last executing test programs: 23m51.502824862s ago: executing program 3 (id=594): syz_usb_control_io$hid(0xffffffffffffffff, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), 0xffffffffffffffff) syz_80211_join_ibss(0x0, &(0x7f0000000340)=@default_ap_ssid, 0x6, 0x2) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(0xffffffffffffffff, 0x40182103, &(0x7f0000000300)={0x0, 0x2, 0xffffffffffffffff, 0x7ff}) syz_open_dev$evdev(&(0x7f0000000000), 0x3, 0x822b01) syz_open_dev$mouse(&(0x7f0000000680), 0x0, 0x14b200) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000400)={'wlan0\x00', 0x0}) r4 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000180), 0xffffffffffffffff) sendmsg$NL80211_CMD_TRIGGER_SCAN(r2, &(0x7f0000000e80)={0x0, 0x0, &(0x7f0000000e40)={&(0x7f00000002c0)={0x1c, r4, 0x1, 0x70bd2b, 0x25dfdbfb, {{}, {@val={0x8, 0x3, r3}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x24004084}, 0x40000) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)={0x24, r1, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r5}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x3}]}, 0x24}}, 0x0) 23m50.789894669s ago: executing program 3 (id=599): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$packet(0x11, 0x3, 0x300) ioctl$TIOCGSID(0xffffffffffffffff, 0x5429, 0x0) ptrace$ARCH_SET_CPUID(0x1e, 0x0, 0x0, 0x1012) r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="0500000003f01f00810000007f00000001"], 0x48) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f0000000240)={r2, 0x0, 0x0}, 0x20) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x2, 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, 0x0) syz_open_dev$tty1(0xc, 0x4, 0x1) r3 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r3, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r3, 0x10e, 0x4, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000000000)={0x20, 0x2d, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}, [@typed={0xc, 0xc, 0x0, 0x0, @u64=0x100000001}]}, 0x20}, 0x1, 0x0, 0x0, 0x800}, 0x4000804) 23m48.537281875s ago: executing program 3 (id=607): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = socket$kcm(0x2, 0x871c457b17ce7df0, 0x0) setsockopt$sock_attach_bpf(r1, 0x1, 0x50, 0x0, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet_int(r2, 0x0, 0x21, &(0x7f0000000340)=0xa9e, 0x4) sendmmsg(0xffffffffffffffff, &(0x7f0000000240), 0x0, 0x20008800) r3 = syz_open_dev$loop(0x0, 0x1000001, 0x6100) r4 = syz_usb_connect(0x5, 0x3f, &(0x7f00000000c0)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r4, 0x0, 0x0) syz_usb_control_io(r4, 0x0, &(0x7f0000000780)={0x84, &(0x7f00000004c0)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$sierra_net(0xffffffffffffffff, &(0x7f0000000180)={0x14, &(0x7f0000000640)=ANY=[@ANYBLOB="400dc8000000c823ec71cd548f3ea87cbba4eb3a5f3d0658793819cb41b80d5a2a358265311b0b0d18b8996ccc544786e72751ac45960d469bd0ed6eaa3abfedc060c48b9c46b0131257b65bfbcceeefe3af494b7c3d0b357f224c357cbdd692c74f4c897f06ca8211cdf494b9250b5e0d53054a853ebe89fbc2ad96efd224c323c253659b55947ccd1b7c4ed37e09cca44ec07b251ada0b518d275599c9f301d8eb78eb9161a1feb7762ea98baaa88a63b13b6075f40d76d86289275200344c291a15362a5c5de32dd1e8a967f5"], &(0x7f0000000140)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x1007}}}, &(0x7f00000001c0)={0x1c, &(0x7f0000000580)=ANY=[@ANYBLOB="40095304000046d00f49e0ab790111c3debedd1b17506d7bad59c68a8d658ddb63b0b69eee113a7c9b1aa3a2038d2ffd3869b6ee92c9da080dc46cc9ca6d798bed4389c21bdf90a9423e3d993d684b08a52a9598f0d4aa401d6e1d"], &(0x7f0000000840)={0xa1, 0x1, 0x400, "c265bac068350b8fea45439396649209f462351ad5def4e3e012035d068836cadd259e124e890819f4a1811df4de87f3201bd85f3aad226a5f6144ecc53bbcb954e2468a03948c2d542512f0f77cc3048b510fac74055f10edf6d9eee12c28cd8327bf606aa2b3345363f5711421d5ad3ff11726555b370466452beee8b34e177c51643ea91bc2c00552833ba83cc3eddea37f95f086c7fb57b21247d62e0214001204225305f8beadc8849639e0641197a3b613fcf7491bdb0ea61f60b14f208a5f77d65645feb1891a0c6db6d1d15b2123e80a876747300f75b213cf0d2751f87cdec7eaf136caa1e4ee75b0ab5282aec63bd1064f8618450e8b110f4193f7eb59a64d076e3ab9a748a9afaa8ab15c9c61c810664a30e96c4847a82c6d6a3868ec26b85b1d0c319631a2f894ab95233baa792e50f706c3bedfdbe05afa37002b3ae7191848074d9fe2c67508d148d471ee4f12de4a1b7355a5d2588704c35fd579c0b9e734f31f71b2827535923f3b253a83bb2d599197e49caf72ae1f5754cf8b2694e32ceeff54b2ceaaf5b33660e471e51e63b479cf130a9d087967c5beaf8c3a6f671449ebbdaa17ad9d6baad02f7d60d8a15dd19c0c6e43aab013ebb69ebff94fdcf0f8210753fa388002b00796b8090280ffd06262c47a8161c348a9beaa4a3b0bb7b4704a24acdd702cf05522e02546bc2a2d79c17adcd5693eba82525ea82a2ab70f595f151dd4f1bbba9408af37652b23858a2723f60275351716e978c478c70485ac8486ece9abba9c6770d1a2154b24f7143e5a9e6cc2022521107f333c4a3087af06fc1d741ec2453fa556d0800aedf2486a0dff245640c40a3a2cafb848ead905b9983968bc190db7c20a939598dc18d332741088fd6b5d1c60c44dd2453673863866b9a45035137870a8eb614106964e61989e94e6b16c8b432bfbe8b2f0e2cdf526fb94853d6c5110bf39ae74c62437e19798f9dac5392ef8efddcb7a5492250001df57cc85c12aa7b6e54fab14f55f663242e2ebcf1a2c58fbf7b21d42c0d5b5e5ff23be24b0264d3d403bc1d2b20b225d6b830b7341f1672703794cb5e8db41461015b5ce4f51260872a52273d3ea6806357e8641db44f480858eaa2ad40ea53490acd346903939d2834be00e359422379abcf7d30b95e34f988d0681ef99f92dd04e171584d3e84b513a8cd049cdbe920e2db5b2ba31994ca4d8ee45a6999113bcaaae079c616b023d150278d4464e004166d6265276a4e8c3eeb3a40dae05d56ca533938f98c6daf29ec94bfa31651346139e88353fb258c203a949533631280ea6652e85de79933dda33cd633773c87e8299489d41cad17920e367e695ea630dce8c19015e697baa0b240ceb77c1af738e7723da91b6ce4ac97b9913491135dd37962130fe9e3e195a669712d4e052ee798a83e360"}, &(0x7f0000000240)=ANY=[@ANYBLOB="8470030000004f023a8cd1980abe"]}) syz_usb_control_io$rtl8150(r4, &(0x7f0000000100)={0x14, &(0x7f0000000000)=ANY=[@ANYBLOB="20fd030000005e0310"], 0x0}, 0x0) r5 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) ioctl$EVIOCGMASK(r5, 0x5b02, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000200)='blkio.bfq.io_service_bytes\x00', 0x275a, 0x0) write$binfmt_misc(r6, &(0x7f0000000040), 0xe09) ioctl$LOOP_CONFIGURE(r3, 0x4c0a, &(0x7f00000002c0)={r6, 0x0, {0x2a00, 0x80010000, 0x0, 0x4, 0x48dd, 0x0, 0x0, 0x0, 0x1c, "fee8a2ab78fc979fd1e00d96072000001ea89de2b7fb0000e60080b8785d96000100", "2809e8dbe108598948224ad54afac100875397bdb22d0000b420a1a93c9e01177d3d058dd4992861ac00", "90be8b1c551265406c7f306003d8a0f4bd00", [0xffffffffffffffff, 0x2000000000001]}}) setsockopt$inet6_tcp_int(r0, 0x6, 0x9, &(0x7f0000000040)=0x80000000, 0x4) io_setup(0x8, &(0x7f0000000540)=0x0) r8 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) io_submit(r7, 0x1, &(0x7f0000000340)=[&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7, 0x4, r8, &(0x7f0000000080)="01000000", 0x4, 0x2a25}]) ioctl$VIDIOC_G_EXT_CTRLS(r6, 0xc0205647, 0x0) r9 = syz_open_dev$video(&(0x7f0000000000), 0x485, 0x40000) sendmsg$NFT_MSG_GETCHAIN(r6, &(0x7f0000000600)={&(0x7f0000000440)={0x10, 0x0, 0x0, 0x800000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x4014}, 0x8000) socket(0x2, 0x80805, 0x0) ioctl$VIDIOC_S_SELECTION(r9, 0xc040565f, &(0x7f00000000c0)={0x9, 0x0, 0x6, {0x8, 0xbde, 0x6, 0x870}}) mlock2(&(0x7f00003ba000/0x4000)=nil, 0x4000, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0x4000000, &(0x7f0000000000)={0x2, 0x4e23, @multicast1}, 0x10) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) inotify_add_watch(r6, &(0x7f0000000080)='./file0\x00', 0x14000000) 23m44.681794749s ago: executing program 3 (id=615): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = syz_open_dev$sndctrl(&(0x7f0000000000), 0x1, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_READ(r2, 0xc4c85512, &(0x7f0000000280)={{0xc}, 0x0, [0x40000000, 0x0, 0x4, 0x3, 0x10001, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x2, 0x3, 0x4, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x5, 0x4829d, 0x0, 0x0, 0x0, 0x0, 0x1000008000, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffc, 0x0, 0x9, 0x0, 0xfffffffffffffffc, 0x4, 0x0, 0x10000, 0x4, 0xfdfffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x1, 0x20040000000, 0x0, 0x8, 0x80000000, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, 0x2, 0x0, 0x0, 0x100003, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000000000, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x7, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x40000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x1075, 0xfffffffffffffffe, 0x0, 0x0, 0x0, 0xfffffffffffffffc, 0x3, 0x7, 0x0, 0x20, 0x6, 0xffffffff80000001, 0x2, 0x0, 0xfffffffffffffffc, 0x4]}) ioctl$SNDRV_SEQ_IOCTL_SET_PORT_INFO(0xffffffffffffffff, 0xc0a85320, &(0x7f0000000400)={{0x80}, 'port0\x00', 0xee, 0x1a1c17, 0x6, 0x0, 0x100000, 0xffffffff, 0x8}) mkdir(&(0x7f00000002c0)='./file0\x00', 0x2) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000480)='./file0\x00', 0x80101) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x10) chroot(&(0x7f0000000780)='./file0\x00') r4 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r4, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r5 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r5, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0/../file0/../file0/../file0\x00', &(0x7f0000000080)='./file0/../file0/../file0/../file0/file0\x00') r6 = epoll_create(0x101) epoll_ctl$EPOLL_CTL_ADD(r6, 0x1, 0xffffffffffffffff, &(0x7f0000000080)={0x40000014}) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000140), 0x8417f, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), r7) r9 = syz_open_dev$dri(&(0x7f00000000c0), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_ADDFB(r9, 0xc01c64ae, &(0x7f0000000180)={0x0, 0x3, 0xa, 0x0, 0x1, 0x81, 0x446}) sendmsg$NL80211_CMD_GET_REG(r7, &(0x7f0000001180)={0x0, 0x0, &(0x7f0000001140)={&(0x7f0000001100)=ANY=[@ANYBLOB='\a\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="090f26bd7000fedbdf251f000000"], 0x14}, 0x1, 0x0, 0x0, 0x40000}, 0x8084) 23m43.38558571s ago: executing program 3 (id=621): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) r1 = syz_open_dev$evdev(&(0x7f0000000100), 0x72, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f0000000280)={'vcan0\x00'}) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) syz_open_dev$vbi(0x0, 0x0, 0x2) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r6 = syz_open_procfs$namespace(0x0, &(0x7f00000000c0)='ns/pid_for_children\x00') ioctl$NS_GET_PARENT(r6, 0xb702, 0x0) sendmsg(r5, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r7 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000240), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={0x80, r7, 0x705, 0x70bd2b, 0x25dfdbff, {}, [@ETHTOOL_A_STRSET_STRINGSETS={0x68, 0x2, 0x0, 0x1, [{0x4}, {0x3c, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}, @ETHTOOL_A_STRINGSET_ID={0x8}]}, {0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x3}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x1}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x2}]}]}, @ETHTOOL_A_STRSET_COUNTS_ONLY={0x4}]}, 0x80}, 0x1, 0x0, 0x0, 0x80}, 0x0) r8 = add_key$keyring(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x2}, 0x0, 0x0, 0x0) add_key$fscrypt_v1(0x0, &(0x7f0000003280)={'fscrypt:', @desc4}, 0x0, 0x0, r8) r9 = syz_io_uring_setup(0x49a, &(0x7f0000000400)={0x0, 0x79af, 0x3180, 0x8000, 0x40024e}, &(0x7f0000000340)=0x0, &(0x7f0000000040)) unshare(0x28040600) syz_memcpy_off$IO_URING_METADATA_GENERIC(r10, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) io_uring_enter(r9, 0x627, 0xc1040000, 0x43, 0x0, 0x0) r11 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r3, 0x8933, &(0x7f0000000140)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r3, &(0x7f0000004340)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000040)={0x24, r11, 0x331, 0x70bd2a, 0x0, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r12}, @BATADV_ATTR_HARD_IFINDEX={0x8}]}, 0x24}}, 0x0) sendmsg$nl_generic(r2, &(0x7f0000000100)={0x0, 0x20, &(0x7f0000000180)={&(0x7f0000000000)={0x28, 0x2d, 0x9, 0x70bd27, 0x0, {0x5}, [@typed={0x14, 0xa, 0x0, 0x0, @ipv6=@loopback={0x900000000000000}}]}, 0x28}}, 0x84) ioctl$EVIOCSFF(r1, 0x40304580, &(0x7f00000000c0)={0x50, 0x3f, 0xd, {0x2, 0x1}, {0x8000, 0x7}, @cond=[{0xeeb, 0x405, 0x4, 0x3, 0x8}, {0x2, 0x2, 0x5, 0x6, 0x6, 0x3b7e}]}) 23m42.990503979s ago: executing program 3 (id=622): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r0, &(0x7f0000001480)=""/4122, 0x101a, 0x9a) 23m42.366478599s ago: executing program 32 (id=622): r0 = syz_open_procfs(0x0, &(0x7f0000000140)='net/ip6_flowlabel\x00') pread64(r0, &(0x7f0000001480)=""/4122, 0x101a, 0x9a) 21m50.839733152s ago: executing program 0 (id=985): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r1 = syz_usb_connect(0x5, 0x24, &(0x7f0000000040)=ANY=[@ANYBLOB="01000074ad6010c410c1ea7eff0102030109021200c81e00"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) (async, rerun: 64) r2 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) (rerun: 64) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='net/ip_mr_vif\x00') read$FUSE(r3, &(0x7f0000020940)={0x2020}, 0x2020) preadv(r3, &(0x7f0000000b00)=[{&(0x7f0000000300)=""/30, 0x1e}], 0x1, 0x80000001, 0x3) r4 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x1) (async) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000200)={0x0, 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) ioctl$KVM_X86_SETUP_MCE(r4, 0x4008ae9c, &(0x7f00000000c0)={0x14, 0x5, 0xd}) r5 = syz_genetlink_get_family_id$smc(&(0x7f0000000100), r3) sendmsg$SMC_PNETID_FLUSH(0xffffffffffffffff, &(0x7f0000000280)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000240)={&(0x7f0000000180)={0x64, r5, 0x100, 0x70bd2b, 0x25dfdbfb, {}, [@SMC_PNETID_NAME={0x9, 0x1, 'syz1\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'nr0\x00'}, @SMC_PNETID_IBPORT={0x5, 0x4, 0x1}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'pimreg0\x00'}, @SMC_PNETID_ETHNAME={0x14, 0x2, 'vxcan1\x00'}]}, 0x64}, 0x1, 0x0, 0x0, 0x4000080}, 0x20004000) (async) ioctl$KVM_SET_MSRS(r4, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYBLOB="01000000000000009102"]) 21m47.797754736s ago: executing program 0 (id=996): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x6, 0x50, 0xffffffffffffffff, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f0000002f80)=[{{&(0x7f0000000200)=@qipcrtr, 0x80, &(0x7f0000001780)=[{&(0x7f00000003c0)=""/190, 0xbe}, {&(0x7f00000004c0)=""/150, 0x96}, {&(0x7f00000000c0)=""/17, 0x11}, {&(0x7f0000000580)=""/4096, 0x1000}, {&(0x7f0000000180)=""/36, 0x24}, {&(0x7f0000001580)=""/251, 0xfb}, {&(0x7f0000001680)=""/98, 0x62}, {&(0x7f0000001700)=""/88, 0x58}], 0x8, &(0x7f0000001800)=""/180, 0xb4}, 0x7}, {{0x0, 0x0, &(0x7f0000002dc0)=[{&(0x7f00000018c0)=""/240, 0xf0}, {&(0x7f00000019c0)=""/6, 0x6}, {&(0x7f0000003000)=""/4096, 0x1000}, {&(0x7f0000002a00)=""/26, 0x1a}, {&(0x7f0000002a40)=""/115, 0x73}, {&(0x7f0000001a00)=""/176, 0xb0}, {&(0x7f0000002b80)=""/20, 0x14}, {&(0x7f0000002bc0)=""/194, 0xc2}, {&(0x7f0000002cc0)=""/233, 0xe9}], 0x9, &(0x7f0000002e80)=""/234, 0xea}, 0x2}], 0x2, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, &(0x7f0000000140)={0x2, 0x1}, 0x2) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) openat$sysfs(0xffffffffffffff9c, 0x0, 0x149a82, 0x10) r2 = openat$tcp_mem(0xffffffffffffff9c, &(0x7f0000000040)='/proc/sys/net/ipv4/tcp_rmem\x00', 0x1, 0x0) io_setup(0x5, &(0x7f0000000540)=0x0) io_submit(r3, 0x1, &(0x7f0000000100)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0xe, r2, &(0x7f00000000c0)='\f', 0x1, 0x0, 0x0, 0x4}]) socketpair$unix(0x1, 0x2, 0x0, 0x0) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$6lowpan_enable(0xffffffffffffffff, 0x0, 0x0) r4 = socket$inet_udp(0x2, 0x2, 0x0) r5 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r5, &(0x7f0000000000)={0x40000000, 0x0, 0x0}, 0x0) bind$inet(r4, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000100), 0x200, 0x0) ppoll(&(0x7f0000000000)=[{r6, 0x8108}], 0x1, 0x0, 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000040)=0x8) mmap$dsp(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x7000008, 0x8012, r6, 0x0) connect$inet(r4, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r4, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@dev={0xfe, 0x80, '\x00', 0x4}, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x200000000000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, {}, 0x0, 0x0, 0x1}, {{@in6=@dev, 0x0, 0x33}, 0x0, @in=@private=0xa010100, 0x0, 0x0, 0x0, 0xb7, 0xffffffff}}, 0xe8) 21m45.933205901s ago: executing program 0 (id=999): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) epoll_pwait(r0, &(0x7f0000000080)=[{}, {}, {}, {}, {}], 0x5, 0x3, 0x0, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r3, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r3, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000380)={{0x14}, [@NFT_MSG_NEWRULE={0x84, 0x6, 0xa, 0x40b, 0x0, 0x0, {0x2}, [@NFTA_RULE_EXPRESSIONS={0x58, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @socket={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_SOCKET_DREG={0x8, 0x2, 0x1, 0x0, 0x3}, @NFTA_SOCKET_KEY={0x8, 0x1, 0x1, 0x0, 0x2}]}}}, {0x30, 0x1, 0x0, 0x1, @nat={{0x8}, @val={0x24, 0x2, 0x0, 0x1, [@NFTA_NAT_REG_PROTO_MIN={0x8, 0x5, 0x1, 0x0, 0x3}, @NFTA_NAT_FAMILY={0x8, 0x2, 0x1, 0x0, 0x2}, @NFTA_NAT_TYPE={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_NAT_FLAGS={0x8, 0x7, 0x1, 0x0, 0x14}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}]}], {0x14}}, 0xac}}, 0x0) epoll_ctl$EPOLL_CTL_ADD(r0, 0x1, r2, &(0x7f0000000100)={0x20000014}) epoll_wait(r0, &(0x7f0000000040)=[{}], 0x1, 0x400) 21m43.264791273s ago: executing program 0 (id=1006): socket$igmp6(0xa, 0x3, 0x2) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, 0x0, 0x0) r0 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) syz_usb_connect$uac1(0x3, 0xae, &(0x7f0000000300)={{0x12, 0x1, 0x300, 0x0, 0x0, 0x0, 0x8, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9c, 0x3, 0x1, 0x0, 0x20, 0xf, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0x8001, 0x9}, [@selector_unit={0xb, 0x24, 0x5, 0x6, 0x5, "22496c9f61bb"}, @processing_unit={0xd, 0x24, 0x7, 0x3, 0x6, 0x6, "7ca9888a7755"}, @input_terminal={0xc, 0x24, 0x2, 0x4, 0x202, 0x4, 0x1, 0x2, 0x24, 0x9}]}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {}, {{0x9, 0x5, 0x1, 0x9, 0x20, 0x81, 0x0, 0x3, {0x7, 0x25, 0x1, 0x2, 0x6, 0x24ae}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x7, 0x2, 0xfe, 0xf5, "94c5646c51"}, @format_type_i_continuous={0xc, 0x24, 0x2, 0x1, 0x2, 0x3, 0x10, 0x5, 's9', 'Vq'}]}, {{0x9, 0x5, 0x82, 0x9, 0x8, 0x8, 0xf7, 0x8, {0x7, 0x25, 0x1, 0x80, 0x5, 0x8}}}}}}}]}}, &(0x7f0000000180)={0xa, &(0x7f0000000000)={0xa, 0x6, 0x300, 0x0, 0xf6, 0x1, 0x10, 0x10}, 0x1e, &(0x7f0000000b80)={0x5, 0xf, 0x1e, 0x3, [@generic={0x3}, @ss_cap={0xa, 0x10, 0x3, 0x0, 0xf, 0xfa, 0x5, 0xde7}, @ssp_cap={0xc, 0x10, 0xa, 0xfc, 0x0, 0x6, 0x0, 0x6}]}, 0x2, [{0xfc, &(0x7f0000000c80)=@string={0xfc, 0x3, "e4e4552e1b9bb1cdd96f3cd32d0003706b2b5664f87307c0596a1ab2b84ef1d01ad72caf2684ad3d2f432c408c176c3175abb43fd7a21619fb58cdaecc665c2486dd5c202de62be39086438e5c357672f3b9a502aded8d6701b54c0521f2d19cc8e6c3c815417b47138d34904a0f4391364b829bd949ec3255e3d4edd92ffaa3ee258bab1927ddb9947dc9aa85d9ae214d9ff2fdb8cc0f42e0e3ea5c0145c3c6dfae5408f02fd7239230ccd5f0e87ddb367d50786781609d1d07907a6a9797784d52ae25b5c788da6bda70906a4da8e0e62bf4904dcb5c050f9084719ec7e265afe167dc52340a57a599bbafecdafff96f6dbcad563e65b26120"}}, {0x4, &(0x7f0000000100)=@lang_id={0x4, 0x3, 0x424}}]}) preadv(r0, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) r1 = socket(0x10, 0x803, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'team_slave_1\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xffe0, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x1}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000600)=@newtfilter={0x84, 0x2c, 0xd2b, 0x70bd2b, 0x25dfdbfb, {0x0, 0x0, 0x0, r3, {0xf}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_u32={{0x8}, {0x58, 0x2, [@TCA_U32_SEL={0x44, 0x5, {0x1, 0x1, 0x3, 0x1, 0x4, 0x2, 0x6, 0x7ffffffa, [{0x200, 0x500, 0x3, 0x6}, {0x6783, 0x2, 0x8001, 0x10}, {0x0, 0x53, 0xa9, 0x1}]}}, @TCA_U32_MARK={0x10, 0xa, {0x0, 0x6}}]}}]}, 0x84}}, 0x24040084) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = epoll_create1(0x80000) poll(&(0x7f0000000040)=[{r5, 0x240}], 0x1, 0x8000db3) socketpair$unix(0x1, 0x1, 0x0, &(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}) epoll_ctl$EPOLL_CTL_ADD(r5, 0x1, r6, &(0x7f0000000100)) shutdown(r6, 0x0) epoll_wait(r5, &(0x7f0000000000)=[{}], 0x1, 0x101) epoll_ctl$EPOLL_CTL_MOD(r5, 0x3, r6, &(0x7f0000000140)={0x2000200b}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000280)={0x1, &(0x7f0000000780)=[{0x200000000006, 0xf, 0x6, 0x7ffc1ffb}]}) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r7 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r7, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') r8 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r8, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f0000000340)='./file0\x00', &(0x7f00000001c0)='./file0/../file0/../file0/../file0\x00') ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'tunl0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=@newqdisc={0x34, 0x24, 0x4ee4e6a52ff56541, 0x2800, 0x25dfdbfb, {0x0, 0x0, 0x0, r9, {}, {0xffff, 0xffff}, {0x10, 0xfff3}}, [@TCA_RATE={0x6, 0x5, {0x7f, 0x9a}}, @qdisc_kind_options=@q_qfg={0x8}]}, 0x34}}, 0x4000810) madvise(&(0x7f00000ec000/0x800000)=nil, 0x800000, 0x17) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) 21m38.821751121s ago: executing program 0 (id=1017): r0 = syz_io_uring_setup(0x833, &(0x7f00000000c0)={0x0, 0x679d, 0x400, 0x2000006, 0x200003ce}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) clock_gettime(0x0, &(0x7f0000000240)={0x0, 0x0}) r5 = io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000002c0)=@IORING_OP_TIMEOUT={0xb, 0x8, 0x0, 0x0, 0x2, &(0x7f0000000200)={r3, r4+60000000}, 0x1, 0xc, 0x1, {0x0, r5}}) r6 = openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$SNDCTL_DSP_SETFRAGMENT(r6, 0xc004500a, &(0x7f0000000180)=0xffff0018) io_uring_enter(r0, 0x3516, 0x0, 0x0, 0x0, 0x0) 21m37.8144206s ago: executing program 0 (id=1018): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0x4}, {0x16, 0xff}]}) 21m37.02458248s ago: executing program 33 (id=1018): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000080)={0x2, &(0x7f0000000000)=[{0x20, 0x0, 0x0, 0x4}, {0x16, 0xff}]}) 2m38.796095914s ago: executing program 4 (id=4362): r0 = syz_open_procfs(0x0, &(0x7f0000019080)='net/ip6_mr_cache\x00') pread64(r0, &(0x7f0000000080)=""/102356, 0x18fd4, 0xd6) r1 = syz_usb_connect(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x77, 0x29, 0x4, 0x20, 0x424, 0x9901, 0xc257, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x10, 0x0, [{{0x9, 0x4, 0x43, 0x0, 0x2, 0x31, 0x7d, 0x55, 0x0, [], [{{0x9, 0x5, 0x2, 0x2, 0x200, 0x2}}, {{0x9, 0x5, 0x82, 0x2, 0x200}}]}}]}}]}}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) syz_usb_control_io$uac1(r1, 0x0, 0x0) symlinkat(&(0x7f0000000000)='./file0\x00', r0, &(0x7f00000190c0)='./file0\x00') syz_usb_control_io$printer(r1, 0x0, &(0x7f0000000540)={0x34, &(0x7f00000001c0)={0x40, 0x17, 0x4, "06fa282f"}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$hid(r1, 0x0, 0x0) 2m36.221824027s ago: executing program 4 (id=4370): socket$inet_udp(0x2, 0x2, 0x0) brk(0xffffffffffffffff) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="120000000000000029000012", @ANYRES64=r0], 0x108}}], 0x1, 0xc040) 2m36.173559302s ago: executing program 4 (id=4371): r0 = socket$inet6(0xa, 0x800000000000002, 0x0) sendto$inet6(r0, 0x0, 0x0, 0x4c881, &(0x7f0000000540)={0xa, 0x4e24, 0x0, @mcast2}, 0x1c) sendmmsg$inet6(r0, &(0x7f0000000280)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)=ANY=[], 0xd0}}, {{&(0x7f0000000040)={0xa, 0x4e22, 0x6, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01'}, 0x1c, 0x0, 0x0, &(0x7f0000000240)=[@rthdr_2292={{0x18, 0x29, 0x39, {0x33, 0x0, 0x1, 0x1}}}], 0x18}}], 0x2, 0x4040005) syz_usb_disconnect(0xffffffffffffffff) r1 = socket$inet6_sctp(0xa, 0x801, 0x84) r2 = syz_io_uring_setup(0x23d, &(0x7f0000000200)={0x0, 0x0, 0x10100, 0x2}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000140)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x2f}}) io_uring_enter(r2, 0x2def, 0x0, 0x20, 0x0, 0x0) shutdown(r1, 0x1) 2m35.173773191s ago: executing program 4 (id=4373): r0 = syz_open_dev$mouse(&(0x7f0000000100), 0x9, 0x41) pipe(&(0x7f0000000580)={0xffffffffffffffff, 0xffffffffffffffff}) write$binfmt_misc(r2, &(0x7f0000000000)='-', 0x1) splice(r1, 0x0, r0, 0x0, 0x5, 0x4) io_uring_setup(0x1b7e, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000040)={0xffffffffffffffff}, 0x111, 0xa}}, 0x20) r4 = fsopen(&(0x7f00000001c0)='ramfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r4, 0x6, 0x0, 0x0, 0x0) r5 = fsmount(r4, 0x0, 0x0) fchdir(r5) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x80) r6 = open_tree(0xffffffffffffff9c, &(0x7f0000000100)='\x00', 0x89901) move_mount(r6, &(0x7f0000000000)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) write$RDMA_USER_CM_CMD_QUERY(r2, &(0x7f00000000c0)={0x13, 0x10, 0xfa00, {&(0x7f0000000140), r3, 0x1}}, 0x18) r7 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/tcp_rfc1337\x00', 0x2, 0x0) sendfile(r7, r7, 0x0, 0x15) read$FUSE(r0, &(0x7f00000005c0)={0x2020, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x2020) timer_create(0x7, &(0x7f00000003c0)={0x0, 0x2a, 0x6, @tid=r8}, &(0x7f0000000380)) socket$inet_udplite(0x2, 0x2, 0x88) 2m34.881053458s ago: executing program 4 (id=4375): socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, 0x0, 0x0) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="140000000000000029000000", @ANYRES64=r0], 0x108}}], 0x1, 0xc040) 2m34.763618324s ago: executing program 4 (id=4377): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f000060c000/0x4000)=nil, 0x4000, 0x16) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f00001b8000/0x2000)=nil, &(0x7f000064f000/0x2000)=nil, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x59}) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f00000000c0)={0x3c, 0x2}) r2 = syz_io_uring_setup(0xbd8, &(0x7f0000000640)={0x0, 0x47fb, 0x8, 0x1, 0x40000333}, &(0x7f0000000100)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) io_uring_enter(r2, 0x847ba, 0xd8c, 0xe, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newlink={0x48, 0x10, 0x1, 0x70bd2c, 0x20, {0x0, 0x0, 0x0, 0x0, 0xdf15003157970113, 0x8084}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc, 0x4, {0x1, 0x9}}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000084}, 0x20000010) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000440)={{0x1, 0x1, 0x18, r0, {0xfce, 0x5}}, './file0\x00'}) setns(r6, 0x10000000) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000300)={0xa, 0x6a, {}, {0xffffffffffffffff}, 0x4, 0x100}) sendmsg$nl_xfrm(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newpolicy={0x1b8, 0x13, 0x2, 0x70bd28, 0x25dfdbff, {{@in6=@mcast2, @in6=@dev={0xfe, 0x80, '\x00', 0x44}, 0x4e24, 0x3, 0x4e23, 0x0, 0xa, 0x120, 0x20, 0x0, 0x0, r8}, {0x71b3, 0x8000000000000001, 0x0, 0x4, 0x9ea3, 0x3, 0x3, 0x9}, {0x8, 0x8, 0x8, 0x74}, 0x4, 0x6e6bbc, 0x1, 0x0, 0x1}, [@replay_val={0x10, 0xa, {0x70bd27, 0x70bd2d, 0x8}}, @algo_auth={0xed, 0x1, {{'blake2b-160\x00'}, 0x528, "57f0f942f9ac7d81df796cd10aacdbfb0e09c125e7311f5b9ec9895c1b7cf56b1f5573e6f50bd6d041276be279cd642be6c13ebc8aed2e5d9301a750c027b049070f1ef920838f94eb7af6cf02d4b3cf374e9135ba5532e0ec986ee404ae9288e8b21540b3abeccc66ed7e8961579e518f466b96e4118ce94e7d73a1901d8a922608503babe2a35a2a53005ad67594f8894dc5fb069b4541ef6d76c7691790684d38d17bcc"}}]}, 0x1b8}}, 0x0) r9 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303}, "68c4502393926b50", "09f700", "1ab6c0ff"}, 0x28) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a64000000060a0b040000000000000000020000003800048034000180090001007866726d000000002400028008000140000000140500030000000000080002400000000c08000440000000140900010073797a30000000000900020073797a32"], 0xcb}, 0x1, 0x0, 0x0, 0x20040885}, 0x40000) syz_genetlink_get_family_id$nl80211(&(0x7f0000002b40), r9) 2m19.63813046s ago: executing program 34 (id=4377): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) r1 = syz_open_procfs$pagemap(0xffffffffffffffff, &(0x7f0000000000)) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) madvise(&(0x7f000060c000/0x4000)=nil, 0x4000, 0x16) ioctl$PAGEMAP_SCAN(r1, 0xc0606610, &(0x7f00000001c0)={0x60, 0x0, &(0x7f00001b8000/0x2000)=nil, &(0x7f000064f000/0x2000)=nil, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x59}) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x2, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c) ioctl$FBIOPUT_CON2FBMAP(0xffffffffffffffff, 0x4610, &(0x7f00000000c0)={0x3c, 0x2}) r2 = syz_io_uring_setup(0xbd8, &(0x7f0000000640)={0x0, 0x47fb, 0x8, 0x1, 0x40000333}, &(0x7f0000000100)=0x0, &(0x7f0000000240)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xfffffe62}], 0x1}) io_uring_enter(r2, 0x847ba, 0xd8c, 0xe, 0x0, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newlink={0x48, 0x10, 0x1, 0x70bd2c, 0x20, {0x0, 0x0, 0x0, 0x0, 0xdf15003157970113, 0x8084}, [@IFLA_IFNAME={0x14, 0x3, 'netdevsim0\x00'}, @IFLA_VFINFO_LIST={0x14, 0x16, 0x0, 0x1, [{0x10, 0x1, 0x0, 0x1, [@IFLA_VF_SPOOFCHK={0xc, 0x4, {0x1, 0x9}}]}]}]}, 0x48}, 0x1, 0x0, 0x0, 0x20000084}, 0x20000010) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000440)={{0x1, 0x1, 0x18, r0, {0xfce, 0x5}}, './file0\x00'}) setns(r6, 0x10000000) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) ioctl$DRM_IOCTL_GET_CLIENT(0xffffffffffffffff, 0xc0286405, &(0x7f0000000300)={0xa, 0x6a, {}, {0xffffffffffffffff}, 0x4, 0x100}) sendmsg$nl_xfrm(r7, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000006c0)=@newpolicy={0x1b8, 0x13, 0x2, 0x70bd28, 0x25dfdbff, {{@in6=@mcast2, @in6=@dev={0xfe, 0x80, '\x00', 0x44}, 0x4e24, 0x3, 0x4e23, 0x0, 0xa, 0x120, 0x20, 0x0, 0x0, r8}, {0x71b3, 0x8000000000000001, 0x0, 0x4, 0x9ea3, 0x3, 0x3, 0x9}, {0x8, 0x8, 0x8, 0x74}, 0x4, 0x6e6bbc, 0x1, 0x0, 0x1}, [@replay_val={0x10, 0xa, {0x70bd27, 0x70bd2d, 0x8}}, @algo_auth={0xed, 0x1, {{'blake2b-160\x00'}, 0x528, "57f0f942f9ac7d81df796cd10aacdbfb0e09c125e7311f5b9ec9895c1b7cf56b1f5573e6f50bd6d041276be279cd642be6c13ebc8aed2e5d9301a750c027b049070f1ef920838f94eb7af6cf02d4b3cf374e9135ba5532e0ec986ee404ae9288e8b21540b3abeccc66ed7e8961579e518f466b96e4118ce94e7d73a1901d8a922608503babe2a35a2a53005ad67594f8894dc5fb069b4541ef6d76c7691790684d38d17bcc"}}]}, 0x1b8}}, 0x0) r9 = fcntl$dupfd(0xffffffffffffffff, 0x0, 0xffffffffffffffff) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(0xffffffffffffffff, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(0xffffffffffffffff, 0x11a, 0x2, &(0x7f0000000140)=@ccm_128={{0x303}, "68c4502393926b50", "09f700", "1ab6c0ff"}, 0x28) r10 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r10, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000a00000a64000000060a0b040000000000000000020000003800048034000180090001007866726d000000002400028008000140000000140500030000000000080002400000000c08000440000000140900010073797a30000000000900020073797a32"], 0xcb}, 0x1, 0x0, 0x0, 0x20040885}, 0x40000) syz_genetlink_get_family_id$nl80211(&(0x7f0000002b40), r9) 1m49.32069929s ago: executing program 6 (id=4503): ioctl$FBIOGET_VSCREENINFO(0xffffffffffffffff, 0x4600, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x0, 0x2002, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair(0x1, 0x1, 0x0, 0x0) bpf$MAP_CREATE(0x0, 0x0, 0x50) r2 = syz_usb_connect(0x5, 0xf4, &(0x7f0000000700)=ANY=[@ANYBLOB="120110014c306f10da0b38011230010203010902e20002a60000000904b10403d7b5d25b09210400020122c705090500100004f40804072501832f08000905000040008103ff0905091b08000c078009042201040e010003090509000000030004090502020002f7810671300c458e9532438d4aae3ef0c9bf5c520b1aaab11a8cae9a60c3160adc1dfedebf5a6ead8834c7780c2eb777ef0caf96cd8b3b77f357f4aa1b662ab40651e6ae8cc63dd9f6e2d24afaed81a927ca2e0354281cfeffffffffffffffbf09aac591308e5c0c3c419bb288a21890e1af4af409050303ff030840040705a6c6415a9f09058503"], 0x0) syz_usb_control_io(r2, &(0x7f00000009c0)={0x2c, 0x0, &(0x7f0000000800)={0x0, 0x3, 0x2, @string={0x2}}, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$cdc_ecm(r2, &(0x7f0000000540)={0x14, 0x0, &(0x7f0000000500)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0) syz_usb_control_io$hid(r2, 0x0, &(0x7f0000000480)={0x2c, &(0x7f0000000240)={0x20, 0x16, 0x2, "2ef8"}, 0x0, 0x0, 0x0, 0x0}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) socket$kcm(0x29, 0x0, 0x0) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sndseq(0xffffffffffffff9c, &(0x7f0000000040), 0x80) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) openat$ptp0(0xffffffffffffff9c, 0x0, 0x100, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={0x0, 0x38}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x3) ioctl$KVM_SET_MSRS(r5, 0x4008ae89, &(0x7f00000000c0)=ANY=[@ANYBLOB="010000000000080080000040"]) r6 = socket$inet_icmp_raw(0x2, 0x3, 0x1) sendto$inet(r6, &(0x7f0000000000)="f461c5bbd75c3583", 0x8, 0x0, &(0x7f0000000100)={0x2, 0x4e23, @empty}, 0x10) r7 = openat$sw_sync(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$SW_SYNC_IOC_INC(r7, 0x40045701, &(0x7f0000000440)=0xffffffff) recvmmsg(r6, &(0x7f000000e280), 0x58a, 0x42, 0x0) getsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x4, 0x0, 0x0) 1m45.325709257s ago: executing program 6 (id=4509): r0 = socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r3 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(r3, 0x84, 0x64, &(0x7f0000000900)=[@in={0x2, 0x4e23, @loopback}, @in6={0xa, 0x0, 0x0, @loopback, 0x7ff}], 0x2c) sendto$inet6(r3, &(0x7f0000000000)='\x00', 0x1, 0x0, &(0x7f000005ffe4)={0xa, 0x4e23, 0x0, @loopback, 0x5}, 0x1c) setsockopt$inet_sctp6_SCTP_EVENTS(r3, 0x84, 0xb, 0x0, 0x0) recvmmsg(r3, 0x0, 0x0, 0x40000040, 0x0) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) socket$nl_route(0x10, 0x3, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) openat$sequencer2(0xffffff9c, &(0x7f0000000080), 0x143240, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x2002, 0x0) ioctl$SNDCTL_DSP_SETFMT(r5, 0xc0045005, &(0x7f0000001180)=0x2000000) mmap$dsp(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x3, 0x12, r5, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r5, 0x5008, 0x0) ioctl$SNDCTL_DSP_SYNC(r5, 0x5001, 0x0) ioctl$SNDCTL_DSP_GETOPTR(r5, 0x800c5012, &(0x7f0000000200)) shmget$private(0x0, 0x2000, 0x800, &(0x7f0000631000/0x2000)=nil) read$dsp(r5, &(0x7f00000000c0)=""/87, 0x57) sendmsg$WG_CMD_GET_DEVICE(r4, &(0x7f00000026c0)={0x0, 0x0, &(0x7f0000002680)={&(0x7f0000002640)=ANY=[@ANYBLOB='(\x00\x00', @ANYRES16, @ANYBLOB="11032bbd7000fbdbdf25e85133ca6e8c9f"], 0x28}, 0x1, 0x0, 0x0, 0x20}, 0x20000880) setsockopt$MRT6_ADD_MIF(r0, 0x29, 0xca, &(0x7f0000000040)={0x0, 0x1}, 0xc) r6 = socket$inet_sctp(0x2, 0x1, 0x84) sendto$inet(r6, &(0x7f0000000140)='^', 0x34000, 0x0, &(0x7f0000004ff0)={0x2, 0x0, @rand_addr=0xfffffffffffffffe}, 0x10) 1m43.215997298s ago: executing program 6 (id=4512): r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000540)=ANY=[@ANYBLOB="11010000733336088dee1edb23610000000109022d0101100000000904000003fe03010009cd8d1f0002000000090505020000fcffff09058b1e20"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) r1 = socket$inet6(0xa, 0x1, 0x8010000000000084) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000000780), 0x0, 0x2, 0x0) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(r2, 0x84, 0x6, 0x0, &(0x7f00000000c0)) ioctl$FBIOGET_FSCREENINFO(0xffffffffffffffff, 0x4602, &(0x7f0000000100)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_emit_ethernet(0x52, &(0x7f00000004c0)=ANY=[@ANYRESOCT=0x0, @ANYRES8=r2], 0x0) r3 = openat$adsp1(0xffffffffffffff9c, &(0x7f00000000c0), 0xa0201, 0x0) r4 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r4, 0x84, 0x6f, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)}, &(0x7f0000000100)=0x10) r6 = socket(0x200000000000011, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000540)={&(0x7f0000000240)=ANY=[@ANYBLOB="3c000000100005ff04000000000000000000004a", @ANYRES32=0x0, @ANYRES8=r0, @ANYRES32, @ANYBLOB], 0x3c}}, 0x0) ioctl$SNDCTL_DSP_GETTRIGGER(r3, 0x80045010, &(0x7f0000000380)) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r4, 0x84, 0x85, &(0x7f0000000240)={0x0, @in={{0x2, 0x0, @empty}}, 0xff, 0x3}, 0x90) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(r4, 0x84, 0x9, &(0x7f0000000840)={r5, @in6={{0xa, 0x4e20, 0x3ae, @empty, 0x129}}, 0x9, 0xd, 0x614, 0x5, 0x98, 0x7, 0x4}, 0x9c) ioctl$SNDCTL_DSP_SETFMT(r3, 0xc0045005, &(0x7f0000000640)=0x8000) connect$inet6(r1, &(0x7f0000000000)={0xa, 0x4e21, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x37}}}, 0x1c) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2e, &(0x7f0000000200)={0x0, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}, 0x20000}}, {{0xa, 0x0, 0x40000, @dev={0xfe, 0x80, '\x00', 0x26}}}}, 0x108) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newqdisc={0x54, 0x10, 0x1, 0x0, 0x10000000, {0x0, 0x0, 0x0, 0x0, {0x1}, {}, {0xe}}, [@TCA_INGRESS_BLOCK={0x8}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1a, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}}, {0x8, 0x1b, [0x0, 0x0]}}]}]}, 0x54}, 0x1, 0x0, 0x0, 0x800}, 0x0) memfd_create(&(0x7f0000000040)='\x01\xfd\xae.+\xa6\x8c\xf8\xff2\x199\x94S,|\x99x?Ue[\xbd\xe1!\x03[d \xa0\x97\xf5G\x97A\xc2\xd8\xf0Uq\xe6+\xa5l\x94\v\xd3\a\xe4\xc4\xb1\xa2\x1c\xffC;\x94Q\r\xb6}\x9c\xecC\v\xcf\xeb\xe4\x9aR\xe5,\x82\x03\xfa\x18\x8dR\xbb\xea5F\x00G\xe8\xc6\xb9\xe4\xb4\x99\x8a\x19P\xb8\x8cx\b\x99\x04R\x05\xaf\xa2\xea5\f\xccV\xa6w%\x06\x19\x7f\xc3\xb3O\xe5t3\x03\x1a\x9b\x00Uf\xa5\xf7\x80Tgiz\nX\b\x91\xfd0\x8e\xb6\xa3\v#\xa1\xdf\xb4\xc0\xe6\xb4\xef\xa8i\xd8\xa2\xd2(\x98\x9bA\x8f\x13\xeb\xf4b/\xef!\x8f\xf6]-\xe9k\xb62\x89gEv\x13\xf4\xc7\xb2\xf5\\\x17\x90\xb5\xa6\xa8\xb8o\x0f\xe2 \xe7\x9c$\xd7\xf2@\xf7cdv[\t\x00\x8d\xf3\xcc1\r$\x1e\xff\xf0P\xb2\x97\xb8\xbc\xeb\x91\x87\x8bu\xbf\xd4\'\xff\x1f\f\x016\x9dQ\xeeT\xe8\bY\x00\xb2\x06\xa6x\xd5O\xd6h\\I\xc9\x8d\a\x1d\xc9\x0f\x82\xdbs\xc7\x83L\x9e\xa2\xd1\xb3\xac\x8d\xd8\xb4\xb4\xea\x90Q\xd8\xc7\xeb%\x8bOp\x1ab\x96\xcf\xbb\x15\xcf\xfcN\xed\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x00p+\x96\x1ei|n\xda\xee\x01\xae\x96*\x82*\xb8j\xda\xaa\x14\x1f\x1d\x9f\xf8\xae\xfcH\xc4\xb3j\xe8\xcfO\xef\x0e\xafe\xb5*\x89\x18\xb2w\x96\b\x1by\xeaT\xdd\xb3g6\xbc\x85\xb2Y\xccv\x06\x00\x00\x00\xc5e\x90\xc51\x9f\v_# \b\xa5\xbcP,|\xe9\xd6s\x1f\x1f\xbe\xd3\x80\xb1\xa8 \xce|df\x903\v\x02\xea.\x03X\xb5\xe4,8\xb7\xadEI\xdcA\xa7\xcc\xd7\xf9n\x1b\x95\xf8\x11Z\xe6:\xf4\xcd\xfe\x02\x8ctdy~_oC\x9e\xef\xf0\xa2K\xe9;\x8e:\x01\x03C\x92\xeb\x16\x1c\xbf\xbe\xef\xccUxhg\xffY\xe6\x83\xa6z\xff\x01\x9d o_{!O\xaajU\x84 \xe9\xb59r\x9cw\x18Z\xd3\xcd\x0e\xba\\\xdb\xf0\xe1\x86\t\xaf\ti\xdc\xbf?\xf5\n\xbd^\x05\xc0\xceuC}\xa8\xc7\xad\x86\xd7\x17&\xb9]1\x05J\x96\xf0\x84\xc1\f\xa6p\x96\xb8\x02\x13pA\x19\tf\x12\x88\xc8\x9c\xc9Cn\xd4\xa47V\'+\xcc\xbf\r\xa9\x10\x1d\xcf\xebKlb\xe5:\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00G\xdf\xbb\xc0_\x99F\xf4n]\x14\xbc\xcd\xd3\x9f\x9fe\xc5\xe6\xe8Mb\xc6\x82\x82\xcc\b\x00\x00\x00\x00\x00\x00\x00\xb8\x18\xe2C\xeb\xa9\x17&\x01&\'w\xa1t0\x80\xf0\x93\x80\x9f\x9b\xe0\x9f\xea\xb9\x9eD]#V\xda\x92\xca\xc6\xfa.\xd6\xe31\xfe\xe8\x02\xebX\xbd\nz\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01;\xbfM.\xe3\x84\x82\x9c\x91\a\x9b\x191c\xaeLz\xe0\x04Daz\x8d\xc3\x03\xab\x8dEGC$\x00e,\x94#\xcd4\xf9\x05\x88.\x13\x03\x04\xdb\x00\x00\x00\x00\x00', 0x4) r7 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x41341) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f0000000200)) ioctl$USBDEVFS_IOCTL(0xffffffffffffffff, 0xc0105512, &(0x7f0000000340)=@usbdevfs_connect={0x6}) openat$mice(0xffffffffffffff9c, &(0x7f0000000880), 0x40800) sendmsg$NL80211_CMD_GET_MESH_CONFIG(r6, &(0x7f00000005c0)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x400000}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)={0x28, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x8b85, 0x22}}}}, ["", "", "", "", "", ""]}, 0x28}, 0x1, 0x0, 0x0, 0x40044}, 0x20000004) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000980)={0x2c, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000000)={0x20, 0x3, 0x1, 0x81}}) 1m39.77810741s ago: executing program 6 (id=4518): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_SWAP(r2, 0x0, 0x4004) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0x0, 0xffffffffffffffff, 0xfffffffffffffffe, 0xfffffffc}, 0x0) socket$inet_tcp(0x2, 0x1, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mknod$loop(&(0x7f0000000080)='./bus\x00', 0x1, 0x0) renameat2(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0xffffffffffffff9c, &(0x7f0000000100)='./bus\x00', 0x2) bind$inet(0xffffffffffffffff, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0) mknod$loop(&(0x7f0000000140)='./file0\x00', 0x2, 0x1) r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) bpf$PROG_LOAD(0x5, 0x0, 0x0) read$FUSE(r3, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r3, &(0x7f0000000040)={0x50, 0x0, r4, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r3, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) syz_usb_connect$cdc_ncm(0x3, 0x6e, &(0x7f0000000000)=ANY=[@ANYBLOB="12011001020000082505a1a44000010203010902"], 0xfffffffffffffffc) r6 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x2080) ioctl$LOOP_SET_FD(r6, 0x4c00, r5) sendmsg$SEG6_CMD_SET_TUNSRC(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f00000002c0)={0x10, 0x0, 0x0, 0x200000}, 0xc, &(0x7f0000000380)={&(0x7f0000000300)={0x44, 0x0, 0x200, 0x70bd28, 0x25dfdbff, {}, [@SEG6_ATTR_SECRET={0x4}, @SEG6_ATTR_SECRET={0x14, 0x4, [0x0, 0x0, 0x1ff, 0x6]}, @SEG6_ATTR_ALGID={0x5}, @SEG6_ATTR_SECRETLEN={0x5, 0x5, 0x2}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x6}]}, 0x44}, 0x1, 0x0, 0x0, 0x4000000}, 0x0) sendmsg$SEG6_CMD_DUMPHMAC(r5, &(0x7f0000000280)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x400}, 0xc, &(0x7f0000000180)={&(0x7f0000000200)={0x60, 0x0, 0x10, 0x70bd25, 0x25dfdbfc, {}, [@SEG6_ATTR_SECRET={0x10, 0x4, [0x8000, 0x8e4, 0x8]}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x800}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x1}, @SEG6_ATTR_DSTLEN={0x8, 0x2, 0x7f}, @SEG6_ATTR_HMACKEYID={0x8, 0x3, 0x101}, @SEG6_ATTR_HMACKEYID={0x8}, @SEG6_ATTR_SECRET={0x14, 0x4, [0xfffffff7, 0x4, 0xfff, 0xfffffff8]}]}, 0x60}, 0x1, 0x0, 0x0, 0x5}, 0x40c0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000c00)=ANY=[@ANYBLOB="b7000000ff020000bfa3000000000000070300c0f0ffffff620af0fff8ffffff71a4f0ff000000002d040200000000001d400200000000004604000001ed000062030000000000001d440000000000007a0a00fe00ffffffc328000051000000b5000000000000009500000000000000023bc065b58111c6dfa041b63af4a3912435f1a864a710e4d58db6a693002e7f3be361917adef6ee1c8a2a4f8ef1e50becb19bc461e91a7168c50000000190f32050e436fe275daf51efd601b6bf01c8e8b1b526375ec4dd6fcd82e4fee5bef7af9aa0d7d600c095199fe3ff3128e599b0eaebbdbd732c9cc00eec363e4a8f6456e2cc21557c0afc646cb7798b3e6440c2fbdb00c37dfca3e35208b0bb0d2cd829e654400e2438ec649dc74a28610643a98d9ec21ead2ed51b104d4d91af25b845d8a7925c3109b151b8b9f75dd08d123deda88c658d42ecbf28bf7076c15b463bebba2c598b4fc72f526d8e8afcb913466aaa7f6df70252e79166d858fcd0e06dd31af9612f2460d0b11008e59a5923906f88b53987ad1714e72ba7a54f0c33d39000d06a59ff616236fd9aa58f2477184b6a89adaf17b0a6041bdef728d236619074d6ebdfd1f5089048ddff6da40f9411fe722631cb467600ade70063e5291569b33d21dae356e1c51f03a801be8189679a16da18ec0ae564162a27afea62d84f3a10746443d6438e959532e0617d419c6bc6ea9f2bca4464f56e24e6d2105bd901204a1deeed4155617572652d950ad31928b0b0c3dc2869f478341d02d0f5ad94b081fcd507acb4b9c65fee9d5a17f48a7382f13d000000225d85ae49cee383dc5049076b989b40000000000000da60d2ae20cfb91d6a49964757cdf538f9ce2bdb1ab062cd54e67011d355d84ce97bb0c6b4a595e487efbb2d71cde2c140952f9a0f0bc6980fe78683ac5c0c31032599ddd71063be9261b2e1aab1675b34a22048ef8c126aeef5f510a8f1aded94a129e4aec6f8d9ab06faffc3a15d96c2ea3e2e04cfe031b2875353193f82ade69d0540059fe6c7fe7cd8697502c7596566d674e425da5e87e59602a9f6590521d31d3804b3e0a1053abdc31282dfb15eb6841bb64a1b304502dda787343ce3c953992e4a982f3c48153baae244e7bf37548c7f1a4cad2422ee965a38f7defbd2160242b104e20dc2d9b0c35608d402ccdd9069bd50b994fda7a9de44028d6112a0c2d21b2dc98816106dec28eaeb883418f562ae00003ea96d10f172c0374d6eed826416050000000bfe9b4a9c5a90ff59d54d1f92ecc4e95dd2d18383117c039862198899b212c55318294270a1ad10c80fef7c24d47afce829ba0f85da6d888f18ea40ab959f6074ab2a40d85d15017ab513cdc6c0e57fb1c1ca571380d7b4ead35a385e0b4a26b702396df7e0465f2f994114f244a9bf93f04bf072f0861f7580e69db384ac7eeedcf2ba1a9508f9d6aba582a896a9f1ffa968eacea75caf822a7a63ba34015ea5aacb1188883ad2a3b1832371fe5bc621426d1ed0a4a99702cc1b6912a1e717d29135753208165b9cdbae2ed9dc7358f0ebadde0b727f27feeb744ddcc536cbae315c7d1fe1399562ba6824840b08000000f6f2f9a6a8346962a350845ffa0d829e4f79adc287906943408e6df3c3bfd03aac93df8866fb010aec0e92bed1fe39af169d2a466f0db6f3d9436a7d55fc30511d00000000c95265b2bd83d64a532869d701723fedcbada1ee7baa5b6a686b50f0937f778af083e055f6138a757ebd0ed93517a6b244f9acf41ac5d73a008364e0606a594817031fc2f52c8785fe0721719b3d654026c6ea08b83b123145ab5703dad844ceb201ddeb6dc5f6a903792283c42efc54fa84323afc4c10eff462c8843187f1dd48ef3fa293774d582956ff0f40b10ca94f6feeb2893c17888e1cdba94a6ea80c33ead5722c3293a493f1479531dd88261458f40d31fe8df15efaaeea831555877f9538d6ee6ba65893ff1f908ba7554ba583fef3ec7932f5954f31a878e2fae6691d1aee1da02ba516467df3e7d1daac43738012e4fee18a22da19fcdb4c2890cda1f96b952511e3a69d694d625e0b2f808890205f3a6da2819d2f9e77c7c64affa54fec0136cbafa5f62e96753b639a924599c1f69219927ea5301fff0a6063d427f0688430754c02180d61542c25000000000000000005a7b57f03ca91a01ba2e30ca99e8ebc15ecb4d91675767999d146aef7799738b292fd640dfef6b04d086f737a159d7e0c6e4d81ad64a8bbca48568325b2969e2b15f36b788bce5ccdbaf75c94cb93499f6947a967a7bce14c6de4e7c0660d80010f5c653d22d49030a8c2a4ab595bf4238f18ca428dafc7ac96d404607a0000000051a2104f22e6db5a62b5089c1b45282d38864daa3ae81d6b0968d1d2867b91b7d120617d12d91db2633d6864da40b54783a17aaeb6737c323f9f98e354cc98dcfe23ad01bd1c61563e69ffe1c2c73e1661261173f359e93d2c5e424c17998809ec8f0232b3955e052a4cecd89008f70314a0bdd491ec86a4555d89fe0120f64c62e8e3ed8bcb45202c3d4bbec8d722824c0ebca8db1ea4a003d2fbdc1f9be78537756ab5bbe4fe9af5d785d0128171c90d9900ce2532b0f9d01c4b45294fbba468df3e1b393cb4e62e754598e47df6bd06431c94bc5d047899fd219f448bf9189c65c9d91eda6b52a373803a9efe44f86909bc90addb7b9aee813df534aac4b3093c91b8068cd849904568916694d461b76a58d88cf0f520310a1e9fdc18cde98d662eee077515d0a8811922929e085392ab3d1311b8243266d87047f601fa88a0da36b9f302e82623951743283070744f143fdec90ba5a82668d5fac114c13955ad6dca5db2231d8ba14c54c47ed04a4b4ace17e357e1d6432399f87a7a14245bbd796a09313b247b95d37ff40a404bdad74bd20000000000000000000099fef7cd7af3ce64a92f95d89d125b1e641240d7e5e27a3d1f7684448c3e3822d617e205061298b939a191be4b48e169bde2cae3accc5bd40a2968b59c93d35f8e42366fdef9a2abae1cf01ce68abff28861aac8302d268569dd42e194e330c7aaa54ebbcefd23f21ce8153b9926e12e925cb56119df72c7533a48d028ad0c74e2a9478fa3be18a1a2b65079cc1c7bc46dd12305a1ae9dd19e8d525206c0a728cfd42193abe8130b51d6c9b94c5513df2d85e8c01a2d69841f3d7799ac04bdc590bb1c89b9c695f163e57343c9bfb59909433c9001c5f8b23e38534a538fc933cac6c2a92d038df638a0f226df9fb857bd414c2cd69985e8053e3dfa41614d7c74d04d8c2471041d17c730fad28395f8d4688898cd58b9d600c851626529bb58aa364b55e73f053450665e7b94ad1012fd7a8139166fd5e59c84f4ab279b1b99c028db4cb9680c8035f967db18de738844da7e260a830c1ffa49f5af3c15423a0e315acb82a3e89218cb314e68fda4d94aa1d815babc13b9fd336d205c5913ef670000000000000000ba470bfe62fe2933082149d42e8a00a5b4f7e9ad0500000000000000"], &(0x7f00000001c0)='GPL\x00', 0x3, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffbf}, 0x48) dup2(r5, r3) 1m34.741459365s ago: executing program 6 (id=4531): r0 = socket(0x10, 0xa, 0x0) ioctl$sock_SIOCGIFVLAN_GET_VLAN_INGRESS_PRIORITY_CMD(r0, 0x8982, &(0x7f0000000000)) ioctl$sock_SIOCETHTOOL(r0, 0x8946, &(0x7f0000000080)={'wg1\x00', &(0x7f0000000040)=@ethtool_cmd={0x28, 0x6, 0xff, 0x0, 0xfa, 0xfa, 0x1, 0x8, 0x3, 0x0, 0x7fffffff, 0xefc2, 0x24, 0x4, 0x8, 0x0, [0x6e, 0x7]}}) 1m34.141990643s ago: executing program 6 (id=4533): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x2000000}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x7}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x46, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f00000000c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1m32.978344371s ago: executing program 35 (id=4533): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {{0x5, 0x0, 0x5, 0x9, 0x0, 0x1, 0x2000000}}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x7}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x46, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f00000000c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 11.073645741s ago: executing program 1 (id=4797): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xc0081, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000780)={0x0, &(0x7f0000000040)=[@code={0x1, 0x6f, {"66470f64dfc4a3255f1d040000000266baf80cb8ecdcf388ef66bafc0cb86b420000ef0fc76cf3b30f01f8c4619e5a72f8b9800000c00f3235010000000f30420f01c448b85a000000000000000f23c00f21f835020007000f23f843cd05"}}, @code={0x1, 0x64, {"0fc75a223e660f382a0f0f20c035010000000f22c048b808000000000000000f23c80f21f8350000c0000f23f866ba410066ed430f0fa4da81966fb7a6c46255453ca60f005da4f2410f2b833e4b285a430f30"}}, @uexit={0x0, 0x18, 0x3}, @code={0x1, 0x65, {"b8010000000f01d9c40202f546000f90cf48b8407f0000000000000f23c00f21f83503000a000f23f80f0f4040b6c421217ccd660f3880370fc1860090000066baf80cb823f6858eef66bafc0cec8f28288e2137"}}, @uexit={0x0, 0x18, 0x3714}, @code={0x1, 0x51, {"0f01f867420f21f066baf80cb8050ad381ef66bafc0cec420fbe15020000002e6666440f1c477d360fc73b66b817008ed80f088fc818ce5b00096465360f01cb"}}], 0x1b9}) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x7, 0x0, 0x180, 0x4, 0x10, 0xf1, 0x0, 0x7fffffffffffe, 0x5, 0x0, 0x5, 0x0, 0x7ff, 0x10000, 0xbdb], 0x1, 0x3c4210}) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_MP_STATE(0xffffffffffffffff, 0x4004ae99, &(0x7f00000001c0)=0x2) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_GUEST_DEBUG_x86(r2, 0x4048ae9b, &(0x7f0000000080)={0x50003, 0x0, {[0x0, 0x100000000, 0x59, 0x2f, 0x7fffffffffffffff, 0x2, 0x2, 0x80000001]}}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000000)=ANY=[@ANYBLOB="01000000000000000f478ef8ed"]) r3 = openat$kvm(0xffffff9c, &(0x7f00000000c0), 0x800, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_REGS(r5, 0x4090ae82, &(0x7f0000000200)={[0x2, 0x9, 0xfffffffffffffffd, 0x0, 0x2, 0x0, 0x4002004c4, 0x1004, 0xffffffffffffffff, 0xc595, 0x0, 0x1, 0xffffffffffffffff, 0x2000000000000000, 0x80000004000000, 0x8d], 0xeeee8000, 0x2010d3}) ioctl$KVM_RUN(r5, 0xae80, 0x0) ioctl$KVM_RUN(r5, 0xae80, 0x0) write$eventfd(0xffffffffffffffff, &(0x7f00000001c0)=0xffffffffffffffff, 0x4009) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f0000000200)={[0x0, 0x6, 0x8000000000, 0x1, 0x1, 0xb, 0x4002004c5, 0x1000, 0x1, 0x0, 0x5, 0x80e, 0x0, 0x6, 0x40000000000000, 0x49], 0xdddd1000, 0x1c6256}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 9.463718421s ago: executing program 1 (id=4802): socket$inet6_tcp(0xa, 0x1, 0x0) ppoll(&(0x7f0000000080)=[{0xffffffffffffffff, 0x4}], 0x1, 0x0, 0x0, 0x0) r0 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r0, 0xc01864c6, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff}) r2 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x2) ioctl$DRM_IOCTL_MODE_GETCRTC(r2, 0xc06864a1, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0}) r4 = socket$kcm(0x2, 0x3, 0x2) sendmsg$inet(r4, &(0x7f0000003a80)={&(0x7f0000000540)={0x2, 0x0, @empty}, 0x10, 0x0, 0x0, &(0x7f0000000580)=[@ip_ttl={{0x14, 0x0, 0x34, 0x4}}], 0x18}, 0x18) ioctl$DRM_IOCTL_MODE_GETFB(r1, 0xc01c64ad, &(0x7f0000000040)={r3}) ioctl$DRM_IOCTL_MODE_GETFB2(r0, 0xc06864ce, &(0x7f0000000140)={r3, 0xffffffff, 0x1ff, 0x9, 0x3, [], [0xc0, 0x4, 0x7, 0x2], [0x8, 0x81, 0x53cc, 0x35], [0x5, 0x8, 0x7, 0x7fff]}) r5 = syz_usb_connect$uac1(0x0, 0x9b, &(0x7f0000000300)=ANY=[@ANYBLOB="12010000000000106b1d01014000010203010902890003010000000904000000010100000a2401000000020102092408000000004c58062404000052072405000053f10b24050000133b9bda531c092405000596efc359090401000001020000090401010101020000090501090000000000072501000000000904020000010200000904"], 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000002c0)={0x2c, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0003043032d759030a4e"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$uac1(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, 0x0) r6 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder0\x00', 0x802, 0x0) mmap$binder(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x1, 0x11, r6, 0x10000000000) mmap$binder(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0x1, 0x11, r6, 0x0) r7 = syz_io_uring_setup(0xbde, &(0x7f0000000540)={0x0, 0xec25, 0x400, 0x41, 0x40000337}, &(0x7f0000000dc0)=0x0, &(0x7f0000000a40)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000180)=0xfffffffe, 0x0, 0x4) syz_io_uring_submit(r8, r9, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r7, 0x847ba, 0x0, 0xe, 0x0, 0x0) r10 = syz_open_dev$tty1(0xc, 0x4, 0x1) r11 = dup(r10) write$UHID_INPUT(r11, &(0x7f0000001080)={0xf, {"6852ad21e0fd02661b37090987f70e06d038e7ff7fc6e5539b0d650e8b089b3f36006e090890e0878f0efcc5e7049b3b612c416b23240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d077202b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d020000001c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b4a5f3090000000000000075271b060029d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841040014f6b76383709d8f5c554336909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f33491237c08822dec110911e893d0a8c4f6777478bc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c24ffffffffffffff7fb70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bed0d4aa202f928f28381aab144a5dc29a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f643577590000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4ed134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146784078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34a1c92f76cc4c24eeb8bc4e9ac2aed9a53803ed0ca4ae3a9737d214060005ea6f1783e2bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9b05000bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48ca2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889bce3076a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02da93aec92a5de203717aa49c2d284acfabe262fccfcbb2b7da2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a35595f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e205ef4a7c43b42aae501b20f7694a035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d558ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4e8b40427bf6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd6700800000082ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39dd2ea9762639ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d0300000000000000b378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769777c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd133d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d678746383074c6bc1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359deea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b3c7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e150600d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b2c2fc5d5f0da42c0456ec015f08e5247d33ae2d35623ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e938ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a893664ac70297dc8d62700000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d902952b72c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dc2f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec0300068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8075ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b67804cfa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000f700000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000044dd0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x1000}}, 0x1006) 6.044354614s ago: executing program 2 (id=4815): timer_create(0x1, 0x0, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x6, &(0x7f0000000040)={0x1, 0x0, 0x60d3, 0x5}) sendmsg$IPCTNL_MSG_CT_GET(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYBLOB="4400000001010102000000000000000002000000240002800c000280040001003a00000014000180080001cd4bde2a0192000000000000000c00"], 0x44}, 0x1, 0x0, 0x0, 0x200448c1}, 0x40) syz_open_dev$usbfs(0x0, 0x76, 0x101301) syz_usb_connect$hid(0x0, 0x36, 0x0, 0x0) syz_mount_image$fuse(&(0x7f0000000040), &(0x7f0000000000)='./file0\x00', 0x0, &(0x7f00000002c0)=ANY=[@ANYBLOB='fd=', @ANYRESHEX, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0], 0x0, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) mount$fuse(0x0, &(0x7f0000000280)='./file0\x00', 0x0, 0x100000, 0x0) syz_clone(0x2c9a4080, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff) 5.720994321s ago: executing program 5 (id=4816): bpf$TOKEN_CREATE(0x24, &(0x7f0000000140), 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000540)=ANY=[@ANYRESOCT=0x0], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x40f00, 0x4, '\x00', 0x0, @fallback=0x16, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, &(0x7f00000000c0)}) r1 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r1, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r1, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r2, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r1, 0x3ba0, &(0x7f0000000280)={0x48, 0x15, r3, 0x0, r2}) r4 = io_uring_setup(0xefe, &(0x7f0000000080)={0x0, 0xd9db, 0x8, 0x6}) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000100)={'wlan1\x00'}) io_uring_register$IORING_REGISTER_FILES(r4, 0x1e, &(0x7f0000000000)=[r4], 0x1) 5.145804709s ago: executing program 5 (id=4818): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x54}}, 0x0) 4.905951312s ago: executing program 5 (id=4819): r0 = bpf$TOKEN_CREATE(0x24, &(0x7f0000000080), 0x8) r1 = ioctl$KVM_GET_STATS_FD_vm(0xffffffffffffffff, 0xaece) r2 = syz_open_procfs$pagemap(0x0, &(0x7f0000000240)) ioctl$PAGEMAP_SCAN(r2, 0xc0606610, &(0x7f00000004c0)={0x60, 0x0, &(0x7f000023d000/0x4000)=nil, &(0x7f00004fa000/0x4000)=nil, 0x4, &(0x7f00000002c0), 0x0, 0x2, 0x5}) r3 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r4 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r4, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) r5 = socket$tipc(0x1e, 0x2, 0x0) setsockopt$TIPC_GROUP_JOIN(r5, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(r5, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000481a}, 0x10) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$binfmt_script(r6, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r6, 0x0) setsockopt$TIPC_GROUP_LEAVE(r5, 0x10f, 0x88) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYRESOCT=r2, @ANYRES32=r0, @ANYBLOB="feffffff00"/20, @ANYRESHEX=r7, @ANYRES64=r2, @ANYBLOB="00000000fdf6ffff2000200000000000f7ffffff0080000000000000"], 0x50) r8 = syz_open_procfs(0x0, &(0x7f0000000200)='net/icmp\x00') ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r1, 0xc02064b2, &(0x7f0000000140)={0x7ff, 0x7d3f, 0x6, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_DESTROY_DUMB(r1, 0xc00464b4, &(0x7f00000001c0)={r9}) r10 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000100), 0x800000, 0x0) setsockopt$SO_TIMESTAMP(0xffffffffffffffff, 0x1, 0x1d, &(0x7f00000000c0)=0xa89, 0x4) r11 = ioctl$KVM_CREATE_VM(r10, 0xae01, 0x0) r12 = ioctl$KVM_CREATE_VCPU(r11, 0xae41, 0x0) ioctl$KVM_SET_NESTED_STATE(r12, 0x4048aecb, &(0x7f00000034c0)={{0x6, 0x0, 0x80, {0x17000, 0x100000, 0x1}}, "cb31455c9ea4288a70a2a6bb8068fd95dd041cf5b177a3bffe992dfbbdf959487337b92336ce1de32e7695c411c0bf9f852d2d71192f33001fd51fd2396a55cb98699a09d21648c4cb30d9e7e3e397c7a3c041c76c72385a46c48c53028456952c2a85822ddf20434ccee5806294ed563ff3a972cddf6ef16ddace933d8a5adea40cd3ad40c9873c29368838e815ff59723519154856b2d5cd9cd79a97dc2fa08dada1175817886e5f9e7aa3dca783a44c667a4806826570ec6acb57d65efc313a384e11fb633dee17ee600145f2cb3103384606140021be766fcb7fa029f0513bbb466177ca1068192550bbf4e6f5694aec747a16e27688a988fa595bca1761b8e88a7dbcaeaf9758b1faf880dd6f1b6eb4c7beb0582b4007f1a67db1352407adbe1456bfe98e94fd825b9419d74f63cdeb6c6976de1890d773f0c8088d2bd48a838cf5b87f5ddf926352960fb978874b0f175acfa55ddfe845e3fc9f75b58bf7a35f33d3c43ed5e3224e92751fa1b43f94f64b681163ef1360a3f3bb7403afc67a188b2104b45c5814aaa9e218552498bf85f4b221d9acc32a331f5f8c109cc9f335ff4e418ab30b54b91fc8211fcbaf64716afdc4b6d0417e04d5723e4675d282b36bef3a3a19e855029e7a9e8b86a6df19332b63e9d8a0f22d96ac230c67657a4e7f7afab91dc0ce751b68980e5a4f6d9d6d9b98802ba9d8576640eea61b8c308a1745df61560e56108bececa3016d93246fdc8b768634e8319b1ffde103c07378f8f4927baba05e992a4b5af0958a7e495e7ce53f7917451d15a963ca14f5cdc4563775688b6533a4b97e0f84b0a33c30077b20805c1f42cc7815efada97ad59ac486bc9e0ee386b49cb97b47fbf8f919f06c75a49636795054b5ebee3e91602c90d7f4db49220affe56d56b96e4f662b2bf36dae482ffc7ba21cbc55e21b73309d6b7aa5509defcb77c236e43b579c61eae5c8d8f8fa71ad876b96069f2e4352c8aaf16e299d21edf5434c0cd9b25cdc9210fb0de759b1dd3fc7fe4c7118bbde72a5617dff21f7a5036448fba7fe41aaee0c289cd076d757e47b0713b236f6f141ba0112c9312b3ec853aabafdf1eb2cbb517d2d7352725f557214d27d9a340af0128fc960a4ea64c933b0d8dd226b6e024471aaac8a7074b2a8695ab990fabba5bf315d246fbfe4260f1fffe54814e33b6235c5b4095437298858909bcbd40a8a286d1bedb06b7b1775bce0a5bca19b0a5c2fa8dbf7b155ae0a43c5086422e5bacb94047e150451f5996420b0d4a697f59decb49900b2b9c13aade536933e14d672c21a35cb68572c3de02f8edd941bff4b8674b91f7aebf35f056a8d388f67f8ef7cfaf6b28fe745831ef41def1839791647016932c70685752851327f1837d2f1e9d8f93443eefed2317119c8152ca451a5d3aeb253fb484283f52e5db9f61f059ad3c217a860ee0571d254483501b00699208c7fa5571cf58b9715c954115bc2db0af28361938bb95ced7370c8cbb6141ef62fdbf369dfc4eccd98ab9886d79a52cbf91a27dd0f4b29940492e860fb94654dea54fad6290570760e3b59a0cf2805372a880971dc61286370aaf167810455cce7654dc4325a41d9d1944abcdc4d81378f1e96a8f94cd95b886a01f086e379601504219d57d531ba34e1ba0905785fb629c61f6b940a652cdee9dbef12b7fcde087b92816db3386a5769049ba00788e31de4ddbb8b56de1fbe3a5e671728effda7cfd0b650cf5df2faf22670812efbbb548e47cbf36c64e05a7877820f08948ceedb35e12a4a143ee0101a7bf0a00a4062b50c39020669700adf739a6f75352a45fd1373d3e85c3867170373f0c7a794d8590f4c22ae62d438ec365b0f6a15cb2ffe0fc6f57185e1760761bd4370027c01dfad0502f00b6898115df3c530d0b0b4a64e623fd580b528a733e4c881cf5843a975a97f92a7833527887c79fa8eec82b9526a15c6c5f2972083ce8aec735810580ffa4ea2cef4823aee044dd70927f7c07bba18b930006aa86ae7399ac6b4c24bc9d6a6ab0c5b428d7255d4d983eadf97e10c1b00867da29ac981acb453073a37236e7ae808e7759b2e0cffc3ec43afb1e95cd090a7d4b9225a0e3cbebfe49b93846ab603891e2da7d85a04bf42d12d16a97c965bc4911d3ba7a9ca505794d87434ef00a436089de67aa8b480070230dfb002eb91edaff428d4908a87afae418dff7ca59aefe1ad8f6935f309fe7985c2310881659c60a66a5e50242497ba1cd5d2bd79496ccd23f9fd901afc6622829cb3701caa50f96e09e3b23bfa31819c04000000000000001a1eb3682de026323d9215fcec42c54401a1af81450830a4b784ed1c7922734bf3632409147680dd3fabcef296353705bb5c0e650e12905a05db1e7923923a96ddc783fc1ed46e2010416c37d9d149ad73e808bd6e4464f62893024a8501803b6c88fc55c8bbc1da7cbf580b5a81fb7c61455ae399aaec303fba12e0f2b51ed5e8bd31db40e8bdbd00e7b1ddd364766c974d813d86fc88a27bf82bba60c62e5f0f6af6bda3390f8e72a2811baf3d6325e70d9a3b59cab1abe95290ecb87985567e1243504c038de9d4d100ea64ffff5208cd8d2474e646f7d81eed6d59b8b0859552b6fc088d874cde3e75ee30243dc9d88ed5b577851a5bd9e2a453287025777fcac19ac33e1c94b4ad272f1055b16b842a6bd6168fb45f1f74ed2467020df5431068a5f2cbeaa6ac1841308c7c9f752aa06927f91fdf18ef9d9e942367e5ecac0abf4d3b8fc7b80238c04799bde63168becc67c5531e843336fb16ab618d37f95a91937b824bf896b044146bc3a5e264a8f23ddd00729cd9aa56d9a9a24b7ab96ae021b193d8874d43ff4b723d86b7564e550378599c3e0c7a2b3d447ad76eb4cd699733d970a5ab218429a1af81df9c8013d6d16a6bcb019f6ace4461cdaa785d20ea027cfa53d521bb91ad2c04aaa6c0f268b14924803977633280c7b7beb14c88fae542b7a13e96253259e7296e37276da88891c14664340e84ae732edbd71e67047e476735b220ca231de31a380ece372db63dec3cb3ef5ac97ec41148febd2acb15cde1ee5e990ea0aaa95c2df39e2111dd1185d14a194e22d34fda8f54e99d3a73e5a231682c726d40816e048c1d059bf3bb9ee2b5f895365d95aa28f6adbf6e16469926b4d8ee7f04c7dbafaa444df5b88596c17874f0efe35e5ada1a69634f4b430f852d33b032f823c5deb54f47a7a4adb1adf56d5440b7a917580004c13e0b36c8e0a203a2be3f8fffd9efef3af19389a12c67859d4381ac0a02da18e25931b41216b731de25e1245482c84d45de1cddbce2109322a3428bff692012573fe9efd02109dbf35c5d3a287dec105cf3f1a2e5f0b1cc08c7b4759766d25d0f7b42c3ea8bf8101e61159a2ba7602e9c7947cf936ac39bf59b24084709fd61d704bbdba7d282aac778b7ec1dcaf984527c8112d56e75ab77ff8898d9816abc77b0e693880bffffffffffffff7fb5cb6967fb0ea8e14efce120947092c3b601002f07cad22e971418092481fcad36ecf0cfd6bc3864115b8507c13554584f1f6fee5ee07eb6a091638d8e7781c1c006166e0f987f9f4de535e9f3df1db8c9328e9a19a73c76059ab4edfe9eda7f16cc6b869229bafb179d194e20ccc6af1d8183b673de8138ddab9a0907278f6eaacc55bf59a450ebc10e0b88c82d9f0deca86ff771f46509250fde94e0c94256b77616d099862ddc9b341838d634a9dc4b55a88fcc6248901135f6aa76365433e7e534e0e5ae8eec2a63df62c3e244a40481189ff54122698c7e2da2c829b2eec9efc9894ee05be04ae6dd48406eaace17827e38bf38b414059aded0343e0711a8d864ff41a8d9ed40fb2aa1a3f4014f691cd0e8af62445a021820ff03afa8a192ee255862f306851df1de96ce36cafb6a60b7069db7aa96fd1ffb2fb01e6247f770304dffe4b1c8d0eeb336dd6806d6ab5d418953b1cae7cbbf53766b61e4aad5cfce8255b78af26f9bd11283a9c7d12cd63b82cd2b506fd4061d1e16fc7c713d80763c3b0aa0faadcd9b7d676101aad80e1ca00369297e1f714003ab8d0b545c335014a522a25a767950963ef821425b79b521076166d0df3ef358c7d60d99cc85463c186e8faf16af79785680382e4cc93f6594f8c4461e0988c08717640df24a5f357db22432fcae21702dc792d201212fb3791e0164bb3d433a8268ec96df73766fdba42965e00e619246cba5d96eb853a7c22c34d2fe5e5d3f3ccf9c627d069517b743cd07f6f7b444074bb9a50269f2e03309c58930e56a9583eb00c37fbcdd391972261f41756c10c8899fcd036e2017e088ef9e6ec31f795d55b3bba214c53c98fc9318e4ade0e7e6fd259aa277fed54c27e5210787a5f6937f56fdbe1da5113f059061ca590ddf536a55cb91ac6ed41cb9c0418b115b29f5e823c1b0ee7c2b3982087763545b34e2c945d587ebce69bbe299a7f52b674f351977370fc700474bc15d7e6ef98c14258ecf401a4f3bba1a9aa76c5ab0b8819fe6efe3fba1899909e5e48554299150ee272451b56142d12ae2bb4942db430239701d494917f2c939a6fb9d98d4751a6f2c4537ec870342d223343a9bd7b8d8c99aff8cbfa298395551185f35dec120228073a1e496a58b59d9ac5986249a7c6db9398395cbf341c08ee910700e2daa042dba1846fef59c72ce872bba2046a14fcf9a47a5686d62bfba76309a9865c26e5fa41dd872fc749fdc57953105ace4978f9eb788c8d061c853ad0313e51e732c5d7bc05e752443c8e99b8e81c688befdb5b14c3cc2f96eb8ce8290303e483992fcbece1ff278d0dc036ad437b6cbc695c7741ba4556e242146d40843c73deaf8fceba40e4a4acd739b3031848b17a210a1ff0dc1908b77030094543af52e1fe2a090c8f217428d02336303f7952c3ddefa7c81850676e7f4cc3d32c3937281fa5ab279c3fe39f92ba077dadb8c2c3df17cc511bd33c41cb161d24aea154f0f5902c94b56fe072d321a983668bd9f4838878e66ec44cb233d7d0ca908a794c844ff8b3ba4c57f6c5fc2f3a54db448b013f0c4998bbc6ed0409b3368391cb28c75f4a909fff90f308ff38c758ff7d8a2920bc221236d89b3b769e44e8ce649b32f5135a0217ba9036a8edddee97d7ba15f2c21fb7d3cae3eb6ef09dd03eed650489c83b5ba5dd9daf7a86cf0544fb8a58e46b860e3e42e10cd6f1c4f81179eb2c3ba611793a32abb4c0768db90e8bdd1694efaa9c2b45c89d203fdfb8b926b6a0d666d91b93065a83184fc2065961f2308056241b66f427c0f0aabc75852c90f0624cf036d537032ca8d73325d2ae2a79a7292c240c34584bb881fe5d468a051cbc0bde061f9eddfb758cd2dfba296eef549e5c4ede097111216a0ec60f90e8d6f5dd843c82e15f505f8c74e854ba9cd386249d552978eb8135a5f8c79c3ceb8dd580800000000000000d6cf3ff2f47c276c8169ab98336582a852c1535018fb2306aca6b8c9f9e38d64c66a722762b76c69d4ca6c14bd6992549e4eec17287fce194467f972d9200c3d1ac4fd4a8f2620e2e4281d28c099946ed90789ba122705326390d3e058ceed24044e542efb36416272eadf6304f30efa0b7bc1ae5be92fe50e591ee6f725726e917ec113506920beb2aa53b39f1d76b31500", "cfb220c7d481332f3f1f8079dfe27e23185fd67a407358db7892789f96b7fa9b14daa48617a10d8a91b820ecbaa470ec0bb1f3cbce7f70ec70b19a4cad082229c2788f8611d7dc306d9a45761a97828c36ed87ebde5d4a3e1609c1422a8ae2f7cca428ebdb0dd38b90b9598a353b18a600bf35a369e6e3e5abb0a1c5c0c0e48e014e7ef1b7d768b3c5657f1adfbb7ff2985082b16c99eb83ec3660990dcf1106efa6b7f8a4798fec811c2c85faec0235c83b7093b3d02367421abc40a554e0b0d7fc1bcaece4222c594f8d20e368fe625ca433c75486fe5c94103cd17291349ee12b877602936688666f82ecd8f4f83d50bb1650e08b96cd25ad147c4c956c98649806a3736d072c8d97c6e3a46a7c18535df8d828b86662400d8e9cc861fa1dd5dc193892d3168396c499e07b279fb76c7e289f2fd955691363bc1de74536dc571817615c88b0d594a136966c129e424ccb7ef1c7c7461eac7ca5f03d72ea4c9c3d1156fb4cb1bb70e097357588b5c49f6716bbae1bd118104b42786f09a3b9f7cb80f383cadfd0c462096ff2d87c1f063fb48e7f08ad5af534c70079f12f28e8921abbd4280801cdf6101ea494768b1274afd0eea5939843d56022a83590920fe446d52dfe699c33977d5592dbf7e0e236b8175d7faae06e0c50f7402174023ce4b996564e945c416fa823f2f9c3213ac50b20bd1fd55bb8d9fe70ee31ea2f404ae0fcbf857bebcc9196c8c622059fea2e248e4058905b69fb98be312d3193ea1d8ff653173e8c4ad8c81d77a5bea45b3cd6fba19b6336f94ec04c8f86d24e9ca959874577d7ca0baf3c4ff30b554bc3ccc06df46d925373fbf7863e2cf684d3bc9603ab72b851ca4728294de87f2dec6f23ca9e43ed2e5cbba662d13137fc1ce0f6ae6aeb974f72f4b750825fafb67715e425f40c7da83b92d4249a0a4e96b789cceb7b07f38cb83f72dd093a345ab3cb8ae760fc14e40ea182a0d7fe1facc62a1ab0902349fd7e27bb0cd349fb5053f4734823abf020739b4b43bb11f5d69b61295068df31177959903c2ea1bb82d24eeaa93d0d475bd5d15b2a401e7ebe0d3cfbd45b2db2882cdb41408aaa718f8320fbb7f9da4f68d0eebeef175442e807e9908132731fe5e268582dcf6dffa4251ebb7121db8e412089fa9d8af9919799547a26b6b8eb44c28f1ce5f9a3021fe30841be204c1b4b3813dccae6baeef9b53fe413cbec46bb0cd95f3793cdc9bfe6cdd96ce0c4aa4a25e1cbbeeee6c9fa558b279048c7e31d07b125bac68d4e1f4253bd4dc7824cf3d722c94cf2b8f61bc8155731f072fd447082b181a13ffb8c08a1d568298c5de2d969fae2bea070a9e2688f294e76b8c200dfb993ec19778eb56ae3127c1116ccc85ef8806fdcb9ee0cb66ff03fbb0fa6c52b9b101b3830fc1650efa859163a264b4059092e5dc9a415ec09bfd1460f142fe5ef00beb6aa9032bd0de97aefc6f65e8cfeea761b3d8174caf528b6627682ff4d4450cb0f34251fc000ed01dd538ef13260984f44703b89dfb511bfb538d0b1c8aded964e1bcc5ca57437468b14a31ec0000a17e4d24369c40500449c37e7dccedba3eceb59d827dace246b5c48afb6a5988e64c560b3dc76c32d831f51cdbc5cfc4364ac8b25372b87c92bacfedc6bc8feb44098dbebc89cda03c59e4c58a31372bd574704b9e788834b9f83c6703f6709efad97c4ce499ea580dae1de282a019247cb3dce5c1906322e6d3ca5157ea6428bc42416936fac194efe136089c07faf7adf1e923003f1dc63fcbc634b389a4f351a6acee785e23c6bb04ca2f265be1e634362b87c6f9fd369bbe62a1db6b286c7ffde6370bb4d6e9e0cc3ec451e1a99d134726c9075e71319d3a683e91e4b900061c0e6d086481069cd32f4cde7816f8e3a0ac6428a7488f31f06ee0da10df3ed0c150d29085879d064f914407f60018bb588735663647bfeda930407d69abef3f72fd461c2b85b00988b412a180fd267fc646a86d297e7e40912607157b6fa873df6442579b1523d8117f0c06c87adf75843b8bff30a5bfb4fe1e9846b7fdd58774641f9cc9c4e38e53ed24a9d9e9dbc7657aa9b220a8545852b0409f5c0812e953823e841967bf55059acc7a4600818134359e72cfae0d04a0738ac8acca133d6395a455b22cdd6f901d4cdea1cf17415f7d7895a4b65f80d2f7c5c60a0dc04b40c9ae5ffc922e074a82afd704673e1766d19db9f60eab0238fb4a3169a08aded607847e5d752d4e24c4914b95bac3892bcfc2076f16a7f07583f0d418b9dec03afdb2e93335a392e1b1ef2910eb2a4b6a63fe61641f3c02bef73cd7e4a77a6f30ae821598c3160511603541bea89022b54f321c2a55cdeeb19335d78a821ab6ca0f36588a9a79a41e2123905a491d658c2a1caeee998c995bb0f816c92c5dc2b862183f80b9f9786c9c5524723c944d11f6894c7f008ab8194f577e22c03631d2a33201f508ea49653e7600639242dbaba704f700ac227f32dc575c559a0a1f4fe0cf6c22fbf7e1ca2ab4b1e4724e8379021e3c9a7c1509c6a413bd7d9c98938e440762eda2546d636597defa86c1ad31126a1182d365f858927d140fb0a97f80adcc5f4ed5efe11ac503453917a263f1d64692348d30f382e85e464ef7616067a42df5de1a1b622fabefe2ca4ceffa4801f7a02fdef40644cd1d079590d900727628d54b44db7ac700d8d664f7eea12837fcf347360d8e43a354fe51b4c49d2b800b5cc06e22c72af2a67ee7bc8ae894e841f2cf2b0a7e381caf944bf4e91ded63b6f82f7474e4f81e986fff7e5339b8e9f60103a1af81833e120f0c88893ecabac044a4a2867cda4fdcb084459a00507aa9e5a8e761a72df3322a1ae8cd918b4994c23bdb1e459b4f21651bd7fa067a00e2a2877bf6b29f289ed8018e0a78f6fb4ded9749640e0e37f6381b320ab72da404f3d70d60152f6fa6738932387b83250cb3148141edb52f109bfd4bda8054959db01f4c550609a63c08cf01ecd110cfc6f0055638c0dde039d2ac2daafe59e561f9f08a8830c3f661e4325de63e98f4a4216ec3b83fd200201ed3f647147611424286ffc6c4a8aca64a6874743242d4feeaa9153de06e51c512d9cab7ae712c6424069f3e5db4ddebe9b48b5f6caa741162edf97674d2368e03a387f798151a4b9b9fa9e3a5838a34313315836bb7291764b9a3c464c0c54a4c64ca774ad200925ac6bf59508c10a8574afde9b821741af43ec64cedc13aa220b39772195283506dfe899dd6a7b37eb21f154056a2df3564ef2bb918a928651de88c3613b84e7960bddd7b46b1304deb30f57b6fe5a3b4788629e91bcc245e748b3387f52da4bb094782326dcfde0827e2d674e41bb375247d349cade9c704e5431785009b0e53f1b45c70b237c9432e07e4c7a8464ed11608a3d2184338dd9e6f6ef4b3d751e979667b6a3953c89aff4eead7a978071a912b3de21a85a5849c57933cf53cd74a610f3e60f699766fbc7e0bb8a891a429c77bb6f3b6f9f8eb0b1bd9588ef2ce98fdf0a0838e4b0bed807d8b673093c717feec8d697e32542274887d039db7a2dbed5d52c8e9767443229f8003c5d67e907376ea2f393484fa70deee159cb56f8d097b8fe2736e95f540137e20725f0940a8d049068ead4c46bb3771a671bb00de88931e03445a55868de0c220db05cbda9f996d5fe7c1070efe5e718fed4d4cb4ecacad3d6b643bc0ffe9a71b720ba7b5adbbdefe29106ef6a6ffe4547f5d02bec312147df0abe80efb2d5e598fc7c8b268e58b59e0d75728e9a18126f013c963ddc92d251405f857fe3a5cbacf443be7772975b7bf4f6d7ed6f80dfcc47a88c6d19120942adb5385be6ef3c0d7e396bcac5affc8f9276d6cd1a0b069aed72a98cde8ea7aabe6cc091b19efcfaf9368dfeb3087a05a42e3b893dae5ffeb72e6ac06e995a2a75ea0b5f7876247bb4c38cf3f0153f1f7473b522f1c440b632270e2b1d654d3ad34ca79c8951b29c628e21029715683a3e6f8f77c5d89ecdae37e0190f79c4c1dbc9d0160e359cd6c94d6662ed53bb01a83374ff593c823acc59241b11f020902069fc0054a9b26cb320bef4fb1f8cc5bd8ae76eb029afab731b9876bc4e8708a8315512823cff1f9375d284ce66e53d4efad6c76d17bb532fc938b8f80c13ce86b5ba3e540164bc5a5d47cd321c241d8740f453ef95bd3878d578561ad6ce20877ffbd44062dce8df1d048d8d5e4045be647886108cbb1f0b26a8b74b66858afedb830a161bb02bde4c46a688a0ea3a7018ce24666aab0f422ede2f78ea29f77e28d87c744cba0285ce33dff5ac45774829699de6d725a9b6db6e7d03ad4ec9d075c386e68ca0bcd9e9911d741ed0168cbddb87a7918a964d206629da4e887277b0ef7d3f9c7082f3f15f29a0dfb39f3b0877a5ec3ac4343e0d808f5aee8f1869923aab6dfc1016821c013109f34aece6183994b853d0e9561375c02cdd26b1b55194757341929a8038864cedd6b5a3b8b51ade44637044c4ebddb190f173969a0ca4cf5d42153763a0b91da0110ae7a25204850927d81b00176d4568a3d444d8029bd010df784e3f673fe855601ec4f1b26b2df58841e6a65f0db66373f63cc14a8b07dfc52ac9957eb542d05ed687c79519609de96df18b63cb294b534ddf7d2e8f41bcc1e5a006191c4db057b6709f0a96f18e02000000be2a19c015b9c4b0b3f42e4de366b71f8da8888809473c3c7a02a1158e375f29997a43bc7118ca4d1abb8f8f21972fc589aaa3d73a4d40a1e1705e169ac6e56cff50d89fc45b6863c8fc67bb2b5939a7f33072539ba4c24077be5711ba368bf7efd4897931531d388eb5c2e56bef337777150dd59518652145c9594e110e41d2615196c6b197916c88cc2814e13a3a922b4ecb044bf31cc90e0bfe0ce07de29188bbcb0ec1a12b509f52582fbb948c3cbe0c6964f46991cec0704bfac08aec6ad8ddfc36dc68c7f547c5ee6af4a8d55c79e3dc1c49b045379811f81e9a185a92cd37ae4ee32c5d3c82d36d6202a6c84fd231fe467071d42072827fd77afa5d757e6f37247f783ef09bdfd7536b666e84bc4bb878005b7829293a04ba090272dec844f4ef0e934617c0851800c6b915ac6f3f03e4a6ab88e21c3f21f93b31d95ea3b9228e0031cb69795de5abd19c4cb4a0cf2984e53ca391cc66e33ee0d510151670331fa264753704fea5e400000f74890c49a74a47e0da13155c5470013d53dea0f05b5e088f1511c209f5be940232318af2757951d399e32eb862d915784713baa8ba93645caf04ba78fa3cf600ff92b9c5be58ad87438a340bac00a5ea9fb17e39478ba61fe36335e48d8c5a0b25f024cbd2ec7f217d0f260951da396dc13a2a74cd90df4b52db686e3b34d27cfa4cebd7bf59cbcfaf4007dc943a1da6e0bd1799a21ab449d7bb42935e50c839c5b567c59742436af15bc8d46095520dcd9273ae2b6f3c1cc2b4311ac9e5d297f0940b1552c5955adb302022022bb7457978998b56328629b7725dfbe3dedb37f37af0697a4471d1d6ff6bec633a38540adeba903f3eaaec5785fbb3c6a598f49dbd9ff93c67dea1ef39a614331b119fa8efccc8bac01595fb95a2a57eec9fc6c6fe82782aa89ea971866fd9a3bca4010182092ab6d1e2b49b964be9e3bb13bd6b77850e435f55a5d46e5bcb3330c7edefd31c33f61275e51600"}) read$FUSE(r8, &(0x7f0000000240)={0x2020}, 0x2020) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0xfffffffffffffeff, 0x9, &(0x7f0000000100)) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) 4.878130667s ago: executing program 2 (id=4820): r0 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r1 = accept(r0, 0x0, &(0x7f00000001c0)) r2 = accept$unix(r1, &(0x7f0000000080)=@abs, &(0x7f0000000100)=0x5c) connect$unix(r2, &(0x7f0000000140)=@abs={0x1, 0x0, 0x4e22}, 0x6e) pipe2$watch_queue(&(0x7f00000002c0)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) mremap(&(0x7f0000ffb000/0x4000)=nil, 0x4000, 0x3000, 0x3, &(0x7f0000ffc000/0x3000)=nil) r5 = socket$inet_udp(0x2, 0x2, 0x0) r6 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, &(0x7f0000000040)={0x4}, 0x10) write(r6, &(0x7f00000000c0)="240000001a005f0214f9f407000904ff80000000fe0200020000000008000400019e16f4", 0x24) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000040)={'gre0\x00', &(0x7f00000002c0)={'syztnl2\x00', 0x0, 0x8, 0x6, 0x0, 0x0, {{0x5, 0x4, 0x0, 0x0, 0x14, 0x1, 0x0, 0xfc, 0x2f, 0x0, @empty, @loopback}}}}) ioctl$IOC_WATCH_QUEUE_SET_SIZE(r4, 0x5760, 0x5e) r7 = geteuid() quotactl_fd$Q_GETNEXTQUOTA(r3, 0xffffffff80000900, r7, &(0x7f0000000000)) 4.644028908s ago: executing program 2 (id=4822): syz_emit_ethernet(0xfef3, &(0x7f0000000200)=ANY=[@ANYBLOB="aaaaaaaaaaaaaaaaaaaaaaaa86dd6012010000641100fe8000000000000000000000000000bbfe8000000000000000000000000000aa4e200e"], 0x0) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x8000, 0x0) readv(r0, &(0x7f00000000c0)=[{&(0x7f0000000280)=""/212, 0xd4}], 0x1) ioctl$TIOCSETD(r0, 0x5423, &(0x7f0000000040)=0xd) syz_open_dev$tty1(0xc, 0x4, 0x1) mkdir(&(0x7f0000000000)='./cgroup/../file0\x00', 0x0) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_subtree(r1, &(0x7f0000000200), 0x2, 0x0) rmdir(&(0x7f0000000240)='./cgroup/../file0\x00') lseek(r2, 0x93, 0x3) 4.458767505s ago: executing program 1 (id=4824): r0 = syz_io_uring_setup(0x17af, &(0x7f0000000380)={0x0, 0x0, 0x13290}, &(0x7f0000000300), &(0x7f0000000000)) r1 = socket$inet(0x2, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x2e, &(0x7f0000000180)=0x7b, 0x4) recvmmsg(r1, &(0x7f0000000300)=[{{0x0, 0x0, 0x0}, 0x101}], 0x1, 0x0, 0x0) r2 = epoll_create(0x4) epoll_ctl$EPOLL_CTL_ADD(r2, 0x1, r0, &(0x7f00000002c0)={0x4}) r3 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x161042, 0x0) ioctl$PPPIOCNEWUNIT(r3, 0xc004743e, &(0x7f0000000000)=0x2) r4 = syz_io_uring_setup(0x234, &(0x7f0000000580)={0x0, 0x0, 0x10100}, &(0x7f0000000000)=0x0, &(0x7f0000000100)=0x0) syz_io_uring_submit(r5, r6, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31}) io_uring_enter(r4, 0x207a98, 0x0, 0x0, 0x0, 0x0) 4.353497157s ago: executing program 5 (id=4825): r0 = socket$inet_udplite(0x2, 0x2, 0x88) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000140)={'bridge_slave_0\x00', 0x0}) r2 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000001c0)=ANY=[@ANYBLOB="280000001300290a000000001000050007000000", @ANYRES32=r1, @ANYBLOB="100000000000000008000c00"], 0x28}}, 0x0) 4.253695377s ago: executing program 2 (id=4826): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000140)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r1, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) syz_io_uring_setup(0x463d, &(0x7f0000000380)={0x0, 0x25b9, 0x100, 0x3, 0x215}, &(0x7f0000000040)=0x0, &(0x7f0000000400)) r3 = socket$inet6(0xa, 0x1, 0x0) r4 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001340)='stat\x00') bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) write$binfmt_script(0xffffffffffffffff, 0x0, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, 0xffffffffffffffff, 0x0) r5 = syz_io_uring_setup(0x4cf7, &(0x7f0000000580)={0x0, 0x8917, 0x2, 0x3, 0xbfdffffb}, &(0x7f0000000000)=0x0, &(0x7f0000000340)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) io_uring_enter(r5, 0x47f6, 0x0, 0x2, 0x0, 0x0) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x1, 0x0) read$eventfd(r4, &(0x7f0000000340), 0x8) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f0000000240)=@newlink={0x44, 0x10, 0x439, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0xd, 0x1084}, [@IFLA_LINKINFO={0x24, 0x12, 0x0, 0x1, @ip6gre={{0xb}, {0x14, 0x2, 0x0, 0x1, [@IFLA_GRE_FLAGS={0x8, 0xd, 0xb2d}, @IFLA_GRE_FLOWINFO={0x8, 0xc, 0x9e}]}}}]}, 0x44}}, 0x4100) r8 = socket(0x400000000010, 0x3, 0x0) r9 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r8, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000600)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0xf, 0xf}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8000, 0x1}}]}}]}, 0x48}}, 0x0) sendmsg$nl_route_sched(r8, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001300)=@delchain={0x24, 0x65, 0x1, 0x70bd2a, 0x25dfdbfd, {0x0, 0x0, 0x0, r10, {0x7, 0x2}, {0xd, 0xfff1}, {0xffe0}}}, 0x24}, 0x1, 0x0, 0x0, 0x8858}, 0x20004804) setsockopt$inet6_IPV6_XFRM_POLICY(r3, 0x29, 0x23, &(0x7f0000000180)={{{@in=@private, @in6=@dev, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, r10}, {}, {}, 0x0, 0x0, 0x2}, {{@in=@local, 0x0, 0x6c}, 0x0, @in6=@loopback, 0x0, 0x0, 0x0, 0x4}}, 0xe8) connect$inet6(r3, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r3, 0x84, 0x6f, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000280)='./binderfs2/binder1\x00', 0x802, 0x0) 4.150747608s ago: executing program 5 (id=4827): unshare(0x6a040000) r0 = socket(0x10, 0x803, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bind$alg(r0, 0x0, 0x0) sendmsg(r2, 0x0, 0x0) move_pages(0x0, 0x0, &(0x7f0000000040), 0x0, 0x0, 0x0) syz_usb_connect(0x0, 0x3d, &(0x7f0000000040)=ANY=[@ANYBLOB="120100004e826d4094225a4241d10102030109022b0001000000000904000002e964c200090504000000"], 0x0) keyctl$KEYCTL_MOVE(0x1e, 0x0, 0xfffffffffffffffd, 0xfffffffffffffffe, 0x1) r3 = syz_open_dev$radio(0x0, 0x0, 0x2) ioctl$VIDIOC_S_EXT_CTRLS(r3, 0xc0205648, &(0x7f0000000200)={0x4, 0x8, 0x5, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x9909da, 0x6, '\x00', @value=0x3}}) syz_open_dev$sndctrl(0x0, 0x0, 0xc0000) r4 = add_key$user(&(0x7f0000000300), &(0x7f00000001c0)={'syz', 0x0}, &(0x7f0000002300)="bc3009bb66682c9d4233b0cc644f5fdae5b9d17f7ada03bc77aea173022c18232e1fb162caf50d08fda40c6e9c515c4a2c7245660296c0460cbff563b781695432f5a83f5ab8979bf6fd1c17aaa22ada927f1feb5074053514edf5734d63b2b58e5c5b848d6fa38f7956549438addc5e72bb0cdbce326b0b3f673b017494917392", 0x81, 0xfffffffffffffffe) r5 = add_key$user(&(0x7f00000003c0), 0x0, &(0x7f00000000c0), 0x0, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r4, r5, r4}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) 3.918911754s ago: executing program 7 (id=4828): r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000180)={0x26, 'aead\x00', 0x0, 0x0, 'generic-gcm-aesni\x00'}, 0x58) readv(r0, &(0x7f0000000040)=[{&(0x7f00000000c0)=""/115, 0x73}], 0x1) syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0xb423, 0x400, 0x5, 0x199}, &(0x7f0000000340), &(0x7f0000000000)) (async) r1 = syz_io_uring_setup(0x10d, &(0x7f0000000140)={0x0, 0xb423, 0x400, 0x5, 0x199}, &(0x7f0000000340)=0x0, &(0x7f0000000000)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x40, 0x3, r0, 0x0, 0x0, 0x0, 0x80800}) io_uring_enter(r1, 0x3516, 0x3e44, 0x8, 0x0, 0x0) (async) io_uring_enter(r1, 0x3516, 0x3e44, 0x8, 0x0, 0x0) 3.433691858s ago: executing program 1 (id=4829): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x54}}, 0x0) 3.283774813s ago: executing program 1 (id=4830): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x20a00, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x1, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f00000c6000/0x18000)=nil, &(0x7f0000000040)=[@text32={0x20, 0x0}], 0x1, 0x40, 0x0, 0x0) r3 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000080), 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, r3, 0x29179000) ioctl$KVM_SET_NESTED_STATE(r2, 0x4080aebf, &(0x7f0000003680)={{0x0, 0x0, 0xfffffea8, {0xf000}}, "cb31455c9ea4288a70a2a6bb8068fd95dd041cf5b177a3bffe992dfbbdf959487337b92336ce1de32e7695c411c0bf9f852d2d71192f33001fd51f5b396a55cb98699a09d21648c4cb30d9d7e3e397c7a3c041c76c72385a46c48c5302848c3696facce956952c2a85822ddf20434ccee5806294ed563ff3a972cddf6ef16ddace933d8a5adea40cd3ad40c9873c29368838e815ff59723519154856b2d5cd9cd79a97dc2fa08dada1175817886e5f9e7aa3dca783a44c667a4806826570ec6acb57d65efc313a384e11fb633dee17ee600145f2cb3103384606140021be766fcb7fa029f0513bbb466177ca1068192550bbf4e6f5694aec747a16e27688a988fa595bca1761b8e88a7dbcaeaf97a8b7b53058b1faf880dd6f1b6eb4c7beb0582b4007f1a67db1352407adbe1456bf762c94fd825b9419d74f63cdeb6c6976de1890d773f0c8088d2bd48a838cf5b87f5ddf926352960fb978874b0f175acfa55ddfe84de3fc9f75b58bf7a35f33d3c43ed5e3224e92751fa1b43f94f64b681163ef1360a3f3bb7403afc67a188b2104b45c5814aaa9e218552498bf85f4b221d9acc32a331f5f8c109cc9f335ff4e418ab30b54b99d5376cd92ac431fc8211fcbaf64716afdc4b6d0417e04d5723e4675d282b36bef3a3a19e855029ec7c33830a6df19332b63e9d8a0f22d96ac230c67657a4e7f7afab91dc0ce751b68980e5a4f6d9d6d9b98802ba9d8576640eea61b8c308a1745df61560e56108bececa3016d93246fdc8b768634e8319b1ffde103c07378f8f4927baba05e992a4b5af0958a7e495e7ce53f7917451d15a963ca14f5cdc4563775688b6533a4b97e0f84b0a33c30077b20805c1f42cc7815efada97ad59ac486bc9e0ee386b49cb97b47fbf8f919f06c75a49636795054b5ebee3e91602c90d7f4db49220affe56d56b96e4f662b2bf36dae482ffc7ba21cbc55e21b73309d6b7aa5509defcb77c236e43b579c61eae5c8d8f8fa71ad876b96069f2e4352c8aaf16e299d21edf5434c0cd9b25cdc9210fb0de759b1dd3fc7fe4c7118bbde72a5617dff21f7a5036448fba7fe41aaee0c289cd076d757e47b0713b236f6f141ba0112c9312b3ec853aabafdf1eb2cbb517d2d7352725f557214d27d9a340af0128fc960a4ea64c933b0d8dd226b6e024471aaac8a7074b2a8695ab990fae33b6235c5b4095437298858909bcbd40a8a286d1bedb06b7b3775bce0a5bca19b0a5c2fa8dbf87b55ae0a43c5086422e5bacb94047e150451f599b9c13aade536933e14d672c21a35cb68572c3de02f3147414eff4b8674b91f7aebf35f056a8d388f67f8ef7cfaf6b28fe745831ef41def1839791647016932c70685752851327f1837d2f1e9d8f93443eefed2317119c8152ca451a5d3aeb253fb484283f52e5db9f61f059ad3c217a860ee0571d254483501b00699208c7fa5571cf58b9715c954115bc2db0af28361938bb95ced7370c8cbb6141ef62fdbf369dfc4eccd98ab9886d79a52cbf91a27dd0f4b29940492e860fb94654dea54fad6290570760e3b59a0cf28053732472dc313b5fedfc583fc702a880971dc61286370aaf167810455cce7654dc4325a41d9d1944abcdc4d81378f1e96a8f94cd95b886a01f086e379601504219d57d531ba34e1ba0905785fb629c61f6b940a652cdee9dbef12b7fcde087b92816db3386a5769049ba00788e31de4ddbb8b56de1fbe3a5e671728effda7cfd0b650cf5df2faf22470812efbbb548e47cbf36c64e05a7877820f08948ceedb35e12a4a143ee0101a7bf0a00a4062b50c39020669700adf739a6f75352a45fd1373d3e85c3867170373f0c7a794d8590f4c22ae62d438ec365b0f6a15cb2ffe0fc6f57185e1760761bd4370027c01dfad0502f00b6898115df3c530d0b0b4a64e623fd580b528a733e4c881cf5843a975a97f92a7833527887c79fa8eec82b9526a15c6c5f2972083ce8aec735810580ffa4ea2cef4823aee044dd70927f7c07bba18b930006aa86ae7399ac6b4c24bc9d6a6ab0c5b428d7255d4d983eadf97e10c1b00867da29ac981acb453073a37236e7ae808e7759b2e0cffc3ec43afb1e95cd090a7d4b9225a0e3cbebfe49b93846ab603891e2da7d85a04bf42d12d16a97c965bc4911d3ba7a9ca505794d8744fef00a436089de67aa8b480070230dfb002eb91edaff428d4908a87afae418dff7ca59aefe1ad8f6935f309fe7985c2310881659c60a66a5e50242497ba1cd5d2bd79496ccd23f9fd901afc6622829cb3701caa50f96e09e3b23bfa3181b74ec7dae2e42c9caab43e49ae1d922a1a1eb3682de026323d9215fcec42c54401a1af81450830a4b784ed1c7922734bf3632409147680dd3fabcef296353705bb5c0e650e12905a05db1e7923923a96ddc783fc1ed46e2010416c37d9d149ad73e808bd6e4464f62893024a8501803b6c88fc55c8bbc1da7cbf580b5a81fb7c61455ae3a8aaec303fba12e0f2b51ed5e8bd31db40e8bdbd00e7b1ddd317069083a5632b5cfc88a27bf82bba60c62e5f0f6af6bda3390f8e72a2811baf3d6325e70d9a3b59cab1abe95290ecb87985567e1243504c038de9d4d100ea64eec45208cd8d2474e646f7d81eed6d59b8b0859552b6fc088d874cde3e75ee30243dc9d88ed5b577851a5bd9e2a453287025777fcac19ac33e1c94b4ad272f1055b16b842a6bd6168fb45f1f74ed2467020df5431068a5f2cbeaa6ac1841308c7c9f752aa06927f91fdf18ef9d9e942367e5ecac0abf4d3b8fc7b80238c0e7faf2ea7d3f5271028fc558a44799bde63168becc67c5531e843336fb16ab618d37f95a91937b824bf896b044146bc3a5e264a8f23ddd00729cd9aa56d9a9a24b7ab96ae021b193d8874d43ff4b723d86b7564e550378599c3e0c7a2b3d447ad76eb4cd699733d970a5ab218429a1af81df9c8013d6d16a6bcb019f6ace4461cdaa785d20ea027cfa53d521bb91ad2c04aaa6c0f268b14924803977633280c7b7beb14c88fae542b7a13e96253259e7296e37276da88891c14664340e84ae732edbd71e67047e476735b220ca231de31a380ece372db632ec3cb3ef5ac97ec41148febd2acb15cde1ee5e990ea0aaa95c2df39e2111dd1185d14a194e22d34fda8f54e99d3a73e5a231682c726d40816e048c1d059bf3bb9ee2b5f895365d95aa28f6adbf6e16469926b4d8ee7f04c7dbafaa444df5b88596c17874f0efe35e5ada1a69634f4b430f852d33b032f823c5deb54f47a7a4adb1adf56d5440b7a917580004c13e0b36c8e0a203a2be3f8fffd9efef3af19389a12c67859d4381ac0a02da18e25931b41216b731de25e1245482c84d45de1cddbce2109322a3428bff692012573fe9efd02109dbf35c5d3a287dec105cf3f1a2e5f0b1cc08c7b4759766d25d0f7b42c3ea8bf8101e61159a2ba7602e9c7947cf936ac39bf59b24084709fd61d704bbdba7d282aac778b7ec1dcaf984527c8112d56e75ab774d1598d9816abc77b0e693880beca5f330c626774ab5cb6967fb0ea8e14efce120947092c3b6f8a22f07cad22e971418092481fcad36ecf0cfd6bc3864115b8507c13554584f1f6fee5ee07eb6a091638d8e7781c1c006166e0f987f9f4de535e9f3df1db8c9328e9a19a73c76059ab4edfe9eda7f16cc6b869229bafb179d194e20ccc6f9338183b673de8138ddab9a0907278f6eaacc55bf59a450ebc10e0b88c82d9f0deca86ff771f46509250fde94e0c94256b77616d099862ddc9b341838d634a9dc4b55a88fcc6248901135f6aa76365433e7e534e0e5ae8eec2a63df62c3e244a40481189ff54122698c7e2da2c829b2eec9efc9894ee05be04ae6dd48406eaace17827e38bf38b414059aded0343e0711a8d864ff41a8d9ed40fb2aa1a3f4014f691cd0e8af62445a021820ff03afa8a192ee255862f306851df1de96ce36cafb6a60b7069db7aa96fd1ffb2fb01e6247f770304dffe4b1c8d0eeb336dd6806d6ab5d418953b1cae7cbbf53766b61e4aad5cfce8255b78af26f9bd11283a9c7d12cd63b82cd2b506fd4061d1e16fc7c713d80763c3b0aa0faadcd9b7d676101aad80e1ca00369297e1f714003ab8d0b545c335014a522a25a767950963ef821425b79b521076166d0df3ef358c7d60d99cc85463c186e8faf16af79785680382e4cc93f6594f8c4461e0988c08717640df24a5f357db22432fcae21702dc792d201212fb3791e0164bb3d433a8268ec96df73766fdba42965e00e619246cba5d96eb853a7c22c34d2fe5e5d3f3ccf9c627d069517b743cd07f6f7b444074bb9a50269f2e03309c58930e56a9583eb00c37fbcdd391972261f41756c10c8899fcd036e2017e088ef9e6ec31f795d55b3bba214c53c98fc9318e4ade0e7e6fd259aa277fed54c27e5210787a5f6937f56fdbe1da5113f059061ca590ddf536a55da91ac6ed41cb9c0418b115b29f5e823c1b0ee7c2b3982087763545b34e2c945d587ebce69bbe299a7f52b674f351977370fc700474bc15d7e6ef98c14258ecf401a4f3bba1a9aa76c5ab0b8819fe6efe3fba1899909e5e48554299150ee272451b56142d12ae2bb4942db430239701d494917f2c939a6fb9d98d4751a6f2c4537ec870342d223343a9bd7b8d8c99aff8cbfa298395551185f35dec120228073a1e496a58b59d9ac5986249a7c6db9398395cbf341c08ee910700e2daa042dba1846fef59c72ce872bba2046a14fcf9a6da5686d62bfba76309a9865c26e5fa41dd872fc749fdc57953105ace4978f9eb788c8d061c853ad0313e51e732c5d7bc05e752443c8e99b8e81c688befdb5b14c3cc2f96eb8ce8290303e483992fcbece1ff278d0dc036ad437b6cbc695c7741ba4556e242146d40843c73deaf8fceba40e4a4acd739b3031848b17a210a1ff0dc1908b77c4bb94543af52e1fe2a090c8f217428d02336303f7952c3ddefa7c81850676e7f4cc3d32c3937281fa5ab279c3fe39f92ba077dadb8c2c3df17cc511bd33c41cb161d24aea154f0f5902c94b56fe072d321a983668bd9f4838878e66ec44cb233d7d0ca908a794c844ff8b3ba4c57f6c5fc2f3a54db448b013f0c4998bbc6ed0409b3368391cb28c6df4a909fff90f308ff38c758ff7d8a2920bc221236d89b3b76de44e8ce649b32f5135a0217ba9036a8edddee97d7ba15f2c21fb7d3cae3eb6ef09dd03eed650489c83b5ba5dd9daf7a86cf0544fb8a58e46b860e3e42e10cd6f1c4f81179eb2c3ba611793a32abb4c0768db90e8bdd1694efaa9c2b45c89d203fdfb8b926b6a0d666d91b93065a83184fc2065961f2308056241b66f427c0f0aabc75852c90f0624cf036d537032ca8d73325d2ae2a79a7292c240c34584bb881fe5d468a051cbc0bde061f9eddfb758cd2dfba296eef549e5c4ede097111216a0ec60f90e8d6f5dd843c82e15f505f8c74e854ba9cd386249d552978eb8135a5f8c79c3ceb8dd5828b0218ffe40f375d6cf3ff2f47c276c8169ab98336582a852c1535018fb2306aca6b8c9f9e38d64c66a722762b76c69d4ca6c14bd6992549e4eec17287fce194467f972d9200c3d1ac4fd4a8f2620e2e4281d28c099946ed90789ba122705326390d3e058ceed24044e542efb36416272eadf6304f30efa0b7bc1ae5be92fe50e591ee6f725726e917ec113506920beb2aa53b39f1d76b31500", "cfb220c7d481332f3f1f8079dfe27e23185fd67a407358db7892789f96b7fa9b14daa48617a10d8a91b820ecbaa470ec0bb1f3cbce7f70ec70b19a4cad082229c2788f8611d7dc306d9a45761a97828c36ed87ebde5d4a3e1609c1422a8ae2f7cca428ebdb0dd38b90b9598a353b18a600bf35a369e6e3e5abb0a1c5c0c0e48e014e7ef1b7d768b3c5657f1adfbb7ff2985082b16c99eb83ec3660990dcf1106efa6b7f8a4798fec811c2c85faec0235c83b7093b3d02367421abc40a554e0b0d7fc1bcaece4222c594f8d20e368fe625ca433c75486fe5c94103cd17291349ee12b877602936688666f82ecd8f4f83d50bb1650e08b96cd25ad147c4c956c98649806a3736d072c8d97c6e3a46a7c18535df8d828b86662400d8e9cc861fa1dd5dc193892d3168396c499e07b279fb76c7e289f2fd955691363bc1de74536dc571817615c88b0d594a136966c129e424ccb7ef1c7c7461eac7ca5f03d72ea4c9c3d1156ee4cb1bb70e097357588b5c49f6716bbae1bd118104b42786f09a3b9f7cb80f383cadfd0c462096ff2bb637b7cf79764b6a4b7ffc5d87c1f063fb48e7f08ad5af534c70079f12f28e8921abbd4280801cdf6101ea494768b1274afd0eea5939843d56022a83590920fe446d52dfe699c33977d5592dbf7e0e236b8175d7faae06e0c50f7402174023ce4b996564e945c416fa823f2f9c3213ac50b20bd1fd55bb8d9fe70ee31ea2f404ae0fcbf857bebcc9196c8c622059fea2e248e4058905b69fb98be312d3193ea1d8ff653173e8c2371371b77a5bea45b3cd6fba19b6336f94ec04c8f86d24e9ca959874577d7ca0baf3c4ff30b554bc3ccc06df46d925373fbf7863e2cf684d3bc9603ab72b851ca4728294de87f2dec6f23ca9e43ed2e5cbba662d13137fc1ce0f6ae6aeb974f72f4b750825fafb67715e425f40c7da83b92d4249a0a4e96b789cceb7b07f38cb83f72dd093a345ab3cb8ae760fc14e40ea182a0d7fe1facc62a1ab0902349fd7e27bb0cd349fb5053f4734823abf020739b4b43bb11f5d69b61295068df31177959903c2ea1bb82d24eeaa93d0d4738d5d15b2a401e7ebe0d3cfbd45b2db2882cdb41408aaa718f8320fbb7f9da4f68d0eebeef175442e807e9908132731fe5e268582dcf6dffa4251ebb7121db8e412089fa9d8af9919799547a26b6b8eb44c28f1ce5f9a3021fe30841be204c1b4b3813dccae6baeef9b53fe413cbec46bb0cd95d3793cdc9bfe6cdd96ce0c4aa4a25e1cbbeeee6c9fa558b279048c7e31d07b125bac68d4e1f4253bd4dc7824cf3d722c94cf2b8f61bc8155731f072fd447082b181a13ffb8c08a1d568298c5de2d969fae2bea070a9e2688f294e76b8c200dfb993ec19778eb56ae3127c1116ccc85ef8806fdcb9ee0cb66ff03fbb0fa6c52b9b101b3830fc1650efa859163a264b4059092e5dc9a415ec09bfd1460f142fe5ef00beb6aa9032bd0de97aefc6f65e8cfeea761b3d8174caf528b6627682ff4d4450cb0f34251fc000ed01dd538ef13260984f44703b89dfb511bfb538d0b1c8aded964e1bcc5ca57437468b14a31ec0000a17e4d24369c40500449c37e7dccedba3eceb59d827dace246b5c48afb6a5988e64c560b3dc76c32d831f51cdbc5cfc4364ac8b25372b87c92bacfedc6bc8feb44098dbebc89cda03c59e4c58a31372bd574704b9e788834b9f83c6703f6709efad97c4ce499ea580dae1de282a019247cb3dce5c1906322e6d3ca5157ea6428bc42416936fac194efe136089c07faf7adf1e923003f1dc63fcbc634b389a4f351a6a4ee785e23c6bb04ca2f265be1e634362b87c6f9fd369bbe62a1db6b286c7ffde6370bb4d6e9e0cc3ec451e1a99d134726c9075e71319d3a6fffffffffffffe3be6d086481069cd32f4cde7816f8e3a0ac6428a7488f31f06ee0da10df3ed0c150d29085879d064f914407f60018bb588735663647bfeda930407d69abef3f72fd461c2b85b00988b412a180fd267fc646a86d297e7e40912607157b6fa873df6442579b1523d8117f0c06c87adf75843b8bff30a5bfb4fe1e9846b7fdd58774641baf9cc9c4e38e53ed24a9d9e9dbc7657aa9b220a8545852b0409f5c0812e953823e841967bf55059acc7a4600818134359e72cfae0d04a0738ac8acca133d6395a455b22cdd6f901d4cdea1cf17415f7d7895a4b65f80d2f7c5c60a0dc04b40c9ae5ffc922e074a82afd704673e1766d19db9f60eab0238fb4a3169a08aded607847e5d752d4e24c4914b95bac3892bcfc2076f16a7f07583f0d418b9dec03afdb2e93335a392e1b1ef2910eb2a4b6a63fe61641f3c02bef73cd7e4a77a6f30ae821598c3160511603541bea89022b54f321c2a55cdeeb19335d78a821ab6ca0f36588a9a79a41e2123905a491d658c2a1caeee998c995bb0f816c92c5dc2b862183f80b9f9786c9c5524723c944d11f6894c7f008ab8194f577e22c03631d2a33205f508ea49653e7600639242dbaba704f700ac227f32dc575c559a0a1f4fe0cf6c22fbf7e1ca2ab4b1e4724e8379021e3c9a7c1509c6a413bd7d9c98938ec40762eda2546d636597defa86c1ad31126a1182d365f858927d140fb0a97f80adcc5f4ed5efe11ac503453917a263f1d64692348d30f382e85e464ef7616067a42df5de1a1b622fabefe2ca4ceffa4801f7a02fdef40644cd1d079590d900727628d54b44db7ac700d8d664f7eea12837fcf347360d8e43a354fe51b4c49e8fcda3c322b738ed2b800b5cc06e22c72af2a67ee7bc8ae894e841f2cf2b0a7e381caf944bf4e91ded63b6f82f7474e4f81e986fff7e5339b8e9f60103a1af81833e120f0c88893ecabac044a4a2867cda4fdcb084459a00507aa9e5a8e761a72df3322a1ae8cd918b4994c23bdb1e459b4f21651bd7fa067a00e2a2877bf6b29f289ed8018e0a78f6fb4ded9749640e0e37f6381b320ab72da404f3d70d60152f6fa6738932387b83250cb3148141edb52f109bfd4bda8054959db01f4c550609a63c08cf01ecd110cfc6f0055638c0dde039d2ac2daafe59e561f9f08a8830c3f661e4325de63e98f4a4216ec3b83fd200201ed3f646ffc6c4a8aca64a6874743242d4feeaa9153de06e51c512d9cab7ae712c6424069f3e5db4ddebe9b48b5f6caa741162edf97674d2368e03a387f798151a4b9b9fa9e3a5838a343133158364a9fe3bb3f9a3c464c0c54a4c64ca774ad200925ac6bf59508c10a8574afde9b821741af43ec64cedc13aa220b39772195283506dfe899dd6a7b37eb21f154056a2df3564ef2bb918a928651de88c3613b84e7960bddd7b46b1304deb30f57b6fe5a3b4788629e91bcc2456a72fabb16b47da71624d2e9081de748b3387f52da4bb094782326dcfde0827e2d674e41bb375247d349cade9c704e5431785009b0e53f1b45c70b237c9432e07e4c7a8464ed11608a3d2184338dd9e6f6ef4b3d751e979667b6a3953c89aff4eead7a978071a912b3de21a85a5849c57933cf53cd74a610f3e60f699766fbc7e0bb8a891a429c77bb6f3b6f9f8eb0b1bd9588ef2ce98fdf0a0838e4b0bed807d8b673093c717feec8d697e32542274887d039db7a2daed5d52c8e9767443229f8003c5d67e907376ea2f393484fa70deee159cb56f8d097b8fe2736e95f540137e20725f0940a8d049068ead4c46bb3771a671bb00de88931e03445a55868de0c220db05cbda9f996d5fe7c1070efe5e718fed4d4cb4ecacad3d6b643bc0ffe9a71b720ba7b5adbbdefe29106ef6a6ffe4547f5d02bec312147df0abe80efb2d5e598fc7c8b268e58b59e0d75728e9a18126f013c963ddc92d251405f857fe3a5cbacf443be7772975b7bf4f6d7ed6f80dfcc47a88c6d19120942adb5385be6ef3c0d7e396bcac5affc8f9276d6cd1a0b069aed72a98cde8ea7aabe6cc091b19efcfaf9368dfeb3087a05a42e3b893dae5ffeb72e6ac06e995a2a75ea0b5f7876247bb4c38cf3f0153f1f7473b522f1c440b632270e2b1d654d3a5ae16cb788482760d34ca79c8951b29c628e21029715683a3e6f8f77c5d89ecdae37e0190f79c4c1dbc9d0160e359cd6c94d6662ed53bb01a83374ff593c823acc59241b11f020902069fc0054a9b26cb320bef4fb1f8cc5bd8ae76eb029afab731b9876bc4e8708a8315512823cff1f9375d284ce66e53d4efad6c76d17bb532fc938b8f80c13ce86b5ba3e540164bc5a5d47cd321c241d8740f453ef95bd3878d578561ad6ce20877ffbd44062dce8df1d048d8d5e4045be647886108cbb1f0b26a8b74b66858afedb830a161bb02bde4c46a688a0ea3a7018ce24666aab0f422ede2f78ea29f77e28d87c744cba0285ce33d0d9ac45774829699de6d725a9b6db6e7d03ad4ec9d075c386e68ca0bcd9e9911d741ed0168cbddb87a7918a964d206629da4e887277b0ef7d3f9c7082f3f15f29a0dfb39f3b0877a5ec3ac4343e0d808f5aee8f1869923aab6dfc3016821c013109f34aece6183994b853d0e9561375c02cdd26b1b55194757341929a8038864cedd6b5a3b8b51ade44637044c4ebddb190f173969a0ca4cf5d42153763a0b91da0110ae7a25204850927d81b00176d4568a3d444d8029bd010df784e3f673fe855601ec4f1b26b2df58841e6a65f0db66373f63cc14a8b07dfc52ac9957eb542d05ed687c79519609de96df18b63cb294b534ddf7d2e8f41bcc1e5a006191c4db057b6709f0a96f18e7e8f67b8be2a19c015b9c4b0b3f42e4de366b71f8da8888809473c3c7a02a1158e375f29997a43bc7118ca4d1abb8f8f21972fc589aaa3d73a4d40a1e1705e169ac6e56cff50d89fc45b6863c8fc67bb2b5939a7f33072539ba4c24077be5711ba368bf7efd4897931531d388eb5c2e56bef337777150dd59518652145c9594e110e41d2615196c6b197916c88cc2814e13a3a922b4ecb044bf31cc90e0bfe0ce07de29188bbcb0ec1a12b509f52582fbb948c3cbe0c6964f46991cec0704bfac08aec6ad8ddfc36dc68c7f547c5ee6af4a8d55c79e3dc1c49b045379811f81e9a185a92cd37ae4ee32c5d3c82d36d6202a6c84fd231fe467071d42072827fd77afa5d757e6f37247f783ef09bdfd7536b666e84bc4bb878005b7829293a04ba090272dec844f4ef0e934617c08518bdc6b915ac6f3f03e4a6ab88e21c3f21f93b31d95ea3b9228e0031cb69795de5abd19c4cb4a0cf2984e53ca391cc66e33ee0d510151670331fa264753704fea5e4b1760f74890c49a74a47e0da13155c5470013d53dea0f05b5e088f1511c209f5be940232318af2757951d399e32eb862d915784713baa8ba93645caf04ba78fa3cf600ff92b9c5be58ad87438a340bac00a5ea9fb17e39478ba61fe36335e48d8c5a0b25f024cbd2ec7f217d0f260951da396dc13a2a74cd90df4b52db686e3b34d27cfa4cebd7bf59cbcfaf4007dc943a1da6e0bd1799a21ab449d7bb42935e50c839c5b567c59742436af15bc8d46095520dcd9273ae2b6f3c1cc2b4311ac9e5d297f0940b1552c5955adb302022022bb7457978998b56328629b7725dfbe3dedb37f37af0697a4471d1d6ff6bec633a38540adeba903f3eaaec5785fbb3c6a598f49dbd9ff93c67dea1ef39a614331b119fa8efccc8bac01595fb95a2a57eec9fc6c6fe82782aa89ea971866fd9a3bca4010182099b964be9e3bb13bd6b77850e435f55a5d46e5bcb3330c7edefd31c33f61275e51600"}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fe5000/0x18000)=nil, &(0x7f0000000280)=[@text32={0x20, &(0x7f0000000140)="65660fc736b9230200000f320fc5b0040000000f0f10970fe8fa640f01cfc4e21d4501c744240000000000c74424021c320000c744240600000000c4e17de69222ad2eec0fc76e04b8200fae82ef66bafc0c66b8004066ef66b8296c", 0x5c}], 0x1, 0x0, 0x0, 0x0) openat$cgroup_freezer_state(0xffffffffffffffff, &(0x7f00000000c0), 0x2, 0x0) ioctl$KVM_RUN(r2, 0xae80, 0x0) 3.173820353s ago: executing program 7 (id=4831): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000240)={0x74, 0x0, 0x7eacfa71abeb3756}) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)=[@code={0xa, 0x64, {"66420f3881710065672ef20f51f0c44115650f66baf80cb8ded1498def66bafc0c66ed66baf80cb85047828bef66bafc0c66ed660f3066baa00066edc4e245976fca66bad10466b8ba6766ef3e66660f73d196"}}], 0x64}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 2.722762395s ago: executing program 7 (id=4833): socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = openat$procfs(0xffffffffffffff9c, &(0x7f00000000c0)='/proc/keys\x00', 0x0, 0x0) read$FUSE(r0, &(0x7f0000019580)={0x2020}, 0x2020) r1 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r1, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) r2 = fanotify_init(0x200, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) ioctl$AUTOFS_IOC_EXPIRE_MULTI(r3, 0x40049366, &(0x7f0000000140)=0x4) fanotify_mark(r2, 0x1, 0x8008cff, 0xffffffffffffffff, 0x0) setsockopt$inet6_int(r1, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) madvise(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x64) io_uring_setup(0x659c, &(0x7f0000000480)={0x0, 0x8716, 0x10, 0x0, 0x57, 0x0, r0}) syz_clone(0x20100100, 0x0, 0x0, 0x0, 0x0, 0x0) openat$full(0xffffffffffffff9c, &(0x7f0000004d00), 0x82000, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r4 = openat$pidfd(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) fcntl$notify(r4, 0x402, 0x29) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='map_files\x00') getdents64(r5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r7, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r6, &(0x7f0000000440)=[{{&(0x7f0000000180)=@tipc=@id, 0x80, &(0x7f0000000280), 0x0, &(0x7f0000000380)=""/147, 0x93}, 0x59f}], 0x1, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r8 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r8, &(0x7f0000000140), 0x10) syz_io_uring_setup(0x835, &(0x7f00000000c0)={0x0, 0x679d, 0x400, 0x2000006, 0x3ce}, &(0x7f0000000040)=0x0, &(0x7f0000000140)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r9, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) 2.441694173s ago: executing program 8 (id=4834): socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="140000000012000029000000", @ANYRES64=r0], 0x108}}], 0x1, 0xc040) 2.034890806s ago: executing program 8 (id=4835): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000340), 0x302, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) ioctl$ifreq_SIOCGIFINDEX_wireguard(0xffffffffffffffff, 0x8933, 0x0) r4 = socket(0x10, 0x803, 0x0) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r4, &(0x7f0000006040)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000140)=@newtfilter={0x68, 0x2c, 0xd27, 0x70bd2a, 0x8000002, {0x0, 0x0, 0x0, r6, {0x0, 0x6}, {}, {0x7, 0xa}}, [@filter_kind_options=@f_basic={{0xa}, {0x38, 0x2, [@TCA_BASIC_EMATCHES={0x34, 0x2, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0xffff}}, @TCA_EMATCH_TREE_LIST={0x28, 0x2, 0x0, 0x1, [@TCF_EM_CMP={0x18, 0x1, 0x0, 0x0, {{0xff, 0x1, 0x8001}, {0x28, 0x6a6, 0xffff, 0x5, 0x2, 0x2}}}, @TCF_EM_CONTAINER={0xc, 0x2, 0x0, 0x0, {{0xffff, 0x0, 0x7540}}}]}]}]}}]}, 0x68}, 0x600, 0x0, 0x0, 0x24008004}, 0x0) 1.697781676s ago: executing program 7 (id=4836): r0 = bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)={0x2, 0x4, 0x8, 0x1, 0x80, 0x0, 0x20000000, '\x00', 0x0, 0x0}, 0x50) r1 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b00000000000000000000000000040000000000", @ANYBLOB="0002000000000000000a41f6ac372e0f5d00", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/14], 0x48) bpf$PROG_LOAD(0x5, &(0x7f0000000840)={0x1, 0x1c, &(0x7f0000000d80)=@ringbuf={{0x18, 0x8}, {{0x18, 0x1, 0x1, 0x0, r1}, {}, {}, {0x85, 0x0, 0x0, 0x5}}, {}, [@snprintf={{0x7, 0x0, 0xb, 0x2}, {0x3, 0x3, 0x3, 0xa, 0xa, 0xfff8, 0x2000000}, {0x5, 0x0, 0xb, 0x9, 0x0, 0x8}, {0x3, 0x3, 0x3, 0xa, 0xa}, {0x7, 0x1, 0xb, 0x7, 0x8}, {0x7, 0x0, 0x0, 0x7}, {}, {}, {}, {0x18, 0x8, 0x2, 0x0, r0}, {}, {0x46, 0x0, 0x0, 0x76}}], {{0x7, 0x1, 0xb, 0x8}, {0x5, 0x0, 0xb, 0x8}, {0x85, 0x0, 0x0, 0x7}}}, &(0x7f00000000c0)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 1.588133651s ago: executing program 2 (id=4837): r0 = syz_open_dev$vim2m(&(0x7f0000000080), 0xe2, 0x2) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) arch_prctl$ARCH_MAP_VDSO_64(0x2003, 0x1cfe) ioctl$vim2m_VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f00000001c0)={0x1, @pix={0xf8, 0x3, 0x38415262, 0x1, 0x21, 0x1, 0x8, 0x7, 0x0, 0x0, 0x0, 0x2}}) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) ioctl$BTRFS_IOC_SET_FEATURES(r0, 0x40309439, &(0x7f0000000040)={0x0, 0x3, 0x8}) sendmsg$NFT_BATCH(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000170900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}}, 0x2000c450) sendmsg$NFT_BATCH(r1, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000004c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x3}}, [@NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x5}, [@NFTA_RULE_CHAIN={0x9, 0x2, 'syz2\x00'}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_RULE_EXPRESSIONS={0x24, 0x4, 0x0, 0x1, [{0x20, 0x1, 0x0, 0x1, @osf={{0x8}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_OSF_TTL={0x5, 0x2, 0x81}, @NFTA_OSF_DREG={0x8, 0x1, 0x1, 0x0, 0xd}]}}}]}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0xe}}}, 0x78}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000840) prlimit64(0x0, 0x7, &(0x7f0000000440), 0x0) inotify_init() 1.553424826s ago: executing program 1 (id=4838): socket$netlink(0x10, 0x3, 0x0) (async) r0 = openat$autofs(0xffffffffffffff9c, &(0x7f0000001100), 0x2, 0x0) (async) r1 = syz_open_dev$tty1(0xc, 0x4, 0x3) r2 = dup(r1) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) (async) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) (async) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) (async) r5 = syz_open_dev$dri(&(0x7f00000002c0), 0x1, 0x0) syz_emit_ethernet(0x4e, &(0x7f0000000600)=ANY=[@ANYBLOB="aaaaaaaaaaaa1780d206050086dd6018232500182c00fe8000000000000000000000000000bbfe8000000000000000000000000000aa620202"], 0x0) (async) syz_emit_ethernet(0x4e, &(0x7f00000001c0)={@local, @link_local={0x17, 0x80, 0xc2, 0x6, 0x5}, @void, {@ipv6={0x86dd, @generic={0x0, 0x6, "182325", 0x18, 0x2c, 0x0, @remote, @local, {[], "b9365394fc379af00659ab39e65121dd3e8c7219b1f783b2"}}}}}, 0x0) r6 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) close(r6) ioctl$DRM_IOCTL_MODE_PAGE_FLIP(r5, 0xc01864b0, &(0x7f0000000000)={0x0, 0x0, 0x1, 0x0, 0x3a9e9908}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, 0x0) r7 = openat$sequencer(0xffffffffffffff9c, 0x0, 0x8002, 0x0) write$P9_RSTATu(r7, &(0x7f0000000780)=ANY=[@ANYBLOB="c20200007d00000005fa0000006a0000004000000000000000000000000000000010000000020000000000000000000000001f00046e6f6465767b6376666f7825ffffff8102000000000000000000000000003800704a86cec602007dfa673effeb09b5351f5bde054000000000187b8200b500003b595fcb14034354b9fd9ef196a51cd5157adc8106b494e11200fbe161e900000000000000000000f313f6005e00f8f67efb716dcf315ecaf385409ac65b9408679d2c3b9e1d52c3d6da9bf1995688dace6cde7ba4a400b4b0b4dbe64f64b1d63f26796dcbec498623d6a838c69a69dfce9cdd5906f174a666a8529a45773407dbdab2885baf050000000000b3016f6465762d6eb17b2300f9daa1ee23266ecf85fea65eb2d979a3fde5f475daf03b1172d97badc7095afd76fe4f0441f7f7741eac030000ecff0000dba0c2f7f09ff53c7e4d1ad66e2d070198019f30118447aa9a74f51685f506ae89480687bd7f3d7f298d792c4a37f2e1cbbd2482929a0d8972b5cf732ea5b0d7238501000000aed3b42ee7cac07de09d1d68a60333a882467d2b31aacdf9cf3ee3884002a91c54528b807a89ca184d16645f06188549b1125d6c4c9b18c2fb56c57d7dc626e4390796a1eb48274669ab13f8b11d146059f310e2634d593fec65d529f382066664df244e4c90570a70049f299f061f75b7797ce1e411ea918ebd888c1e156b8456931d2ea726ba9609d51a41dd3de304bd7c7ed0a456f0ae12516105c9478f7ded2dc47ec13c0f6af88ba6e5c6397c7d5021d7989528fd1739e1c2d87fff000000000000007461b0ccaaa1933a0e8a826b14d4fcb2989ffaaa1acffa8054e9559dfae4697aa00b03b3d80e5524f8495fee7e8d88cb5a040302acb0d1260f2584db48e8d9064e8ce178ce396e85b97e4886444049810f25f1ceca975deb491a125bf0d72f87cc10b0154e08936daadd8b1e9798d4ec856993d53b9038ab44fdb0223d5a11c9", @ANYRES32=0x0, @ANYRES64=r5, @ANYRES32=0x0], 0x2c2) write$UHID_INPUT(r2, &(0x7f0000002080)={0xf, {"a2e3ad21e08eeb661b5d300987f70e06d038e7ff7fc6e5539b0d650e8b089b3f313b6c090890e0878f0e1ac6e7049b3b46959b649a240d5b67f3988f7ef319520100ffe8d178708c523c921b1b5b31070d07410936cd3b78130daa61d8e8040000005802b77f07227227b7ba67e0e78657a6f5c2a874e62a9ccdc0d31a0c9f318c0da1993bd160e233df4a62179c6f30e065cd5b91cd0ae193973735b36d5b1b63dd1c00305d3f46635eb016d5b1dda98e2d749be7bd1df1fb3b231fdcdb5075a9aaa1b469c3090000000000000075271b286329d169934288fd789aa37d6e98b224fd44b65b31334ffc55cc82cd3ac32ecdb08ced6f9081b4dd0d8b38f3cd4498bee800490841bdb114f6b76383709d8f5c554336909fda039aec54a1236e80f6a8abadea7662496bddbb42be6bfb2f17959d1f416e56c71b1931870262f5e801119242ca026bfc821e7e7daf2451138e645bb80c617669314e2fbe70de98ec76a9e40dad47f36fd9f7d0d42a4b5f1185ccdcf16ff46295d8a0fa17713c5802630933a9a34af674f3f39fe23491237c08822dec110911e893d0a8c4f6777478bc360934b82910ff85bfd995083bba2987a67399eac427d145d546a40b9f6ff14ac488ec130fb3850a27af9544ae15ffffffffffffffff1243513f000000000000000a3621c56cea8d20fa911a0c41db6ebe8cac64f17679141d54b34bbc9963ac4f4bb3309603f1d4ab966203861b5b15a841f2b575a8bd0d78248ebe4d9a80002695104f674c2431dca141fae269cab70e9a66f3c3a9a63e9639e1f59c0ede26c6b5d74b078a5e15c31634e5ae098ce9ee70771aaa18119a867e14ffd9f9db2a7869d85864056526f889af43a6056080572286522449df466c632b3570243f989cce7cd9f465e41e610c20d80421d653a5520000008213b704c7fb082ff27590678ef9f190bae97909507041d860420c5664b27921b14dc1db8892fd32d0ad7bc946813591ad8deff4b05f60cea0da7710ac0000000000008000bea37ce0d0d4aa202f928f28381aab144a5dc29a04a6a2b83c7068ae949ed06e288e810bac9c76600025e19c907f6435f7590000008271a1f5f8528f227e79c1389dbdfffe492f21579d2c15b8c70cdb1c332d86d87341432750861ec2bc3451edca194b221cfec4603d276bbaa1dfa6d4fb8a48a76eafc9a9a0270e4c10d64cd5a62427264f2377fe763c43470833ac96c45f357cbbaba8f1b1fdcc7cbb61a7cdb9744ed7f9129aede2be21ccfdc4e9134f8684b3a4f354da9a795e96334e207dff70f1988037b2ed3aaf575c0b88d8f146684078416d59fdee5325928974d12dad99dac44c3f0008047096a44002bebc2420aed92fa9b6578b4779415d4ac01b75d5495c118045651cf41c2fc48b778efa5ea5677747430af4162b987b80c3e001cd34e5c92f76cc4c24eeb8bc4e9ac2aed9a53803ed0ca4ae3a9737d214060005ea6f1783e287b3bee96e3a726eafe2fdfaa78d1f48c13b64df07847754b8400daaa69bf5c8f4350aeae9ca1207e78283cd0b20ceb360c7e658828163e2d25c4aa348561f927e88f63aa70e73a5e69b3df3495903f06572e1e007fa55a2999f596d067312f5779e8dbfdcf3427138f3d444d2639a10477f9bec4b0bbb6e3c04be68981f392203dd0ee3ef478e16dacfc5e3e03cf7ab8e3902f1b0ff034ef655b253ca509383815b1b6fc6522d4e4fdc11a48cf42d48604675fde2b94cf00500a2690891abf8ab9c015073014d9e08d4338b8780bdecd436cf0541359bafffa45237f104b96210403b2de9efed496f423500c7872c827467cfa5c4e72730d56bd068ed211cf847535edecb7b373f78b095b68441a34cb51682a8ae4d24ad0465f3927f889b813076a882e8020f06c4c2ba1dd5cac7c18876da865d258734dd73583df292892448039ef799cf0630becdcce04579b5561dc825ab829827945e020c1f67ee615feb6243378e0610060f02da93aec92a5de203717aa49c2d284acfabe262fccfcbb2b75a2183c46eb65ca8104e1b4da7fbb77ab2fc043aead87c32ab875ee7c2e7b7019c982cd3b43eaeb1a5fb135c0c7dcee8fe6516a328032f88c042891824659e9e94265c803b35ee5f83a2b210520106b8a358b50ab7a1fa89af9c251fe5294b3d1802d5676d95f160ec97b1ad94872cb2044642c37b4a6cc6c04effc1672db7e4b68d787d9a7a508ae54b3cd7369dde50e8c77d95a3d361c040babb171607caac2a3559ad4f75465f49c0d0ae3716db6e00cb11db4a5fade2a57c10238e204a67737c3b42aae501b20f7694a00f16e2d0174035a2c22656dc29880acebdbe8ddbd75c2f998d8ac2dfad2ba3a504767b6b45a45957f24d758ed024b3849c11d412a2a03b4047497022d9c30e23ef4df5c89644f48bb536f7945b59d7bcddff754413d135273ea8e75f22f216c6b9990ae71806f2c00b4025c48b75c0f73cdb9a7b8fa367b50028067e7f16f4dd569d462f4f19eacdb3ed70eeebb4e8b40427db6fe29068c0ca3d2414442e8f3a154704b0e51bc664a137b26be719f4f7c9a5678a674dfc95df80b9ce375dd649c8c704e509bd88c8e63d8c7dd67071115c8982ba46af4d6adcc9f68a75b9397b035153faf46366e7205dd8d6f37525c1a0e94610dd94323f6c15d085197149bfd6655548cfd9c52c9711937f79abb1a124f1210465483cd3b2d78378cfb85ed82e7da0f6eb6d279f2ae455925d0f6f1ba571eba281f2a654fb39ddff3b484439ff158e7c5419e037f3e3ad038f2211f1033195563c7f93cd54b9094f226e783271e1e5a2a2c10712eab625d64931cd4ffe6738d97b9b5ef828ee9fb059fc01af0e79c1e14b1d25988c69a399567c1d93768f7971d31488b8658a20878b7c1dd7ba02fc42939dde3d4a3339a65d507dc59c51097b40517705da56e9ebf0afa53282bf86dbb58c548069ff6eb95aade7cc66d7bbef724779ca1f731b3346ff177050373d79ff7b3e7f9bc0c1b4b266a8878b90baaa039d3e3b63979ac3df6e6f4859afd50238c7547a39b60810938044ae185d2ba3e00a4e73676864ae090d0300000000000000b378dd4dd891e937c2ea5410e0513005000000000000003911fab964c271550027697b52160687461602f88df165d884b36ec2b6c25a2f33c715687e9d4afb96d6861aca47da73d6f3144345f48843dd014e5c5ad8fe995754bd9cf32fce1e31919c4b2082fb0a30b9deae84bed4b28045634073c9c58c89d9e99c81769177c6d594f88a4facfd4c735a20307c737afa2d60399473296b831dbd933d93994ba3064279b10ea0c5833f41f157ea2302993dbe433b1aa3a3766d5439020484f4113c4c859465c3b415c3432f81db8719539d5bf372aaaea1cc43a6c5cbe59758bfee2916580dac4b008e595f437491d87abed02cefcd9db53d94d02daee67918e5d678746383074c6bc1050000002f7809959bc048850613d17ca51055f2f416a44fe180d2d50c312cca7cb14a2bdc331f57a9817139a206fc76957227ffff2de20a4b8e3737fbb42913777c06376f799eba367e21f94ca598705f5dcb767d6f0900d6b0f6095e53c4c4234d0c1fbe434f6ab8f43c0013ee93b83946ee7759e89d7bdd1a32d7b311711b757fe43c06d21a35810d8fe98b27faea8aa12bc8716eefc5c97c45ac33eeec964c5214bc3a9359bdea1cccab94f15e36319cb34ebcacedb82c2ed3de5a8a8f0011e8f74e82d7f96093530e76692839d7961939adfdeeeaff19d11efcafb6d546fef271e89d6cc2389e81ff58cefcce3fbf4625a7e7de40e42e07b3c7340002000000000000f288a4510de03dab19d26285eda89156d50dd385a60333ba5bbf5d77cd7007ad1519ad5470de3dd6d6080cafccf8a97406bb6b68a1f0c4549820a73c880f475f732ae00398e8bd1f4108b7807fb33b72685ec37a2d3f766413a60459516246e5a1d998a2017aef0948a68cf255315ab80dd349e891aef595dc4d470e8ac32a308e15fc37d06aeac289c0523f483e1ff7408c6087f1ab652f2ef91d4f2b01987b0f46da034e5c3f745a7ee8101a3934c54e24b48ec0275e2d0687dc746b0827cbf652f406c6b95f2722e58c05f752ce2126596e1cd7655b904801784c416b22f73d324678e2724f43f1fe687c7e8a60c28b82b6528341b648cdd56fed7cdcbb1575912d5ecd36dea3bca0b7427d8392c6289455e8f8d2ab2242729251ae033a9e02210e62df0546a74b333a1c48f95fd54acb5741259e8c5488efeee327415cc19451432c6f14c27693102a3cd84857cd6586fc5ca9a93eb0145fac0662ff86107f998a8ef7df8aa14046c55b03d3d47f88a8d60f7774a2ee08758897fb411a94b3c2fc5d5f0da42c0456ec015f08e5247d33ae2d35603ff8454c16f8342856935125102bb784ed7148b6ce431b63ee356b0c785f2f47b90e29389f22fc5b59a70efaea2bd40195af4486220d702e30bfc43c10ec23ea6283994a7dde4dcb61fea6b651fb1d62458d0741a12830052fcc460db043afe525629b40d7cee458e4cb5e930ed624806c43a006e39336d07c2b8081c128ad2706f48261f7897484c297a1a6613bc18f5a38d442768af38041efe03d152ef95ff569e76db2391f4509d7f339d92fdb4a89364949da398000000000000000d80a4fe654578376e599aff3565b1d531f30912b9945030b81ea9935fd46edb44a78f615255490a4b621501f2a9e4d24624c4dac9274118c67584f5d374755534d7f68f679c4ff516a9cc8036cbd65868fcb2bf1cb9aea4e05df72279fdb0d2b9e935c5af3cf474bed79dfc248c1f5aea4b8b32c5d295e57079d0fe662a46b7f71cd47744db86c50b704c971d90295c7b2c7439a2d78ccfa79b5fc2bff6bbf840262bf89394b3e0691953264d2700c838fa2c7b3425260f59554e502dcea39cb313b0000000000004ca7c12f45858d6284ca6270d6b2f0e58fded8a7b4a302a97bc641df07720ba2b26bbfcc807ca0abb1b44322269c21c5ec68cb068ea88067d905ea917bb03eefdaebdeabf2d0dce80997c915c8949de992587c2cb5fe36d7d3e5db21b094b8b77940b5f07722e47a08d367e5f84c96ec664b72934b99b3109af65d77e86abd6859cddf4bbae1f0930462df15fddbc48562ea3511a8065ef028cf12f14dcf6ebecd8d884836174faf1aa609e5f1ee1162dfa13bdc1fa7cfaadba85c72e9758f03a755d0be53f8d2a1dfb1c68cc164b0a0780d971a96ea2c4d4ca0398c2235980a9307b3d5bd3b01faffd0a5dbed2881a9700af561ac8c6b00000000000000f96f06817fb903729a7db6ff957697c9ede7885d94ffb0969be0daf60af93109eb1dee72e4363f51af62af6fb2a6df3bec89822a7a0b678058fa3fef86faec216eb6992162f8dcbf719c148cd2f9c55f4901203a9a8a2c3e90f3943dbc10360a1a49700d1dfbf66d69f6fbaf506c8bcce8bb0d872a02238926407a4eddd5d0fc5a752f90000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000400", 0x1000}}, 0x1006) (async) r8 = socket(0x11, 0xa, 0x0) write$vga_arbiter(0xffffffffffffffff, &(0x7f0000000000)=@unlock_all, 0x7) (async) sendmsg$can_bcm(r8, &(0x7f00000000c0)={&(0x7f0000000000), 0x10, &(0x7f0000000080)={0x0}, 0x8, 0x0, 0x0, 0x44080}, 0x20044084) (async) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x3, 0x6, &(0x7f0000006680)) r9 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r9, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x64, 0x3e, 0x107, 0x0, 0x25dfdbfc, {0x4, 0x7c}, [@typed={0x4}, @nested={0x49, 0x1, 0x0, 0x1, [@generic="b409bec974eae7a1654953fb762ce46e90514954d944afe69940e676be9538294b718d7f78620e70cbb0ea92a3adc6184ee3ace22cb25b278b377971be88ddf8ea278290ce"]}]}, 0x64}}, 0x0) (async) readahead(0xffffffffffffffff, 0x8, 0x9) (async) ioctl$AUTOFS_DEV_IOCTL_VERSION(r0, 0xc0189371, &(0x7f00000001c0)={{0x1, 0x1, 0x36}, './file0\x00'}) (async) mmap(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x2000008, 0x7b345e05922a0178, 0xffffffffffffffff, 0x1dd1c000) (async) socket$inet(0x2, 0x4000000000000001, 0x0) 1.381105453s ago: executing program 7 (id=4839): socket$netlink(0x10, 0x3, 0x0) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) bpf$BPF_PROG_DETACH(0x8, &(0x7f0000000740)=ANY=[@ANYRES32, @ANYRES32, @ANYRES64=r0], 0x20) 1.309764584s ago: executing program 8 (id=4840): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x54}}, 0x0) 1.183292411s ago: executing program 7 (id=4841): fsopen(&(0x7f0000000000)='cifs\x00', 0x0) syz_usb_connect(0x0, 0x24, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_control_io$cdc_ncm(0xffffffffffffffff, 0x0, 0x0) r2 = syz_io_uring_setup(0xcaf, &(0x7f0000000100)={0x0, 0xb601, 0x1, 0x5, 0x17a}, &(0x7f0000000240)=0x0, &(0x7f00000000c0)=0x0) r5 = add_key(&(0x7f0000000700)='encrypted\x00', 0x0, 0x0, 0x0, 0xfffffffffffffff9) add_key$user(&(0x7f0000000780), &(0x7f0000000580)={'syz', 0x3}, &(0x7f0000000600)="533b84994c4f5e3fcf17cba4cee05d8251566b37179b25568f3bc4899e8fe4d0defe4c27f31094f7c29ebca7320d7d04cb096c18ba4ee0a511b00cbdaf8e3e0547c4d4148be9a115226a88d18d175f330a29d3c17606ddd3c9651b23fc97af3565bfabd58647f68cdefb68a270b242a43fa3f769b90b4344b829b12acd44f4885199393050700410d2c9f6eeb0f98e21db580c93fbe365e6452a99f7b16e048c77c285081971f122b988e22b78f7274e7071b381f36b2f28b5af719deefc317a0838f49ff90dac7b79a47d3ee077d817e32d91214aac2d0fd17b0f258e86675645da1354c082387de8abdef5bc835078dc29", 0xf2, r5) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0xc000000, &(0x7f00000001c0)=[{&(0x7f0000001600)=""/4096, 0x1000}], 0x1, 0x1e}) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0x25dfdbfd, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) sendmsg$nl_route_sched(r7, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000001300)=@newtfilter={0x88c, 0x2c, 0xd27, 0x70bd28, 0x8000, {0x0, 0x0, 0x0, r9, {0x9, 0xffe0}, {}, {0xa, 0xfff3}}, [@filter_kind_options=@f_bpf={{0x8}, {0x860, 0x2, [@TCA_BPF_FD={0x8, 0x6, r6}, @TCA_BPF_OPS={{0x6}, {0x4}}, @TCA_BPF_POLICE={0x848, 0x2, [@TCA_POLICE_RATE={0x404, 0x2, [0xb, 0x7, 0x4, 0x8, 0x5, 0x1, 0x0, 0xc0, 0x6, 0x101, 0x920, 0x7, 0x3, 0x2, 0x2c9d, 0x6, 0x26, 0x2, 0x10, 0xffffffa0, 0x7d0, 0xffff, 0x10000, 0x3, 0x3, 0xfffffff9, 0xe5, 0x3, 0x8, 0x3, 0x3, 0x9, 0x1, 0xfffffff9, 0x22, 0x2, 0x1, 0x2, 0x0, 0x0, 0xea3, 0x1, 0x0, 0x4, 0x91, 0x4, 0x3, 0x5, 0x7, 0x4, 0x7f, 0x6, 0xd9a, 0xc, 0xb, 0x100, 0xed7, 0x8, 0xad4, 0x15, 0x9, 0xfffffff5, 0x31, 0x7, 0x1, 0x3, 0x8, 0x17028692, 0x3, 0x4, 0x7f, 0x4, 0xfe, 0x5, 0xffff, 0x3f, 0x6, 0x5, 0xdf, 0xec, 0x9, 0x7, 0xb, 0x7ff, 0x3fb3c724, 0x7, 0x7, 0x8, 0x6, 0x7fff, 0x8, 0x6, 0x2, 0x3, 0x5, 0x5, 0x1, 0x10, 0x3, 0x97, 0x1, 0x0, 0x1, 0x5b5b, 0x9, 0x8, 0x9, 0x2000, 0x4ce, 0x8, 0xfff, 0x6, 0x8db3, 0x9, 0x6, 0x279, 0x6, 0x6, 0xffff, 0x0, 0x3, 0x4, 0x4, 0xfff, 0x5, 0x2, 0x800, 0xffff, 0x4, 0x0, 0x7, 0x10000, 0x8000, 0x6, 0xad9b, 0x7, 0x0, 0x3ff, 0x7, 0x8, 0x1, 0x1, 0x7, 0xd6e4, 0x4, 0x533, 0x9, 0x276, 0x7, 0xff, 0x4, 0x2, 0x1166, 0xfffffffa, 0x3, 0xb20e, 0xe8, 0x4, 0x7f4, 0x7, 0x1, 0xfff, 0x3, 0x8001, 0x4, 0x3, 0x4, 0x7, 0x8, 0xca2, 0xc0000000, 0x1000, 0x3, 0x2, 0x9, 0x18, 0xc6, 0x7, 0x7, 0x4, 0x80000000, 0x0, 0x7, 0xb68, 0x7ab, 0x52, 0x3, 0x80, 0x9, 0x2da, 0x5, 0x9, 0x7fff, 0x2, 0xd5916ed, 0x9, 0xb8, 0x6, 0x5, 0x9, 0x2cc, 0x0, 0x2, 0xb7, 0x3, 0xb6b6, 0x0, 0x4, 0x9, 0x5, 0x2, 0x0, 0x4, 0xfce2, 0x8, 0xc, 0x3f5c, 0x100, 0xdb03, 0xfffffff9, 0x4, 0xf84, 0x6, 0xd7d2, 0xffffffff, 0xf300, 0x9a84, 0x8, 0x516, 0x3, 0x3, 0x8, 0x2, 0x1000, 0xffffffff, 0x3, 0x6, 0x200, 0xfffffffc, 0x6, 0x7fff, 0x8, 0x6, 0x8001, 0x8, 0x4, 0x5, 0x8, 0x1, 0xcdb9, 0x70, 0xf1, 0x10, 0x6, 0x93d5eea, 0x2]}, @TCA_POLICE_PEAKRATE={0x404, 0x3, [0x0, 0x5, 0xb, 0x7, 0x5, 0x101, 0x8000, 0x80000000, 0x5, 0x10, 0xffffffff, 0x7, 0x7fffffff, 0xffffffff, 0x4, 0x3ff, 0x8, 0x693d24ac, 0x9, 0x5, 0x7b, 0x9, 0x2, 0xe9, 0x14b, 0x3, 0x40, 0x8d, 0x1, 0x6, 0x101, 0xfff, 0x9, 0x7, 0x6, 0x10000, 0x8, 0x8001, 0x10c4, 0x3, 0x205, 0x9, 0x8, 0x60b, 0xd, 0xffff, 0x4, 0x1, 0xe, 0x1, 0x9, 0xffff, 0x8, 0x5, 0x0, 0x9, 0x5, 0x8, 0xfffffff9, 0x401, 0xd, 0x800, 0x4, 0x6, 0x3, 0x9, 0x3ff, 0x10, 0x8, 0x80000000, 0x6, 0x2afa, 0xffffffff, 0x6, 0x2, 0x3ff, 0x0, 0xd, 0x2, 0x6, 0x8, 0x2, 0x2000000, 0x7, 0x6, 0x7, 0x3, 0x7, 0x8, 0x8, 0x6, 0x5, 0x7fff, 0x3, 0x1200, 0x9, 0xbc, 0x1, 0x8001, 0x9, 0xf, 0x5, 0x2, 0x3192212c, 0x3, 0x1, 0x3, 0x1000, 0x0, 0x9, 0x8000, 0xfffffff8, 0x3dae, 0x80, 0x5, 0x9, 0x9, 0x7, 0x698, 0x1, 0x7, 0x7f, 0x6, 0x401, 0x5, 0x7, 0x7fffffff, 0x7, 0x10001, 0xffffffe3, 0x7ff, 0x4, 0x10, 0x7, 0x1, 0x7, 0x9, 0x1ff, 0x7, 0xc5dd, 0x2, 0x7, 0x80, 0x3, 0xa, 0xff, 0x9, 0x6, 0x1, 0xd, 0x45, 0x10000, 0x553, 0x800, 0x0, 0x3, 0x4, 0x1b, 0xb, 0x1, 0x8, 0x59, 0x200, 0x1, 0x6, 0x5, 0xd, 0x8001, 0x5c34a762, 0x4, 0x9, 0x3, 0xf, 0x0, 0x9, 0x3, 0x40, 0xf9, 0xfffffff8, 0x2d1f, 0x0, 0x6, 0x3, 0x80002001, 0x4, 0x40, 0x0, 0xffffffff, 0x80000000, 0x9, 0x8, 0x7, 0xfffffff1, 0x5, 0x7f, 0x9, 0x81, 0x9, 0xeb5e, 0x4, 0x6, 0x2, 0x3, 0xf9d, 0xf, 0xce, 0xea5, 0x6, 0x4, 0x6, 0x400, 0x2, 0x300, 0x15, 0x8, 0x2, 0x6, 0x3, 0x9, 0x800, 0xa, 0x1fd, 0x6, 0x442b89e0, 0x3, 0x0, 0x35b4, 0x10001, 0x3, 0x10001, 0x5, 0x9, 0x4, 0xf, 0x6, 0x7, 0x0, 0x7, 0x0, 0x8ba2, 0x8, 0x2, 0x10001, 0x8, 0x9, 0x6, 0x7fffffff, 0x1, 0x3, 0x6, 0xbd3, 0x9, 0x7fffffff, 0x7, 0xffffd4a4, 0x5]}, @TCA_POLICE_TBF={0x3c, 0x1, {0x8001, 0x6, 0xbc, 0x7fffffff, 0x12b0abb7, {0xe, 0x0, 0x3, 0x9, 0x40, 0xfffffffb}, {0x1, 0x2, 0xfff7, 0x101, 0x8000, 0x3}, 0x8, 0x9}}]}]}}]}, 0x88c}, 0x1, 0x0, 0x0, 0x22044028}, 0x0) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r10 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r10, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') getcwd(&(0x7f0000000440)=""/211, 0xd3) fcntl$setlease(0xffffffffffffffff, 0x400, 0x1) io_uring_enter(r2, 0x847ba, 0x20000000, 0xe, 0x0, 0x0) r11 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r11, 0x8933, 0x0) 894.728818ms ago: executing program 2 (id=4842): r0 = openat$dir(0xffffffffffffff9c, &(0x7f0000000280)='.\x00', 0x8000, 0x1f7) r1 = fanotify_init(0x200, 0x0) fanotify_mark(r1, 0x201, 0x4800003e, r0, 0x0) fanotify_mark(r1, 0x21, 0x9, r0, 0x0) r2 = io_uring_setup(0x6259, &(0x7f0000000000)={0x0, 0x7d56, 0x4000, 0x1, 0x296}) mmap(&(0x7f0000ffe000/0x1000)=nil, 0x1000, 0x2, 0x110, r0, 0x46ac3000) r3 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r3, 0x8933, &(0x7f0000000000)={'vxcan0\x00', 0x0}) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r5, 0x10e, 0xc, &(0x7f0000000140)={0x4}, 0x10) write(r5, &(0x7f0000000a00)="1c0000001a005f0214f9f407000904001f000000ff02000200020000", 0x1c) connect$can_bcm(r3, &(0x7f0000000180)={0x1d, r4}, 0x10) sendmsg$can_bcm(r3, &(0x7f00000004c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000500)=ANY=[@ANYBLOB="050000000300000000000000", @ANYRES64=0x0, @ANYBLOB="0000000001"], 0x48}}, 0x0) r6 = socket(0x18, 0x800, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000100)={0x1c, 0x2, 0x3, 0x101, 0x0, 0x0, {0x4, 0x0, 0x200a}, [@NFQA_CFG_CMD={0x8, 0x1, {0x1, 0x0, 0x11}}]}, 0x1c}}, 0x2404c010) sendmsg$NFQNL_MSG_CONFIG(r7, &(0x7f0000001080)={0x0, 0x0, &(0x7f0000001040)={&(0x7f0000000200)=ANY=[@ANYBLOB="1c0000000203010100000000000000000300000a0800010001"], 0x1c}, 0x1, 0x0, 0x0, 0x40841}, 0x2000c010) r8 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r8, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="4000000010000108fdffffff0000000800000000", @ANYRES32=0x0, @ANYBLOB="000000002104020008001b"], 0x40}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) connect$pppoe(r6, &(0x7f0000000100)={0x18, 0x0, {0x2, @multicast, 'vcan0\x00'}}, 0x1e) sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000040)={0x28, 0x0, 0x0, 0x70bd2d, 0x25dfdbff, {{}, {@val={0x8}, @val={0xc, 0x99, {0x8, 0x42}}}}}, 0x28}, 0x1, 0x0, 0x0, 0x20000015}, 0x4) read(r3, &(0x7f0000001480)=""/4096, 0x1000) syz_io_uring_setup(0xd91, &(0x7f0000000080)={0x0, 0xe192, 0x1000, 0x1, 0x108, 0x0, r2}, &(0x7f0000000100), &(0x7f0000000140)) 878.602186ms ago: executing program 8 (id=4843): r0 = openat$kvm(0x0, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_DISABLE_QUIRKS(r1, 0x4068aea3, &(0x7f0000000240)={0x74, 0x0, 0x7eacfa71abeb3756}) syz_kvm_setup_syzos_vm$x86(r1, &(0x7f0000c00000/0x400000)=nil) r2 = syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000040)={0x0, &(0x7f0000000180)=[@code={0xa, 0x64, {"66420f3881710065672ef20f51f0c44115650f66baf80cb8ded1498def66bafc0c66ed66baf80cb85047828bef66bafc0c66ed660f3066baa00066edc4e245976fca66bad10466b8ba6766ef3e66660f73d196"}}], 0x64}) ioctl$KVM_RUN(r2, 0xae80, 0x0) 337.685439ms ago: executing program 5 (id=4844): r0 = syz_usb_connect(0x0, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000994bd740f60d5600b5a0000000010902120001000000000904"], 0x0) syz_usb_control_io$printer(r0, 0x0, &(0x7f00000005c0)={0x34, &(0x7f00000000c0)=ANY=[@ANYBLOB='\x00\x00?'], 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) r2 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x1, 0x0) writev(r2, &(0x7f0000000080)=[{&(0x7f00000000c0)="5bffd08307d80c79b1cb7b5f0c5b4d719c69c8513f748fbe425a7bc388c9019bef114779f7a10dc03a883d6e16a0a704f74297f381ff1db75098a9b38bb67206a7ff22e6ca46dc760bdad8a79d5951988c55a368dd1132ba7f129c2e65441eaa27492c069488df0881f123ca01ae873f5b36eb0fddb8f07420f5484d81cabde167c87ffbab6a94b24b5537bb1a08d56469f516fd4b7c66e2ac50d5ff4e52c628d0a89e53d0e78582a5ab2a2c714f66", 0xfe7c}], 0x1) ioctl$BLKZEROOUT(r2, 0x127f, &(0x7f0000000240)={0x2000, 0x1000000}) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in6=@mcast1, @in6=@empty, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x20, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x6, 0x0, 0x10000, 0xffffffffffffffff, 0xffffffffffff8001, 0xfffffffbfffffffe}, {0x0, 0x4}, 0x0, 0x0, 0x0, 0x1, 0x3}, {{@in=@local, 0x4d2, 0x32}, 0x0, @in=@multicast1, 0x0, 0x0, 0x0, 0xb7, 0x2}}, 0xe8) sendmmsg(r1, &(0x7f0000007fc0), 0x800001d, 0x1c) 193.002538ms ago: executing program 8 (id=4845): socket$inet_udp(0x2, 0x2, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) r0 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r0, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x9}, 0x20) setsockopt$inet6_int(r0, 0x29, 0x1000000000021, &(0x7f0000000000)=0xffffffc3, 0x4) sendmmsg(r0, &(0x7f0000001500)=[{{&(0x7f0000000040)=@l2tp6={0xa, 0x0, 0x7080000, @ipv4={'\x00', '\xff\xff', @loopback}, 0x7, 0x1}, 0x80, 0x0, 0x0, &(0x7f0000000100)=ANY=[@ANYBLOB="140000120000000029000000", @ANYRES64=r0], 0x108}}], 0x1, 0xc040) 0s ago: executing program 8 (id=4846): sendmsg$can_bcm(0xffffffffffffffff, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000400)={0x0, 0x38}}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa14, 0xffffffff}, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000000), 0x0, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(r3, 0xc02064b2, &(0x7f0000000200)={0xa2, 0x6576, 0xd}) mmap(&(0x7f0000001000/0x4000)=nil, 0x4000, 0x4, 0x11, r3, 0x100000000) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000340), 0x327681, 0x0) setsockopt$inet6_group_source_req(0xffffffffffffffff, 0x29, 0x2c, &(0x7f0000000080)={0x20, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @remote}}}, 0x108) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) r4 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) ioctl$USBDEVFS_REAPURBNDELAY(r4, 0x4004550c, 0x0) socket$inet6_tcp(0xa, 0x1, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000017c0)={0x1, 0xe, &(0x7f0000000200)=ANY=[], &(0x7f00000001c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0xffffffff}, 0x10}, 0x94) r5 = socket$packet(0x11, 0x2, 0x300) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000240)) dup(r5) sendfile(r6, 0xffffffffffffffff, &(0x7f0000000300)=0x5, 0x7fffffff) ioctl$UFFDIO_REGISTER(0xffffffffffffffff, 0xc020aa00, &(0x7f0000000240)={{&(0x7f0000400000/0x1000)=nil, 0x20400000}, 0x1}) r7 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r7, &(0x7f0000000240)=[{&(0x7f0000033a80)=""/102386, 0xfffffd6e}], 0x1, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) kernel console output (not intermixed with test programs): sb 3-1: USB disconnect, device number 114 [ 1534.875033][T23863] loop5: detected capacity change from 0 to 7 [ 1534.893524][T23863] Dev loop5: unable to read RDB block 7 [ 1534.925372][T23863] loop5: unable to read partition table [ 1534.934943][T23863] loop5: partition table beyond EOD, truncated [ 1534.959378][T23863] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1535.022696][ T5233] Dev loop5: unable to read RDB block 7 [ 1535.038042][ T5233] loop5: unable to read partition table [ 1535.050574][T23837] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 1535.055681][ T5233] loop5: partition table beyond EOD, truncated [ 1535.088786][T23837] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 1535.126454][T23837] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 1535.155595][T23837] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 1535.340930][T23837] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1535.440041][T23837] 8021q: adding VLAN 0 to HW filter on device team0 [ 1535.464534][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 1535.471692][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1535.501512][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 1535.508677][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1535.647222][T23860] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1535.653786][T23860] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1535.668390][T23860] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1535.680111][T23837] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1535.704704][T23860] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1535.763883][T23860] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1535.845350][T23860] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 1535.935718][T23860] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1535.941951][T23860] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1535.964077][T23837] veth0_vlan: entered promiscuous mode [ 1535.991624][T23837] veth1_vlan: entered promiscuous mode [ 1535.995651][T23860] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 1536.072065][T23837] veth0_macvtap: entered promiscuous mode [ 1536.093801][T23837] veth1_macvtap: entered promiscuous mode [ 1536.149950][T23837] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1536.173074][T23860] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1536.183469][T23860] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1536.192528][T23860] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1536.236168][T23837] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1536.251702][ T44] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1536.372277][ T44] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1536.437348][ T885] usb 3-1: new high-speed USB device number 115 using dummy_hcd [ 1536.464710][T16560] usb 7-1: new high-speed USB device number 89 using dummy_hcd [ 1536.489718][ T44] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1536.569992][ T44] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1536.605274][ T885] usb 3-1: device descriptor read/64, error -71 [ 1536.658769][T16560] usb 7-1: Using ep0 maxpacket: 8 [ 1536.669452][T16560] usb 7-1: config 0 has an invalid interface number: 186 but max is 0 [ 1536.788716][T16560] usb 7-1: config 0 has no interface number 0 [ 1536.854127][T23895] netlink: 'syz.1.4379': attribute type 4 has an invalid length. [ 1536.868940][T16560] usb 7-1: config 0 interface 186 altsetting 0 has an endpoint descriptor with address 0x9A, changing to 0x8A [ 1536.884893][ T885] usb 3-1: new high-speed USB device number 116 using dummy_hcd [ 1536.910731][T16560] usb 7-1: config 0 interface 186 altsetting 0 endpoint 0x8A has an invalid bInterval 0, changing to 7 [ 1536.975565][T16101] Bluetooth: hci1: command 0x0405 tx timeout [ 1537.008568][ T13] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1537.047865][ T885] usb 3-1: device descriptor read/64, error -71 [ 1537.068736][T16560] usb 7-1: New USB device found, idVendor=07c0, idProduct=1500, bcdDevice=b8.c5 [ 1537.104929][ T13] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1537.164223][T16560] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1537.175360][ T885] usb usb3-port1: attempt power cycle [ 1537.226615][ T7808] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1537.254922][ T7808] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1537.320970][T16560] usb 7-1: Product: syz [ 1537.433120][T16560] usb 7-1: Manufacturer: syz [ 1537.485229][T23900] netlink: 16 bytes leftover after parsing attributes in process `syz.1.4381'. [ 1537.515661][ T885] usb 3-1: new high-speed USB device number 117 using dummy_hcd [ 1537.526286][T16560] usb 7-1: SerialNumber: syz [ 1537.548017][ T885] usb 3-1: device descriptor read/8, error -71 [ 1537.569015][T16560] usb 7-1: config 0 descriptor?? [ 1537.697410][T16101] Bluetooth: hci2: command 0x0405 tx timeout [ 1537.775213][T16101] Bluetooth: hci4: command 0x0406 tx timeout [ 1537.795189][ T885] usb 3-1: new high-speed USB device number 118 using dummy_hcd [ 1537.827001][ T885] usb 3-1: device descriptor read/8, error -71 [ 1537.954345][ T885] usb usb3-port1: unable to enumerate USB device [ 1538.015312][T16101] Bluetooth: hci5: command 0x0405 tx timeout [ 1538.126067][T16560] iowarrior 7-1:0.186: IOWarrior product=0x1500, serial= interface=186 now attached to iowarrior1 [ 1538.175509][T16101] Bluetooth: hci0: command 0x040f tx timeout [ 1538.265575][T16560] usb 7-1: USB disconnect, device number 89 [ 1538.392856][T23916] kvm: kvm [23915]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc1) = 0x800 [ 1538.484212][T23916] kvm: kvm [23915]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x11e) = 0x0 [ 1538.593136][T23916] kvm: kvm [23915]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0x187) = 0x800 [ 1539.141937][T16101] Bluetooth: hci1: command 0x0405 tx timeout [ 1539.766567][T23933] gtp3: entered promiscuous mode [ 1539.774831][T10105] Bluetooth: hci2: command 0x0405 tx timeout [ 1539.780909][T23933] gtp3: entered allmulticast mode [ 1539.901254][T10105] Bluetooth: hci4: command 0x0406 tx timeout [ 1540.095595][T10105] Bluetooth: hci5: command 0x0405 tx timeout [ 1540.254813][T10105] Bluetooth: hci0: command 0x040f tx timeout [ 1540.803201][T23947] netlink: 'syz.1.4393': attribute type 8 has an invalid length. [ 1541.147780][T21213] usb 3-1: new high-speed USB device number 119 using dummy_hcd [ 1541.340110][T21213] usb 3-1: Using ep0 maxpacket: 16 [ 1541.374728][T23953] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1541.386198][T21213] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1541.393901][T23953] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1541.444895][T21213] usb 3-1: config 0 has no interfaces? [ 1541.500211][T21213] usb 3-1: New USB device found, idVendor=045e, idProduct=05da, bcdDevice= 0.00 [ 1541.579170][T21213] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1541.607173][T21213] usb 3-1: config 0 descriptor?? [ 1542.169199][T23959] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1542.177770][T10105] Bluetooth: hci5: command 0x0405 tx timeout [ 1542.178359][T23959] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1542.314658][T16560] usb 7-1: new high-speed USB device number 90 using dummy_hcd [ 1542.335252][T10105] Bluetooth: hci0: command 0x040f tx timeout [ 1542.566886][T16560] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1542.593261][T16560] usb 7-1: New USB device found, idVendor=0471, idProduct=0304, bcdDevice=e4.df [ 1542.686619][T16560] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1542.796321][T16560] usb 7-1: config 0 descriptor?? [ 1542.898870][T16560] pwc: Askey VC010 type 2 USB webcam detected. [ 1543.283351][T16560] pwc: recv_control_msg error -32 req 02 val 2b00 [ 1543.444793][T16560] pwc: recv_control_msg error -32 req 02 val 2700 [ 1543.462961][T16560] pwc: recv_control_msg error -32 req 02 val 2c00 [ 1543.496551][T16560] pwc: recv_control_msg error -32 req 04 val 1000 [ 1543.518613][T16560] pwc: recv_control_msg error -32 req 04 val 1300 [ 1543.547374][T16560] pwc: recv_control_msg error -32 req 04 val 1400 [ 1543.591422][T16560] pwc: recv_control_msg error -32 req 02 val 2000 [ 1543.618770][T16560] pwc: recv_control_msg error -32 req 02 val 2100 [ 1543.655547][T16560] pwc: recv_control_msg error -32 req 04 val 1500 [ 1543.938682][T16560] pwc: recv_control_msg error -32 req 02 val 2400 [ 1543.994906][T16560] pwc: recv_control_msg error -32 req 02 val 2600 [ 1544.055446][T16560] pwc: recv_control_msg error -32 req 02 val 2900 [ 1544.075101][T16560] pwc: recv_control_msg error -32 req 02 val 2800 [ 1544.104778][T16560] pwc: recv_control_msg error -32 req 04 val 1100 [ 1544.142403][T16560] pwc: Registered as video103. [ 1544.194765][T16560] input: PWC snapshot button as /devices/platform/dummy_hcd.6/usb7/7-1/input/input116 [ 1544.335747][T23957] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1544.367498][T23957] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1544.400742][ T24] usb 7-1: USB disconnect, device number 90 [ 1544.415107][T16101] Bluetooth: hci0: command 0x040f tx timeout [ 1544.687316][T23978] loop5: detected capacity change from 0 to 7 [ 1544.729013][T23837] Dev loop5: unable to read RDB block 7 [ 1544.736674][T23837] loop5: unable to read partition table [ 1544.742530][T23837] loop5: partition table beyond EOD, truncated [ 1544.759297][T23978] Dev loop5: unable to read RDB block 7 [ 1544.794418][T23978] loop5: unable to read partition table [ 1544.810395][T23978] loop5: partition table beyond EOD, truncated [ 1544.819776][T23978] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1545.100013][T23983] gtp0: entered promiscuous mode [ 1545.117328][T23983] gtp0: entered allmulticast mode [ 1545.143186][T23985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1545.155378][T23985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1545.180748][T23985] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1545.190870][ T24] usb 6-1: new high-speed USB device number 68 using dummy_hcd [ 1545.235249][T23985] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1545.280633][ T885] usb 3-1: USB disconnect, device number 119 [ 1545.384949][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 1545.409105][ T24] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1545.452277][ T24] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1545.494985][ T24] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1545.511143][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1545.520490][ T24] usb 6-1: Product: syz [ 1545.530547][ T24] usb 6-1: Manufacturer: syz [ 1545.556483][ T24] usb 6-1: SerialNumber: syz [ 1545.571904][T23985] sctp: [Deprecated]: syz.1.4406 (pid 23985) Use of int in maxseg socket option. [ 1545.571904][T23985] Use struct sctp_assoc_value instead [ 1545.596397][ T24] usb 6-1: config 0 descriptor?? [ 1545.629425][ T24] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1545.665069][ T24] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 1545.939669][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1545.946181][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1546.214205][ T24] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 1546.222696][ T24] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 1546.315177][T21213] usb 7-1: new high-speed USB device number 91 using dummy_hcd [ 1546.478025][T21213] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1546.488315][T21213] usb 7-1: config 63 has an invalid interface number: 66 but max is 0 [ 1546.496991][T16101] Bluetooth: hci0: command 0x040f tx timeout [ 1546.516943][T21213] usb 7-1: config 63 has an invalid descriptor of length 0, skipping remainder of the config [ 1546.535349][T21213] usb 7-1: config 63 has no interface number 0 [ 1546.541674][T21213] usb 7-1: config 63 interface 66 has no altsetting 0 [ 1546.552320][T21213] usb 7-1: New USB device found, idVendor=174f, idProduct=8a31, bcdDevice=39.f4 [ 1546.563418][T21213] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1546.581859][T21213] usb 7-1: Product: 캃瀨﫛ç£ÉŒíš·äŒŽâ£¹ä°©å«‘à¡â¯ã¨Ì‡á™¿à¹¡æš³é€§ë’¡í€ªê©œéš¦æ½µç‹·æ²¬ä½Šå…挙蔴蕢뉤➿鄾鳻⸱ᖌ⮡噱娞㹞츆ｅ틼ᅗ਽闶é¸ç‚¨ì²¸ë‹™á¯”腆뤹瘰㙮辫룯ힿỉጉ騤춾诮욤쓫ä„箌ꮂɧ㤻津꿪쒿鄛鰠㦂ᯩ㊸î¨á±œéžœî¥˜ì…‹ï²é‰ã²™ê½„鮡㼨焰똩ì¸ì‹³î…’çŠÚ¹ì­ì´â¬ºî˜à¼©ì¤‰á°–鶟鉨 [ 1546.641874][T21213] usb 7-1: SerialNumber: â  [ 1546.740195][T24002] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1546.762138][T24002] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1546.914970][ T24] em28xx 6-1:0.0: Unknown AC97 audio processor detected! [ 1547.003778][T21213] uvcvideo 7-1:63.66: probe with driver uvcvideo failed with error -22 [ 1547.020007][T21213] usb 7-1: USB disconnect, device number 91 [ 1547.733502][ T24] em28xx 6-1:0.0: couldn't setup AC97 register 4 [ 1547.741382][ T24] em28xx 6-1:0.0: couldn't setup AC97 register 6 [ 1547.750088][ T24] em28xx 6-1:0.0: couldn't setup AC97 register 54 [ 1547.766203][ T24] em28xx 6-1:0.0: couldn't setup AC97 register 56 [ 1547.794678][ T6023] usb 3-1: new high-speed USB device number 120 using dummy_hcd [ 1547.925817][ T24] usb 6-1: USB disconnect, device number 68 [ 1547.994600][ T6023] usb 3-1: Using ep0 maxpacket: 16 [ 1548.000663][ T6023] usb 3-1: too many configurations: 216, using maximum allowed: 8 [ 1548.010593][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.021538][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.060805][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.124600][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.170885][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.191156][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.300041][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.314299][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.340151][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.353077][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.372826][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.384003][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.420983][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.432142][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.452291][ T6023] usb 3-1: config 0 has an invalid descriptor of length 177, skipping remainder of the config [ 1548.463940][ T6023] usb 3-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1548.478585][ T6023] usb 3-1: New USB device found, idVendor=05ac, idProduct=024b, bcdDevice= 0.00 [ 1548.507637][ T6023] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1548.532135][ T6023] usb 3-1: config 0 descriptor?? [ 1548.574795][T16560] usb 7-1: new high-speed USB device number 92 using dummy_hcd [ 1548.582735][T16101] Bluetooth: hci0: command 0x040f tx timeout [ 1548.740381][T16560] usb 7-1: config index 0 descriptor too short (expected 2084, got 36) [ 1548.763591][T16560] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1549.068659][T16560] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1549.125286][T16560] usb 7-1: New USB device found, idVendor=0079, idProduct=0006, bcdDevice= 0.00 [ 1549.157696][T16560] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1549.193662][T16560] usb 7-1: config 0 descriptor?? [ 1549.600679][T24026] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4417'. [ 1549.802897][T16560] usbhid 7-1:0.0: can't add hid device: -71 [ 1549.819203][T16560] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 1549.892638][T16560] usb 7-1: USB disconnect, device number 92 [ 1550.344873][T16560] usb 3-1: USB disconnect, device number 120 [ 1550.654610][T16101] Bluetooth: hci0: command 0x040f tx timeout [ 1550.750017][T24034] gtp4: entered promiscuous mode [ 1550.814850][T24034] gtp4: entered allmulticast mode [ 1551.705480][ T6023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1552.024779][ T6023] usb 7-1: new high-speed USB device number 93 using dummy_hcd [ 1552.239657][ T6023] usb 7-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1552.265701][ T6023] usb 7-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1552.304975][ T6023] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1552.349283][ T6023] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1552.412476][T24049] raw-gadget.1 gadget.6: fail, usb_ep_enable returned -22 [ 1552.428261][ T6023] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1552.750688][ T5934] usb 7-1: USB disconnect, device number 93 [ 1552.794254][T24063] netlink: 4 bytes leftover after parsing attributes in process `syz.5.4428'. [ 1552.831466][T24046] binder: BINDER_SET_CONTEXT_MGR already set [ 1552.855292][T24046] binder: 24045:24046 ioctl 4018620d 200000000040 returned -16 [ 1552.914718][T16560] usb 3-1: new high-speed USB device number 121 using dummy_hcd [ 1552.933778][T10105] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 1552.946709][T10105] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 1552.956869][T10105] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 1552.969038][T10105] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 1552.977637][T10105] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 1553.095290][T16560] usb 3-1: Using ep0 maxpacket: 32 [ 1553.135466][T16560] usb 3-1: config 0 has an invalid interface number: 89 but max is 0 [ 1553.177962][T16560] usb 3-1: config 0 has no interface number 0 [ 1553.184126][T16560] usb 3-1: config 0 interface 89 has no altsetting 0 [ 1553.326203][T16560] usb 3-1: New USB device found, idVendor=0ccd, idProduct=10af, bcdDevice=38.4e [ 1553.344549][T16560] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1553.352580][T16560] usb 3-1: Product: syz [ 1553.394565][T16560] usb 3-1: Manufacturer: syz [ 1553.399211][T16560] usb 3-1: SerialNumber: syz [ 1553.445842][T16560] usb 3-1: config 0 descriptor?? [ 1553.479774][T16560] em28xx 3-1:0.89: New device syz syz @ 480 Mbps (0ccd:10af, interface 89, class 89) [ 1553.514614][T16560] em28xx 3-1:0.89: Video interface 89 found: bulk [ 1553.844663][ T5934] usb 7-1: new high-speed USB device number 94 using dummy_hcd [ 1554.014723][ T5934] usb 7-1: Using ep0 maxpacket: 32 [ 1554.032213][ T5934] usb 7-1: config 0 has no interfaces? [ 1554.064466][T16560] em28xx 3-1:0.89: unknown em28xx chip ID (0) [ 1554.070983][ T5934] usb 7-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1554.123704][ T5934] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1554.189459][ T5934] usb 7-1: config 0 descriptor?? [ 1554.432005][T24067] chnl_net:caif_netlink_parms(): no params data found [ 1554.714294][T16560] em28xx 3-1:0.89: reading from i2c device at 0xa0 failed (error=-5) [ 1554.773308][T16560] em28xx 3-1:0.89: board has no eeprom [ 1554.803256][T24093] netlink: 'syz.1.4436': attribute type 3 has an invalid length. [ 1554.865224][T16560] em28xx 3-1:0.89: Identified as Terratec Grabby (card=67) [ 1554.901216][T16560] em28xx 3-1:0.89: analog set to bulk mode. [ 1554.937911][ T5934] em28xx 3-1:0.89: Registering V4L2 extension [ 1554.953480][T24067] bridge0: port 1(bridge_slave_0) entered blocking state [ 1554.974278][T16560] usb 3-1: USB disconnect, device number 121 [ 1554.987763][T24067] bridge0: port 1(bridge_slave_0) entered disabled state [ 1555.000379][T16560] em28xx 3-1:0.89: Disconnecting em28xx [ 1555.017492][T24067] bridge_slave_0: entered allmulticast mode [ 1555.045635][T24067] bridge_slave_0: entered promiscuous mode [ 1555.065493][T16101] Bluetooth: hci3: command tx timeout [ 1555.089147][T24067] bridge0: port 2(bridge_slave_1) entered blocking state [ 1555.103369][T24067] bridge0: port 2(bridge_slave_1) entered disabled state [ 1555.123711][T24067] bridge_slave_1: entered allmulticast mode [ 1555.135075][T24067] bridge_slave_1: entered promiscuous mode [ 1555.170807][T24096] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4437'. [ 1555.236934][T24097] netlink: 48 bytes leftover after parsing attributes in process `syz.1.4437'. [ 1555.287082][ T5934] em28xx 3-1:0.89: Config register raw data: 0xffffffed [ 1555.334894][T24067] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1555.345811][ T5934] em28xx 3-1:0.89: AC97 chip type couldn't be determined [ 1555.352866][ T5934] em28xx 3-1:0.89: No AC97 audio processor [ 1555.396411][T24067] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1555.427584][ T5934] usb 3-1: Decoder not found [ 1555.464806][ T5934] em28xx 3-1:0.89: failed to create media graph [ 1555.471129][ T5934] em28xx 3-1:0.89: V4L2 device video103 deregistered [ 1555.492555][ T5934] em28xx 3-1:0.89: Registering snapshot button... [ 1555.610701][T24067] team0: Port device team_slave_0 added [ 1555.627975][T24067] team0: Port device team_slave_1 added [ 1555.657436][ T5934] input: em28xx snapshot button as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.89/input/input117 [ 1555.734256][ T5934] em28xx 3-1:0.89: Remote control support is not available for this card. [ 1555.917966][T24110] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1556.088268][T16560] em28xx 3-1:0.89: Closing input extension [ 1556.133962][T16560] em28xx 3-1:0.89: Deregistering snapshot button [ 1556.341495][T24067] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1556.470578][T24067] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1556.505872][T16560] em28xx 3-1:0.89: Freeing device [ 1556.642090][T24067] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1556.747103][T16560] usb 7-1: USB disconnect, device number 94 [ 1556.917657][T24112] _ÐZ`Ô€@ÿÃ: entered promiscuous mode [ 1556.966079][T24067] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1557.013415][T24067] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1557.135709][T16101] Bluetooth: hci3: command tx timeout [ 1557.606599][T24067] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1558.088385][T24067] hsr_slave_0: entered promiscuous mode [ 1558.156417][T24067] hsr_slave_1: entered promiscuous mode [ 1558.204230][T24067] debugfs: 'hsr0' already exists in 'hsr' [ 1558.238859][T24067] Cannot create hsr debugfs directory [ 1558.264695][T24131] netlink: 'syz.2.4446': attribute type 3 has an invalid length. [ 1559.221157][T16101] Bluetooth: hci3: command tx timeout [ 1559.244842][T24141] syzkaller1: entered promiscuous mode [ 1559.323930][T16560] usb 6-1: new full-speed USB device number 69 using dummy_hcd [ 1559.340937][T24141] syzkaller1: entered allmulticast mode [ 1559.649829][T16560] usb 6-1: config 0 has an invalid interface number: 176 but max is 2 [ 1559.664595][T16560] usb 6-1: config 0 has an invalid interface number: 3 but max is 2 [ 1559.674782][T16560] usb 6-1: config 0 has no interface number 0 [ 1559.701293][T16560] usb 6-1: config 0 has no interface number 1 [ 1559.714580][T16560] usb 6-1: too many endpoints for config 0 interface 3 altsetting 255: 255, using maximum allowed: 30 [ 1559.739014][T16560] usb 6-1: config 0 interface 3 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1559.752755][T16560] usb 6-1: config 0 interface 3 has no altsetting 0 [ 1559.855186][T16560] usb 6-1: New USB device found, idVendor=05c6, idProduct=9205, bcdDevice=29.ac [ 1559.864625][T16560] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1559.879369][T16560] usb 6-1: config 0 descriptor?? [ 1560.101280][T16560] usb 6-1: Could not set interface, error -71 [ 1560.142603][T16560] usb 6-1: selecting invalid altsetting 0 [ 1560.183034][T16560] usb 6-1: Could not set interface, error -22 [ 1560.209573][T24067] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 1560.231067][T16560] usb 6-1: USB disconnect, device number 69 [ 1560.270831][T24067] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 1560.360681][T24067] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 1560.429928][T24067] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 1560.716078][T24169] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1560.846578][T24169] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1560.925072][T24159] sg_write: data in/out 54068/42 bytes for SCSI command 0x0-- guessing data in; [ 1560.925072][T24159] program syz.6.4454 not setting count and/or reply_len properly [ 1561.220258][T24067] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1561.301839][T16101] Bluetooth: hci3: command tx timeout [ 1561.302707][T16560] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1561.316245][T24067] 8021q: adding VLAN 0 to HW filter on device team0 [ 1561.419073][T24067] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 1561.430080][T24067] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1561.445115][ T7808] bridge0: port 1(bridge_slave_0) entered blocking state [ 1561.452304][ T7808] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1561.882093][ T7808] bridge0: port 2(bridge_slave_1) entered blocking state [ 1561.889317][ T7808] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1562.351331][T24067] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1562.589898][T24181] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1562.740671][T24067] veth0_vlan: entered promiscuous mode [ 1562.801319][T24067] veth1_vlan: entered promiscuous mode [ 1562.996086][T24067] veth0_macvtap: entered promiscuous mode [ 1563.043261][T24067] veth1_macvtap: entered promiscuous mode [ 1563.170459][T24067] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1563.267162][T24067] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1563.474952][ T61] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.515256][ T61] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.556050][T24192] netlink: 3 bytes leftover after parsing attributes in process `syz.5.4459'. [ 1563.640469][ T61] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.654437][T24192] 0ªX¹¦À: renamed from caif0 [ 1563.714077][T24192] 0ªX¹¦À: entered allmulticast mode [ 1563.725162][T24192] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 1563.782542][T24195] netlink: 65039 bytes leftover after parsing attributes in process `syz.5.4459'. [ 1563.812600][ T61] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1563.840755][T20609] usb 3-1: new low-speed USB device number 122 using dummy_hcd [ 1564.015059][T20609] usb 3-1: Invalid ep0 maxpacket: 64 [ 1564.158732][T20609] usb 3-1: new low-speed USB device number 123 using dummy_hcd [ 1564.167311][ T61] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1564.210897][ T61] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1564.285274][T24215] loop5: detected capacity change from 0 to 7 [ 1564.307247][T24215] Dev loop5: unable to read RDB block 7 [ 1564.331511][T24215] loop5: unable to read partition table [ 1564.339960][ T13] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1564.358726][T20609] usb 3-1: Invalid ep0 maxpacket: 64 [ 1564.361821][T24217] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1564.365444][ T13] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1564.388086][T20609] usb usb3-port1: attempt power cycle [ 1564.391542][T24217] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1564.402021][T24215] loop5: partition table beyond EOD, truncated [ 1564.432434][T24215] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1564.476033][ T6023] usb 7-1: new full-speed USB device number 95 using dummy_hcd [ 1564.624704][ T6023] usb 7-1: device descriptor read/64, error -71 [ 1564.663619][ T61] bridge_slave_1: left allmulticast mode [ 1564.675895][ T61] bridge_slave_1: left promiscuous mode [ 1564.696048][ T61] bridge0: port 2(bridge_slave_1) entered disabled state [ 1564.740624][ T61] bridge_slave_0: left allmulticast mode [ 1564.754796][T20609] usb 3-1: new low-speed USB device number 124 using dummy_hcd [ 1564.772555][ T61] bridge_slave_0: left promiscuous mode [ 1564.785463][T20609] usb 3-1: Invalid ep0 maxpacket: 64 [ 1564.793139][ T61] bridge0: port 1(bridge_slave_0) entered disabled state [ 1564.844385][ T61] tipc: Resetting bearer [ 1564.904874][ T6023] usb 7-1: new full-speed USB device number 96 using dummy_hcd [ 1564.924750][T20609] usb 3-1: new low-speed USB device number 125 using dummy_hcd [ 1564.945917][T20609] usb 3-1: Invalid ep0 maxpacket: 64 [ 1564.952323][T20609] usb usb3-port1: unable to enumerate USB device [ 1565.069786][ T6023] usb 7-1: device descriptor read/64, error -71 [ 1565.198222][ T6023] usb usb7-port1: attempt power cycle [ 1565.674654][ T6023] usb 7-1: new full-speed USB device number 97 using dummy_hcd [ 1565.766197][ T6023] usb 7-1: device descriptor read/8, error -71 [ 1566.016975][ T61] tipc: Disabling bearer [ 1566.065552][ T6023] usb 7-1: new full-speed USB device number 98 using dummy_hcd [ 1566.174781][ T6023] usb 7-1: device descriptor read/8, error -71 [ 1566.295698][ T6023] usb usb7-port1: unable to enumerate USB device [ 1566.891314][ T61] bond1 (unregistering): Released all slaves [ 1566.974890][T24236] input: syz1 as /devices/virtual/input/input118 [ 1568.494691][ T6023] usb 6-1: new high-speed USB device number 70 using dummy_hcd [ 1568.684826][ T6023] usb 6-1: Using ep0 maxpacket: 16 [ 1568.693376][ T6023] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1568.703800][ T6023] usb 6-1: config 1 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 8 [ 1568.849145][ T6023] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1569.294077][ T61] bond2 (unregistering): Released all slaves [ 1569.321339][ T6023] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1569.446728][ T6023] usb 6-1: config 1 interface 2 altsetting 1 has an endpoint descriptor with address 0x1A, changing to 0xA [ 1569.553666][ T6023] usb 6-1: config 1 interface 2 altsetting 1 endpoint 0xA has invalid maxpacket 239, setting to 64 [ 1569.953234][ T6023] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1569.966225][ T6023] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1569.979494][ T6023] usb 6-1: Product: syz [ 1570.008738][ T6023] usb 6-1: Manufacturer: syz [ 1570.155404][ T6023] usb 6-1: SerialNumber: syz [ 1570.649016][ T6023] usb 6-1: USB disconnect, device number 70 [ 1570.896991][T16560] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1571.199042][ T61] bond0 (unregistering): Released all slaves [ 1571.307823][T24283] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4482'. [ 1571.308594][ T61] bond3 (unregistering): Released all slaves [ 1571.327036][T24283] netlink: 48 bytes leftover after parsing attributes in process `syz.5.4482'. [ 1571.494339][T24283] vlan2: entered allmulticast mode [ 1571.667277][ T61] tipc: Disabling bearer [ 1571.715853][ T61] tipc: Left network mode [ 1571.744621][ T6023] usb 6-1: new high-speed USB device number 71 using dummy_hcd [ 1571.830374][ T61] IPVS: stopping backup sync thread 13589 ... [ 1571.995698][ T6023] usb 6-1: Using ep0 maxpacket: 16 [ 1572.002836][ T6023] usb 6-1: config 0 has an invalid interface number: 11 but max is 0 [ 1572.015919][ T6023] usb 6-1: config 0 has no interface number 0 [ 1572.034999][ T6023] usb 6-1: too many endpoints for config 0 interface 11 altsetting 255: 255, using maximum allowed: 30 [ 1572.058974][ T6023] usb 6-1: config 0 interface 11 altsetting 255 has 0 endpoint descriptors, different from the interface descriptor's value: 255 [ 1572.106115][ T6023] usb 6-1: config 0 interface 11 has no altsetting 0 [ 1572.166408][ T6023] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice=d2.7b [ 1572.180376][ T6023] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1572.203542][ T6023] usb 6-1: Product: syz [ 1572.213991][ T6023] usb 6-1: Manufacturer: syz [ 1572.299592][ T6023] usb 6-1: SerialNumber: syz [ 1572.325726][ T6023] usb 6-1: config 0 descriptor?? [ 1572.676257][ T6023] usb 6-1: Expected 3 endpoints, found: 0 [ 1572.808538][ T6023] usb 6-1: USB disconnect, device number 71 [ 1573.949931][T24310] input: syz1 as /devices/virtual/input/input119 [ 1575.048759][ T885] usb 7-1: new high-speed USB device number 99 using dummy_hcd [ 1575.063392][T24310] gretap1: entered allmulticast mode [ 1575.185623][ T885] usb 7-1: device descriptor read/64, error -71 [ 1575.464748][ T885] usb 7-1: new high-speed USB device number 100 using dummy_hcd [ 1575.493719][T24323] netlink: 'syz.2.4489': attribute type 3 has an invalid length. [ 1580.499647][T20609] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1581.224284][T24365] bridge0: port 1(bridge_slave_0) entered disabled state [ 1581.504603][ T6023] usb 6-1: new high-speed USB device number 72 using dummy_hcd [ 1581.676896][ T6023] usb 6-1: Using ep0 maxpacket: 32 [ 1581.698614][ T6023] usb 6-1: config 0 has no interfaces? [ 1581.734624][ T6023] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1581.791534][ T6023] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1581.968735][ T6023] usb 6-1: config 0 descriptor?? [ 1582.365464][T24375] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4502'. [ 1582.429725][T24375] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4502'. [ 1582.464825][T20609] usb 7-1: new high-speed USB device number 101 using dummy_hcd [ 1582.637372][ T61] hsr_slave_0: left promiscuous mode [ 1582.658313][ T61] hsr_slave_1: left promiscuous mode [ 1582.664902][T20609] usb 7-1: Using ep0 maxpacket: 16 [ 1582.679837][T20609] usb 7-1: config 166 has an invalid interface number: 177 but max is 1 [ 1582.700376][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1582.715012][T20609] usb 7-1: config 166 has an invalid interface number: 34 but max is 1 [ 1582.728039][ T61] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1582.744577][T20609] usb 7-1: config 166 has no interface number 0 [ 1582.762214][T20609] usb 7-1: config 166 has no interface number 1 [ 1582.784647][T20609] usb 7-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 1582.797842][ T61] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1582.818710][ T61] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1582.828947][T20609] usb 7-1: config 166 interface 177 altsetting 4 has an invalid descriptor for endpoint zero, skipping [ 1582.873605][T20609] usb 7-1: config 166 interface 34 altsetting 1 has a duplicate endpoint with address 0x9, skipping [ 1582.905230][T20609] usb 7-1: config 166 interface 34 altsetting 1 has an endpoint descriptor with address 0xA6, changing to 0x86 [ 1582.950048][T20609] usb 7-1: config 166 interface 34 altsetting 1 endpoint 0x86 has invalid maxpacket 23105, setting to 1024 [ 1583.017549][T20609] usb 7-1: config 166 interface 34 altsetting 1 bulk endpoint 0x86 has invalid maxpacket 1024 [ 1583.054200][T20609] usb 7-1: config 166 interface 34 altsetting 1 endpoint 0x85 has an invalid bInterval 0, changing to 7 [ 1583.151837][T20609] usb 7-1: config 166 interface 34 altsetting 1 endpoint 0x85 has invalid wMaxPacketSize 0 [ 1583.189558][T20609] usb 7-1: config 166 interface 34 altsetting 1 has 5 endpoint descriptors, different from the interface descriptor's value: 4 [ 1583.223203][T20609] usb 7-1: config 166 interface 177 has no altsetting 0 [ 1583.241207][T20609] usb 7-1: config 166 interface 34 has no altsetting 0 [ 1583.269199][T20609] usb 7-1: New USB device found, idVendor=0bda, idProduct=0138, bcdDevice=30.12 [ 1583.279807][T20609] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1583.290498][T20609] usb 7-1: Product: syz [ 1583.295734][ T885] usb 3-1: new high-speed USB device number 126 using dummy_hcd [ 1583.309508][T20609] usb 7-1: Manufacturer: syz [ 1583.344359][T20609] usb 7-1: SerialNumber: syz [ 1583.495623][ T885] usb 3-1: Using ep0 maxpacket: 8 [ 1583.508538][ T885] usb 3-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 1583.528382][ T885] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1583.563393][ T885] usb 3-1: config 0 descriptor?? [ 1583.583731][T20609] ums-realtek 7-1:166.177: USB Mass Storage device detected [ 1583.787309][ T885] asix 3-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1583.833300][T20609] ums-realtek 7-1:166.34: USB Mass Storage device detected [ 1584.095137][T20609] ums-realtek 7-1:166.34: probe with driver ums-realtek failed with error -5 [ 1584.331074][ T61] team0 (unregistering): Port device team_slave_1 removed [ 1584.593364][T24382] netlink: 40 bytes leftover after parsing attributes in process `syz.2.4504'. [ 1584.736492][ T61] team0 (unregistering): Port device team_slave_0 removed [ 1585.483649][T24409] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1585.635513][T24409] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1585.812737][T20609] usb 7-1: Found UVC 0.00 device syz (0bda:0138) [ 1585.860408][T20609] usb 7-1: No valid video chain found. [ 1585.948162][T20609] usb 7-1: USB disconnect, device number 101 [ 1587.503696][ T885] asix 3-1:0.0 (unnamed net_device) (uninitialized): Failed to write reg index 0x0000: -71 [ 1587.518289][T21213] usb 6-1: USB disconnect, device number 72 [ 1587.567516][ T885] asix 3-1:0.0: probe with driver asix failed with error -71 [ 1587.637450][ T885] usb 3-1: USB disconnect, device number 126 [ 1587.822170][T24415] pim6reg: entered allmulticast mode [ 1588.001138][T21213] usb 6-1: new high-speed USB device number 73 using dummy_hcd [ 1588.164674][ T43] usb 3-1: new high-speed USB device number 127 using dummy_hcd [ 1588.179827][T21213] usb 6-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1588.222336][T21213] usb 6-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1588.267680][T21213] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1588.302096][T21213] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1588.333916][T21213] usb 6-1: Product: syz [ 1588.339646][T21213] usb 6-1: Manufacturer: syz [ 1588.345387][ T43] usb 3-1: device descriptor read/64, error -71 [ 1588.351917][T21213] usb 6-1: SerialNumber: syz [ 1588.357351][T13397] usb 7-1: new high-speed USB device number 102 using dummy_hcd [ 1588.388605][T21213] cdc_mbim 6-1:1.0: skipping garbage [ 1588.552174][T13397] usb 7-1: Using ep0 maxpacket: 8 [ 1588.585219][ T43] usb 3-1: new high-speed USB device number 2 using dummy_hcd [ 1588.597227][T24422] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1588.601126][T13397] usb 7-1: config index 0 descriptor too short (expected 301, got 45) [ 1588.617171][T24422] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1588.635205][T24422] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1588.646048][T13397] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1588.657528][T13397] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1588.669773][T13397] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1588.689257][T24422] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1588.710082][T13397] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1588.738480][T13397] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1e, bcdDevice=61.23 [ 1588.752372][T24422] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1588.754709][ T43] usb 3-1: device descriptor read/64, error -71 [ 1588.771614][T13397] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1588.875714][ T43] usb usb3-port1: attempt power cycle [ 1589.040802][T13397] usb 7-1: usb_control_msg returned -32 [ 1589.071136][T13397] usbtmc 7-1:16.0: can't read capabilities [ 1589.226969][ T43] usb 3-1: new high-speed USB device number 3 using dummy_hcd [ 1589.263741][ T43] usb 3-1: device descriptor read/8, error -71 [ 1589.488872][T24422] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1589.505569][T21213] cdc_mbim 6-1:1.0: setting tx_max = 32 [ 1589.525307][ T43] usb 3-1: new high-speed USB device number 4 using dummy_hcd [ 1589.660092][T21213] cdc_mbim 6-1:1.0: cdc-wdm2: USB WDM device [ 1589.666887][ T43] usb 3-1: device descriptor read/8, error -71 [ 1589.693084][T21213] wwan wwan0: port wwan0mbim0 attached [ 1589.716653][T21213] cdc_mbim 6-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.5-1, CDC MBIM, 1a:ea:f8:36:55:56 [ 1589.785347][ T43] usb usb3-port1: unable to enumerate USB device [ 1590.097662][ T6023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1590.745747][T21213] usb 6-1: USB disconnect, device number 73 [ 1590.789659][T21213] cdc_mbim 6-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.5-1, CDC MBIM [ 1591.147001][T21213] wwan wwan0: port wwan0mbim0 disconnected [ 1591.169627][T16560] usb 7-1: USB disconnect, device number 102 [ 1592.344809][T20609] usb 7-1: new high-speed USB device number 103 using dummy_hcd [ 1592.635086][T20609] usb 7-1: Using ep0 maxpacket: 8 [ 1592.762771][T20609] usb 7-1: config 0 has no interfaces? [ 1594.757692][T24493] netlink: 'syz.2.4524': attribute type 7 has an invalid length. [ 1594.815272][T24493] netlink: 'syz.2.4524': attribute type 5 has an invalid length. [ 1594.864940][T24493] netlink: 17 bytes leftover after parsing attributes in process `syz.2.4524'. [ 1594.935912][T24497] netlink: 12 bytes leftover after parsing attributes in process `syz.5.4525'. [ 1595.254680][T16560] usb 3-1: new low-speed USB device number 5 using dummy_hcd [ 1595.451805][T16560] usb 3-1: config 1 interface 0 altsetting 5 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1595.488574][T24503] FAULT_INJECTION: forcing a failure. [ 1595.488574][T24503] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1595.565740][T16560] usb 3-1: config 1 interface 0 has no altsetting 0 [ 1595.600294][T24503] CPU: 1 UID: 0 PID: 24503 Comm: syz.1.4527 Not tainted syzkaller #0 PREEMPT(full) [ 1595.600322][T24503] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1595.600333][T24503] Call Trace: [ 1595.600340][T24503] [ 1595.600348][T24503] dump_stack_lvl+0x189/0x250 [ 1595.600373][T24503] ? __pfx____ratelimit+0x10/0x10 [ 1595.600393][T24503] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1595.600414][T24503] ? __pfx__printk+0x10/0x10 [ 1595.600437][T24503] ? __might_fault+0xb0/0x130 [ 1595.600472][T24503] should_fail_ex+0x414/0x560 [ 1595.600499][T24503] copy_fpstate_to_sigframe+0xa8d/0xce0 [ 1595.600529][T24503] ? copy_fpstate_to_sigframe+0x181/0xce0 [ 1595.600560][T24503] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1595.600592][T24503] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 1595.600624][T24503] ? __lock_acquire+0xab9/0xd20 [ 1595.600653][T24503] ? fpu__alloc_mathframe+0xad/0x130 [ 1595.600679][T24503] get_sigframe+0x58d/0x7d0 [ 1595.600708][T24503] ? __pfx_get_sigframe+0x10/0x10 [ 1595.600734][T24503] ? irqentry_exit+0x74/0x90 [ 1595.600760][T24503] x64_setup_rt_frame+0x15b/0xd40 [ 1595.600791][T24503] ? _raw_spin_unlock_irq+0x29/0x50 [ 1595.600811][T24503] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1595.600825][T24503] ? get_signal+0x1151/0x1340 [ 1595.600851][T24503] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1595.600884][T24503] arch_do_signal_or_restart+0x3d7/0x750 [ 1595.600908][T24503] ? __fget_files+0x3a0/0x420 [ 1595.600927][T24503] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1595.600966][T24503] ? exit_to_user_mode_loop+0x40/0x110 [ 1595.600992][T24503] exit_to_user_mode_loop+0x75/0x110 [ 1595.601017][T24503] do_syscall_64+0x2bd/0x3b0 [ 1595.601038][T24503] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1595.601055][T24503] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1595.601071][T24503] ? clear_bhb_loop+0x60/0xb0 [ 1595.601092][T24503] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1595.601109][T24503] RIP: 0033:0x7f344318d97f [ 1595.601127][T24503] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1595.601142][T24503] RSP: 002b:00007f3443f70030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1595.601163][T24503] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00007f344318d97f [ 1595.601174][T24503] RDX: 0000000000000001 RSI: 00007f3443f70090 RDI: 0000000000000003 [ 1595.601186][T24503] RBP: 00007f3443f70090 R08: 0000000000000000 R09: 00007f3443f6fdf7 [ 1595.601197][T24503] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1595.601208][T24503] R13: 00007f34433e6038 R14: 00007f34433e5fa0 R15: 00007f344350fa28 [ 1595.601238][T24503] [ 1595.661398][T16560] usb 3-1: string descriptor 0 read error: -22 [ 1596.433606][T20609] usb 7-1: string descriptor 0 read error: -71 [ 1596.452735][T20609] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1596.534590][T20609] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1596.590804][T20609] usb 7-1: config 0 descriptor?? [ 1596.621038][T20609] usb 7-1: can't set config #0, error -71 [ 1596.628568][T20609] usb 7-1: USB disconnect, device number 103 [ 1596.714694][T16560] usb 3-1: New USB device found, idVendor=044f, idProduct=b654, bcdDevice= 0.40 [ 1596.774827][T16560] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1596.808344][T24521] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1596.871687][T24521] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1596.988612][T24525] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1597.040612][T24525] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1597.057875][T16560] usbhid 3-1:1.0: can't add hid device: -71 [ 1597.083940][T16560] usbhid 3-1:1.0: probe with driver usbhid failed with error -71 [ 1597.144160][T16560] usb 3-1: USB disconnect, device number 5 [ 1597.370142][ T44] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1597.815166][ T44] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1598.032645][ T44] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1598.266784][ T44] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1598.554899][ T5933] usb 6-1: new high-speed USB device number 74 using dummy_hcd [ 1598.565376][T13397] usb 3-1: new high-speed USB device number 6 using dummy_hcd [ 1598.714741][ T5933] usb 6-1: Using ep0 maxpacket: 32 [ 1598.740894][ T5933] usb 6-1: config 0 has no interfaces? [ 1598.761229][T13397] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1598.764969][ T5933] usb 6-1: New USB device found, idVendor=0e41, idProduct=5051, bcdDevice=d5.e8 [ 1598.802529][T13397] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1598.824261][ T44] bridge_slave_1: left allmulticast mode [ 1598.844290][ T44] bridge_slave_1: left promiscuous mode [ 1598.847122][ T5933] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1598.873637][T13397] usb 3-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 1598.895390][ T44] bridge0: port 2(bridge_slave_1) entered disabled state [ 1598.899990][ T5933] usb 6-1: config 0 descriptor?? [ 1598.925463][T13397] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1598.953734][T13397] usb 3-1: config 0 descriptor?? [ 1598.977366][ T44] bridge_slave_0: left allmulticast mode [ 1598.992339][ T44] bridge_slave_0: left promiscuous mode [ 1599.023280][ T44] bridge0: port 1(bridge_slave_0) entered disabled state [ 1599.440388][T13397] arvo 0003:1E7D:30D4.0041: ignoring exceeding usage max [ 1599.502201][T10105] Bluetooth: hci5: unexpected cc 0x0c03 length: 249 > 1 [ 1599.512846][T10105] Bluetooth: hci5: unexpected cc 0x1003 length: 249 > 9 [ 1599.521519][T10105] Bluetooth: hci5: unexpected cc 0x1001 length: 249 > 9 [ 1599.522138][T13397] arvo 0003:1E7D:30D4.0041: hidraw0: USB HID v0.00 Device [HID 1e7d:30d4] on usb-dummy_hcd.2-1/input0 [ 1599.529736][T10105] Bluetooth: hci5: unexpected cc 0x0c23 length: 249 > 4 [ 1599.551391][T10105] Bluetooth: hci5: unexpected cc 0x0c38 length: 249 > 2 [ 1599.695931][T16560] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1599.728256][T13397] arvo 0003:1E7D:30D4.0041: couldn't init struct arvo_device [ 1599.802851][T13397] arvo 0003:1E7D:30D4.0041: couldn't install keyboard [ 1599.829501][T13397] arvo 0003:1E7D:30D4.0041: probe with driver arvo failed with error -71 [ 1599.877021][T13397] usb 3-1: USB disconnect, device number 6 [ 1599.909022][T24546] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1599.993381][T24546] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1600.230731][T24558] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1600.317592][T24558] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1601.615365][T10105] Bluetooth: hci5: command tx timeout [ 1602.221766][T24567] openvswitch: netlink: IP tunnel dst address not specified [ 1602.273485][T21213] hid_parser_main: 1 callbacks suppressed [ 1602.273506][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.495175][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.502646][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.652376][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.737950][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.778718][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.810955][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.850699][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.868109][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.887975][T21213] hid-generic 0008:0006:0007.0042: unknown main item tag 0x0 [ 1602.949782][T21213] hid-generic 0008:0006:0007.0042: hidraw0: HID v0.0b Device [syz1] on syz1 [ 1603.075871][ T44] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1603.144410][ T44] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1603.180255][T24575] loop6: detected capacity change from 0 to 524288000 [ 1603.182313][T24573] fido_id[24573]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1603.203874][ T44] bond0 (unregistering): Released all slaves [ 1603.296446][ T30] kauditd_printk_skb: 14 callbacks suppressed [ 1603.296486][ T30] audit: type=1800 audit(1759009752.005:1730): pid=24581 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.7.4541" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1603.440259][T24582] support for the xor transformation has been removed. [ 1603.522123][ T43] usb 6-1: USB disconnect, device number 74 [ 1603.694857][T10105] Bluetooth: hci5: command tx timeout [ 1604.205929][T24596] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1604.948951][T24614] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4550'. [ 1604.974090][T24616] FAULT_INJECTION: forcing a failure. [ 1604.974090][T24616] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1604.988732][T24614] FAULT_INJECTION: forcing a failure. [ 1604.988732][T24614] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1605.030535][T24616] CPU: 1 UID: 0 PID: 24616 Comm: syz.1.4549 Not tainted syzkaller #0 PREEMPT(full) [ 1605.030562][T24616] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1605.030573][T24616] Call Trace: [ 1605.030581][T24616] [ 1605.030590][T24616] dump_stack_lvl+0x189/0x250 [ 1605.030614][T24616] ? __pfx____ratelimit+0x10/0x10 [ 1605.030633][T24616] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1605.030652][T24616] ? __pfx__printk+0x10/0x10 [ 1605.030675][T24616] ? __might_fault+0xb0/0x130 [ 1605.030712][T24616] should_fail_ex+0x414/0x560 [ 1605.030742][T24616] _copy_from_user+0x2d/0xb0 [ 1605.030765][T24616] ___sys_sendmsg+0x158/0x2a0 [ 1605.030791][T24616] ? __pfx____sys_sendmsg+0x10/0x10 [ 1605.030850][T24616] ? __fget_files+0x2a/0x420 [ 1605.030865][T24616] ? __fget_files+0x3a0/0x420 [ 1605.030893][T24616] __sys_sendmmsg+0x227/0x430 [ 1605.030927][T24616] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1605.030947][T24616] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1605.030994][T24616] ? ksys_write+0x22a/0x250 [ 1605.031019][T24616] ? __pfx_ksys_write+0x10/0x10 [ 1605.031039][T24616] ? rcu_is_watching+0x15/0xb0 [ 1605.031064][T24616] __x64_sys_sendmmsg+0xa0/0xc0 [ 1605.031089][T24616] do_syscall_64+0xfa/0x3b0 [ 1605.031107][T24616] ? lockdep_hardirqs_on+0x9c/0x150 [ 1605.031125][T24616] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1605.031141][T24616] ? clear_bhb_loop+0x60/0xb0 [ 1605.031163][T24616] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1605.031181][T24616] RIP: 0033:0x7f344318eec9 [ 1605.031197][T24616] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1605.031213][T24616] RSP: 002b:00007f3443f70038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1605.031233][T24616] RAX: ffffffffffffffda RBX: 00007f34433e5fa0 RCX: 00007f344318eec9 [ 1605.031247][T24616] RDX: 0000000000000002 RSI: 00002000000006c0 RDI: 0000000000000003 [ 1605.031259][T24616] RBP: 00007f3443f70090 R08: 0000000000000000 R09: 0000000000000000 [ 1605.031271][T24616] R10: 00000000200088d4 R11: 0000000000000246 R12: 0000000000000001 [ 1605.031283][T24616] R13: 00007f34433e6038 R14: 00007f34433e5fa0 R15: 00007f344350fa28 [ 1605.031313][T24616] [ 1605.043316][T24614] CPU: 0 UID: 0 PID: 24614 Comm: syz.7.4550 Not tainted syzkaller #0 PREEMPT(full) [ 1605.043342][T24614] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1605.043354][T24614] Call Trace: [ 1605.043362][T24614] [ 1605.043371][T24614] dump_stack_lvl+0x189/0x250 [ 1605.043396][T24614] ? __pfx____ratelimit+0x10/0x10 [ 1605.043416][T24614] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1605.043436][T24614] ? __pfx__printk+0x10/0x10 [ 1605.043472][T24614] should_fail_ex+0x414/0x560 [ 1605.043503][T24614] _copy_to_user+0x31/0xb0 [ 1605.043527][T24614] simple_read_from_buffer+0xe1/0x170 [ 1605.043556][T24614] proc_fail_nth_read+0x1b3/0x220 [ 1605.043579][T24614] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1605.043601][T24614] ? rw_verify_area+0x2a6/0x4d0 [ 1605.043622][T24614] ? __lock_acquire+0xab9/0xd20 [ 1605.043648][T24614] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1605.043675][T24614] vfs_read+0x200/0xa30 [ 1605.043696][T24614] ? fdget_pos+0x247/0x320 [ 1605.043716][T24614] ? __pfx___mutex_lock+0x10/0x10 [ 1605.043736][T24614] ? __pfx_vfs_read+0x10/0x10 [ 1605.043759][T24614] ? __fget_files+0x2a/0x420 [ 1605.043780][T24614] ? __fget_files+0x3a0/0x420 [ 1605.043794][T24614] ? __fget_files+0x2a/0x420 [ 1605.043819][T24614] ksys_read+0x145/0x250 [ 1605.043842][T24614] ? __pfx_ksys_read+0x10/0x10 [ 1605.043861][T24614] ? rcu_is_watching+0x15/0xb0 [ 1605.043884][T24614] ? do_syscall_64+0xbe/0x3b0 [ 1605.043906][T24614] do_syscall_64+0xfa/0x3b0 [ 1605.043924][T24614] ? lockdep_hardirqs_on+0x9c/0x150 [ 1605.043942][T24614] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1605.043960][T24614] ? clear_bhb_loop+0x60/0xb0 [ 1605.043980][T24614] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1605.043997][T24614] RIP: 0033:0x7f27f098d8dc [ 1605.044013][T24614] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1605.044029][T24614] RSP: 002b:00007f27eebee030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1605.044047][T24614] RAX: ffffffffffffffda RBX: 00007f27f0be5fa0 RCX: 00007f27f098d8dc [ 1605.044061][T24614] RDX: 000000000000000f RSI: 00007f27eebee0a0 RDI: 0000000000000004 [ 1605.044072][T24614] RBP: 00007f27eebee090 R08: 0000000000000000 R09: 0000000000000000 [ 1605.044084][T24614] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1605.044095][T24614] R13: 00007f27f0be6038 R14: 00007f27f0be5fa0 R15: 00007f27f0d0fa28 [ 1605.044125][T24614] [ 1605.776553][T24635] netlink: 'syz.2.4554': attribute type 3 has an invalid length. [ 1605.784442][T10105] Bluetooth: hci5: command tx timeout [ 1605.810867][ T44] hsr_slave_0: left promiscuous mode [ 1606.388625][ T44] hsr_slave_1: left promiscuous mode [ 1606.396226][ T44] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1606.408146][ T44] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1606.486333][ T44] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1606.497849][ T44] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1606.671673][ T44] veth1_macvtap: left promiscuous mode [ 1606.686422][ T44] veth0_macvtap: left promiscuous mode [ 1606.754292][ T44] veth1_vlan: left promiscuous mode [ 1606.790425][ T44] veth0_vlan: left promiscuous mode [ 1607.217885][ T44] pim6reg (unregistering): left allmulticast mode [ 1607.382104][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1607.388504][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1607.855161][T10105] Bluetooth: hci5: command tx timeout [ 1608.348984][ T44] team0 (unregistering): Port device team_slave_1 removed [ 1608.420116][ T44] team0 (unregistering): Port device team_slave_0 removed [ 1609.296866][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1609.806362][T24661] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1609.806775][T24661] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1610.216141][T24547] chnl_net:caif_netlink_parms(): no params data found [ 1610.401660][T24671] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1610.440624][T24671] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1610.725324][T21213] usb 6-1: new high-speed USB device number 75 using dummy_hcd [ 1610.895680][T24547] bridge0: port 1(bridge_slave_0) entered blocking state [ 1610.926910][T21213] usb 6-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 0 [ 1610.945274][T24547] bridge0: port 1(bridge_slave_0) entered disabled state [ 1610.986056][T24547] bridge_slave_0: entered allmulticast mode [ 1611.016997][T21213] usb 6-1: New USB device found, idVendor=05ac, idProduct=0238, bcdDevice= 0.40 [ 1611.047127][T24547] bridge_slave_0: entered promiscuous mode [ 1611.063929][T21213] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1611.085469][T24547] bridge0: port 2(bridge_slave_1) entered blocking state [ 1611.108360][T21213] usb 6-1: Product: syz [ 1611.117548][T24547] bridge0: port 2(bridge_slave_1) entered disabled state [ 1611.125950][T21213] usb 6-1: Manufacturer: syz [ 1611.133081][T21213] usb 6-1: SerialNumber: syz [ 1611.150695][T24547] bridge_slave_1: entered allmulticast mode [ 1611.245248][T24547] bridge_slave_1: entered promiscuous mode [ 1611.280147][T21213] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input120 [ 1611.403594][ T5218] bcm5974 6-1:1.0: could not read from device [ 1611.473822][T21213] usb 6-1: USB disconnect, device number 75 [ 1611.480875][ T5218] bcm5974 6-1:1.0: could not read from device [ 1611.500487][ T5218] bcm5974 6-1:1.0: could not read from device [ 1611.679007][T24547] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1611.750135][T24547] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1611.826461][T24712] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4569'. [ 1612.048912][T24547] team0: Port device team_slave_0 added [ 1612.094858][T20609] usb 3-1: new high-speed USB device number 7 using dummy_hcd [ 1612.128480][T24717] netlink: 4 bytes leftover after parsing attributes in process `syz.7.4571'. [ 1612.170480][T24547] team0: Port device team_slave_1 added [ 1612.336833][T20609] usb 3-1: Using ep0 maxpacket: 32 [ 1612.374971][T20609] usb 3-1: config 0 has an invalid interface number: 132 but max is 0 [ 1612.404967][T20609] usb 3-1: config 0 has no interface number 0 [ 1612.411109][T20609] usb 3-1: config 0 interface 132 altsetting 0 endpoint 0x82 has invalid wMaxPacketSize 0 [ 1612.528405][T20609] usb 3-1: New USB device found, idVendor=0413, idProduct=6023, bcdDevice=ec.e5 [ 1612.549274][T20609] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1612.584825][T20609] usb 3-1: Product: syz [ 1612.589065][T20609] usb 3-1: Manufacturer: syz [ 1612.593662][T20609] usb 3-1: SerialNumber: syz [ 1612.603180][T20609] usb 3-1: config 0 descriptor?? [ 1612.951290][T24547] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1613.013432][T24547] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1613.063712][T20609] em28xx 3-1:0.132: New device syz syz @ 480 Mbps (0413:6023, interface 132, class 132) [ 1613.086869][T20609] em28xx 3-1:0.132: Video interface 132 found: [ 1613.108565][T24547] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1613.236282][T24547] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1613.243275][T24547] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1613.368226][T24547] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1613.495545][T20609] em28xx 3-1:0.132: unknown em28xx chip ID (0) [ 1613.676772][T24547] hsr_slave_0: entered promiscuous mode [ 1613.683820][T24547] hsr_slave_1: entered promiscuous mode [ 1613.746435][T24547] debugfs: 'hsr0' already exists in 'hsr' [ 1613.752241][T24547] Cannot create hsr debugfs directory [ 1614.135032][T20609] em28xx 3-1:0.132: failed to read eeprom (err=-110) [ 1614.141919][T20609] em28xx 3-1:0.132: em28xx_i2c_register: em28xx_i2_eeprom failed! retval [-110] [ 1614.374609][T20609] em28xx 3-1:0.132: Identified as Leadtek Winfast USB II (card=7) [ 1614.392898][T20609] em28xx 3-1:0.132: analog set to bulk mode. [ 1614.415120][ T5933] em28xx 3-1:0.132: Registering V4L2 extension [ 1614.452607][T20609] usb 3-1: USB disconnect, device number 7 [ 1614.480885][T20609] em28xx 3-1:0.132: Disconnecting em28xx [ 1614.906244][T21213] usb 6-1: new high-speed USB device number 76 using dummy_hcd [ 1614.908939][ T5933] em28xx 3-1:0.132: Config register raw data: 0xffffffed [ 1614.937962][T24547] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 1614.979635][ T5933] em28xx 3-1:0.132: AC97 chip type couldn't be determined [ 1615.012463][T24547] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 1615.023371][ T5933] em28xx 3-1:0.132: No AC97 audio processor [ 1615.060751][ T5933] usb 3-1: Decoder not found [ 1615.094389][T21213] usb 6-1: config 1 has an invalid interface number: 7 but max is 0 [ 1615.104819][T21213] usb 6-1: config 1 has no interface number 0 [ 1615.107847][ T5933] em28xx 3-1:0.132: failed to create media graph [ 1615.113819][T21213] usb 6-1: config 1 interface 7 altsetting 0 has an endpoint descriptor with address 0xDB, changing to 0x8B [ 1615.147552][T24547] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 1615.178187][ T5933] em28xx 3-1:0.132: V4L2 device video103 deregistered [ 1615.222545][ T5933] em28xx 3-1:0.132: Remote control support is not available for this card. [ 1615.244694][T21213] usb 6-1: config 1 interface 7 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64 [ 1615.265755][T20609] em28xx 3-1:0.132: Closing input extension [ 1615.273075][T24547] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 1615.307757][T21213] usb 6-1: config 1 interface 7 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1615.315599][T20609] em28xx 3-1:0.132: Freeing device [ 1615.367585][T21213] usb 6-1: New USB device found, idVendor=1199, idProduct=68a3, bcdDevice= 0.00 [ 1615.401067][T21213] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1615.539404][T21213] usb 6-1: Product: syz [ 1615.555094][T21213] usb 6-1: Manufacturer: syz [ 1615.565327][T21213] usb 6-1: SerialNumber: syz [ 1615.649494][T24750] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1616.325356][T24750] raw-gadget.1 gadget.5: fail, usb_ep_enable returned -22 [ 1616.936829][T21213] sierra_net 6-1:1.7 wwan0: register 'sierra_net' at usb-dummy_hcd.5-1, Sierra Wireless USB-to-WWAN Modem, 00:00:00:00:01:07 [ 1616.987514][T24547] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1617.416834][T24547] 8021q: adding VLAN 0 to HW filter on device team0 [ 1617.444287][T24761] syz.1.4579 (24761): drop_caches: 2 [ 1617.469763][ T7808] bridge0: port 1(bridge_slave_0) entered blocking state [ 1617.476954][ T7808] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1617.532067][ T7808] bridge0: port 2(bridge_slave_1) entered blocking state [ 1617.539282][ T7808] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1617.694890][ T5933] usb 6-1: USB disconnect, device number 76 [ 1617.722397][ T5933] sierra_net 6-1:1.7 wwan0: unregister 'sierra_net' usb-dummy_hcd.5-1, Sierra Wireless USB-to-WWAN Modem [ 1617.773599][T24547] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 1618.026710][ T5933] sierra_net 6-1:1.7 wwan0 (unregistered): usb_control_msg failed, status -19 [ 1618.061523][T24547] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1618.442628][T24547] veth0_vlan: entered promiscuous mode [ 1618.570247][T24547] veth1_vlan: entered promiscuous mode [ 1618.703835][T24795] netlink: 132 bytes leftover after parsing attributes in process `syz.1.4584'. [ 1618.877191][T24547] veth0_macvtap: entered promiscuous mode [ 1618.895573][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1619.069018][T24547] veth1_macvtap: entered promiscuous mode [ 1619.209751][T24547] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1619.308364][T24547] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1619.408160][ T36] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1619.455111][T13397] usb 6-1: new high-speed USB device number 77 using dummy_hcd [ 1619.463086][ T36] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1619.550096][ T36] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1619.585931][ T36] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1619.815098][T13397] usb 6-1: Using ep0 maxpacket: 16 [ 1619.890330][T13397] usb 6-1: New USB device found, idVendor=06be, idProduct=a232, bcdDevice=33.f3 [ 1620.012265][T13397] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1620.115943][T13397] usb 6-1: Product: syz [ 1620.120166][T13397] usb 6-1: Manufacturer: syz [ 1620.258989][ T1323] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1620.308563][ T1323] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1620.370826][T13397] usb 6-1: SerialNumber: syz [ 1620.441965][ T44] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1620.496299][T13397] usb 6-1: config 0 descriptor?? [ 1620.497482][ T44] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1620.915065][T24804] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1620.934094][T24804] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1620.963908][T24823] FAULT_INJECTION: forcing a failure. [ 1620.963908][T24823] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1620.997351][T13397] dvb-usb: found a 'AME DTV-5100 USB2.0 DVB-T' in warm state. [ 1621.013585][T24823] CPU: 0 UID: 0 PID: 24823 Comm: syz.8.4534 Not tainted syzkaller #0 PREEMPT(full) [ 1621.013611][T24823] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1621.013623][T24823] Call Trace: [ 1621.013631][T24823] [ 1621.013640][T24823] dump_stack_lvl+0x189/0x250 [ 1621.013666][T24823] ? __pfx____ratelimit+0x10/0x10 [ 1621.013687][T24823] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1621.013708][T24823] ? __pfx__printk+0x10/0x10 [ 1621.013732][T24823] ? __might_fault+0xb0/0x130 [ 1621.013768][T24823] should_fail_ex+0x414/0x560 [ 1621.013799][T24823] _copy_from_user+0x2d/0xb0 [ 1621.013823][T24823] ___sys_sendmsg+0x158/0x2a0 [ 1621.013849][T24823] ? __pfx____sys_sendmsg+0x10/0x10 [ 1621.013908][T24823] ? __fget_files+0x2a/0x420 [ 1621.013925][T24823] ? __fget_files+0x3a0/0x420 [ 1621.013952][T24823] __x64_sys_sendmsg+0x19b/0x260 [ 1621.013977][T24823] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1621.014009][T24823] ? __pfx_ksys_write+0x10/0x10 [ 1621.014030][T24823] ? rcu_is_watching+0x15/0xb0 [ 1621.014054][T24823] ? do_syscall_64+0xbe/0x3b0 [ 1621.014079][T24823] do_syscall_64+0xfa/0x3b0 [ 1621.014097][T24823] ? lockdep_hardirqs_on+0x9c/0x150 [ 1621.014121][T24823] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1621.014139][T24823] ? clear_bhb_loop+0x60/0xb0 [ 1621.014161][T24823] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1621.014179][T24823] RIP: 0033:0x7fc92ad8eec9 [ 1621.014195][T24823] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1621.014211][T24823] RSP: 002b:00007fc92bbe7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1621.014231][T24823] RAX: ffffffffffffffda RBX: 00007fc92afe5fa0 RCX: 00007fc92ad8eec9 [ 1621.014246][T24823] RDX: 0000000000000000 RSI: 0000200000006040 RDI: 0000000000000006 [ 1621.014257][T24823] RBP: 00007fc92bbe7090 R08: 0000000000000000 R09: 0000000000000000 [ 1621.014269][T24823] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1621.014280][T24823] R13: 00007fc92afe6038 R14: 00007fc92afe5fa0 R15: 00007fc92b10fa28 [ 1621.014310][T24823] [ 1621.226434][T13397] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 1621.305454][T24804] dtv5100: wlen = 0, aborting. [ 1621.378621][T13397] dvbdev: DVB: registering new adapter (AME DTV-5100 USB2.0 DVB-T) [ 1621.510533][T13397] usb 6-1: media controller created [ 1621.611336][T13397] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1622.219088][T13397] zl10353_read_register: readreg error (reg=127, ret==0) [ 1622.248694][T13397] dvb-usb: no frontend was attached by 'AME DTV-5100 USB2.0 DVB-T' [ 1622.273863][T13397] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully initialized and connected. [ 1623.514947][T13397] usb 6-1: USB disconnect, device number 77 [ 1623.728808][T24859] FAULT_INJECTION: forcing a failure. [ 1623.728808][T24859] name failslab, interval 1, probability 0, space 0, times 0 [ 1623.729887][T13397] dvb-usb: AME DTV-5100 USB2.0 DVB-T successfully deinitialized and disconnected. [ 1623.963270][T24859] CPU: 1 UID: 0 PID: 24859 Comm: syz.5.4598 Not tainted syzkaller #0 PREEMPT(full) [ 1623.963287][T24859] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1623.963295][T24859] Call Trace: [ 1623.963300][T24859] [ 1623.963305][T24859] dump_stack_lvl+0x189/0x250 [ 1623.963322][T24859] ? __pfx____ratelimit+0x10/0x10 [ 1623.963334][T24859] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1623.963345][T24859] ? __pfx__printk+0x10/0x10 [ 1623.963362][T24859] ? __pfx___might_resched+0x10/0x10 [ 1623.963372][T24859] ? fs_reclaim_acquire+0x7d/0x100 [ 1623.963387][T24859] should_fail_ex+0x414/0x560 [ 1623.963405][T24859] should_failslab+0xa8/0x100 [ 1623.963421][T24859] __kmalloc_cache_noprof+0x70/0x3d0 [ 1623.963434][T24859] ? sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 1623.963448][T24859] sctp_auth_asoc_copy_shkeys+0x14e/0x5a0 [ 1623.963463][T24859] sctp_association_new+0x15d3/0x25f0 [ 1623.963485][T24859] sctp_connect_new_asoc+0x2c5/0x690 [ 1623.963499][T24859] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1623.963510][T24859] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1623.963525][T24859] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1623.963537][T24859] ? security_sctp_bind_connect+0x7e/0x2e0 [ 1623.963552][T24859] sctp_sendmsg+0x155c/0x2810 [ 1623.963571][T24859] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1623.963585][T24859] ? aa_sk_perm+0x81e/0x950 [ 1623.963604][T24859] ? __pfx_aa_sk_perm+0x10/0x10 [ 1623.963620][T24859] ? sock_rps_record_flow+0x19/0x410 [ 1623.963636][T24859] ? inet_sendmsg+0x2f4/0x370 [ 1623.963652][T24859] __sock_sendmsg+0x19c/0x270 [ 1623.963670][T24859] ____sys_sendmsg+0x52d/0x830 [ 1623.963686][T24859] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1623.963703][T24859] ? import_iovec+0x74/0xa0 [ 1623.963718][T24859] ___sys_sendmsg+0x21f/0x2a0 [ 1623.963732][T24859] ? __pfx____sys_sendmsg+0x10/0x10 [ 1623.963764][T24859] ? __fget_files+0x2a/0x420 [ 1623.963773][T24859] ? __fget_files+0x3a0/0x420 [ 1623.963787][T24859] __sys_sendmmsg+0x227/0x430 [ 1623.963809][T24859] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1623.963820][T24859] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1623.963847][T24859] ? ksys_write+0x22a/0x250 [ 1623.963861][T24859] ? __pfx_ksys_write+0x10/0x10 [ 1623.963873][T24859] ? rcu_is_watching+0x15/0xb0 [ 1623.963887][T24859] __x64_sys_sendmmsg+0xa0/0xc0 [ 1623.963901][T24859] do_syscall_64+0xfa/0x3b0 [ 1623.963912][T24859] ? lockdep_hardirqs_on+0x9c/0x150 [ 1623.963923][T24859] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1623.963933][T24859] ? clear_bhb_loop+0x60/0xb0 [ 1623.963945][T24859] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1623.963954][T24859] RIP: 0033:0x7f8e57f8eec9 [ 1623.963965][T24859] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1623.963974][T24859] RSP: 002b:00007f8e561f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1623.963985][T24859] RAX: ffffffffffffffda RBX: 00007f8e581e5fa0 RCX: 00007f8e57f8eec9 [ 1623.963993][T24859] RDX: 0000000000000002 RSI: 00002000000006c0 RDI: 0000000000000003 [ 1623.963999][T24859] RBP: 00007f8e561f6090 R08: 0000000000000000 R09: 0000000000000000 [ 1623.964005][T24859] R10: 00000000200088d4 R11: 0000000000000246 R12: 0000000000000001 [ 1623.964012][T24859] R13: 00007f8e581e6038 R14: 00007f8e581e5fa0 R15: 00007f8e5830fa28 [ 1623.964028][T24859] [ 1625.000523][T24869] IPv6: addrconf: prefix option has invalid lifetime [ 1625.026669][T24873] netlink: 20 bytes leftover after parsing attributes in process `syz.7.4602'. [ 1626.248139][ T24] IPVS: starting estimator thread 0... [ 1626.365985][T24894] IPVS: using max 28 ests per chain, 67200 per kthread [ 1626.836702][T24902] syz_tun: entered promiscuous mode [ 1626.842099][T24902] vlan3: entered promiscuous mode [ 1627.180534][ T24] usb 3-1: new full-speed USB device number 8 using dummy_hcd [ 1627.328390][ T24] usb 3-1: device descriptor read/64, error -71 [ 1627.397537][T24913] FAULT_INJECTION: forcing a failure. [ 1627.397537][T24913] name failslab, interval 1, probability 0, space 0, times 0 [ 1627.478329][T24913] CPU: 0 UID: 0 PID: 24913 Comm: syz.7.4611 Not tainted syzkaller #0 PREEMPT(full) [ 1627.478355][T24913] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1627.478366][T24913] Call Trace: [ 1627.478375][T24913] [ 1627.478384][T24913] dump_stack_lvl+0x189/0x250 [ 1627.478410][T24913] ? __pfx____ratelimit+0x10/0x10 [ 1627.478431][T24913] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1627.478452][T24913] ? __pfx__printk+0x10/0x10 [ 1627.478476][T24913] ? crng_make_state+0x3fc/0x700 [ 1627.478505][T24913] ? crng_make_state+0x13a/0x700 [ 1627.478534][T24913] should_fail_ex+0x414/0x560 [ 1627.478566][T24913] should_failslab+0xa8/0x100 [ 1627.478593][T24913] __kmalloc_cache_noprof+0x70/0x3d0 [ 1627.478616][T24913] ? sctp_add_bind_addr+0x8c/0x370 [ 1627.478639][T24913] sctp_add_bind_addr+0x8c/0x370 [ 1627.478663][T24913] sctp_copy_local_addr_list+0x30b/0x4e0 [ 1627.478685][T24913] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 1627.478705][T24913] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1627.478725][T24913] ? sctp_v6_is_any+0x64/0x80 [ 1627.478753][T24913] ? sctp_copy_one_addr+0x93/0x360 [ 1627.478775][T24913] sctp_bind_addr_copy+0xb3/0x3c0 [ 1627.478795][T24913] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1627.478823][T24913] sctp_connect_new_asoc+0x2e0/0x690 [ 1627.478850][T24913] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1627.478869][T24913] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1627.478896][T24913] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1627.478917][T24913] ? security_sctp_bind_connect+0x7e/0x2e0 [ 1627.478944][T24913] sctp_sendmsg+0x155c/0x2810 [ 1627.478979][T24913] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1627.479005][T24913] ? aa_sk_perm+0x81e/0x950 [ 1627.479036][T24913] ? __pfx_aa_sk_perm+0x10/0x10 [ 1627.479065][T24913] ? sock_rps_record_flow+0x19/0x410 [ 1627.479092][T24913] ? inet_sendmsg+0x2f4/0x370 [ 1627.479121][T24913] __sock_sendmsg+0x19c/0x270 [ 1627.479150][T24913] ____sys_sendmsg+0x52d/0x830 [ 1627.479179][T24913] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1627.479212][T24913] ? import_iovec+0x74/0xa0 [ 1627.479239][T24913] ___sys_sendmsg+0x21f/0x2a0 [ 1627.479264][T24913] ? __pfx____sys_sendmsg+0x10/0x10 [ 1627.479326][T24913] ? __fget_files+0x2a/0x420 [ 1627.479341][T24913] ? __fget_files+0x3a0/0x420 [ 1627.479370][T24913] __sys_sendmmsg+0x227/0x430 [ 1627.479399][T24913] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1627.479418][T24913] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1627.479467][T24913] ? ksys_write+0x22a/0x250 [ 1627.479492][T24913] ? __pfx_ksys_write+0x10/0x10 [ 1627.479512][T24913] ? rcu_is_watching+0x15/0xb0 [ 1627.479538][T24913] __x64_sys_sendmmsg+0xa0/0xc0 [ 1627.479563][T24913] do_syscall_64+0xfa/0x3b0 [ 1627.479581][T24913] ? lockdep_hardirqs_on+0x9c/0x150 [ 1627.479600][T24913] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.479618][T24913] ? clear_bhb_loop+0x60/0xb0 [ 1627.479640][T24913] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1627.479657][T24913] RIP: 0033:0x7f27f098eec9 [ 1627.479674][T24913] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1627.479689][T24913] RSP: 002b:00007f27eebee038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1627.479708][T24913] RAX: ffffffffffffffda RBX: 00007f27f0be5fa0 RCX: 00007f27f098eec9 [ 1627.479722][T24913] RDX: 0000000000000002 RSI: 00002000000006c0 RDI: 0000000000000003 [ 1627.479734][T24913] RBP: 00007f27eebee090 R08: 0000000000000000 R09: 0000000000000000 [ 1627.479752][T24913] R10: 00000000200088d4 R11: 0000000000000246 R12: 0000000000000001 [ 1627.479763][T24913] R13: 00007f27f0be6038 R14: 00007f27f0be5fa0 R15: 00007f27f0d0fa28 [ 1627.479795][T24913] [ 1627.847081][ T24] usb 3-1: new full-speed USB device number 9 using dummy_hcd [ 1628.375383][ T24] usb 3-1: device descriptor read/64, error -71 [ 1628.497157][ T24] usb usb3-port1: attempt power cycle [ 1628.508510][T24819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1628.847397][ T24] usb 3-1: new full-speed USB device number 10 using dummy_hcd [ 1628.935719][ T24] usb 3-1: device descriptor read/8, error -71 [ 1629.425278][ T24] usb 3-1: new full-speed USB device number 11 using dummy_hcd [ 1629.463494][ T24] usb 3-1: device descriptor read/8, error -71 [ 1629.595462][ T24] usb usb3-port1: unable to enumerate USB device [ 1631.213013][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.223001][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.231873][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.240744][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.249625][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.258449][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.267839][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.276612][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.284930][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1631.293165][T24963] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1632.422013][T24970] FAULT_INJECTION: forcing a failure. [ 1632.422013][T24970] name failslab, interval 1, probability 0, space 0, times 0 [ 1632.537648][T24970] CPU: 1 UID: 0 PID: 24970 Comm: syz.8.4623 Not tainted syzkaller #0 PREEMPT(full) [ 1632.537674][T24970] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1632.537685][T24970] Call Trace: [ 1632.537694][T24970] [ 1632.537703][T24970] dump_stack_lvl+0x189/0x250 [ 1632.537732][T24970] ? __pfx____ratelimit+0x10/0x10 [ 1632.537752][T24970] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1632.537774][T24970] ? __pfx__printk+0x10/0x10 [ 1632.537814][T24970] should_fail_ex+0x414/0x560 [ 1632.537845][T24970] should_failslab+0xa8/0x100 [ 1632.537872][T24970] __kmalloc_cache_noprof+0x70/0x3d0 [ 1632.537896][T24970] ? sctp_add_bind_addr+0x8c/0x370 [ 1632.537919][T24970] sctp_add_bind_addr+0x8c/0x370 [ 1632.537943][T24970] sctp_copy_local_addr_list+0x30b/0x4e0 [ 1632.537966][T24970] ? sctp_copy_local_addr_list+0x9b/0x4e0 [ 1632.537984][T24970] ? __pfx_sctp_copy_local_addr_list+0x10/0x10 [ 1632.538011][T24970] ? sctp_v6_is_any+0x64/0x80 [ 1632.538032][T24970] ? sctp_copy_one_addr+0x93/0x360 [ 1632.538055][T24970] sctp_bind_addr_copy+0xb3/0x3c0 [ 1632.538075][T24970] ? sctp_assoc_set_bind_addr_from_ep+0xa5/0x1a0 [ 1632.538103][T24970] sctp_connect_new_asoc+0x2e0/0x690 [ 1632.538129][T24970] ? __pfx_sctp_connect_new_asoc+0x10/0x10 [ 1632.538149][T24970] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1632.538175][T24970] ? bpf_lsm_sctp_bind_connect+0x9/0x20 [ 1632.538196][T24970] ? security_sctp_bind_connect+0x7e/0x2e0 [ 1632.538223][T24970] sctp_sendmsg+0x155c/0x2810 [ 1632.538257][T24970] ? __pfx_sctp_sendmsg+0x10/0x10 [ 1632.538282][T24970] ? aa_sk_perm+0x81e/0x950 [ 1632.538315][T24970] ? __pfx_aa_sk_perm+0x10/0x10 [ 1632.538344][T24970] ? sock_rps_record_flow+0x19/0x410 [ 1632.538373][T24970] ? inet_sendmsg+0x2f4/0x370 [ 1632.538402][T24970] __sock_sendmsg+0x19c/0x270 [ 1632.538432][T24970] ____sys_sendmsg+0x52d/0x830 [ 1632.538462][T24970] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1632.538494][T24970] ? import_iovec+0x74/0xa0 [ 1632.538522][T24970] ___sys_sendmsg+0x21f/0x2a0 [ 1632.538547][T24970] ? __pfx____sys_sendmsg+0x10/0x10 [ 1632.538606][T24970] ? __fget_files+0x2a/0x420 [ 1632.538623][T24970] ? __fget_files+0x3a0/0x420 [ 1632.538649][T24970] __sys_sendmmsg+0x227/0x430 [ 1632.538677][T24970] ? __pfx___sys_sendmmsg+0x10/0x10 [ 1632.538695][T24970] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1632.538742][T24970] ? ksys_write+0x22a/0x250 [ 1632.538769][T24970] ? __pfx_ksys_write+0x10/0x10 [ 1632.538787][T24970] ? rcu_is_watching+0x15/0xb0 [ 1632.538812][T24970] __x64_sys_sendmmsg+0xa0/0xc0 [ 1632.538836][T24970] do_syscall_64+0xfa/0x3b0 [ 1632.538854][T24970] ? lockdep_hardirqs_on+0x9c/0x150 [ 1632.538873][T24970] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1632.538891][T24970] ? clear_bhb_loop+0x60/0xb0 [ 1632.538914][T24970] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1632.538931][T24970] RIP: 0033:0x7fc92ad8eec9 [ 1632.538947][T24970] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1632.538962][T24970] RSP: 002b:00007fc92bbe7038 EFLAGS: 00000246 ORIG_RAX: 0000000000000133 [ 1632.538980][T24970] RAX: ffffffffffffffda RBX: 00007fc92afe5fa0 RCX: 00007fc92ad8eec9 [ 1632.539055][T24970] RDX: 0000000000000002 RSI: 00002000000006c0 RDI: 0000000000000003 [ 1632.539067][T24970] RBP: 00007fc92bbe7090 R08: 0000000000000000 R09: 0000000000000000 [ 1632.539079][T24970] R10: 00000000200088d4 R11: 0000000000000246 R12: 0000000000000001 [ 1632.539090][T24970] R13: 00007fc92afe6038 R14: 00007fc92afe5fa0 R15: 00007fc92b10fa28 [ 1632.539122][T24970] [ 1633.305108][T13397] usb 6-1: new full-speed USB device number 78 using dummy_hcd [ 1633.377359][T24979] loop5: detected capacity change from 0 to 7 [ 1633.410041][T24979] Dev loop5: unable to read RDB block 7 [ 1633.445628][T24979] loop5: unable to read partition table [ 1633.457383][T13397] usb 6-1: not running at top speed; connect to a high speed hub [ 1633.476951][T13397] usb 6-1: config 1 interface 0 has no altsetting 0 [ 1633.496650][T24979] loop5: partition table beyond EOD, truncated [ 1633.511350][T13397] usb 6-1: New USB device found, idVendor=05ac, idProduct=0230, bcdDevice= 0.40 [ 1633.531639][T24979] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1633.544372][T13397] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1633.560582][T13397] usb 6-1: Product: syz [ 1633.571691][T13397] usb 6-1: Manufacturer: syz [ 1633.593556][T13397] usb 6-1: SerialNumber: syz [ 1633.759235][T24990] netlink: 8 bytes leftover after parsing attributes in process `syz.7.4629'. [ 1633.825886][T24972] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1633.887846][T24972] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1634.022066][T13397] input: bcm5974 as /devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/input/input121 [ 1634.071298][ T5218] bcm5974 6-1:1.0: could not read from device [ 1634.093503][T13397] usb 6-1: USB disconnect, device number 78 [ 1635.518706][T25030] FAULT_INJECTION: forcing a failure. [ 1635.518706][T25030] name failslab, interval 1, probability 0, space 0, times 0 [ 1635.580267][T25030] CPU: 0 UID: 0 PID: 25030 Comm: syz.8.4638 Not tainted syzkaller #0 PREEMPT(full) [ 1635.580294][T25030] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1635.580305][T25030] Call Trace: [ 1635.580313][T25030] [ 1635.580320][T25030] dump_stack_lvl+0x189/0x250 [ 1635.580344][T25030] ? __pfx____ratelimit+0x10/0x10 [ 1635.580364][T25030] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1635.580384][T25030] ? __pfx__printk+0x10/0x10 [ 1635.580412][T25030] ? __lock_acquire+0xab9/0xd20 [ 1635.580447][T25030] should_fail_ex+0x414/0x560 [ 1635.580481][T25030] should_failslab+0xa8/0x100 [ 1635.580505][T25030] kmem_cache_alloc_noprof+0x73/0x3c0 [ 1635.580527][T25030] ? skb_clone+0x212/0x3a0 [ 1635.580551][T25030] skb_clone+0x212/0x3a0 [ 1635.580575][T25030] __netlink_deliver_tap+0x404/0x850 [ 1635.580607][T25030] ? netlink_deliver_tap+0x2e/0x1b0 [ 1635.580628][T25030] netlink_deliver_tap+0x19c/0x1b0 [ 1635.580647][T25030] netlink_unicast+0x7fa/0x9e0 [ 1635.580685][T25030] ? __pfx_netlink_unicast+0x10/0x10 [ 1635.580712][T25030] ? netlink_sendmsg+0x642/0xb30 [ 1635.580729][T25030] ? skb_put+0x11b/0x210 [ 1635.580750][T25030] netlink_sendmsg+0x805/0xb30 [ 1635.580779][T25030] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1635.580802][T25030] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1635.580820][T25030] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1635.580837][T25030] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1635.580857][T25030] __sock_sendmsg+0x219/0x270 [ 1635.580886][T25030] ____sys_sendmsg+0x505/0x830 [ 1635.580913][T25030] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1635.580941][T25030] ? import_iovec+0x74/0xa0 [ 1635.580969][T25030] ___sys_sendmsg+0x21f/0x2a0 [ 1635.580992][T25030] ? __pfx____sys_sendmsg+0x10/0x10 [ 1635.581051][T25030] ? __fget_files+0x2a/0x420 [ 1635.581066][T25030] ? __fget_files+0x3a0/0x420 [ 1635.581093][T25030] __x64_sys_sendmsg+0x19b/0x260 [ 1635.581120][T25030] ? __pfx___x64_sys_sendmsg+0x10/0x10 [ 1635.581153][T25030] ? __pfx_ksys_write+0x10/0x10 [ 1635.581173][T25030] ? rcu_is_watching+0x15/0xb0 [ 1635.581197][T25030] ? do_syscall_64+0xbe/0x3b0 [ 1635.581221][T25030] do_syscall_64+0xfa/0x3b0 [ 1635.581240][T25030] ? lockdep_hardirqs_on+0x9c/0x150 [ 1635.581259][T25030] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1635.581276][T25030] ? clear_bhb_loop+0x60/0xb0 [ 1635.581298][T25030] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1635.581314][T25030] RIP: 0033:0x7fc92ad8eec9 [ 1635.581331][T25030] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1635.581347][T25030] RSP: 002b:00007fc92bbe7038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1635.581367][T25030] RAX: ffffffffffffffda RBX: 00007fc92afe5fa0 RCX: 00007fc92ad8eec9 [ 1635.581381][T25030] RDX: 0000000000000000 RSI: 0000200000006040 RDI: 0000000000000006 [ 1635.581394][T25030] RBP: 00007fc92bbe7090 R08: 0000000000000000 R09: 0000000000000000 [ 1635.581405][T25030] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1635.581416][T25030] R13: 00007fc92afe6038 R14: 00007fc92afe5fa0 R15: 00007fc92b10fa28 [ 1635.581447][T25030] [ 1635.934739][T25028] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1636.764647][T25045] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4641'. [ 1636.945894][T25047] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1636.954376][ T43] usb 6-1: new high-speed USB device number 79 using dummy_hcd [ 1637.028965][T25047] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1637.221887][ T43] usb 6-1: config 3 has an invalid descriptor of length 0, skipping remainder of the config [ 1637.332860][ T43] usb 6-1: config 3 has 1 interface, different from the descriptor's value: 2 [ 1637.417328][ T43] usb 6-1: config 3 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1637.560074][T25061] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1637.583604][ T43] usb 6-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1637.646435][ T43] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1637.698995][ T43] usb 6-1: Product: syz [ 1637.711943][ T43] usb 6-1: Manufacturer: syz [ 1637.748285][ T43] usb 6-1: SerialNumber: syz [ 1637.791160][ T43] cdc_ncm 6-1:3.0: CDC Union missing and no IAD found [ 1637.802563][ T43] cdc_ncm 6-1:3.0: bind() failure [ 1637.985490][T25041] sctp: [Deprecated]: syz.5.4640 (pid 25041) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1637.985490][T25041] Use struct sctp_sack_info instead [ 1638.096739][ T5934] net_ratelimit: 328 callbacks suppressed [ 1638.096757][ T5934] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1638.131627][T24819] usb 6-1: USB disconnect, device number 79 [ 1638.178808][T25077] bridge0: port 1(bridge_slave_0) entered disabled state [ 1640.082027][T25108] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4654'. [ 1640.388499][T25113] netlink: 24 bytes leftover after parsing attributes in process `syz.1.4655'. [ 1640.834357][T25119] netlink: 76 bytes leftover after parsing attributes in process `syz.2.4656'. [ 1640.965930][T25123] fuse: Bad value for 'fd' [ 1641.724387][T25133] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1641.795562][T25133] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1642.390405][T25139] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.710579][T25142] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1643.125908][T25145] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1643.165631][T25145] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1643.290026][T25147] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1643.444391][T25147] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1643.502331][T25147] binder: 25144:25147 ioctl c0306201 200000000440 returned -14 [ 1643.581479][T25158] netlink: 8 bytes leftover after parsing attributes in process `syz.2.4666'. [ 1645.025761][T13397] usb 3-1: new full-speed USB device number 12 using dummy_hcd [ 1645.169643][T13397] usb 3-1: device descriptor read/64, error -71 [ 1645.435668][T13397] usb 3-1: new full-speed USB device number 13 using dummy_hcd [ 1645.564716][ T24] usb 6-1: new high-speed USB device number 80 using dummy_hcd [ 1645.575024][T13397] usb 3-1: device descriptor read/64, error -71 [ 1645.700824][T13397] usb usb3-port1: attempt power cycle [ 1645.734883][ T24] usb 6-1: Using ep0 maxpacket: 16 [ 1645.746783][ T24] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1645.758001][ T24] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1645.775782][ T24] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1645.814372][ T24] usb 6-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1645.832853][ T24] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1645.844779][ T24] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1645.873243][ T24] usb 6-1: Product: syz [ 1645.890267][ T24] usb 6-1: Manufacturer: syz [ 1645.902609][ T24] usb 6-1: SerialNumber: syz [ 1646.064917][T13397] usb 3-1: new full-speed USB device number 14 using dummy_hcd [ 1646.222356][T13397] usb 3-1: device descriptor read/8, error -71 [ 1646.416497][T25177] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1646.430160][T25173] binder_alloc: binder_alloc_mmap_handler: 25172 200000ffc000-200001000000 already mapped failed -16 [ 1646.515218][T13397] usb 3-1: new full-speed USB device number 15 using dummy_hcd [ 1646.556933][T13397] usb 3-1: device descriptor read/8, error -71 [ 1646.687395][T13397] usb usb3-port1: unable to enumerate USB device [ 1647.583365][ T24] usb 6-1: USB disconnect, device number 80 [ 1647.693237][T19059] udevd[19059]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1647.710528][T24819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1647.720138][T25193] fuse: Bad value for 'fd' [ 1648.779930][T25205] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4679'. [ 1648.850563][T25205] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1649.020360][ T30] audit: type=1326 audit(1759009797.725:1731): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.173117][ T30] audit: type=1326 audit(1759009797.745:1732): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.361342][ T30] audit: type=1326 audit(1759009797.745:1733): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=206 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.449711][ T30] audit: type=1326 audit(1759009797.745:1734): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.517843][ T30] audit: type=1326 audit(1759009797.745:1735): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.580850][ T30] audit: type=1326 audit(1759009797.755:1736): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=209 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.623843][ T30] audit: type=1326 audit(1759009797.755:1737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.648292][ T30] audit: type=1326 audit(1759009797.755:1738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.673243][ T30] audit: type=1326 audit(1759009797.755:1739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1649.804728][ T30] audit: type=1326 audit(1759009797.755:1740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25204 comm="syz.2.4679" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f65b238eec9 code=0x7ffc0000 [ 1650.402052][T25223] netlink: del zone limit has 4 unknown bytes [ 1650.471059][T25230] kvm_intel: set kvm_intel.dump_invalid_vmcs=1 to dump internal KVM state. [ 1650.775309][T25238] netlink: 'syz.2.4689': attribute type 1 has an invalid length. [ 1651.190959][T25241] bond0: (slave bridge2): making interface the new active one [ 1651.276297][T25241] bond0: (slave bridge2): Enslaving as an active interface with an up link [ 1651.500919][T24819] usb 6-1: new high-speed USB device number 81 using dummy_hcd [ 1651.838671][T24819] usb 6-1: Using ep0 maxpacket: 16 [ 1651.866756][T24819] usb 6-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1651.897795][T24819] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1651.940977][T24819] usb 6-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1651.981020][T24819] usb 6-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1652.010928][T21213] usb 3-1: new high-speed USB device number 16 using dummy_hcd [ 1652.054943][T24819] usb 6-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1652.065821][T24819] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1652.073825][T24819] usb 6-1: Product: syz [ 1652.114421][T24819] usb 6-1: Manufacturer: syz [ 1652.159857][T24819] usb 6-1: SerialNumber: syz [ 1652.175643][T21213] usb 3-1: Using ep0 maxpacket: 8 [ 1652.189340][T21213] usb 3-1: New USB device found, idVendor=0c45, idProduct=613a, bcdDevice=c4.6d [ 1652.200007][T21213] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1652.219682][T21213] usb 3-1: Product: syz [ 1652.229838][T21213] usb 3-1: Manufacturer: syz [ 1652.239952][T21213] usb 3-1: SerialNumber: syz [ 1652.276710][T21213] usb 3-1: config 0 descriptor?? [ 1652.860077][T21213] gspca_main: sonixj-2.14.0 probing 0c45:613a [ 1652.932523][T25244] binder_alloc: binder_alloc_mmap_handler: 25243 200000ffc000-200001000000 already mapped failed -16 [ 1652.965486][T21213] gspca_sonixj: reg_w1 err -71 [ 1652.970365][T21213] sonixj 3-1:0.0: probe with driver sonixj failed with error -71 [ 1653.051157][T25262] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1653.106634][T21213] usb 3-1: USB disconnect, device number 16 [ 1653.167991][T25262] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1653.667423][T25265] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4695'. [ 1654.362259][T24819] usb 6-1: USB disconnect, device number 81 [ 1654.514411][T19059] udevd[19059]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1656.106217][T25297] batadv_slave_1: entered promiscuous mode [ 1656.115809][T25297] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1657.011789][T25292] batadv_slave_1: left promiscuous mode [ 1657.336631][T24819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1658.507261][T25327] loop5: detected capacity change from 0 to 7 [ 1658.821052][T25327] Dev loop5: unable to read RDB block 7 [ 1659.064541][T25327] loop5: unable to read partition table [ 1659.070436][T25327] loop5: partition table beyond EOD, truncated [ 1659.164523][T25327] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1660.268770][T25355] netlink: 8 bytes leftover after parsing attributes in process `syz.1.4720'. [ 1660.330809][T25355] netlink: 312 bytes leftover after parsing attributes in process `syz.1.4720'. [ 1660.383734][T25355] netlink: 'syz.1.4720': attribute type 1 has an invalid length. [ 1660.944622][T24819] usb 3-1: new high-speed USB device number 17 using dummy_hcd [ 1661.175687][T24819] usb 3-1: Using ep0 maxpacket: 8 [ 1661.220413][T24819] usb 3-1: unable to get BOS descriptor or descriptor too short [ 1661.256211][T24819] usb 3-1: unable to read config index 0 descriptor/start: -71 [ 1661.286777][T24819] usb 3-1: can't read configurations, error -71 [ 1661.358961][T25371] loop5: detected capacity change from 0 to 7 [ 1661.417094][T25371] Dev loop5: unable to read RDB block 7 [ 1661.435275][T25371] loop5: unable to read partition table [ 1661.441180][T25371] loop5: partition table beyond EOD, truncated [ 1661.514566][T25371] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1661.735154][T25372] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1661.836623][T25372] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1662.145811][T25385] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4731'. [ 1662.354837][T24819] usb 3-1: new high-speed USB device number 18 using dummy_hcd [ 1662.474635][ T5933] usb 6-1: new low-speed USB device number 82 using dummy_hcd [ 1662.546337][T24819] usb 3-1: Using ep0 maxpacket: 16 [ 1662.627978][ T5933] usb 6-1: config index 0 descriptor too short (expected 1307, got 27) [ 1662.643441][T24819] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1662.664860][ T5933] usb 6-1: config 0 has an invalid interface number: 0 but max is -1 [ 1662.708559][T24819] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1662.729119][ T5933] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1662.774524][T24819] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1662.804019][ T5933] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 0 [ 1662.864530][T24819] usb 3-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1662.890737][ T5933] usb 6-1: string descriptor 0 read error: -22 [ 1662.925477][ T5933] usb 6-1: New USB device found, idVendor=0460, idProduct=0008, bcdDevice=e2.de [ 1662.950503][T24819] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1663.007135][T24819] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1663.025021][ T5933] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1663.033135][T24819] usb 3-1: Product: syz [ 1663.039258][T24819] usb 3-1: Manufacturer: syz [ 1663.043961][T24819] usb 3-1: SerialNumber: syz [ 1663.100260][ T5933] usb 6-1: config 0 descriptor?? [ 1663.148729][ T5933] hub 6-1:0.0: bad descriptor, ignoring hub [ 1663.164985][ T5933] hub 6-1:0.0: probe with driver hub failed with error -5 [ 1663.231768][T25392] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4732'. [ 1663.483052][ T5934] usb 6-1: USB disconnect, device number 82 [ 1663.533473][T25381] binder_alloc: binder_alloc_mmap_handler: 25379 200000ffc000-200001000000 already mapped failed -16 [ 1664.335595][T13397] usb 6-1: new high-speed USB device number 83 using dummy_hcd [ 1664.356720][T25401] netlink: 32 bytes leftover after parsing attributes in process `syz.7.4733'. [ 1664.356780][T25401] netlink: 152 bytes leftover after parsing attributes in process `syz.7.4733'. [ 1664.357615][T25401] netlink: 152 bytes leftover after parsing attributes in process `syz.7.4733'. [ 1664.495008][T13397] usb 6-1: Using ep0 maxpacket: 32 [ 1664.497822][T13397] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1664.497848][T13397] usb 6-1: config 0 has no interface number 0 [ 1664.500473][T13397] usb 6-1: New USB device found, idVendor=8086, idProduct=9500, bcdDevice=2c.d8 [ 1664.500500][T13397] usb 6-1: New USB device strings: Mfr=193, Product=2, SerialNumber=3 [ 1664.500522][T13397] usb 6-1: Product: syz [ 1664.500538][T13397] usb 6-1: Manufacturer: syz [ 1664.500553][T13397] usb 6-1: SerialNumber: syz [ 1664.528413][T13397] usb 6-1: config 0 descriptor?? [ 1664.533150][T13397] usb 6-1: dvb_usb_v2: found a 'Intel CE9500 reference design' in warm state [ 1664.533177][T13397] usb 6-1: selecting invalid altsetting 1 [ 1664.533194][T13397] usb 6-1: dvb_usb_ce6230: usb_set_interface() failed=-22 [ 1664.570263][T13397] usb 6-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1664.570681][T13397] dvbdev: DVB: registering new adapter (Intel CE9500 reference design) [ 1664.570758][T13397] usb 6-1: media controller created [ 1664.637199][T13397] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1665.873940][T25416] loop5: detected capacity change from 0 to 7 [ 1665.907666][T24819] usb 3-1: USB disconnect, device number 18 [ 1665.930644][T25416] Dev loop5: unable to read RDB block 7 [ 1665.936707][T13397] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-110 [ 1665.975589][T13397] zl10353_read_register: readreg error (reg=127, ret==-110) [ 1665.998645][T25406] usb 6-1: dvb_usb_ce6230: usb_control_msg() failed=-32 [ 1666.010868][T25416] loop5: unable to read partition table [ 1666.051514][T19059] udevd[19059]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1666.077999][T25416] loop5: partition table beyond EOD, truncated [ 1666.121453][T25416] loop_reread_partitions: partition scan of loop5 (þ被xü—ŸÑà– ) failed (rc=-5) [ 1666.763797][T25429] gtp5: entered promiscuous mode [ 1666.812175][T25429] gtp5: entered allmulticast mode [ 1666.897464][ T6023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1666.956436][ T7808] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1666.966021][T24819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1666.984425][ T6023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1667.585202][T25446] syzkaller0: entered promiscuous mode [ 1667.603023][T25446] syzkaller0: entered allmulticast mode [ 1667.855173][T13397] usb 6-1: USB disconnect, device number 83 [ 1668.165132][ T30] kauditd_printk_skb: 22 callbacks suppressed [ 1668.165150][ T30] audit: type=1326 audit(1759009816.865:1763): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.224549][ T30] audit: type=1326 audit(1759009816.865:1764): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.282229][ T30] audit: type=1326 audit(1759009816.905:1765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.459226][ T30] audit: type=1326 audit(1759009816.915:1766): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.644942][ T30] audit: type=1326 audit(1759009816.915:1767): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.718188][ T30] audit: type=1326 audit(1759009816.915:1768): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.740937][T16101] Bluetooth: hci5: command 0x0405 tx timeout [ 1668.801395][ T30] audit: type=1326 audit(1759009816.915:1769): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.840293][ T1300] ieee802154 phy0 wpan0: encryption failed: -22 [ 1668.846719][ T1300] ieee802154 phy1 wpan1: encryption failed: -22 [ 1668.896646][ T30] audit: type=1326 audit(1759009816.915:1770): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1668.959018][ T30] audit: type=1326 audit(1759009816.915:1771): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1669.034536][ T30] audit: type=1326 audit(1759009816.915:1772): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25454 comm="syz.7.4750" exe="/root/syz-executor" sig=0 arch=c000003e syscall=54 compat=0 ip=0x7f27f098eec9 code=0x7ffc0000 [ 1669.294864][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1669.755244][T13397] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1669.975277][T13397] usb 3-1: Using ep0 maxpacket: 16 [ 1670.035263][T25488] gtp0: entered promiscuous mode [ 1670.062175][T25488] gtp0: entered allmulticast mode [ 1670.112793][T13397] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1670.253994][T25493] sctp: [Deprecated]: syz.8.4759 (pid 25493) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1670.253994][T25493] Use struct sctp_sack_info instead [ 1670.275289][T13397] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 1670.327538][T13397] usb 3-1: New USB device found, idVendor=045e, idProduct=fc40, bcdDevice=72.a8 [ 1670.440577][T13397] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1670.576003][T13397] usb 3-1: config 0 descriptor?? [ 1670.623048][T13397] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1670.673946][T25502] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1670.729826][T25502] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1670.781571][T25502] binder: 25498:25502 ioctl c02054a5 200000000580 returned -22 [ 1670.853663][T16101] Bluetooth: hci5: command 0x0405 tx timeout [ 1671.000819][T25502] binder_alloc: 25498: binder_alloc_buf, no vma [ 1672.204386][T25522] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1672.325581][T25524] netlink: 3 bytes leftover after parsing attributes in process `syz.7.4767'. [ 1672.554200][T25527] netlink: 52 bytes leftover after parsing attributes in process `syz.5.4768'. [ 1672.657386][ T1323] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1672.667476][T21213] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1672.679059][ T5933] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1673.818723][T21213] usb 3-1: USB disconnect, device number 19 [ 1674.194337][T25549] gtp6: entered promiscuous mode [ 1674.226803][T25549] gtp6: entered allmulticast mode [ 1674.589384][T25559] netlink: 12 bytes leftover after parsing attributes in process `syz.1.4777'. [ 1675.414567][ T43] usb 3-1: new high-speed USB device number 20 using dummy_hcd [ 1675.732006][ T43] usb 3-1: Using ep0 maxpacket: 16 [ 1675.742490][ T43] usb 3-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1675.762747][ T43] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has an invalid bInterval 0, changing to 7 [ 1675.804362][ T43] usb 3-1: config 1 interface 1 altsetting 1 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1675.808060][T25559] syz.1.4777 (25559): drop_caches: 2 [ 1675.981746][ T43] usb 3-1: Duplicate descriptor for config 1 interface 0 altsetting 0, skipping [ 1675.986019][T25575] FAULT_INJECTION: forcing a failure. [ 1675.986019][T25575] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1676.024418][ T43] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1676.024511][T10105] Bluetooth: hci3: command 0x0406 tx timeout [ 1676.056816][T25575] CPU: 1 UID: 0 PID: 25575 Comm: syz.5.4781 Not tainted syzkaller #0 PREEMPT(full) [ 1676.056834][T25575] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1676.056842][T25575] Call Trace: [ 1676.056847][T25575] [ 1676.056853][T25575] dump_stack_lvl+0x189/0x250 [ 1676.056870][T25575] ? __pfx____ratelimit+0x10/0x10 [ 1676.056882][T25575] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1676.056895][T25575] ? __pfx__printk+0x10/0x10 [ 1676.056909][T25575] ? __might_fault+0xb0/0x130 [ 1676.056929][T25575] should_fail_ex+0x414/0x560 [ 1676.056947][T25575] copy_fpstate_to_sigframe+0xa8d/0xce0 [ 1676.056965][T25575] ? copy_fpstate_to_sigframe+0x181/0xce0 [ 1676.056982][T25575] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1676.056997][T25575] ? seqcount_lockdep_reader_access+0x15f/0x1c0 [ 1676.057019][T25575] ? __lock_acquire+0xab9/0xd20 [ 1676.057037][T25575] ? fpu__alloc_mathframe+0xad/0x130 [ 1676.057052][T25575] get_sigframe+0x58d/0x7d0 [ 1676.057070][T25575] ? __pfx_get_sigframe+0x10/0x10 [ 1676.057086][T25575] ? posixtimer_deliver_signal+0x305/0x410 [ 1676.057102][T25575] x64_setup_rt_frame+0x15b/0xd40 [ 1676.057120][T25575] ? lockdep_hardirqs_on+0x9c/0x150 [ 1676.057131][T25575] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1676.057141][T25575] ? get_signal+0x1151/0x1340 [ 1676.057155][T25575] ? __pfx_x64_setup_rt_frame+0x10/0x10 [ 1676.057174][T25575] arch_do_signal_or_restart+0x3d7/0x750 [ 1676.057189][T25575] ? __fget_files+0x3a0/0x420 [ 1676.057200][T25575] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1676.057222][T25575] ? exit_to_user_mode_loop+0x40/0x110 [ 1676.057238][T25575] exit_to_user_mode_loop+0x75/0x110 [ 1676.057252][T25575] do_syscall_64+0x2bd/0x3b0 [ 1676.057265][T25575] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1676.057274][T25575] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1676.057284][T25575] ? clear_bhb_loop+0x60/0xb0 [ 1676.057295][T25575] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1676.057305][T25575] RIP: 0033:0x7f8e57f8d97f [ 1676.057316][T25575] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1676.057325][T25575] RSP: 002b:00007f8e561f6030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1676.057336][T25575] RAX: 0000000000000001 RBX: 0000000000000003 RCX: 00007f8e57f8d97f [ 1676.057343][T25575] RDX: 0000000000000001 RSI: 00007f8e561f6090 RDI: 0000000000000003 [ 1676.057349][T25575] RBP: 00007f8e561f6090 R08: 0000000000000000 R09: 00007f8e561f5df7 [ 1676.057356][T25575] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1676.057362][T25575] R13: 00007f8e581e6038 R14: 00007f8e581e5fa0 R15: 00007f8e5830fa28 [ 1676.057377][T25575] [ 1676.324290][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1676.333695][ T43] usb 3-1: Product: syz [ 1676.338549][ T43] usb 3-1: Manufacturer: syz [ 1676.343185][ T43] usb 3-1: SerialNumber: syz [ 1676.659123][T25581] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4784'. [ 1676.790965][T25570] binder_alloc: binder_alloc_mmap_handler: 25566 200000ffc000-200001000000 already mapped failed -16 [ 1677.084696][ T5933] usb 6-1: new full-speed USB device number 84 using dummy_hcd [ 1677.274827][ T5933] usb 6-1: too many configurations: 68, using maximum allowed: 8 [ 1677.284521][ T5933] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1677.327216][ T5933] usb 6-1: can't read configurations, error -61 [ 1677.387560][T25593] netlink: 4 bytes leftover after parsing attributes in process `syz.1.4788'. [ 1677.464893][ T5933] usb 6-1: new full-speed USB device number 85 using dummy_hcd [ 1677.546565][T25597] gtp0: entered promiscuous mode [ 1677.551581][T25597] gtp0: entered allmulticast mode [ 1677.557148][T25601] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1677.558139][T25601] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1677.592778][T25598] netlink: 'syz.7.4787': attribute type 5 has an invalid length. [ 1677.618391][T25598] ip6erspan0: entered promiscuous mode [ 1677.644020][T25598] bridge0: port 3(macsec0) entered blocking state [ 1677.653652][T25598] bridge0: port 3(macsec0) entered disabled state [ 1677.661079][T25598] macsec0: entered allmulticast mode [ 1677.666825][T25598] veth1_macvtap: entered allmulticast mode [ 1677.675840][T25598] macsec0: entered promiscuous mode [ 1677.689869][T25598] bridge0: port 3(macsec0) entered blocking state [ 1677.697063][T25598] bridge0: port 3(macsec0) entered forwarding state [ 1677.706191][T25602] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1677.714765][ T5933] usb 6-1: too many configurations: 68, using maximum allowed: 8 [ 1677.727768][ T5933] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1677.735631][ T5933] usb 6-1: can't read configurations, error -61 [ 1677.742409][ T5933] usb usb6-port1: attempt power cycle [ 1677.762392][T25602] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1678.095455][ T5933] usb 6-1: new full-speed USB device number 86 using dummy_hcd [ 1678.132150][ T5933] usb 6-1: too many configurations: 68, using maximum allowed: 8 [ 1678.158615][ T5933] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1678.168103][ T5933] usb 6-1: can't read configurations, error -61 [ 1678.416880][ T13] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1678.433927][ T6023] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1678.443252][T24819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1678.504552][ T5933] usb 6-1: new full-speed USB device number 87 using dummy_hcd [ 1678.555280][ T5933] usb 6-1: too many configurations: 68, using maximum allowed: 8 [ 1678.580085][ T5933] usb 6-1: unable to read config index 0 descriptor/start: -61 [ 1678.594678][ T5933] usb 6-1: can't read configurations, error -61 [ 1678.629948][ T5933] usb usb6-port1: unable to enumerate USB device [ 1678.769294][ T43] usb 3-1: USB disconnect, device number 20 [ 1678.954043][T19059] udevd[19059]: error opening ATTR{/sys/devices/platform/dummy_hcd.2/usb3/3-1/3-1:1.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1679.425147][ T43] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1679.605460][ T43] usb 3-1: Using ep0 maxpacket: 32 [ 1679.622816][ T43] usb 3-1: config 0 has an invalid interface number: 85 but max is 0 [ 1679.641624][ T43] usb 3-1: config 0 has no interface number 0 [ 1679.671857][ T43] usb 3-1: config 0 interface 85 altsetting 7 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 1679.734988][ T43] usb 3-1: config 0 interface 85 has no altsetting 0 [ 1679.765152][ T43] usb 3-1: New USB device found, idVendor=05ac, idProduct=0219, bcdDevice=f0.72 [ 1679.787034][ T43] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1679.813434][ T43] usb 3-1: Product: syz [ 1679.831916][ T43] usb 3-1: Manufacturer: syz [ 1679.859237][ T43] usb 3-1: SerialNumber: syz [ 1679.882642][ T43] usb 3-1: config 0 descriptor?? [ 1680.154676][T25620] netlink: 8 bytes leftover after parsing attributes in process `syz.5.4796'. [ 1680.392972][ T43] appletouch 3-1:0.85: Geyser mode initialized. [ 1680.421247][ T43] input: appletouch as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.85/input/input122 [ 1680.776118][ T24] usb 3-1: USB disconnect, device number 21 [ 1680.804361][ T24] appletouch 3-1:0.85: input: appletouch disconnected [ 1681.264628][T24819] usb 6-1: new low-speed USB device number 88 using dummy_hcd [ 1681.404379][T25636] bridge0: port 1(bridge_slave_0) entered disabled state [ 1681.434645][T24819] usb 6-1: config 32 has 1 interface, different from the descriptor's value: 2 [ 1681.443746][T24819] usb 6-1: config 32 interface 0 altsetting 0 endpoint 0x85 has an invalid bInterval 0, changing to 10 [ 1681.492661][T24819] usb 6-1: config 32 interface 0 altsetting 0 endpoint 0x85 has invalid maxpacket 255, setting to 8 [ 1681.524913][T24819] usb 6-1: New USB device found, idVendor=19b5, idProduct=0021, bcdDevice=98.c7 [ 1681.533986][T24819] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1681.617305][T25634] raw-gadget.2 gadget.5: fail, usb_ep_enable returned -22 [ 1681.876304][T25638] gtp7: entered promiscuous mode [ 1681.935446][T25638] gtp7: entered allmulticast mode [ 1682.010573][T25642] lo: entered promiscuous mode [ 1682.017272][T25642] tunl0: entered promiscuous mode [ 1682.058048][T25642] gre0: entered promiscuous mode [ 1682.065234][T25642] gretap0: entered promiscuous mode [ 1682.071405][T25642] erspan0: entered promiscuous mode [ 1682.078133][T25642] ip_vti0: entered promiscuous mode [ 1682.084399][T25642] ip6_vti0: entered promiscuous mode [ 1682.091577][T25642] sit0: entered promiscuous mode [ 1682.098516][T25642] ip6tnl0: entered promiscuous mode [ 1682.105598][T25642] ip6gre0: entered promiscuous mode [ 1682.111902][T25642] syz_tun: entered promiscuous mode [ 1682.118736][T25642] ip6gretap0: entered promiscuous mode [ 1682.126233][T25642] bridge0: entered promiscuous mode [ 1682.132375][T25642] vcan0: entered promiscuous mode [ 1682.138776][T25642] bond0: entered promiscuous mode [ 1682.143905][T25642] bond_slave_0: entered promiscuous mode [ 1682.150571][T25642] bond_slave_1: entered promiscuous mode [ 1682.161510][T25642] team0: entered promiscuous mode [ 1682.170281][T25642] team_slave_0: entered promiscuous mode [ 1682.176344][T25642] team_slave_1: entered promiscuous mode [ 1682.184157][T25642] dummy0: entered promiscuous mode [ 1682.193139][T25642] nlmon0: entered promiscuous mode [ 1682.225208][T25642] 0ªX¹¦À: entered promiscuous mode [ 1682.243324][T25642] 0ªX¹¦À: left allmulticast mode [ 1682.250530][T25642] A link change request failed with some changes committed already. Interface 60ªX¹¦À may have been left with an inconsistent configuration, please check. [ 1682.570209][T25648] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1682.595776][T25648] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1682.921446][T25648] binder_alloc: binder_alloc_mmap_handler: 25644 200000ffc000-200001000000 already mapped failed -16 [ 1683.197838][T25657] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1684.905303][T25676] bridge0: port 1(bridge_slave_0) entered disabled state [ 1685.075488][T25678] netlink: 8 bytes leftover after parsing attributes in process `syz.8.4813'. [ 1685.262326][T25680] gtp0: entered promiscuous mode [ 1685.330768][T25680] gtp0: entered allmulticast mode [ 1685.389050][T25683] fuse: Bad value for 'fd' [ 1685.415501][T24819] usb 6-1: string descriptor 0 read error: -71 [ 1685.580829][T24819] usb 6-1: USB disconnect, device number 88 [ 1685.673334][T25685] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1686.954480][T25708] bridge0: port 1(bridge_slave_0) entered disabled state [ 1687.196914][ T30] kauditd_printk_skb: 55 callbacks suppressed [ 1687.196934][ T30] audit: type=1326 audit(1759009835.845:1828): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=25709 comm="syz.2.4826" exe="/root/syz-executor" sig=9 arch=c000003e syscall=231 compat=0 ip=0x7f65b238eec9 code=0x0 [ 1687.365912][T25718] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1687.376495][ C1] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1687.694525][ T5933] usb 6-1: new high-speed USB device number 89 using dummy_hcd [ 1687.869039][ T5933] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1687.911259][ T5933] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x4 has invalid wMaxPacketSize 0 [ 1688.008770][ T5933] usb 6-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1688.023060][T24819] GRED: Unable to relocate VQ 0x0 after dequeue, screwing up backlog [ 1688.275428][ T5933] usb 6-1: New USB device found, idVendor=2294, idProduct=425a, bcdDevice=d1.41 [ 1688.334250][ T5933] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1688.497023][ T5933] usb 6-1: Product: syz [ 1688.501217][ T5933] usb 6-1: Manufacturer: syz [ 1688.576714][ T5933] usb 6-1: SerialNumber: syz [ 1688.640310][ T5933] usb 6-1: config 0 descriptor?? [ 1688.686744][ T5933] usb 6-1: ucan: probing device on interface #0 [ 1688.755900][ T5933] usb 6-1: ucan: invalid EP count (1) [ 1688.761314][ T5933] usb 6-1: ucan: probe failed; try to update the device firmware [ 1690.680313][T25769] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4842'. [ 1690.725289][T13397] usb 6-1: USB disconnect, device number 89 [ 1691.116616][T25769] bridge0: port 2(bridge_slave_1) entered disabled state [ 1691.214747][ T31] INFO: task syz.4.4377:23889 blocked for more than 143 seconds. [ 1691.245051][ T43] usb 6-1: new high-speed USB device number 90 using dummy_hcd [ 1691.265121][ T31] Not tainted syzkaller #0 [ 1691.273158][ T31] Blocked by coredump. [ 1691.278789][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 1691.312568][ T31] task:syz.4.4377 state:D stack:25512 pid:23889 tgid:23888 ppid:18858 task_flags:0x400448 flags:0x00024000 [ 1691.337500][ T31] Call Trace: [ 1691.340997][ T31] [ 1691.344128][ T31] __schedule+0x1798/0x4cc0 [ 1691.353343][ T31] ? __pfx___schedule+0x10/0x10 [ 1691.423138][ T43] usb 6-1: New USB device found, idVendor=0df6, idProduct=0056, bcdDevice=a0.b5 [ 1691.445412][ T43] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1691.472208][ T43] usb 6-1: config 0 descriptor?? [ 1691.486963][ T31] ? schedule+0x91/0x360 [ 1691.504306][ T31] schedule+0x165/0x360 [ 1691.527008][ T31] schedule_timeout+0x9a/0x270 [ 1691.541599][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 1691.548117][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1691.559561][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1691.567108][ T31] ? wait_for_completion+0x267/0x5d0 [ 1691.573656][ T31] wait_for_completion+0x2bf/0x5d0 [ 1691.643858][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 1691.670098][ T31] ? io_wq_put_and_exit+0x160/0x650 [ 1691.689858][ T31] ? io_wq_put_and_exit+0x160/0x650 [ 1691.699855][ T31] io_wq_put_and_exit+0x316/0x650 [ 1691.733150][ T43] asix 6-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 1691.749686][ T31] io_uring_clean_tctx+0x11f/0x1a0 [ 1691.780681][ T31] ? __pfx_io_uring_clean_tctx+0x10/0x10 [ 1691.795407][ T31] ? io_uring_drop_tctx_refs+0x131/0x1c0 [ 1691.828554][ T31] io_uring_cancel_generic+0x6ca/0x7d0 [ 1691.851778][ T31] ? __pfx_io_uring_cancel_generic+0x10/0x10 [ 1691.880634][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 1691.913343][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1691.937211][ T31] ? io_uring_unreg_ringfd+0x52f/0x540 [ 1691.942965][ T31] do_exit+0x345/0x2300 [ 1691.960308][ T31] ? do_raw_spin_lock+0x121/0x290 [ 1691.968086][ T31] ? __pfx_do_exit+0x10/0x10 [ 1691.972811][ T31] do_group_exit+0x21c/0x2d0 [ 1691.984241][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1692.175582][ T31] get_signal+0x1286/0x1340 [ 1692.184270][ T31] arch_do_signal_or_restart+0x9a/0x750 [ 1692.192465][ T31] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1692.201804][ T31] ? exit_to_user_mode_loop+0x40/0x110 [ 1692.215468][ T31] exit_to_user_mode_loop+0x75/0x110 [ 1692.222701][ T31] do_syscall_64+0x2bd/0x3b0 [ 1692.229909][ T31] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1692.239558][ T31] ? asm_sysvec_apic_timer_interrupt+0x1a/0x20 [ 1692.252971][ T31] ? clear_bhb_loop+0x60/0xb0 [ 1692.260177][ T31] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1692.268423][ T31] RIP: 0033:0x7fc7e058eec9 [ 1692.274339][ T31] RSP: 002b:00007fc7e14620e8 EFLAGS: 00000246 ORIG_RAX: 00000000000000ca [ 1692.286887][ T31] RAX: fffffffffffffe00 RBX: 00007fc7e07e5fa8 RCX: 00007fc7e058eec9 [ 1692.299342][ T31] RDX: 0000000000000000 RSI: 0000000000000080 RDI: 00007fc7e07e5fa8 [ 1692.312186][ T31] RBP: 00007fc7e07e5fa0 R08: 0000000000000000 R09: 0000000000000000 [ 1692.382197][ T31] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 1692.445778][ T43] asix 6-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -71 [ 1692.549180][ T31] R13: 00007fc7e07e6038 R14: 00007fc7e090f940 R15: 00007fc7e090fa28 [ 1692.700810][ T43] asix 6-1:0.0 (unnamed net_device) (uninitialized): Error reading PHY_ID register: ffffffb9 [ 1692.714150][ T31] [ 1692.770329][ T31] [ 1692.770329][ T31] Showing all locks held in the system: [ 1692.819023][ T43] asix 6-1:0.0: probe with driver asix failed with error -71 [ 1692.835461][ T31] 4 locks held by kworker/u8:1/13: [ 1692.840700][ T31] #0: ffff88801b2fe948 ((wq_completion)netns){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1692.869524][ T31] #1: ffffc90000127bc0 (net_cleanup_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1692.982425][ T43] usb 6-1: USB disconnect, device number 90 [ 1693.006984][ T31] #2: ffffffff8f52d2f0 (pernet_ops_rwsem){++++}-{4:4}, at: cleanup_net+0xf7/0x800 [ 1693.143592][ T31] #3: ffffffff8f53a188 (rtnl_mutex){+.+.}-{4:4}, at: mpls_net_exit+0x79/0x270 [ 1693.229617][ T31] 1 lock held by khungtaskd/31: [ 1693.252162][ T31] #0: ffffffff8e13a120 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 1693.275280][ T31] 2 locks held by getty/5628: [ 1693.287758][ T31] #0: ffff88814e1590a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 1693.308240][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 1693.340388][ T31] 3 locks held by kworker/1:4/21213: [ 1693.397228][ T31] #0: ffff88801a480d48 ((wq_completion)events){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1693.454985][ T31] #1: ffffc9000448fbc0 (deferred_process_work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1693.474567][ T31] #2: ffffffff8f53a188 (rtnl_mutex){+.+.}-{4:4}, at: switchdev_deferred_process_work+0xe/0x20 [ 1693.495677][ T31] 2 locks held by iou-wrk-23889/23892: [ 1693.519831][ T31] 3 locks held by kworker/u8:7/25612: [ 1693.543854][ T31] #0: ffff88801a489148 ((wq_completion)events_unbound){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 1693.666109][ T31] #1: ffffc90003c0fbc0 ((linkwatch_work).work){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 1693.699263][ T31] #2: ffffffff8f53a188 (rtnl_mutex){+.+.}-{4:4}, at: linkwatch_event+0xe/0x60 [ 1693.714941][ T31] 1 lock held by syz.7.4841/25763: [ 1693.720151][ T31] #0: ffffffff8f53a188 (rtnl_mutex){+.+.}-{4:4}, at: tun_chr_close+0x3e/0x1c0 [ 1693.768407][ T31] 2 locks held by syz.2.4842/25769: [ 1693.789421][ T31] #0: ffffffff8f53a188 (rtnl_mutex){+.+.}-{4:4}, at: rtnl_newlink+0x8db/0x1c70 [ 1693.831721][ T31] #1: ffffffff8e13fbb8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 1693.871687][ T31] 2 locks held by syz.8.4846/25776: [ 1693.881988][ T31] #0: ffff888078a23208 (&sb->s_type->i_mutex_key#11){+.+.}-{4:4}, at: sock_close+0x9b/0x240 [ 1693.926075][ T31] #1: ffffffff8e13fbb8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x3b9/0x730 [ 1694.016133][ T31] 1 lock held by syz.8.4846/25778: [ 1694.094294][ T31] [ 1694.121060][ T31] ============================================= [ 1694.121060][ T31] [ 1694.129738][ T31] NMI backtrace for cpu 0 [ 1694.129754][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1694.129772][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1694.129782][ T31] Call Trace: [ 1694.129789][ T31] [ 1694.129797][ T31] dump_stack_lvl+0x189/0x250 [ 1694.129823][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1694.129844][ T31] ? __pfx__printk+0x10/0x10 [ 1694.129879][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 1694.129907][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 1694.129932][ T31] ? __pfx__printk+0x10/0x10 [ 1694.129958][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 1694.129978][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 1694.130003][ T31] watchdog+0xf93/0xfe0 [ 1694.130031][ T31] ? watchdog+0x1de/0xfe0 [ 1694.130057][ T31] kthread+0x711/0x8a0 [ 1694.130079][ T31] ? __pfx_watchdog+0x10/0x10 [ 1694.130099][ T31] ? __pfx_kthread+0x10/0x10 [ 1694.130120][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1694.130137][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1694.130153][ T31] ? __pfx_kthread+0x10/0x10 [ 1694.130174][ T31] ret_from_fork+0x439/0x7d0 [ 1694.130193][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1694.130222][ T31] ? __switch_to_asm+0x39/0x70 [ 1694.130241][ T31] ? __switch_to_asm+0x33/0x70 [ 1694.130260][ T31] ? __pfx_kthread+0x10/0x10 [ 1694.130279][ T31] ret_from_fork_asm+0x1a/0x30 [ 1694.130315][ T31] [ 1694.130323][ T31] Sending NMI from CPU 0 to CPUs 1: [ 1694.277748][ C1] NMI backtrace for cpu 1 [ 1694.277765][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 1694.277782][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1694.277793][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 1694.277815][ C1] Code: 53 e8 02 00 cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d b3 a9 0d 00 f3 0f 1e fa fb f4 cc cc cc cc cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 1694.277829][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c2 [ 1694.277844][ C1] RAX: 2316f4990a8c2c00 RBX: ffffffff81969528 RCX: 2316f4990a8c2c00 [ 1694.277857][ C1] RDX: 0000000000000001 RSI: ffffffff8d9ba5a7 RDI: ffffffff8be33f80 [ 1694.277869][ C1] RBP: ffffc90000197f20 R08: ffff8880b8732f9b R09: 1ffff110170e65f3 [ 1694.277881][ C1] R10: dffffc0000000000 R11: ffffed10170e65f4 R12: ffffffff8fa3a730 [ 1694.277893][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff110039d5b40 [ 1694.277904][ C1] FS: 0000000000000000(0000) GS:ffff888125d12000(0000) knlGS:0000000000000000 [ 1694.277917][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 1694.277929][ C1] CR2: 0000200001000000 CR3: 0000000040f62000 CR4: 00000000003526f0 [ 1694.277944][ C1] DR0: 0000000000006842 DR1: 0000000000000000 DR2: 0000000000000000 [ 1694.277954][ C1] DR3: 0000000000000000 DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 1694.277964][ C1] Call Trace: [ 1694.277972][ C1] [ 1694.277979][ C1] default_idle+0x13/0x20 [ 1694.277997][ C1] default_idle_call+0x74/0xb0 [ 1694.278015][ C1] do_idle+0x1e8/0x510 [ 1694.278034][ C1] ? __pfx_do_idle+0x10/0x10 [ 1694.278047][ C1] ? lockdep_hardirqs_on+0x9c/0x150 [ 1694.278071][ C1] cpu_startup_entry+0x44/0x60 [ 1694.278086][ C1] start_secondary+0x101/0x110 [ 1694.278108][ C1] common_startup_64+0x13e/0x147 [ 1694.278135][ C1] [ 1694.653265][T25612] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1694.666319][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 1694.673166][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 1694.682254][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 1694.692291][ T31] Call Trace: [ 1694.695562][ T31] [ 1694.698479][ T31] dump_stack_lvl+0x99/0x250 [ 1694.703055][ T31] ? __asan_memcpy+0x40/0x70 [ 1694.707628][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1694.712810][ T31] ? __pfx__printk+0x10/0x10 [ 1694.717388][ T31] vpanic+0x281/0x750 [ 1694.721353][ T31] ? __pfx_vpanic+0x10/0x10 [ 1694.725870][ T31] ? __x2apic_send_IPI_mask+0x1e4/0x260 [ 1694.731421][ T31] ? preempt_schedule+0xae/0xc0 [ 1694.736285][ T31] panic+0xb9/0xc0 [ 1694.740016][ T31] ? __pfx_panic+0x10/0x10 [ 1694.744439][ T31] ? __pfx_panic+0x10/0x10 [ 1694.748860][ T31] watchdog+0xfd2/0xfe0 [ 1694.753019][ T31] ? watchdog+0x1de/0xfe0 [ 1694.757351][ T31] kthread+0x711/0x8a0 [ 1694.761430][ T31] ? __pfx_watchdog+0x10/0x10 [ 1694.766113][ T31] ? __pfx_kthread+0x10/0x10 [ 1694.770706][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 1694.775886][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 1694.781063][ T31] ? __pfx_kthread+0x10/0x10 [ 1694.785628][ T31] ret_from_fork+0x439/0x7d0 [ 1694.790196][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 1694.795286][ T31] ? __switch_to_asm+0x39/0x70 [ 1694.800024][ T31] ? __switch_to_asm+0x33/0x70 [ 1694.804762][ T31] ? __pfx_kthread+0x10/0x10 [ 1694.809328][ T31] ret_from_fork_asm+0x1a/0x30 [ 1694.814077][ T31] [ 1694.817352][ T31] Kernel Offset: disabled [ 1694.821658][ T31] Rebooting in 86400 seconds..