383200 [ 657.529841][ T5847] RDX: 0000000000000000 RSI: 0000000080000000 RDI: 0000000000000000 [ 657.537908][ T5847] RBP: ffffffff8a759c60 R08: ffffc9000429f6a7 R09: 1ffff92000853ed4 [ 657.545956][ T5847] R10: dffffc0000000000 R11: fffff52000853ed5 R12: dead000000000100 [ 657.555694][ T5847] R13: dffffc0000000000 R14: dead000000000100 R15: dead000000000122 [ 657.563879][ T5847] FS: 0000000000000000(0000) GS:ffff888125c57000(0000) knlGS:0000000000000000 [ 657.573015][ T5847] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 657.580406][ T5847] CR2: 000020000000a000 CR3: 00000000338b0000 CR4: 00000000003526f0 [ 657.588436][ T5847] Kernel panic - not syncing: Fatal exception [ 657.594657][ T5847] Kernel Offset: disabled [ 657.598987][ T5847] Rebooting in 86400 seconds..