last executing test programs:

14.405069717s ago: executing program 1 (id=243):
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x0)
mount$fuse(0x0, 0x0, 0x0, 0x2b38094, &(0x7f0000000400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=0x0])
mount(0x0, &(0x7f0000000380)='./file1\x00', &(0x7f0000000040)='autofs\x00', 0x0, &(0x7f0000000400))
chdir(&(0x7f0000000080)='./file1\x00')
r0 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0)
mkdir(&(0x7f0000000300)='./bus\x00', 0x0)
chdir(&(0x7f0000000140)='./bus\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000180)='./file1\x00', 0x0)
mkdir(&(0x7f0000000200)='./file0\x00', 0x0)
r1 = open(&(0x7f0000000000)='.\x00', 0x0, 0x0)
chdir(&(0x7f0000000140)='./file0\x00')
ioctl$LOOP_CTL_GET_FREE(r1, 0x4c82)
unlinkat(r1, &(0x7f0000000280)='./file0\x00', 0x200)
ioctl$AUTOFS_IOC_PROTOSUBVER(r0, 0x40049366, &(0x7f0000000180))
r2 = bpf$MAP_CREATE(0x0, &(0x7f0000000500)=ANY=[@ANYBLOB="0b00000005000000010001000900000001"], 0x48)
r3 = bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x11, 0xc, &(0x7f00000002c0)=ANY=[@ANYBLOB="1800e300"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f00000001c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sys_enter\x00', r3}, 0x18)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x10, 0xd, &(0x7f0000000040)=ANY=[@ANYBLOB="1801000000000000000000000000000085"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0xd, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
r4 = syz_io_uring_setup(0xd1, &(0x7f0000000480)={0x0, 0x2, 0x400, 0x0, 0x2d2}, &(0x7f0000000000)=<r5=>0x0, &(0x7f0000000340)=<r6=>0x0)
syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4)
mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1)
syz_io_uring_submit(r5, r6, &(0x7f0000000040)=@IORING_OP_READV=@pass_iovec={0x1, 0x8, 0x4007, @fd, 0x0, 0x0, 0x0, 0x0, 0x1})
r7 = socket$igmp(0x2, 0x3, 0x2)
setsockopt$ARPT_SO_SET_REPLACE(r7, 0x0, 0x60, &(0x7f00000000c0)={'filter\x00', 0x7, 0x4, 0x3c0, 0x1f0, 0x1f0, 0x108, 0x1f0, 0x2d8, 0x2d8, 0x4, 0x0, {[{{@arp={@loopback, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 0x0, 0x0, {@mac=@dev}, {}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'bond_slave_0\x00', 'wg0\x00'}, 0xc0, 0x108}, @unspec=@LED={0x48, 'LED\x00', 0x0, {'syz1\x00'}}}, {{@uncond, 0xc0, 0xe8}, @unspec=@CLASSIFY={0x28}}, {{@uncond, 0xc0, 0xe8}, @unspec=@STANDARD={0x28, '\x00', 0x0, 0xffffffffffffffff}}], {{'\x00', 0xc0, 0xe8}, {0x28}}}}, 0x410)
io_uring_enter(r4, 0x47ba, 0x0, 0x0, 0x0, 0x0)
r8 = syz_usb_connect(0x2, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="120100007e3dc410cd0621013ddd0102030109021b000100094000090485000189fe1f000905820220"], 0x0)
syz_usb_control_io$cdc_ecm(r8, &(0x7f0000000300)={0x14, 0x0, &(0x7f00000002c0)={0x0, 0x3, 0x1a, {0x1a}}}, 0x0)
munlockall()

11.152896017s ago: executing program 1 (id=253):
r0 = socket$kcm(0x2, 0x1, 0x84)
sendmsg$inet(r0, &(0x7f0000000340)={&(0x7f00000002c0)={0x2, 0x4e20, @loopback}, 0x10, &(0x7f0000000300)=[{&(0x7f00000003c0)='pR', 0x2}], 0x1, &(0x7f0000000940)=ANY=[@ANYBLOB="3400000000000000000000000700000001440cd221ac14143a00000001071364e0000001ac1e0101e00000020a01010101010000000000001400000000000000000000000200000008000000000000001c000000000000000000000007000000890b127f000001ac1414aa0000000000580000000000000000000000070000004404cf20444410b1e0000002fffffffbac1e000100000006e000000100000008ac14142000000006ac1414aa000003000000000000000003e0000002000056ccac1e0101fffffffc10"], 0xd8}, 0x4000000)
r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x17, 0x0, 0x4, 0xff, 0x0, 0x1, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48)
bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000005900000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90)
bpf$PROG_LOAD(0x5, &(0x7f00000008c0)={0x6, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90)
sendmsg$inet(r0, &(0x7f0000000600)={&(0x7f00000001c0)={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}, 0x10, &(0x7f0000000380)=[{&(0x7f0000000640)="80", 0x26892}], 0x1}, 0xfc)
sendmsg$inet(r0, &(0x7f0000000680)={&(0x7f0000000000)={0x2, 0x4e24, @rand_addr=0x64010102}, 0x10, &(0x7f0000000540)=[{&(0x7f0000000240)="f9", 0x1}], 0x1}, 0x4000080)

9.605550617s ago: executing program 4 (id=256):
socket$nl_generic(0x10, 0x3, 0x10)
openat$cgroup_subtree(0xffffffffffffffff, 0x0, 0x2, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
socket$nl_generic(0x10, 0x3, 0x10)
r0 = bpf$PROG_LOAD(0x5, &(0x7f0000000480)={0x1e, 0x8, &(0x7f0000000f40)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f1e7f2aa3d9b18ed81c0c869b51ec6c0af4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289e01aa27ae8b09e00e79ab20b0b8e1148f42fc3199f000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5465a932b77e74e802a0d42bc6099ad2300000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb0767192302000000b0eea24492a660583eecb42cbcd3de3a83209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80af735ed41793bdf9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809bdb9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca005ace1a84521f14518c9b476fccbd6c712016219848624b87cec2dbc68223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed85b980680b00002b435ac15fc0288d9b2a169cdcacc413038dafb7a2c8cb482bac0ac502d9ba96ffffff7f00001000000000eeff7c5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccff729eec082830689da6b53b263339863297771429d120000003341bf4abacac95900fca0493cf29b33dcc9ffffffffffffffd39fec2271ff01589646efd1cf870cd7bb2366fde41f94290c2a5ff870ce41fd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f76161d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1093b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2ae582786105c7df8be5877050c91301bb997316dbf17866fb84d4173731efe895ff2e1c5560926e90109b598502d3e959efc71f665c4d75cf2458e3546c1c776da64fb5abee0acfd235f2f4632c9062ece84c99a061887a20639b41c8c12ee86c50804042b3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc75aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7aec6b79e30cbd128f54c2d3335457acf37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f45f90400000000000000d6b2c5ea1393fdf24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8ff0700000000cc9d8046c216c1f895778cb25122a2a9f9b444aeadea2a40da8daccf080842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec8485b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba4958ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250ddc8674152f94e3a409e2a3bce109b60000000000000000d6d5210d7503000000a87a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750898b1bd627e873f8703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e6c257a45319f18101288d139bd3da20fed05a8fe64680b0a3fc22dd70400000000946912d6c98cd1a9fbe1e7d58c08acaf30235b918a31d2eca55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009556237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854352cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c77685efc0ceb1c8e5729c66418d169fc03aa188546b3ad2a182068e1e3a0e2505bc7f41019645466a53f1c96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a42010082008df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7eaa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945ecefa26b8471d424c14283a94395b64645288d7226bbd9ccd628ab84875f2c50ba891cea592b0430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7daac4be290159f6bcd75f0dda9de5532e71ae9e48b0ed0254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6b0fdf9743af932cd6db49a47613808bad959710300000000000000832d0a45fa4242e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6cafa86966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e30393cd7a4d67ff2a49c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bf3194fef97dcecc467ace45feeb685c5870d05f88a0f463db88d377442e1349acaf766218b54a9d620100000000000000494198276eb2df7766411bef0ebb5000000000006065d635b0b7a00ee767221d8af9753387e0cd8d718f54a29df6eba3bd4c440e6e2172e3fcc01b8babb757b5c59217b80d0db3ba582814a604e4ef7a803e9ca7c85b35c9b93a9e0885e238b44ae1c2e64cce3b27083b8246829e64056000302bffff15405bd5f2eba20000000000000000000000000000000000009a9823fd8fbc5aa165099c5ed032b48ea12d8e0588dc52702e4084913a06d468d0928bad76d697e1f85ab030e788d38788ee5b5428d4a971cc97db9fd231088e570735ce129e7e77fc2777692664a1488fd8d6dff4dad618fd54f529d4555c6507009ee69dd1bc55258789b24052137e9637f3efbab71720f88c3c44b3b7486f979e8a3174b531f573fe0e5239c000be2733c49546f6e8a9175ec6f14dbf72cac91643b2fd99c29eca28a3c2e60d5e5b8795fae16a7c3ea57e728eca35eaf0155a39f97580e079175426c088a0208040982a0000000000000000000000000051ceaaf0159fe61f2eade7603d0a7a56fb09cd119ac06adb6597155ae47846892bb423c024d8cbe9240b71ec6dc2124d3a19e2d714b273d95d1d3aa737cb04a33615ff2a730e51067d5d675d7122361c37c61a43b5afd865b60d4cae891b73220f17d25985a7f76834995e53a93a1c7b9eef267df691ca983a0b15bda7f6c5c1ca7aa50261a3089a1ebf0734c9b07e8951ff023263ad5aed8cfb49b49e128c697724c057d22c5df5aef27ce3db11d5ad5527d149d076e1a87e2df27c0cb8a67ad026bf953e88f10447e125c2c0f1aebee1f3390a9e3ddad4e2a6e0f6e4569fdefa19e870e04acf9493b963f98e23cfc665e4f465fa3f801e1957c399e45f61d3459b1c606204368bb931345af2823c487d2fd99db6ea6e008e7ffa06ca861551189d155bd077a79fe2c7e961352e56824f727d21d41eae78bfec4a2d7a7edbc8ef958c5ea599f7c25bf71c2340558aa12fdd24a88aaad5921aee7dae6a2f3009d9cb43ab4898d0f0aa565431b6abe585d75db04d1c9ba0b9de4ae8b0d3132bc6810cc9a693979f55174a72e1df9fdef35bc470f9e6e591982757f45c52c645d891bf63bb21fb66926ebe1a8525611fc3e8bb8795c36dc2a86b5ab46ff33cc74f61751b2dae92676db85c8d0c721b7ea4544bf51c95c86fcac1f434d09d1ee4928aafe23de66fed972e0dddfb33f64e48701b049239e7f552d816441d11c4c2647c014462344359198d97c4b6e9ed31ca18987b64de079b2bed641e8a92f13ca70844c65cb423d01950b0ebf44bd28e09c05d9ae5dd689fb880fb18d042219f5ac60c3a03b085abf3e8e3efc842a8d328733461f04c99607061c65ed14c61322a5ac2d371a95b8ad867ec92d13a4fa4ae033a09673866cd779a8758d8855400d8c6a7242dc207251e8797eca24ea4f487663e60f2f5e1f1424958fd148f846830e88a42d93e1fe9b0b4a4a268921738938aa9f3cb3811ac87c54c8ebc8bcfb4613cc3a997ff1579edbd4ade8020e3ad001b072b1a751b588ac4639f35a58e00a50c0270608c7a7f10132b1c25b9ea81232fbef665f6212f875b2a0000000000000000000000000000002684c2d8eb8cac98930fa6a893ca44c0f64c07a87eb7b05f56ca6c70cb3a0eb328a15fe96a88235155e6d64bd434f641ddf9db2245e47e5904453577895dd81d", @ANYBLOB="f485e72b1fa0ec474b307390c321863374d9b9c2586fc691c65a3556c6fa92e26e14c554f2636743386e3a316d958ce5229cdc99cf6a185d135efac8c276fa72ace090ad8050461955f68c0cd702c9fed927f7218c6a8297703642baee3147540941b30b9e9c8798fb005013f3c2fead9f85814dc87ab5"], &(0x7f0000000380)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, @fallback=0x35, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000)={0x0, 0x0, 0x400, 0x5}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000540)='rcu_utilization\x00', r0}, 0x10)
bpf$ITER_CREATE(0xb, 0x0, 0x0)
bpf$ITER_CREATE(0x21, 0x0, 0x0)
mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0xb, 0xc3072, 0xffffffffffffffff, 0x0)
r1 = socket(0x2000000000000021, 0x2, 0x10000000000002)
connect$rxrpc(r1, &(0x7f0000000140)=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x8, @multicast2}}, 0x24)
sendmmsg(r1, &(0x7f0000000180)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18, 0xe000}, 0x5}], 0x1, 0x0)
recvmmsg(r1, &(0x7f0000000d00), 0xf000, 0x10002, 0x0)

9.468679215s ago: executing program 1 (id=257):
r0 = openat$smackfs_access(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/access\x00', 0x2, 0x0)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)="5febd0a274ef68c04bcf8714eaffa77ac14ffc04324d8a3a22bfeadff2179674faf663285879ce4c181a39cdacf74bff553352c4b3b1", 0x36}], 0x1)
r1 = socket$kcm(0x21, 0x2, 0x2)
r2 = socket$inet6(0xa, 0x3, 0xff)
setsockopt$inet6_IPV6_RTHDR(r2, 0x29, 0x39, &(0x7f0000000140)=ANY=[@ANYBLOB="0002"], 0x18)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r6 = socket$inet6(0xa, 0x80002, 0x0)
connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c)
setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000080)=ANY=[@ANYBLOB="0600000000000005"], 0x8)
sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00)
write$binfmt_elf64(r2, 0x0, 0x90)
sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0)
recvmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/19, 0x13}, 0x40010000)
epoll_create1(0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
r7 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$NL80211_CMD_SET_COALESCE(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000b00)={&(0x7f0000000040)=ANY=[@ANYBLOB='(\x00\x00\x00', @ANYRES16=0x0, @ANYBLOB="01000000f9ffffffffff01"], 0x28}}, 0x0)
ioctl(r7, 0x8b1b, &(0x7f0000000040))
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x19, 0x4, &(0x7f00000003c0)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x1c}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)

8.10428188s ago: executing program 0 (id=259):
openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0)
r0 = socket$phonet_pipe(0x23, 0x5, 0x2)
fcntl$setown(r0, 0x8, 0x0)
syz_open_dev$cec(&(0x7f0000001380), 0x0, 0x80000)
r1 = syz_io_uring_setup(0x231, &(0x7f0000000140)={0x0, 0x0, 0x10100, 0x0, 0x1e1}, &(0x7f0000000200)=<r2=>0x0, &(0x7f0000000100)=<r3=>0x0)
syz_io_uring_submit(r2, r3, &(0x7f00000009c0)=@IORING_OP_WRITE={0x17, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0xffffffffffffff31})
io_uring_enter(r1, 0x7a98, 0x0, 0x0, 0x0, 0x4f)
r4 = syz_init_net_socket$llc(0x1a, 0x2, 0x0)
bind$llc(r4, &(0x7f0000000040)={0x1a, 0x0, 0x0, 0x0, 0x8, 0xd}, 0x10)
socket$inet6_tcp(0xa, 0x1, 0x0)
r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000006c0)={0x18, 0xb, &(0x7f0000000640)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020000000000000000000007b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b703000000000000850000000600000095"], &(0x7f00000004c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000540)={&(0x7f0000000300)='rcu_utilization\x00', r5}, 0x10)
socket$inet6_mptcp(0xa, 0x1, 0x106)
socket$nl_netfilter(0x10, 0x3, 0xc)
socket$inet_udp(0x2, 0x2, 0x0)
socket$inet_dccp(0x2, 0x6, 0x0)
pipe(&(0x7f0000000100))
getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14)
r6 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0)
write$cgroup_int(r6, &(0x7f0000000000), 0xffffff6a)
sendfile(r4, r6, 0x0, 0xffffffff000)

7.911686003s ago: executing program 1 (id=261):
r0 = openat$rtc(0xffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3)

7.628822611s ago: executing program 1 (id=263):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20000008b}, 0x0)
r0 = getpid()
openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0)
r1 = openat(0xffffffffffffff9c, &(0x7f00000001c0)='./file0\x00', 0x0, 0x0)
flock(r1, 0x2)
sched_setscheduler(r0, 0x2, 0x0)
mmap$IORING_OFF_SQ_RING(&(0x7f0000ffc000/0x3000)=nil, 0x3000, 0x0, 0x4011, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f0000000180)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x4)
r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000000)='sched_switch\x00', r4, 0x0, 0x8000000000000001}, 0x18)
r5 = socket(0x40000000015, 0x5, 0x0)
setsockopt$SO_RDS_TRANSPORT(r5, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) (fail_nth: 1)

6.813990662s ago: executing program 0 (id=266):
r0 = bpf$BPF_MAP_GET_FD_BY_ID(0xe, &(0x7f0000000400)={0x0, 0xacc, 0x8}, 0xc)
dup(r0)
r1 = socket(0xa, 0x3, 0x3a)
setsockopt$MRT6_ADD_MFC_PROXY(r1, 0x29, 0xd2, &(0x7f00000000c0)={{0xa, 0x0, 0x0, @mcast2}, {0xa, 0x0, 0x0, @mcast1}, 0x0, {[0x691, 0x0, 0x2]}}, 0x5c)
openat$sysfs(0xffffffffffffff9c, &(0x7f0000000040)='/sys/power/pm_debug_messages', 0x101, 0x0)
syz_open_procfs(0x0, &(0x7f0000000240)='fd/3\x00')
r2 = socket$nl_netfilter(0x10, 0x3, 0xc)
sendmsg$NFT_BATCH(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000340)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01020000000000000000010004000000010073797a300000000040000000160a01000000000000000000010000080900010073797a30000000000900020073797a3000000000140003800800014000000000080002400000000038000000160a0101000b000000000000010000000900820073797a30000000000900010073797a3000000000040003800800074000000000140000001000010000000000000000000000000a"], 0xc0}}, 0x800)
bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB="b4080000000000006110500000000000a60000000000000094fffffd00000000"], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xfd90, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f00000000c0), 0x0, 0x10, &(0x7f0000000080), 0xffffffffffffffb2, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x48)
r3 = syz_open_dev$loop(&(0x7f0000000040), 0x5, 0x80)
ioctl$BLKBSZSET(r3, 0x40081271, &(0x7f00000001c0)=0xfffffffffffffffa)
r4 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x1, 0x8, 0x8, 0x0, 0xffffffffffffffff, 0x0, '\x00', 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48)
bpf$BPF_PROG_DETACH(0x1c, &(0x7f0000000000)={@map=r4, 0xffffffffffffffff, 0x2c, 0x0, 0x0, @void, @value}, 0x20)
close(0x3)
syz_open_procfs(0x0, &(0x7f00000000c0)='fd/3\x00')
r5 = socket$isdn(0x22, 0x3, 0x1)
r6 = openat$tcp_congestion(0xffffff9c, &(0x7f0000000300), 0x1, 0x0)
write$tcp_congestion(r6, &(0x7f0000000100)='reno\x00', 0x5)
r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000040)='pids.events\x00', 0x275a, 0x0)
write$binfmt_script(r7, &(0x7f0000000100), 0xfffffd9d)
sendfile(r6, r7, 0x0, 0x8000002b)
fsetxattr(r5, &(0x7f0000000180)=@known='trusted.overlay.impure\x00', &(0x7f0000000200)='\x00', 0x1, 0x3)
r8 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r1], 0x48)
syz_emit_ethernet(0x52, &(0x7f0000000000)={@local, @local, @void, {@ipv4={0x800, @icmp={{0xa, 0x4, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local, {[@cipso={0x86, 0x12, 0x3, [{0x1, 0xc, "000000000009594960c0"}]}]}}, @time_exceeded={0x3, 0x0, 0x0, 0x3, 0x0, 0x0, {0x5, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40, @broadcast, @multicast1}}}}}}, 0x0)
bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xc, 0x27, &(0x7f0000000240)=ANY=[@ANYBLOB="18000000faffffff000000000900000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf09000000000000550901000000000095000000000000000014030008000000b7080000000000007b8af8ff00000000b7080000060000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r8, @ANYBLOB="0000000000000000b70500000800000085000000a500000018100000", @ANYRES32=r8, @ANYBLOB="0000000000000000183a000005000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7020000000000ea840000008600000018440000f9ffffff0000000000000000bf91000000000000b7020000020000008500000085000000b7000000000000009500000000000000"], &(0x7f0000000080)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)

5.612997556s ago: executing program 0 (id=268):
r0 = openat$smackfs_access(0xffffffffffffff9c, &(0x7f0000000040)='/sys/fs/smackfs/access\x00', 0x2, 0x0)
writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000140)="5febd0a274ef68c04bcf8714eaffa77ac14ffc04324d8a3a22bfeadff2179674faf663285879ce4c181a39cdacf74bff553352c4b3b1", 0x36}], 0x1)
r1 = socket$kcm(0x21, 0x2, 0x2)
r2 = socket$inet6(0xa, 0x3, 0xff)
setsockopt$inet6_IPV6_RTHDR(r2, 0x29, 0x39, &(0x7f0000000140)=ANY=[@ANYBLOB="0002"], 0x18)
connect$inet6(r2, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @remote}}, 0x1c)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8)
r3 = getpid()
sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x3)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000280)={<r4=>0xffffffffffffffff, <r5=>0xffffffffffffffff})
connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r6 = socket$inet6(0xa, 0x80002, 0x0)
connect$inet6(r6, &(0x7f0000000000)={0xa, 0x4e27, 0xffffffff, @mcast2, 0x5}, 0x1c)
setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000080)=ANY=[@ANYBLOB="0600000000000005"], 0x8)
sendmmsg$inet6(r6, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00)
write$binfmt_elf64(r2, 0x0, 0x90)
sendmsg$kcm(r1, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0x0, 0x2, 0x10, {0x2, 0x0, @broadcast}}, 0x80, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="18000000000000001001000001"], 0x18}, 0x0)
recvmsg$kcm(r1, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=""/19, 0x13}, 0x40010000)
epoll_create1(0x0)
bpf$PROG_LOAD(0x5, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x21, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
r7 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$sock_SIOCGIFINDEX_80211(0xffffffffffffffff, 0x8933, &(0x7f0000000040)={'wlan1\x00'})
ioctl(r7, 0x8b1b, &(0x7f0000000040))
bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x19, 0x4, &(0x7f00000003c0)=@framed={{}, [@ldst={0x3, 0x0, 0x3, 0x1, 0x0, 0x1c}]}, &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @cgroup_sockopt=0x15, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)

4.863037818s ago: executing program 1 (id=270):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0)
sched_setscheduler(0x0, 0x1, &(0x7f00000001c0)=0x7)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000180)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
r3 = gettid()
timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r3}, &(0x7f0000bbdffc))
r4 = syz_open_dev$dri(&(0x7f0000003c40), 0x9237, 0x0)
ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r4, 0xc01064bd, &(0x7f0000000800)={&(0x7f00000007c0)="aa", 0x1})
ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r4, 0xc01064bd, &(0x7f00000001c0)={&(0x7f0000000240)='=V', 0x2})
ioctl$DRM_IOCTL_MODE_CREATEPROPBLOB(r4, 0xc01064bd, &(0x7f0000000340)={&(0x7f00000003c0)="12", 0x1, <r5=>0x0})
ioctl$DRM_IOCTL_MODE_DESTROYPROPBLOB(r4, 0xc00464be, &(0x7f0000000000)={r5})
sendmsg$nl_generic(0xffffffffffffffff, &(0x7f00000029c0)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x1c}}, 0x0)
timer_settime(0x0, 0x0, &(0x7f0000000280)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0)
socketpair$tipc(0x1e, 0x5, 0x0, &(0x7f0000000500)={<r6=>0xffffffffffffffff})
r7 = open(&(0x7f0000000040)='./file0\x00', 0x650180, 0x180)
ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f00000000c0)={'sit0\x00', &(0x7f00000002c0)={'syztnl0\x00', <r8=>0x0, 0x20, 0x10, 0x3ff, 0x6, {{0x38, 0x4, 0x2, 0x5, 0xe0, 0x65, 0x0, 0x4, 0x2f, 0x0, @local, @private=0xa010100, {[@timestamp={0x44, 0x10, 0x72, 0x0, 0x9, [0x1fe1, 0x0, 0x401]}, @rr={0x7, 0x1f, 0x93, [@empty, @multicast1, @broadcast, @local, @empty, @broadcast, @broadcast]}, @timestamp={0x44, 0xc, 0xbd, 0x0, 0x4, [0xfffffffc, 0x23]}, @noop, @noop, @timestamp_prespec={0x44, 0x3c, 0xb5, 0x3, 0x1, [{@multicast1, 0x95}, {@local, 0xff}, {@empty, 0x8000}, {@broadcast, 0x7}, {@loopback, 0x6}, {@remote, 0xeee0}, {@remote}]}, @timestamp_prespec={0x44, 0xc, 0xc8, 0x3, 0x9, [{@remote, 0x8580}]}, @timestamp_addr={0x44, 0x44, 0xdd, 0x1, 0x4, [{@broadcast, 0x7}, {@loopback, 0xd}, {@local, 0xde43}, {@loopback, 0x6}, {@local, 0xa}, {@private=0xa010102, 0x3}, {@remote, 0x8}, {@loopback, 0x1}]}]}}}}})
sendmsg$nl_route(r7, &(0x7f0000000480)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000240)={&(0x7f00000003c0)=@bridge_newneigh={0x9c, 0x1c, 0x20, 0x70bd28, 0x25dfdbff, {0xa, 0x0, 0x0, r8, 0x1, 0x4, 0x7}, [@NDA_LLADDR={0xa, 0x2, @random="e2aae3cd66ee"}, @NDA_LINK_NETNSID={0x8, 0xa, 0x6cb1}, @NDA_DST_IPV6={0x14, 0x1, @private1={0xfc, 0x1, '\x00', 0x1}}, @NDA_DST_IPV6={0x14, 0x1, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}}, @NDA_MASTER={0x8, 0x9, 0x1}, @NDA_FDB_EXT_ATTRS={0x1c, 0xe, 0x0, 0x1, [@NFEA_ACTIVITY_NOTIFY={0x5, 0x1, 0xc2}, @NFEA_DONT_REFRESH={0x4}, @NFEA_DONT_REFRESH={0x4}, @NFEA_DONT_REFRESH={0x4}, @NFEA_DONT_REFRESH={0x4}]}, @NDA_DST_IPV4={0x8, 0x1, @multicast2}, @NDA_NH_ID={0x8}, @NDA_VLAN={0x6, 0x5, 0x4}, @NDA_LINK_NETNSID={0x8, 0xa, 0x486f1f}]}, 0x9c}, 0x1, 0x0, 0x0, 0x8002}, 0x4010000)
recvmsg(r6, &(0x7f0000000ac0)={0x0, 0x0, &(0x7f0000000940)=[{&(0x7f00000005c0)=""/151, 0x97}], 0x1, &(0x7f0000002f40)=""/229, 0xe5}, 0x0)

4.861972555s ago: executing program 4 (id=271):
r0 = socket$packet(0x11, 0x3, 0x300)
ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00'})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x88200, 0x0)
r3 = syz_open_dev$usbfs(&(0x7f0000000480), 0x77, 0x141341)
ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, 0x0)
ioctl$USBDEVFS_IOCTL(r3, 0xc0105512, &(0x7f0000000000)=@usbdevfs_driver={0x0, 0x4010, 0x0})
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r2, 0x40046f41, 0x20000502)
r4 = bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000100)='xen_mc_flush_reason\x00', r2}, 0x18)
bind$inet(r2, &(0x7f0000000000)={0x2, 0x4e20, @private=0xa010102}, 0x10)
r5 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/kernel/address_bits', 0x0, 0x4)
lseek(r5, 0x0, 0x0)
ioctl$mixer_OSS_GETVERSION(r5, 0x80044d76, &(0x7f0000000040))
r6 = socket$pppoe(0x18, 0x1, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="3400000011000100000000000000000007000000", @ANYRES64=r4, @ANYBLOB="000000000000000014001a80100004800c", @ANYRES64=r6], 0x34}}, 0x0)

4.226045404s ago: executing program 2 (id=272):
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', <r2=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe8000"/18], 0x68}}, 0x0)
sendto$packet(r0, &(0x7f0000000180)="a6bea8a120e5f8320c30ce5086dda5e986f34c10d8c39c3002de8ec445ae083a4b7fc08a086fc691", 0x5b2, 0x0, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14)

3.935596638s ago: executing program 3 (id=273):
r0 = openat$rtc(0xffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3)

3.682554731s ago: executing program 0 (id=274):
r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x56a, 0xd5, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x7}}}}]}}]}}, 0x0)
syz_usb_control_io(r0, 0x0, 0x0)
socket$nl_route(0x10, 0x3, 0x0)
r1 = io_uring_setup(0x79bf, 0x0)
r2 = open(&(0x7f0000000280)='.\x00', 0x141080, 0x0)
fcntl$notify(r2, 0x402, 0x8000003d)
fcntl$notify(0xffffffffffffffff, 0x402, 0x8000003d)
fcntl$notify(0xffffffffffffffff, 0x402, 0x36)
close_range(r1, 0xffffffffffffffff, 0x0)
syz_usb_control_io$hid(r0, &(0x7f0000000000)={0x24, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x22, 0x7, {[@local=@item_012={0x1, 0x2, 0x0, 'D'}, @main=@item_4={0x3, 0x0, 0xb, "58611047"}]}}, 0x0}, 0x0)
r3 = syz_usb_connect$cdc_ncm(0x1, 0x113, &(0x7f00000000c0)={{0x12, 0x1, 0x200, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x101, 0x2, 0x1, 0x3, 0x50, 0x0, {{0x9, 0x4, 0x0, 0x0, 0x1, 0x2, 0xd, 0x0, 0x0, {{0x5}, {0x5, 0x24, 0x0, 0x904c}, {0xd, 0x24, 0xf, 0x1, 0xe6c9, 0x0, 0xc, 0x2}, {0x6, 0x24, 0x1a, 0x2, 0x5}, [@mdlm_detail={0x95, 0x24, 0x13, 0xf, "557d877d710c2a9149b333ffa8b7cd34d6b86f09b99d32630b72435a73b76d0449812f59c091db090ac8f68c14197e11d308b2ecaa5cc0589a4e5c9228f8df0299b10e3ef35b541ccaf7f79974b52b0d6b43ff6b97c8a983f2d05443f68a9c3698c62c9d6c2659b3c3d317e9649e5c3f00e6ea5008f96d0f116395c7543398e468179552a263436f021e6e22338d3f1c69"}, @obex={0x5, 0x24, 0x15, 0xef93}, @dmm={0x7, 0x24, 0x14, 0x7b71, 0x7ff}, @acm={0x4}]}, {{0x9, 0x5, 0x81, 0x3, 0x50, 0x7, 0x6, 0xc0}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x2, 0x2, 0xd, 0x0, 0x0, "", {{{0x9, 0x5, 0x82, 0x2, 0x10, 0x0, 0xa0, 0x9}}, {{0x9, 0x5, 0x3, 0x2, 0x3ff, 0x4, 0x7, 0x3}}}}}}}]}}, &(0x7f00000006c0)={0xa, &(0x7f0000000200)={0xa, 0x6, 0x110, 0x1, 0x4, 0x9, 0x20, 0xbe}, 0x0, 0x0, 0x8, [{0x7b, &(0x7f0000000340)=@string={0x7b, 0x3, "9211ef411d57c4e2d6f68d7d58228b7bc86032f6361553098f06a72dc3c60c9b415173dcb6445707bf5bb91b073c34c60bc551314963678f26fb2cf8893d9dfe301b1cf036e2071c1a9c91273ce18491d1a3403b69348ec7bc88a537d99075c0d60c241a020ee55e412db79b81a9fb592c60d8fbfb83e3c78a"}}, {0x4, &(0x7f00000003c0)=@lang_id={0x4, 0x3, 0x424}}, {0x4, &(0x7f0000000400)=@lang_id={0x4, 0x3, 0x445}}, {0x99, &(0x7f0000000440)=@string={0x99, 0x3, "bd4b25b7542a23eb264a6f4bdb67cb297631b66c87bb3ae3e94eeeda6f02f4a282d5a36fdef9aac0f5966b8bf9196d7032f6b4cd8d0adad95b35631c81ca77ea8b9fa4aaa145f53c1942317c44f9f7a51804ecd7498558925dce49b29825f4736624fdfab1f38f0b01ec76a3ec14214add07db98e811dad9a1cbede7181e1a6f81481811e5a3c7dcbc320a554e9ebf2097b3d5e699e0f9"}}, {0x4, &(0x7f0000000500)=@lang_id={0x4, 0x3, 0x1009}}, {0x4, &(0x7f0000000540)=@lang_id={0x4, 0x3, 0xf8ff}}, {0x4, &(0x7f0000000580)=@lang_id={0x4, 0x3, 0x804}}, {0xff, &(0x7f00000005c0)=@string={0xff, 0x3, "7ae8a7627902b62dd374407d483b1e11c2256c71571d884012084f7006e207c64cf73ba16b772fba1f1ce41e42dfe13396bd5158beb3221aed059de004d677bbe2ab92d72f9571ae251ee0932059fe44215436a69ba1af859e7d83c334b25ebb85fa095eaa11f3127ebe9cbc41b93ec9aeb2bbdd86394ca9bef588f0ca14da5b396347adbdf78624f425be6ed026fe39f567a7487695f3b9b5449b33380ce5d2cebb815ddf4ad02983dc9befaad4c31e5399b6edd70c7c5a3d1b97993be4e787bf1a4c531f26ac1effb2ed706e879c96fee0cf40d1317307acd49776b74b2e6942dfa023161fdd0a5195251d8c249e857aef280748ee4b1a09de62785b"}}]})
syz_usb_control_io$cdc_ncm(r3, &(0x7f0000000880)={0x14, &(0x7f0000000740)={0x0, 0x5, 0xf4, {0xf4, 0x5, "ffd3b83a0a05fa5ab8b6ebd47b2f630d79809256a676e4ef7b05827be281f623241e11d91297f8f588dcab97ad7f75d61748eac7e05f65e1e5e1f9a0de3277b22e0039b35133e9b178ea59e5eb58718a48a788e45da2c79a39c23b7bb3df51a2949e8c1623fb3c3930f403506d5f81f4a7fe3c7977662b70253934b65ffcef2edc691ec288db749208ceef7eeacfa821f9bdd82e310e979414fd77926341eb9972cc1b03fd899d95f5e1d706bedbd11f326a2e0081174d3d32c6c4d6d27d2433d6612f1d40f5a1fc508eddac9830631e0822f8fa3db0032827d539df725013819186c3a9180da1be81b5f3db1a59a566cf01"}}, &(0x7f0000000840)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000000b40)={0x44, &(0x7f00000008c0)={0x20, 0x2d, 0x8f, "5663c1a2bfcd5c54e30235509efdae54d12ffb6098b07015f72c088deb2542bf3e292e7a6cb098322facca6e768c91fd5d1ad977ef8784a366b6c675dcddf38f8da42d16a89c2c54e91684ec2bd72e2776824d6d13fa3b7a2a07ac4212ab8295e618ef8cd92e819a2af6594dd821924d41b58b644f95382b89455e2bd714ba3574ab1088fcf6f11e4c23b727ae829f"}, &(0x7f0000000980)={0x0, 0xa, 0x1, 0x2}, &(0x7f00000009c0)={0x0, 0x8, 0x1, 0x8a}, &(0x7f0000000a00)={0x20, 0x80, 0x1c, {0x0, 0x3ff, 0x3, 0x10, 0x5, 0x2, 0x2, 0x9, 0x5, 0x1, 0x9, 0x200}}, &(0x7f0000000a40)={0x20, 0x85, 0x4, 0xc513}, &(0x7f0000000a80)={0x20, 0x83, 0x2}, &(0x7f0000000ac0)={0x20, 0x87, 0x2, 0x7}, &(0x7f0000000b00)={0x20, 0x89, 0x2}})

3.620932216s ago: executing program 4 (id=275):
r0 = openat$ipvs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/sys/net/ipv4/vs/sync_ports\x00', 0x2, 0x0)
r1 = socket(0x10, 0x3, 0x0)
getsockopt$sock_cred(r1, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0, <r2=>0x0}, &(0x7f0000cab000)=0xc)
setregid(0xffffffffffffffff, r2)
r3 = socket$inet_udplite(0x2, 0x2, 0x88)
getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000000240)={0x0, <r4=>0x0}, 0x0)
setuid(r4)
write$UHID_CREATE2(r0, 0x0, 0x0)

3.570024405s ago: executing program 3 (id=276):
bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x4, &(0x7f0000000040)=ANY=[@ANYBLOB], &(0x7f0000003ff6)='GPL\x00', 0x5, 0xc3, &(0x7f000000cf3d)=""/195, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x8, 0x10, &(0x7f0000000000), 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x94)
r0 = syz_open_dev$midi(&(0x7f0000000000), 0x2, 0x28002)
madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x15)
ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r0, 0x40045730, &(0x7f0000000040))

3.563049775s ago: executing program 4 (id=277):
r0 = openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0)
ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0)
sendmsg$IPSET_CMD_TEST(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000400)=ANY=[@ANYBLOB="800000000b0601020000000000000000090000000900020073799d30000000000500010007000000580008800c00078007001a00242e0000100007800c001840fffffffffffffffd100007800c001b4000000000000000100c00078008000a400000ffff100008800c0002"], 0x80}}, 0x40800)
r1 = socket$nl_generic(0x10, 0x3, 0x10)
sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)=ANY=[@ANYBLOB="280500003d0007010000000000000000017c0000040000000c00018006000600800a000004"], 0x528}}, 0x4800)
r2 = eventfd(0x0)
close(r2)

3.533153465s ago: executing program 2 (id=278):
r0 = socket$nl_generic(0x10, 0x3, 0x10)
getsockopt$netlink(r0, 0x10e, 0xb, 0x0, &(0x7f0000000040))
r1 = socket$packet(0x11, 0x3, 0x300)
r2 = socket$inet6_tcp(0xa, 0x1, 0x0)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000300)={'ip6_vti0\x00', <r3=>0x0})
sendto$packet(r1, &(0x7f0000000180)="10030600e4ff020002004788aa96a13bb1000011", 0x14, 0x0, &(0x7f0000000140)={0x11, 0x0, r3, 0x1, 0x0, 0x6, @dev={'\xaa\xaa\xaa\xaa\xaa', 0x16}}, 0x14)
r4 = syz_open_dev$loop(&(0x7f00000001c0), 0x7, 0x20802)
ioctl$LOOP_SET_STATUS(r4, 0x1277, 0x0)

3.342369391s ago: executing program 4 (id=279):
r0 = socket$inet6_sctp(0xa, 0x5, 0x84)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000020c0)}, &(0x7f0000002100)=0x10)
socket$nl_route(0x10, 0x3, 0x0)
mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0)
write$cgroup_type(0xffffffffffffffff, 0x0, 0x0)
r1 = gettid()
prlimit64(r1, 0x5, &(0x7f0000000300)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8)
setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x1000000000000f, &(0x7f0000000080)=0x7fffffff, 0x4)
sendmsg$NL80211_CMD_DEL_NAN_FUNCTION(0xffffffffffffffff, 0x0, 0x48800)
setsockopt$sock_attach_bpf(0xffffffffffffffff, 0x1, 0x34, &(0x7f0000000040), 0x4)
mkdir(&(0x7f0000000200)='./file1\x00', 0x0)
openat(0xffffffffffffffff, &(0x7f00000003c0)='./file1/file0\x00', 0x13b241, 0x82)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000000)={<r3=>0xffffffffffffffff, <r4=>0xffffffffffffffff})
pipe(&(0x7f0000000080)={<r5=>0xffffffffffffffff, <r6=>0xffffffffffffffff})
splice(r3, 0x0, r6, 0x0, 0x39000, 0x0)
ioctl$int_in(r5, 0x5452, &(0x7f00000000c0)=0x9)
close_range(r4, 0xffffffffffffffff, 0x0)
mount(0x0, 0x0, 0x0, 0x0, 0x0)
chdir(&(0x7f0000000080)='./file1\x00')
mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0)
openat$dir(0xffffffffffffff9c, 0x0, 0x0, 0x1)
unlinkat(0xffffffffffffff9c, 0x0, 0x200)
open(&(0x7f0000000000)='.\x00', 0x0, 0x0)
r7 = open(&(0x7f00000000c0)='.\x00', 0x0, 0x0)
symlinkat(&(0x7f00000000c0)='./file1\x00', r7, 0x0)

3.294550634s ago: executing program 2 (id=280):
r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff)
socket(0x1e, 0x2, 0x0)
syz_emit_ethernet(0x9a, &(0x7f0000000600)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8)
syz_open_dev$radio(0x0, 0x2, 0x2)
r2 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x510, 0x0, 0x138, 0x210, 0x0, 0x138, 0x478, 0x478, 0x478, 0x478, 0x478, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x2000000}}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x570)
r3 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
r4 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r5 = openat$cgroup_procs(r4, &(0x7f0000000040)='tasks\x00', 0x2, 0x0)
sendfile(r5, r5, 0x0, 0xc)
r6 = openat$cgroup_procs(r4, &(0x7f0000000240)='cgroup.procs\x00', 0x2, 0x0)
sendfile(r6, r6, 0x0, 0xfff)
sendfile(r6, r5, 0x0, 0x5)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90)
ioctl$sock_SIOCGIFINDEX_80211(r3, 0x8b36, &(0x7f0000000000)={'wlan0\x00'})
r7 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_buf(r7, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8)
r8 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r8, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2, 0x13, 0x0, 0x0, 0x2}, 0x10}}, 0x0)
ioctl$VIDIOC_S_SELECTION(r0, 0xc040565f, &(0x7f0000000180)={0xb, 0x0, 0x3, {0x4, 0x7, 0x0, 0x2}})

3.269541531s ago: executing program 3 (id=281):
ioctl$BTRFS_IOC_TREE_SEARCH(0xffffffffffffffff, 0x7005, 0x0)
readv(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3)

2.476738765s ago: executing program 3 (id=282):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f00000001c0)=0x8)
r0 = getpid()
sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x6770c000)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r1=>0xffffffffffffffff, <r2=>0xffffffffffffffff})
connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r2, 0x0, 0x0, 0x0)
recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x143042, 0x0)
r3 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x2, 0x0)
mount$fuse(0x0, &(0x7f0000000100)='./file1\x00', &(0x7f0000000140), 0x2, &(0x7f0000002400)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r3, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0])
read$FUSE(r3, &(0x7f0000000200)={0x2020, 0x0, <r4=>0x0}, 0x2020)
r5 = socket$inet_icmp(0x2, 0x2, 0x1)
bind$inet(r5, &(0x7f0000000480)={0x2, 0x4e20, @multicast1}, 0x10)
open(&(0x7f00000000c0)='./file1\x00', 0x425001, 0x95)
write$FUSE_INIT(r3, &(0x7f0000002300)={0x50, 0x0, r4, {0x7, 0x9, 0x0, 0x1030002}}, 0x50)
read$FUSE(r3, &(0x7f0000004580)={0x2020, 0x0, <r6=>0x0}, 0x2020)
write$FUSE_INTERRUPT(r3, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r6}, 0x10)
r7 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0)
dup3(r7, r3, 0x0)
openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x105042, 0x0)

2.300031057s ago: executing program 2 (id=283):
syz_open_dev$MSR(0x0, 0xea9, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0)
sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce)
sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x40100c1)
r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0)
setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x3a, 0x39, 0x0, 0x18)
read$FUSE(r1, 0x0, 0x0)
bind$tipc(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, 0x0, 0x0)
r3 = socket$rds(0x15, 0x5, 0x0)
r4 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2)
r5 = fcntl$dupfd(r4, 0x0, r4)
write$binfmt_script(r5, &(0x7f0000000100), 0xfffffd9d)
write$FUSE_INIT(r5, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x28, 0x0, 0x840, 0x1, 0x0, 0x400400, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}}, 0x50)
munmap(&(0x7f0000002000/0x1000)=nil, 0x1000)
bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r3, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10, 0x0, 0x0, &(0x7f0000000300)}, 0x8000000)
quotactl$Q_QUOTAOFF(0xffffffff80000300, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)

1.234558194s ago: executing program 3 (id=284):
syz_open_dev$MSR(0x0, 0xea9, 0x0)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x100008b}, 0x0)
sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce)
sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8)
openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0)
sendmsg$802154_dgram(0xffffffffffffffff, 0x0, 0x40100c1)
r1 = openat$fuse(0xffffffffffffff9c, 0x0, 0x42, 0x0)
setsockopt$inet6_IPV6_RTHDR(0xffffffffffffffff, 0x3a, 0x39, 0x0, 0x18)
read$FUSE(r1, 0x0, 0x0)
bind$tipc(0xffffffffffffffff, 0x0, 0x0)
r2 = socket$tipc(0x1e, 0x2, 0x0)
setsockopt$TIPC_GROUP_JOIN(r2, 0x10f, 0x87, 0x0, 0x0)
r3 = socket$rds(0x15, 0x5, 0x0)
r4 = syz_open_dev$vbi(&(0x7f00000001c0), 0x1, 0x2)
r5 = fcntl$dupfd(r4, 0x0, r4)
write$binfmt_script(r5, &(0x7f0000000100), 0xfffffd9d)
write$FUSE_INIT(r5, &(0x7f0000000180)={0x50, 0x0, 0x0, {0x7, 0x28, 0x0, 0x840, 0x1, 0x0, 0x400400, 0x0, 0x0, 0x0, 0x0, 0xfffffffb}}, 0x50)
munmap(&(0x7f0000002000/0x1000)=nil, 0x1000)
bind$rds(r3, &(0x7f0000000840)={0x2, 0x0, @loopback}, 0x10)
sendmsg$rds(r3, &(0x7f0000000000)={&(0x7f0000000040)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xa}}, 0x10, 0x0, 0x0, &(0x7f0000000300)=[@mask_cswp={0x58, 0x114, 0x9, {{0xffff, 0x8000}, 0x0, &(0x7f00000002c0), 0x1, 0xa, 0x8001, 0xf7, 0x50, 0xa0b6}}], 0x58}, 0x8000000)
quotactl$Q_QUOTAOFF(0xffffffff80000300, &(0x7f00000000c0)=@loop={'/dev/loop', 0x0}, 0x0, 0x0)

772.429291ms ago: executing program 2 (id=285):
r0 = socket$nl_route(0x10, 0x3, 0x0)
ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f0000000080)={'wg2\x00'})
r1 = socket$nl_route(0x10, 0x3, 0x0)
r2 = socket$inet6_udp(0xa, 0x2, 0x0)
seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x1, &(0x7f0000000380)=[{0x6, 0x0, 0x0, 0x7fffffff}]})
iopl(0x3)
syslog(0x9, &(0x7f00000001c0)=""/164, 0xa4)
ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000c80)={'lo\x00', <r3=>0x0})
sendmsg$nl_route_sched(r1, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000640)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r3, {}, {0xffff, 0xffff}, {0x10}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x12, 0x2, [@TCA_HHF_RESET_TIMEOUT={0x8, 0x4, 0x800}, @TCA_HHF_ADMIT_BYTES={0x8, 0x5, 0x4}]}}]}, 0x40}, 0x1, 0x0, 0x0, 0x51}, 0x0)
ioctl$sock_ipv6_tunnel_SIOCDELTUNNEL(0xffffffffffffffff, 0x89f2, &(0x7f0000000180)={'ip6tnl0\x00', &(0x7f00000000c0)={'ip6_vti0\x00', <r4=>0x0, 0x4, 0x9, 0x5, 0x400000, 0x20, @remote, @mcast2, 0x20, 0x1, 0x7f, 0xcef}})
r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0)
ioctl$KVM_CAP_SPLIT_IRQCHIP(r6, 0x4068aea3, &(0x7f0000000080))
ioctl$KVM_SET_GSI_ROUTING(r6, 0x4008ae6a, &(0x7f0000000200)=ANY=[@ANYBLOB="010000000000000000000000050000"])
sendmsg$nl_route(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000001c0)=@newlink={0x68, 0x10, 0x403, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x88a9fd85, 0x28882}, [@IFLA_LINKINFO={0x48, 0x12, 0x0, 0x1, @vti={{0x8}, {0x3c, 0x2, 0x0, 0x1, [@vti_common_policy, @vti_common_policy=[@IFLA_VTI_IKEY={0x8, 0x2, 0xf}, @IFLA_VTI_FWMARK={0x8, 0x6, 0xca}, @IFLA_VTI_IKEY={0x8, 0x2, 0x8000}, @IFLA_VTI_LINK={0x8, 0x1, r4}, @IFLA_VTI_OKEY={0x8, 0x3, 0x7}, @IFLA_VTI_IKEY={0x8, 0x2, 0xbbe}, @IFLA_VTI_IKEY={0x8, 0x2, 0x4}]]}}}]}, 0x68}}, 0x0)

282.849296ms ago: executing program 0 (id=286):
r0 = openat$rtc(0xffffff9c, 0x0, 0x0, 0x0)
ioctl$BTRFS_IOC_TREE_SEARCH(r0, 0x7005, 0x0)
readv(r0, &(0x7f0000000000)=[{&(0x7f00000012c0)=""/191, 0x4}], 0x3)

141.112369ms ago: executing program 4 (id=287):
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
syz_emit_ethernet(0x5e, 0x0, 0x0)
recvmsg(0xffffffffffffffff, 0x0, 0x22)
ioctl$IOMMU_TEST_OP_CREATE_ACCESS(0xffffffffffffffff, 0x3ba0, &(0x7f0000000240)={0x48})
r1 = socket$nl_route(0x10, 0x3, 0x0)
sendmsg$nl_route(r1, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000680)=ANY=[@ANYRESHEX=r0, @ANYRES32=0x0, @ANYRESHEX=r1], 0x70}, 0x1, 0x0, 0x0, 0x20008010}, 0x4)
sendmsg$nl_route(r1, &(0x7f0000000640)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x10000000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000680)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x40000}, 0x8000)
ioctl$IOMMU_TEST_OP_ACCESS_RW$syz(0xffffffffffffffff, 0x3ba0, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'batadv0\x00', <r2=>0x0})
bpf$MAP_CREATE_CONST_STR(0x0, 0x0, 0x0)
sendmsg$BATADV_CMD_TP_METER(0xffffffffffffffff, &(0x7f0000000440)={0xffffffffffffffff, 0x0, &(0x7f0000000100)={0x0}, 0x1, 0x0, 0x0, 0x48801}, 0x4)
r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48)
bpf$PROG_LOAD(0x5, &(0x7f00000002c0)={0x15, 0x10, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000800000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b702000014000000b70300000000000085000000a0000000bf090000000000005509010000030000950000000000000085100000f5ffffffbf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000240)='syzkaller\x00', 0x9, 0x0, 0x0, 0x0, 0x2d, '\x00', 0x0, @sk_reuseport, 0x0, 0x8300, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x90)
r4 = bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x11, 0x10, &(0x7f0000000140)=ANY=[], &(0x7f0000000600)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value}, 0x94)
bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r4}, 0x18)
r5 = openat$ubi_ctrl(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0)
ioctl$F2FS_IOC_START_VOLATILE_WRITE(r5, 0x40186f40, 0x20000502)
socketpair(0x1, 0x3, 0x0, &(0x7f0000000000)={<r6=>0xffffffffffffffff})
ioctl$SIOCSIFHWADDR(r6, 0x8b06, &(0x7f0000000080)={'wlan1\x00', @random="02000000000a"})
flock(0xffffffffffffffff, 0x2)
sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x20008014, &(0x7f0000000340)={0x11, 0x2, r2, 0x1, 0x0, 0x6, @broadcast}, 0x14)
renameat(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0)
mount(0x0, &(0x7f0000000040)='./cgroup\x00', &(0x7f0000000080)='befs\x00', 0x109, 0x0)
socket$inet(0x2, 0x2, 0x7)

85.655484ms ago: executing program 3 (id=288):
r0 = socket$packet(0x11, 0x3, 0x300)
r1 = socket$nl_route(0x10, 0x3, 0x0)
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000040)={'ip6gretap0\x00', <r2=>0x0})
sendmsg$nl_route(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="6800000010000100"/20, @ANYRES32=r2, @ANYBLOB="0000000000000000480012800e0001006970366772657461700000003400028008000100", @ANYRES32, @ANYBLOB="14000600fe8000"/18], 0x68}}, 0x0)
sendto$packet(r0, &(0x7f0000000180)="a6bea8a120e5f8320c30ce5086dda5e986f34c10d8c39c3002de8ec445ae083a4b7fc08a086fc691", 0x5b2, 0x0, &(0x7f0000000140)={0x11, 0x0, r2, 0x1, 0x0, 0x6, @local}, 0x14)

28.587204ms ago: executing program 0 (id=289):
bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0)
writev(0xffffffffffffffff, &(0x7f0000000000)=[{0x0}, {&(0x7f0000000340)="8a226ff432407a7f5fd09590d734f795e12e57ce9fed3f0300eb6368ed559a85603b0080", 0x24}], 0x2)
syz_genetlink_get_family_id$nl80211(&(0x7f0000000340), 0xffffffffffffffff)
socket(0x1e, 0x2, 0x0)
syz_emit_ethernet(0x9a, &(0x7f0000000600)=ANY=[@ANYRES32=0x41424344, @ANYRES32=0x41424344], 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000300)={0x8, 0x8b}, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4)
sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2)
prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0)
r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0)
read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8)
syz_open_dev$radio(0x0, 0x2, 0x2)
r1 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$IPT_SO_SET_REPLACE(r1, 0x0, 0x40, &(0x7f0000000000)=@mangle={'mangle\x00', 0x44, 0x6, 0x510, 0x0, 0x138, 0x210, 0x0, 0x138, 0x478, 0x478, 0x478, 0x478, 0x478, 0x6, 0x0, {[{{@ip={@broadcast, @multicast1=0xe0007600, 0x0, 0x0, 'geneve1\x00', 'ip6gre0\x00'}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x2000000}}, @inet=@DSCP={0x28}}, {{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @local, 0x0, 0x0, 'batadv_slave_1\x00', 'veth1_virt_wifi\x00', {}, {}, 0x11}, 0x0, 0x70, 0xa0}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @local}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'vlan1\x00', 'nr0\x00'}, 0x0, 0xb0, 0xd8, 0x0, {}, [@common=@unspec=@connlimit={{0x40}}]}, @unspec=@CHECKSUM={0x28}}, {{@ip={@loopback, @multicast2, 0x0, 0x0, 'syzkaller0\x00', 'veth1_to_team\x00'}, 0x0, 0x70, 0x198}, @common=@unspec=@SECMARK={0x128, 'SECMARK\x00', 0x0, {0x1, 0x0, 'system_u:object_r:dbusd_etc_t:s0\x00'}}}, {{@ip={@broadcast, @multicast2, 0x0, 0x0, 'lo\x00', 'batadv_slave_1\x00'}, 0x0, 0xa0, 0xd0, 0x0, {}, [@common=@unspec=@mac={{0x30}, {@multicast}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x0, 0x0, @loopback}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x570)
r2 = syz_init_net_socket$rose(0xb, 0x5, 0x0)
mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz1\x00', 0x1ff)
r3 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0)
r4 = openat$cgroup_procs(r3, &(0x7f0000000040)='tasks\x00', 0x2, 0x0)
sendfile(r4, r4, 0x0, 0xc)
r5 = openat$cgroup_procs(r3, &(0x7f0000000240)='cgroup.procs\x00', 0x2, 0x0)
sendfile(r5, r5, 0x0, 0xfff)
sendfile(r5, r4, 0x0, 0x5)
bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f0000000340)={0x3}, 0x10, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x10, 0x0, @void, @value}, 0x90)
ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8b36, &(0x7f0000000000)={'wlan0\x00'})
r6 = socket$inet_tcp(0x2, 0x1, 0x0)
setsockopt$inet_buf(r6, 0x0, 0x8008000000010, &(0x7f00000003c0)="17000000020001000003d68c5ee17688a2003208030300ecff3f0000000300000a0000000098fc5ad9485bbb6a880000d6c8db0000dba67e06000000e28900000200df018000000000f50607bdff59100ac45761547a681f009cee4a5acb3da400001fb700674f00c88ebbf9315033bf79ac2dff060115003901000000000000ea000000000000000002ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e0", 0xb8)
r7 = socket$key(0xf, 0x3, 0x2)
sendmsg$key(r7, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)={0x2, 0x13, 0x0, 0x0, 0x2}, 0x10}}, 0x0)
ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000140)={&(0x7f0000000040)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f0000000080)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0], &(0x7f00000000c0)=[0x0], &(0x7f0000000100)=[0x0], 0x7, 0x8, 0x1, 0x1})

0s ago: executing program 2 (id=290):
syz_usb_connect(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="12010000e09d7040460a2196324f01020301090224000100000000090400000206d3450009050102100000000009058b0240"], 0x0)
prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100008b}, 0x0)
r0 = getpid()
r1 = socket(0x2, 0x80805, 0x0)
getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r1, 0x84, 0x6f, &(0x7f0000000080)={0x0, 0x2, &(0x7f0000000380)=[@in={0x2, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}}]}, &(0x7f0000000180)=0xfe04)
sched_setscheduler(r0, 0x1, &(0x7f0000000100)=0x5)
bpf$TOKEN_CREATE(0x24, &(0x7f0000000100), 0x8)
bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)={0x1b, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, '\x00', 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, @void, @value, @void, @value}, 0x48)
syz_open_dev$usbmon(0x0, 0x0, 0x0)
sched_setaffinity(0x0, 0x0, 0x0)
sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7)
mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0)
socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={<r2=>0xffffffffffffffff, <r3=>0xffffffffffffffff})
connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e)
sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0)
recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0)
socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000040)={0xffffffffffffffff, <r4=>0xffffffffffffffff})
sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0)
write(0xffffffffffffffff, &(0x7f0000000340), 0x11000)
r5 = socket$nl_generic(0x10, 0x3, 0x10)
r6 = syz_genetlink_get_family_id$ipvs(&(0x7f0000000040), 0xffffffffffffffff)
sendmsg$IPVS_CMD_SET_SERVICE(r5, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000080)={0x14, r6, 0x1, 0x70bd26, 0x25dfdbff}, 0x14}, 0x1, 0x0, 0x0, 0x81}, 0x40400a0)

kernel console output (not intermixed with test programs):

Warning: Permanently added '10.128.0.56' (ED25519) to the list of known hosts.
[   74.340967][ T5812] cgroup: Unknown subsys name 'net'
[   74.447364][ T5812] cgroup: Unknown subsys name 'cpuset'
[   74.456406][ T5812] cgroup: Unknown subsys name 'rlimit'
Setting up swapspace version 1, size = 127995904 bytes
[   76.024500][ T5812] Adding 124996k swap on ./swap-file.  Priority:0 extents:1 across:124996k 
[   80.439185][ T5843] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1
[   80.447903][ T5843] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1
[   80.457020][ T5843] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9
[   80.457432][ T5835] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1
[   80.466366][ T5843] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9
[   80.479022][ T5845] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9
[   80.481700][ T5840] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1
[   80.496575][ T5839] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1
[   80.507549][ T5835] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4
[   80.514949][ T5835] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9
[   80.523255][ T5840] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9
[   80.530767][ T5840] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9
[   80.532638][ T5844] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9
[   80.545040][ T5835] Bluetooth: hci3: unexpected cc 0x0c25 length: 249 > 3
[   80.545788][ T5844] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9
[   80.552741][ T5840] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9
[   80.559897][ T5844] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2
[   80.567631][ T5840] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9
[   80.573902][ T5844] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4
[   80.581598][ T5840] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4
[   80.588814][ T5844] Bluetooth: hci4: unexpected cc 0x0c25 length: 249 > 3
[   80.595209][ T5840] Bluetooth: hci1: unexpected cc 0x0c25 length: 249 > 3
[   80.601193][ T5844] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4
[   80.608570][ T5840] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2
[   80.615921][ T5844] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2
[   80.624052][ T5831] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4
[   80.637215][ T5844] Bluetooth: hci0: unexpected cc 0x0c25 length: 249 > 3
[   80.645043][ T5840] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2
[   80.667445][   T53] Bluetooth: hci2: unexpected cc 0x0c25 length: 249 > 3
[   80.675586][   T53] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2
[   81.098135][ T5822] chnl_net:caif_netlink_parms(): no params data found
[   81.157386][ T5826] chnl_net:caif_netlink_parms(): no params data found
[   81.213705][ T5824] chnl_net:caif_netlink_parms(): no params data found
[   81.258891][ T5823] chnl_net:caif_netlink_parms(): no params data found
[   81.407659][ T5822] bridge0: port 1(bridge_slave_0) entered blocking state
[   81.415062][ T5822] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.422504][ T5822] bridge_slave_0: entered allmulticast mode
[   81.431062][ T5822] bridge_slave_0: entered promiscuous mode
[   81.442827][ T5829] chnl_net:caif_netlink_parms(): no params data found
[   81.459072][ T5826] bridge0: port 1(bridge_slave_0) entered blocking state
[   81.466465][ T5826] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.474497][ T5826] bridge_slave_0: entered allmulticast mode
[   81.481277][ T5826] bridge_slave_0: entered promiscuous mode
[   81.508249][ T5822] bridge0: port 2(bridge_slave_1) entered blocking state
[   81.515643][ T5822] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.522918][ T5822] bridge_slave_1: entered allmulticast mode
[   81.529952][ T5822] bridge_slave_1: entered promiscuous mode
[   81.546552][ T5826] bridge0: port 2(bridge_slave_1) entered blocking state
[   81.553805][ T5826] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.561327][ T5826] bridge_slave_1: entered allmulticast mode
[   81.568594][ T5826] bridge_slave_1: entered promiscuous mode
[   81.575265][ T5824] bridge0: port 1(bridge_slave_0) entered blocking state
[   81.582427][ T5824] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.589860][ T5824] bridge_slave_0: entered allmulticast mode
[   81.596810][ T5824] bridge_slave_0: entered promiscuous mode
[   81.604665][ T5824] bridge0: port 2(bridge_slave_1) entered blocking state
[   81.611767][ T5824] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.620309][ T5824] bridge_slave_1: entered allmulticast mode
[   81.627480][ T5824] bridge_slave_1: entered promiscuous mode
[   81.715785][ T5826] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   81.736687][ T5822] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   81.749014][ T5822] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   81.767948][ T5823] bridge0: port 1(bridge_slave_0) entered blocking state
[   81.775593][ T5823] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.782777][ T5823] bridge_slave_0: entered allmulticast mode
[   81.791609][ T5823] bridge_slave_0: entered promiscuous mode
[   81.804054][ T5826] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   81.825055][ T5824] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   81.836934][ T5824] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   81.854884][ T5823] bridge0: port 2(bridge_slave_1) entered blocking state
[   81.861993][ T5823] bridge0: port 2(bridge_slave_1) entered disabled state
[   81.869450][ T5823] bridge_slave_1: entered allmulticast mode
[   81.876260][ T5823] bridge_slave_1: entered promiscuous mode
[   81.935488][ T5826] team0: Port device team_slave_0 added
[   81.941669][ T5829] bridge0: port 1(bridge_slave_0) entered blocking state
[   81.949074][ T5829] bridge0: port 1(bridge_slave_0) entered disabled state
[   81.956371][ T5829] bridge_slave_0: entered allmulticast mode
[   81.963813][ T5829] bridge_slave_0: entered promiscuous mode
[   81.982417][ T5822] team0: Port device team_slave_0 added
[   81.990977][ T5822] team0: Port device team_slave_1 added
[   82.007682][ T5823] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   82.019600][ T5826] team0: Port device team_slave_1 added
[   82.026000][ T5829] bridge0: port 2(bridge_slave_1) entered blocking state
[   82.033634][ T5829] bridge0: port 2(bridge_slave_1) entered disabled state
[   82.040830][ T5829] bridge_slave_1: entered allmulticast mode
[   82.048027][ T5829] bridge_slave_1: entered promiscuous mode
[   82.067554][ T5824] team0: Port device team_slave_0 added
[   82.076075][ T5824] team0: Port device team_slave_1 added
[   82.112315][ T5823] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   82.157535][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_0
[   82.164566][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.190900][ T5822] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   82.221619][ T5829] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link
[   82.241167][ T5822] batman_adv: batadv0: Adding interface: batadv_slave_1
[   82.248479][ T5822] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.274631][ T5822] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   82.295651][ T5823] team0: Port device team_slave_0 added
[   82.302063][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_0
[   82.309141][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.335496][ T5826] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   82.349093][ T5829] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link
[   82.367826][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_0
[   82.375285][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.401455][ T5824] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   82.419225][ T5823] team0: Port device team_slave_1 added
[   82.434492][ T5826] batman_adv: batadv0: Adding interface: batadv_slave_1
[   82.441470][ T5826] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.468078][ T5826] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   82.490737][ T5824] batman_adv: batadv0: Adding interface: batadv_slave_1
[   82.498011][ T5824] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.524027][ T5824] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   82.561927][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_0
[   82.569120][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.595192][ T5823] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   82.609392][ T5829] team0: Port device team_slave_0 added
[   82.617945][ T5829] team0: Port device team_slave_1 added
[   82.656657][   T53] Bluetooth: hci1: command tx timeout
[   82.672997][ T5822] hsr_slave_0: entered promiscuous mode
[   82.680429][ T5822] hsr_slave_1: entered promiscuous mode
[   82.688425][ T5823] batman_adv: batadv0: Adding interface: batadv_slave_1
[   82.695555][ T5823] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.721633][ T5823] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   82.733508][   T53] Bluetooth: hci0: command tx timeout
[   82.733615][ T5840] Bluetooth: hci2: command tx timeout
[   82.739027][ T5830] Bluetooth: hci4: command tx timeout
[   82.744798][ T5134] Bluetooth: hci3: command tx timeout
[   82.765964][ T5824] hsr_slave_0: entered promiscuous mode
[   82.772121][ T5824] hsr_slave_1: entered promiscuous mode
[   82.778459][ T5824] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   82.786375][ T5824] Cannot create hsr debugfs directory
[   82.808904][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_0
[   82.816069][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.842278][ T5829] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active
[   82.855667][ T5829] batman_adv: batadv0: Adding interface: batadv_slave_1
[   82.862652][ T5829] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem.
[   82.888634][ T5829] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active
[   82.915796][ T5826] hsr_slave_0: entered promiscuous mode
[   82.922002][ T5826] hsr_slave_1: entered promiscuous mode
[   82.928520][ T5826] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   82.936350][ T5826] Cannot create hsr debugfs directory
[   83.019382][ T5823] hsr_slave_0: entered promiscuous mode
[   83.026074][ T5823] hsr_slave_1: entered promiscuous mode
[   83.032025][ T5823] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   83.040273][ T5823] Cannot create hsr debugfs directory
[   83.103382][ T5829] hsr_slave_0: entered promiscuous mode
[   83.109718][ T5829] hsr_slave_1: entered promiscuous mode
[   83.116827][ T5829] debugfs: Directory 'hsr0' with parent 'hsr' already present!
[   83.125309][ T5829] Cannot create hsr debugfs directory
[   83.440319][ T5824] netdevsim netdevsim2 netdevsim0: renamed from eth0
[   83.452834][ T5824] netdevsim netdevsim2 netdevsim1: renamed from eth1
[   83.476183][ T5824] netdevsim netdevsim2 netdevsim2: renamed from eth2
[   83.493615][ T5824] netdevsim netdevsim2 netdevsim3: renamed from eth3
[   83.528263][ T5822] netdevsim netdevsim3 netdevsim0: renamed from eth0
[   83.546242][ T5822] netdevsim netdevsim3 netdevsim1: renamed from eth1
[   83.561340][ T5822] netdevsim netdevsim3 netdevsim2: renamed from eth2
[   83.575273][ T5822] netdevsim netdevsim3 netdevsim3: renamed from eth3
[   83.650760][ T5823] netdevsim netdevsim0 netdevsim0: renamed from eth0
[   83.661664][ T5823] netdevsim netdevsim0 netdevsim1: renamed from eth1
[   83.696011][ T5823] netdevsim netdevsim0 netdevsim2: renamed from eth2
[   83.708900][ T5823] netdevsim netdevsim0 netdevsim3: renamed from eth3
[   83.791667][ T5826] netdevsim netdevsim1 netdevsim0: renamed from eth0
[   83.805009][ T5826] netdevsim netdevsim1 netdevsim1: renamed from eth1
[   83.818309][ T5824] 8021q: adding VLAN 0 to HW filter on device bond0
[   83.834096][ T5826] netdevsim netdevsim1 netdevsim2: renamed from eth2
[   83.843962][ T5826] netdevsim netdevsim1 netdevsim3: renamed from eth3
[   83.904384][ T5829] netdevsim netdevsim4 netdevsim0: renamed from eth0
[   83.921822][ T5829] netdevsim netdevsim4 netdevsim1: renamed from eth1
[   83.934592][ T5829] netdevsim netdevsim4 netdevsim2: renamed from eth2
[   83.955837][ T5824] 8021q: adding VLAN 0 to HW filter on device team0
[   83.968629][ T5829] netdevsim netdevsim4 netdevsim3: renamed from eth3
[   83.997631][ T5822] 8021q: adding VLAN 0 to HW filter on device bond0
[   84.020186][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state
[   84.027689][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state
[   84.038799][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state
[   84.045977][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state
[   84.132874][ T5822] 8021q: adding VLAN 0 to HW filter on device team0
[   84.168482][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state
[   84.175616][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state
[   84.197714][ T2910] bridge0: port 2(bridge_slave_1) entered blocking state
[   84.204949][ T2910] bridge0: port 2(bridge_slave_1) entered forwarding state
[   84.242523][ T5823] 8021q: adding VLAN 0 to HW filter on device bond0
[   84.300665][ T5823] 8021q: adding VLAN 0 to HW filter on device team0
[   84.338279][ T2910] bridge0: port 1(bridge_slave_0) entered blocking state
[   84.345642][ T2910] bridge0: port 1(bridge_slave_0) entered forwarding state
[   84.382860][ T2910] bridge0: port 2(bridge_slave_1) entered blocking state
[   84.390174][ T2910] bridge0: port 2(bridge_slave_1) entered forwarding state
[   84.428052][ T5826] 8021q: adding VLAN 0 to HW filter on device bond0
[   84.452344][ T5829] 8021q: adding VLAN 0 to HW filter on device bond0
[   84.521108][ T5826] 8021q: adding VLAN 0 to HW filter on device team0
[   84.578690][ T2967] bridge0: port 1(bridge_slave_0) entered blocking state
[   84.585860][ T2967] bridge0: port 1(bridge_slave_0) entered forwarding state
[   84.603386][ T5829] 8021q: adding VLAN 0 to HW filter on device team0
[   84.641846][ T1163] bridge0: port 1(bridge_slave_0) entered blocking state
[   84.649049][ T1163] bridge0: port 1(bridge_slave_0) entered forwarding state
[   84.696703][ T1163] bridge0: port 2(bridge_slave_1) entered blocking state
[   84.703898][ T1163] bridge0: port 2(bridge_slave_1) entered forwarding state
[   84.722252][ T2910] bridge0: port 2(bridge_slave_1) entered blocking state
[   84.729455][ T2910] bridge0: port 2(bridge_slave_1) entered forwarding state
[   84.744779][ T5134] Bluetooth: hci1: command tx timeout
[   84.762063][ T5824] 8021q: adding VLAN 0 to HW filter on device batadv0
[   84.815606][ T5134] Bluetooth: hci4: command tx timeout
[   84.821104][ T5134] Bluetooth: hci0: command tx timeout
[   84.826867][ T5134] Bluetooth: hci3: command tx timeout
[   84.832317][ T5134] Bluetooth: hci2: command tx timeout
[   84.872010][ T5822] 8021q: adding VLAN 0 to HW filter on device batadv0
[   84.908768][ T5829] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network
[   84.957570][ T5823] 8021q: adding VLAN 0 to HW filter on device batadv0
[   85.014461][ T5824] veth0_vlan: entered promiscuous mode
[   85.058528][ T5824] veth1_vlan: entered promiscuous mode
[   85.116539][ T5822] veth0_vlan: entered promiscuous mode
[   85.161504][ T5823] veth0_vlan: entered promiscuous mode
[   85.170602][ T5822] veth1_vlan: entered promiscuous mode
[   85.179447][ T5824] veth0_macvtap: entered promiscuous mode
[   85.197849][ T5823] veth1_vlan: entered promiscuous mode
[   85.226928][ T5824] veth1_macvtap: entered promiscuous mode
[   85.262631][ T5826] 8021q: adding VLAN 0 to HW filter on device batadv0
[   85.289688][ T5823] veth0_macvtap: entered promiscuous mode
[   85.314792][ T5823] veth1_macvtap: entered promiscuous mode
[   85.326726][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_0
[   85.347569][ T5829] 8021q: adding VLAN 0 to HW filter on device batadv0
[   85.361602][ T5824] batman_adv: batadv0: Interface activated: batadv_slave_1
[   85.380328][ T5822] veth0_macvtap: entered promiscuous mode
[   85.410497][ T5823] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.427939][ T5823] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.440530][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_0
[   85.451085][ T5824] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   85.461910][ T5824] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   85.470992][ T5824] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   85.480205][ T5824] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   85.493071][ T5822] veth1_macvtap: entered promiscuous mode
[   85.520618][ T5823] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.538450][ T5823] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.553968][ T5823] batman_adv: batadv0: Interface activated: batadv_slave_1
[   85.579928][ T5823] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   85.593680][ T5823] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   85.602628][ T5823] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   85.612060][ T5823] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   85.637737][ T5826] veth0_vlan: entered promiscuous mode
[   85.691913][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.707171][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.717409][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   85.728420][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.739787][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_0
[   85.770094][ T5826] veth1_vlan: entered promiscuous mode
[   85.794981][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.805701][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.816229][ T5822] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   85.827016][ T5822] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   85.838110][ T5822] batman_adv: batadv0: Interface activated: batadv_slave_1
[   85.895466][   T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   85.906735][   T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   85.920149][ T5822] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   85.929063][ T5822] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   85.939579][ T5822] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   85.949003][ T5822] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   86.009497][   T51] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.026749][ T5826] veth0_macvtap: entered promiscuous mode
[   86.032681][   T51] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.041184][ T2910] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.044199][ T5826] veth1_macvtap: entered promiscuous mode
[   86.055592][ T2910] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.063054][ T5829] veth0_vlan: entered promiscuous mode
[   86.114729][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   86.126356][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.138550][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   86.149482][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.159641][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   86.170561][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.183710][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_0
[   86.202750][ T5829] veth1_vlan: entered promiscuous mode
[   86.229223][ T2910] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.242757][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   86.258092][ T2910] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.261284][ T5824] soft_limit_in_bytes is deprecated and will be removed. Please report your usecase to linux-mm@kvack.org if you depend on this functionality.
[   86.265576][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.265613][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   86.265631][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.265645][ T5826] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   86.265661][ T5826] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.266764][ T5826] batman_adv: batadv0: Interface activated: batadv_slave_1
[   86.402945][ T5826] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   86.417376][ T5826] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   86.440907][ T5826] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   86.450207][ T5826] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   86.487820][   T71] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.498649][   T71] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.628782][ T5829] veth0_macvtap: entered promiscuous mode
[   86.699148][ T5829] veth1_macvtap: entered promiscuous mode
[   86.710092][   T12] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   86.725831][   T12] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   86.769187][ T5916] kvm_intel: L1TF CPU bug present and SMT on, data leak possible. See CVE-2018-3646 and https://www.kernel.org/doc/html/latest/admin-guide/hw-vuln/l1tf.html for details.
[   86.813628][ T5134] Bluetooth: hci1: command tx timeout
[   86.852136][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   86.876683][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.893598][ T5134] Bluetooth: hci2: command tx timeout
[   86.899112][ T5830] Bluetooth: hci0: command tx timeout
[   86.904597][   T53] Bluetooth: hci4: command tx timeout
[   86.904638][ T5840] Bluetooth: hci3: command tx timeout
[   86.916538][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[   86.933293][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   86.933629][   T57] usb 3-1: new high-speed USB device number 2 using dummy_hcd
[   86.961418][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   86.979340][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   86.990892][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   87.007032][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3e) already exists on: batadv_slave_0
[   87.018015][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   87.070170][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_0
[   87.094247][ T2910] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   87.110691][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   87.121791][    T0] NOHZ tick-stop error: local softirq work is pending, handler #140!!!
[   87.144537][ T2910] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   87.166004][   T57] usb 3-1: New USB device found, idVendor=09e1, idProduct=5121, bcdDevice=40.c1
[   87.180538][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   87.190914][   T57] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   87.200066][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   87.211430][   T57] usb 3-1: Product: syz
[   87.218275][   T57] usb 3-1: Manufacturer: syz
[   87.223077][   T57] usb 3-1: SerialNumber: syz
[   87.223789][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[   87.236657][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   87.271772][   T57] usb 3-1: config 0 descriptor??
[   87.311118][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   87.326382][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[   87.351988][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   87.371102][ T5829] batman_adv: The newly added mac address (aa:aa:aa:aa:aa:3f) already exists on: batadv_slave_1
[   87.383049][ T5829] batman_adv: It is strongly recommended to keep mac addresses unique to avoid problems!
[   87.413366][    T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!!
[   87.419468][ T5829] batman_adv: batadv0: Interface activated: batadv_slave_1
[   87.428696][    T0] NOHZ tick-stop error: local softirq work is pending, handler #40!!!
[   87.451409][ T5829] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0
[   87.453904][    T0] NOHZ tick-stop error: local softirq work is pending, handler #200!!!
[   87.464050][ T5829] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0
[   87.490730][ T5829] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0
[   87.500305][ T5829] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0
[   87.954175][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[   88.023305][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[   88.145077][    T0] NOHZ tick-stop error: local softirq work is pending, handler #100!!!
[   88.645280][   T57] int51x1 3-1:0.0: probe with driver int51x1 failed with error -22
[   89.567088][ T5840] Bluetooth: hci1: command tx timeout
[   89.567091][ T5830] Bluetooth: hci3: command tx timeout
[   89.567154][ T5840] Bluetooth: hci0: command tx timeout
[   89.572536][ T5830] Bluetooth: hci2: command tx timeout
[   89.572571][ T5830] Bluetooth: hci4: command tx timeout
[   89.647977][ T5879] usb 3-1: USB disconnect, device number 2
[   89.842567][   T71] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   89.857081][   T71] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   89.935774][ T5924] devpts: called with bogus options
[   90.119875][   T11] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   90.161155][   T11] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   90.338432][   T11] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50
[   90.364801][   T11] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50
[   90.536633][ T5913] usb 4-1: new high-speed USB device number 2 using dummy_hcd
[   90.743517][ T5913] usb 4-1: Using ep0 maxpacket: 16
[   90.899838][ T5913] usb 4-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4
[   91.138382][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[   91.295313][ T5913] usb 4-1: Product: syz
[   91.299544][ T5913] usb 4-1: Manufacturer: syz
[   91.343311][ T5913] usb 4-1: SerialNumber: syz
[   91.380300][ T5913] usb 4-1: config 0 descriptor??
[   91.475603][ T5913] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state.
[   91.818085][ T5913] gp8psk: usb in 128 operation failed.
[   92.312437][ T5913] gp8psk: usb in 137 operation failed.
[   92.363955][ T5913] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[   92.540102][ T5913] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver)
[   92.593932][ T5939] netlink: 1268 bytes leftover after parsing attributes in process `syz.4.5'.
[   92.616021][ T5913] usb 4-1: media controller created
[   92.741158][ T5913] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[   92.815610][  T974] cfg80211: failed to load regulatory.db
[   92.907780][ T5913] gp8psk_fe: Frontend revision 1 attached
[   92.949022][ T5913] usb 4-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)...
[   93.056413][ T5913] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered.
[   93.207452][ T5913] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected.
[   93.221948][ T5913] gp8psk: found Genpix USB device pID = 201 (hex)
[   93.430453][    T8] usb 4-1: USB disconnect, device number 2
[   93.725028][    T8] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected.
[   94.269497][ T5961] netlink: 1268 bytes leftover after parsing attributes in process `syz.2.8'.
[   94.627659][ T5959] ubi0: attaching mtd0
[   94.644593][ T5959] ubi0: scanning is finished
[   94.649563][ T5959] ubi0: empty MTD device detected
[   94.820542][ T5964] Driver unsupported XDP return value 0 on prog  (id 3) dev N/A, expect packet loss!
[   94.924170][ T5943] sch_tbf: burst 4398 is lower than device lo mtu (65550) !
[   96.058293][ T5959] ubi0: attached mtd0 (name "mtdram test device", size 0 MiB)
[   96.066238][ T5959] ubi0: PEB size: 4096 bytes (4 KiB), LEB size: 3968 bytes
[   96.075354][ T5959] ubi0: min./max. I/O unit sizes: 1/64, sub-page size 1
[   96.085578][ T5959] ubi0: VID header offset: 64 (aligned 64), data offset: 128
[   96.096195][ T5959] ubi0: good PEBs: 32, bad PEBs: 0, corrupted PEBs: 0
[   96.105417][ T5959] ubi0: user volume: 0, internal volumes: 1, max. volumes count: 23
[   96.122333][ T5959] ubi0: max/mean erase counter: 0/0, WL threshold: 4096, image sequence number: 482878513
[   96.141995][ T5972] program syz.4.19 is using a deprecated SCSI ioctl, please convert it to SG_IO
[   96.358808][ T5959] ubi0: available PEBs: 28, total reserved PEBs: 4, PEBs reserved for bad PEB handling: 0
[   96.400226][ T5981] ubi0: background thread "ubi_bgt0d" started, PID 5981
[   97.384798][ T5991] netlink: 'syz.2.23': attribute type 5 has an invalid length.
[  100.305918][ T6006] ubi: mtd0 is already attached to ubi0
[  100.329088][ T6006] warning: `syz.0.29' uses wireless extensions which will stop working for Wi-Fi 7 hardware; use nl80211
[  102.094131][ T6027] UDPLite: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[  103.409733][ T6031] 8021q: adding VLAN 0 to HW filter on device bond0
[  103.458991][ T6031] bond0: (slave rose0): Enslaving as an active interface with an up link
[  103.488167][ T5913] usb 1-1: new high-speed USB device number 2 using dummy_hcd
[  103.552486][ T5930] IPVS: starting estimator thread 0...
[  103.677170][ T6038] IPVS: using max 21 ests per chain, 50400 per kthread
[  103.687186][ T6041] FAULT_INJECTION: forcing a failure.
[  103.687186][ T6041] name failslab, interval 1, probability 0, space 0, times 1
[  103.692938][ T5913] usb 1-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7
[  103.738335][ T6041] CPU: 1 UID: 0 PID: 6041 Comm: syz.4.37 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  103.738365][ T6041] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  103.738382][ T6041] Call Trace:
[  103.738389][ T6041]  <TASK>
[  103.738398][ T6041]  dump_stack_lvl+0x241/0x360
[  103.738435][ T6041]  ? __pfx_dump_stack_lvl+0x10/0x10
[  103.738456][ T6041]  ? __pfx__printk+0x10/0x10
[  103.738490][ T6041]  ? __kmalloc_node_noprof+0xb9/0x4d0
[  103.738520][ T6041]  ? __pfx___might_resched+0x10/0x10
[  103.738547][ T6041]  should_fail_ex+0x40a/0x550
[  103.738576][ T6041]  should_failslab+0xac/0x100
[  103.738604][ T6041]  __kmalloc_node_noprof+0xe1/0x4d0
[  103.738631][ T6041]  ? alloc_slab_obj_exts+0x3a/0xa0
[  103.738657][ T6041]  ? __kmalloc_node_noprof+0xb9/0x4d0
[  103.738689][ T6041]  alloc_slab_obj_exts+0x3a/0xa0
[  103.738715][ T6041]  __memcg_slab_post_alloc_hook+0x319/0x7e0
[  103.738756][ T6041]  ? kasan_unpoison+0x46/0x70
[  103.738792][ T6041]  __kmalloc_node_noprof+0x30d/0x4d0
[  103.738819][ T6041]  ? __kvmalloc_node_noprof+0x72/0x190
[  103.738857][ T6041]  __kvmalloc_node_noprof+0x72/0x190
[  103.738890][ T6041]  seq_read_iter+0x20c/0xd70
[  103.738918][ T6041]  ? rcu_is_watching+0x15/0xb0
[  103.738961][ T6041]  copy_splice_read+0x637/0xb40
[  103.738994][ T6041]  ? __pfx_copy_splice_read+0x10/0x10
[  103.739042][ T6041]  ? alloc_pipe_info+0x370/0x4d0
[  103.739066][ T6041]  ? __pfx_copy_splice_read+0x10/0x10
[  103.739090][ T6041]  splice_direct_to_actor+0x4af/0xc80
[  103.739145][ T6041]  ? __pfx_direct_splice_actor+0x10/0x10
[  103.739170][ T6041]  ? __pfx_splice_direct_to_actor+0x10/0x10
[  103.739194][ T6041]  ? __fget_files+0x2a/0x410
[  103.739221][ T6041]  ? __pfx_lock_release+0x10/0x10
[  103.739252][ T6041]  do_splice_direct+0x289/0x3e0
[  103.739281][ T6041]  ? __pfx_do_splice_direct+0x10/0x10
[  103.739301][ T6041]  ? __fget_files+0x2a/0x410
[  103.739327][ T6041]  ? __pfx_direct_file_splice_eof+0x10/0x10
[  103.739360][ T6041]  ? rw_verify_area+0x239/0x630
[  103.739395][ T6041]  do_sendfile+0x564/0x8a0
[  103.739431][ T6041]  ? __pfx_do_sendfile+0x10/0x10
[  103.739459][ T6041]  ? __fget_files+0x2a/0x410
[  103.739513][ T6041]  __se_sys_sendfile64+0x17c/0x1e0
[  103.739543][ T6041]  ? __pfx___se_sys_sendfile64+0x10/0x10
[  103.739571][ T6041]  ? do_syscall_64+0x100/0x230
[  103.739602][ T6041]  ? do_syscall_64+0xb6/0x230
[  103.739632][ T6041]  do_syscall_64+0xf3/0x230
[  103.739659][ T6041]  ? clear_bhb_loop+0x35/0x90
[  103.739692][ T6041]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  103.739719][ T6041] RIP: 0033:0x7f488518cd29
[  103.739743][ T6041] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  103.739759][ T6041] RSP: 002b:00007f4885faf038 EFLAGS: 00000246 ORIG_RAX: 0000000000000028
[  103.739781][ T6041] RAX: ffffffffffffffda RBX: 00007f48853a5fa0 RCX: 00007f488518cd29
[  103.739796][ T6041] RDX: 0000000000000000 RSI: 0000000000000003 RDI: 0000000000000005
[  103.739808][ T6041] RBP: 00007f4885faf090 R08: 0000000000000000 R09: 0000000000000000
[  103.739821][ T6041] R10: 000000007ffffffd R11: 0000000000000246 R12: 0000000000000001
[  103.739846][ T6041] R13: 0000000000000000 R14: 00007f48853a5fa0 R15: 00007fffee6881a8
[  103.739876][ T6041]  </TASK>
[  103.778978][ T5913] usb 1-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47
[  104.095602][ T5913] usb 1-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d
[  104.097269][ T6048] netlink: 4 bytes leftover after parsing attributes in process `syz.4.40'.
[  104.106427][ T5913] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  104.137738][ T6029] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  104.175775][ T5913] usb 1-1: Quirk or no altset; falling back to MIDI 1.0
[  104.253516][ T5908] usb 4-1: new high-speed USB device number 3 using dummy_hcd
[  104.261265][  T974] usb 2-1: new high-speed USB device number 2 using dummy_hcd
[  104.599665][  T974] usb 2-1: too many endpoints for config 0 interface 0 altsetting 0: 196, using maximum allowed: 30
[  104.610618][ T5908] usb 4-1: Using ep0 maxpacket: 32
[  105.417404][  T974] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  105.434428][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  105.475762][  T974] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  105.493145][ T5908] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  105.530544][  T974] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 196
[  105.561598][ T5908] usb 4-1: New USB device found, idVendor=046d, idProduct=c31c, bcdDevice= 0.40
[  105.591854][ T5908] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  105.604249][  T974] usb 2-1: New USB device found, idVendor=04d9, idProduct=a055, bcdDevice= 0.00
[  105.638863][ T5908] usb 4-1: config 0 descriptor??
[  105.658174][  T974] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  105.682162][ T5908] hub 4-1:0.0: USB hub found
[  105.709661][  T974] usb 2-1: config 0 descriptor??
[  105.897769][ T5908] hub 4-1:0.0: 1 port detected
[  105.920772][ T5913] usb 1-1: USB disconnect, device number 2
[  106.744461][ T6049] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  106.763639][ T5908] hub 4-1:0.0: hub_hub_status failed (err = -71)
[  106.770756][ T6049] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  106.815017][ T5908] hub 4-1:0.0: config failed, can't get hub status (err -71)
[  106.844718][  T974] usbhid 2-1:0.0: can't add hid device: -71
[  106.865141][  T974] usbhid 2-1:0.0: probe with driver usbhid failed with error -71
[  106.880335][ T5908] usbhid 4-1:0.0: can't add hid device: -71
[  106.896603][ T5908] usbhid 4-1:0.0: probe with driver usbhid failed with error -71
[  106.909039][  T974] usb 2-1: USB disconnect, device number 2
[  107.003240][ T5908] usb 4-1: USB disconnect, device number 3
[  107.344880][ T5913] usb 1-1: new high-speed USB device number 3 using dummy_hcd
[  107.368086][ T6091] FAULT_INJECTION: forcing a failure.
[  107.368086][ T6091] name fail_usercopy, interval 1, probability 0, space 0, times 1
[  107.381562][ T6091] CPU: 0 UID: 0 PID: 6091 Comm: syz.2.44 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  107.381587][ T6091] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  107.381598][ T6091] Call Trace:
[  107.381606][ T6091]  <TASK>
[  107.381614][ T6091]  dump_stack_lvl+0x241/0x360
[  107.381641][ T6091]  ? __pfx_dump_stack_lvl+0x10/0x10
[  107.381679][ T6091]  ? __pfx__printk+0x10/0x10
[  107.381716][ T6091]  ? snprintf+0xda/0x120
[  107.381739][ T6091]  should_fail_ex+0x40a/0x550
[  107.381768][ T6091]  _copy_to_user+0x31/0xb0
[  107.381789][ T6091]  simple_read_from_buffer+0xca/0x150
[  107.381817][ T6091]  proc_fail_nth_read+0x1e9/0x250
[  107.381845][ T6091]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  107.381874][ T6091]  ? rw_verify_area+0x243/0x630
[  107.381906][ T6091]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  107.381932][ T6091]  vfs_read+0x1f8/0xb40
[  107.381965][ T6091]  ? fdget_pos+0x254/0x320
[  107.381994][ T6091]  ? __pfx___mutex_lock+0x10/0x10
[  107.382021][ T6091]  ? __pfx_vfs_read+0x10/0x10
[  107.382057][ T6091]  ? __fget_files+0x2a/0x410
[  107.382086][ T6091]  ? __fget_files+0x395/0x410
[  107.382117][ T6091]  ? __fget_files+0x2a/0x410
[  107.382159][ T6091]  ksys_read+0x18f/0x2b0
[  107.382181][ T6091]  ? __pfx_ksys_read+0x10/0x10
[  107.382201][ T6091]  ? do_syscall_64+0x100/0x230
[  107.382230][ T6091]  ? do_syscall_64+0xb6/0x230
[  107.382259][ T6091]  do_syscall_64+0xf3/0x230
[  107.382286][ T6091]  ? clear_bhb_loop+0x35/0x90
[  107.382318][ T6091]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  107.382346][ T6091] RIP: 0033:0x7fc9c358b73c
[  107.382364][ T6091] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48
[  107.382381][ T6091] RSP: 002b:00007fc9c43a4030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  107.382402][ T6091] RAX: ffffffffffffffda RBX: 00007fc9c37a6080 RCX: 00007fc9c358b73c
[  107.382417][ T6091] RDX: 000000000000000f RSI: 00007fc9c43a40a0 RDI: 000000000000000c
[  107.382430][ T6091] RBP: 00007fc9c43a4090 R08: 0000000000000000 R09: 0000000000000000
[  107.382443][ T6091] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  107.382455][ T6091] R13: 0000000000000000 R14: 00007fc9c37a6080 R15: 00007ffe8dae20f8
[  107.382486][ T6091]  </TASK>
[  107.605207][    C0] vkms_vblank_simulate: vblank timer overrun
[  107.957483][ T5913] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  107.986063][ T5913] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  108.392644][ T5913] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  108.405923][ T5913] usb 1-1: New USB device found, idVendor=056a, idProduct=00d5, bcdDevice= 0.00
[  108.415461][ T5913] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  108.444215][ T5913] usb 1-1: config 0 descriptor??
[  108.979642][ T6120] FAULT_INJECTION: forcing a failure.
[  108.979642][ T6120] name failslab, interval 1, probability 0, space 0, times 0
[  109.053368][ T6120] CPU: 1 UID: 0 PID: 6120 Comm: syz.4.53 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  109.053396][ T6120] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  109.053409][ T6120] Call Trace:
[  109.053426][ T6120]  <TASK>
[  109.053435][ T6120]  dump_stack_lvl+0x241/0x360
[  109.053467][ T6120]  ? __pfx_dump_stack_lvl+0x10/0x10
[  109.053488][ T6120]  ? __pfx__printk+0x10/0x10
[  109.053522][ T6120]  ? kmem_cache_alloc_node_noprof+0x4f/0x380
[  109.053552][ T6120]  ? __pfx___might_resched+0x10/0x10
[  109.053581][ T6120]  should_fail_ex+0x40a/0x550
[  109.053609][ T6120]  should_failslab+0xac/0x100
[  109.053637][ T6120]  kmem_cache_alloc_node_noprof+0x77/0x380
[  109.053664][ T6120]  ? __alloc_skb+0x1c3/0x440
[  109.053697][ T6120]  __alloc_skb+0x1c3/0x440
[  109.053731][ T6120]  ? __pfx___alloc_skb+0x10/0x10
[  109.053766][ T6120]  ? __pfx___might_resched+0x10/0x10
[  109.053792][ T6120]  alloc_skb_with_frags+0xc3/0x820
[  109.053837][ T6120]  sock_alloc_send_pskb+0x91a/0xa60
[  109.053877][ T6120]  ? __pfx_sock_alloc_send_pskb+0x10/0x10
[  109.053901][ T6120]  ? __lock_acquire+0x1397/0x2100
[  109.053932][ T6120]  ? dev_get_by_index+0x23/0x2d0
[  109.053957][ T6120]  packet_sendmsg+0x4080/0x6c30
[  109.054007][ T6120]  ? __lock_acquire+0x1397/0x2100
[  109.054044][ T6120]  ? smack_socket_sendmsg+0x1bb/0x540
[  109.054073][ T6120]  ? __pfx_smack_socket_sendmsg+0x10/0x10
[  109.054100][ T6120]  ? tomoyo_socket_sendmsg_permission+0x288/0x420
[  109.054129][ T6120]  ? __pfx_packet_sendmsg+0x10/0x10
[  109.054158][ T6120]  ? __pfx_tomoyo_socket_sendmsg_permission+0x10/0x10
[  109.054195][ T6120]  ? __fget_files+0x2a/0x410
[  109.054229][ T6120]  ? __pfx_packet_sendmsg+0x10/0x10
[  109.054257][ T6120]  __sock_sendmsg+0x221/0x270
[  109.054285][ T6120]  __sys_sendto+0x363/0x4c0
[  109.054318][ T6120]  ? __pfx___sys_sendto+0x10/0x10
[  109.054358][ T6120]  ? __fget_files+0x2a/0x410
[  109.054393][ T6120]  ? lockdep_hardirqs_on_prepare+0x43d/0x780
[  109.054431][ T6120]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  109.054464][ T6120]  __x64_sys_sendto+0xde/0x100
[  109.054495][ T6120]  do_syscall_64+0xf3/0x230
[  109.054522][ T6120]  ? clear_bhb_loop+0x35/0x90
[  109.054554][ T6120]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  109.054581][ T6120] RIP: 0033:0x7f488518cd29
[  109.054598][ T6120] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  109.054615][ T6120] RSP: 002b:00007f4885faf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002c
[  109.054636][ T6120] RAX: ffffffffffffffda RBX: 00007f48853a5fa0 RCX: 00007f488518cd29
[  109.054651][ T6120] RDX: 000000000000ff88 RSI: 0000000020000180 RDI: 0000000000000003
[  109.054663][ T6120] RBP: 00007f4885faf090 R08: 0000000020000140 R09: 0000000000000014
[  109.054675][ T6120] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  109.054684][ T6120] R13: 0000000000000000 R14: 00007f48853a5fa0 R15: 00007fffee6881a8
[  109.054708][ T6120]  </TASK>
[  109.059240][ T5913] wacom 0003:056A:00D5.0001: Unknown device_type for 'HID 056a:00d5'. Assuming pen.
[  109.321906][ T6087] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  109.381097][  T974] usb 4-1: new high-speed USB device number 4 using dummy_hcd
[  109.453559][ T6087] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  109.579665][ T5913] wacom 0003:056A:00D5.0001: hidraw0: USB HID v0.00 Device [HID 056a:00d5] on usb-dummy_hcd.0-1/input0
[  109.635063][  T974] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  109.656390][  T974] usb 4-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  109.677806][ T5913] input: Wacom Bamboo Pen 6x8 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:056A:00D5.0001/input/input7
[  109.721996][  T974] usb 4-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  109.766958][  T974] usb 4-1: New USB device found, idVendor=056a, idProduct=00d5, bcdDevice= 0.00
[  109.824946][ T5913] usb 1-1: USB disconnect, device number 3
[  109.826275][  T974] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  109.965388][  T974] usb 4-1: config 0 descriptor??
[  110.073527][ T6140] netem: change failed
[  110.622753][ T6125] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  110.715572][ T6125] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  111.124935][  T974] wacom 0003:056A:00D5.0002: Unknown device_type for 'HID 056a:00d5'. Assuming pen.
[  111.455732][  T974] wacom 0003:056A:00D5.0002: hidraw0: USB HID v0.00 Device [HID 056a:00d5] on usb-dummy_hcd.3-1/input0
[  111.487050][  T974] input: Wacom Bamboo Pen 6x8 Pen as /devices/platform/dummy_hcd.3/usb4/4-1/4-1:0.0/0003:056A:00D5.0002/input/input10
[  112.605808][  T974] usb 4-1: USB disconnect, device number 4
[  112.634280][ T6179] FAULT_INJECTION: forcing a failure.
[  112.634280][ T6179] name failslab, interval 1, probability 0, space 0, times 0
[  112.734376][ T6182] usb usb9: Requested nonsensical USBDEVFS_URB_ZERO_PACKET.
[  112.808840][ T6179] CPU: 1 UID: 0 PID: 6179 Comm: syz.3.72 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  112.808868][ T6179] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  112.808881][ T6179] Call Trace:
[  112.808889][ T6179]  <TASK>
[  112.808897][ T6179]  dump_stack_lvl+0x241/0x360
[  112.808926][ T6179]  ? __pfx_dump_stack_lvl+0x10/0x10
[  112.808947][ T6179]  ? __pfx__printk+0x10/0x10
[  112.808984][ T6179]  ? __kmalloc_node_noprof+0xb9/0x4d0
[  112.809014][ T6179]  ? __pfx___might_resched+0x10/0x10
[  112.809043][ T6179]  should_fail_ex+0x40a/0x550
[  112.809072][ T6179]  should_failslab+0xac/0x100
[  112.809100][ T6179]  __kmalloc_node_noprof+0xe1/0x4d0
[  112.809127][ T6179]  ? alloc_slab_obj_exts+0x3a/0xa0
[  112.809169][ T6179]  alloc_slab_obj_exts+0x3a/0xa0
[  112.809195][ T6179]  __memcg_slab_post_alloc_hook+0x319/0x7e0
[  112.809241][ T6179]  ? __d_alloc+0x31/0x670
[  112.809271][ T6179]  ? __d_alloc+0x31/0x670
[  112.809298][ T6179]  kmem_cache_alloc_lru_noprof+0x28e/0x390
[  112.809333][ T6179]  __d_alloc+0x31/0x670
[  112.809367][ T6179]  d_alloc_pseudo+0x1f/0xb0
[  112.809398][ T6179]  alloc_file_pseudo+0x123/0x290
[  112.809431][ T6179]  ? __pfx_alloc_file_pseudo+0x10/0x10
[  112.809462][ T6179]  ? _raw_spin_unlock+0x28/0x50
[  112.809483][ T6179]  ? alloc_fd+0x61a/0x690
[  112.809517][ T6179]  sock_alloc_file+0xb8/0x280
[  112.809545][ T6179]  __sys_socket+0x1dd/0x3c0
[  112.809573][ T6179]  ? __pfx___sys_socket+0x10/0x10
[  112.809599][ T6179]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  112.809628][ T6179]  ? exc_page_fault+0x590/0x8b0
[  112.809657][ T6179]  __x64_sys_socket+0x7a/0x90
[  112.809684][ T6179]  do_syscall_64+0xf3/0x230
[  112.809712][ T6179]  ? clear_bhb_loop+0x35/0x90
[  112.809745][ T6179]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  112.809773][ T6179] RIP: 0033:0x7f175498ec47
[  112.809790][ T6179] Code: f0 ff ff 77 06 c3 0f 1f 44 00 00 48 c7 c2 a8 ff ff ff f7 d8 64 89 02 b8 ff ff ff ff c3 66 0f 1f 44 00 00 b8 29 00 00 00 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  112.809807][ T6179] RSP: 002b:00007f175586dfa8 EFLAGS: 00000286 ORIG_RAX: 0000000000000029
[  112.809829][ T6179] RAX: ffffffffffffffda RBX: 00007f1754ba6080 RCX: 00007f175498ec47
[  112.809844][ T6179] RDX: 0000000000000010 RSI: 0000000000000003 RDI: 0000000000000010
[  112.809856][ T6179] RBP: 00000000ffffffff R08: 0000000000000000 R09: 0000000000000000
[  112.809868][ T6179] R10: 00000000200000c0 R11: 0000000000000286 R12: 0000000000000001
[  112.809880][ T6179] R13: 0000000000000000 R14: 00007f1754ba6080 R15: 00007fffe801d898
[  112.809910][ T6179]  </TASK>
[  113.382833][ T6187] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  113.423518][ T6187] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  113.595248][ T5913] usb 1-1: new high-speed USB device number 4 using dummy_hcd
[  114.618450][ T6213] ptm ptm1: ldisc open failed (-12), clearing slot 1
[  114.788455][ T6203] kexec: Could not allocate control_code_buffer
[  114.964645][  T974] usb 2-1: new high-speed USB device number 3 using dummy_hcd
[  115.087722][ T6226] FAULT_INJECTION: forcing a failure.
[  115.087722][ T6226] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  115.113042][ T6226] CPU: 0 UID: 0 PID: 6226 Comm: syz.0.84 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  115.113077][ T6226] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  115.113089][ T6226] Call Trace:
[  115.113098][ T6226]  <TASK>
[  115.113107][ T6226]  dump_stack_lvl+0x241/0x360
[  115.113136][ T6226]  ? __pfx_dump_stack_lvl+0x10/0x10
[  115.113156][ T6226]  ? __pfx__printk+0x10/0x10
[  115.113187][ T6226]  ? __pfx_lock_release+0x10/0x10
[  115.113221][ T6226]  should_fail_ex+0x40a/0x550
[  115.113249][ T6226]  _copy_from_user+0x2d/0xb0
[  115.113270][ T6226]  copy_msghdr_from_user+0xae/0x680
[  115.113299][ T6226]  ? __pfx_copy_msghdr_from_user+0x10/0x10
[  115.113321][ T6226]  ? __fget_files+0x2a/0x410
[  115.113351][ T6226]  ? __fget_files+0x2a/0x410
[  115.113386][ T6226]  __sys_sendmsg+0x209/0x350
[  115.113421][ T6226]  ? __pfx___sys_sendmsg+0x10/0x10
[  115.113466][ T6226]  ? do_sys_openat2+0x17a/0x1d0
[  115.113520][ T6226]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  115.113549][ T6226]  ? do_syscall_64+0x100/0x230
[  115.113579][ T6226]  ? do_syscall_64+0xb6/0x230
[  115.113608][ T6226]  do_syscall_64+0xf3/0x230
[  115.113635][ T6226]  ? clear_bhb_loop+0x35/0x90
[  115.113667][ T6226]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  115.113695][ T6226] RIP: 0033:0x7f9aaa38cd29
[  115.113713][ T6226] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  115.113729][ T6226] RSP: 002b:00007f9aab2ae038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  115.113752][ T6226] RAX: ffffffffffffffda RBX: 00007f9aaa5a5fa0 RCX: 00007f9aaa38cd29
[  115.113768][ T6226] RDX: 0000000000000000 RSI: 0000000020000040 RDI: 0000000000000003
[  115.113781][ T6226] RBP: 00007f9aab2ae090 R08: 0000000000000000 R09: 0000000000000000
[  115.113793][ T6226] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  115.113805][ T6226] R13: 0000000000000000 R14: 00007f9aaa5a5fa0 R15: 00007ffdd3e26c88
[  115.113835][ T6226]  </TASK>
[  115.176691][  T974] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  115.180252][    C0] vkms_vblank_simulate: vblank timer overrun
[  116.207336][  T974] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  116.233393][  T974] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  116.270520][  T974] usb 2-1: New USB device found, idVendor=056a, idProduct=00d5, bcdDevice= 0.00
[  116.373196][  T974] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  116.399204][  T974] usb 2-1: config 0 descriptor??
[  117.521315][  T974] wacom 0003:056A:00D5.0003: Unknown device_type for 'HID 056a:00d5'. Assuming pen.
[  117.566169][  T974] wacom 0003:056A:00D5.0003: hidraw0: USB HID v0.00 Device [HID 056a:00d5] on usb-dummy_hcd.1-1/input0
[  117.567522][  T974] input: Wacom Bamboo Pen 6x8 Pen as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/0003:056A:00D5.0003/input/input13
[  117.746068][ T6219] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  117.746322][ T6219] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  117.748523][  T974] usb 2-1: USB disconnect, device number 3
[  118.568614][ T6265] netlink: 'syz.3.97': attribute type 39 has an invalid length.
[  118.807062][ T6271] kAFS: unparsable volume name
[  122.187221][ T6282] xt_CHECKSUM: CHECKSUM should be avoided.  If really needed, restrict with "-p udp" and only use in OUTPUT
[  122.199787][ T6282] xt_SECMARK: unable to map security context 'system_u:object_r:dbusd_etc_t:s0'
[  125.103812][ T5930] usb 3-1: new high-speed USB device number 3 using dummy_hcd
[  126.159457][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  126.170591][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  126.203133][ T5930] usb 3-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  126.263165][ T5930] usb 3-1: New USB device found, idVendor=056a, idProduct=00d5, bcdDevice= 0.00
[  126.289389][ T5930] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  126.344744][ T5930] usb 3-1: config 0 descriptor??
[  126.544593][ T6335] veth0_virt_wifi: mtu less than device minimum
[  127.664648][ T5930] wacom 0003:056A:00D5.0004: Unknown device_type for 'HID 056a:00d5'. Assuming pen.
[  128.244194][ T6311] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  128.252833][ T6311] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  128.275266][ T6346] FAULT_INJECTION: forcing a failure.
[  128.275266][ T6346] name failslab, interval 1, probability 0, space 0, times 0
[  128.344035][ T6346] CPU: 1 UID: 0 PID: 6346 Comm: syz.0.119 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  128.344066][ T6346] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  128.344078][ T6346] Call Trace:
[  128.344098][ T6346]  <TASK>
[  128.344107][ T6346]  dump_stack_lvl+0x241/0x360
[  128.344142][ T6346]  ? __pfx_dump_stack_lvl+0x10/0x10
[  128.344164][ T6346]  ? __pfx__printk+0x10/0x10
[  128.344197][ T6346]  ? __kmalloc_noprof+0xb5/0x4c0
[  128.344226][ T6346]  ? __pfx___might_resched+0x10/0x10
[  128.344257][ T6346]  should_fail_ex+0x40a/0x550
[  128.344285][ T6346]  should_failslab+0xac/0x100
[  128.344313][ T6346]  __kmalloc_noprof+0xdd/0x4c0
[  128.344339][ T6346]  ? nla_strdup+0x9c/0x140
[  128.344363][ T6346]  ? __kasan_kmalloc+0x98/0xb0
[  128.344389][ T6346]  nla_strdup+0x9c/0x140
[  128.344425][ T6346]  nf_tables_newchain+0x2102/0x3310
[  128.344488][ T6346]  ? __pfx_nf_tables_newchain+0x10/0x10
[  128.344548][ T6346]  ? __pfx_lock_acquire+0x10/0x10
[  128.344575][ T6346]  ? nfnl_pernet+0x23/0x240
[  128.344616][ T6346]  ? __nla_parse+0x40/0x60
[  128.344648][ T6346]  nfnetlink_rcv+0x14e3/0x2ab0
[  128.344707][ T6346]  ? __pfx_nfnetlink_rcv+0x10/0x10
[  128.344779][ T6346]  ? netlink_deliver_tap+0x2e/0x1b0
[  128.344809][ T6346]  ? skb_clone+0x240/0x390
[  128.344829][ T6346]  ? __pfx_lock_release+0x10/0x10
[  128.344871][ T6346]  ? netlink_deliver_tap+0x2e/0x1b0
[  128.344905][ T6346]  netlink_unicast+0x7f6/0x990
[  128.344943][ T6346]  ? __pfx_netlink_unicast+0x10/0x10
[  128.344968][ T6346]  ? __virt_addr_valid+0x45f/0x530
[  128.344999][ T6346]  ? __phys_addr_symbol+0x2f/0x70
[  128.345028][ T6346]  ? __check_object_size+0x47a/0x730
[  128.345064][ T6346]  netlink_sendmsg+0x8e4/0xcb0
[  128.345115][ T6346]  ? __pfx_netlink_sendmsg+0x10/0x10
[  128.345161][ T6346]  ? __pfx_netlink_sendmsg+0x10/0x10
[  128.345190][ T6346]  __sock_sendmsg+0x221/0x270
[  128.345219][ T6346]  ____sys_sendmsg+0x52a/0x7e0
[  128.345260][ T6346]  ? __pfx_____sys_sendmsg+0x10/0x10
[  128.345289][ T6346]  ? __fget_files+0x2a/0x410
[  128.345319][ T6346]  ? __fget_files+0x2a/0x410
[  128.345356][ T6346]  __sys_sendmsg+0x269/0x350
[  128.345393][ T6346]  ? __pfx___sys_sendmsg+0x10/0x10
[  128.345440][ T6346]  ? do_sys_openat2+0x17a/0x1d0
[  128.345497][ T6346]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  128.345526][ T6346]  ? do_syscall_64+0x100/0x230
[  128.345557][ T6346]  ? do_syscall_64+0xb6/0x230
[  128.345587][ T6346]  do_syscall_64+0xf3/0x230
[  128.345613][ T6346]  ? clear_bhb_loop+0x35/0x90
[  128.345647][ T6346]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  128.345675][ T6346] RIP: 0033:0x7f9aaa38cd29
[  128.345693][ T6346] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  128.345709][ T6346] RSP: 002b:00007f9aab2ae038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  128.345743][ T6346] RAX: ffffffffffffffda RBX: 00007f9aaa5a5fa0 RCX: 00007f9aaa38cd29
[  128.345759][ T6346] RDX: 0000000000000000 RSI: 0000000020000080 RDI: 0000000000000003
[  128.345772][ T6346] RBP: 00007f9aab2ae090 R08: 0000000000000000 R09: 0000000000000000
[  128.345784][ T6346] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  128.345796][ T6346] R13: 0000000000000000 R14: 00007f9aaa5a5fa0 R15: 00007ffdd3e26c88
[  128.345828][ T6346]  </TASK>
[  128.497512][ T5930] wacom 0003:056A:00D5.0004: hidraw0: USB HID v0.00 Device [HID 056a:00d5] on usb-dummy_hcd.2-1/input0
[  128.702052][ T5930] input: Wacom Bamboo Pen 6x8 Pen as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:0.0/0003:056A:00D5.0004/input/input18
[  128.801715][ T5930] usb 3-1: USB disconnect, device number 3
[  128.813302][ T5880] usb 2-1: new high-speed USB device number 4 using dummy_hcd
[  128.986771][ T5880] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16
[  129.006892][ T5880] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64
[  129.013516][    T8] usb 1-1: new high-speed USB device number 5 using dummy_hcd
[  129.056261][ T5880] usb 2-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32
[  129.066449][ T5880] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  129.103286][ T5880] usb 2-1: Product: syz
[  129.108306][ T5880] usb 2-1: Manufacturer: syz
[  129.143956][ T5880] usb 2-1: SerialNumber: syz
[  129.159916][ T5880] usb 2-1: config 0 descriptor??
[  129.182431][ T6350] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  129.187041][    T8] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16
[  129.200014][ T6350] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22
[  129.205535][    T8] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64
[  129.230395][    T8] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32
[  129.250098][    T8] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  129.276694][    T8] usb 1-1: Product: syz
[  129.327301][    T8] usb 1-1: Manufacturer: syz
[  129.331997][    T8] usb 1-1: SerialNumber: syz
[  129.355414][    T8] usb 1-1: config 0 descriptor??
[  129.373033][ T6354] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22
[  129.382987][ T6354] raw-gadget.1 gadget.0: fail, usb_ep_enable returned -22
[  129.615561][ T6373] netlink: 'syz.4.131': attribute type 39 has an invalid length.
[  132.033250][ T5930] usb 3-1: new high-speed USB device number 4 using dummy_hcd
[  132.077915][ T5880] dm9601 2-1:0.0: probe with driver dm9601 failed with error -71
[  132.179747][ T5880] usb 2-1: USB disconnect, device number 4
[  132.253408][ T5930] usb 3-1: Using ep0 maxpacket: 16
[  132.276650][ T5930] usb 3-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xC6, changing to 0x86
[  132.323359][ T5930] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x86 has invalid wMaxPacketSize 0
[  132.362649][ T5930] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x86 has invalid maxpacket 0
[  132.364429][   T29] audit: type=1326 audit(1738045113.414:2): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  132.400708][ T5930] usb 3-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 225
[  132.412285][   T29] audit: type=1326 audit(1738045113.454:3): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  132.458248][ T5930] usb 3-1: New USB device found, idVendor=054c, idProduct=06c1, bcdDevice=c2.87
[  132.523201][   T29] audit: type=1326 audit(1738045113.454:4): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  132.554857][ T5930] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  132.562974][ T5930] usb 3-1: Product: syz
[  132.583194][ T5930] usb 3-1: Manufacturer: syz
[  132.593842][   T29] audit: type=1326 audit(1738045113.454:5): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  132.615764][ T5930] usb 3-1: SerialNumber: syz
[  132.629831][ T5930] usb 3-1: config 0 descriptor??
[  132.636777][ T5930] usb 3-1: can't set config #0, error -71
[  132.655066][ T5930] usb 3-1: USB disconnect, device number 4
[  132.661153][   T29] audit: type=1326 audit(1738045113.454:6): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  132.708006][   T29] audit: type=1326 audit(1738045113.454:7): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=55 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  132.756902][   T29] audit: type=1326 audit(1738045113.454:8): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  132.830529][ T6399] UDPLite6: UDP-Lite is deprecated and scheduled to be removed in 2025, please contact the netdev mailing list
[  132.854078][   T29] audit: type=1326 audit(1738045113.454:9): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=257 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  133.016220][    T8] dm9601 1-1:0.0: probe with driver dm9601 failed with error -71
[  133.036205][    T8] usb 1-1: USB disconnect, device number 5
[  133.043258][   T29] audit: type=1326 audit(1738045113.454:10): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  133.115702][   T29] audit: type=1326 audit(1738045113.454:11): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=_ pid=6390 comm="syz.1.134" exe="/root/syz-executor" sig=0 arch=c000003e syscall=16 compat=0 ip=0x7f4040d8cd29 code=0x7ffc0000
[  133.236779][ T1298] ieee802154 phy0 wpan0: encryption failed: -22
[  133.243811][ T1298] ieee802154 phy1 wpan1: encryption failed: -22
[  133.989741][ T6416] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem
[  134.283187][  T974] usb 4-1: new low-speed USB device number 5 using dummy_hcd
[  134.473233][  T974] usb 4-1: Invalid ep0 maxpacket: 32
[  134.603223][  T974] usb 4-1: new low-speed USB device number 6 using dummy_hcd
[  134.784363][  T974] usb 4-1: Invalid ep0 maxpacket: 32
[  134.813362][  T974] usb usb4-port1: attempt power cycle
[  135.123469][ T5880] usb 5-1: new high-speed USB device number 2 using dummy_hcd
[  135.213600][  T974] usb 4-1: new low-speed USB device number 7 using dummy_hcd
[  135.335466][ T5880] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16
[  135.357781][ T5880] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64
[  135.375099][  T974] usb 4-1: device descriptor read/8, error -71
[  135.398772][ T5880] usb 5-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32
[  135.418229][ T5880] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  135.433175][ T5880] usb 5-1: Product: syz
[  135.438452][ T5880] usb 5-1: Manufacturer: syz
[  135.453354][ T5880] usb 5-1: SerialNumber: syz
[  135.464417][ T5880] usb 5-1: config 0 descriptor??
[  135.473479][ T6422] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  135.485944][ T6422] raw-gadget.1 gadget.4: fail, usb_ep_enable returned -22
[  135.623329][ T5825] usb 2-1: new high-speed USB device number 5 using dummy_hcd
[  135.667702][ T6430] netlink: 8 bytes leftover after parsing attributes in process `syz.3.147'.
[  135.698276][ T6430] netlink: 12 bytes leftover after parsing attributes in process `syz.3.147'.
[  135.728958][ T6430] netlink: 'syz.3.147': attribute type 7 has an invalid length.
[  136.035199][ T5825] usb 2-1: config 0 has an invalid interface number: 4 but max is 0
[  136.053186][ T5825] usb 2-1: config 0 has no interface number 0
[  136.061752][ T5825] usb 2-1: New USB device found, idVendor=05c6, idProduct=9035, bcdDevice=26.4c
[  136.083666][ T5825] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  136.092060][ T5825] usb 2-1: Product: syz
[  136.109616][ T5825] usb 2-1: Manufacturer: syz
[  136.208100][ T5825] usb 2-1: SerialNumber: syz
[  136.334122][ T5825] usb 2-1: config 0 descriptor??
[  136.805588][ T6439] FAULT_INJECTION: forcing a failure.
[  136.805588][ T6439] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  136.850020][ T6439] CPU: 0 UID: 0 PID: 6439 Comm: syz.2.150 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  136.850051][ T6439] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  136.850063][ T6439] Call Trace:
[  136.850071][ T6439]  <TASK>
[  136.850079][ T6439]  dump_stack_lvl+0x241/0x360
[  136.850107][ T6439]  ? __pfx_dump_stack_lvl+0x10/0x10
[  136.850126][ T6439]  ? __pfx__printk+0x10/0x10
[  136.850157][ T6439]  ? __pfx_lock_release+0x10/0x10
[  136.850191][ T6439]  should_fail_ex+0x40a/0x550
[  136.850218][ T6439]  _copy_from_user+0x2d/0xb0
[  136.850239][ T6439]  copy_msghdr_from_user+0xae/0x680
[  136.850269][ T6439]  ? __pfx_copy_msghdr_from_user+0x10/0x10
[  136.850291][ T6439]  ? __fget_files+0x2a/0x410
[  136.850322][ T6439]  ? __fget_files+0x2a/0x410
[  136.850357][ T6439]  __sys_sendmsg+0x209/0x350
[  136.850393][ T6439]  ? __pfx___sys_sendmsg+0x10/0x10
[  136.850435][ T6439]  ? do_sys_openat2+0x17a/0x1d0
[  136.850489][ T6439]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  136.850518][ T6439]  ? do_syscall_64+0x100/0x230
[  136.850555][ T6439]  ? do_syscall_64+0xb6/0x230
[  136.850584][ T6439]  do_syscall_64+0xf3/0x230
[  136.850609][ T6439]  ? clear_bhb_loop+0x35/0x90
[  136.850641][ T6439]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  136.850668][ T6439] RIP: 0033:0x7fc9c358cd29
[  136.850685][ T6439] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  136.850701][ T6439] RSP: 002b:00007fc9c43c5038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  136.850722][ T6439] RAX: ffffffffffffffda RBX: 00007fc9c37a5fa0 RCX: 00007fc9c358cd29
[  136.850736][ T6439] RDX: 0000000020008844 RSI: 0000000020000000 RDI: 0000000000000003
[  136.850749][ T6439] RBP: 00007fc9c43c5090 R08: 0000000000000000 R09: 0000000000000000
[  136.850761][ T6439] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  136.850772][ T6439] R13: 0000000000000000 R14: 00007fc9c37a5fa0 R15: 00007ffe8dae20f8
[  136.850800][ T6439]  </TASK>
[  137.576864][ T5913] usb 3-1: new high-speed USB device number 5 using dummy_hcd
[  137.805367][ T5913] usb 3-1: no configurations
[  137.827362][ T5913] usb 3-1: can't read configurations, error -22
[  137.858539][ T6448] trusted_key: syz.0.153 sent an empty control message without MSG_MORE.
[  137.949742][ T5880] dm9601 5-1:0.0: probe with driver dm9601 failed with error -71
[  138.207989][ T5913] usb 3-1: new high-speed USB device number 6 using dummy_hcd
[  138.239620][ T5880] usb 5-1: USB disconnect, device number 2
[  138.425114][ T5913] usb 3-1: no configurations
[  138.434497][ T5913] usb 3-1: can't read configurations, error -22
[  138.439891][ T5825] usb 2-1: USB disconnect, device number 5
[  138.451288][ T5913] usb usb3-port1: attempt power cycle
[  139.213461][ T5913] usb 3-1: new high-speed USB device number 7 using dummy_hcd
[  139.245067][ T5913] usb 3-1: no configurations
[  139.249794][ T5913] usb 3-1: can't read configurations, error -22
[  139.403399][ T5913] usb 3-1: new high-speed USB device number 8 using dummy_hcd
[  139.465283][ T5913] usb 3-1: no configurations
[  139.469972][ T5913] usb 3-1: can't read configurations, error -22
[  139.528312][ T5913] usb usb3-port1: unable to enumerate USB device
[  139.853600][ T5879] usb 2-1: new full-speed USB device number 6 using dummy_hcd
[  140.380623][ T5879] usb 2-1: unable to get BOS descriptor or descriptor too short
[  140.399516][ T5879] usb 2-1: not running at top speed; connect to a high speed hub
[  140.425808][ T5879] usb 2-1: config 219 has 1 interface, different from the descriptor's value: 2
[  140.435410][ T5879] usb 2-1: config 219 interface 0 has no altsetting 0
[  140.442295][ T5879] usb 2-1: config 219 interface 0 has no altsetting 1
[  140.477276][ T5879] usb 2-1: New USB device found, idVendor=2b73, idProduct=0017, bcdDevice=a2.0e
[  140.513849][ T5879] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  140.713216][ T5879] usb 2-1: Product: syz
[  140.763857][ T5879] usb 2-1: Manufacturer: syz
[  140.774638][ T5879] usb 2-1: SerialNumber: syz
[  141.176834][ T6475] FAULT_INJECTION: forcing a failure.
[  141.176834][ T6475] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  141.374686][ T6462] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  141.403349][ T6475] CPU: 1 UID: 0 PID: 6475 Comm: syz.4.159 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  141.403380][ T6475] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  141.403392][ T6475] Call Trace:
[  141.403400][ T6475]  <TASK>
[  141.403412][ T6475]  dump_stack_lvl+0x241/0x360
[  141.403441][ T6475]  ? __pfx_dump_stack_lvl+0x10/0x10
[  141.403462][ T6475]  ? __pfx__printk+0x10/0x10
[  141.403505][ T6475]  ? __pfx_lock_release+0x10/0x10
[  141.403537][ T6475]  should_fail_ex+0x40a/0x550
[  141.403563][ T6475]  _copy_from_iter+0x1e9/0x1c20
[  141.403591][ T6475]  ? __virt_addr_valid+0x183/0x530
[  141.403627][ T6475]  ? __alloc_skb+0x28f/0x440
[  141.403652][ T6475]  ? __pfx__copy_from_iter+0x10/0x10
[  141.403681][ T6475]  ? __virt_addr_valid+0x183/0x530
[  141.403706][ T6475]  ? __virt_addr_valid+0x183/0x530
[  141.403730][ T6475]  ? __virt_addr_valid+0x45f/0x530
[  141.403757][ T6475]  ? __phys_addr_symbol+0x2f/0x70
[  141.403781][ T6475]  ? __check_object_size+0x47a/0x730
[  141.403808][ T6475]  netlink_sendmsg+0x73d/0xcb0
[  141.403848][ T6475]  ? __pfx_netlink_sendmsg+0x10/0x10
[  141.403887][ T6475]  ? __pfx_netlink_sendmsg+0x10/0x10
[  141.403915][ T6475]  __sock_sendmsg+0x221/0x270
[  141.403939][ T6475]  ____sys_sendmsg+0x52a/0x7e0
[  141.403975][ T6475]  ? __pfx_____sys_sendmsg+0x10/0x10
[  141.404002][ T6475]  ? __fget_files+0x2a/0x410
[  141.404030][ T6475]  ? __fget_files+0x2a/0x410
[  141.404062][ T6475]  __sys_sendmsg+0x269/0x350
[  141.404096][ T6475]  ? __pfx___sys_sendmsg+0x10/0x10
[  141.404136][ T6475]  ? do_sys_openat2+0x17a/0x1d0
[  141.404193][ T6475]  ? __pfx_lockdep_hardirqs_on_prepare+0x10/0x10
[  141.404220][ T6475]  ? do_syscall_64+0x100/0x230
[  141.404248][ T6475]  ? do_syscall_64+0xb6/0x230
[  141.404274][ T6475]  do_syscall_64+0xf3/0x230
[  141.404299][ T6475]  ? clear_bhb_loop+0x35/0x90
[  141.404329][ T6475]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  141.404353][ T6475] RIP: 0033:0x7f488518cd29
[  141.404371][ T6475] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  141.404385][ T6475] RSP: 002b:00007f4885faf038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e
[  141.404405][ T6475] RAX: ffffffffffffffda RBX: 00007f48853a5fa0 RCX: 00007f488518cd29
[  141.404418][ T6475] RDX: 0000000000000000 RSI: 0000000020000280 RDI: 0000000000000003
[  141.404429][ T6475] RBP: 00007f4885faf090 R08: 0000000000000000 R09: 0000000000000000
[  141.404440][ T6475] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001
[  141.404451][ T6475] R13: 0000000000000000 R14: 00007f48853a5fa0 R15: 00007fffee6881a8
[  141.404477][ T6475]  </TASK>
[  141.749386][ T6462] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  141.861672][ T5879] usb 2-1: selecting invalid altsetting 0
[  141.867918][ T5879] usb 2-1: selecting invalid altsetting 0
[  141.904475][ T5879] usb 2-1: USB disconnect, device number 6
[  142.460386][ T5842] udevd[5842]: error opening ATTR{/sys/devices/platform/dummy_hcd.1/usb2/2-1/2-1:219.0/sound/card3/controlC3/../uevent} for writing: No such file or directory
[  143.063546][ T5879] usb 1-1: new high-speed USB device number 6 using dummy_hcd
[  143.545634][ T6462] syz.1.157 (6462) used greatest stack depth: 18936 bytes left
[  143.569583][ T5879] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16
[  143.601147][ T5879] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64
[  143.638483][ T5879] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32
[  143.673539][ T5879] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  143.681642][ T5879] usb 1-1: Product: syz
[  143.731241][ T5879] usb 1-1: Manufacturer: syz
[  143.763981][ T5879] usb 1-1: SerialNumber: syz
[  143.868357][ T5879] usb 1-1: config 0 descriptor??
[  144.127620][ T6490] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  144.283335][ T6490] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  147.335469][ T5879] dm9601 1-1:0.0: probe with driver dm9601 failed with error -71
[  147.433364][ T5879] usb 1-1: USB disconnect, device number 6
[  148.429758][ T6526] tipc: Started in network mode
[  148.435034][ T6526] tipc: Node identity 1, cluster identity 2
[  148.441614][ T6526] tipc: Node number set to 1
[  148.447250][ T6526] tipc: Cannot configure node identity twice
[  150.810082][ T6532] netlink: 'syz.1.176': attribute type 4 has an invalid length.
[  151.014432][ T6537] netlink: 1280 bytes leftover after parsing attributes in process `syz.0.178'.
[  151.063264][ T6537] openvswitch: netlink: Flow actions attr not present in new flow.
[  151.293279][ T6545] netlink: 40 bytes leftover after parsing attributes in process `syz.1.181'.
[  151.678483][ T5880] usb 1-1: new high-speed USB device number 7 using dummy_hcd
[  152.283349][ T5880] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16
[  152.322147][ T5880] usb 1-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64
[  152.643181][ T5880] usb 1-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32
[  152.873382][ T5880] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  153.203244][ T5880] usb 1-1: Product: syz
[  153.207570][ T5880] usb 1-1: Manufacturer: syz
[  153.212199][ T5880] usb 1-1: SerialNumber: syz
[  153.236587][ T5880] usb 1-1: config 0 descriptor??
[  153.251364][ T6547] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  153.259184][ T6547] raw-gadget.0 gadget.0: fail, usb_ep_enable returned -22
[  153.431983][ T6541] kexec: Could not allocate control_code_buffer
[  155.610025][ T5830] Bluetooth: hci2: Malformed LE Event: 0x0d
[  155.720147][ T6577] netlink: 8 bytes leftover after parsing attributes in process `syz.2.189'.
[  156.460433][ T6581] IPv6: Can't replace route, no match found
[  156.500199][ T6581] FAULT_INJECTION: forcing a failure.
[  156.500199][ T6581] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  156.567413][ T6581] CPU: 0 UID: 0 PID: 6581 Comm: syz.2.193 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  156.567443][ T6581] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  156.567455][ T6581] Call Trace:
[  156.567462][ T6581]  <TASK>
[  156.567471][ T6581]  dump_stack_lvl+0x241/0x360
[  156.567500][ T6581]  ? __pfx_dump_stack_lvl+0x10/0x10
[  156.567521][ T6581]  ? __pfx__printk+0x10/0x10
[  156.567559][ T6581]  ? snprintf+0xda/0x120
[  156.567583][ T6581]  should_fail_ex+0x40a/0x550
[  156.567610][ T6581]  _copy_to_user+0x31/0xb0
[  156.567633][ T6581]  simple_read_from_buffer+0xca/0x150
[  156.567662][ T6581]  proc_fail_nth_read+0x1e9/0x250
[  156.567690][ T6581]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  156.567718][ T6581]  ? rw_verify_area+0x243/0x630
[  156.567749][ T6581]  ? __pfx_proc_fail_nth_read+0x10/0x10
[  156.567777][ T6581]  vfs_read+0x1f8/0xb40
[  156.567810][ T6581]  ? fdget_pos+0x254/0x320
[  156.567837][ T6581]  ? __pfx___mutex_lock+0x10/0x10
[  156.567862][ T6581]  ? __pfx_vfs_read+0x10/0x10
[  156.567890][ T6581]  ? do_sys_openat2+0x17a/0x1d0
[  156.567919][ T6581]  ? __fget_files+0x2a/0x410
[  156.567947][ T6581]  ? __fget_files+0x395/0x410
[  156.567972][ T6581]  ? __fget_files+0x2a/0x410
[  156.568005][ T6581]  ksys_read+0x18f/0x2b0
[  156.568027][ T6581]  ? __pfx_ksys_read+0x10/0x10
[  156.568048][ T6581]  ? do_syscall_64+0x100/0x230
[  156.568077][ T6581]  ? do_syscall_64+0xb6/0x230
[  156.568107][ T6581]  do_syscall_64+0xf3/0x230
[  156.568132][ T6581]  ? clear_bhb_loop+0x35/0x90
[  156.568174][ T6581]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  156.568203][ T6581] RIP: 0033:0x7fc9c358b73c
[  156.568221][ T6581] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48
[  156.568237][ T6581] RSP: 002b:00007fc9c43c5030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000
[  156.568258][ T6581] RAX: ffffffffffffffda RBX: 00007fc9c37a5fa0 RCX: 00007fc9c358b73c
[  156.568273][ T6581] RDX: 000000000000000f RSI: 00007fc9c43c50a0 RDI: 0000000000000004
[  156.568285][ T6581] RBP: 00007fc9c43c5090 R08: 0000000000000000 R09: 0000000000000000
[  156.568297][ T6581] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000002
[  156.568308][ T6581] R13: 0000000000000000 R14: 00007fc9c37a5fa0 R15: 00007ffe8dae20f8
[  156.568339][ T6581]  </TASK>
[  156.614485][ T6584] netlink: 12 bytes leftover after parsing attributes in process `syz.4.194'.
[  156.618140][    C0] vkms_vblank_simulate: vblank timer overrun
[  156.814696][    C0] vkms_vblank_simulate: vblank timer overrun
[  157.844753][ T6598] Bluetooth: MGMT ver 1.23
[  158.622118][ T5880] dm9601 1-1:0.0: probe with driver dm9601 failed with error -110
[  160.512981][ T5134] Bluetooth: hci0: command 0x0401 tx timeout
[  160.519590][ T5830] Bluetooth: hci0: Opcode 0x0401 failed: -110
[  161.023307][ T6602] xt_SECMARK: unable to map security context 'system_u:object_r:dbusd_etc_t:s0'
[  163.246142][ T5825] usb 1-1: USB disconnect, device number 7
[  163.428994][ T6626] devpts: called with bogus options
[  163.819071][  T974] usb 5-1: new high-speed USB device number 3 using dummy_hcd
[  164.433274][  T974] usb 5-1: Using ep0 maxpacket: 16
[  164.442887][  T974] usb 5-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4
[  164.472532][  T974] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  164.493921][  T974] usb 5-1: Product: syz
[  164.508292][  T974] usb 5-1: Manufacturer: syz
[  164.525175][  T974] usb 5-1: SerialNumber: syz
[  164.540083][  T974] usb 5-1: config 0 descriptor??
[  164.560100][  T974] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state.
[  164.761896][  T974] gp8psk: usb in 128 operation failed.
[  164.975084][  T974] gp8psk: usb in 137 operation failed.
[  164.980618][  T974] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  165.005684][  T974] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver)
[  166.300045][  T974] usb 5-1: media controller created
[  167.307764][  T974] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  169.702329][ T6655] netlink: 40 bytes leftover after parsing attributes in process `syz.4.214'.
[  169.839511][  T974] gp8psk_fe: Frontend revision 1 attached
[  169.845723][  T974] usb 5-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)...
[  169.855860][  T974] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered.
[  169.963619][  T974] gp8psk: usb in 138 operation failed.
[  169.969158][  T974] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected.
[  170.012298][  T974] gp8psk: found Genpix USB device pID = 201 (hex)
[  170.059909][  T974] usb 5-1: USB disconnect, device number 3
[  170.595436][  T974] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected.
[  170.869204][ T6673] netlink: 8 bytes leftover after parsing attributes in process `syz.1.220'.
[  170.878156][ T6673] netlink: 16 bytes leftover after parsing attributes in process `syz.1.220'.
[  171.536256][ T6685] devpts: called with bogus options
[  171.852179][ T5913] usb 1-1: new high-speed USB device number 8 using dummy_hcd
[  171.872124][  T974] usb 5-1: new high-speed USB device number 4 using dummy_hcd
[  171.962043][    T8] usb 2-1: new high-speed USB device number 7 using dummy_hcd
[  172.021994][ T5913] usb 1-1: Using ep0 maxpacket: 16
[  172.034999][ T5913] usb 1-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4
[  172.051989][ T5913] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  172.070936][ T5913] usb 1-1: Product: syz
[  172.075576][ T5913] usb 1-1: Manufacturer: syz
[  172.080216][ T5913] usb 1-1: SerialNumber: syz
[  172.102010][    T8] usb 2-1: device descriptor read/64, error -71
[  172.149728][ T5913] usb 1-1: config 0 descriptor??
[  172.183897][ T5913] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state.
[  172.316401][ T6692] netlink: 12 bytes leftover after parsing attributes in process `syz.3.225'.
[  172.471473][  T974] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 16
[  173.019719][ T5913] gp8psk: usb in 128 operation failed.
[  173.062110][  T974] usb 5-1: config 0 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 64
[  173.101910][ T5913] gp8psk: usb in 137 operation failed.
[  173.107561][ T5913] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  173.131946][    T8] usb 2-1: new high-speed USB device number 8 using dummy_hcd
[  173.142928][ T5913] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver)
[  173.152010][  T974] usb 5-1: string descriptor 0 read error: -71
[  173.162548][  T974] usb 5-1: New USB device found, idVendor=0a46, idProduct=9621, bcdDevice=4f.32
[  173.192141][ T5913] usb 1-1: media controller created
[  173.211371][  T974] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  173.265923][ T5913] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  173.272827][  T974] usb 5-1: config 0 descriptor??
[  173.289383][  T974] usb 5-1: can't set config #0, error -71
[  173.321914][    T8] usb 2-1: device descriptor read/64, error -71
[  173.334192][  T974] usb 5-1: USB disconnect, device number 4
[  173.380933][ T5913] gp8psk_fe: Frontend revision 1 attached
[  173.397386][ T5913] usb 1-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)...
[  173.412390][ T5913] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered.
[  173.480456][    T8] usb usb2-port1: attempt power cycle
[  173.535972][ T5913] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected.
[  173.567440][ T5913] gp8psk: found Genpix USB device pID = 201 (hex)
[  173.794707][ T5913] usb 1-1: USB disconnect, device number 8
[  173.842502][    T8] usb 2-1: new high-speed USB device number 9 using dummy_hcd
[  173.893108][    T8] usb 2-1: device descriptor read/8, error -71
[  174.009216][ T5913] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected.
[  174.151938][    T8] usb 2-1: new high-speed USB device number 10 using dummy_hcd
[  174.193033][    T8] usb 2-1: device descriptor read/8, error -71
[  174.354023][    T8] usb usb2-port1: unable to enumerate USB device
[  176.468428][ T6728] sctp: [Deprecated]: syz.4.236 (pid 6728) Use of struct sctp_assoc_value in delayed_ack socket option.
[  176.468428][ T6728] Use struct sctp_sack_info instead
[  176.550476][ T6732] trusted_key: encrypted_key: insufficient parameters specified
[  176.709519][ T6736] RDS: rds_bind could not find a transport for ::ffff:10.1.1.0, load rds_tcp or rds_rdma?
[  177.164169][ T6741] tmpfs: Unknown parameter '%Āla'
[  177.997138][ T6743] netlink: 12 bytes leftover after parsing attributes in process `syz.1.241'.
[  178.179419][ T6733] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium
[  179.771541][ T5880] usb 2-1: new full-speed USB device number 11 using dummy_hcd
[  179.935415][ T5880] usb 2-1: device descriptor read/64, error -71
[  180.581588][ T5880] usb 2-1: new full-speed USB device number 12 using dummy_hcd
[  180.731574][ T5880] usb 2-1: device descriptor read/64, error -71
[  180.902189][ T5880] usb usb2-port1: attempt power cycle
[  181.281873][ T5880] usb 2-1: new full-speed USB device number 13 using dummy_hcd
[  181.745958][ T5880] usb 2-1: device descriptor read/8, error -71
[  182.043147][ T5880] usb 2-1: new full-speed USB device number 14 using dummy_hcd
[  182.064350][ T5879] usb 3-1: new high-speed USB device number 9 using dummy_hcd
[  182.095258][ T5880] usb 2-1: device descriptor read/8, error -71
[  182.215028][ T5880] usb usb2-port1: unable to enumerate USB device
[  182.219610][ T6778] netlink: 830 bytes leftover after parsing attributes in process `syz.3.251'.
[  182.241815][ T5879] usb 3-1: Using ep0 maxpacket: 8
[  182.270710][ T5879] usb 3-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0
[  182.299058][ T5879] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0
[  182.310211][ T5879] usb 3-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32
[  182.326387][ T5879] usb 3-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3
[  182.341123][ T5879] usb 3-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23
[  182.384011][ T5879] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  182.616258][ T5879] usb 3-1: usb_control_msg returned -32
[  182.634282][ T5879] usbtmc 3-1:16.0: can't read capabilities
[  182.897323][ T6789] xt_SECMARK: unable to map security context 'system_u:object_r:dbusd_etc_t:s0'
[  183.980904][ T6790] 9pnet_fd: Insufficient options for proto=fd
[  185.497450][ T5879] usb 3-1: USB disconnect, device number 9
[  185.957444][ T6811] devpts: called with bogus options
[  186.144431][ T6822] FAULT_INJECTION: forcing a failure.
[  186.144431][ T6822] name fail_usercopy, interval 1, probability 0, space 0, times 0
[  186.157754][ T6822] CPU: 0 UID: 0 PID: 6822 Comm: syz.1.263 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  186.157780][ T6822] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  186.157793][ T6822] Call Trace:
[  186.157800][ T6822]  <TASK>
[  186.157809][ T6822]  dump_stack_lvl+0x241/0x360
[  186.157839][ T6822]  ? __pfx_dump_stack_lvl+0x10/0x10
[  186.157861][ T6822]  ? __pfx__printk+0x10/0x10
[  186.157895][ T6822]  ? __pfx_lock_release+0x10/0x10
[  186.157924][ T6822]  ? __local_bh_enable_ip+0x168/0x200
[  186.157951][ T6822]  should_fail_ex+0x40a/0x550
[  186.157981][ T6822]  _copy_from_user+0x2d/0xb0
[  186.158003][ T6822]  rds_setsockopt+0x6d9/0x13f0
[  186.158037][ T6822]  ? __pfx_rds_setsockopt+0x10/0x10
[  186.158082][ T6822]  ? __pfx_lock_acquire+0x10/0x10
[  186.158109][ T6822]  ? __fget_files+0x2a/0x410
[  186.158142][ T6822]  ? do_sys_openat2+0x17a/0x1d0
[  186.158172][ T6822]  ? __pfx_rds_setsockopt+0x10/0x10
[  186.158198][ T6822]  do_sock_setsockopt+0x3af/0x720
[  186.158235][ T6822]  ? __pfx_do_sock_setsockopt+0x10/0x10
[  186.158281][ T6822]  ? __fget_files+0x395/0x410
[  186.158304][ T6822]  ? __fget_files+0x2a/0x410
[  186.158337][ T6822]  __x64_sys_setsockopt+0x1ee/0x280
[  186.158371][ T6822]  do_syscall_64+0xf3/0x230
[  186.158397][ T6822]  ? clear_bhb_loop+0x35/0x90
[  186.158427][ T6822]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  186.158452][ T6822] RIP: 0033:0x7f4040d8cd29
[  186.158469][ T6822] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  186.158485][ T6822] RSP: 002b:00007f4041c61038 EFLAGS: 00000246 ORIG_RAX: 0000000000000036
[  186.158504][ T6822] RAX: ffffffffffffffda RBX: 00007f4040fa6160 RCX: 00007f4040d8cd29
[  186.158518][ T6822] RDX: 0000000000000008 RSI: 0000000000000114 RDI: 0000000000000009
[  186.158529][ T6822] RBP: 00007f4041c61090 R08: 0000000000000004 R09: 0000000000000000
[  186.158540][ T6822] R10: 00000000200008c0 R11: 0000000000000246 R12: 0000000000000001
[  186.158552][ T6822] R13: 0000000000000000 R14: 00007f4040fa6160 R15: 00007fffa2d08f48
[  186.158580][ T6822]  </TASK>
[  186.621168][ T5913] usb 4-1: new high-speed USB device number 9 using dummy_hcd
[  186.801145][ T5913] usb 4-1: Using ep0 maxpacket: 16
[  186.837358][ T5913] usb 4-1: New USB device found, idVendor=09c0, idProduct=0201, bcdDevice= a.a4
[  186.850881][ T5913] usb 4-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3
[  186.871500][ T5913] usb 4-1: Product: syz
[  186.880495][ T5913] usb 4-1: Manufacturer: syz
[  186.890620][ T5913] usb 4-1: SerialNumber: syz
[  186.910639][ T5913] usb 4-1: config 0 descriptor??
[  186.924525][ T5913] dvb-usb: found a 'Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver' in warm state.
[  186.986969][ T6827] netlink: 12 bytes leftover after parsing attributes in process `syz.0.266'.
[  187.129370][ T5913] gp8psk: usb in 128 operation failed.
[  187.142625][ T5913] gp8psk: usb in 137 operation failed.
[  187.150418][ T5913] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer.
[  187.181842][ T5913] dvbdev: DVB: registering new adapter (Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver)
[  187.210581][ T5913] usb 4-1: media controller created
[  187.456796][ T5913] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered.
[  187.498048][ T5913] gp8psk_fe: Frontend revision 1 attached
[  187.537497][ T5913] usb 4-1: DVB: registering adapter 1 frontend 0 (Genpix DVB-S)...
[  187.632633][ T5913] dvbdev: dvb_create_media_entity: media entity 'Genpix DVB-S' registered.
[  187.901652][ T5913] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receiver successfully initialized and connected.
[  187.958604][ T5913] gp8psk: found Genpix USB device pID = 201 (hex)
[  188.158980][ T5913] usb 4-1: USB disconnect, device number 9
[  189.506842][ T5913] dvb-usb: Genpix 8PSK-to-USB2 Rev.1 DVB-S receive successfully deinitialized and disconnected.
[  189.641565][ T6851] ubi0: detaching mtd0
[  189.692635][ T6851] ubi0: mtd0 is detached
[  189.742324][ T6853] netlink: 20 bytes leftover after parsing attributes in process `syz.2.272'.
[  190.067028][ T6862] netlink: 1268 bytes leftover after parsing attributes in process `syz.4.277'.
[  190.296167][ T5879] usb 1-1: new high-speed USB device number 9 using dummy_hcd
[  190.837187][ T6871] xt_SECMARK: unable to map security context 'system_u:object_r:dbusd_etc_t:s0'
[  190.870291][ T5879] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7
[  190.894926][ T5879] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0
[  190.905365][ T5879] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2
[  190.934430][ T5879] usb 1-1: New USB device found, idVendor=056a, idProduct=00d5, bcdDevice= 0.00
[  190.954074][ T5879] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0
[  191.003772][ T5879] usb 1-1: config 0 descriptor??
[  191.817668][ T6860] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy
[  191.831097][ T5879] wacom 0003:056A:00D5.0005: Unknown device_type for 'HID 056a:00d5'. Assuming pen.
[  191.844138][ T6860] misc raw-gadget: fail, usb_gadget_register_driver returned -16
[  191.853736][ T5879] wacom 0003:056A:00D5.0005: hidraw0: USB HID v0.00 Device [HID 056a:00d5] on usb-dummy_hcd.0-1/input0
[  191.866703][ T5879] input: Wacom Bamboo Pen 6x8 Pen as /devices/platform/dummy_hcd.0/usb1/1-1/1-1:0.0/0003:056A:00D5.0005/input/input24
[  192.455638][ T5879] usb 1-1: USB disconnect, device number 9
[  193.247361][ T6893] netlink: 6 bytes leftover after parsing attributes in process `syz.2.285'.
[  193.574353][ T6900] netlink: 20 bytes leftover after parsing attributes in process `syz.3.288'.
[  193.927908][ T6903] ubi0: attaching mtd0
[  193.940755][ T6903] ubi0: scanning is finished
[  193.947063][ T6903] ==================================================================
[  193.955155][ T6903] BUG: KASAN: slab-use-after-free in notifier_chain_register+0x141/0x3f0
[  193.963600][ T6903] Read of size 4 at addr ffff888078ed98d8 by task syz.4.287/6903
[  193.971324][ T6903] 
[  193.973634][ T6903] CPU: 0 UID: 0 PID: 6903 Comm: syz.4.287 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  193.973649][ T6903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  193.973658][ T6903] Call Trace:
[  193.973663][ T6903]  <TASK>
[  193.973669][ T6903]  dump_stack_lvl+0x241/0x360
[  193.973686][ T6903]  ? __pfx_dump_stack_lvl+0x10/0x10
[  193.973699][ T6903]  ? __pfx__printk+0x10/0x10
[  193.973720][ T6903]  ? _printk+0xd5/0x120
[  193.973739][ T6903]  ? __virt_addr_valid+0x183/0x530
[  193.973759][ T6903]  ? __virt_addr_valid+0x183/0x530
[  193.973780][ T6903]  print_report+0x169/0x550
[  193.973796][ T6903]  ? __virt_addr_valid+0x183/0x530
[  193.973814][ T6903]  ? __virt_addr_valid+0x183/0x530
[  193.973836][ T6903]  ? __virt_addr_valid+0x45f/0x530
[  193.973855][ T6903]  ? __phys_addr+0xba/0x170
[  193.973874][ T6903]  ? notifier_chain_register+0x141/0x3f0
[  193.973890][ T6903]  kasan_report+0x143/0x180
[  193.973906][ T6903]  ? notifier_chain_register+0x141/0x3f0
[  193.973923][ T6903]  notifier_chain_register+0x141/0x3f0
[  193.973942][ T6903]  blocking_notifier_chain_register+0x61/0xc0
[  193.973959][ T6903]  ubi_wl_init+0x3396/0x3720
[  193.973984][ T6903]  ubi_attach+0x3e01/0x5b80
[  193.974013][ T6903]  ? __pfx_ubi_attach+0x10/0x10
[  193.974033][ T6903]  ? ubi_attach_mtd_dev+0x19fa/0x3540
[  193.974054][ T6903]  ubi_attach_mtd_dev+0x1a3a/0x3540
[  193.974082][ T6903]  ctrl_cdev_ioctl+0x346/0x570
[  193.974103][ T6903]  ? __pfx_ctrl_cdev_ioctl+0x10/0x10
[  193.974127][ T6903]  ? __pfx_ctrl_cdev_ioctl+0x10/0x10
[  193.974148][ T6903]  __se_sys_ioctl+0xf5/0x170
[  193.974161][ T6903]  do_syscall_64+0xf3/0x230
[  193.974179][ T6903]  ? clear_bhb_loop+0x35/0x90
[  193.974199][ T6903]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  193.974217][ T6903] RIP: 0033:0x7f488518cd29
[  193.974229][ T6903] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  193.974240][ T6903] RSP: 002b:00007f4885f8e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  193.974254][ T6903] RAX: ffffffffffffffda RBX: 00007f48853a6080 RCX: 00007f488518cd29
[  193.974265][ T6903] RDX: 0000000020000502 RSI: 0000000040186f40 RDI: 0000000000000006
[  193.974273][ T6903] RBP: 00007f488520e2a0 R08: 0000000000000000 R09: 0000000000000000
[  193.974282][ T6903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  193.974290][ T6903] R13: 0000000000000000 R14: 00007f48853a6080 R15: 00007fffee6881a8
[  193.974304][ T6903]  </TASK>
[  193.974309][ T6903] 
[  194.217987][ T6903] Allocated by task 5959:
[  194.222339][ T6903]  kasan_save_track+0x3f/0x80
[  194.227018][ T6903]  __kasan_kmalloc+0x98/0xb0
[  194.231603][ T6903]  __kmalloc_cache_noprof+0x243/0x390
[  194.237003][ T6903]  ubi_attach_mtd_dev+0x552/0x3540
[  194.242121][ T6903]  ctrl_cdev_ioctl+0x346/0x570
[  194.246893][ T6903]  __se_sys_ioctl+0xf5/0x170
[  194.251479][ T6903]  do_syscall_64+0xf3/0x230
[  194.255981][ T6903]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  194.261878][ T6903] 
[  194.264195][ T6903] Freed by task 6851:
[  194.268164][ T6903]  kasan_save_track+0x3f/0x80
[  194.272836][ T6903]  kasan_save_free_info+0x40/0x50
[  194.277863][ T6903]  __kasan_slab_free+0x59/0x70
[  194.282625][ T6903]  kfree+0x196/0x430
[  194.286521][ T6903]  device_release+0x99/0x1c0
[  194.291115][ T6903]  kobject_put+0x22f/0x480
[  194.295531][ T6903]  ubi_detach_mtd_dev+0x347/0x480
[  194.300578][ T6903]  ctrl_cdev_ioctl+0x231/0x570
[  194.305353][ T6903]  __se_sys_ioctl+0xf5/0x170
[  194.309946][ T6903]  do_syscall_64+0xf3/0x230
[  194.314453][ T6903]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  194.320357][ T6903] 
[  194.322679][ T6903] The buggy address belongs to the object at ffff888078ed8000
[  194.322679][ T6903]  which belongs to the cache kmalloc-8k of size 8192
[  194.336827][ T6903] The buggy address is located 6360 bytes inside of
[  194.336827][ T6903]  freed 8192-byte region [ffff888078ed8000, ffff888078eda000)
[  194.350802][ T6903] 
[  194.353122][ T6903] The buggy address belongs to the physical page:
[  194.359539][ T6903] page: refcount:0 mapcount:0 mapping:0000000000000000 index:0x0 pfn:0x78ed8
[  194.368300][ T6903] head: order:3 mapcount:0 entire_mapcount:0 nr_pages_mapped:0 pincount:0
[  194.376804][ T6903] flags: 0xfff00000000040(head|node=0|zone=1|lastcpupid=0x7ff)
[  194.384355][ T6903] page_type: f5(slab)
[  194.388339][ T6903] raw: 00fff00000000040 ffff88801ac42280 ffffea0001fb9200 dead000000000002
[  194.396923][ T6903] raw: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  194.405597][ T6903] head: 00fff00000000040 ffff88801ac42280 ffffea0001fb9200 dead000000000002
[  194.414269][ T6903] head: 0000000000000000 0000000000020002 00000000f5000000 0000000000000000
[  194.423027][ T6903] head: 00fff00000000003 ffffea0001e3b601 ffffffffffffffff 0000000000000000
[  194.431718][ T6903] head: 0000000000000008 0000000000000000 00000000ffffffff 0000000000000000
[  194.440383][ T6903] page dumped because: kasan: bad access detected
[  194.446807][ T6903] page_owner tracks the page as allocated
[  194.452519][ T6903] page last allocated via order 3, migratetype Unmovable, gfp_mask 0xd28c0(GFP_NOWAIT|__GFP_IO|__GFP_FS|__GFP_NORETRY|__GFP_COMP|__GFP_NOMEMALLOC), pid 5490, tgid 5490 (dhcpcd), ts 74632569982, free_ts 74597776049
[  194.473203][ T6903]  post_alloc_hook+0x1f4/0x240
[  194.477999][ T6903]  get_page_from_freelist+0x3651/0x37a0
[  194.483545][ T6903]  __alloc_frozen_pages_noprof+0x292/0x710
[  194.489353][ T6903]  alloc_pages_mpol+0x311/0x660
[  194.494207][ T6903]  allocate_slab+0x8f/0x3a0
[  194.498759][ T6903]  ___slab_alloc+0xc27/0x14a0
[  194.503462][ T6903]  __slab_alloc+0x58/0xa0
[  194.507813][ T6903]  __kmalloc_node_track_caller_noprof+0x2e9/0x4c0
[  194.514236][ T6903]  kmalloc_reserve+0x111/0x2a0
[  194.519004][ T6903]  __alloc_skb+0x1f3/0x440
[  194.523428][ T6903]  netlink_dump+0x1ee/0xe10
[  194.527957][ T6903]  netlink_recvmsg+0x6ec/0x11a0
[  194.532819][ T6903]  sock_recvmsg+0x22f/0x280
[  194.537341][ T6903]  ____sys_recvmsg+0x1c6/0x480
[  194.542124][ T6903]  __sys_recvmsg+0x291/0x390
[  194.546735][ T6903]  do_syscall_64+0xf3/0x230
[  194.551248][ T6903] page last free pid 5812 tgid 5812 stack trace:
[  194.557572][ T6903]  free_frozen_pages+0xe04/0x10e0
[  194.562614][ T6903]  vfree+0x1c3/0x360
[  194.566517][ T6903]  kcov_close+0x28/0x50
[  194.570680][ T6903]  __fput+0x3e9/0x9f0
[  194.574671][ T6903]  __x64_sys_close+0x7f/0x110
[  194.579353][ T6903]  do_syscall_64+0xf3/0x230
[  194.583860][ T6903]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  194.589757][ T6903] 
[  194.592077][ T6903] Memory state around the buggy address:
[  194.597708][ T6903]  ffff888078ed9780: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  194.605769][ T6903]  ffff888078ed9800: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  194.613839][ T6903] >ffff888078ed9880: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  194.621898][ T6903]                                                     ^
[  194.628825][ T6903]  ffff888078ed9900: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  194.636889][ T6903]  ffff888078ed9980: fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb fb
[  194.644953][ T6903] ==================================================================
[  194.660095][ T6903] Kernel panic - not syncing: KASAN: panic_on_warn set ...
[  194.667345][ T6903] CPU: 0 UID: 0 PID: 6903 Comm: syz.4.287 Not tainted 6.13.0-syzkaller-08265-g9c5968db9e62 #0
[  194.677615][ T6903] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 12/27/2024
[  194.687698][ T6903] Call Trace:
[  194.691013][ T6903]  <TASK>
[  194.693939][ T6903]  dump_stack_lvl+0x241/0x360
[  194.698614][ T6903]  ? __pfx_dump_stack_lvl+0x10/0x10
[  194.703809][ T6903]  ? __pfx__printk+0x10/0x10
[  194.708406][ T6903]  ? vscnprintf+0x5d/0x90
[  194.712739][ T6903]  panic+0x349/0x880
[  194.716648][ T6903]  ? check_panic_on_warn+0x21/0xb0
[  194.721852][ T6903]  ? __pfx_panic+0x10/0x10
[  194.726274][ T6903]  ? check_panic_on_warn+0x21/0xb0
[  194.731393][ T6903]  ? check_panic_on_warn+0x72/0xb0
[  194.736542][ T6903]  check_panic_on_warn+0x86/0xb0
[  194.741555][ T6903]  ? notifier_chain_register+0x141/0x3f0
[  194.747193][ T6903]  end_report+0x77/0x160
[  194.751448][ T6903]  kasan_report+0x154/0x180
[  194.755972][ T6903]  ? notifier_chain_register+0x141/0x3f0
[  194.761623][ T6903]  notifier_chain_register+0x141/0x3f0
[  194.767117][ T6903]  blocking_notifier_chain_register+0x61/0xc0
[  194.773222][ T6903]  ubi_wl_init+0x3396/0x3720
[  194.777873][ T6903]  ubi_attach+0x3e01/0x5b80
[  194.782447][ T6903]  ? __pfx_ubi_attach+0x10/0x10
[  194.787342][ T6903]  ? ubi_attach_mtd_dev+0x19fa/0x3540
[  194.792760][ T6903]  ubi_attach_mtd_dev+0x1a3a/0x3540
[  194.798025][ T6903]  ctrl_cdev_ioctl+0x346/0x570
[  194.802856][ T6903]  ? __pfx_ctrl_cdev_ioctl+0x10/0x10
[  194.808191][ T6903]  ? __pfx_ctrl_cdev_ioctl+0x10/0x10
[  194.813537][ T6903]  __se_sys_ioctl+0xf5/0x170
[  194.818169][ T6903]  do_syscall_64+0xf3/0x230
[  194.822714][ T6903]  ? clear_bhb_loop+0x35/0x90
[  194.827428][ T6903]  entry_SYSCALL_64_after_hwframe+0x77/0x7f
[  194.833366][ T6903] RIP: 0033:0x7f488518cd29
[  194.837818][ T6903] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48
[  194.857459][ T6903] RSP: 002b:00007f4885f8e038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010
[  194.865919][ T6903] RAX: ffffffffffffffda RBX: 00007f48853a6080 RCX: 00007f488518cd29
[  194.873916][ T6903] RDX: 0000000020000502 RSI: 0000000040186f40 RDI: 0000000000000006
[  194.881914][ T6903] RBP: 00007f488520e2a0 R08: 0000000000000000 R09: 0000000000000000
[  194.889911][ T6903] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000
[  194.897913][ T6903] R13: 0000000000000000 R14: 00007f48853a6080 R15: 00007fffee6881a8
[  194.905917][ T6903]  </TASK>
[  194.909309][ T6903] Kernel Offset: disabled
[  194.913636][ T6903] Rebooting in 86400 seconds..