last executing test programs: 21m11.03397274s ago: executing program 32 (id=1527): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000140)={'syzkaller0\x00', 0x7101}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x202000, 0x0) close(r1) r2 = socket$nl_route(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) r3 = socket$nl_audit(0x10, 0x3, 0x9) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000340)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r4, {0xf, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_cake={{0x9}, {0xc, 0x2, [@TCA_CAKE_ATM={0x8, 0x4, 0x1}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040084) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r5 = socket(0x400000000010, 0x3, 0x0) ioctl$AUTOFS_DEV_IOCTL_FAIL(0xffffffffffffffff, 0xc0189377, &(0x7f0000000000)={{0x1, 0x1, 0x18, r1, {0x0, 0x42}}, './file0\x00'}) ioctl$SIOCSIFHWADDR(r6, 0x8924, &(0x7f0000000040)={'dvmrp0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000440)={'syzkaller0\x00', 0x0}) r8 = socket$kcm(0x11, 0x3, 0x0) sendmsg$kcm(r8, &(0x7f00000000c0)={&(0x7f0000000280)=@xdp={0x2c, 0x0, r7, 0x18}, 0x80, &(0x7f00000034c0)=[{&(0x7f00000001c0)='\'', 0x1}], 0x1}, 0x8000) 20m27.140073631s ago: executing program 33 (id=1751): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000340), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_BOOT_CPU_ID(r1, 0xae78, 0x0) ioctl$KVM_SET_SREGS(r2, 0x4138ae84, &(0x7f0000000100)={{0x4000, 0xeeee0002, 0xc, 0x0, 0x81, 0x0, 0x0, 0x24, 0x0, 0x0, 0x0, 0xff}, {0xeeee8000, 0x5000, 0x3, 0xfc, 0x8, 0x0, 0x1, 0x64, 0xe, 0x0, 0x3, 0xfc}, {0x3000, 0x10000, 0xac0766d6490919ee, 0x0, 0x0, 0x0, 0xfd, 0x40, 0x6, 0x1, 0x4, 0x2}, {0x4000, 0xffff1000, 0xf, 0x0, 0x0, 0x8, 0x3, 0x7}, {0x6000, 0xffff1000, 0xf, 0x2, 0xfe, 0xdb, 0x3, 0xc, 0x58, 0x8, 0x6, 0xfc}, {0x200000, 0x1000, 0x0, 0x3, 0x9b, 0xfd, 0xfc, 0x4, 0x0, 0x6, 0xc0, 0x10}, {0x3000, 0x40000, 0xc, 0x0, 0x7, 0xfb, 0x0, 0x7, 0x1a, 0x2, 0x0, 0x42}, {0x0, 0x3000, 0xe, 0x2, 0x2, 0x6f, 0x1, 0xfd, 0x0, 0x9, 0x3, 0x5}, {0x2000, 0xb}, {}, 0x9df9ffdf, 0x0, 0x2, 0x12, 0x9, 0x8000, 0x0, [0x8, 0x0, 0x2]}) ioctl$KVM_TRANSLATE(r2, 0xc018ae85, &(0x7f0000001280)={0x0, 0xdddd0000, 0x2, 0x1c, 0x50}) 12m11.92147387s ago: executing program 34 (id=4765): r0 = socket$inet_sctp(0x2, 0x1, 0x84) setsockopt$IP_VS_SO_SET_DELDEST(r0, 0x84000000, 0x488, &(0x7f0000000280)={{0x84, @empty, 0x4e20, 0x3, 'lblc\x00', 0x1d, 0x2, 0x2a}, {@loopback, 0x4e23, 0x10000, 0xc24, 0x9, 0xfffffffc}}, 0x44) 9m52.41627372s ago: executing program 35 (id=5119): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r0 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r0, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r1 = socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r2 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r2, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000019140)='net/fib_trie\x00') pread64(r3, &(0x7f0000000080)=""/102356, 0x18fd4, 0x200) syz_genetlink_get_family_id$nfc(&(0x7f0000000480), 0xffffffffffffffff) write$nci(0xffffffffffffffff, &(0x7f00000004c0)=ANY=[], 0x102) bind$inet(r1, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) connect$inet(r1, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) setsockopt$inet_IP_XFRM_POLICY(r1, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xee01}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFNL_MSG_CTHELPER_NEW(r5, &(0x7f0000001240)={0x0, 0x0, &(0x7f0000001200)={&(0x7f0000001140)={0x38, 0x0, 0x9, 0x201, 0x0, 0x0, {0x5, 0x0, 0x9}, [@NFCTH_TUPLE={0x24, 0x2, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @empty}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5, 0x1, 0x11}}]}]}, 0x38}, 0x1, 0x0, 0x0, 0x4000080}, 0x40000) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000380), 0xffffffffffffffff) r7 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r7, 0x8933, &(0x7f0000000000)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_FRAME(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000fc0)={&(0x7f0000000080)=ANY=[@ANYBLOB='H\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="010000000000000000000200000008000300", @ANYRES32=r8, @ANYBLOB="0c00990000000200000000000800a000940900000800260094090000080027000000000008"], 0x48}, 0x1, 0x0, 0x0, 0x81}, 0x0) r9 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r9, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000200)=@newqdisc={0x148, 0x24, 0x605, 0x0, 0x0, {0x0, 0x0, 0x0, 0x1, {0x0, 0x1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_red={{0x8}, {0x11c, 0x2, [@TCA_RED_PARMS={0x14, 0x1, {0x10, 0x10, 0x80, 0x8, 0x8, 0x8, 0x7}}, @TCA_RED_STAB={0x104}]}}]}, 0x148}}, 0x280c0) 5m2.152361527s ago: executing program 7 (id=5767): r0 = io_uring_setup(0x7118, &(0x7f0000000180)={0x0, 0x2c3f, 0x0, 0x21, 0xab}) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file2\x00', 0x0) mount$overlay(0x0, &(0x7f0000000100)='./file0\x00', &(0x7f0000000000), 0x0, &(0x7f00000000c0)={[{@workdir={'workdir', 0x3d, './file0'}}, {@lowerdir={'lowerdir', 0x3d, '.'}}, {@upperdir={'upperdir', 0x3d, './file2'}}], [], 0x2c}) chdir(&(0x7f0000000140)='./file0\x00') r1 = openat$dir(0xffffffffffffff9c, &(0x7f0000000080)='.\x00', 0x101000, 0x108) getdents64(r1, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./gadget\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./gadget\x00', &(0x7f0000000200)='gadgetfs\x00', 0x0, 0x0) write(0xffffffffffffffff, &(0x7f0000000400)="0000000009020900010100803212010002000000402505a0a4000100", 0x1c) r2 = openat(0xffffffffffffff9c, &(0x7f0000000600)='./gadget/ep1in-bulk\x00', 0x2, 0x0) write(r2, &(0x7f0000000700)="0100000007058102400000", 0xb) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.swap.events\x00', 0x275a, 0x0) r3 = open(&(0x7f0000000040)='.\x00', 0x20000, 0x0) getdents64(r3, 0x0, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) clock_getres(0x5, 0x0) 5m1.756426493s ago: executing program 7 (id=5768): r0 = socket$nl_rdma(0x10, 0x3, 0x14) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000003c0)=ANY=[@ANYBLOB="18000000111409e49f363c9169239f2108004b002800d8"], 0x18}}, 0x4000004) pipe2(&(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}, 0x800) r3 = memfd_create(&(0x7f00000002c0)='\xe9`\x06\x00\x00\x00\x91\x00\x00\x00\x00\x00\x00\x00j\x00\x00\x00\x00\x00n', 0x3) write$binfmt_elf32(r2, &(0x7f0000000840)=ANY=[], 0x38) fcntl$setpipe(r1, 0x407, 0x8001a0) splice(r1, 0x0, r3, 0x0, 0x200002, 0x4) r4 = openat$vim2m(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000001900)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @vlan={{0x9}, {0xc, 0x2, 0x0, 0x1, [@IFLA_VLAN_ID={0x6, 0x1, 0x4000}]}}}]}, 0x3c}}, 0x0) ioctl$MEDIA_IOC_REQUEST_ALLOC(0xffffffffffffffff, 0x80047c05, &(0x7f00000002c0)=0xffffffffffffffff) ioctl$vim2m_VIDIOC_DQBUF(r4, 0xc04c5611, &(0x7f0000000300)=@multiplanar_mmap={0xfffffffa, 0x3, 0x4, 0x8, 0x1, {}, {0x5, 0xc, 0xd8, 0x1d, 0xdf, 0x65, "e07a412f"}, 0x1, 0x1, {&(0x7f0000000240)=[{0x3, 0x9, {0x7}, 0x7}, {0x1, 0x3b, {0x7fff}, 0x4}]}, 0x2, 0x0, r6}) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) r7 = socket$inet6(0xa, 0x800, 0x6) r8 = socket$inet_icmp_raw(0x2, 0x3, 0x1) fgetxattr(r8, &(0x7f0000000000)=@known='system.sockprotoname\x00', &(0x7f0000000040)=""/111, 0xfffffffffffffd73) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, &(0x7f0000000340)='pimreg1\x00', 0x10) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1, 0x0, 0x0, 0x2) r9 = syz_io_uring_setup(0xf00, &(0x7f0000000400)={0x0, 0x5961, 0x10000, 0x0, 0x4e}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0, &(0x7f0000000080)=0x0) syz_io_uring_submit(r10, r11, r12, &(0x7f0000000280)=@IORING_OP_FUTEX_WAIT={0x33, 0x48, 0x0, 0x8a, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x2}}) io_uring_enter(r9, 0x2000, 0xfffffffd, 0x9, 0x0, 0x0) r13 = bpf$PROG_LOAD(0x5, &(0x7f0000000100)={0x20, 0x3, &(0x7f0000000040)=ANY=[@ANYBLOB="1800000000000000000000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @netfilter=0x2d, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_LINK_CREATE(0x1c, &(0x7f0000000080)={r13, 0xffffffffffffffff, 0x2d, 0x0, @void}, 0x10) 5m1.088485637s ago: executing program 7 (id=5770): prlimit64(0x0, 0xe, 0x0, 0x0) socket$inet_sctp(0x2, 0x1, 0x84) prlimit64(0x0, 0x0, 0x0, &(0x7f0000000100)) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x1) ioctl$KVM_IOEVENTFD(r1, 0x40a0ae49, &(0x7f0000000080)={0x7ff, 0xd000}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000100)={0xffff1000, 0x20f000, 0x8}) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r1, 0x4020aed2, &(0x7f0000000140)={0x40000}) ioctl$TIOCSSOFTCAR(0xffffffffffffffff, 0x5453, 0x0) writev(0xffffffffffffffff, &(0x7f0000003e80)=[{0x0}], 0x1) bind$inet6(0xffffffffffffffff, &(0x7f0000000200)={0xa, 0x4e23, 0x5, @ipv4={'\x00', '\xff\xff', @loopback}, 0x4}, 0x1c) listen(0xffffffffffffffff, 0x50) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) ioctl$UI_SET_EVBIT(r3, 0x40045564, 0x3) ioctl$UI_SET_ABSBIT(r3, 0x40045567, 0x0) write$uinput_user_dev(r3, &(0x7f0000000ec0)={'syz0\x00', {0x0, 0x0, 0xfffc}, 0x0, [0x7, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x2, 0x3, 0x0, 0x40000000, 0xfeffffff, 0x0, 0x0, 0xfffffffc, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0xfffffffc, 0x40000000, 0x0, 0xfffffffc, 0x0, 0xffffffff, 0x0, 0xa, 0x0, 0x2d52c0], [0x7, 0x1, 0x2, 0xb16, 0x0, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x8, 0x1000, 0x0, 0xf, 0x1, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000000, 0x1, 0x0, 0x0, 0x0, 0x0, 0xfefffffd, 0x0, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xf], [0x88000001, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x7, 0x20000, 0xfffffffd, 0x2, 0xe, 0x1, 0x0, 0x0, 0x3c63, 0x9, 0x20, 0x0, 0x0, 0x9, 0x0, 0x2, 0x0, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x2, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x0, 0x7, 0x0, 0x0, 0x80000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x80000, 0xfffeffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfff, 0x0, 0x0, 0x800, 0x0, 0x40002, 0x2, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4, 0x0, 0x80, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x0, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) prctl$PR_SET_MM_EXE_FILE(0x23, 0xd, r0) close_range(r2, 0xffffffffffffffff, 0x0) sched_setscheduler(0x0, 0x2, 0x0) socket$unix(0x1, 0x1, 0x0) r4 = syz_open_dev$dvb_demux(&(0x7f0000000080), 0x0, 0x41) ioctl$DVB_DEMUX_DMX_ADD_PID(r4, 0x40026f33, &(0x7f00000001c0)=0x808c) 4m59.740813721s ago: executing program 6 (id=5773): openat(0xffffffffffffff9c, &(0x7f0000000380)='./cgroup.cpu/cgroup.procs\x00', 0x0, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x9, 0x0, &(0x7f0000001540)='GPL\x00', 0x2, 0x0, 0x0, 0x40f00, 0x2}, 0x94) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) writev(0xffffffffffffffff, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) openat$kvm(0xffffffffffffff9c, 0x0, 0x68c81, 0x0) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000044c0)={0x0, 0x54}, 0x1, 0x0, 0x0, 0x48000}, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000240)={0x0, 0x44}, 0x1, 0x0, 0x0, 0x10000047}, 0x4000084) 4m59.628172283s ago: executing program 7 (id=5774): mkdirat(0xffffffffffffff9c, &(0x7f0000000200)='./tracing\x00', 0x1ff) r0 = socket$inet(0x2, 0x3, 0x4) setsockopt$inet_opts(r0, 0x0, 0x4, &(0x7f0000000080)="8907040400", 0x5) getsockopt$inet_opts(r0, 0x0, 0x4, 0x0, &(0x7f0000000200)) r1 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000080)=ANY=[@ANYBLOB="12010000090024206d041cc340000000000109022400010000a00009040000010301010009210008000122010009058103"], 0x0) syz_usb_control_io$hid(r1, &(0x7f00000002c0)={0x24, &(0x7f0000000380)=ANY=[@ANYBLOB="c60009"], 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io$hid(r1, &(0x7f0000001640)={0x14, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002290", @ANYRESHEX=r0], 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000080), 0x0, 0xedff) r2 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r2, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r2, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) connect$inet(r2, &(0x7f0000000100)={0x2, 0x4e24, @private=0xa010102}, 0x10) syz_open_dev$hidraw(&(0x7f0000000000), 0x0, 0x8000) r3 = signalfd(0xffffffffffffffff, &(0x7f00000001c0), 0x8) close(r3) socket$inet_smc(0x2b, 0x1, 0x0) fcntl$setstatus(r3, 0x4, 0x2c00) ppoll(&(0x7f0000002300)=[{r3, 0x20}], 0x1, 0x0, 0x0, 0x0) mount(0x0, &(0x7f0000000200)='./tracing\x00', &(0x7f0000000300)='tracefs\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000000240)='./file0\x00', 0xc0042, 0x1) r5 = socket(0x1d, 0x2, 0x6) mount$9p_fd(0x0, &(0x7f0000000440)='./file0\x00', &(0x7f0000000040), 0x3000084, &(0x7f0000000280)={'trans=fd,', {'rfdno', 0x3d, r4}, 0x2c, {'wfdno', 0x3d, r5}, 0x2c, {[{@cache_readahead}]}}) openat(0xffffffffffffff9c, &(0x7f0000000400)='./tracing/uprobe_events\x00', 0x1, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x80, &(0x7f00000002c0)={{'fd', 0x3d, r6}, 0x2c, {'rootmode', 0x3d, 0x4000}}) read$FUSE(r6, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r6, &(0x7f0000000080)={0x50, 0x0, r7, {0x7, 0x29, 0x9, 0xffffffff90adedc4, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x10}}, 0x50) syz_fuse_handle_req(r6, &(0x7f00000042c0)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000100", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006380)={0x20, 0x0, 0x0, {0x0, 0x1c}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 4m59.375140341s ago: executing program 6 (id=5775): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000c80)={'lo\x00'}) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./config\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./config\x00', &(0x7f0000000080)='configfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./config/usb_gadget/g1/functions/printer.usb0\x00', 0x1ff) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/printer.usb0/pnp_string\x00', 0x0, 0x0) read(r1, &(0x7f0000000300)=""/100, 0x64) 4m58.953744059s ago: executing program 6 (id=5777): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f0000000040)={0x3, &(0x7f0000000080)=[{0x6, 0x0, 0x7, 0x7fff7ffc}, {0x2, 0xd, 0x96, 0x9}, {0x3, 0xa, 0x80, 0x7}]}) link(0x0, 0x0) 4m58.504715427s ago: executing program 6 (id=5779): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x48241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x6bf1c2d5adba8c32}) ioctl$TUNSETGROUP(r0, 0x400454ce, 0x0) r1 = syz_open_dev$mtd(&(0x7f0000000900), 0x46, 0x1) ioctl$MEMWRITEOOB(r1, 0xc0104d03, &(0x7f0000001940)={0x3, 0x0, 0x0}) 4m58.221948359s ago: executing program 6 (id=5781): r0 = socket$can_raw(0x1d, 0x3, 0x1) setsockopt$CAN_RAW_FD_FRAMES(r0, 0x65, 0x5, &(0x7f0000000000), 0x4) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x3, 0xe, &(0x7f00000021c0)=ANY=[@ANYBLOB="b70200001000b15cbfa300000000000007030000f8ffffff7a0af0ff0000000079a4f0ff00000000b706000000000081ad64020000000000450404000100ff0f1704000001130a00b7050000010000006a0af2fe0000000085000000a3000000b700000000000000950000000000000000e154cd8445974b26c933f7ffffffffe4fbffffff55bb2007ee51050512b5b42128aa090a79507df79f298129daa7a6b2f91af50342115e17392ac627c87867c000006146001e04aeacea799a22a2fa798b5adc43eb27d53319d0ad229e5752548300000000dbc2777df150b7cdd77b2314fd085f028f2ed1a4535550614e09d6378198a6097a670838337af2abd55a87ac0394b2f92ffab7d153d62058d0a413b2173619ccf55520f22c9ca8b6712f3024b7041b1df65b3e1b9bf115646d14ce53d13d0ccacda1ef0900094fa737c28b99938512c816fdcceaede3faedc51d29a47fc813a2ec00f4c7a53ac271d6d7f4ea6bf97f2f33e2ea2e534300bcb3fdc4b4861004eefbda7f54f82a804da4f86bb47a4a69bf9bc5fa96ee293fbd165a5a68488e40b030166565a097b1b44b451de736bb6d43db8dd63d4b77b206000000000000e254a6d491b849a5a787e814c4fd21a18986252a70f8f92eb6f0e8c7db4bf23242a1f2c28159f09943b1b0452d1b72183aacf4a84f9130b775dd4e9e3070756f97ad91935a6ddfa8f90e79321a0574fb30ff0000001989328c8ddc20ea011bf5742e0e0d4334db8b20ce3f9f16cb7fc20fb4791ec85821d0c48fb657c29b309c73f0977e7cde65a82b94c461d7962b0d2277a84af326f3813e2c25a61ec45c3af9948f17da954aff3fc8c108755f75ca13fb7c8bbd8b6e7dac1aba4b20dc7de058a4dfa7e85a8bdf1d41a2d8bda74d66f47cc180f82c5f573c6d294d3665016ac59dda0fde4745db06753a7ac74a2d32f7528751313694bf5700b20ef0c248ddd3da32396a614cacad4aff2066bb5d4045c958559b7dcb98a6273b8c651e24d9f679e4fbe948dfb4cc4a389469600241730459f0123fd39206000000000000eb55dad46de56ef907b059b90b8aa49afb9a79ae5498f6589880ed6eea7b9c670012be05e7de0940313c5870786554df26236ebced9390cb6941b8375d936a7d2120eca291963eb2d537d8ee4de5c12e28ef97d9ebd9c77f1774cf4683c960119451c31539b22809e1d7f0cda06a9fa87d64cb77872a2cd8a104e16bb1a2bacf13464ca03aff14a9aa4bd9539f5096412b92012e095b84c20243ff98df3347f011000000f27e3c33269c0e153b28b2d4410572bc45b9d3fa02208d304d455c36300000000022320178b00cc6ed7966130b547dbf8b497a6103876843ee04ed9ff002000000cd1d00000020000000ef19349ee7f31abc11c800000000000000000000000928ee53595a779d243a48cea769470424d28804c04b2c4324ab7f4a5c81921f0128dfd70b438af60b060000000000000056642b49b745f3bf2cf7908b6d7d748308eea09fc361b4735efbf3411718d6ee7aebf9ef679dbfae9fb4a79f8a836804ed3a1079b0282a12043408cd60b687dcff91af19010000000000000000456f7d2a42bd1304202274f20675eb781925440578e93046aaddea8ec4ca37f71c2710a7ea8ae0dc214e1cc275b26adfa892e6de92000000000000000000ddff004cff9ec780f535e62f4eeee50e5bafecea4d4134f9d006c8d6883eca5c9c58c9e9338c73de2f04f15d005387577f480000ea65559eb00e76e9d0ada201bcbb5c252b28a60ca770663da451790cc36000906d5a9fad98c308e39bd5ffb6151d79c1cee1cd102e3c8e63e9fba05e3633be3f00000015762e5f5a3a0bc33fdbe28a5ffc83f2b485185cc92fe7f791e8f6429309d6adab4b96508e5bf024ed8f8a005f2bbf96c89739f5cf1e750d50517a59a3ad09e8802e8f4f535447cc0fc9d5f99a73145dfcedad69da9cd4375c624600e78f4458542b14f29611f95d4a31838eeb20c20bb82aa31771cd379ec83554cea5e6539db7384e1f58d81f2f2653c4d9818708e25c89b552d7fcd116bce9c764c714c9402c21d1aac59efb28d4f91652f6000000000000000320f8059195729d60c534ee8e8ff0755b67fe4c25edb85bcff24c757aa8090000000000008c420eb4304f66e3a37aaf000000c42a575939206d0c0f0e9dd5fd545470f862f8c3c14fa9ecd1e877b0d8ca84c044859e85e6158f9184bc61a9a284db80e4636c25b96174327d82761c26e329555f9290af4100000000000000ff0ffd3763655500344bae34137f5ab0d534b8d63e4ca3b671f2de1cdf519192c6b59a601fd419adc16e2055b85058f793484305d7a1759782e4c571ee855a47bc00edf5e9020c09ab004321610b857e8717764b633b21cb32f0e03280e09758bd445ab91d20baca005452b79d7b574a247f1d2fe45b3c4e93da3d51de647c10dd49944dc87c92332af00f191b66b6a6f732a91f0e2e9120be61e58c79d497247d278888901d442ad7f8536607a644e9e3d769db497c3960dfde12182334caee994adc38a436367a54b9e182b78e9a0ceb9a2c4f63902c1ad1a7c5a08d0920a23c2a86abbdf357849a651733e57f31019876026888c8ccb85c86b4f8ffffff7f000000002c331fca0e541b7ca211c28ed61c525708a13d115b43f8b1894c8fa8a14dc4810f61ae96c18cc7130000000000002100000000000000000001000027c9a46157a3609b6fd9843ee19ec647249a9375de5858818f3c4a4fa6ce46f4d42b07199de8b99231ace58c77819ee214e49666c464d35ca9b5143ed3b3dc8c17a23692759ccf5a205311b7ab22532697b861dfb54609fd88e6043bd52ae84c1bb0c8000000edb3d42c68a27ef6a1296dfff4a979369b0e8ebc62887aa46e820a74f91381dcc198e353047db70686d147357024eb3cb94f1e89cb5ba0a56aa046b4dc521a3d9356b4b8b5917c4c860495b240e80063bde261fd00000000007271e28ef6806bc8e139c49b91c76bea3858f7f05b47d3e519f1634e8fbd8d31330d89069f9648a2ff93060ff073b3a113e47edf76f7b0976cf2ec447c030931651dd315003b7a6a5433a2bb560ae99ec4b227eda2e63a1c31a2c2bd48a822cbe92b6524e0cd8020ecaa34e19e7141d5e221509342bfe7d294d1eb3de6a50ca0301f89c2ee627e949c68b3a4a426a996d503a26e9a714ee5f72d8805dd1bfbd081f6a5d1f1289dfe14cb9194e26a44fac273461fc5c0e0a33db76cf059f40fa2640b6bfb74dd35391b8fa18479da9f4b6641fce9a24b96767b837ca037a1199735c375c705c798e0e208e4a5259d0bfa526b462af45a6eab34000000000000000000000000c4426344ec1a3366515dee221e747f55d7dd02534bc503b9b28277c253e410986bef2111a99cc448d652929f8a67a6a1d3f00dcad91aff428aade3f85714a1d3ef29acd4d49b62339c10c2ec0dac4728288e78980c1184d8223edbccbf9258b7374e79a1f8bf3fb73c8c6dbb7bbdfc399847db97c02461792e3a49dac16c60c3fcaab222025d78963c3ac899fa8b63f58a30212c9b2d7fe751e2046b78f86e22861b6504c667350244dd6d9189a8b9c45f8aaff9db694811ca86ed978f23eed7459c0382074170cf1e25b0e9ba3d1cc309353eea4cd8ab96bafda393276bdd8d32ead8db9e1b252a37ff7e0d45728fc1a6ec566981bc8ccfe6cc1897449ba5f26a9d66ac73e6f5c401376f23a314e0b9ff997d22f3e34b7524642c248aa813edaa626f0000000000000000000000000000000003ba34b611569a451564d3a5400f9097ffe7a37e765be352be71ee24250d6828562c7e24cb763062d6000c409de6a6135eae8a00000000008d797190a26c933f933aff5c521eeb7a84a62d148a846e74e76b515b6b8be29e8b69310fa130cf6d6b74f33205d3cc218ca554ed8085ae044f5bf2e89a0000bde05c114e7a020fc1a5fd3eeeb822008b2d7d1cc062b51b0aca4956b557e51a1385cc572b0074b0950fb1437de2590bf99ec7ceb69e1fe2465fce099c992d57b804a22e148ae3411523814aee03ee2df877edfabf4aa94f07c6fdd127e57a8bf7975f2e606c25a299980a6e52fcf7849d45bb38573fbba8afef1aa7a24c805f7aee3e39a3000000000000000000000000000000000000878f88c4742ac490951c36c610a0d266588ec6a0bd300cf160b5a5d9e9fafa49ecc8430832d795e727b7fc2b76e7fc4141fdbb82f45d3cdd3fb8d4b443ab4954fdf5c1b9a6ab3e457f098329307ccb0a1989b6c37509692e952e7244f48bc12569ff8eb30d0f887b85b5ef44fb9a7571319190be0c226ed72f346cc4aa071ae0c72fa8bd00d5590c4f4ba65d0c8e1f4870fe3c414681e41b40163eb1aa2a7429a2208cd6e69c7d959e87da3fd0101159a03ab7fe78881ee7a1ee7a2edff75fb18a181e0c54352be2b7a5b5273198291c28d9141deeb3cdba5d414ae4b0000000000000000000000000009eacd83458d8a606be71970497a4fd4ca3b48ca482ab3804e2fac216b3ba613608b1a465456a33fd08491d337d7344c01cfc9e73bf1bca1cbec7614c8c3c76411e61fef6a93da8914490b50bd837d068e9bf8f3348794a44115d163b5ff85629b0a3ad4023448140770de2e5f262b9a50afcc210b8d8ea24b6dd7d068b356f53afaf89acae30935ec92657e37bf0821cbe612ac2aa7baf4d21ab373ea4fea57d0d9ac418862e791df3d1d85bb780fbfa401e09e3745d70174dd9ab52cdcadfd3454916408810090a19fa1cf0df6aa714fbcffbb7d6c7f45237df3296867725fd2bdbcd2f7ab10fea0fe85ce1137e775e4c01a136aed7f1d0d192a95be64bab53144ff3efd87fcb6421483e6a1690408712913dfb10a88201340c96dfd745a84dc177dd7a598ec015daa56eb0924e01df353a9ad69d0a59e40203018c82e74f39f8c4cb8823f0bfdfe170549e305628625f50"], &(0x7f0000000b80)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0xfffffedf, 0x10, &(0x7f0000000040)}, 0x48) bpf$ENABLE_STATS(0x20, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000680)={r1, 0x0, 0xe, 0x0, &(0x7f0000000300)="14fd54ab72df97e6256c00000000", 0x0, 0xfeff, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x434421, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000b00)={0x0, 0x0, &(0x7f0000000080)={0x0}, 0x1, 0x0, 0x0, 0x4081}, 0x2400c800) pipe(&(0x7f0000000080)) r2 = socket$l2tp(0x2, 0x2, 0x73) bind$inet(r2, &(0x7f00000002c0)={0x2, 0x4e20, @empty}, 0x10) connect$inet(r2, &(0x7f0000000200)={0x2, 0x0, @local}, 0x10) sendmmsg$inet(r2, &(0x7f0000000900)=[{{0x0, 0x0, 0x0}}], 0x40000cf, 0x0) r3 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) ioctl$KVM_GET_ONE_REG(r3, 0x4010aeab, &(0x7f0000002240)=@riscv64_smstateen_csr={0x0, 0x0}) prctl$PR_SCHED_CORE(0x3e, 0x2, 0x0, 0x3, 0x0) prlimit64(0x0, 0xd, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000000)=0x7) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x143102) ioctl$ifreq_SIOCGIFINDEX_vcan(0xffffffffffffffff, 0x8933, &(0x7f00000000c0)={'vxcan1\x00', 0x0}) bind$can_j1939(0xffffffffffffffff, &(0x7f0000000100)={0x1d, r5, 0x1, {0x2}, 0xfd}, 0x18) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, 0x0, 0x0) mq_open(0x0, 0xc0, 0x11b, 0x0) open(0x0, 0x109240, 0x145) openat$audio1(0xffffffffffffff9c, &(0x7f0000000080), 0x123201, 0x0) close(0x3) openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) 4m56.87442953s ago: executing program 6 (id=5782): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r1], 0x78}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) r3 = openat$pidfd(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pidfd_send_signal(r3, 0xfffffffe, &(0x7f00000000c0)={0x5, 0x0, 0x6}, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000000), &(0x7f0000000200)='./file0\x00', &(0x7f0000000280), 0x80, &(0x7f00000003c0)={'trans=virtio,', {[{@aname={'aname', 0x3d, 's!@%)\\]^[@/.-'}}]}}) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000140)={@val={0x8, 0x800}, @val={0x0, 0x0, 0xffe, 0x0, 0x1}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1f, 0x30, 0x66, 0x0, 0x4, 0x11, 0x0, @empty, @multicast1}, {0x4e23, 0x4e20, 0x1c, 0x0, @gue={{0x1, 0x0, 0x0, 0x1, 0x0, @void}, "0000000000000000009dd2709db8d753"}}}}, 0x3e) 4m56.498749533s ago: executing program 0 (id=5788): r0 = socket$netlink(0x10, 0x3, 0x0) writev(r0, &(0x7f00000000c0)=[{&(0x7f0000000080)="1b0000001e00190f00003fffffffda060200000000e80001dd0008040d0009000d0000000005000000", 0x29}], 0x1) 4m56.341169393s ago: executing program 0 (id=5789): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$inet6_udp(0xa, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000c80)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000cc0)=@newqdisc={0x3c, 0x24, 0xd0f, 0x200000, 0x0, {0x60, 0x0, 0x0, r2, {}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_gred={{0x9}, {0x4}}, @TCA_INGRESS_BLOCK={0x8, 0xd, 0xff}]}, 0x3c}, 0x1, 0x0, 0x0, 0x8814}, 0x24008004) (fail_nth: 7) 4m56.014655821s ago: executing program 0 (id=5790): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, 0x0, 0x1, 0x0) write(r0, &(0x7f0000000100)='e:my_r!ad_msr1 _s', 0x11) 4m56.005364655s ago: executing program 5 (id=5792): r0 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./config/usb_gadget/g1/functions/printer.usb0/pnp_string\x00', 0x0, 0x0) read(r0, &(0x7f0000000300)=""/100, 0x64) 4m55.82363985s ago: executing program 0 (id=5793): mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf", @ANYRES32=0x0, @ANYBLOB="20100000000004001400030076214d68305f766972745f7769666900"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x44010) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8000000004) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r4, 0xc008561c, &(0x7f00000000c0)={0xf0f002, 0x2, @name="2a0bfa91762a67fc38beda01496988cd2bae0aa03dc5d7b06bef2d1e67d01e0c"}) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r5, &(0x7f0000000300)={0x1f, 0xffff, 0x3}, 0x20) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff8000}]}) close_range(r6, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x249f0, 0x0) 4m55.7299559s ago: executing program 7 (id=5794): r0 = socket$nl_audit(0x10, 0x3, 0x9) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$team(&(0x7f0000000100), r1) ioctl$ifreq_SIOCGIFINDEX_team(r0, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) (async) r4 = socket(0x2, 0x3, 0x1) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0a000000040000000800000008"], 0x50) r6 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0xb, 0xd, &(0x7f0000000180)=ANY=[@ANYBLOB="180000ffff0000000000000000000000850000005000000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000001b80)='syzkaller\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback=0x2b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r7 = socket$inet_smc(0x2b, 0x1, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r8, 0x8933, &(0x7f0000000040)={'team0\x00', 0x0}) sendmsg$nl_route(r8, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5400000010000304000000000000000000000400", @ANYRES32=0x0, @ANYBLOB="00030000a08200002c0012800b00010067726574617000001c000280050008000400000005000a000100000008000100", @ANYRES32=r9, @ANYBLOB="0800020001000000"], 0x54}, 0x1, 0x0, 0x0, 0x4004}, 0x24048060) (async) r10 = socket$inet6_tcp(0xa, 0x1, 0x0) sendmsg$sock(r10, &(0x7f0000000540)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000500)=[@timestamping={{0x10, 0x1, 0x51, 0x6}}], 0x10}, 0x8000) (async) socket$nl_generic(0x10, 0x3, 0x10) (async) setsockopt$inet_buf(r7, 0x0, 0x8008000000010, &(0x7f0000005e40)="17000000020001000003d68c5ee17688a2003208020300ecff3f0200000300000a000000009afc5ad9485bbb6a880000d6c8db0000dba67e060180000a0000f10607bdff59100ac45761407a681f009cee4a5acb3da400001fb700674f19b44e09f9315033bf79ac2dff060115003901000000000000ea000000000000000009ffff02dfccebf6ba0008400200000000e90554062a80e605007f71174aa951f3c63e5c83f1ba2112ce68bf17a6e000"/184, 0xb8) (async) setsockopt$inet_tcp_TCP_REPAIR(r7, 0x6, 0x13, &(0x7f0000000000)=0x1, 0xfffa) (async) bpf$PROG_LOAD(0x5, &(0x7f0000000800)={0xb, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x31, '\x00', 0x0, @fallback=0x3c, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r11 = epoll_create1(0x0) epoll_ctl$EPOLL_CTL_ADD(r11, 0x1, r7, &(0x7f0000000340)={0x12}) (async) setsockopt$inet_tcp_TCP_REPAIR_QUEUE(r7, 0x6, 0x14, &(0x7f00000000c0), 0x4) (async) connect$inet(r7, &(0x7f0000000080)={0x2, 0x4e21, @dev={0xac, 0x14, 0x14, 0x3a}}, 0x10) r12 = socket(0x10, 0x3, 0x4) sendmsg$nl_route(r12, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000080)=ANY=[@ANYBLOB="70020000130029"], 0x270}, 0x1, 0x0, 0x0, 0x20008014}, 0x4) (async) setsockopt$sock_int(r7, 0x1, 0x12, &(0x7f0000000100)=0x8, 0x4) (async) bpf$PROG_BIND_MAP(0xa, &(0x7f0000000080)={r6}, 0xc) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000040)={'team_slave_1\x00', 0x0}) (async) sendmsg$TEAM_CMD_OPTIONS_SET(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f00000005c0)=ANY=[@ANYBLOB='`\x00\x00\x00', @ANYRES16=r2, @ANYBLOB="11012cbd7000ffdbdf2501000000080001004c9f4e6a7c795c9dd61ff3ec4f52f1460eca2bef83280f156481ae5bf490d57222ef183d4f9b73b95c6be55d53a0bb95b442a0651a2704cdc0f88e887678e45e08d23e4406f859a10dbe91a661a0d37b48839cea1b591e110a4d3199231d982da7aa43efd704ff7f", @ANYRES32=r3, @ANYBLOB="4400028040000100240001006d6f6465000000000000000000000000000000000000000000000000000000000500030005000000100004006c6f616462616c616e636500"], 0x60}, 0x1, 0x0, 0x0, 0x400}, 0x4040894) (async) r14 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r14, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000000)=@newlink={0x30, 0x10, 0x801, 0x0, 0x25dfdbfe, {0x0, 0x0, 0x0, r13, 0x0, 0xa00}, [@IFLA_MASTER={0x8}, @IFLA_GROUP={0x8}]}, 0x30}}, 0x0) 4m55.629898152s ago: executing program 5 (id=5795): r0 = socket$netlink(0x10, 0x3, 0x6) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r1 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) getpgrp(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) uname(0xffffffffffffffff) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) timerfd_create(0x8, 0x0) munlockall() r3 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x40001, r3, 0x1, 0x0) r4 = syz_open_dev$MSR(&(0x7f0000000200), 0x9, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) sched_setaffinity(r3, 0x2, &(0x7f0000000000)=0x80000000000003) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, &(0x7f0000000640), 0x0) accept4$alg(0xffffffffffffffff, 0x0, 0x0, 0x80000) r5 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)={0x18, 0x25, 0x9, 0x0, 0x800, {0x2}, [@nested={0x4, 0x1}]}, 0x18}}, 0x80) socketpair$unix(0x1, 0x2, 0x0, 0x0) ioctl$TCSETS(r1, 0x40045431, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0xfc, "2af01c3d0040fbffffffffffffff00"}) r6 = syz_open_pts(r1, 0x0) r7 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f00000005c0)=ANY=[@ANYBLOB="6f0300020e000000000000000000ac973e7f06aa3f000005000500000000000a004e240000000700000000000000000000ffffac14140a0100000000000000050006006c0000000a004e2000001800fc00ffffffe700000000000000000000060000000000000002001000000004d600"], 0x70}}, 0x4004040) ioctl$TIOCSTI(r6, 0x5412, &(0x7f00000000c0)) socket$nl_xfrm(0x10, 0x3, 0x6) 4m54.906791879s ago: executing program 7 (id=5796): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) ioperm(0x3, 0x9, 0x80) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f00000005c0)='fd', 0x0, r4) write$tun(r4, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r5, 0x0, 0x2) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r8, r8) setpgid(0x0, r8) fchdir(r7) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x163000, 0x0) close(r9) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) 4m54.745603878s ago: executing program 0 (id=5797): mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) mkdir(0x0, 0x1ff) rmdir(&(0x7f0000000280)='./my_configfs/target/core/rd_mcp_0/dev0\x00') 4m54.468665456s ago: executing program 0 (id=5798): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) utimes(0x0, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(r1, &(0x7f00000014c0)={&(0x7f0000000140)=@x25, 0x80, &(0x7f0000001480)=[{0x0}], 0x1}, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000130001000400"/20, @ANYRES32=0x0, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ptrace(0x10, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, &(0x7f0000000000)) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) 4m54.247222465s ago: executing program 5 (id=5799): mkdir(&(0x7f0000000000)='./file0\x00', 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) mount$fuse(0x0, &(0x7f0000000340)='./file0/file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f0000000100)='dctcp', 0x5) bind$inet6(r1, &(0x7f0000000080)={0xa, 0x2, 0x200, @loopback, 0x7}, 0x1c) setsockopt$inet6_tcp_int(r1, 0x6, 0x2000000000000022, &(0x7f0000000200)=0x1, 0x4) sendto$inet6(r1, &(0x7f0000000240)="3633e0", 0x3, 0x24000045, &(0x7f00000001c0)={0xa, 0x2, 0x8, @loopback, 0xa8e}, 0x1c) bind$bt_sco(0xffffffffffffffff, 0x0, 0x0) read$FUSE(r0, &(0x7f000000b1c0)={0x2020, 0x0, 0x0, 0x0, 0x0}, 0x2020) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000280)={0x4e, &(0x7f00000000c0)=[{0x9, 0xf9}, {0x1, 0x8, 0x74, 0x8}, {0x4, 0x0, 0x2, 0x4}]}) syz_fuse_handle_req(r0, &(0x7f00000042c0)="9ab1446569aa24b774753c9e994c09c24df9d42fa5a228e469b44cecf6f9f5ce5f77c93b1895aaac9cf34b37415f11fe22d6fa0162aa743b242e8fe0a8659e32fb543d7969d6513136a9f332a8074f8ee1e445277ddd5859eb5ac3321eb710be880a441031da9b31f791d54fb3c97cd8ee92b00cbf962be8eb5fd0b7cab207645f59cf87a8c41e2739dd8386b6bb84b627cbf5e09bac876ad4b215f0e510a853c5e8b9f7822b26771d72972290a1f9a6f0a46942be0d0eb7aa5145ff368863b14e9845926088f9f92d554e572926290dc6e6b574aea8c500fbe5697f881c0cec48282c6d07619248da0c3b9aa6f7c778525d1760051e4ba8ef31d3c8d3e1d4214ffa5261ce1fdbc12eba889968137f5c06fea233000296cf18df494b4e7b1bee7dc2f3751c37415d46f6d7ffb3d0f788f2100ee41266e6fba75b61af22e1d7b286507ff100cc34ed28d5a2c8be3231446874bbbde6f3c367ca802d64192ffcce1ea41b2cbc57f7500fc4f8f12fe02690c1c9785bbc35542b59d05600783cf4f4633b374101d8ed395303392b238d198f9f68c8ae928cbf3b558deec6d38ebaa526e749ac4e47dd5b838ec34f2820a1134252ae60159d4e030cf5e5d6f8de799a31e12ae57cfe5a1a3ded525c6e71271271d35a0056265362387a361f21ea0f4b6d46f6a83a8512687e43b31e11b1396d6e9e49cf42b693732e226b55d21a1203022f6be9f8ecccb68de3bf4ce99689514bd752f4e60bd2f8e376d7fae5b5fc8db0f53db8c52746671e361b9319419c1b3f3168b4797ebd2d118ee42dda4bc59dd0251236195c8cdafc0546354eeb28f4c7e71e8245a6ccaddfb858f61039c0ccf5acd924680aab38dd061fc7b123f24ac7f3d3c0cee43b61045bb1efea25af86088a0591f166e2f11ea4089860893b17ca5e3d99ec75131268e2e4e290c2bf15e4dde23284e4bdf6e549c096ce221d9c8a6c0fc78aa6a1c8b547c0e10738de2a1e8663e03ab0ce4594e244989f75b6672de1eee97ba7e6467a0da51c0e75d5866c405b03c4744d8d3fbb01eddba5a0361662269154c2f0e61a9433982eb904ff562896cbfa692eb1e6c644fcf6cbc103a76b712af706a47608d3e2f5d54d47d8e9906ab37ddf04004d32ce00200fc3c274666aeb618b27424d87b6a4b0262de4436b9e6f150bc798394c298b25a2c318fbe786185464057c0bcfcd1917230d78ee1a49eca12068fa676852c1099096c6cb98dfda27fedac41826516e42cc116f0cbb68f0f810418258dc5a65c0e1ada296176e17f8d762894c80542a79383cc1674a4f3d6520633ce80baba214c20628899f9ac826484c887713aed9c5caf13b40a598cb1e81f7b18dae39efc22dc99ff497e11f158edc2716ebe3bcd593691aa26523efc168e1394ab439c9a9270575ef34eeee9084b0a31b2d81d47c964ac61e600f75d9321d7474dde45bb8d0cc46510488ab68486d3ba6cc9c3ddb6f66f2e5d251ee285121e1645a2f5167fc5fb8ac4491c0d9d0423c7a8452efea2f5a30096a0fa47173f3a68500a5c755ea939c838d3be126a87ff6baa5a1fba638a5c64767d17f04201b935fcb1cb6afa175594f410f2ff773194c703e623876051e46bb0850a5016e65f8fa34b96bafdfe851a0756fe26fb63d52113c0935b0867f7dc8a94d887484b15e8f92b6a316a22c04a985cc94e432cd43f44001bcdbd48efcd463c402d3d181298e96db60fdb714b82e146567af5ae3fc0c3f9d241471b4d129f928d286f780facb1e84434610ab3379dfff0f64d57b4a1c2e96c98b693de952d26773d24e7a95eddbc450f79932d5332d27991c7bfbd3bc35bfeb9496fbebccb5e4c35c368e021dea643cb292d794d3d3bbcc960f989bef09763dc73d83cbf907485635265e81f87b712d958a66719230fc6466615a0e3bb998d48159e9e9c51959354a545966bcffa298c7673b4d32b991c886a997236642c0f104f6795feab9f48d0ffc74667f3f3e82473ac892ad25f4b13029b0b27fb1d86991ddc42bbc3fe584ed364e769f3bc72ed8749e7a654ec1a2ec7a01bd2d5caccdc6241a1b1ef2726db54d2c34ab47020b4c729b5994b43deb00ad959950e0051d2c0f27217397055e78f1dd3bd867a45e06c2134ae8981021aae881cc7b2049fe7c82d2127ec81d6430c8116355c8d0ab8b9291c688ed9b8dbb1ed6f1a99bb58a1be8d5737acbf9461b142c8982f52481195d35ef82aed4fa52385ea4ed00a739d01cad7af9f7c27d357748e24f28d22065ccb37300e8f5d8dae5ca79af7a50edc3e05184d1a2a6d59784d5ceeb1f1550a44ea03bee4dc5c27eb78f0032593c7d082e59211f83a8b91aa78bfb7e959328ee63af26a37b79ce5e5139eeebd12e28b2a26ad2fcbdca652524d036b324782d54247a48b9f8200b2d6d2c091c41366d677e3be6e136cec6c3080d608849135c6e3c7d695d2e226ae1ce999d730d7f79116ab85762e55a3e5a66a690ce0a4bb4fd1560c796e2797414b544ef78e29d55e4853fdbf3362085a65c46105f32c360a0a9867b984a5d0297fe0b06a45684ac801a8e66294cef6e5f3c48648884fbb2422fa00488df33a9a0ff1039c81f1939f2cd2f5fe8aa805af2d2332ac37244ed4a7b50265af8062752b0c16511e5f25e8aa2b60645675bc826557bb75474ca4787f6b584b2f83bc25192579104aa0baae79f396df0d31121f90db9acea9695ee0fe0c22df4db503ec8b2437b05f5d35a65722fa82eebd2aff4bcd3316a5cffc4b31913fd02f82130c77f320bf04bf8fa873d0e3f62122d6a5f87d3e908bedafed4a3cb6d9f73ff546f5a2b74a2493b1753e89b682352bb3166563518dcb190c7b3d9fd667c57978a670b192641a674dc92c2401d067b6767aa632ce32a401175c98200a52ab5d80dffa719746d0bff8a84bac4a56e0ab8124fc332b64ea662d01e1b73231a6638f01cf4d699448da228c16951149c8d3dab9a7e3be9a16c7d1ffb061818f8f9cb2b42739fae4a0d70c0701c8dceee785d36ef6413162de1917df01c693ef3e1f517e7fc46245209fee52f5c6a2f50ab3f56d67d1cd987282b24071d8ebb1bc5cd635957b2a7ad92d0650abd5bbc24b75885b6119592a3d715392718e52f9124c4ac95be3582abba4ac3a4049ee49fa8ceb9b59d4e1e2a069c9d482879fd8d27d5ac22ef870542453be22c2ec4ebf1472c19fbfb56aa0a3671297b020e3fe49d201a82a04420e90bda43691dacf92347bcbcae3742cc4abad4c8010c0afa15278795d4d76c482461ae78f30569e1dcf87b9b150d07a2bd81676ec6022422d490759ae1e861a6c4cd1f733bd772d60975a59356c385a4a390429f3d2131e7f616015261df6db3cc3ec261a53be10c4f197e71878984fee00e6d1069f79825194b7af434fb6bb86db18e11977f82928be35054543060cea94ebb4015d061f20f8454e056e7b6e4f9a1621ef2377d77659c20bf358c817519f1801be15ae3b5b42adfab367777a6789635a0dcdd1f2b97edecea0210768af67601d1b95a8850dddb6b1f4b0c2f52c835b0833d81966ad19e49ceb9dc9c729cd8334bc3ee5bb8c74186f5cc3e765b9fdd91d79baaab3d2ab64c15d655d1af7de9cf8d5d7c1baef24577843ce142331743b45b06104b6d0d4392e61ca8c07507ff5f831bbf720854db4debf64182aaebf899ba57626a48748fc2dcf016013d575595d24d383eef2da0ff0c9f6fe9c64b186cd4617e3f37635d7dacb58ec297f3ddb48ce4a5e00cc127267e18a1fdf209e098f2cb2e9c0630d15ec9b867b2b95ecf82ad2c0ba39df9c4d36d492bc9a55c4b767da966e4fd7f4d2fef5e91d0575177c05d240b50757031c76333d43bcc828ab2f0376e29d12d1261ce104a8ea488091326bc451c120c8c04d3e64835c893f55b312e248ad8fc1c32429d68e6b67bf45ab8a1cc3db22f9f01a2266b8349046d3d3e081eaa7f7020c73c0762d11a33b517b8f081da3c61ef63e1d40cd87d69c7ac7491fb61bb57c1fe2d218aff6d39b3e1fc847f0ed894e2f0b4d6a4ad03ba42e28bb1dfab645081f548e64ceb8ce15d2214bd66a14fe594aa447c3537eb493299fef0f9326236ea5dae44e23b34801fe06ee16c79545feaf2528421d6e7f9a256a7914d86bd053dc33c8c2043ba73714f5ff5f0507097a56c40b2190e77877d43be849ee2ac129e582930ced06d359eebb49eda4edb13819f91cecc449c9613d9659906179f8fefa34fecb7d21cdaf09a1ce8d094421da80796c97c02fc56171aaba53fd8a7f55de059044717df164f3571028f16995d51fc8829534cdf58dd134def1e43a34e4f5f372fa8e19d3b85881e99ecd45faa4fccfdb47e094ab06955f3960fac71294dd965f24a97cff36b9966cf1a4c3e96c3e14a3951dcc8a3e9371f7e1ae9df77ddb1a99172174adbee8ea57a0c9872a6d677c2875da88a6a7234bebf68a3cc0532a9809a4de4b4d419bff67b0ba825a7ae6e999087155378357ae67e2dd98697f1d10ffa4497dde6582571670456db995228b97d0ecb2fb30c2ba6c16038c40059815c56b35666cc1c5090f6c38e0f4c12abf79919951b85a2734d32dd12b239912d541f9163387a4aa0be0b7a12d9c6b56dbcf1e9aadcfd72e2664a84d6c5147c72bffe7c3560ccd8c447b748dcd26cc9ca2a85cded742a8dccdfd8e78c96e78d405a19faab9e57183b37583f94b3d416b2920c6b746427ed75c08dc3be02720c1edc4743229153c48f1239b222b9fe2e21c0ae28122bc44f9dc78a59f3485ac8057eb21f0857bcfea2d9ebbbcc197e7880d81515bb1cb7192d97c4258c09926d137e245977db40812b253f99a504bb68137d8d73ca4e7c808d50f1dcc600e6a6db90238ff44e075932fe668c066e6988a6a8b4a8485120c8e4d6511268a75d8f9b0f06689aac8cd621e90c62af1e59aa9efe928e9ea098661b408a2825c4f9aac1efd9d54d163a651054b9ab32719d2be3b176f6795ddad0f1310b9237181689f2f9dd34a41d4d4cd2d7569bf56e6a80bc24d90df3bdde0f9649e699f4ef70c4f3faf9553a231215416bba26c29f17861e0f265e9641b2307ed43d6fde23a378669f4ade874e54c20a5e902205dcaa79a3e8584a3f78a86e703451115a1717df882507c607297afac0a056a0f3509a57502fd2ffff6035d04b91f72f5e1a69ddafaf80f7b2f7a13f38c683988436585e6bc7fc2da328449675c234ec0acf5294ce06c72442beba15e65d6a3e1b5dc3c8f115e1005798383f79b0194f6b7d4b1b32371acbf22340af6e5ee3ea840f7ed451226daef3041fc194e051af2fb450022b394c774273b9575c974c324ecd7268435176ee28c54bb54c8e829232ca636f3bdef60ed460b5ff425936626dd16a3f436f08a863582a79f393378f60f6c8ecdd13d83073bfda2e9f8d0c74a841021cbb8c148e70bfc585627449cdd9fb3045db3ea08a96108b52ee8a4f5048a5d910355789f4bb85c1362955e267e719581c38a2648eaa0b516db6277d2ee3c6e1e1090df3f53a31b747d99887e337dadddab16a297d9e56797007a3d18ce333311c70bb1bf45bdae517ffc589419af643773bb30a1fbff7ecd4a8ae7456a608fe73547c2eda4f070d57dc70b65d867526c946a435ea581497da18646ce569eaf6ccf3474cd6e7aa3d6d4732836ff4167c9153757ce58a34864be6d479f7b4ea1d6480b9ac16c5bff346a74e74133234744df867e16b3d2f1f7db4b21b89019b520917ef863e60f52999d6946b9e09cb60054f49d8a255f02e4b62fff6e6adb9a167ea70a177d00b26f56e29b63138a2ebc30b956161a4ab25d5da1c207c3f762714f651341ae771e17d84fa1c86685f2fcb0a128c2e1208d1930e7ff0d8d55299154112af574b881be8b69cc1721d548ad4dc02632e184c47f9b394bf4a834e60fbead8c8bfbf5087f8454513b0b086ac97bbbb9aa342af9def758fe88f1e4570e65f93fd4a9868665d08fac0cf6ebde786995c433504ca01cdf83311aaae20cc76f819a4344a8ee4e26c1094cb00d2c8a67c733fffcd89e97534cacb08a64d75e8594fa31f0dcfcafb0d1bc184c7067fec6a48ddefd580d4d9a4128d8f70f6fc6562da683904766e982ecd0286064db6844131bb7962a0a497f7b97fefad88a0b128bdf8cca774b1c32cb4af259bfebccda036e7e4ea8962838dbb5c04ffab0a2f1481848a27f06171645daf5246a2e563f3ed60097a9d7023d6ba5c8a58d39f733b12baf0863d82c427460f51cf9e3f77281a42221725b7bb75c2116ab31f704661f090d3eeddd2aa6efc619946b4933c398b635fd04ba3758294965c568997e1ef44b0562804e6c64558f6cfa87662a988c321a856ead51c848528a4954f9ff1948d517d67bc11db66801648848bfb7ee12296428bc3ffec863e9c77ff31ee386197679adab2a0e93bbe0c66ffe9c4b09b636f6216faa373aa8271678cc57ad46898222df7e2d8b14a5b70130596c0430997c4c04d9b5187fd9bb26b71fd19aacc8e08a3239f0eebca7b2873062a19f327a4a282012ebf9898a5ab6310b8623c864d4dada3ded00ad201ce8f3973f90396f5edc1ba466e16247fe6b0ee98acfd53792cc0fea33647b841596655b8d9efbc14b50fe0b588e4c41e2cbd0a700529e7ca91122d3d1b26e52bf44a0c9fe37cdbc352357f13b2adc68e78a00f6dc88a8e6ea54bd0b2c8276f9e1bfebc8655a1f47b72c25ffa97f4463630cc21428ca3bb381a6d3171d28bb946f746f820247bf3f7bb69caaeb5c47026ca9997e586e657a9e1569312bb443299ef4cfeacc9aaf4fc3aaa4a77a21579234d2aab6fd0234398ae07ca7c57ac6d6a51e025744b1430abce27f7f9b0d0e45c051e34d20db95cadcc0e4e327dbd979166b33e39a3951d0b8dd62c0d1542b69583cfc07b127243cac4b052cb29ccb3592972698fa4cd84633d222d78b8741d5f903f8636d95cddfe2ef13829df9ce32705edfda51ded2f0ef38f60a33a2e00373107eef56a01acb5e05d849279b5987343c8bbc73ea660ceaf7c9b90c0a8e1412ff3f517cef8fe604d7a26e085170a76e1bf43f5d1bb77ee771fe841d59fe2cc2874d25bf991b4af6bf9ffe1bfbf3a5587006b60bab5bdfd5a3192e82d474ecab0ab656967856c84cba9469c5823c1d1bf104d2a21c071bb08b2a137883dd9c8f545d6958db8efa45263ae303de76e70f2f6a10e1858e6654004f2a099dc31950ee730c465e0a1822935e309d41650fba489aa3050eedbf3f058d24d1f04fc340966e42d72052d84a66789ccf75000c3fc83b8842badd6b22ddaaaf53ed34e25c1b638e3630d66a7903405052902cf8e7395d54679e2f4a2bf7c8c89b0dc38969376ea164fe97b37b1172e6e8f05a929aa373108e891a64e38e18b432a115a44d754811e03c4f4ae7c525a6b9b92aab0d16967ee1a64eeeb2207c094f6aa96f126d058eff22435a4ae76c31f888ee13b327d2cab4ab5a56abf4cae88c583dd67129271708aa17f4f10886ead0e12734314bd4a49e64349beba4abdf94a1fb23a72cf7e16b5af2f1706d9646a5ff7dbf5c7b1cb2c3781346167b15d4625841d9f3d14392db1d39101d37175c42c522229db0708544058d75cebf3e399cd443d1b943c6f3017a898bd49836a8d92519deb810712aed76602682ef0df2be270734eeda7f289a76f4684baf75702a1ac3da005e62b83f794b934cf882db5d50e5ed4aca868e300d690c0b10daf0a47486e9f49d1b08eac6cf5090ddd2443b1459b2df86ab3447b2b5c6afe8aadb410de6a84b640e326eb882832d1a9cb12e0b8f13aef579f404af8631cdd5a30a031dad19cdf247575dd223229330f19fe4d88c51242217397acf66b86c743de283d5df7212fce59af17eb702eccab192f56f054a33709d41841e4a39638e02b4210559593f9b5c44fd22d9da637ef1a3a0a41c40469990dc4beec30a05b67931c0560d9a59fa875f3e26fd1eb32655aa30c7a1cd3d541716fdaacdda206328f3cbc8f16fc2be26690f18963a16febbaf2cb6c199330579ca067c60b54cbdd211c1350e066448fb50ae28ed58788ac98f0ded3414c8735ab90639916e26ab29102cc2609035e56d9b9d2dbc98118835bcf0e437c77052efe2293d9f19b7197aa1b94b10997b0b1efdef251de8945a97fec885f032c3bee2447335230b866d7aef515b04664d0c59e18233f9a229969e3e17d69716413ca3bc55f5959e340627ea803f7b26f4a74295b295344a3685287093998a1ce75b1ed5d730c9aec812617b4c200a0250c9ef8ef7d2fcfc59ef97422eca746bc6451a5b77307d14c1cfa0ea2c8eb7cf7819644577a6456efec0af058a0e3c8ec371019009462bfe174a11368b57fbe3090208a57b2236b97edc32cda5c6fc988cbaaf91c4020a06a7ad45519eaa761e045fc84d3219b287206282347a031ef1e7b7dbc67de738fa8f9fe71c44201fd1d548f8aebe93bf502d64d4b5f470a419e3fcd87f0616b9813048311ed20ac2efd7f18dcd6889542208b50c28c8c0700f73fa33a964e38d699819cab2098c6ff081266721cdced87ff41948c84037485f30d38a99eeeb3ff4c3049742a29eb09bb35c358e732546267c165a62fee9e25abdafdb8a48785bd432d160797e7a41d580f59d7d8e59b3e6b954d39f86db33b8f7cabde43e8e04cac1fcf9aa6fdbe4326e0d9c782d9a630055b36f85c2b8efebf18f42ef14ee5eb1d33ca322db69704f8bb90bf30eb05908b8d8ed169580923f53a6539cc3b55baa47718053d2ff103c23d90f9cb49ddc7d759950f605bafabcb7953c042c0523b84da994529a87ad68fc6f0709fd7af5fc20e53a17d3f5fd4d25fc5ff6598c6ddfc34668a08ee5e066d81a65e7979c50c08febf76dc5a3a405f551bb8449d94ea0dfdad6dd6dd6d6e4486f4ae1d2523c05f46198d8af4da12873ebdf7d6b5f2d0f1b2d29759ab0d78e34ae6f17b7ab83518cf8b18836ea5630ee934e5ecc123f0d3fe6b803ae1f735d65dcadcaaf6660e02ecad0290f6ead0594733a10b2b1654a44244424fa8b3180b551ac401828203e61603b017106e2256f01b9f26db33897167d9defb54ddfe49334150574493895370bad46cc658667aa9a8ed333c86f112b2a542936af92e2f933254b6fb0b1a599eec3bf2e476ae6714e2486dd31b29e4d26838d84bd7a62c62beab3ba71642278ecaf2e50d70670d9fdff105019791d36321bc57fdfd8f65f2ea1cb188035ecabf6140e777b7e6d2177ac29e9a1a2f87dd54d96184bb1a855bd9efdadfc606f13621f40e07cd8be9c2435c8c90b4ccba5eb7ddcf8cf1f76617c9a9e011abf4a63ffe31df63ecacb8b1d2d653e613cb399ce079392f9ca2e226c60b6e8103447c24c1f80d42e1ee747997602ae3ccff8f9f98ce9b56f6f3e3c0ba507df8b2169539cfc946c42da72644feb9b3b582ce332f8b2eda02192958194903d17b3e9b4bd60d08cd9a7989d946ece6d8dc01d6b66a7851bb11e4b075d38081d3ce7bf1875fec9daf47a589abdb72763c9747b83a28389238b0279c8e41db6521130420851acac463664a97be2190aff921923475f2c1f8a87d1169229e5f10dd0a92221e61358b156020f2c9ca2cb6580743a8d5e3c59e6fd97a7a246211450c7c62f1891cedb434102f8794d81c1caf2c1b4ae18b7c4b9c88de5c51da33e3343cef76da0d00341c2e60c4562c162e41a7efa8290cc9061f3d6a592d5f104c5018f31bcaf912bdd37370fbf8fedf0aa9026c1142299197d67ab026756927b5864ea42c45a82c23c275697d31a1b7900670c9a3c967d12974543c11f20c367a336bea9b9ebe480f9c806528138dff35c5f56b1199b75748e9c5cf50e6a32397dc3eeb04c3636c0848a5e13df8a9758bacea231f34cba13b466360b0dec69f74f8bf9a2dcf3dd94fa3a7d27e8caae00240559d75875ef9c619416593ca0072e7f38caae5a530c62dbe00e38c12cb8b924d63fca4d5c3a4c8f50e8f4f86fc1fe2b163219c46c21eb783e587e18e07ab7e1927a646c4f154c5000cb65ce9528457c3c66f43d9ab7d61580df0ecfb31cb38e4cbcdc3dafcca57311abec6b74048c8b74505ba678a4db07ed7243c70a821aee66a487bf91fd273418f8ef657d1eeb9ea6f095d47641e9f9fa30599e8b9c6b4453a1a5e8afd86fcafb46dd095fa4a98a2b26470e2c799b08c6000f5c3c4e28961463724377f37813f3922484fda986eb7c93ae8365baf648acbb344ca7e044d7ba93e7ba35c31085f3f99c5fdb2f9f2845f00b8590395e8ff730b86f5dd7f52297b8ecd5d5a6bb452bcd12b98d6adb27e7ef0e84b9567c66093ca3edab7e64ac4f56360501d81823ea2b1595f934c5f61c8558304c16154109a983a2af8725c7af91b5bc57e555768aa8115236a6ccc921d472b608eb6b82c4ba3747d79027d7856fae5369aa325df6a76138a5b41a94377eeeb251087e0b8510d8890e3f7a0cffaeddb9d2c29bc89f952489f82ee2e2b485cd297e6d30683701623cf73ee9ee606baeae9c3afba287eff57731b9cfaf034b1f56c8b31a32a1078c4fcab298c3f925a8e7cacceb9edf7ba2e54d31033a25462021e4a3c0bf5af341b462ee4417024da7c12c7f385de3af129aef1338a9c1fd68323d07ff47ec8bcca66b44300624d02c9202a2d093c3c85fd922b57b3bd14162c8ca5690734b7e4e4b8980b73a8e9908a9fa3dd508b30e3b1e1fd4ec388affa27c4bc26ca2820e0a902d51ff94984e8894fa5fca7b8704b7600ca6d6b1b1527ea999fcdf8fe3b290ec0036cad222f92cf8a5a54d0fa91de6e74ef61f60a233c9f15fdc86226c3f688de15ed8f0c3f1bc3afcad87cee47a19384afc6a804f197339ebce4aca211dbe0504a000755d18f20c4ecacd4123acdff7653cbb26456499495662508c8186afb883f5481c6bdf88cf137e263bde9d62f054573e0d1454cc119c95d4d9011332bd77682f79debcf5c21f0be7e9a83a58cec34e7cfb17a8122e030669228e4d3d9e274a678c5b77e6180aacc2fa8eb9952c5b04de6b2c7bee591badab96a3c3248c275b5b8faf5394eacc427a840570033be5006c33ce2d2c6e54f08681c3f74ad2fe54bca6dc62a9d84f6c58509c1e5dd5cfcc7a358493d428de48dfc1bc3f74154801c97e6aae38445045320b4cf66c1e56eb6ea2c1218de65f120b463c5cfb9255b3a25eb6e848cbd977f0605d71c561c2a754f5761c31f84101ee8178782cc8cf70b41a2204c5cb2f3134d572327fe4bbc1792249dfcf0ae7ba5d81fb5ae4a7978d044085f3b7f2e398c05733e2bf456cae898f8b5a81e9c79179bb5ca716713fce643dabe21eaee4386e646e25ad3adc5a4ad40f9bd6743f5f742efb1a674ffdbd2ced56c646ae590eb8f10283b47f57e6f96ad76adebecb24df74020b096fdee3c8d780d563a915f73c8b0246b861cd3a8580d5cf75798e8cf1c5875724661a39277e7165fe48ed8d5e6a20d68239f626fe8ea434a4e6e03ea434ec68c4b92a0fc2af15a135d6cbaeeca39a0c1896dab33daac", 0x2000, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = syz_io_uring_setup(0x28a0, &(0x7f0000000800)={0x0, 0xcf6d, 0x80, 0x0, 0x3c7}, &(0x7f0000000880), &(0x7f00000008c0), &(0x7f0000000000)) io_uring_register$IORING_REGISTER_FILE_ALLOC_RANGE(r5, 0x19, &(0x7f0000000a80)={0x1, 0xf, 0x7}, 0x0) write$FUSE_INIT(r0, &(0x7f0000000400)={0x50, 0x0, r2, {0x7, 0x2b, 0x10, 0x1c20040, 0x0, 0x0, 0xc0000000, 0x1, 0x0, 0x0, 0x100}}, 0x50) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000100)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0xfffffffffffffff5, 0xffffffffffffffff, {0x0, 0x0, 0x0, 0x8, 0x80002, 0x5, {0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffd, 0x0, 0x4, 0x0, 0x6000, 0xd, r3, 0x0, 0x800000}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) syz_fuse_handle_req(0xffffffffffffffff, 0x0, 0x0, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006780)={0x90, 0x0, 0x3, {0x5, 0x0, 0xd04, 0xfffffffffffffffc, 0x0, 0xd, {0x0, 0x8, 0xfffffffffffffffd, 0x200, 0xffffffffffffffff, 0x0, 0x0, 0x4, 0x4, 0x2000, 0x101, r3, r4, 0xf0ee, 0xb}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r6 = open(&(0x7f00000001c0)='./file0/file0\x00', 0x1802, 0x40) r7 = socket$inet(0xa, 0x801, 0x84) connect$inet(r7, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r7, 0x8) r8 = accept4(r7, 0x0, 0x0, 0x0) sendto$inet(r8, &(0x7f00000002c0)="cc", 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_DEFAULT_SNDINFO(r8, 0x84, 0x22, &(0x7f0000000580)={0x2, 0x0, 0x6, 0xffffffff}, 0x10) sendto$inet6(r8, &(0x7f0000000200)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x1}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r8, 0x84, 0x7b, &(0x7f00000000c0)={0x0, 0x2}, 0x8) ioctl$FUSE_DEV_IOC_CLONE(r6, 0x80046b00, 0x0) socket$l2tp6(0xa, 0x2, 0x73) 4m54.137469182s ago: executing program 5 (id=5800): r0 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r0, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r0, &(0x7f0000000480)={0x2, 0x0, @multicast1}, 0x10) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r0, 0x0, 0xd, &(0x7f0000000040)=0xfffffffc, 0x4) setsockopt$inet_int(r0, 0x0, 0x6, &(0x7f0000000080)=0x4, 0x4) recvmmsg(r0, &(0x7f0000000340)=[{{0x0, 0x0, 0x0, 0x2a}, 0xffffff81}], 0x1, 0x45833af92e4b38ff, 0x0) 4m52.945850847s ago: executing program 5 (id=5801): mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./tracing\x00', 0x1ff) mount(0x0, &(0x7f0000000040)='./tracing\x00', &(0x7f0000000080)='tracefs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f00000000c0)='./tracing/dynamic_events\x00', 0x1, 0x0) write(r0, 0x0, 0x0) 4m52.415747698s ago: executing program 5 (id=5802): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newtfilter={0x64, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r5, {0xe, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x20, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x5, 0x2, 0x4}, {0x7, 0x0, 0x65494358c887d6ea}}}]}]}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000000440)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x25}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000140)="ac46", 0x5dc}], 0x1}, 0x8804) 4m41.272961533s ago: executing program 36 (id=5782): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000000), 0x40241, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r1 = socket$inet_udp(0x2, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000240)=ANY=[@ANYBLOB="7800000010000304000000000000000000007400", @ANYRES32=0x0, @ANYBLOB="00000000600000005800128008000100677470004c00028008000100", @ANYRES32=r1], 0x78}, 0x1, 0x0, 0x0, 0x24008040}, 0x0) r3 = openat$pidfd(0xffffff9c, &(0x7f0000000000), 0x0, 0x0) pidfd_send_signal(r3, 0xfffffffe, &(0x7f00000000c0)={0x5, 0x0, 0x6}, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f0000000000), &(0x7f0000000200)='./file0\x00', &(0x7f0000000280), 0x80, &(0x7f00000003c0)={'trans=virtio,', {[{@aname={'aname', 0x3d, 's!@%)\\]^[@/.-'}}]}}) r4 = socket$kcm(0x2, 0x3, 0x2) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000000040)={'syzkaller1\x00', @broadcast}) write$tun(r0, &(0x7f0000000140)={@val={0x8, 0x800}, @val={0x0, 0x0, 0xffe, 0x0, 0x1}, @ipv4=@udp={{0x5, 0x4, 0x3, 0x1f, 0x30, 0x66, 0x0, 0x4, 0x11, 0x0, @empty, @multicast1}, {0x4e23, 0x4e20, 0x1c, 0x0, @gue={{0x1, 0x0, 0x0, 0x1, 0x0, @void}, "0000000000000000009dd2709db8d753"}}}}, 0x3e) 4m39.502404169s ago: executing program 37 (id=5796): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x11, 0x3, 0x0) r2 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r3, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xfff3}}, [@qdisc_kind_options=@q_sfq={{0x8}, {0xfffffffffffffdbc, 0x2, {{0x1, 0xd, 0x0, 0x9, 0x8}, 0x6, 0x1, 0x1, 0x4, 0x8, 0xe, 0x7, 0x1d, 0x3, 0x9, {0xa2d6, 0x200, 0xb, 0x40, 0x2, 0x1ff}}}}]}, 0x78}}, 0x0) ioperm(0x3, 0x9, 0x80) pipe(&(0x7f00000001c0)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = fsopen(&(0x7f0000000080)='autofs\x00', 0x0) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x4}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r6, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) fsconfig$FSCONFIG_SET_FD(r5, 0x5, &(0x7f00000005c0)='fd', 0x0, r4) write$tun(r4, &(0x7f0000000380)=ANY=[], 0xfdef) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r7 = fsmount(r5, 0x0, 0x2) r8 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) setpgid(r8, r8) setpgid(0x0, r8) fchdir(r7) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', 0x0, 0x0, 0x0) r9 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x163000, 0x0) close(r9) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r9, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @link_local={0x1, 0x80, 0xc2, 0x0, 0x0, 0x1}}) socket(0x400000000010, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) 4m38.328044418s ago: executing program 38 (id=5798): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x802, 0x0) utimes(0x0, 0x0) ioctl$sock_SIOCGIFVLAN_ADD_VLAN_CMD(r0, 0x8982, &(0x7f0000000400)={0x0, 'batadv0\x00', {0x5}}) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$kcm(r1, &(0x7f00000014c0)={&(0x7f0000000140)=@x25, 0x80, &(0x7f0000001480)=[{0x0}], 0x1}, 0x4000000) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000040)={'batadv0\x00', 0x0}) sendmsg$nl_route(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000340)={&(0x7f0000000080)=ANY=[@ANYBLOB="3c000000130001000400"/20, @ANYRES32=0x0, @ANYBLOB='\t\x00\x00\x00\x00\x00\x00\x00\b\x00\n\x00', @ANYRES32=r3, @ANYBLOB="1400350064756d6d7930"], 0x3c}, 0x1, 0x0, 0x0, 0x8004010}, 0x0) openat$vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x80, 0x0) ptrace(0x10, 0x1) r4 = socket$pppl2tp(0x18, 0x1, 0x1) ioctl$FS_IOC_GET_ENCRYPTION_NONCE(r1, 0x8010661b, &(0x7f0000000000)) ioctl$SIOCSIFMTU(r4, 0x8922, &(0x7f0000000080)={'dummy0\x00'}) 4m37.139123603s ago: executing program 39 (id=5802): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$kcm(0x11, 0x3, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) r4 = socket$unix(0x1, 0x5, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x4e, &(0x7f0000000080)={&(0x7f00000001c0)=@newqdisc={0x44, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r5, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x0, 0xf}}, [@qdisc_kind_options=@q_hfsc={{0x9}, {0x14, 0x2, @TCA_HFSC_FSC={0x10, 0x2, {0xa30e, 0x1, 0xfffffffa}}}}]}, 0x44}}, 0x0) sendmsg$nl_route_sched(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000800)=@newtfilter={0x64, 0x2c, 0xd3f, 0x70b524, 0x25dfdbfa, {0x0, 0x0, 0x0, r5, {0xe, 0xffe0}, {}, {0x7, 0xfff2}}, [@filter_kind_options=@f_flow={{0x9}, {0x34, 0x2, [@TCA_FLOW_EMATCHES={0x20, 0xb, 0x0, 0x1, [@TCA_EMATCH_TREE_HDR={0x8, 0x1, {0x1}}, @TCA_EMATCH_TREE_LIST={0x14, 0x2, 0x0, 0x1, [@TCF_EM_NBYTE={0x10, 0x1, 0x0, 0x0, {{0x5, 0x2, 0x4}, {0x7, 0x0, 0x65494358c887d6ea}}}]}]}, @TCA_FLOW_KEYS={0x8, 0x1, 0x18d0b}, @TCA_FLOW_MODE={0x8, 0x2, 0x1}]}}]}, 0x64}, 0x1, 0x0, 0x0, 0x4008848}, 0xc884) r6 = socket$can_raw(0x1d, 0x3, 0x1) ioctl$SIOCSIFHWADDR(r6, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @broadcast}) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$kcm(r2, &(0x7f0000000440)={&(0x7f0000000380)=@xdp={0x2c, 0x7, r7, 0x25}, 0x80, &(0x7f0000000340)=[{&(0x7f0000000140)="ac46", 0x5dc}], 0x1}, 0x8804) 2m36.972561671s ago: executing program 3 (id=6309): bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x11, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, @fallback=0x28, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r0 = socket$inet6(0xa, 0x5, 0x0) mknodat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x1000, 0x0) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000240)=ANY=[@ANYRESDEC=r0, @ANYBLOB="5e88d7aacb3c348cffb5c0ef59a5e3e457aca6bf5d2c618ce84501987b5a191b538d32caf9da3443feca5f990e1159c5a7e7ad9a57b4c914c3b31873c4e2073b189d9ceb5ab585cd41bbfb2d39a8a0eb5895aab50e9d7ef46580451973f748f920c57405d2c9264fcb18d1e3b3817cf6a8ee39f422bd17f9bee869790239979bebc89f274fa74c776afcc341a3eab90735626af0e8f1775ebe731353db38de9f208bb3b4e8c4a65c9a295ecc742e65e4b4354f819163f4", @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESHEX=r0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r1, &(0x7f00000021c0)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000000040)={0x50, 0x0, r2, {0x7, 0x1f, 0x8, 0xffffffffd2cb6432, 0x83, 0x2, 0x0, 0xabe6, 0x0, 0x0, 0x8, 0x8101}}, 0x50) syz_fuse_handle_req(r1, &(0x7f000000a340)="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000170000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000080000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e1ffffff000000000000000000000000000000000000000000000000000000000000000000000000000000000f00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d838aae8c05dd22d0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000209bfd66eea2105600000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000005f5de6af0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f00000001c0)={0x20, 0x0, 0xfffffffffffffffd, {0x0, 0xf83cb676ac42ebc1}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x20c01, 0x0) r3 = dup(r0) bind$unix(r3, &(0x7f00000001c0)=@abs={0xa, 0x2}, 0x6e) 2m36.814607285s ago: executing program 3 (id=6311): socket$nl_route(0x10, 0x3, 0x0) clock_gettime(0xa, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000002180)='blkio.bfq.io_merged\x00', 0x275a, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000280)={0x9}) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_PIT(r1, 0x8048ae66, &(0x7f0000000100)={[{0x5, 0xc000, 0x4, 0x5, 0xff, 0x9, 0x3, 0x8, 0xb9, 0x3, 0x8e, 0x5, 0xc50}, {0x804, 0x1, 0x1, 0x45, 0x4, 0x6, 0x2, 0xff, 0x0, 0x4, 0x6, 0x7f, 0x20c}, {0xf1c2, 0x3, 0x38, 0xf, 0x84, 0x7, 0x3, 0x50, 0x0, 0x5, 0x4, 0x5, 0x3a}], 0xffffffff}) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x1fd, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r2, 0x4090ae82, &(0x7f00000003c0)={[0x60000000000, 0xd4, 0x0, 0x63, 0x200002000001, 0x0, 0x1, 0x0, 0x0, 0x36ae, 0x7, 0x7fff, 0x3, 0x400000000], 0x80a0000, 0x1}) ioctl$KVM_RUN(r2, 0xae80, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x1) r3 = syz_open_dev$vbi(&(0x7f0000000080), 0x3, 0x2) ioctl$VIDIOC_S_OUTPUT(r3, 0xc004562f, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r3, 0xc0845657, &(0x7f0000000380)={0x0, @bt={0x2d0, 0x191, 0x1, 0x0, 0xdd9f83, 0x1, 0x2f, 0xf3, 0x2, 0x8, 0x1000008e, 0x3, 0x7, 0x7f, 0x27, 0x20, {0x0, 0x6fd8e84d}, 0x3, 0xed}}) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x80) mbind(&(0x7f00005f7000/0x2000)=nil, 0x2000, 0x1, 0x0, 0x0, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r4 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000003200)=ANY=[@ANYBLOB="5801000010000100880000000000000000000000000001fc010000000000000000000000000001000107144e230005000000003a00"/64, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c00000020010000000000000000000000000002000000000000000092010000000000000600000000000000ffff0000000000001c25080000000000020000000000000000000000000000000700000000000000ffffffffffffffff00000000000000001f00000000000000feffffffffffffff02000000fcffffff000000002abd5000043500000200010020000000480003006465666c617465000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000002400090000f8ffffffffffff810000000000000009000000000000000001000000000000"], 0x158}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r5 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000480)=ANY=[@ANYBLOB="400100001a000100feff19afff65a78029ff00010000ac1e0101000000000000000000000000fc010000000000000000000000418184fb1898227a2300050a00000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="ff020000000000000000000000000001000004d46c000000fc02000000000000000000000000000007000000000000009201000000000010a39b000000000000ffff0000000000001c250800000000000500000000000000fcffffffffffffff0400000000000000ffffffffffffffff00000000000000001f000000000000000500000000000000fefffffffc030000000000007e000000053500000200010020000000480003006465666c6174650000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008001f0002000000"], 0x140}}, 0x844) madvise(&(0x7f0000000000/0x600000)=nil, 0x60005f, 0x3) mincore(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x0) 2m36.244084656s ago: executing program 3 (id=6318): r0 = creat(&(0x7f0000000100)='./file0\x00', 0xecf86c37d53049ea) write$binfmt_elf32(r0, &(0x7f00000008c0)=ANY=[@ANYBLOB="7f454c4604070003070000000000000002000300030000000903000038000000fcffffff0e000000000020000100050000000000001400000300000004000000040020000c0000000004"], 0x58) (async) close(r0) execve(&(0x7f0000000400)='./file0\x00', 0x0, 0x0) (async) r1 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x800) ioctl$SNDRV_SEQ_IOCTL_GET_PORT_INFO(r1, 0xc0a45322, &(0x7f0000000040)) 2m36.154297777s ago: executing program 3 (id=6319): r0 = memfd_create(&(0x7f0000000400)='\xa3\x9fn\xb4dR\x04i5\x02\xac\xce\xe1\x88\x9d[@8\xd7\xce\x1f 9I\x7f\x15\x1d\x93=\xb5\xe7\\\'L\xe6\xd2\x8e\xbc)JtTDq\x81\xcf\x81\xba\xe51\xf5 \xc8\x10>\xc9\\\x85\x17L\xbf\xcf\x91\xdfM\xf3\x02^T*\x00\x02\xb9~B\x9f\xacl\x1d3\x06o\xf8\x16H\xaa*\x02\xf7\xfb\x06\xf1\x83\x92\xa8\xc2\xcb\xae\xb0\xb4\x93\xb8\x04\xf1\x99\xc2yY+\xd9y\x8a\xd5b\xe8\"q\x1b0)\xccm\xacz\xc1\xadd\x9b6a\xf3\xdds\xbb\x88\xff\b\x85\xb3s\x00\x0e\xbcfvi\x85\xfc.|\xd4h\xec\x82o\x8e\x93\x11\xc1\xd4\xae\x05\x17=\xd9R\xd0\xd4\x90\xcf\x9b\xdc\xaeV\x88\x94\x9f\xe3\xefqi\xed\xa8w\xbe\xd0\xd0-tBl\x9e+\xd3\xed\xce\x9f\x83\x86\xf9\x12\x16Ts\x80\x13]C\xfb`\xc2`\xf7\x1a\x00\x00\x00\x00\x00\x00\x00k\xae\xcb\x1a.\xc2\x8f\xd1x4]PZ\x9e\xd5Y\xf0L\xa4\xbc\x84\xf6\x04L\xff0\x8b\\*\xf9,\xb6\r\x97\xedy\xe0\x8a\xe2\x8ck\xc6S\xc3g\xb9\x1a\xf8\x8f \x9d\x00u7\xd8\'\xf1E\xa4(Q\x80Fy\xb5\xe4q\xc9\xff \xd8\x9d\xad\x11\xf8m\xd3\xbc\x9e\x10D\x7f!\xca\x0ev\x15h$\x01\xdd\xe5\xce\xf8*\xb3\x01\x85\a\xe4qv&\x9c\xac\x9aN~o\xe5\x89\xd5\a\x9f\f\x1f\xc2e/\x8d\x1e\n\xd0_\xbd!^\xa46\xb8j\xc0x\n\xdb\xe1\xa3\xd6\xae;\r\x92@\xa5I\x88Z1F\xf0\x1at\t\xd0\x8a\x04m\x06\xf3BL\xffS\x9eY\xf4\xb0U \xf8\xd00\x88y\xebX\x92\xd5\xbb\xa1h7\xf3\xe0\x0f\xbd\x02\xe4%\xf9\xb1\x87\x8aM\xfeG\xb2L\xbd\x92-\xcd\x1f\xf4\xe1,\xb7G|\xec\"\xa2\xab\xf6\x84\xe0\xcf1\x9a', 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x3, 0x3) ioctl$FS_IOC_GETFSLABEL(r1, 0x400452c9, &(0x7f0000000100)) r2 = syz_open_dev$sndmidi(&(0x7f00000002c0), 0x379, 0x0) writev(r2, 0x0, 0x0) openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x80000) socket$kcm(0x21, 0x2, 0xa) ioctl$DRM_IOCTL_MODE_GETRESOURCES(0xffffffffffffffff, 0xc04064a0, &(0x7f0000000380)={0x0, 0x0, &(0x7f0000000440), 0x0}) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x5, &(0x7f0000000040)={0x0, 0x0, 0x10001, 0x5}) ioctl$PPPIOCGIDLE(0xffffffffffffffff, 0x8008743f, &(0x7f00000005c0)) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) socket(0x2d, 0x80002, 0x0) timer_settime(r3, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r4, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000380)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a01010000000000000000010000000900010073797a30000000002c000000030a01020000000000000000010000000900010073797a30000000000900030073797a312000000038000000030a01040000000000000000010000010900010073797a30000000000c000240000000000000000109000300030000000000000014000000110001"], 0xac}, 0x1, 0x0, 0x0, 0x8040}, 0x0) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) ioctl$sock_FIOGETOWN(r1, 0x8903, &(0x7f0000000240)) r5 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r5, 0x4008af00, &(0x7f0000000140)=0x200000000) r6 = syz_open_dev$swradio(&(0x7f0000000000), 0x0, 0x2) ioctl$VIDIOC_PREPARE_BUF(r6, 0xc058565d, &(0x7f0000000180)=@multiplanar_userptr={0xff, 0xb, 0x4, 0x2000, 0x401, {}, {0x2, 0x0, 0xcf, 0x3, 0xc0, 0x8, "65ec72bb"}, 0x4, 0x2, {0x0}, 0x9}) preadv2(r5, &(0x7f0000000080)=[{&(0x7f0000000000)=""/72, 0x48}], 0x1, 0x0, 0x3000, 0x3) r7 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000840)='memory.events.local\x00', 0x275a, 0x0) write$binfmt_script(r7, &(0x7f0000000040), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r7, 0x0) modify_ldt$write(0x1, &(0x7f0000000280)={0x5, 0xffffffffffffffff, 0x4000, 0x0, 0x1, 0x1, 0x1, 0x0, 0x1, 0x1}, 0x10) write$binfmt_elf32(r0, &(0x7f00000001c0)=ANY=[@ANYBLOB="7f454c466000002ed8e4f97765ce27b90300060000000000000000b738000000000035f4c38422a3bc8220000500000004020300b300000000002a0000000000000000"], 0xd8) execveat(r0, &(0x7f0000000000)='\x00', 0x0, 0x0, 0x1000) 2m35.134483151s ago: executing program 3 (id=6323): openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x12000, 0x40) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xa, &(0x7f00000000c0)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x0, 0x7fff0006}]}) unshare(0x22020400) r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x42, 0x0) fallocate(r0, 0x0, 0x1, 0xff) syz_emit_ethernet(0x6a, &(0x7f0000000680)=ANY=[@ANYBLOB="0180c200000000000000000008004c00005c000000000073907800000000e000000100004e22004890780300000000000000d663cd75673f3c2fdc000000000000000100000000000000056980b2e865284992526b3f12744020cdf770280290c865754e85f2769a66fd"], 0x0) unshare(0x20000) 2m35.133528052s ago: executing program 3 (id=6325): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000040)) r1 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f00000000c0)=0x3, 0x4) r2 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'macvlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x200080d4}, 0x4c014) connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) connect$unix(r1, &(0x7f0000000180)=@file={0x1, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xf, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000080)=0x930) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000240), 0x8080, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r5}}) ioctl$TIOCGISO7816(r5, 0x80285442, &(0x7f0000000280)) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000c82000/0x3000)=nil, 0x3000}}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000003380)) ioctl$COMEDI_BUFINFO(0xffffffffffffffff, 0xc02c640e, &(0x7f0000000000)={0x7, 0x401, 0x0, 0x5, 0x35, 0x4, 0x3}) setsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f0000000340)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', r3}, 0x14) 2m13.917567965s ago: executing program 40 (id=6325): r0 = syz_open_dev$tty1(0xc, 0x4, 0x1) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$VT_OPENQRY(r0, 0x5600, &(0x7f0000000040)) r1 = socket$unix(0x1, 0x2, 0x0) setsockopt$sock_int(r1, 0x1, 0x10, &(0x7f00000000c0)=0x3, 0x4) r2 = socket(0x200000000000011, 0x2, 0xd) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f00000000c0)={'macvlan0\x00', 0x0}) bind$packet(r2, &(0x7f0000000080)={0x11, 0x800, r3, 0x1, 0x0, 0x6, @multicast}, 0x14) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x200080d4}, 0x4c014) connect$unix(0xffffffffffffffff, &(0x7f0000000100)=@file={0x0, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) connect$unix(r1, &(0x7f0000000180)=@file={0x1, './file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa'}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0xf, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) mmap(&(0x7f0000000000/0xe7e000)=nil, 0xe7e000, 0xfffffffffffffffe, 0x4031, 0xffffffffffffffff, 0x7542d000) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r5, 0xc0045516, &(0x7f0000000080)=0x930) mount$9p_fd(0x0, &(0x7f0000000040)='.\x00', &(0x7f0000000240), 0x8080, &(0x7f0000000300)={'trans=fd,', {'rfdno', 0x3d, r5}, 0x2c, {'wfdno', 0x3d, r5}}) ioctl$TIOCGISO7816(r5, 0x80285442, &(0x7f0000000280)) r6 = userfaultfd(0x80001) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r6, 0xc020aa00, &(0x7f00000002c0)={{&(0x7f0000c82000/0x3000)=nil, 0x3000}}) ioctl$UFFDIO_REGISTER(r6, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1, 0x2}) ioctl$KDGETLED(r0, 0x4b31, &(0x7f0000003380)) ioctl$COMEDI_BUFINFO(0xffffffffffffffff, 0xc02c640e, &(0x7f0000000000)={0x7, 0x401, 0x0, 0x5, 0x35, 0x4, 0x3}) setsockopt$inet6_mreq(r2, 0x29, 0x14, &(0x7f0000000340)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', r3}, 0x14) 1m39.371138385s ago: executing program 9 (id=6566): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=@newtaction={0x13d0, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x13bc, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x8, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x1ff, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}, @m_tunnel_key={0xe0, 0x5, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e20}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private2}]}, {0x91, 0x6, "722118be311f5ea750e93f7f66128d94d9bcb014300007eb6121202ead9e8359d26e4bc9fd5c340574ecdbd1c7a007ff76d51f593c31c8f1c13e84c114c58c57bb8772bc17a13fd0f98d52e89782e49285c940351dd0abddfc1190a240834ee7387dda5ddc73f862c3e7cf25c483b4dbaf1987eaada5a7a56cc5a6700e60a7cde94d56a6aef06c209670f5c16a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_pedit={0x1028, 0x12, 0x0, 0x0, {{0xa}, {0xf8c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{0x7ff, 0x1ff, 0x3, 0xffff8000, 0xfffffffa}, 0x0, 0xf5, [{0x55, 0x6, 0x10e, 0xb, 0x3, 0x44c}, {0xf, 0x7, 0x9, 0xffffffff, 0x401, 0x7916d5a6}]}, [{0x2, 0x3, 0x10001, 0x28b3e385, 0x2, 0x236}, {0xe, 0x2, 0x80000000, 0x6, 0x6}, {0x6, 0x1, 0x3, 0x8, 0x3, 0xfffffffc}, {0x582d, 0x8000, 0x8, 0x2, 0x6, 0x7a}, {0x4, 0x4, 0x4, 0x1, 0x0, 0x6}, {0x6, 0x81, 0x4, 0x2, 0x1}, {0x5, 0x3, 0x6cd1, 0x7, 0x3, 0xd192e22a}, {0x9, 0x8, 0x9, 0x1, 0x3, 0xbae}, {0x6, 0x8, 0x7, 0x2, 0x4}, {0x10e, 0x4, 0x3ff, 0x7, 0x800, 0x7}, {0xc, 0x80, 0x7, 0x4, 0x5, 0x800}, {0xb95, 0x5, 0x96, 0x9, 0xf, 0x7f}, {0x3ff, 0x3, 0xfffff94d, 0x1, 0x9, 0x1}, {0xffff, 0x1, 0x4, 0x9, 0xfffffffb, 0x8}, {0x1, 0x1, 0x6cdc, 0xfffffffd, 0x1, 0x10}, {0x0, 0x1, 0x6, 0xc, 0x6, 0xe248}, {0xa46, 0x0, 0x8001, 0x7, 0x101, 0x7fff}, {0x7, 0x0, 0x44d7, 0x73e8, 0x101, 0x688}, {0xc, 0x10001, 0x4, 0x5, 0x5c}, {0x0, 0x1, 0xffffff9e, 0xe5ac, 0xff}, {0x9, 0x5, 0x4a4, 0x80000000, 0x4}, {0xf723, 0x6, 0x8, 0x100, 0x8, 0xfffffffe}, {0x3, 0x7, 0x8001, 0x5, 0xd1c5, 0x9}, {0x9, 0x9, 0x6, 0x0, 0x5, 0x10000}, {0x3ff, 0x200, 0x5, 0x3e4, 0xe6, 0x1}, {0x31d, 0x3e71eee6, 0x5, 0x4, 0x80000000, 0x5a9}, {0xabb, 0x8001, 0x0, 0x7ff, 0x82f, 0x80}, {0x8, 0xff, 0x3, 0x4, 0x80000001, 0x9}, {0x0, 0x0, 0x9, 0x2, 0x853, 0x4}, {0x1, 0x1, 0x1, 0xffff0000, 0x4}, {0x80000001, 0x5, 0x2, 0x6, 0x73000, 0x7}, {0x3ff, 0x9, 0xfffffff7, 0x9b13, 0xfffffff9, 0x7161c348}, {0x7, 0x4, 0x101, 0x9, 0x4, 0x7}, {0xad, 0x1ff, 0x800, 0x6e04d4f6, 0x5b8f, 0x3093}, {0x1, 0x7, 0x11, 0x8483, 0x3ff, 0x9}, {0x7, 0x4, 0xffff, 0x401, 0x0, 0x1ff}, {0x0, 0x3, 0x2, 0x1, 0x6, 0x5}, {0xbd, 0x5a, 0x8001, 0xff, 0x4, 0x3}, {0x0, 0x9, 0x838, 0x431, 0xfffffffb, 0x6b5}, {0x9, 0x5, 0x0, 0x5, 0x1, 0x1000}, {0x9, 0x7, 0x3, 0x0, 0xd, 0x31766c52}, {0x4, 0x8, 0x10001, 0x0, 0x1, 0x101}, {0x0, 0x12c6, 0x3, 0x3, 0x100, 0x1f}, {0x14, 0x8, 0x6, 0xb, 0x7fff}, {0x9, 0x9, 0x0, 0x9, 0x4, 0x2}, {0xfffff661, 0x7, 0x9, 0xfff, 0x10, 0x8}, {0x180, 0xe2b, 0x2, 0x1, 0x9, 0x1}, {0x8001, 0x2, 0x0, 0x8, 0x4, 0x7}, {0x0, 0xfffffffc, 0x9, 0x5, 0x46a9, 0xff}, {0x6, 0x1, 0x3, 0x4, 0x101, 0x101}, {0xff, 0x9, 0xfffffffb, 0x7, 0xfffffff7, 0x7}, {0x1e00, 0x17efbf35, 0x1, 0x6, 0x899, 0x6}, {0x101, 0xfffffffb, 0x3, 0xffffd361, 0x1, 0x4}, {0x28, 0x7f, 0x1, 0x9, 0x5, 0xd35c}, {0x3, 0x0, 0x4, 0x1, 0x8, 0x4}, {0x9, 0x9, 0x6, 0x7, 0x7}, {0x800, 0x6, 0x13ea, 0x81, 0x7fffffff}, {0x8, 0x4, 0x81, 0x7, 0xbfdc, 0x3}, {0x5, 0x8, 0xeba4, 0x5, 0x2, 0x3}, {0x1, 0x3, 0x4a64, 0x6ba, 0x2, 0xf}, {0x5e4, 0x7ff, 0x400, 0x8, 0xffff46f5, 0x80500}, {0x5, 0xf, 0x2, 0x7, 0x2, 0x1}, {0xb, 0x400, 0x200, 0x3, 0x40, 0x2}, {0x80000001, 0x7fffffff, 0xc736, 0xcd8, 0x2, 0x4}, {0x0, 0x6, 0x6, 0x101, 0x4, 0x4}, {0xfffffbff, 0x8, 0x100, 0x0, 0x9, 0x9}, {0x0, 0x1, 0xff, 0x0, 0x80000001, 0x6}, {0x1, 0x7, 0x769b5e8d, 0x6, 0x9, 0x8000}, {0x1, 0x5, 0x4, 0x1245, 0x5, 0xfffffffa}, {0x1, 0x8, 0x1200, 0x4, 0xfff, 0x10}, {0x1, 0x7f, 0x9, 0x8fa8, 0x5, 0x7}, {0x2, 0x5, 0xa, 0x2, 0x4, 0x80000000}, {0xad, 0x2, 0x8, 0x9, 0x7, 0xeee6}, {0x80000000, 0x2c, 0xf0000000, 0x8, 0x1, 0x2}, {0x4, 0x832, 0x8, 0x7, 0x6, 0x8}, {0x5, 0x9, 0xffffffff, 0x6, 0xc, 0x8}, {0x2, 0x5, 0x8bb, 0x5a8, 0xc4, 0xa}, {0x7f, 0x9d, 0x9, 0x6, 0x400, 0x8001}, {0x9, 0x5, 0x5, 0x4, 0x7, 0x8b1}, {0x10, 0x2, 0x7ff, 0x10001, 0x40, 0x698c}, {0xc60, 0x3, 0xb04, 0x2, 0x4, 0x8}, {0x4, 0x2, 0x6, 0x7, 0x5}, {0xfffffff9, 0x5, 0x4, 0x9, 0x2, 0x4}, {0x1, 0x6, 0x4, 0x3, 0x0, 0x5}, {0x6, 0xb6, 0x9667, 0x9, 0xffffffff, 0x80000000}, {0x8000, 0x11f, 0x10000, 0x8, 0x3, 0x6}, {0xa7, 0x7, 0x6, 0x6, 0x2da51768, 0x1}, {0xd0b2, 0x800, 0x0, 0x5, 0x7, 0xa8}, {0x4, 0xb, 0x6, 0x4, 0x27, 0x9}, {0x7, 0x0, 0x40, 0x8, 0x34a, 0x81}, {0x6, 0x782e, 0x1ff, 0x9, 0x8, 0x6}, {0x2, 0x4, 0xd, 0x31b6, 0x80000000, 0x63}, {0x5d6, 0x8, 0x7f4, 0x72ad, 0xfff, 0x7}, {0x80000000, 0x5, 0x8, 0x6, 0x5, 0x9}, {0xf0, 0x6, 0xfffeffff, 0x5, 0x5, 0x1}, {0xffffff78, 0xfcc9888, 0x3, 0x3, 0x0, 0xffff}, {0xfffffff7, 0x7fff, 0x0, 0x10000, 0x101, 0x56f}, {0x9, 0x6, 0x3, 0x8, 0xf, 0x40}, {0x10, 0xc7, 0xded, 0x2, 0x4, 0x5}, {0x100, 0x7, 0x10, 0x9, 0xd1, 0xac}, {0x7f, 0x4, 0x7, 0xfffffff9, 0x2, 0x1}, {0x9, 0xb63, 0x10000000, 0x3ff, 0xfffffff9, 0xff66}, {0x20000000, 0x8, 0xffffffff, 0x8, 0x9, 0x16f}, {0x94ab, 0x1, 0x5, 0xe3e, 0x2, 0x4}, {0x1, 0x6, 0x7, 0x6, 0x7, 0xfffffff9}, {0xa739, 0x1000, 0x795cd5c5, 0xd, 0xfff, 0x1}, {0x9, 0xffff, 0x40, 0x7, 0x3, 0x7}, {0x1, 0x4, 0x0, 0x0, 0x3, 0xfd43}, {0x80000001, 0x80000000, 0x68, 0x643, 0x10000, 0x9}, {0x7ff, 0x9, 0xd89, 0x6, 0x3ff, 0x4}, {0x6, 0x9, 0xd3a4, 0x6, 0x9, 0x7}, {0x3, 0x7ff, 0x4, 0x3f, 0x4, 0x1}, {0x59000000, 0x8, 0x5, 0x5, 0x9, 0xa}, {0x10, 0xd939, 0x2, 0x7f, 0x80000001, 0x1ff}, {0x51, 0xff, 0x4, 0xfffffffd, 0x5, 0x8}, {0x2, 0x7031, 0xf, 0x9, 0x8, 0x7}, {0x3513, 0xffffffff, 0xfe800, 0xfffffffd, 0x1, 0x2}, {0x9, 0x0, 0x4, 0x59c, 0x7fffffff, 0x4}, {0x1, 0x7, 0x4e6a9eaa, 0x2, 0x1000, 0x8}, {0x2, 0x0, 0x9, 0x0, 0x9, 0x1}, {0x66b8, 0x1f0, 0x10000, 0x10, 0x7, 0x7}, {0x8, 0x100, 0xfffffffb, 0x1ff, 0x1, 0xe}, {0x0, 0xdfbf, 0x8, 0x3, 0xf011, 0x3}, {0x4, 0x7, 0x8, 0x9, 0x2, 0x5}, {0x10001, 0xbd, 0xf2d, 0x100, 0x1, 0x8}, {0xf, 0xfd, 0x5, 0x7fffffff, 0x4e, 0xf2}, {0x1, 0x101, 0x5c7, 0x7ff, 0x400, 0xda}, {0x1, 0x0, 0x7, 0x2, 0x5, 0x7b689826}], [{0x2}, {}, {0x1}, {0x4, 0x1}, {0x5}, {0x1, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x4}, {0x3, 0x1}, {0x3, 0x1}, {0x3}, {}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x1, 0x1}, {0x5}, {0x1, 0x1}, {0x2}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x1}, {0x4, 0x1}, {0x2}, {0x1, 0x1}, {0x0, 0x1}, {0x6, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {}, {0x0, 0x1}, {}, {0x1, 0x1}, {0x4}, {0x1}, {0x5}, {0x6}, {0x4}, {0x1}, {0x0, 0x1}, {0x9}, {0x1}, {0x5}, {0x7, 0x1}, {0x6}, {0x2}, {0x3, 0x1}, {0x5}, {0x1}, {0x5, 0x1}, {0x7, 0x1}, {0x4}, {0x1, 0x1}, {0x5}, {0x2}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x2}, {0x1}, {0x3, 0x1}, {0x5, 0x1}, {}, {0x5, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5}, {0x2}, {0x4, 0x1}, {0x5}, {0x4, 0x1}, {0x0, 0x1}, {0x5}, {0x3}, {0x2}, {0x4, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x4}, {0x5, 0x1}, {0x7, 0x1}, {0x5}, {0x4}, {0x0, 0x1}, {0x4}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x5}, {0x3}, {}, {0x4}, {}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x4}, {0x2, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x5}, {0x5, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x138, 0x5, 0x0, 0x1, [{0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x34, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x34, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0x2c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}]}]}]}, {0x73, 0x6, "3e6f0789c64c7d0664a0e89f067427ff277a6796faefd2e4e7fee2317d8ed29d55b6dd1a8da4590c0e50ac77a694cd19f95f0536497bcc17ebe8ca6da6d9d1aa49df2155c5e048652ad7070104462021d6373184bc7e7be49efdad67d3284740bfa7f81de8e98fed04adbf36cb8453"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x4, 0x3}}}}, @m_nat={0xec, 0x9, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0x1, 0x2, 0x3, 0x80}, @dev={0xac, 0x14, 0x14, 0x3e}, @dev={0xac, 0x14, 0x14, 0x1d}, 0xff000000}}]}, {0x9b, 0x6, "9f1bea516cc89fa06850e0b0766cf30d98eb4100d8a8700885e84e72d414d48c32c077e9aa93b6beef0a6129265409de358a6492371e0929f12a7fa9cc864fbbf35de4941886c1c4d40893c95f2802bb86cde5c22d3f880069c60d2896f8b2b9ec91ce73576b0574454013dfd9463349b4c2e2a40249cd07093819974a949eb813da51ecdb7b192bc4c7486b4634b48bb8de6ae673bbd4"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_bpf={0x138, 0x1d, 0x0, 0x0, {{0x8}, {0x14, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x9}]}, {0x100, 0x6, "98e4d013c7de8073ab870d57adbc86f6d1c461ae1c0aaf15e937f1a59526e26ca3b2d7fc11cc8fd4b0aa41e8e22b77707e107ce353fe2c3fc87383cc266cfcda91942c13ff8b037ebcc25a2971627cd5457bfe30bed2e62fdd656f92f657fba49a53f87fc133adeb5d5f616beec06b2d1c164658cdba32ab8ba56a5f9945c1fd08a85db5fac4d212acb9cbcdc32221dfe3ecb967dcd75b1f14dc504bd53e144e869a0cac50a0a81b4dbbdb3f23bbd4ea8ded9b46eeb42cac8eb84dafa605b8182cdd8c8b56d1223e928d9c73540f5a8ba1de5ce066c5e9e65994ca8d1b99d41757a15c1bbce66f07c4b9bbf3f82b65a69ca96697372693d1e6badacc"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0x13d0}, 0x1, 0x0, 0x0, 0x40845}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000000)) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r3, 0x107, 0x5, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:04.0/irq\x00', 0x0, 0x0) read(r5, &(0x7f0000000800), 0xa) write(r4, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x8000002) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x600000, 0x9) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r0, 0x0, 0x5004) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1m38.089790043s ago: executing program 9 (id=6571): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=@bridge_delvlan={0x28, 0x56, 0x1, 0x0, 0x0, {}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x0, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8}}}]}, 0x28}}, 0x0) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000180)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x4e20, @dev={0xac, 0x14, 0x14, 0x3b}}]}, &(0x7f00000002c0)=0x10) r2 = openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x220000, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'ni_atmio16d\x00', [0x9, 0x8, 0x6, 0x1, 0x7, 0xf, 0x1, 0x9, 0xc, 0xffff8001, 0x6, 0x1, 0x2, 0x7, 0x1, 0x6, 0x49f, 0xb1, 0x3ff, 0xa77d, 0x7, 0x9c8, 0xa0000000, 0x8, 0x5f000, 0x1, 0x7fffffff, 0x2, 0x7, 0x1, 0x0, 0x6]}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e06f40908"], 0xa) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000580)) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000001080)='./proc_dir\x00', &(0x7f00000010c0)='proc\x00', 0x0, 0x0) openat(0xffffffffffffff9c, &(0x7f0000001100)='./proc_dir/acpi/wakeup\x00', 0x0, 0x0) write$uinput_user_dev(r3, &(0x7f0000000ec0)={'syz1\x00', {0x0, 0x0, 0xfffc}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x40000000, 0xfeffffff, 0x0, 0x0, 0xfffffffc, 0x1, 0x0, 0x4, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fff, 0x3, 0x80000000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x5, 0x4, 0x7fffffff, 0x0, 0x2000, 0xfffffffc, 0x0, 0x8, 0x0, 0x20000, 0xfffffffc, 0xfffffffc, 0x40000000, 0x0, 0xfffffffc, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0, 0x2], [0x0, 0x1, 0x2, 0xb16, 0x4000000, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0xaaf, 0x7, 0x0, 0x0, 0x4, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x200, 0x0, 0x2, 0x8, 0x1000, 0x0, 0xf, 0x1, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x0, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x7, 0x0, 0x0, 0x0, 0x800, 0x5, 0xfffffffe, 0x0, 0xf, 0x0, 0xd], [0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2b439038, 0x0, 0x9, 0x0, 0x4dc, 0x20000, 0xfffffffd, 0x2, 0xe, 0x1, 0x0, 0x0, 0xffffffff, 0x9, 0x0, 0x0, 0x0, 0x9, 0x8, 0x2, 0x2, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0xad1, 0x0, 0x0, 0x4, 0x80, 0x8, 0x0, 0x0, 0x0, 0x5, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x3, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x200, 0x0, 0x0, 0x0, 0x0, 0xfffff402, 0x5, 0x0, 0x0, 0x800, 0x0, 0x40002, 0x2, 0x20000000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4, 0x2, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x80000001, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) r4 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r4, 0x1, 0x20, &(0x7f0000fee000), 0x4) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) 1m37.448052367s ago: executing program 9 (id=6576): r0 = openat$pidfd(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) r1 = openat(r0, &(0x7f0000000140)='root/proc/sys\x00', 0x10000, 0x0) getdents64(r1, &(0x7f0000000000)=""/256, 0x100) (fail_nth: 7) 1m37.254265485s ago: executing program 9 (id=6578): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=@base={0x5, 0x4, 0xf54, 0xd, 0x0, 0xffffffffffffffff, 0x3}, 0x50) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x1, 0xd, &(0x7f0000000f80)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000085000000a000000095"], &(0x7f0000000340)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x33, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_mtu(r4, 0x29, 0x17, &(0x7f0000000080)=0x5, 0x4) setsockopt$sock_attach_bpf(r2, 0x1, 0x32, &(0x7f0000000000)=r1, 0x0) sendmsg$inet(r3, &(0x7f0000000500)={0x0, 0x0, 0x0}, 0x4800) r5 = signalfd(r1, &(0x7f0000000040)={[0x0, 0x2]}, 0x8) r6 = syz_genetlink_get_family_id$gtp(&(0x7f00000001c0), 0xffffffffffffffff) sendmsg$GTP_CMD_ECHOREQ(r5, &(0x7f0000000280)={&(0x7f0000000180)={0x10, 0x0, 0x0, 0x40000000}, 0xc, &(0x7f0000000240)={&(0x7f0000000200)={0x3c, r6, 0x0, 0x70bd25, 0x25dfdbff, {}, [@GTPA_PEER_ADDR6={0x14, 0xb, @ipv4={'\x00', '\xff\xff', @loopback}}, @GTPA_PEER_ADDR6={0x14, 0xb, @rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02'}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4044080}, 0x814) 1m37.199654014s ago: executing program 9 (id=6579): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000005c0)=@newtaction={0x13d0, 0x30, 0x1, 0x70bd28, 0x0, {}, [{0x13bc, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x8, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x3, 0x1}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x1ff, 0x0, 0x0, 0x0, 0x4}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x1}}}}, @m_tunnel_key={0xe0, 0x5, 0x0, 0x0, {{0xf}, {0x20, 0x2, 0x0, 0x1, [@TCA_TUNNEL_KEY_ENC_DST_PORT={0x6, 0x9, 0x4e20}, @TCA_TUNNEL_KEY_ENC_IPV6_DST={0x14, 0x6, @private2}]}, {0x91, 0x6, "722118be311f5ea750e93f7f66128d94d9bcb014300007eb6121202ead9e8359d26e4bc9fd5c340574ecdbd1c7a007ff76d51f593c31c8f1c13e84c114c58c57bb8772bc17a13fd0f98d52e89782e49285c940351dd0abddfc1190a240834ee7387dda5ddc73f862c3e7cf25c483b4dbaf1987eaada5a7a56cc5a6700e60a7cde94d56a6aef06c209670f5c16a"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x3, 0x2}}}}, @m_pedit={0x1028, 0x12, 0x0, 0x0, {{0xa}, {0xf8c, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe50, 0x2, {{{0x7ff, 0x1ff, 0x3, 0xffff8000, 0xfffffffa}, 0x0, 0xf5, [{0x55, 0x6, 0x10e, 0xb, 0x3, 0x44c}, {0xf, 0x7, 0x9, 0xffffffff, 0x401, 0x7916d5a6}]}, [{0x2, 0x3, 0x10001, 0x28b3e385, 0x2, 0x236}, {0xe, 0x2, 0x80000000, 0x6, 0x6}, {0x6, 0x1, 0x3, 0x8, 0x3, 0xfffffffc}, {0x582d, 0x8000, 0x8, 0x2, 0x6, 0x7a}, {0x4, 0x4, 0x4, 0x1, 0x0, 0x6}, {0x6, 0x81, 0x4, 0x2, 0x1}, {0x5, 0x3, 0x6cd1, 0x7, 0x3, 0xd192e22a}, {0x9, 0x8, 0x9, 0x1, 0x3, 0xbae}, {0x6, 0x8, 0x7, 0x2, 0x4}, {0x10e, 0x4, 0x3ff, 0x7, 0x800, 0x7}, {0xc, 0x80, 0x7, 0x4, 0x5, 0x800}, {0xb95, 0x5, 0x96, 0x9, 0xf, 0x7f}, {0x3ff, 0x3, 0xfffff94d, 0x1, 0x9, 0x1}, {0xffff, 0x1, 0x4, 0x9, 0xfffffffb, 0x8}, {0x1, 0x1, 0x6cdc, 0xfffffffd, 0x1, 0x10}, {0x0, 0x1, 0x6, 0xc, 0x6, 0xe248}, {0xa46, 0x0, 0x8001, 0x7, 0x101, 0x7fff}, {0x7, 0x0, 0x44d7, 0x73e8, 0x101, 0x688}, {0xc, 0x10001, 0x4, 0x5, 0x5c}, {0x0, 0x1, 0xffffff9e, 0xe5ac, 0xff}, {0x9, 0x5, 0x4a4, 0x80000000, 0x4}, {0xf723, 0x6, 0x8, 0x100, 0x8, 0xfffffffe}, {0x3, 0x7, 0x8001, 0x5, 0xd1c5, 0x9}, {0x9, 0x9, 0x6, 0x0, 0x5, 0x10000}, {0x3ff, 0x200, 0x5, 0x3e4, 0xe6, 0x1}, {0x31d, 0x3e71eee6, 0x5, 0x4, 0x80000000, 0x5a9}, {0xabb, 0x8001, 0x0, 0x7ff, 0x82f, 0x80}, {0x8, 0xff, 0x3, 0x4, 0x80000001, 0x9}, {0x0, 0x0, 0x9, 0x2, 0x853, 0x4}, {0x1, 0x1, 0x1, 0xffff0000, 0x4}, {0x80000001, 0x5, 0x2, 0x6, 0x73000, 0x7}, {0x3ff, 0x9, 0xfffffff7, 0x9b13, 0xfffffff9, 0x7161c348}, {0x7, 0x4, 0x101, 0x9, 0x4, 0x7}, {0xad, 0x1ff, 0x800, 0x6e04d4f6, 0x5b8f, 0x3093}, {0x1, 0x7, 0x11, 0x8483, 0x3ff, 0x9}, {0x7, 0x4, 0xffff, 0x401, 0x0, 0x1ff}, {0x0, 0x3, 0x2, 0x1, 0x6, 0x5}, {0xbd, 0x5a, 0x8001, 0xff, 0x4, 0x3}, {0x0, 0x9, 0x838, 0x431, 0xfffffffb, 0x6b5}, {0x9, 0x5, 0x0, 0x5, 0x1, 0x1000}, {0x9, 0x7, 0x3, 0x0, 0xd, 0x31766c52}, {0x4, 0x8, 0x10001, 0x0, 0x1, 0x101}, {0x0, 0x12c6, 0x3, 0x3, 0x100, 0x1f}, {0x14, 0x8, 0x6, 0xb, 0x7fff}, {0x9, 0x9, 0x0, 0x9, 0x4, 0x2}, {0xfffff661, 0x7, 0x9, 0xfff, 0x10, 0x8}, {0x180, 0xe2b, 0x2, 0x1, 0x9, 0x1}, {0x8001, 0x2, 0x0, 0x8, 0x4, 0x7}, {0x0, 0xfffffffc, 0x9, 0x5, 0x46a9, 0xff}, {0x6, 0x1, 0x3, 0x4, 0x101, 0x101}, {0xff, 0x9, 0xfffffffb, 0x7, 0xfffffff7, 0x7}, {0x1e00, 0x17efbf35, 0x1, 0x6, 0x899, 0x6}, {0x101, 0xfffffffb, 0x3, 0xffffd361, 0x1, 0x4}, {0x28, 0x7f, 0x1, 0x9, 0x5, 0xd35c}, {0x3, 0x0, 0x4, 0x1, 0x8, 0x4}, {0x9, 0x9, 0x6, 0x7, 0x7}, {0x800, 0x6, 0x13ea, 0x81, 0x7fffffff}, {0x8, 0x4, 0x81, 0x7, 0xbfdc, 0x3}, {0x5, 0x8, 0xeba4, 0x5, 0x2, 0x3}, {0x1, 0x3, 0x4a64, 0x6ba, 0x2, 0xf}, {0x5e4, 0x7ff, 0x400, 0x8, 0xffff46f5, 0x80500}, {0x5, 0xf, 0x2, 0x7, 0x2, 0x1}, {0xb, 0x400, 0x200, 0x3, 0x40, 0x2}, {0x80000001, 0x7fffffff, 0xc736, 0xcd8, 0x2, 0x4}, {0x0, 0x6, 0x6, 0x101, 0x4, 0x4}, {0xfffffbff, 0x8, 0x100, 0x0, 0x9, 0x9}, {0x0, 0x1, 0xff, 0x0, 0x80000001, 0x6}, {0x1, 0x7, 0x769b5e8d, 0x6, 0x9, 0x8000}, {0x1, 0x5, 0x4, 0x1245, 0x5, 0xfffffffa}, {0x1, 0x8, 0x1200, 0x4, 0xfff, 0x10}, {0x1, 0x7f, 0x9, 0x8fa8, 0x5, 0x7}, {0x2, 0x5, 0xa, 0x2, 0x4, 0x80000000}, {0xad, 0x2, 0x8, 0x9, 0x7, 0xeee6}, {0x80000000, 0x2c, 0xf0000000, 0x8, 0x1, 0x2}, {0x4, 0x832, 0x8, 0x7, 0x6, 0x8}, {0x5, 0x9, 0xffffffff, 0x6, 0xc, 0x8}, {0x2, 0x5, 0x8bb, 0x5a8, 0xc4, 0xa}, {0x7f, 0x9d, 0x9, 0x6, 0x400, 0x8001}, {0x9, 0x5, 0x5, 0x4, 0x7, 0x8b1}, {0x10, 0x2, 0x7ff, 0x10001, 0x40, 0x698c}, {0xc60, 0x3, 0xb04, 0x2, 0x4, 0x8}, {0x4, 0x2, 0x6, 0x7, 0x5}, {0xfffffff9, 0x5, 0x4, 0x9, 0x2, 0x4}, {0x1, 0x6, 0x4, 0x3, 0x0, 0x5}, {0x6, 0xb6, 0x9667, 0x9, 0xffffffff, 0x80000000}, {0x8000, 0x11f, 0x10000, 0x8, 0x3, 0x6}, {0xa7, 0x7, 0x6, 0x6, 0x2da51768, 0x1}, {0xd0b2, 0x800, 0x0, 0x5, 0x7, 0xa8}, {0x4, 0xb, 0x6, 0x4, 0x27, 0x9}, {0x7, 0x0, 0x40, 0x8, 0x34a, 0x81}, {0x6, 0x782e, 0x1ff, 0x9, 0x8, 0x6}, {0x2, 0x4, 0xd, 0x31b6, 0x80000000, 0x63}, {0x5d6, 0x8, 0x7f4, 0x72ad, 0xfff, 0x7}, {0x80000000, 0x5, 0x8, 0x6, 0x5, 0x9}, {0xf0, 0x6, 0xfffeffff, 0x5, 0x5, 0x1}, {0xffffff78, 0xfcc9888, 0x3, 0x3, 0x0, 0xffff}, {0xfffffff7, 0x7fff, 0x0, 0x10000, 0x101, 0x56f}, {0x9, 0x6, 0x3, 0x8, 0xf, 0x40}, {0x10, 0xc7, 0xded, 0x2, 0x4, 0x5}, {0x100, 0x7, 0x10, 0x9, 0xd1, 0xac}, {0x7f, 0x4, 0x7, 0xfffffff9, 0x2, 0x1}, {0x9, 0xb63, 0x10000000, 0x3ff, 0xfffffff9, 0xff66}, {0x20000000, 0x8, 0xffffffff, 0x8, 0x9, 0x16f}, {0x94ab, 0x1, 0x5, 0xe3e, 0x2, 0x4}, {0x1, 0x6, 0x7, 0x6, 0x7, 0xfffffff9}, {0xa739, 0x1000, 0x795cd5c5, 0xd, 0xfff, 0x1}, {0x9, 0xffff, 0x40, 0x7, 0x3, 0x7}, {0x1, 0x4, 0x0, 0x0, 0x3, 0xfd43}, {0x80000001, 0x80000000, 0x68, 0x643, 0x10000, 0x9}, {0x7ff, 0x9, 0xd89, 0x6, 0x3ff, 0x4}, {0x6, 0x9, 0xd3a4, 0x6, 0x9, 0x7}, {0x3, 0x7ff, 0x4, 0x3f, 0x4, 0x1}, {0x59000000, 0x8, 0x5, 0x5, 0x9, 0xa}, {0x10, 0xd939, 0x2, 0x7f, 0x80000001, 0x1ff}, {0x51, 0xff, 0x4, 0xfffffffd, 0x5, 0x8}, {0x2, 0x7031, 0xf, 0x9, 0x8, 0x7}, {0x3513, 0xffffffff, 0xfe800, 0xfffffffd, 0x1, 0x2}, {0x9, 0x0, 0x4, 0x59c, 0x7fffffff, 0x4}, {0x1, 0x7, 0x4e6a9eaa, 0x2, 0x1000, 0x8}, {0x2, 0x0, 0x9, 0x0, 0x9, 0x1}, {0x66b8, 0x1f0, 0x10000, 0x10, 0x7, 0x7}, {0x8, 0x100, 0xfffffffb, 0x1ff, 0x1, 0xe}, {0x0, 0xdfbf, 0x8, 0x3, 0xf011, 0x3}, {0x4, 0x7, 0x8, 0x9, 0x2, 0x5}, {0x10001, 0xbd, 0xf2d, 0x100, 0x1, 0x8}, {0xf, 0xfd, 0x5, 0x7fffffff, 0x4e, 0xf2}, {0x1, 0x101, 0x5c7, 0x7ff, 0x400, 0xda}, {0x1, 0x0, 0x7, 0x2, 0x5, 0x7b689826}], [{0x2}, {}, {0x1}, {0x4, 0x1}, {0x5}, {0x1, 0x1}, {0x3, 0x1}, {0x5, 0x1}, {0x3}, {0x3}, {0x4}, {0x3, 0x1}, {0x3, 0x1}, {0x3}, {}, {0x1, 0x1}, {0x1}, {0x5, 0x1}, {0x2, 0x1}, {0x3}, {0x1, 0x1}, {0x5}, {0x1, 0x1}, {0x2}, {0x0, 0x1}, {0x2, 0x1}, {0x4}, {0x1}, {0x4, 0x1}, {0x2}, {0x1, 0x1}, {0x0, 0x1}, {0x6, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x1, 0x1}, {}, {0x0, 0x1}, {}, {0x1, 0x1}, {0x4}, {0x1}, {0x5}, {0x6}, {0x4}, {0x1}, {0x0, 0x1}, {0x9}, {0x1}, {0x5}, {0x7, 0x1}, {0x6}, {0x2}, {0x3, 0x1}, {0x5}, {0x1}, {0x5, 0x1}, {0x7, 0x1}, {0x4}, {0x1, 0x1}, {0x5}, {0x2}, {0x3, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x2, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x2}, {0x1}, {0x3, 0x1}, {0x5, 0x1}, {}, {0x5, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x5}, {0x2}, {0x4, 0x1}, {0x5}, {0x4, 0x1}, {0x0, 0x1}, {0x5}, {0x3}, {0x2}, {0x4, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x2, 0x1}, {0x4}, {0x5, 0x1}, {0x7, 0x1}, {0x5}, {0x4}, {0x0, 0x1}, {0x4}, {0x4}, {0x4, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x5}, {0x3}, {}, {0x4}, {}, {0x3}, {0x2, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {}, {0x2, 0x1}, {0x4}, {0x0, 0x1}, {0x3}, {0x4}, {0x2, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x2, 0x1}, {0x5}, {0x5, 0x1}]}}, @TCA_PEDIT_KEYS_EX={0x138, 0x5, 0x0, 0x1, [{0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x2}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x3c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x3}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x34, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6}]}, {0x34, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x5}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x4}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}]}, {0x14, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_HTYPE={0x6}]}, {0x2c, 0x6, 0x0, 0x1, [@TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_CMD={0x6, 0x2, 0x1}, @TCA_PEDIT_KEY_EX_CMD={0x6}, @TCA_PEDIT_KEY_EX_HTYPE={0x6, 0x1, 0x1}]}]}]}, {0x73, 0x6, "3e6f0789c64c7d0664a0e89f067427ff277a6796faefd2e4e7fee2317d8ed29d55b6dd1a8da4590c0e50ac77a694cd19f95f0536497bcc17ebe8ca6da6d9d1aa49df2155c5e048652ad7070104462021d6373184bc7e7be49efdad67d3284740bfa7f81de8e98fed04adbf36cb8453"}, {0xc, 0x7, {0x1, 0x1}}, {0xc, 0x8, {0x4, 0x3}}}}, @m_nat={0xec, 0x9, 0x0, 0x0, {{0x8}, {0x2c, 0x2, 0x0, 0x1, [@TCA_NAT_PARMS={0x28, 0x1, {{0x1, 0x1, 0x2, 0x3, 0x80}, @dev={0xac, 0x14, 0x14, 0x3e}, @dev={0xac, 0x14, 0x14, 0x1d}, 0xff000000}}]}, {0x9b, 0x6, "9f1bea516cc89fa06850e0b0766cf30d98eb4100d8a8700885e84e72d414d48c32c077e9aa93b6beef0a6129265409de358a6492371e0929f12a7fa9cc864fbbf35de4941886c1c4d40893c95f2802bb86cde5c22d3f880069c60d2896f8b2b9ec91ce73576b0574454013dfd9463349b4c2e2a40249cd07093819974a949eb813da51ecdb7b192bc4c7486b4634b48bb8de6ae673bbd4"}, {0xc}, {0xc, 0x8, {0x1}}}}, @m_bpf={0x138, 0x1d, 0x0, 0x0, {{0x8}, {0x14, 0x2, 0x0, 0x1, [@TCA_ACT_BPF_FD={0x8}, @TCA_ACT_BPF_OPS_LEN={0x6, 0x3, 0x9}]}, {0x100, 0x6, "98e4d013c7de8073ab870d57adbc86f6d1c461ae1c0aaf15e937f1a59526e26ca3b2d7fc11cc8fd4b0aa41e8e22b77707e107ce353fe2c3fc87383cc266cfcda91942c13ff8b037ebcc25a2971627cd5457bfe30bed2e62fdd656f92f657fba49a53f87fc133adeb5d5f616beec06b2d1c164658cdba32ab8ba56a5f9945c1fd08a85db5fac4d212acb9cbcdc32221dfe3ecb967dcd75b1f14dc504bd53e144e869a0cac50a0a81b4dbbdb3f23bbd4ea8ded9b46eeb42cac8eb84dafa605b8182cdd8c8b56d1223e928d9c73540f5a8ba1de5ce066c5e9e65994ca8d1b99d41757a15c1bbce66f07c4b9bbf3f82b65a69ca96697372693d1e6badacc"}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x2}}}}]}]}, 0x13d0}, 0x1, 0x0, 0x0, 0x40845}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_io_uring_setup(0x278, &(0x7f0000000340)={0x0, 0x0, 0x13580}, &(0x7f0000000100), &(0x7f0000000280), &(0x7f0000000000)) r3 = socket$packet(0x11, 0x3, 0x300) setsockopt$packet_rx_ring(r3, 0x107, 0x5, 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x14) mkdirat(0xffffffffffffff9c, &(0x7f00000001c0)='./mysys\x00', 0x1ff) mount(0x0, &(0x7f0000000100)='./mysys\x00', &(0x7f0000000200)='sysfs\x00', 0x0, 0x0) r5 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./mysys/bus/pci/devices/0000:00:04.0/irq\x00', 0x0, 0x0) read(r5, &(0x7f0000000800), 0xa) write(r4, &(0x7f0000005c00)="2700000014000707030e0000120f0a0011000100f5fe0012ff000000078a151f75080039000500", 0x27) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bond0\x00'}) socket$nl_generic(0x10, 0x3, 0x10) syz_open_dev$tty20(0xc, 0x4, 0x1) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) madvise(&(0x7f0000bc0000/0x400000)=nil, 0x600000, 0x9) ptrace$ARCH_SHSTK_UNLOCK(0x1e, r0, 0x0, 0x5004) bpf$PROG_LOAD(0x5, 0x0, 0x0) syz_clone3(&(0x7f000000c340)={0xa802100, 0x0, 0x0, 0x0, {0x2e}, 0x0, 0x0, 0x0, 0x0}, 0x58) 1m36.774619496s ago: executing program 9 (id=6582): mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) r0 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000776000/0x4000)=nil, 0x5000) shmctl$IPC_RMID(r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x18, 0x1, 0x2, 0x301, 0x0, 0x0, {0x6, 0x0, 0x6}, [@CTA_EXPECT_MASTER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40080}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB], 0xd) connect$unix(r2, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x0, 0xc000) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x7, 0x10, 0x3, 0x0, {{0x6, 0x4, 0x1, 0x9, 0x18, 0x66, 0x0, 0x4, 0x0, 0x0, @multicast2, @multicast2, {[@noop]}}}}}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xd) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x2, 0x4, 0xff, 0x1, 0x100}, 0x49) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x2, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0xce}}}, &(0x7f0000001540)='GPL\x00', 0x4}, 0x94) 1m21.5731044s ago: executing program 41 (id=6582): mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) r0 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000776000/0x4000)=nil, 0x5000) shmctl$IPC_RMID(r0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x18, 0x1, 0x2, 0x301, 0x0, 0x0, {0x6, 0x0, 0x6}, [@CTA_EXPECT_MASTER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40080}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB], 0xd) connect$unix(r2, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x0, 0xc000) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x7, 0x10, 0x3, 0x0, {{0x6, 0x4, 0x1, 0x9, 0x18, 0x66, 0x0, 0x4, 0x0, 0x0, @multicast2, @multicast2, {[@noop]}}}}}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xd) r4 = dup(r3) write$6lowpan_enable(r4, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) r5 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x2, 0x4, 0xff, 0x1, 0x100}, 0x49) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x2, 0x0, r5}, {}, {}, {0x85, 0x0, 0x0, 0xce}}}, &(0x7f0000001540)='GPL\x00', 0x4}, 0x94) 6.4599779s ago: executing program 2 (id=7068): mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) r0 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000776000/0x4000)=nil, 0x5000) shmctl$IPC_RMID(r0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x18, 0x1, 0x2, 0x301, 0x0, 0x0, {0x6, 0x0, 0x6}, [@CTA_EXPECT_MASTER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40080}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB], 0xd) connect$unix(r2, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x0, 0xc000) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x7, 0x10, 0x3, 0x0, {{0x6, 0x4, 0x1, 0x9, 0x18, 0x66, 0x0, 0x4, 0x0, 0x0, @multicast2, @multicast2, {[@noop]}}}}}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xd) r5 = dup(r3) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x2, 0x4, 0xff, 0x1, 0x100}, 0x49) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x2, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0xce}}}, &(0x7f0000001540)='GPL\x00', 0x4}, 0x94) 5.869325975s ago: executing program 2 (id=7071): r0 = landlock_create_ruleset(&(0x7f0000000000)={0x10, 0x0, 0x3}, 0x18, 0x0) readv(r0, &(0x7f0000000140)=[{&(0x7f0000000480)=""/211, 0xd3}], 0x1) r1 = socket$inet_udp(0x2, 0x2, 0x0) syz_usb_connect(0x3, 0x24, &(0x7f00000042c0)={{0x12, 0x1, 0x300, 0x3f, 0x84, 0x97, 0x40, 0xb57, 0x9de3, 0x87f6, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0xe4, 0x0, 0x20, 0xd, "", [{{0x9, 0x4, 0x56, 0x1, 0x0, 0x3, 0x1, 0x2, 0x9}}]}}]}}, &(0x7f0000004cc0)={0x0, 0x0, 0x0, 0x0}) setsockopt$sock_int(r1, 0x1, 0xf, &(0x7f0000000000)=0x100002b3, 0x4) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e20, @empty}, 0x10) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000000)=0x100000b3, 0x4) prlimit64(0x0, 0xe, 0x0, 0x0) socketpair$unix(0x1, 0x2, 0x0, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) r4 = openat(0xffffffffffffff9c, &(0x7f00000002c0)='./file2\x00', 0x42, 0x0) pwrite64(r4, &(0x7f00000000c0)='a', 0x200000c1, 0x9000) lseek(r4, 0x5, 0x4) write$FUSE_DIRENTPLUS(r4, 0x0, 0x10) sendmsg$NFT_BATCH(r3, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={0x0}}, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) setresuid(0xffffffffffffffff, 0xee00, 0xffffffffffffffff) prlimit64(0x0, 0xd, &(0x7f0000000340)={0xcf44, 0xfffffffffffffff7}, 0x0) semget(0x1, 0x3, 0x2) r5 = openat$btrfs_control(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f00000004c0)={'vxcan0\x00', 0x0}) sendmsg$nl_route(r5, &(0x7f00000005c0)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000580)={&(0x7f0000000500)=@ipv6_newaddrlabel={0x5c, 0x48, 0xec3567ed724bdc4d, 0x70bd2d, 0x25dfdbfe, {0xa, 0x0, 0x40, 0x0, r6, 0xfffff001}, [@IFAL_LABEL={0x8, 0x2, 0x1}, @IFAL_LABEL={0x8}, @IFAL_ADDRESS={0x14, 0x1, @private0}, @IFAL_ADDRESS={0x14, 0x1, @remote}, @IFAL_LABEL={0x8, 0x2, 0x7}]}, 0x5c}, 0x1, 0x0, 0x0, 0x10}, 0x8081) stat(&(0x7f0000000080)='./file0\x00', 0x0) getresgid(&(0x7f00000001c0), &(0x7f0000000200), &(0x7f0000000240)) stat(&(0x7f0000000280)='./file0\x00', &(0x7f00000002c0)) r7 = io_uring_setup(0x1020, &(0x7f00000000c0)={0x0, 0x6a0d, 0x3000, 0x1, 0x387}) io_uring_register$IORING_REGISTER_RESIZE_RINGS(r7, 0x21, 0x0, 0x1) 5.643568623s ago: executing program 8 (id=7073): r0 = openat$audio(0xffffffffffffff9c, &(0x7f0000000180), 0x109842, 0x0) r1 = socket$l2tp6(0xa, 0x2, 0x73) r2 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_udp(0x2, 0x2, 0x0) r5 = openat$btrfs_control(0xffffff9c, 0x0, 0x108400, 0x0) getsockname$packet(r5, 0x0, 0x0) openat(0xffffffffffffffff, &(0x7f0000000100)='.\x00', 0x515401, 0x408) pipe(&(0x7f0000000600)={0xffffffffffffffff, 0xffffffffffffffff}) io_setup(0x3ff, &(0x7f0000000500)=0x0) io_submit(r8, 0xf000, &(0x7f0000000300)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x5, 0x0, r7, 0x0}, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x1, 0x0, r7, &(0x7f00000001c0)='m', 0xffffff4c}]) r9 = syz_open_dev$dri(&(0x7f0000000040), 0x9, 0x40040) ioctl$DRM_IOCTL_SYNCOBJ_FD_TO_HANDLE_SYNC_FILE(r6, 0xc01864c2, &(0x7f0000000080)={0x0, 0x1, r7}) ioctl$DRM_IOCTL_SYNCOBJ_HANDLE_TO_FD_SYNC_FILE(r9, 0xc01864c1, &(0x7f0000000140)={r10}) ioctl$DRM_IOCTL_SYNCOBJ_DESTROY(0xffffffffffffffff, 0xc00864c0, &(0x7f0000000040)={r10}) bpf$MAP_GET_NEXT_KEY(0x4, &(0x7f00000001c0)={0xffffffffffffffff, 0x0, 0x0}, 0x20) mprotect(&(0x7f0000ff9000/0x4000)=nil, 0x200000, 0x2) bind$l2tp6(r1, &(0x7f0000000000)={0xa, 0x0, 0x1, @empty, 0x0, 0x2}, 0x20) connect$l2tp6(r1, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) ioctl$SNDCTL_DSP_GETOPTR(r0, 0x800c5012, &(0x7f0000000440)) sendmmsg$inet6(r1, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) socketpair$unix(0x1, 0x2, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r12, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r11, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r13, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f00000002c0)=ANY=[@ANYBLOB="1c0000000406010800000000000000060a0000050500010007000000"], 0x1c}, 0x1, 0x0, 0x0, 0x4002}, 0x24000000) 3.920188361s ago: executing program 8 (id=7079): mkdir(&(0x7f00000004c0)='./bus\x00', 0x0) r0 = shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmat(r0, &(0x7f0000776000/0x4000)=nil, 0x5000) shmctl$IPC_RMID(r0, 0x0) prlimit64(0x0, 0xe, 0x0, 0x0) getpid() mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_EXP_GET(r1, &(0x7f0000000600)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000003c0)={0x18, 0x1, 0x2, 0x301, 0x0, 0x0, {0x6, 0x0, 0x6}, [@CTA_EXPECT_MASTER={0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x40080}, 0x10) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000300)={0xffffffffffffffff, 0xffffffffffffffff}) syz_emit_vhci(&(0x7f0000000040)=ANY=[@ANYBLOB], 0xd) connect$unix(r2, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x0, 0xc000) bind$inet(0xffffffffffffffff, 0x0, 0x0) socket$igmp6(0xa, 0x3, 0x2) r3 = openat$ptmx(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) bind$alg(0xffffffffffffffff, &(0x7f0000000600)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb(blowfish)\x00'}, 0x58) r4 = accept4(0xffffffffffffffff, 0x0, 0x0, 0x0) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000000240)={'tunl0\x00', &(0x7f0000000180)={'syztnl2\x00', 0x0, 0x7, 0x10, 0x3, 0x0, {{0x6, 0x4, 0x1, 0x9, 0x18, 0x66, 0x0, 0x4, 0x0, 0x0, @multicast2, @multicast2, {[@noop]}}}}}) ioctl$TIOCSETD(r3, 0x5423, &(0x7f0000000040)=0xd) r5 = dup(r3) write$6lowpan_enable(r5, &(0x7f0000000000)='0', 0xfffffd2c) ioctl$TIOCVHANGUP(r3, 0x5437, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000040)={0x0}, 0x1, 0x0, 0x0, 0xc0}, 0x20000000) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=@base={0x2, 0x4, 0xff, 0x1, 0x100}, 0x49) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000000)={0x6, 0xf, &(0x7f00000000c0)=@ringbuf={{}, {{0x18, 0x1, 0x2, 0x0, r6}, {}, {}, {0x85, 0x0, 0x0, 0xce}}}, &(0x7f0000001540)='GPL\x00', 0x4}, 0x94) 3.551988316s ago: executing program 2 (id=7082): unshare(0x6a040000) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x1, 0x3) getsockopt$bt_BT_DEFER_SETUP(r0, 0x112, 0x7, 0x0, &(0x7f00000000c0)) r1 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_TX_RING(r1, 0x10e, 0xc, &(0x7f0000000040)={0x8604}, 0x10) r2 = openat$cachefiles(0xffffff9c, &(0x7f0000000080), 0x284100, 0x0) sendmsg$nl_route(r2, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000180)=@mpls_getroute={0x1c, 0x1a, 0x200, 0x70bd25, 0x0, {0x1c, 0x14, 0x0, 0x4, 0xfd, 0x4, 0x0, 0x0, 0x2000}}, 0x1c}, 0x1, 0x0, 0x0, 0x24000004}, 0x400c980) socket$l2tp(0x2, 0x2, 0x73) r3 = fsopen(&(0x7f00000001c0)='bpf\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x1, 0x0) fchdir(r4) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = bpf$BPF_LINK_CREATE_XDP(0x1c, 0x0, 0x0) r6 = dup(r5) r7 = socket$nl_route(0x10, 0x3, 0x0) getsockopt$sock_buf(r7, 0x1, 0x9, &(0x7f0000000480)=""/168, &(0x7f0000000180)=0xa8) bpf$OBJ_PIN_MAP(0x6, &(0x7f00000000c0)=@generic={&(0x7f0000000040)='./file0\x00', r6}, 0x18) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) bpf$OBJ_GET_MAP(0x7, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x3, 0x5, &(0x7f00000003c0)=ANY=[@ANYBLOB="18020000092700000000000001000000850000009a00000077510800000000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0xc, 0x0, 0x0, 0x1e00}, 0x94) mkdirat(r6, &(0x7f0000000240)='\x00', 0x2a) mkdirat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x1c0) r8 = openat$dir(0xffffffffffffff9c, &(0x7f0000000100)='./file1\x00', 0x2100, 0x0) unlinkat(0xffffffffffffffff, &(0x7f00000002c0)='./file1\x00', 0x200) fchdir(r8) creat(&(0x7f0000000140)='./file1\x00', 0x57) socket(0x29, 0x80000, 0x7) mount$tmpfs(0x0, &(0x7f0000001880)='.\x00', &(0x7f00000018c0), 0x1, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) 3.465185451s ago: executing program 8 (id=7083): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2}, &(0x7f0000000300)=0x0) fcntl$lock(0xffffffffffffffff, 0x24, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(r0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e21, @multicast2}, 0x10) connect$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @empty}, 0x10) setsockopt$inet_tcp_int(r1, 0x6, 0x19, &(0x7f00000000c0)=0x3, 0x4) sendmmsg$sock(r1, &(0x7f00000031c0)=[{{0x0, 0x0, &(0x7f0000002580)}}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f0000002780)=',', 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000002a40)="78a1674706", 0x5}], 0x1}}, {{0x0, 0x0, &(0x7f0000002fc0)=[{&(0x7f0000002bc0)="ff", 0x1}], 0x1}}, {{0x0, 0x0, &(0x7f0000003140)}}], 0x5, 0x4044800) mmap(&(0x7f0000000000/0x200000)=nil, 0x200000, 0x300000b, 0x204031, 0xffffffffffffffff, 0x42795000) prctl$PR_SET_MM(0x23, 0x7, &(0x7f0000ffd000/0x3000)=nil) brk(0x5ede6002) mmap$xdp(&(0x7f0000800000/0x800000)=nil, 0x800006, 0x7000001, 0x6e073, 0xffffffffffffffff, 0x0) r2 = socket$nl_sock_diag(0x10, 0x3, 0x4) mknod$loop(&(0x7f00000002c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x100, 0x0) r3 = openat$nvram(0xffffffffffffff9c, &(0x7f0000000080), 0x101080, 0x0) preadv(r3, &(0x7f0000001400)=[{&(0x7f0000000180)=""/147, 0x93}], 0x1, 0x1, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2002, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x40, 0x7, &(0x7f0000006680)) mkdirat(r3, &(0x7f0000000080)='./file0\x00', 0x1fe) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_SREGS(r6, 0x4138ae84, 0x0) r7 = open(&(0x7f0000000100)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', 0x0, 0x11) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) fcntl$lock(r7, 0x410, &(0x7f00000000c0)={0x1, 0x1, 0x6, 0xfffe}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x100010, r7, 0xa9525000) link(&(0x7f0000000600)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00', &(0x7f00000004c0)='./file0aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\x00') ioprio_set$pid(0x0, 0x0, 0x2007) close_range(r2, 0xffffffffffffffff, 0x0) 2.99855825s ago: executing program 2 (id=7084): socket$nl_netfilter(0x10, 0x3, 0xc) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x2) r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000001b40), 0x20341, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000040)) ioctl$TCSETSF2(r0, 0x402c542d, &(0x7f0000000000)={0x3, 0x407, 0x8, 0x801003e, 0x80, '\v\b\x00', 0x9, 0xfffffff5}) r1 = ioctl$TIOCGPTPEER(r0, 0x5441, 0x12) dup(r1) r2 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0xc11f) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r2, 0x4010640d, 0x0) r3 = openat$nullb(0xffffffffffffff9c, &(0x7f00000000c0), 0x4000000145802, 0x0) syz_open_dev$usbfs(0x0, 0x76, 0x103381) mprotect(&(0x7f0000000000/0x1000)=nil, 0x1000, 0x1) r4 = socket(0x2c, 0x803, 0xffffffff) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f1, &(0x7f0000005b80)={'ip6gre0\x00', 0x0}) r5 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace$cont(0x21, r5, 0x8, 0xffff) r6 = dup(r3) ioctl$SNDRV_CTL_IOCTL_ELEM_ADD(r6, 0xc1105517, &(0x7f0000000480)={{0x6, 0x6, 0x4a7, 0x6, 'syz1\x00', 0x6}, 0x5, 0x3, 0xb4, r5, 0x0, 0x3, 'syz1\x00', &(0x7f0000000180)}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r6, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) write$binfmt_aout(r6, 0x0, 0xffffffdb) timer_create(0x0, 0x0, 0x0) mprotect(&(0x7f000088f000/0x3000)=nil, 0x3000, 0x0) setpriority(0x2, 0x0, 0x8) socket$pppoe(0x18, 0x1, 0x0) ioctl$VHOST_VSOCK_SET_RUNNING(0xffffffffffffffff, 0x4004af61, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x64) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) 2.351480771s ago: executing program 4 (id=7089): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1, 0x8}, 0x52) r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x0) readv(r0, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) 2.309582672s ago: executing program 4 (id=7091): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=@bridge_delvlan={0x28, 0x56, 0x1, 0x0, 0x0, {}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x0, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8}}}]}, 0x28}}, 0x0) r2 = openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x220000, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'ni_atmio16d\x00', [0x9, 0x8, 0x6, 0x1, 0x7, 0xf, 0x1, 0x9, 0xc, 0xffff8001, 0x6, 0x1, 0x2, 0x7, 0x1, 0x6, 0x49f, 0xb1, 0x3ff, 0xa77d, 0x7, 0x9c8, 0xa0000000, 0x8, 0x5f000, 0x1, 0x7fffffff, 0x2, 0x7, 0x1, 0x0, 0x6]}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e06f40908"], 0xa) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000580)) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000001080)='./proc_dir\x00', &(0x7f00000010c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./proc_dir/acpi/wakeup\x00', 0x0, 0x0) write$uinput_user_dev(r3, &(0x7f0000000ec0)={'syz1\x00', {0x0, 0x0, 0xfffc}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x40000000, 0xfeffffff, 0x0, 0x0, 0xfffffffc, 0x1, 0x0, 0x4, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fff, 0x3, 0x80000000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x5, 0x4, 0x7fffffff, 0x0, 0x2000, 0xfffffffc, 0x0, 0x8, 0x0, 0x20000, 0xfffffffc, 0xfffffffc, 0x40000000, 0x0, 0xfffffffc, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0, 0x2], [0x0, 0x1, 0x2, 0xb16, 0x4000000, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0xaaf, 0x7, 0x0, 0x0, 0x4, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x200, 0x0, 0x2, 0x8, 0x1000, 0x0, 0xf, 0x1, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x0, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x7, 0x0, 0x0, 0x0, 0x800, 0x5, 0xfffffffe, 0x0, 0xf, 0x0, 0xd], [0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2b439038, 0x0, 0x9, 0x0, 0x4dc, 0x20000, 0xfffffffd, 0x2, 0xe, 0x1, 0x0, 0x0, 0xffffffff, 0x9, 0x0, 0x0, 0x0, 0x9, 0x8, 0x2, 0x2, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0xad1, 0x0, 0x0, 0x4, 0x80, 0x8, 0x0, 0x0, 0x0, 0x5, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x3, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x200, 0x0, 0x0, 0x0, 0x0, 0xfffff402, 0x5, 0x0, 0x0, 0x800, 0x0, 0x40002, 0x2, 0x20000000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4, 0x2, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x80000001, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x20, &(0x7f0000fee000), 0x4) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write(r6, &(0x7f0000000400)='./my_', 0x5) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)={0x18, 0x2f, 0x9, 0x70bd28, 0x1, {0x4}, [@nested={0x4, 0xd}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r8, 0x84, 0x76, 0x0, 0x0) mremap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f000000b000/0x1000)=nil) sendmsg$key(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)={0x2, 0x6, 0x7, 0x4, 0x21, 0x0, 0x70bd2c, 0x25dfdbfe, [@sadb_spirange={0x2, 0x10, 0x4d5, 0x4d4}, @sadb_x_sa2={0x2, 0x13, 0x3, 0x0, 0x0, 0x70bd2b, 0x3503}, @sadb_sa={0x2, 0x1, 0x4d2, 0x58, 0x81, 0x9d, 0x2, 0x80000000}, @sadb_x_filter={0x5, 0x1a, @in6=@rand_addr=' \x01\x00', @in=@broadcast, 0x2c, 0x4, 0x4}, @sadb_ident={0x2, 0xa, 0xbfe2, 0x0, 0x4b9e}, @sadb_sa={0x2, 0x1, 0x4d3, 0x2, 0x20, 0x1e, 0x4, 0x20000000}, @sadb_x_filter={0x5, 0x1a, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private0, 0x10, 0x20, 0x26}, @sadb_x_nat_t_type={0x1, 0x14, 0xfb}, @sadb_spirange={0x2, 0x10, 0x4d3, 0x4d4}, @sadb_x_policy={0x8, 0x12, 0x3, 0x2, 0x0, 0x6e6bbb, 0x3, {0x6, 0xff, 0x3a, 0x3, 0x0, 0x1, 0x0, @in=@private=0xa010100, @in=@dev={0xac, 0x14, 0x14, 0x18}}}]}, 0x108}}, 0x40010) write$uinput_user_dev(r3, &(0x7f0000000a40)={'syz0\x00', {0x0, 0x0, 0x0, 0x1f}, 0x4d, [0x1ff, 0xfffffffc, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x865, 0x0, 0x0, 0x0, 0x80, 0x4001, 0x0, 0x2, 0xfffffe00, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x7ff, 0xfffffffd, 0x0, 0x4, 0x0, 0x0, 0x27, 0x0, 0xfffffffd, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x1, 0x0, 0x401, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4], [0x2, 0x3, 0x10000002, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x800, 0x9262, 0x4, 0x8000000, 0x0, 0x0, 0x4, 0xffffffff, 0x400000, 0x1, 0x5, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x1000, 0x401c, 0x0, 0x0, 0x0, 0x4, 0xfffffffb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0xb, 0x0, 0x200, 0xfd5], [0x0, 0xfffffff9, 0x0, 0x20000002, 0x0, 0x5, 0x0, 0x0, 0xffffffff, 0x0, 0xfffffffe, 0x800, 0x4, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x80000, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8000000, 0x3514b2c0, 0x0, 0x6, 0x0, 0x3, 0x1000, 0x82, 0xffffffff, 0x0, 0x4, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x100, 0x0, 0x6, 0x6, 0x0, 0x4], [0x81, 0x5, 0x5d30, 0x1, 0x0, 0x100000, 0xdbc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x6, 0x8, 0x0, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x4, 0x3, 0x0, 0x0, 0x2, 0x0, 0xff, 0x0, 0x0, 0x0, 0xe58b, 0xfffffff9, 0x0, 0x3, 0x0, 0x4, 0x1ff]}, 0x45c) 2.009377313s ago: executing program 4 (id=7092): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="2d000000010001", 0x7) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000001) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) write(r2, &(0x7f0000000040)="05000000010000", 0x7) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) bind$xdp(r4, &(0x7f0000000240)={0x2c, 0x1, r5}, 0x10) r6 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r6, 0xe) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x3f00000000000000) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl816\x00', [0x140, 0x2, 0x3, 0x2, 0xff, 0x10000, 0x7ffd, 0x6, 0x3, 0xc72d, 0x4, 0x10, 0xf8, 0x8, 0x4ce, 0x9e9c, 0x104, 0x401, 0x6, 0x8, 0x4, 0x0, 0xa, 0x9, 0xff9, 0x200000, 0xaf, 0x0, 0x7, 0x0, 0x4]}) 1.833700506s ago: executing program 2 (id=7093): openat$ublk_ctrl(0xffffffffffffff9c, 0x0, 0x2, 0x0) mremap(&(0x7f00007b3000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000394000/0x4000)=nil) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, 0x0) r0 = getpid() sched_setscheduler(r0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f00000003c0)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f00000000c0), 0x10119, 0x2, 0x0) socket(0x25, 0x801, 0x7) r3 = openat$binderfs(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$BINDER_WRITE_READ(r3, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000180)=[@acquire], 0xffffffffffffff47, 0x0, 0x0}) 1.633132584s ago: executing program 1 (id=7094): r0 = openat$sndtimer(0xffffff9c, &(0x7f0000000000), 0x101) ioctl$SNDRV_TIMER_IOCTL_GSTATUS(r0, 0xc0405405, &(0x7f0000000040)={{0x0, 0x0, 0x6, 0x2, 0x7f}, 0x0, 0x6, 0xff000000}) (async) ioctl$EXT4_IOC_ALLOC_DA_BLKS(r0, 0x660c) (async) r1 = accept4$bt_l2cap(0xffffffffffffffff, 0x0, &(0x7f0000000080), 0x80000) (async) ioctl$UBLK_U_CMD_START_DEV(0xffffffffffffffff, 0xc0207506, &(0x7f00000000c0)={0x0, 0xffff, 0x0, 0x0, 0x0}) ioctl$sock_SIOCSPGRP(r1, 0x8902, &(0x7f0000000140)=r2) (async) r3 = creat(&(0x7f0000000180)='./file0\x00', 0x0) ioctl$UBLK_U_CMD_ADD_DEV(r3, 0xc0207504, &(0x7f0000000200)={0xffffffff, 0xffff, 0x40, &(0x7f00000001c0)=@new_dev={0x3, 0x9e7, 0x0, 0x0, 0x1000, 0xffffffff, r2, 0x0, 0x4}}) (async) ioctl$ifreq_SIOCGIFINDEX_vcan(r1, 0x8933, &(0x7f0000000280)={'vxcan1\x00', 0x0}) connect$can_bcm(r3, &(0x7f00000002c0)={0x1d, r4}, 0x10) (async, rerun: 64) setsockopt$bt_l2cap_L2CAP_CONNINFO(r1, 0x6, 0x2, &(0x7f0000000300)={0x3c7, "3e9caa"}, 0x6) (async, rerun: 64) setsockopt$inet_sctp6_SCTP_HMAC_IDENT(r3, 0x84, 0x16, &(0x7f0000000340)={0x3, [0x3, 0x8a, 0x7f]}, 0xa) (async) ioctl$sock_inet6_SIOCADDRT(r3, 0x890b, &(0x7f0000000380)={@private0, @remote, @local, 0x0, 0x0, 0x7, 0x480, 0x7, 0x100, r4}) (async, rerun: 64) socket$xdp(0x2c, 0x3, 0x0) (async, rerun: 64) getsockopt$inet_sctp6_SCTP_GET_LOCAL_ADDRS(r3, 0x84, 0x6d, &(0x7f0000000400)={0x0, 0x39, "1591aab130ad7d9be54413de2965f864ab080016d50dd798af373ec544d269e0e8be4ee04358ef4f51ca8e06bce28794e3e800431d0d28aac4"}, &(0x7f0000000480)=0x41) getsockopt$inet_sctp_SCTP_SOCKOPT_PEELOFF(r3, 0x84, 0x66, &(0x7f00000004c0)={r5, 0x8}, &(0x7f0000000500)=0x8) (async) setsockopt$inet6_group_source_req(r3, 0x29, 0x2f, &(0x7f0000000540)={0x9, {{0xa, 0x4e21, 0xd66, @ipv4={'\x00', '\xff\xff', @local}, 0x1fbc}}, {{0xa, 0x4e22, 0x7, @mcast2, 0xff}}}, 0x104) ioctl$AUTOFS_DEV_IOCTL_SETPIPEFD(r3, 0xc0189378, &(0x7f0000000680)={{0x1, 0x1, 0x18, r1, {r3}}, './file0\x00'}) getpeername$packet(r7, &(0x7f00000006c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f0000000700)=0x14) (async) truncate(&(0x7f0000000740)='./file0\x00', 0xf76b) (async) r8 = syz_genetlink_get_family_id$nl80211(&(0x7f00000007c0), r3) sendmsg$NL80211_CMD_AUTHENTICATE(r7, &(0x7f00000008c0)={&(0x7f0000000780)={0x10, 0x0, 0x0, 0x20}, 0xc, &(0x7f0000000880)={&(0x7f0000000800)={0x5c, r8, 0x800, 0x70bd26, 0x25dfdbfe, {{}, {@val={0x8}, @val={0xc, 0x99, {0x6, 0x12}}}}, [@key_params=[@NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}], @NL80211_ATTR_AUTH_TYPE={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x5}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ1={0x8, 0xa0, 0xfffffffc}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x7}]]}, 0x5c}, 0x1, 0x0, 0x0, 0x20000000}, 0x40801) (async) ioctl$VFAT_IOCTL_READDIR_SHORT(r3, 0x82187202, &(0x7f0000000900)=[{0x0, 0x0, 0x100}, {0x0, 0x0, 0x100}]) (async) mmap$IORING_OFF_SQ_RING(0x0, 0xf565, 0xa, 0x1010, 0xffffffffffffffff, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000b40)={'veth0_virt_wifi\x00'}) (async, rerun: 32) setsockopt$bt_l2cap_L2CAP_OPTIONS(r1, 0x6, 0x1, &(0x7f0000000b80)={0x9d96, 0x1, 0x7c, 0x80, 0xe5, 0x0, 0x6}, 0xc) (async, rerun: 32) r9 = mmap$IORING_MAP_OFF_PARAM_REGION(0x0, 0x10000, 0x1000004, 0x810, r7, 0x20000000) (async) syz_ublk_setup_queues(r3, 0x0, &(0x7f0000000bc0)={0x0, 0xa07a, 0x20, 0x2, 0xd6, 0x0, r6}, &(0x7f0000000c40)=[{0x0, 0x0, 0xffffffffffffffff, {0x0, 0x63db, 0x800, 0x0, 0x161, 0x0, r6}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xfed9, 0x4028, 0x3, 0x272, 0x0, r7}}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0x7aa1, 0x80, 0x2, 0x118, 0x0, r6}, 0xffffffffffffffff, 0x0, 0x0}, {0x0, 0x0, 0xffffffffffffffff, {0x0, 0xe033, 0x10, 0x2, 0x3b1}}], 0x4, &(0x7f0000001ec0)={0x2e, 0x43, 0x0, r6, 0xc0107520, 0x0, 0x0, 0x0, 0x0, {0x5}, 0x0, 0x0, '\x00', {0x2, 0xe91, 0x0, &(0x7f0000000ec0)=@buf_512="8759ab0d40bf06736ecbaf98a5c83a24273220a49d8cda3816a1fb5cbedc56f24a2a02d6f197b4997ae06766a25f9dc1174cb1552d9e4bb59c427cff9bbfce12dea05f008f9f07a1ff26be25aeb3429b2149d528a6928ab382708e4b39f7153e36eaebd32cbb268f8024507cbbb2827ab7a5cf0ab1e98a5ad6232f6375131886afb506b83b2c7978aeaaf0b1485b3bc83206264f0878f1e8f4d8ec2c3f28da2f677886d8667696c0357326bc78da96417cebf7b21a221e3361e6c4f3dd61f48bcdfe128d9840d144423e58f4266815ca376e8b2e9817bec45ce6eb15e9695202a8116b665bab1131e47a284e3f191495df6b810a8f78d3b44a56b6f5906b016a0d64d961a13094420af886c9bb5f681569c077a5f5639670b26962611cee60941a056ac64d36fbb2eed490810901cf56909234a5b903e410d2cc4d5e557c62ef8a07da71adf63fa76a6a74b77eb92bfa3f1baa08402d93db0b83accf647cf92a5520178c47311f038f9ae003ad660057d16fbb21664d711cce899f56254599bcf8350bf239e3c80c7f74da97980666dfebec4297308785428b8dee08132a948bf414badb981da935d447c5c3bf3905373c97d3ddd245f4fced8e39d6ed7556f3fb8115c65de3a6ceb026abff3abd26a8c93fd3666ad196e272947fd7e142c0f0745fb0ce2edc8a323da883f9b8d314d9432709edecd5f4409530f6c519734a35"}}, &(0x7f0000001f40)) syz_io_uring_complete(r9, r10) setsockopt$EBT_SO_SET_COUNTERS(r3, 0x0, 0x81, &(0x7f0000001fc0)={'nat\x00', 0x0, 0x0, 0x0, [0x3, 0xffffffff, 0x81, 0x9, 0x6, 0xa], 0x2, &(0x7f0000001f80)=[{}], 0x0, [{}, {}]}, 0x70) 1.564023305s ago: executing program 1 (id=7095): r0 = socket(0x10, 0x3, 0xc) write(r0, &(0x7f0000000040)="effd00001000ff00fd4344c007110000f3050a00dbfd010000000001ffdf00", 0xfe00) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r3, 0x4008ae89, &(0x7f0000003000)={0x1, 0x0, [{0x4d0, 0x0, 0x1ff}]}) ioctl$KVM_SET_MP_STATE(r3, 0x4004ae99, &(0x7f0000000040)=0x5) 1.503553582s ago: executing program 8 (id=7096): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="2d000000010001", 0x7) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000001) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) write(r2, &(0x7f0000000040)="05000000010000", 0x7) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00'}) bind$xdp(r4, 0x0, 0x0) r5 = landlock_create_ruleset(&(0x7f00000002c0)={0x7f6e}, 0x18, 0x0) landlock_restrict_self(r5, 0xe) r6 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r6, 0xffffffffffffffff, 0x3f00000000000000) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl816\x00', [0x140, 0x2, 0x3, 0x2, 0xff, 0x10000, 0x7ffd, 0x6, 0x3, 0xc72d, 0x4, 0x10, 0xf8, 0x8, 0x4ce, 0x9e9c, 0x104, 0x401, 0x6, 0x8, 0x4, 0x0, 0xa, 0x9, 0xff9, 0x200000, 0xaf, 0x0, 0x7, 0x0, 0x4]}) 1.097972235s ago: executing program 4 (id=7097): mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup/syz1\x00', 0x1ff) r0 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r1 = openat$cgroup_subtree(r0, &(0x7f0000000140), 0x2, 0x0) write$cgroup_subtree(r1, &(0x7f0000000300)=ANY=[@ANYBLOB='+p'], 0x6) r2 = socket$igmp(0x2, 0x3, 0x2) setsockopt$IPT_SO_SET_REPLACE(r2, 0x0, 0x40, &(0x7f0000000340)=@mangle={'mangle\x00', 0x1f, 0x6, 0x45c, 0x1d4, 0x1d4, 0x1d4, 0x268, 0x334, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x3c8, 0x6, &(0x7f0000000040), {[{{@uncond, 0x0, 0xd4, 0x104, 0x0, {}, [@common=@ah={{0x2c}, {[0x6, 0x8001]}}, @common=@unspec=@connbytes={{0x38}, {[{0x5}, {0x5}], 0x1}}]}, @TPROXY={0x30, 'TPROXY\x00', 0x0, {0x4317c145, 0x800, @multicast1, 0x4e24}}}, {{@uncond, 0x0, 0x94, 0xd0, 0x0, {}, [@inet=@rpfilter={{0x24}, {0x3}}]}, @inet=@TPROXY1={0x3c, 'TPROXY\x00', 0x1, {0x7, 0xa70, @ipv4=@loopback, 0x4e22}}}, {{@uncond, 0x0, 0x70, 0x94}, @common=@unspec=@NFQUEUE1={0x24, 'NFQUEUE\x00', 0x1, {0x6}}}, {{@ip={@empty, @private=0xa010101, 0xffffffff, 0xffffff00, 'pimreg0\x00', 'vlan1\x00', {0xff}, {}, 0x0, 0x1, 0x27}, 0x0, 0x90, 0xcc, 0x0, {}, [@common=@socket0={{0x20}}]}, @inet=@TPROXY1={0x3c, 'TPROXY\x00', 0x1, {0x7, 0x442, @ipv4=@initdev={0xac, 0x1e, 0x1, 0x0}, 0x4e24}}}, {{@ip={@dev={0xac, 0x14, 0x14, 0x2e}, @local, 0xffffff00, 0xff, 'wg1\x00', 'dummy0\x00', {0xff}, {0xff}, 0x0, 0x1, 0x22}, 0x0, 0x70, 0x94}, @TTL={0x24, 'TTL\x00', 0x0, {0x0, 0xb1}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x4b8) 1.077288832s ago: executing program 1 (id=7098): socket$inet6_tcp(0xa, 0x1, 0x0) bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000540)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xbf, &(0x7f0000000600)=""/191, 0x41100, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000829000/0x3000)=nil, 0x3000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socket$alg(0x26, 0x5, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e20}, 0x6e) landlock_restrict_self(0xffffffffffffffff, 0x1) r1 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r2 = dup(r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xa, 0x13, r2, 0x2000) mkdir(&(0x7f0000000400)='./file0\x00', 0x114) mount(0x0, &(0x7f0000000180)='./file0\x00', &(0x7f0000000080)='sysfs\x00', 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f00000000c0)='./bus\x00', 0x1d7) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x0, &(0x7f0000000400)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}]}) chdir(&(0x7f0000000000)='./bus\x00') madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) sync() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x94, 0x7fff0000}]}) 1.007837375s ago: executing program 4 (id=7099): setsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000180)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x02', 0x800, 0x0, 0x3, 0x1, 0x8}, 0x52) r0 = syz_open_dev$usbmon(&(0x7f0000000000), 0x6, 0x0) readv(r0, 0x0, 0x0) syz_open_dev$usbfs(&(0x7f0000000240), 0x10, 0x80100) 989.323935ms ago: executing program 8 (id=7100): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000005c0)={&(0x7f00000000c0)=@bridge_delvlan={0x28, 0x56, 0x1, 0x0, 0x0, {}, [@BRIDGE_VLANDB_ENTRY={0x10, 0x1, 0x0, 0x0, @BRIDGE_VLANDB_ENTRY_TUNNEL_INFO={0xc, 0x4, 0x0, 0x1, @BRIDGE_VLANDB_TINFO_CMD={0x8}}}]}, 0x28}}, 0x0) r2 = openat$comedi(0xffffff9c, &(0x7f0000000080)='/dev/comedi3\x00', 0x220000, 0x0) ioctl$COMEDI_DEVCONFIG(r2, 0x40946400, &(0x7f00000000c0)={'ni_atmio16d\x00', [0x9, 0x8, 0x6, 0x1, 0x7, 0xf, 0x1, 0x9, 0xc, 0xffff8001, 0x6, 0x1, 0x2, 0x7, 0x1, 0x6, 0x49f, 0xb1, 0x3ff, 0xa77d, 0x7, 0x9c8, 0xa0000000, 0x8, 0x5f000, 0x1, 0x7fffffff, 0x2, 0x7, 0x1, 0x0, 0x6]}) syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="040e06f40908"], 0xa) getsockopt$inet6_int(r0, 0x29, 0x18, 0x0, &(0x7f0000000580)) r3 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000001000)='./proc_dir\x00', 0x1ff) mount(0x0, &(0x7f0000001080)='./proc_dir\x00', &(0x7f00000010c0)='proc\x00', 0x0, 0x0) r4 = openat(0xffffffffffffff9c, &(0x7f0000001100)='./proc_dir/acpi/wakeup\x00', 0x0, 0x0) write$uinput_user_dev(r3, &(0x7f0000000ec0)={'syz1\x00', {0x0, 0x0, 0xfffc}, 0x0, [0x9faf, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x3, 0x0, 0x40000000, 0xfeffffff, 0x0, 0x0, 0xfffffffc, 0x1, 0x0, 0x4, 0x20000000, 0x0, 0x0, 0x0, 0x0, 0x8, 0x7fff, 0x3, 0x80000000, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x5, 0x4, 0x7fffffff, 0x0, 0x2000, 0xfffffffc, 0x0, 0x8, 0x0, 0x20000, 0xfffffffc, 0xfffffffc, 0x40000000, 0x0, 0xfffffffc, 0x0, 0xffffffff, 0xdc, 0xa, 0x0, 0x2d52c0, 0x2], [0x0, 0x1, 0x2, 0xb16, 0x4000000, 0xffffffcb, 0x0, 0x0, 0x0, 0x2000, 0xaaf, 0x7, 0x0, 0x0, 0x4, 0x4000000, 0x9, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x10, 0x0, 0x0, 0x200, 0x0, 0x2, 0x8, 0x1000, 0x0, 0xf, 0x1, 0x2000002, 0x0, 0x0, 0x0, 0xfffffffe, 0x20000100, 0x1, 0x0, 0x0, 0x66bd, 0x0, 0xfefffffd, 0x0, 0x8, 0xd77, 0x0, 0x0, 0xfffff37a, 0x0, 0x7, 0x0, 0x0, 0x0, 0x800, 0x5, 0xfffffffe, 0x0, 0xf, 0x0, 0xd], [0x8, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x2b439038, 0x0, 0x9, 0x0, 0x4dc, 0x20000, 0xfffffffd, 0x2, 0xe, 0x1, 0x0, 0x0, 0xffffffff, 0x9, 0x0, 0x0, 0x0, 0x9, 0x8, 0x2, 0x2, 0x0, 0xd12, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0xad1, 0x0, 0x0, 0x4, 0x80, 0x8, 0x0, 0x0, 0x0, 0x5, 0xfffffffe, 0x4], [0x0, 0xfffffffc, 0xfffffffc, 0xc, 0x6, 0x0, 0x7, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x7e, 0x0, 0x3, 0x2, 0x0, 0xe, 0x4000000, 0x3, 0x0, 0x8d, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0xfffeffff, 0x200, 0x0, 0x0, 0x0, 0x0, 0xfffff402, 0x5, 0x0, 0x0, 0x800, 0x0, 0x40002, 0x2, 0x20000000, 0x0, 0x6, 0x0, 0x0, 0x0, 0x4, 0x2, 0x0, 0x0, 0xfffffffd, 0x2, 0x0, 0x0, 0x0, 0x80000001, 0x5]}, 0x45c) ioctl$UI_DEV_CREATE(r3, 0x5501) r5 = socket$inet6(0xa, 0x5, 0x0) setsockopt$sock_int(r5, 0x1, 0x20, &(0x7f0000fee000), 0x4) mkdir(&(0x7f0000000000)='./my_configfs\x00', 0x1ff) mount(0x0, &(0x7f0000000000)='./my_configfs\x00', &(0x7f0000000100)='configfs\x00', 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000300)='./my_configfs/target/dbroot\x00', 0x1, 0x0) write(r6, &(0x7f0000000400)='./my_', 0x5) r7 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r7, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000400)={&(0x7f0000000080)={0x18, 0x2f, 0x9, 0x70bd28, 0x1, {0x4}, [@nested={0x4, 0xd}]}, 0x18}, 0x1, 0x0, 0x0, 0x42804}, 0x10) r8 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r8, 0x84, 0x76, 0x0, 0x0) mremap(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1000, 0x3, &(0x7f000000b000/0x1000)=nil) sendmsg$key(r4, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000440)={&(0x7f0000000300)={0x2, 0x6, 0x7, 0x4, 0x21, 0x0, 0x70bd2c, 0x25dfdbfe, [@sadb_spirange={0x2, 0x10, 0x4d5, 0x4d4}, @sadb_x_sa2={0x2, 0x13, 0x3, 0x0, 0x0, 0x70bd2b, 0x3503}, @sadb_sa={0x2, 0x1, 0x4d2, 0x58, 0x81, 0x9d, 0x2, 0x80000000}, @sadb_x_filter={0x5, 0x1a, @in6=@rand_addr=' \x01\x00', @in=@broadcast, 0x2c, 0x4, 0x4}, @sadb_ident={0x2, 0xa, 0xbfe2, 0x0, 0x4b9e}, @sadb_sa={0x2, 0x1, 0x4d3, 0x2, 0x20, 0x1e, 0x4, 0x20000000}, @sadb_x_filter={0x5, 0x1a, @in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in6=@private0, 0x10, 0x20, 0x26}, @sadb_x_nat_t_type={0x1, 0x14, 0xfb}, @sadb_spirange={0x2, 0x10, 0x4d3, 0x4d4}, @sadb_x_policy={0x8, 0x12, 0x3, 0x2, 0x0, 0x6e6bbb, 0x3, {0x6, 0xff, 0x3a, 0x3, 0x0, 0x1, 0x0, @in=@private=0xa010100, @in=@dev={0xac, 0x14, 0x14, 0x18}}}]}, 0x108}}, 0x40010) write$uinput_user_dev(r3, &(0x7f0000000a40)={'syz0\x00', {0x0, 0x0, 0x0, 0x1f}, 0x4d, [0x1ff, 0xfffffffc, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x4, 0x0, 0x865, 0x0, 0x0, 0x0, 0x80, 0x4001, 0x0, 0x2, 0xfffffe00, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x7ff, 0xfffffffd, 0x0, 0x4, 0x0, 0x0, 0x27, 0x0, 0xfffffffd, 0x0, 0x0, 0x800, 0x3, 0x0, 0x0, 0x1, 0x0, 0x401, 0x0, 0x0, 0xfffffffe, 0xffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x4], [0x2, 0x3, 0x10000002, 0x0, 0x0, 0x40000, 0x0, 0x0, 0x0, 0x800, 0x9262, 0x4, 0x8000000, 0x0, 0x0, 0x4, 0xffffffff, 0x400000, 0x1, 0x5, 0x0, 0x3, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x3, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000000, 0x1000, 0x401c, 0x0, 0x0, 0x0, 0x4, 0xfffffffb, 0x0, 0x0, 0x0, 0x2, 0x0, 0x3, 0x0, 0x0, 0xb, 0x0, 0x200, 0xfd5], [0x0, 0xfffffff9, 0x0, 0x20000002, 0x0, 0x5, 0x0, 0x0, 0xffffffff, 0x0, 0xfffffffe, 0x800, 0x4, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x80000, 0x0, 0x0, 0x2, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x3, 0x8000000, 0x3514b2c0, 0x0, 0x6, 0x0, 0x3, 0x1000, 0x82, 0xffffffff, 0x0, 0x4, 0x0, 0x7f, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x100, 0x0, 0x6, 0x6, 0x0, 0x4], [0x81, 0x5, 0x5d30, 0x1, 0x0, 0x100000, 0xdbc1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x6, 0x8, 0x0, 0xfffffffe, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xff, 0x0, 0x0, 0x8, 0x0, 0x2, 0x0, 0xd, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x4, 0x3, 0x0, 0x0, 0x2, 0x0, 0xff, 0x0, 0x0, 0x0, 0xe58b, 0xfffffff9, 0x0, 0x3, 0x0, 0x4, 0x1ff]}, 0x45c) 853.949046ms ago: executing program 4 (id=7101): ioctl$SNDRV_RAWMIDI_IOCTL_STATUS32(0xffffffffffffffff, 0xc0245720, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000440)={0x7, 0x3, &(0x7f0000000300)=ANY=[], 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x6}, 0x94) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=@newtaction={0xa4, 0x30, 0x1, 0x0, 0x0, {}, [{0x90, 0x1, [@m_ct={0x44, 0x2, 0x0, 0x0, {{0x7}, {0x1c, 0x2, 0x0, 0x1, [@TCA_CT_PARMS={0x18, 0x1, {0xe4b, 0x11e41e7a, 0x20000000, 0x3, 0xf}}]}, {0x4}, {0xc, 0x7, {0x0, 0x1}}, {0xc, 0x8, {0x0, 0x2}}}}, @m_ife={0x48, 0x1, 0x0, 0x0, {{0x8}, {0x20, 0x2, 0x0, 0x1, [@TCA_IFE_PARMS={0x1c, 0x1, {{0x0, 0x0, 0x10000000}}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x24c4436d5a174b6d, 0x2}}}}]}]}, 0xa4}, 0x1, 0x0, 0x0, 0x804}, 0x4004000) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000380)=0x34) r0 = socket$inet(0xa, 0x801, 0x84) connect$inet(r0, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r0, 0x8) r1 = accept4(r0, 0x0, 0x0, 0x0) sendto$inet6(r1, &(0x7f0000000040)='x', 0x1, 0x0, 0x0, 0x0) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f0000000140)={0x0, 0x3}, 0x8) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(r1, 0x84, 0x7b, &(0x7f00000001c0)={0x0, 0x4}, 0x8) r2 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x10000000000002) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r2, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = socket$netlink(0x10, 0x3, 0x4) r6 = syz_genetlink_get_family_id$tipc(&(0x7f0000000540), r5) sendmsg$TIPC_CMD_SHOW_PORTS(r5, &(0x7f0000000680)={&(0x7f0000000500)={0x10, 0x0, 0x0, 0x20000}, 0xc, &(0x7f00000005c0)={&(0x7f0000000580)={0x1c, r6, 0x300, 0x70bd26, 0x25dfdbfc, {}, ["", "", "", "", "", "", "", "", ""]}, 0x1c}, 0x1, 0x0, 0x0, 0x80}, 0x4000000) socket$igmp(0x2, 0x3, 0x2) syz_emit_vhci(&(0x7f0000000040)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_complete={{0xe, 0xc}, @hci_rp_le_read_supported_states={{0x3}, {0x40, "481a20001200"}}}}, 0xf) r7 = syz_open_dev$usbfs(&(0x7f0000000480), 0x76, 0x160341) ioctl$USBDEVFS_IOCTL(r7, 0xc0105512, &(0x7f0000000200)) r8 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r8, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000200)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x2c, 0x3, 0xa, 0x101, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x78, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x50, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8, 0x1, 0x1, 0x0, 0x1}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0x9}]}}}, {0x28, 0x1, 0x0, 0x1, @fwd={{0x8}, @val={0x1c, 0x2, 0x0, 0x1, [@NFTA_FWD_SREG_ADDR={0x8, 0x2, 0x1, 0x0, 0x17}, @NFTA_FWD_NFPROTO={0x8, 0x3, 0x1, 0x0, 0xa}, @NFTA_FWD_SREG_DEV={0x8, 0x1, 0x1, 0x0, 0x9}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz1\x00'}]}], {0x14}}, 0xec}, 0x1, 0x0, 0x0, 0x200000c1}, 0x0) 836.47785ms ago: executing program 8 (id=7102): mkdir(&(0x7f0000000000)='proc\x00', 0x1ff) mount(0x0, &(0x7f0000000200)='proc\x00', &(0x7f0000000300)='proc\x00', 0x0, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000240)=ANY=[@ANYBLOB="340000001100010027bd7000fddbdf", @ANYBLOB="20100000000004001400030076214d68305f766972745f7769666900"], 0x34}, 0x1, 0x0, 0x0, 0x801}, 0x4000000) openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000380)={0x8, 0x100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000200)=0x5) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x80200, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r1, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFULNL_MSG_CONFIG(r2, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000300)={0x1c, 0x1, 0x4, 0x101, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0x4}]}, 0x1c}, 0x1, 0x0, 0x0, 0x20000000}, 0x44010) socket$inet_udp(0x2, 0x2, 0x0) connect$unix(0xffffffffffffffff, 0x0, 0x0) r3 = socket$netlink(0x10, 0x3, 0x8000000004) r4 = syz_open_dev$video4linux(&(0x7f0000000080), 0x0, 0x0) ioctl$VIDIOC_QUERYMENU(r4, 0xc008561c, &(0x7f00000000c0)={0xf0f002, 0x2, @name="2a0bfa91762a67fc38beda01496988cd2bae0aa03dc5d7b06bef2d1e67d01e0c"}) writev(r3, &(0x7f0000000200)=[{&(0x7f00000000c0)="580000001500add427323b472545b4560a117fff0b0082001b59000d00ff0028925aa80020007b00090080000efffeffe809000000ff0000f03ac7100003ffffffffffffffffffffffe7ee0000000000000000020000", 0x56}, {&(0x7f00000001c0)="ee64", 0x2}], 0x2) sendmsg$key(0xffffffffffffffff, &(0x7f0000000140)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f0000000240)=ANY=[@ANYBLOB="0207000902"], 0x10}}, 0x0) syz_open_dev$radio(&(0x7f0000000080), 0x3, 0x2) r5 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) write(r5, &(0x7f0000000040)="05000000010001", 0x7) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) lseek(0xffffffffffffffff, 0x249f0, 0x0) 461.429284ms ago: executing program 1 (id=7103): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$team(&(0x7f0000000000), r0) r2 = socket$inet_udp(0x2, 0x2, 0x0) ioctl$ifreq_SIOCGIFINDEX_team(r2, 0x8933, &(0x7f0000000100)={'team0\x00', 0x0}) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000180)={'team_slave_1\x00', 0x0}) sendmsg$TEAM_CMD_OPTIONS_SET(r0, &(0x7f0000001200)={0x0, 0x0, &(0x7f0000001400)={&(0x7f00000001c0)=ANY=[@ANYBLOB="00000000985b4f4e2e32715209968f85928acf688c32e09effd164f59bf864d3015e18ae85eca2d486cb25aeabe6dce4a806b34ac9499866b18df215902fa973212877b98b302eaa04d1047e28e2", @ANYRES16=r1, @ANYRESOCT, @ANYRES32=r3, @ANYBLOB="4400028040000100240001007072696f72697479000000000000000000000000000000000000000000000000050003000e000000080004000a00000008000600", @ANYRES32=r4, @ANYBLOB], 0x60}}, 0x0) 313.570477ms ago: executing program 1 (id=7104): r0 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nfc(&(0x7f0000000a40), r1) sendmsg$NFC_CMD_START_POLL(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="1400711ec50000", @ANYRES16=r2, @ANYBLOB="010027bd7000fcdbdf2506000000"], 0x14}, 0x1, 0x0, 0x0, 0x800}, 0x4048008) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x100000, 0x1, &(0x7f0000006680)) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) (async) prlimit64(0x0, 0x6, &(0x7f0000000140), 0x0) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)={0x0}}, 0x0) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) r3 = getpid() r4 = syz_pidfd_open(r3, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f00000000c0)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41100, 0x6b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x39}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) (async) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r5 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) (async) sched_setscheduler(r5, 0x2, &(0x7f0000000200)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) (async) connect$unix(r6, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r7, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r5, 0x8, &(0x7f0000000240)=0x2) (async) sched_setaffinity(r5, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r6, &(0x7f00000000c0), 0x10106, 0x2, 0x0) pipe(&(0x7f0000000180)) (async) pipe(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}) connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x2, {{0x1, 0x1}}}, 0x10) (async) connect$tipc(0xffffffffffffffff, &(0x7f0000000000)=@name={0x1e, 0x2, 0x2, {{0x1, 0x1}}}, 0x10) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340), 0x2000011a) (async) write$binfmt_misc(0xffffffffffffffff, &(0x7f0000000340), 0x2000011a) splice(0xffffffffffffffff, 0x0, r8, 0x0, 0x4ff9c, 0x0) setns(r4, 0x24020000) (async) setns(r4, 0x24020000) syz_clone(0x1fa02000, 0x0, 0xfffffffffffffeab, 0x0, 0x0, 0x0) setreuid(0x0, 0x0) 194.091µs ago: executing program 2 (id=7105): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000080)={0x1f, 0xffffffffffffffff, 0x3}, 0x6) write(r0, &(0x7f0000000000)="2d000000010001", 0x7) r1 = openat$comedi(0xffffffffffffff9c, &(0x7f0000000080)='/dev/comedi2\x00', 0x1, 0x0) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000200), 0x400, 0x0) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000340)={0x1f, 0xffff, 0x3}, 0x6) sendmsg$kcm(0xffffffffffffffff, 0x0, 0x20000001) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) write(r2, &(0x7f0000000040)="05000000010000", 0x7) r3 = socket$inet_tcp(0x2, 0x1, 0x0) r4 = socket$xdp(0x2c, 0x3, 0x0) setsockopt$XDP_RX_RING(r4, 0x11b, 0x2, &(0x7f00000002c0)=0x100, 0x4) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r3, 0x8933, &(0x7f0000000080)={'batadv_slave_0\x00', 0x0}) bind$xdp(r4, &(0x7f0000000240)={0x2c, 0x1, r5}, 0x10) r6 = landlock_create_ruleset(0x0, 0x0, 0x0) landlock_restrict_self(r6, 0xe) r7 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fff7ffc}]}) close_range(r7, 0xffffffffffffffff, 0x3f00000000000000) ioctl$COMEDI_DEVCONFIG(r1, 0x40946400, &(0x7f00000003c0)={'pcl816\x00', [0x140, 0x2, 0x3, 0x2, 0xff, 0x10000, 0x7ffd, 0x6, 0x3, 0xc72d, 0x4, 0x10, 0xf8, 0x8, 0x4ce, 0x9e9c, 0x104, 0x401, 0x6, 0x8, 0x4, 0x0, 0xa, 0x9, 0xff9, 0x200000, 0xaf, 0x0, 0x7, 0x0, 0x4]}) 0s ago: executing program 1 (id=7106): mkdir(&(0x7f0000000140)='./config\x00', 0xdf) mount(0x0, &(0x7f0000000180)='./config\x00', &(0x7f00000001c0)='configfs\x00', 0x0, 0x0) r0 = openat(0xffffffffffffff9c, &(0x7f0000000340)='./config/usb_gadget/g1/functions/mass_storage.0/lun.0/file\x00', 0x2, 0x0) write(r0, &(0x7f0000000380)='fi', 0x2) kernel console output (not intermixed with test programs): rface 86 has no altsetting 0 [ 1611.402075][ T4805] usb 9-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1611.410896][ T4805] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1611.427387][ T4805] usb 9-1: Product: syz [ 1611.430287][ T4805] usb 9-1: Manufacturer: syz [ 1611.434286][ T4805] usb 9-1: SerialNumber: syz [ 1611.569485][ T7877] FAULT_INJECTION: forcing a failure. [ 1611.569485][ T7877] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1611.574983][ T7877] CPU: 0 UID: 0 PID: 7877 Comm: syz.9.6520 Tainted: G L syzkaller #0 PREEMPT(full) [ 1611.575003][ T7877] Tainted: [L]=SOFTLOCKUP [ 1611.575007][ T7877] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1611.575013][ T7877] Call Trace: [ 1611.575018][ T7877] [ 1611.575023][ T7877] dump_stack_lvl+0x100/0x190 [ 1611.575042][ T7877] should_fail_ex.cold+0x5/0xa [ 1611.575068][ T7877] _copy_from_user+0x2e/0xd0 [ 1611.575086][ T7877] kstrtouint_from_user+0xd6/0x1d0 [ 1611.575107][ T7877] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1611.575120][ T7877] ? __lock_acquire+0x49f/0x1a40 [ 1611.575145][ T7877] proc_fail_nth_write+0x83/0x220 [ 1611.575172][ T7877] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1611.575192][ T7877] vfs_write+0x2aa/0x1050 [ 1611.575204][ T7877] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1611.575220][ T7877] ? __pfx_vfs_write+0x10/0x10 [ 1611.575229][ T7877] ? find_held_lock+0x2b/0x80 [ 1611.575243][ T7877] ? __fget_files+0x215/0x3d0 [ 1611.575257][ T7877] ? __fget_files+0x21f/0x3d0 [ 1611.575271][ T7877] ksys_write+0x12a/0x250 [ 1611.575281][ T7877] ? __pfx_ksys_write+0x10/0x10 [ 1611.575296][ T7877] do_int80_emulation+0x14b/0x720 [ 1611.575313][ T7877] asm_int80_emulation+0x1a/0x20 [ 1611.575324][ T7877] RIP: 0023:0xf71c73eb [ 1611.575334][ T7877] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1611.575346][ T7877] RSP: 002b:00000000f54864bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 1611.575358][ T7877] RAX: ffffffffffffffda RBX: 0000000000000005 RCX: 00000000f54865d0 [ 1611.575365][ T7877] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1611.575372][ T7877] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1611.575378][ T7877] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1611.575384][ T7877] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1611.575398][ T7877] [ 1611.691306][ T4804] usb 14-1: USB disconnect, device number 15 [ 1611.944285][ T7910] netlink: 4 bytes leftover after parsing attributes in process `syz.9.6528'. [ 1611.980206][ T7910] fuse: Bad value for 'fd' [ 1612.511407][ T4805] usbhid 9-1:228.86: couldn't find an input interrupt endpoint [ 1612.530852][ T4805] usb 9-1: USB disconnect, device number 42 [ 1612.612933][ T42] audit: type=1804 audit(2124.247:1118): pid=7920 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.9.6530" name="bus" dev="ramfs" ino=119898 res=1 errno=0 [ 1612.634410][ T42] audit: type=1804 audit(2124.247:1119): pid=7920 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.9.6530" name="bus" dev="ramfs" ino=119898 res=1 errno=0 [ 1612.863463][ T4638] Bluetooth: hci6: unexpected event for opcode 0x4ad0 [ 1612.949268][ T7928] overlayfs: failed to resolve './file1': -2 [ 1613.589145][ T7938] fuse: fd is not a fuse device [ 1615.744848][ T4804] usb 14-1: new high-speed USB device number 16 using dummy_hcd [ 1615.895106][ T4804] usb 14-1: Using ep0 maxpacket: 8 [ 1615.900535][ T4804] usb 14-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1615.907236][ T4804] usb 14-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1615.914490][ T4804] usb 14-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1616.024814][ T4805] usb 9-1: new high-speed USB device number 43 using dummy_hcd [ 1616.264122][ T7969] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1616.338946][ T4805] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1617.029695][ T4805] usb 9-1: config 228 has an invalid interface number: 86 but max is 0 [ 1617.032890][ T4805] usb 9-1: config 228 has no interface number 0 [ 1617.035431][ T4805] usb 9-1: config 228 interface 86 has no altsetting 0 [ 1617.040567][ T4805] usb 9-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1617.043988][ T4805] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1617.046945][ T4805] usb 9-1: Product: syz [ 1617.048540][ T4805] usb 9-1: Manufacturer: syz [ 1617.050225][ T4805] usb 9-1: SerialNumber: syz [ 1617.157098][ T4638] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1617.169581][ T7979] input: syz1 as /devices/virtual/input/input54 [ 1617.187660][ T7979] db_root: cannot be changed because it's in use [ 1617.569599][ T42] audit: type=1804 audit(2129.207:1120): pid=7990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.6546" name="bus" dev="ramfs" ino=119760 res=1 errno=0 [ 1617.598101][ T42] audit: type=1804 audit(2129.207:1121): pid=7990 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.6546" name="bus" dev="ramfs" ino=119760 res=1 errno=0 [ 1617.708412][ T4805] usbhid 9-1:228.86: couldn't find an input interrupt endpoint [ 1617.723713][ T4805] usb 9-1: USB disconnect, device number 43 [ 1617.861915][ T42] audit: type=1326 audit(2129.487:1122): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7983 comm="syz.8.6545" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1617.891595][ T42] audit: type=1326 audit(2129.517:1123): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=7983 comm="syz.8.6545" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1618.541886][ T5871] usb 14-1: USB disconnect, device number 16 [ 1618.593866][ T7997] bridge0: port 2(bridge_slave_1) entered disabled state [ 1618.596393][ T7997] bridge0: port 1(bridge_slave_0) entered disabled state [ 1618.608800][ T7997] pci 0000:00:01.0: [1234:1111] type 00 class 0x030000 conventional PCI endpoint [ 1618.634339][ T7997] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref] [ 1618.638240][ T7997] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff] [ 1618.640662][ T7997] pci 0000:00:01.0: ROM [mem 0xfeae0000-0xfeaeffff pref] [ 1618.643601][ T7997] pci 0000:00:01.0: Video device with shadowed ROM at [mem 0x000c0000-0x000dffff] [ 1618.660525][ T7997] pci 0000:00:01.0: Adding to iommu group 1 [ 1618.669710][ T7997] pci 0000:00:01.0: vgaarb: setting as boot VGA device [ 1618.671903][ T7997] pci 0000:00:01.0: vgaarb: bridge control possible [ 1618.673983][ T7997] pci 0000:00:01.0: vgaarb: VGA device added: decodes=io+mem,owns=io+mem,locks=none [ 1618.691427][ T7997] pci 0000:00:01.0: BAR 0 [mem 0x80000000-0x80ffffff pref]: assigned [ 1618.697638][ T7997] pci 0000:00:01.0: BAR 2 [mem 0x81000000-0x81000fff]: assigned [ 1618.705440][ T7997] bochs-drm 0000:00:01.0: vgaarb: deactivate vga console [ 1618.716345][ T7997] [drm] Found bochs VGA, ID 0xb0c5. [ 1618.720213][ T7997] [drm] Framebuffer size 16384 kB @ 0x80000000, mmio @ 0x81000000. [ 1618.746845][ T1005] usb 9-1: new full-speed USB device number 44 using dummy_hcd [ 1618.759231][ T7997] [drm] Initialized bochs-drm 1.0.0 for 0000:00:01.0 on minor 2 [ 1618.777606][ T8000] syzkaller0: entered promiscuous mode [ 1618.783760][ T8000] syzkaller0: entered allmulticast mode [ 1618.849318][ T7997] bochs-drm 0000:00:01.0: [drm] fb1: bochs-drmdrmfb frame buffer device [ 1618.912592][ T1005] usb 9-1: config index 0 descriptor too short (expected 28277, got 36) [ 1618.919178][ T1005] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1618.926859][ T8006] syzkaller0: entered promiscuous mode [ 1618.928699][ T8006] syzkaller0: entered allmulticast mode [ 1618.930218][ T1005] usb 9-1: config 0 has no interfaces? [ 1618.939170][ T1005] usb 9-1: New USB device found, idVendor=056a, idProduct=0063, bcdDevice= 0.00 [ 1618.952786][ T1005] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1618.990691][ T1005] usb 9-1: config 0 descriptor?? [ 1619.203544][ T4804] usb 9-1: USB disconnect, device number 44 [ 1619.337734][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 1619.550301][ T8020] fuse: fd is not a fuse device [ 1619.579456][ T8020] kvm: requested 4190 ns i8254 timer period limited to 200000 ns [ 1619.584703][ T4805] usb 14-1: new high-speed USB device number 17 using dummy_hcd [ 1619.736828][ T4805] usb 14-1: unable to get BOS descriptor or descriptor too short [ 1619.741102][ T4805] usb 14-1: config 228 has an invalid interface number: 86 but max is 0 [ 1619.745195][ T4805] usb 14-1: config 228 has no interface number 0 [ 1619.749399][ T4805] usb 14-1: config 228 interface 86 has no altsetting 0 [ 1619.756492][ T4805] usb 14-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1619.759488][ T4805] usb 14-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1619.762140][ T4805] usb 14-1: Product: syz [ 1619.763614][ T4805] usb 14-1: Manufacturer: syz [ 1619.766211][ T4805] usb 14-1: SerialNumber: syz [ 1619.875884][ T42] audit: type=1804 audit(2131.517:1124): pid=8027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.6557" name="bus" dev="ramfs" ino=120280 res=1 errno=0 [ 1619.894177][ T42] audit: type=1804 audit(2131.517:1125): pid=8027 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.6557" name="bus" dev="ramfs" ino=120280 res=1 errno=0 [ 1620.446008][ T4805] usbhid 14-1:228.86: couldn't find an input interrupt endpoint [ 1620.463659][ T4805] usb 14-1: USB disconnect, device number 17 [ 1621.130822][ T8043] netlink: 16 bytes leftover after parsing attributes in process `syz.9.6560'. [ 1621.175750][ T4805] usb 13-1: new high-speed USB device number 16 using dummy_hcd [ 1621.383735][ T4805] usb 13-1: config 27 interface 0 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 7 [ 1621.387931][ T4805] usb 13-1: config 27 interface 0 altsetting 0 bulk endpoint 0xB has invalid maxpacket 47 [ 1621.391691][ T4805] usb 13-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.9d [ 1621.395972][ T8047] program syz.9.6562 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1621.401986][ T4805] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1621.419872][ T8038] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1621.443080][ T4805] usb 13-1: Quirk or no altset; falling back to MIDI 1.0 [ 1621.739342][ T4805] usb 13-1: USB disconnect, device number 16 [ 1621.992027][ T8053] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1621.994277][ T8053] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1621.997507][ T8053] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1621.999566][ T8053] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1622.697484][ T42] audit: type=1804 audit(2134.337:1126): pid=8068 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.6569" name="bus" dev="ramfs" ino=120383 res=1 errno=0 [ 1622.718824][ T42] audit: type=1804 audit(2134.347:1127): pid=8068 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.6569" name="bus" dev="ramfs" ino=120383 res=1 errno=0 [ 1622.804705][ T1005] usb 9-1: new high-speed USB device number 45 using dummy_hcd [ 1622.977200][ T1005] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1622.985114][ T1005] usb 9-1: config 228 has an invalid interface number: 86 but max is 0 [ 1622.993234][ T1005] usb 9-1: config 228 has no interface number 0 [ 1622.999146][ T1005] usb 9-1: config 228 interface 86 has no altsetting 0 [ 1623.009807][ T1005] usb 9-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1623.019118][ T1005] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1623.029429][ T1005] usb 9-1: Product: syz [ 1623.034229][ T1005] usb 9-1: Manufacturer: syz [ 1623.040176][ T1005] usb 9-1: SerialNumber: syz [ 1623.792082][ T4638] Bluetooth: hci5: unexpected event for opcode 0x0809 [ 1623.870438][ T8079] input: syz1 as /devices/virtual/input/input55 [ 1624.054958][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1624.055112][ T4638] Bluetooth: hci6: command 0x0406 tx timeout [ 1624.055199][ T4638] Bluetooth: hci2: command 0x0c1a tx timeout [ 1624.076482][ T8090] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1624.076791][ T8090] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1624.076970][ T8090] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1624.077144][ T8090] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1624.227562][ T1005] usbhid 9-1:228.86: couldn't find an input interrupt endpoint [ 1624.232671][ T1005] usb 9-1: USB disconnect, device number 45 [ 1624.267587][ T8098] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1624.267905][ T8098] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1624.268078][ T8098] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1624.268240][ T8098] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1624.572845][ T42] audit: type=1804 audit(2136.207:1128): pid=8111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.6581" name="bus" dev="ramfs" ino=121086 res=1 errno=0 [ 1625.255157][ T42] audit: type=1804 audit(2136.217:1129): pid=8111 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.6581" name="bus" dev="ramfs" ino=121086 res=1 errno=0 [ 1625.946684][ T4665] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1625.953126][ T8120] input: syz1 as /devices/virtual/input/input56 [ 1626.124197][ T8123] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1626.129088][ T8123] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1626.131910][ T8123] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1626.139397][ T8123] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1626.169198][ T8130] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1626.196468][ T8132] netlink: 16 bytes leftover after parsing attributes in process `syz.4.6589'. [ 1626.381006][ T8139] netlink: 20 bytes leftover after parsing attributes in process `syz.8.6592'. [ 1626.595687][T31373] usb 9-1: new high-speed USB device number 46 using dummy_hcd [ 1626.768059][T31373] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1626.771665][T31373] usb 9-1: config 228 has an invalid interface number: 86 but max is 0 [ 1626.776081][T31373] usb 9-1: config 228 has no interface number 0 [ 1626.780449][T31373] usb 9-1: config 228 interface 86 has no altsetting 0 [ 1626.787905][T31373] usb 9-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1626.791999][T31373] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1626.798233][T31373] usb 9-1: Product: syz [ 1626.801672][T31373] usb 9-1: Manufacturer: syz [ 1626.804385][T31373] usb 9-1: SerialNumber: syz [ 1627.563492][T31373] usbhid 9-1:228.86: couldn't find an input interrupt endpoint [ 1627.585060][T31373] usb 9-1: USB disconnect, device number 46 [ 1627.599527][ T4665] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1627.681522][ T42] audit: type=1804 audit(2139.317:1130): pid=8153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.6595" name="bus" dev="ramfs" ino=121232 res=1 errno=0 [ 1627.709448][ T42] audit: type=1804 audit(2139.317:1131): pid=8153 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.6595" name="bus" dev="ramfs" ino=121232 res=1 errno=0 [ 1628.204881][ T4638] Bluetooth: hci6: command 0x0406 tx timeout [ 1628.206930][ T4638] Bluetooth: hci5: command 0x206a tx timeout [ 1628.208903][ T4665] Bluetooth: hci7: command 0x0c1a tx timeout [ 1629.009887][ T8158] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1629.031948][ T8158] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1629.043683][ T8158] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1629.049057][ T8158] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1629.074104][ T4665] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 1629.146281][ T8166] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1629.590637][ T4665] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1629.811460][ T8189] pim6reg: entered allmulticast mode [ 1629.874690][T31373] usb 13-1: new high-speed USB device number 17 using dummy_hcd [ 1629.892538][ T8188] pim6reg: left allmulticast mode [ 1630.468368][ T42] audit: type=1800 audit(2142.107:1132): pid=8191 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6607" name="pnp_string" dev="configfs" ino=120539 res=0 errno=0 [ 1630.606756][ T8193] input: syz0 as /devices/virtual/input/input58 [ 1630.687684][T31373] usb 13-1: unable to get BOS descriptor or descriptor too short [ 1630.696684][T31373] usb 13-1: config 228 has an invalid interface number: 86 but max is 0 [ 1630.704888][T31373] usb 13-1: config 228 has no interface number 0 [ 1630.707426][T31373] usb 13-1: config 228 interface 86 has no altsetting 0 [ 1630.715343][T31373] usb 13-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1630.724838][T31373] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1630.728097][T31373] usb 13-1: Product: syz [ 1630.729442][T31373] usb 13-1: Manufacturer: syz [ 1630.732409][T31373] usb 13-1: SerialNumber: syz [ 1630.872595][ T8201] FAULT_INJECTION: forcing a failure. [ 1630.872595][ T8201] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1630.877004][ T8201] CPU: 2 UID: 0 PID: 8201 Comm: syz.2.6612 Tainted: G L syzkaller #0 PREEMPT(full) [ 1630.877023][ T8201] Tainted: [L]=SOFTLOCKUP [ 1630.877027][ T8201] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1630.877034][ T8201] Call Trace: [ 1630.877053][ T8201] [ 1630.877059][ T8201] dump_stack_lvl+0x100/0x190 [ 1630.877156][ T8201] should_fail_ex.cold+0x5/0xa [ 1630.877181][ T8201] _copy_from_user+0x2e/0xd0 [ 1630.877239][ T8201] kstrtouint_from_user+0xd6/0x1d0 [ 1630.877252][ T8201] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1630.877265][ T8201] ? __lock_acquire+0x49f/0x1a40 [ 1630.877299][ T8201] proc_fail_nth_write+0x83/0x220 [ 1630.877327][ T8201] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1630.877346][ T8201] vfs_write+0x2aa/0x1050 [ 1630.877358][ T8201] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1630.877374][ T8201] ? __pfx_vfs_write+0x10/0x10 [ 1630.877383][ T8201] ? find_held_lock+0x2b/0x80 [ 1630.877397][ T8201] ? __fget_files+0x215/0x3d0 [ 1630.877411][ T8201] ? __fget_files+0x21f/0x3d0 [ 1630.877425][ T8201] ksys_write+0x12a/0x250 [ 1630.877435][ T8201] ? __pfx_ksys_write+0x10/0x10 [ 1630.877449][ T8201] do_int80_emulation+0x14b/0x720 [ 1630.877491][ T8201] asm_int80_emulation+0x1a/0x20 [ 1630.877503][ T8201] RIP: 0023:0xf71873eb [ 1630.877513][ T8201] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1630.877525][ T8201] RSP: 002b:00000000f54464bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 1630.877548][ T8201] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54465d0 [ 1630.877555][ T8201] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1630.877562][ T8201] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1630.877568][ T8201] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1630.877575][ T8201] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1630.877588][ T8201] [ 1631.084916][ T4665] Bluetooth: hci7: command 0x0c1a tx timeout [ 1631.086747][ T4638] Bluetooth: hci5: command 0x206a tx timeout [ 1631.101395][ T8208] input: syz1 as /devices/virtual/input/input59 [ 1631.112831][ T8208] db_root: cannot be changed because it's in use [ 1631.310922][ T42] audit: type=1800 audit(2142.947:1133): pid=8214 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6616" name="pnp_string" dev="configfs" ino=120700 res=0 errno=0 [ 1631.365398][ T8215] syzkaller0: entered promiscuous mode [ 1631.373705][ T8215] syzkaller0: entered allmulticast mode [ 1631.399648][ T8215] tipc: Started in network mode [ 1631.408104][ T8215] tipc: Node identity 968775973f33, cluster identity 4711 [ 1631.438853][ T8215] tipc: Enabled bearer , priority 0 [ 1631.446214][T31373] usbhid 13-1:228.86: couldn't find an input interrupt endpoint [ 1631.463931][T31373] usb 13-1: USB disconnect, device number 17 [ 1631.536601][ T8213] tipc: Resetting bearer [ 1631.590054][ T8213] tipc: Disabling bearer [ 1632.309719][ T8233] fuse: fd is not a fuse device [ 1632.429912][ T8235] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1632.436983][ T8235] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1632.443052][ T8235] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1632.451767][ T8235] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1632.630955][ T42] audit: type=1800 audit(2144.267:1134): pid=8240 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.6625" name="pnp_string" dev="configfs" ino=121870 res=0 errno=0 [ 1632.814742][T28372] usb 13-1: new high-speed USB device number 18 using dummy_hcd [ 1632.974878][T28372] usb 13-1: Using ep0 maxpacket: 16 [ 1632.981072][T28372] usb 13-1: config 0 interface 0 altsetting 1 endpoint 0x7 has invalid wMaxPacketSize 0 [ 1632.987377][T28372] usb 13-1: config 0 interface 0 altsetting 1 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1632.995413][T28372] usb 13-1: config 0 interface 0 altsetting 1 endpoint 0x8F has an invalid bInterval 0, changing to 7 [ 1633.004512][T28372] usb 13-1: config 0 interface 0 altsetting 1 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1633.014866][T28372] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1633.020133][T28372] usb 13-1: New USB device found, idVendor=06cb, idProduct=0006, bcdDevice=9a.eb [ 1633.027929][T28372] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1633.033334][T28372] usb 13-1: Product: syz [ 1633.037964][T28372] usb 13-1: Manufacturer: syz [ 1633.040911][T28372] usb 13-1: SerialNumber: syz [ 1633.053492][T28372] usb 13-1: config 0 descriptor?? [ 1633.064458][ T8238] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1633.276017][ T8238] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 1633.287660][T28372] input: syz syz as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/input/input60 [ 1633.606825][ T4804] usb 13-1: USB disconnect, device number 18 [ 1633.834762][ T1005] usb 7-1: new high-speed USB device number 87 using dummy_hcd [ 1633.997917][ T1005] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1634.005252][ T1005] usb 7-1: config 228 has an invalid interface number: 86 but max is 0 [ 1634.011506][ T1005] usb 7-1: config 228 has no interface number 0 [ 1634.017654][ T1005] usb 7-1: config 228 interface 86 has no altsetting 0 [ 1634.027961][ T1005] usb 7-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1634.038159][ T1005] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1634.043632][ T1005] usb 7-1: Product: syz [ 1634.048348][ T1005] usb 7-1: Manufacturer: syz [ 1634.051501][ T1005] usb 7-1: SerialNumber: syz [ 1634.353221][ T8249] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=198462431 (396924862 ns) > initial count (148514 ns). Using initial count to start timer. [ 1634.444869][ T4638] Bluetooth: hci5: command 0x206a tx timeout [ 1634.445307][ T1566] Bluetooth: hci2: command 0x0c1a tx timeout [ 1634.446804][ T4665] Bluetooth: hci6: command 0x0406 tx timeout [ 1634.526895][ T4665] Bluetooth: hci7: command 0x0c1a tx timeout [ 1634.610586][ T8256] binder: 8255:8256 ioctl c0306201 80000080 returned -14 [ 1634.625872][ T8256] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1634.631145][ T8256] batadv_slave_1: entered allmulticast mode [ 1634.950923][ T1005] usbhid 7-1:228.86: couldn't find an input interrupt endpoint [ 1634.985497][ T1005] usb 7-1: USB disconnect, device number 87 [ 1635.330738][ T8270] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1635.333154][ T8270] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1635.336465][ T8270] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1635.338671][ T8270] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1635.446441][ T42] audit: type=1800 audit(2147.077:1135): pid=8275 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6634" name="pnp_string" dev="configfs" ino=121512 res=0 errno=0 [ 1635.656753][ T4665] Bluetooth: hci6: unexpected event for opcode 0x4ad0 [ 1635.734165][ T8279] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1635.979722][ T8285] batadv1: entered promiscuous mode [ 1636.117302][ T8287] netlink: 20 bytes leftover after parsing attributes in process `syz.2.6638'. [ 1637.334868][ T4665] Bluetooth: hci2: command 0x0c1a tx timeout [ 1637.390023][ T42] audit: type=1800 audit(2149.027:1136): pid=8298 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6643" name="pnp_string" dev="configfs" ino=121560 res=0 errno=0 [ 1637.404488][ T8300] netlink: 'syz.4.6642': attribute type 1 has an invalid length. [ 1637.414694][ T4665] Bluetooth: hci7: command 0x0c1a tx timeout [ 1637.414710][ T1566] Bluetooth: hci5: command 0x206a tx timeout [ 1637.448011][ T8300] bond1: entered allmulticast mode [ 1637.450152][ T8296] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1637.452235][ T8296] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1637.457726][ T8296] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1637.461389][ T8296] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1637.530273][ T8300] bond1: (slave vti0): The slave device specified does not support setting the MAC address [ 1637.546362][ T8300] bond1: (slave vti0): Setting fail_over_mac to active for active-backup mode [ 1637.569607][ T8300] bond1: (slave vti0): making interface the new active one [ 1637.575537][ T8300] vti0: entered allmulticast mode [ 1637.584572][ T8300] vti0: left allmulticast mode [ 1637.622602][ T42] audit: type=1804 audit(2149.257:1137): pid=8309 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.6645" name="/newroot/210/file0" dev="tmpfs" ino=1203 res=1 errno=0 [ 1638.064930][ T1005] usb 9-1: new high-speed USB device number 47 using dummy_hcd [ 1638.226985][ T1005] usb 9-1: Using ep0 maxpacket: 32 [ 1638.230940][ T1005] usb 9-1: config 0 has an invalid interface number: 12 but max is 0 [ 1638.236086][ T1005] usb 9-1: config 0 has no interface number 0 [ 1638.240370][ T1005] usb 9-1: config 0 interface 12 has no altsetting 0 [ 1638.249385][ T1005] usb 9-1: New USB device found, idVendor=2c42, idProduct=1202, bcdDevice=85.40 [ 1638.256366][ T1005] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1638.263609][ T1005] usb 9-1: Product: syz [ 1638.269506][ T1005] usb 9-1: Manufacturer: syz [ 1638.273456][ T1005] usb 9-1: SerialNumber: syz [ 1638.281231][ T1005] usb 9-1: config 0 descriptor?? [ 1639.484846][ T1566] Bluetooth: hci7: command 0x0c1a tx timeout [ 1639.484903][ T4638] Bluetooth: hci5: command 0x206a tx timeout [ 1639.487181][ T1566] Bluetooth: hci2: command 0x0c1a tx timeout [ 1639.489706][ T4665] Bluetooth: hci6: command 0x0406 tx timeout [ 1639.565978][ T8320] fuse: Unknown parameter '184467440737095516150Ba3f YSX2vMI%XaZIMCլH6eU^rPKKvvvDLi`P1yW Ql#GT~w @\xǼ؃audOLcuƟC| VPG[GZ' [ 1639.580133][ T4665] Bluetooth: hci2: SCO packet for unknown connection handle 200 [ 1639.822463][ T8329] netlink: 12 bytes leftover after parsing attributes in process `syz.8.6651'. [ 1639.835667][ T8329] openvswitch: netlink: Flow actions attr not present in new flow. [ 1640.044319][ T4665] Bluetooth: hci2: unexpected event 0x03 length: 1 < 11 [ 1640.322192][ T1005] f81534 9-1:0.12: f81534_get_register: reg: 1003 failed: -71 [ 1640.327540][ T1005] f81534 9-1:0.12: f81534_find_config_idx: read failed: -71 [ 1640.331265][ T1005] f81534 9-1:0.12: f81534_calc_num_ports: find idx failed: -71 [ 1640.344744][ T1005] f81534 9-1:0.12: probe with driver f81534 failed with error -71 [ 1640.351560][ T1005] usb 9-1: USB disconnect, device number 47 [ 1640.542488][ T4638] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 1640.568025][ T4638] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 1640.585937][ T4638] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 1640.594194][ T4638] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 1640.616235][ T4638] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 1640.908344][ T8354] tipc: Cannot configure node identity twice [ 1641.101366][ T8364] input: syz1 as /devices/virtual/input/input61 [ 1641.140477][ T8364] db_root: cannot be changed because it's in use [ 1641.304894][ T1005] usb 13-1: new high-speed USB device number 19 using dummy_hcd [ 1641.363365][ T4714] netdevsim netdevsim9 netdevsim3 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1641.393745][ T4714] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1641.474919][ T1005] usb 13-1: Using ep0 maxpacket: 32 [ 1641.485559][ T1005] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1641.499529][ T1005] usb 13-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1641.518775][ T1005] usb 13-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 5 [ 1641.519842][ T8371] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6662'. [ 1641.528445][ T1005] usb 13-1: New USB device found, idVendor=0458, idProduct=5011, bcdDevice= 0.00 [ 1641.539537][ T1005] usb 13-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1641.558569][ T1005] usb 13-1: config 0 descriptor?? [ 1641.674325][ T8370] random: crng reseeded on system resumption [ 1641.753428][ T4714] netdevsim netdevsim9 netdevsim2 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1641.759149][ T4714] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1641.886219][ T4714] netdevsim netdevsim9 netdevsim1 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1641.891114][ T4714] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1641.987963][ T4714] netdevsim netdevsim9 netdevsim0 (unregistering): unset [0, 0] type 1 family 0 port 8472 - 0 [ 1641.991485][ T4714] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1642.100763][ T1005] input: HID 0458:5011 as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/0003:0458:5011.0089/input/input62 [ 1642.234794][ T1005] input: HID 0458:5011 as /devices/platform/dummy_hcd.8/usb13/13-1/13-1:0.0/0003:0458:5011.0089/input/input63 [ 1642.306224][ T42] audit: type=1326 audit(2153.937:1138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.324123][ T1005] kye 0003:0458:5011.0089: input,hiddev0,hidraw1: USB HID v0.00 Mouse [HID 0458:5011] on usb-dummy_hcd.8-1/input0 [ 1642.360085][ T42] audit: type=1326 audit(2153.937:1139): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.404844][ T42] audit: type=1326 audit(2153.957:1140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=331 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.413456][ T42] audit: type=1326 audit(2153.957:1141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.434090][ T42] audit: type=1326 audit(2153.957:1142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.445161][ T42] audit: type=1326 audit(2153.957:1143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=436 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.461115][ T42] audit: type=1326 audit(2153.957:1144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.481524][ T42] audit: type=1326 audit(2153.957:1145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.492457][ T42] audit: type=1326 audit(2153.967:1146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=395 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.520611][ T8338] bridge0: port 1(bridge_slave_0) entered blocking state [ 1642.526736][ T42] audit: type=1326 audit(2153.967:1147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8355 comm="syz.8.6659" exe="/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x7ffc0000 [ 1642.545083][ T8338] bridge0: port 1(bridge_slave_0) entered disabled state [ 1642.549397][ T8338] bridge_slave_0: entered allmulticast mode [ 1642.556414][ T8338] bridge_slave_0: entered promiscuous mode [ 1642.631071][ T4638] Bluetooth: hci6: unexpected subevent 0x1a length: 30 > 6 [ 1642.700290][ T8338] bridge0: port 2(bridge_slave_1) entered blocking state [ 1642.704364][ T8338] bridge0: port 2(bridge_slave_1) entered disabled state [ 1642.721521][ T8338] bridge_slave_1: entered allmulticast mode [ 1642.727954][ T8338] bridge_slave_1: entered promiscuous mode [ 1642.775535][ T4638] Bluetooth: hci1: command tx timeout [ 1642.889066][ T8338] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1642.906795][ T8338] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1642.989707][ T4714] bridge_slave_1: left allmulticast mode [ 1642.993718][ T4714] bridge_slave_1: left promiscuous mode [ 1642.998187][ T4714] bridge0: port 2(bridge_slave_1) entered disabled state [ 1643.016141][ T4714] bridge_slave_0: left allmulticast mode [ 1643.021214][ T4714] bridge_slave_0: left promiscuous mode [ 1643.025004][ T4714] bridge0: port 1(bridge_slave_0) entered disabled state [ 1643.052055][ T4714] dvmrp1: left allmulticast mode [ 1643.314928][ T5871] usb 13-1: reset high-speed USB device number 19 using dummy_hcd [ 1643.417405][ T4714] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1643.422142][ T4714] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1643.430035][ T4714] bond0 (unregistering): Released all slaves [ 1643.436237][ T8338] team0: Port device team_slave_0 added [ 1643.439181][ T5459] 8021q: adding VLAN 0 to HW filter on device eth1 [ 1643.759892][ T5871] usb 13-1: device descriptor read/64, error -32 [ 1643.767254][ T8338] team0: Port device team_slave_1 added [ 1643.786668][ T4714] tipc: Left network mode [ 1643.862018][ T8338] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1643.864875][ T8338] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1643.874369][ T8338] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1643.881228][ T8338] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1643.884334][ T8338] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1643.897699][ T8338] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1644.034718][ T5871] usb 13-1: reset high-speed USB device number 19 using dummy_hcd [ 1644.140778][ T8338] hsr_slave_0: entered promiscuous mode [ 1644.146304][ T8338] hsr_slave_1: entered promiscuous mode [ 1644.148587][ T8338] debugfs: 'hsr0' already exists in 'hsr' [ 1644.150670][ T8338] Cannot create hsr debugfs directory [ 1644.170518][ T5871] usb 13-1: device descriptor read/64, error -32 [ 1644.384340][ T5459] 8021q: adding VLAN 0 to HW filter on device eth6 [ 1644.424709][ T5871] usb 13-1: reset high-speed USB device number 19 using dummy_hcd [ 1644.453687][ T5871] usb 13-1: device descriptor read/8, error -32 [ 1644.684718][ T5871] usb 13-1: reset high-speed USB device number 19 using dummy_hcd [ 1644.714979][ T5871] usb 13-1: device descriptor read/8, error -32 [ 1644.763232][ T8359] raw-gadget.0 gadget.8: failed to queue suspend event [ 1644.766892][ T8359] raw-gadget.0 gadget.8: failed to queue disconnect event [ 1644.833756][ T1005] usb 13-1: USB disconnect, device number 19 [ 1644.845570][ T4638] Bluetooth: hci1: command tx timeout [ 1644.981495][ T4638] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 1645.025607][ T8338] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1645.048303][ T8441] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6675'. [ 1645.064154][ T8444] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1645.156908][ T4714] hsr_slave_0: left promiscuous mode [ 1645.163398][ T4714] hsr_slave_1: left promiscuous mode [ 1645.180223][ T4714] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1645.197522][ T4714] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1645.221513][ T4714] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1645.242063][ T4714] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1645.308973][ T4714] veth1_macvtap: left allmulticast mode [ 1645.420809][ T4714] veth1_macvtap: left promiscuous mode [ 1645.843330][ T4714] veth0_macvtap: left promiscuous mode [ 1646.116612][ T4714] veth1_vlan: left promiscuous mode [ 1646.525805][ T5459] 8021q: adding VLAN 0 to HW filter on device eth11 [ 1646.786308][ T8338] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1646.843182][ T8461] CIFS: VFS: UNC: missing share name [ 1646.846008][ T8461] CIFS: VFS: Malformed UNC in devname [ 1646.956867][ T4638] Bluetooth: hci1: command tx timeout [ 1648.060594][ T8338] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1648.328008][ T5459] 8021q: adding VLAN 0 to HW filter on device eth12 [ 1648.582230][ T8338] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1648.968441][ T4714] IPVS: stop unused estimator thread 0... [ 1649.004871][ T4638] Bluetooth: hci1: command tx timeout [ 1649.041574][ T8495] input: syz1 as /devices/virtual/input/input64 [ 1649.534038][ T8504] netlink: 20 bytes leftover after parsing attributes in process `syz.8.6688'. [ 1649.588026][ T8506] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6687'. [ 1649.704128][ T42] kauditd_printk_skb: 7 callbacks suppressed [ 1649.704140][ T42] audit: type=1326 audit(2161.337:1155): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8503 comm="syz.8.6688" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x0 [ 1650.176668][ T8338] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 1650.182288][ T8338] 8021q: adding VLAN 0 to HW filter on device netdevsim0 [ 1650.197494][ T8338] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 1650.212155][ T8338] 8021q: adding VLAN 0 to HW filter on device netdevsim1 [ 1650.218204][ T8338] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 1650.227917][ T8338] 8021q: adding VLAN 0 to HW filter on device netdevsim2 [ 1650.239820][ T8338] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 1650.243570][ T4638] Bluetooth: hci6: unexpected event for opcode 0x4ad0 [ 1650.253908][ T8338] 8021q: adding VLAN 0 to HW filter on device netdevsim3 [ 1650.318418][ T8535] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1650.380928][ T8338] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1650.405421][ T8338] 8021q: adding VLAN 0 to HW filter on device team0 [ 1650.420713][T32561] bridge0: port 1(bridge_slave_0) entered blocking state [ 1650.423091][T32561] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1650.455190][T32561] bridge0: port 2(bridge_slave_1) entered blocking state [ 1650.457506][T32561] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1650.513000][ T8542] netlink: 8 bytes leftover after parsing attributes in process `syz.8.6690'. [ 1650.535487][ T8542] netlink: 8 bytes leftover after parsing attributes in process `syz.8.6690'. [ 1650.966351][ T42] audit: type=1800 audit(2162.607:1156): pid=8551 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6692" name="local" dev="configfs" ino=123657 res=0 errno=0 [ 1651.039453][ T8558] netlink: 48 bytes leftover after parsing attributes in process `syz.8.6694'. [ 1651.163436][ T8338] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1651.217865][ T8565] program syz.2.6695 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1651.228936][ T8338] veth0_vlan: entered promiscuous mode [ 1651.235663][ T8338] veth1_vlan: entered promiscuous mode [ 1651.263157][ T8338] veth0_macvtap: entered promiscuous mode [ 1651.269221][ T8338] veth1_macvtap: entered promiscuous mode [ 1651.281684][ T8338] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1651.288995][ T8338] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1651.317555][ T42] audit: type=1804 audit(2162.957:1157): pid=8569 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.6697" name="bus" dev="ramfs" ino=122687 res=1 errno=0 [ 1651.331725][ T42] audit: type=1804 audit(2162.957:1158): pid=8569 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.6697" name="bus" dev="ramfs" ino=122687 res=1 errno=0 [ 1651.368906][ T12] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.380589][ T12] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.392744][ T12] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.419211][ T12] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1651.554335][ T9802] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1651.561110][ T8572] netlink: 20 bytes leftover after parsing attributes in process `syz.4.6698'. [ 1651.564109][ T9802] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1651.598138][ T9800] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1651.607300][ T9800] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1651.774803][ T42] audit: type=1800 audit(2163.407:1159): pid=8577 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6652" name="pnp_string" dev="configfs" ino=124008 res=0 errno=0 [ 1652.028183][ T8582] fuse: fd is not a fuse device [ 1652.147055][ T42] audit: type=1800 audit(2163.787:1160): pid=8584 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6701" name="local" dev="configfs" ino=124043 res=0 errno=0 [ 1653.044790][T11008] usb 9-1: new high-speed USB device number 48 using dummy_hcd [ 1653.053332][ T4638] Bluetooth: hci1: unexpected subevent 0x10 length: 5 > 2 [ 1653.094278][ T42] audit: type=1800 audit(2164.727:1161): pid=8600 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6707" name="pnp_string" dev="configfs" ino=122721 res=0 errno=0 [ 1653.224855][T11008] usb 9-1: Using ep0 maxpacket: 8 [ 1653.228357][T11008] usb 9-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1653.234979][T11008] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1653.238423][T11008] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1653.403948][ T8606] program syz.1.6708 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1653.482760][ T42] audit: type=1804 audit(2165.117:1162): pid=8610 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.6711" name="bus" dev="ramfs" ino=122772 res=1 errno=0 [ 1653.499199][ T42] audit: type=1804 audit(2165.127:1163): pid=8610 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.6711" name="bus" dev="ramfs" ino=122772 res=1 errno=0 [ 1653.573394][ T8615] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1653.770255][ T8617] batadv_slave_1: entered promiscuous mode [ 1653.790371][ T8617] batadv_slave_1: left promiscuous mode [ 1654.120790][ T42] audit: type=1326 audit(2165.747:1164): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8618 comm="syz.8.6713" exe="/syz-executor" sig=9 arch=40000003 syscall=252 compat=1 ip=0xf705efec code=0x0 [ 1654.765376][ T4956] usb 6-1: new high-speed USB device number 55 using dummy_hcd [ 1654.984967][ T4956] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1654.990300][ T4956] usb 6-1: config 228 has an invalid interface number: 86 but max is 0 [ 1654.995939][ T4956] usb 6-1: config 228 has no interface number 0 [ 1655.001870][ T4956] usb 6-1: config 228 interface 86 has no altsetting 0 [ 1655.010602][ T4956] usb 6-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1655.018870][ T4956] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1655.032922][ T4956] usb 6-1: Product: syz [ 1655.038738][ T4956] usb 6-1: Manufacturer: syz [ 1655.043469][ T4956] usb 6-1: SerialNumber: syz [ 1655.894372][ T10] usb 9-1: USB disconnect, device number 48 [ 1656.119141][ T42] kauditd_printk_skb: 1 callbacks suppressed [ 1656.119153][ T42] audit: type=1800 audit(2167.677:1166): pid=8647 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.6721" name="local" dev="configfs" ino=124253 res=0 errno=0 [ 1656.159045][ T4956] usbhid 6-1:228.86: couldn't find an input interrupt endpoint [ 1656.168706][ T4956] usb 6-1: USB disconnect, device number 55 [ 1656.172432][ T8652] netlink: 'syz.8.6722': attribute type 1 has an invalid length. [ 1656.202350][ T8652] bond1: option mode: invalid value (7) [ 1656.406557][ T8652] bond1 (unregistering): Released all slaves [ 1656.540912][ T8659] netlink: 'syz.8.6722': attribute type 10 has an invalid length. [ 1656.549269][ T8659] netlink: 40 bytes leftover after parsing attributes in process `syz.8.6722'. [ 1656.590830][ T8659] dummy0: entered promiscuous mode [ 1656.709178][ T42] audit: type=1800 audit(2168.347:1167): pid=8664 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6725" name="pnp_string" dev="configfs" ino=124948 res=0 errno=0 [ 1657.141588][ T8667] ceph: No mds server is up or the cluster is laggy [ 1657.145939][ T4956] libceph: connect (1)[c::]:6789 error -101 [ 1657.258233][ T4956] libceph: mon0 (1)[c::]:6789 connect error [ 1657.267879][ T8671] pim6reg: entered allmulticast mode [ 1657.313741][ T8671] pim6reg: left allmulticast mode [ 1657.500706][ T8683] netlink: del zone limit has 4 unknown bytes [ 1657.510474][ T8683] netlink: 20 bytes leftover after parsing attributes in process `syz.8.6730'. [ 1657.515683][ T8683] openvswitch: netlink: Missing key (keys=40, expected=10000000) [ 1657.528567][ T4638] Bluetooth: hci6: unexpected subevent 0x19 length: 30 > 28 [ 1657.531777][ T4638] Bluetooth: hci6: Unable to find connection with handle 0x0000 [ 1657.681318][ T42] audit: type=1800 audit(2169.317:1168): pid=8691 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6734" name="pnp_string" dev="configfs" ino=124367 res=0 errno=0 [ 1657.722618][ T8689] program syz.1.6732 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1657.730655][ T4638] Bluetooth: hci2: unexpected event for opcode 0x4ad0 [ 1657.751020][ T8695] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1657.840010][ T4638] Bluetooth: hci6: unexpected event for opcode 0x0c5f [ 1658.136983][ T8706] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1658.142411][ T8706] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1658.155317][ T8706] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1658.163281][ T8706] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1658.171189][ T8706] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1658.242863][ T8706] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 1658.311793][ T4665] Bluetooth: hci2: unexpected subevent 0x19 length: 30 > 28 [ 1658.314367][ T4665] Bluetooth: hci2: Unable to find connection with handle 0x0000 [ 1658.658843][ T42] audit: type=1800 audit(2170.297:1169): pid=8717 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6744" name="pnp_string" dev="configfs" ino=124429 res=0 errno=0 [ 1658.816583][ T8716] netlink: 80 bytes leftover after parsing attributes in process `syz.2.6743'. [ 1659.009212][ T8726] vhci_hcd vhci_hcd.0: pdev(8) rhport(0) sockfd(6) [ 1659.011326][ T8726] vhci_hcd vhci_hcd.0: devid(0) speed(5) speed_str(super-speed) [ 1659.014175][ T8726] vhci_hcd vhci_hcd.0: Device attached [ 1659.298056][ T4848] usb 54-1: SetAddress Request (14) to port 0 [ 1659.304303][ T4848] usb 54-1: new SuperSpeed USB device number 14 using vhci_hcd [ 1659.561600][ T8741] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1659.564419][ T8741] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1659.570753][ T8741] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1659.573660][ T8741] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1659.583543][ T4638] Bluetooth: hci6: unexpected subevent 0x19 length: 30 > 28 [ 1659.591118][ T4638] Bluetooth: hci6: Unable to find connection with handle 0x0000 [ 1659.604085][ T8727] vhci_hcd: connection reset by peer [ 1659.616056][ T5911] vhci_hcd vhci_hcd.8: stop threads [ 1659.622986][ T5911] vhci_hcd vhci_hcd.8: release socket [ 1659.630209][ T5911] vhci_hcd vhci_hcd.8: disconnect device [ 1659.679868][ T42] audit: type=1800 audit(2171.317:1170): pid=8749 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6754" name="pnp_string" dev="configfs" ino=124513 res=0 errno=0 [ 1659.829874][ T8752] program syz.4.6753 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1659.945587][ T8758] netlink: 'syz.1.6755': attribute type 2 has an invalid length. [ 1659.948703][ T8758] netlink: 'syz.1.6755': attribute type 2 has an invalid length. [ 1659.964839][ T1483] usb 7-1: new high-speed USB device number 88 using dummy_hcd [ 1660.114815][ T1483] usb 7-1: Using ep0 maxpacket: 8 [ 1660.121278][ T1483] usb 7-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1660.132183][ T1483] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1660.138775][ T1483] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1660.512678][ T8767] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1660.760159][ T8772] netlink: 'syz.8.6757': attribute type 2 has an invalid length. [ 1660.771555][ T8772] netlink: 'syz.8.6757': attribute type 1 has an invalid length. [ 1661.222238][ T8771] Process accounting resumed [ 1661.575052][ T4665] Bluetooth: hci6: command 0x0406 tx timeout [ 1661.575120][ T1566] Bluetooth: hci2: command 0x0c1a tx timeout [ 1661.644827][ T1566] Bluetooth: hci1: command 0x0c1a tx timeout [ 1661.644862][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1661.712114][ T8788] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1661.716907][ T8788] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1661.721204][ T8788] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1661.730225][ T8788] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1661.783215][ T4638] Bluetooth: hci2: unexpected subevent 0x18 length: 30 > 19 [ 1661.785719][ T4638] Bluetooth: hci2: Unable to find connection for dst 00:00:00:00:00:00 sid 0x00 [ 1661.898622][ T42] audit: type=1800 audit(2173.537:1171): pid=8800 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6764" name="pnp_string" dev="configfs" ino=124627 res=0 errno=0 [ 1662.786053][ T1483] usb 7-1: USB disconnect, device number 88 [ 1663.294050][ T8846] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6776'. [ 1663.735580][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1663.737833][ T4638] Bluetooth: hci6: command 0x0406 tx timeout [ 1663.740005][ T4638] Bluetooth: hci2: command 0x0c1a tx timeout [ 1663.765355][ T8854] CacheFiles: Failed to register: -95 [ 1663.805423][ T1566] Bluetooth: hci1: command 0x0c1a tx timeout [ 1663.916955][ T8858] netlink: 'syz.2.6780': attribute type 1 has an invalid length. [ 1663.927545][ T1566] Bluetooth: hci6: unexpected subevent 0x10 length: 5 > 2 [ 1664.078946][ T42] audit: type=1804 audit(2175.717:1172): pid=8864 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.1.6784" name="bus" dev="ramfs" ino=125229 res=1 errno=0 [ 1664.088019][ T1566] Bluetooth: hci6: unexpected subevent 0x19 length: 30 > 28 [ 1664.091275][ T1566] Bluetooth: hci6: Unable to find connection with handle 0x0000 [ 1664.108782][ T42] audit: type=1804 audit(2175.747:1173): pid=8864 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.1.6784" name="bus" dev="ramfs" ino=125229 res=1 errno=0 [ 1664.276574][ T8870] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1664.367931][ T4848] usb 54-1: device descriptor read/8, error -110 [ 1664.439243][ T8879] FAULT_INJECTION: forcing a failure. [ 1664.439243][ T8879] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1664.455936][ T8879] CPU: 0 UID: 0 PID: 8879 Comm: syz.8.6789 Tainted: G L syzkaller #0 PREEMPT(full) [ 1664.455957][ T8879] Tainted: [L]=SOFTLOCKUP [ 1664.455962][ T8879] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1664.455969][ T8879] Call Trace: [ 1664.455973][ T8879] [ 1664.455979][ T8879] dump_stack_lvl+0x100/0x190 [ 1664.455997][ T8879] should_fail_ex.cold+0x5/0xa [ 1664.456012][ T8879] _copy_to_user+0x32/0xd0 [ 1664.456033][ T8879] simple_read_from_buffer+0xcb/0x170 [ 1664.456065][ T8879] proc_fail_nth_read+0x1af/0x230 [ 1664.456080][ T8879] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1664.456096][ T8879] ? rw_verify_area+0xce/0x6d0 [ 1664.456112][ T8879] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1664.456144][ T8879] vfs_read+0x1e4/0xb40 [ 1664.456156][ T8879] ? __pfx_vfs_read+0x10/0x10 [ 1664.456165][ T8879] ? find_held_lock+0x2b/0x80 [ 1664.456179][ T8879] ? __fget_files+0x215/0x3d0 [ 1664.456193][ T8879] ? __fget_files+0x21f/0x3d0 [ 1664.456206][ T8879] ksys_read+0x12a/0x250 [ 1664.456216][ T8879] ? __pfx_ksys_read+0x10/0x10 [ 1664.456230][ T8879] do_int80_emulation+0x14b/0x720 [ 1664.456247][ T8879] asm_int80_emulation+0x1a/0x20 [ 1664.456258][ T8879] RIP: 0023:0xf71973eb [ 1664.456268][ T8879] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1664.456280][ T8879] RSP: 002b:00000000f544d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1664.456291][ T8879] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f544d5d0 [ 1664.456299][ T8879] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1664.456305][ T8879] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1664.456312][ T8879] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1664.456318][ T8879] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1664.456331][ T8879] [ 1664.795214][ T4848] usb usb54-port1: attempt power cycle [ 1664.883272][ T42] audit: type=1800 audit(2176.517:1174): pid=8884 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.6791" name="pnp_string" dev="configfs" ino=124884 res=0 errno=0 [ 1664.924809][T28372] usb 13-1: new high-speed USB device number 20 using dummy_hcd [ 1664.940983][ T8885] binder: 8875:8885 ioctl c0306201 80000080 returned -14 [ 1664.959069][ T8888] netlink: 'syz.4.6792': attribute type 1 has an invalid length. [ 1665.107670][T28372] usb 13-1: New USB device found, idVendor=065a, idProduct=0009, bcdDevice= 1.00 [ 1665.114343][T28372] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1665.120915][T28372] usb 13-1: Product: syz [ 1665.124407][T28372] usb 13-1: Manufacturer: syz [ 1665.148885][T28372] opticon 13-1:1.0: opticon converter detected [ 1665.197910][T28372] usb 13-1: opticon converter now attached to ttyUSB0 [ 1665.356941][ T4848] usb usb54-port1: unable to enumerate USB device [ 1665.462619][ T8897] netlink: 4 bytes leftover after parsing attributes in process `syz.8.6790'. [ 1665.914843][ T1566] Bluetooth: hci1: command 0x0c1a tx timeout [ 1665.948677][ T1566] Bluetooth: hci1: unexpected event for opcode 0x4ad0 [ 1665.961115][ T8900] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1666.013551][ T1566] Bluetooth: hci6: unexpected event for opcode 0x4ad0 [ 1666.103113][ T8905] db_root: cannot be changed because it's in use [ 1666.126663][ T8902] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1666.440518][ T1483] usb 13-1: USB disconnect, device number 20 [ 1666.483277][ T1483] opticon ttyUSB0: opticon converter now disconnected from ttyUSB0 [ 1666.507887][ T1483] opticon 13-1:1.0: device disconnected [ 1666.575253][ T42] audit: type=1800 audit(2178.217:1175): pid=8914 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6800" name="pnp_string" dev="configfs" ino=125315 res=0 errno=0 [ 1666.759779][ T42] audit: type=1804 audit(2178.397:1176): pid=8919 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.6802" name="bus" dev="ramfs" ino=126031 res=1 errno=0 [ 1666.782635][ T42] audit: type=1804 audit(2178.397:1177): pid=8919 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.6802" name="bus" dev="ramfs" ino=126031 res=1 errno=0 [ 1666.958102][ T8924] vhci_hcd vhci_hcd.0: pdev(4) rhport(0) sockfd(7) [ 1666.960859][ T8924] vhci_hcd vhci_hcd.0: devid(0) speed(6) speed_str(super-speed-plus) [ 1666.967978][ T8924] vhci_hcd vhci_hcd.0: Device attached [ 1667.105838][ T8928] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1667.114082][ T8928] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1667.122834][ T8928] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1667.137556][ T8928] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1667.234742][ T1483] usb 46-1: SetAddress Request (46) to port 0 [ 1667.238122][ T1483] usb 46-1: new SuperSpeed USB device number 46 using vhci_hcd [ 1667.267185][ T1566] Bluetooth: hci6: unexpected event for opcode 0x4ad0 [ 1667.287981][ T8933] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1667.463343][ T8939] binder: 8929:8939 ioctl c0306201 80000080 returned -14 [ 1667.751772][ T8925] vhci_hcd: connection reset by peer [ 1667.758601][ T12] vhci_hcd vhci_hcd.4: stop threads [ 1667.761376][ T12] vhci_hcd vhci_hcd.4: release socket [ 1667.768117][ T12] vhci_hcd vhci_hcd.4: disconnect device [ 1668.025184][ T42] audit: type=1800 audit(2179.667:1178): pid=8946 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6810" name="pnp_string" dev="configfs" ino=126068 res=0 errno=0 [ 1668.069719][ T8947] bond6: Unable to set down delay as MII monitoring is disabled [ 1668.083906][ T8947] bond6 (unregistering): Released all slaves [ 1668.212802][ T8954] overlay: filesystem on ./file0 is read-only [ 1668.302299][ T8954] ip6gretap0: entered promiscuous mode [ 1668.705300][ T8961] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1668.707643][ T8961] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1668.719262][ T8961] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1668.721612][ T8961] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1668.770149][ T8966] xt_addrtype: output interface limitation not valid in PREROUTING and INPUT [ 1668.838680][ T8970] xt_cgroup: path and classid specified [ 1669.092244][ T8976] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1669.100323][ T42] audit: type=1326 audit(2180.737:1179): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=8975 comm="syz.8.6818" exe="/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf705efec code=0x0 [ 1669.669196][ T42] audit: type=1800 audit(2181.307:1180): pid=8979 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6819" name="pnp_string" dev="configfs" ino=126171 res=0 errno=0 [ 1669.797002][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.799167][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.802381][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.806806][ T8985] smbdirect: ib_dev[syz2]: added: RNIC max_fast_reg_page_list_len=256 device_cap_flags=0x200000 kernel_cap_flags=0x10 page_size_cap=0x1000 [ 1669.811376][ T8985] smbdirect: ib_dev[syz2]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=1 max_cqe=3276800 max_qp_wr=32768 max_send_sge=6 max_recv_sge=6 [ 1669.817283][ T8985] smbdirect: ib_dev[syz2]PORT[1]: iwarp=1 ib=0 roce=0 v1=0 v2=0 core_cap_flags=0x400008 [ 1669.826411][ T8985] infiniband syz2: RDMA CMA: cma_listen_on_dev, error -98 [ 1669.861977][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.865016][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.867777][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.870476][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.873054][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.875849][ T8985] wg2 speed is unknown, defaulting to 1000 [ 1669.886256][ T8987] lo speed is unknown, defaulting to 1000 [ 1669.889057][ T8987] lo speed is unknown, defaulting to 1000 [ 1669.891297][ T8987] lo speed is unknown, defaulting to 1000 [ 1670.027094][ T8986] binder: 8980:8986 ioctl c0306201 80000080 returned -14 [ 1670.070625][ T8987] infiniband sz1: set active [ 1670.076123][ T4848] lo speed is unknown, defaulting to 1000 [ 1670.088090][T28372] usb 6-1: new high-speed USB device number 56 using dummy_hcd [ 1670.108469][ T8987] infiniband sz1: added lo [ 1670.132907][ T8987] smbdirect: ib_dev[sz1]: added: IB_CA max_fast_reg_page_list_len=512 device_cap_flags=0x1c001223c76 kernel_cap_flags=0x14 page_size_cap=0xfffff000 [ 1670.141908][ T8987] smbdirect: ib_dev[sz1]: num_ports=1 max_qp_rd_atom=128 max_qp_init_rd_atom=128 max_sgl_rd=0 max_sge_rd=32 max_cqe=32767 max_qp_wr=1048576 max_send_sge=32 max_recv_sge=32 [ 1670.147405][ T8987] smbdirect: ib_dev[sz1]PORT[1]: iwarp=0 ib=0 roce=1 v1=0 v2=1 core_cap_flags=0x803005 [ 1670.163597][ T8987] RDS/IB: sz1: added [ 1670.165818][ T8987] smc: adding ib device sz1 with port count 1 [ 1670.167927][ T8987] smc: ib device sz1 port 1 has no pnetid [ 1670.170011][ T4848] lo speed is unknown, defaulting to 1000 [ 1670.172491][ T8987] lo speed is unknown, defaulting to 1000 [ 1670.264703][T28372] usb 6-1: Using ep0 maxpacket: 8 [ 1670.267319][ T8987] lo speed is unknown, defaulting to 1000 [ 1670.270423][T28372] usb 6-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1670.276100][T28372] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1670.282131][T28372] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1670.470366][ T8987] lo speed is unknown, defaulting to 1000 [ 1670.536060][ T1566] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1670.548984][ T9004] db_root: cannot be changed because it's in use [ 1670.661970][ T9008] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1670.719554][ T8987] lo speed is unknown, defaulting to 1000 [ 1670.764762][ T1566] Bluetooth: hci1: command 0x0c1a tx timeout [ 1670.764780][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1670.764809][ T4638] Bluetooth: hci6: command 0x0406 tx timeout [ 1670.776042][ T4638] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1670.789154][ T9012] input: syz1 as /devices/virtual/input/input67 [ 1670.805208][ T9012] db_root: cannot be changed because it's in use [ 1670.947394][ T42] audit: type=1800 audit(2182.587:1181): pid=9018 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6829" name="pnp_string" dev="configfs" ino=125510 res=0 errno=0 [ 1670.988977][ T8987] lo speed is unknown, defaulting to 1000 [ 1670.993624][ T9020] IPv6: RTM_NEWROUTE with no NLM_F_CREATE or NLM_F_REPLACE [ 1670.999388][ T9020] IPv6: NLM_F_CREATE should be set when creating new route [ 1671.063494][ T9020] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1671.154276][ T1166] Bluetooth: hci3: Frame reassembly failed (-84) [ 1671.161096][ T8987] lo speed is unknown, defaulting to 1000 [ 1671.165349][ T5911] netdevsim netdevsim8 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1671.175933][ T5911] netdevsim netdevsim8 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1671.182002][ T5911] netdevsim netdevsim8 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1671.185665][ T5911] netdevsim netdevsim8 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1671.544831][ T10] usb 9-1: new high-speed USB device number 49 using dummy_hcd [ 1671.616587][ T9026] Config c/2 of g1 needs at least one function. [ 1671.618880][ T9026] udc dummy_udc.0: failed to start g1: -22 [ 1671.621011][ T9026] configfs-gadget.g1 gadget.0: probe with driver configfs-gadget.g1 failed with error -22 [ 1671.637472][ T9026] UDC core: g1: couldn't find an available UDC or it's busy [ 1671.701008][ T10] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1671.717765][ T10] usb 9-1: config 228 has an invalid interface number: 86 but max is 0 [ 1671.721400][ T10] usb 9-1: config 228 has no interface number 0 [ 1671.726649][ T10] usb 9-1: config 228 interface 86 has no altsetting 0 [ 1671.737112][ T10] usb 9-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1671.741696][ T10] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1671.745210][ T10] usb 9-1: Product: syz [ 1671.747132][ T10] usb 9-1: Manufacturer: syz [ 1671.749098][ T10] usb 9-1: SerialNumber: syz [ 1672.285079][ T1483] usb 46-1: device descriptor read/8, error -110 [ 1672.677060][ T1483] usb usb46-port1: attempt power cycle [ 1672.679937][ T10] usbhid 9-1:228.86: couldn't find an input interrupt endpoint [ 1672.693778][ T10] usb 9-1: USB disconnect, device number 49 [ 1672.802388][ T5887] usb 6-1: USB disconnect, device number 56 [ 1672.911731][ T4665] Bluetooth: hci1: unexpected subevent 0x1a length: 30 > 6 [ 1673.050089][ T42] audit: type=1800 audit(2184.687:1182): pid=9042 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6838" name="pnp_string" dev="configfs" ino=125648 res=0 errno=0 [ 1673.122875][ T9044] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1673.128201][ T9044] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1673.131041][ T9044] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1673.134483][ T9044] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1673.148469][ T4665] Bluetooth: hci1: unexpected event for opcode 0x0809 [ 1673.157539][ T9047] input: syz1 as /devices/virtual/input/input68 [ 1673.165289][ T4638] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1673.175433][ T4665] Bluetooth: hci3: command 0x1003 tx timeout [ 1673.193123][ T9047] db_root: cannot be changed because it's in use [ 1673.248479][ T1483] usb usb46-port1: unable to enumerate USB device [ 1673.551186][ T42] audit: type=1804 audit(2185.187:1183): pid=9057 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.6842" name="bus" dev="ramfs" ino=125738 res=1 errno=0 [ 1673.603177][ T42] audit: type=1804 audit(2185.187:1184): pid=9057 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.6842" name="bus" dev="ramfs" ino=125738 res=1 errno=0 [ 1673.638365][ T4665] Bluetooth: hci6: unexpected event for opcode 0x4ad0 [ 1673.667029][ T4665] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1673.674062][ T9060] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1673.744562][ T4665] Bluetooth: hci1: unexpected subevent 0x1a length: 30 > 6 [ 1673.934981][ T42] audit: type=1800 audit(2185.567:1185): pid=9069 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6848" name="pnp_string" dev="configfs" ino=126599 res=0 errno=0 [ 1674.109464][ T9073] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1674.113330][ T9073] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1674.117091][ T9073] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1674.120729][ T9073] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1674.384755][ T5887] usb 13-1: new high-speed USB device number 21 using dummy_hcd [ 1674.406344][ T4665] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1674.446192][ T4665] Bluetooth: hci6: unexpected subevent 0x1a length: 30 > 6 [ 1674.514702][ T42] audit: type=1800 audit(2186.147:1186): pid=9092 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.6857" name="pnp_string" dev="configfs" ino=125791 res=0 errno=0 [ 1674.543277][ T5887] usb 13-1: unable to get BOS descriptor or descriptor too short [ 1674.550469][ T5887] usb 13-1: config 228 has an invalid interface number: 86 but max is 0 [ 1674.557897][ T5887] usb 13-1: config 228 has no interface number 0 [ 1674.565457][ T5887] usb 13-1: config 228 interface 86 has no altsetting 0 [ 1674.579240][ T5887] usb 13-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1674.587717][ T5887] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1674.593730][ T5887] usb 13-1: Product: syz [ 1674.597273][ T5887] usb 13-1: Manufacturer: syz [ 1674.601243][ T5887] usb 13-1: SerialNumber: syz [ 1674.623977][ T9094] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1674.629305][ T9094] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1674.633193][ T9094] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1674.638811][ T9094] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1674.838349][ T9108] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1674.878723][ T9107] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1674.978303][ T9113] gretap1: entered promiscuous mode [ 1675.373490][ T5887] usbhid 13-1:228.86: couldn't find an input interrupt endpoint [ 1675.386940][ T5887] usb 13-1: USB disconnect, device number 21 [ 1675.445845][ T4665] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1675.515526][ T4665] Bluetooth: hci6: unexpected subevent 0x1a length: 30 > 6 [ 1675.643453][ T42] audit: type=1800 audit(2187.277:1187): pid=9127 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.2.6867" name="pnp_string" dev="configfs" ino=125932 res=0 errno=0 [ 1675.800756][ T9129] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1675.805283][ T9129] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1675.810681][ T9129] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1675.814376][ T9129] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1675.942133][ T4665] Bluetooth: hci6: unexpected event for opcode 0x4ad0 [ 1675.948305][ T9143] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1676.166862][ T1483] usb 6-1: new full-speed USB device number 57 using dummy_hcd [ 1676.359187][ T1483] usb 6-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1676.362598][ T1483] usb 6-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1676.365748][ T1483] usb 6-1: Product: syz [ 1676.367409][ T1483] usb 6-1: Manufacturer: syz [ 1676.369277][ T1483] usb 6-1: SerialNumber: syz [ 1676.373614][ T1483] usb 6-1: config 0 descriptor?? [ 1676.555351][ T5887] usb 7-1: new full-speed USB device number 89 using dummy_hcd [ 1676.570239][ T9160] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1676.573248][ T9160] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1676.576720][ T9160] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1676.579638][ T9160] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1676.584844][T28372] usb 6-1: USB disconnect, device number 57 [ 1676.636202][ T1483] usb 9-1: new high-speed USB device number 50 using dummy_hcd [ 1676.708381][ T5887] usb 7-1: New USB device found, idVendor=1604, idProduct=8007, bcdDevice=af.a6 [ 1676.712185][ T5887] usb 7-1: New USB device strings: Mfr=1, Product=23, SerialNumber=3 [ 1676.716628][ T5887] usb 7-1: Product: syz [ 1676.718413][ T5887] usb 7-1: Manufacturer: syz [ 1676.720019][ T5887] usb 7-1: SerialNumber: syz [ 1676.723755][ T5887] usb 7-1: config 0 descriptor?? [ 1676.794759][ T1483] usb 9-1: Using ep0 maxpacket: 8 [ 1676.798169][ T1483] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1676.801508][ T1483] usb 9-1: config 0 has no interfaces? [ 1676.805344][ T1483] usb 9-1: New USB device found, idVendor=0582, idProduct=0025, bcdDevice= 0.40 [ 1676.808387][ T1483] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1676.811034][ T1483] usb 9-1: Product: syz [ 1676.812533][ T1483] usb 9-1: Manufacturer: syz [ 1676.814196][ T1483] usb 9-1: SerialNumber: syz [ 1676.817841][ T1483] usb 9-1: config 0 descriptor?? [ 1676.935047][ T9156] netlink: 12 bytes leftover after parsing attributes in process `syz.2.6878'. [ 1676.940299][ T1483] usb 7-1: USB disconnect, device number 89 [ 1677.541699][ T4665] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1677.547240][ T9174] input: syz1 as /devices/virtual/input/input69 [ 1677.558996][ T9174] db_root: cannot be changed because it's in use [ 1677.566966][ T1483] usb 6-1: new high-speed USB device number 58 using dummy_hcd [ 1677.570059][ T4665] Bluetooth: hci2: unexpected subevent 0x1a length: 30 > 6 [ 1677.678094][ T9179] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1677.737501][ T1483] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1677.741850][ T1483] usb 6-1: config 228 has an invalid interface number: 86 but max is 0 [ 1677.744573][ T1483] usb 6-1: config 228 has no interface number 0 [ 1677.747051][ T1483] usb 6-1: config 228 interface 86 has no altsetting 0 [ 1677.752720][ T1483] usb 6-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1677.758040][ T1483] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1677.760790][ T1483] usb 6-1: Product: syz [ 1677.762289][ T1483] usb 6-1: Manufacturer: syz [ 1677.763854][ T1483] usb 6-1: SerialNumber: syz [ 1678.115741][ T1483] usbhid 6-1:228.86: couldn't find an input interrupt endpoint [ 1678.124120][ T1483] usb 6-1: USB disconnect, device number 58 [ 1678.390091][ T9187] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1678.393065][ T9187] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1678.396584][ T9187] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1678.399581][ T9187] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1678.749427][ T9207] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1678.840933][ T4665] Bluetooth: hci1: unexpected subevent 0x1a length: 30 > 6 [ 1679.140452][ T4665] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1679.162373][ T9217] input: syz1 as /devices/virtual/input/input70 [ 1679.179585][ T9217] db_root: cannot be changed because it's in use [ 1679.193110][ T1483] usb 9-1: USB disconnect, device number 50 [ 1679.315210][ T9219] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1679.318121][ T9219] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1679.321005][ T9219] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1679.323827][ T9219] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1679.580055][ T4665] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1679.631289][ T9227] input: syz1 as /devices/virtual/input/input71 [ 1679.642162][ T9227] db_root: cannot be changed because it's in use [ 1679.647040][ T9228] ptrace attach of ""[9229] was attempted by "/syz-executor exec"[9228] [ 1680.181681][ T9231] syz.1.6901 (9231): drop_caches: 2 [ 1680.315984][ T5887] usb 13-1: new high-speed USB device number 22 using dummy_hcd [ 1680.470261][ T5887] usb 13-1: unable to get BOS descriptor or descriptor too short [ 1680.484488][ T5887] usb 13-1: config 228 has an invalid interface number: 86 but max is 0 [ 1680.493888][ T5887] usb 13-1: config 228 has no interface number 0 [ 1680.505900][ T5887] usb 13-1: config 228 interface 86 has no altsetting 0 [ 1680.518611][ T5887] usb 13-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1680.530111][ T5887] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1680.540939][ T5887] usb 13-1: Product: syz [ 1680.543198][ T5887] usb 13-1: Manufacturer: syz [ 1680.550033][ T5887] usb 13-1: SerialNumber: syz [ 1680.551982][ T4665] Bluetooth: hci6: unexpected subevent 0x1a length: 30 > 6 [ 1680.776500][ T1442] ieee802154 phy1 wpan1: encryption failed: -22 [ 1681.135139][ T1483] usb 7-1: new high-speed USB device number 90 using dummy_hcd [ 1681.334770][ T4665] Bluetooth: hci1: command 0x0c1a tx timeout [ 1681.336763][ T4665] Bluetooth: hci7: command 0x0c1a tx timeout [ 1681.338676][ T4665] Bluetooth: hci2: command 0x0c1a tx timeout [ 1681.376948][ T1483] usb 7-1: Using ep0 maxpacket: 8 [ 1681.390275][ T1483] usb 7-1: config 179 has an invalid interface number: 65 but max is 0 [ 1681.399843][ T1483] usb 7-1: config 179 has no interface number 0 [ 1681.411088][ T1483] usb 7-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1681.423907][ T1483] usb 7-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1681.434759][T28372] usb 6-1: new high-speed USB device number 59 using dummy_hcd [ 1681.440949][ T1483] usb 7-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1681.452766][ T1483] usb 7-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1681.461921][ T1483] usb 7-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1681.474375][ T1483] usb 7-1: config 179 interface 65 has no altsetting 0 [ 1681.479283][ T1483] usb 7-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1681.490296][ T1483] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1681.594955][T28372] usb 6-1: Using ep0 maxpacket: 8 [ 1681.605740][T28372] usb 6-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1681.616836][T28372] usb 6-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1681.619812][ T1483] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:179.65/input/input72 [ 1681.624456][T28372] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1682.237395][ T9260] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1682.303449][ T9257] netlink: 4 bytes leftover after parsing attributes in process `syz.2.6906'. [ 1682.351446][ T9262] binder: 9243:9262 ioctl c0306201 80000080 returned -14 [ 1682.666227][ T5887] usbhid 13-1:228.86: couldn't find an input interrupt endpoint [ 1682.705678][ T5887] usb 13-1: USB disconnect, device number 22 [ 1682.966272][ T4848] usb 7-1: USB disconnect, device number 90 [ 1682.966357][ C0] xpad 7-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1683.596613][ T4638] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1683.603822][ T9275] input: syz1 as /devices/virtual/input/input73 [ 1683.620234][ T9275] db_root: cannot be changed because it's in use [ 1683.969646][ T9277] bridge_slave_0: left allmulticast mode [ 1683.972265][ T9277] bridge_slave_0: left promiscuous mode [ 1683.975485][ T9277] bridge0: port 1(bridge_slave_0) entered disabled state [ 1683.981835][ T9277] bridge_slave_1: left allmulticast mode [ 1683.984327][ T9277] bridge_slave_1: left promiscuous mode [ 1683.988280][ T9277] bridge0: port 2(bridge_slave_1) entered disabled state [ 1683.998107][ T9277] bond0: (slave bond_slave_0): Releasing backup interface [ 1684.006140][ T9277] bond0: (slave bond_slave_1): Releasing backup interface [ 1684.024058][ T9278] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6911'. [ 1684.026844][ T9277] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1684.027967][ T9278] netlink: 4 bytes leftover after parsing attributes in process `syz.4.6911'. [ 1684.030813][ T9277] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1684.041034][ T9277] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1684.044107][ T9277] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1684.050973][ T9277] A link change request failed with some changes committed already. Interface hsr_slave_0 may have been left with an inconsistent configuration, please check. [ 1684.058985][ T4848] lo speed is unknown, defaulting to 1000 [ 1684.061460][ T43] wg2 speed is unknown, defaulting to 1000 [ 1684.190548][ T4848] usb 6-1: USB disconnect, device number 59 [ 1684.245719][ T4638] Bluetooth: hci2: unexpected subevent 0x1a length: 30 > 6 [ 1684.301456][ T9291] misc userio: Can't change port type on an already running userio instance [ 1684.359129][ T9295] openvswitch: netlink: Missing key (keys=40, expected=100) [ 1684.368835][ T9295] fuse: fd is not a fuse device [ 1684.466136][ T9302] fuse: fd is not a fuse device [ 1684.764717][ T10] usb 7-1: new high-speed USB device number 91 using dummy_hcd [ 1684.985774][ T10] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1684.989719][ T10] usb 7-1: config 0 has 0 interfaces, different from the descriptor's value: 1 [ 1685.001411][ T10] usb 7-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1685.005327][ T10] usb 7-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1685.007993][ T10] usb 7-1: Product: syz [ 1685.009395][ T10] usb 7-1: Manufacturer: syz [ 1685.013577][ T10] usb 7-1: config 0 descriptor?? [ 1685.705655][T31373] usb 9-1: new high-speed USB device number 51 using dummy_hcd [ 1685.874973][T31373] usb 9-1: Using ep0 maxpacket: 8 [ 1685.878804][T31373] usb 9-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1685.882743][T31373] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1685.890301][T31373] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1686.552385][ T10] usb 7-1: USB disconnect, device number 91 [ 1686.636359][ T9318] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1688.064488][ T4638] Bluetooth: hci2: unexpected subevent 0x1a length: 30 > 6 [ 1688.576428][ T9340] [U] ]4 [ 1688.577388][ T9340] [U] #iqVi-롉JZ [ 1688.578898][ T9340] [U] IIP~-) [ 1688.580133][ T9340] [U] Z;كQ-Dٱ#XnuSYܼ'G=!FŖo$r"i%8G^Giסdj}Dz*0U]Cb`޷ڮF= qȟ:yWBzB~Kp1}\a^6q&28S [ 1688.585029][ T9340] [U] B>4Ё4@".'4M}b-'ߨʣ5,N[C5e;cZ[ #Hۺk(J`FI/XA3-jHjJ5M0VN£`))sڌj@C [ 1688.589027][ T9340] [U] $TJӫ⤎RvAGO /c"&w{M5a+y] [ 1688.736622][ T9340] zram0: detected capacity change from 8 to 0 [ 1688.845537][ T4805] usb 13-1: new high-speed USB device number 23 using dummy_hcd [ 1688.889213][ T4848] usb 9-1: USB disconnect, device number 51 [ 1689.005317][ T4805] usb 13-1: too many configurations: 9, using maximum allowed: 8 [ 1689.308926][ T4638] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1689.314265][ T9362] db_root: cannot be changed because it's in use [ 1689.908062][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.064713][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.074744][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.079112][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.083613][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.087499][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.091398][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.104239][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.117500][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.130672][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.141013][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.149626][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.160206][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.174336][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.184367][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.196889][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.210383][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.232524][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.252676][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.269911][ T9368] netlink: 'syz.4.6937': attribute type 1 has an invalid length. [ 1690.281333][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.296806][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.316820][ T4805] usb 13-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1690.331382][ T4805] usb 13-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1690.346615][ T4805] usb 13-1: config 0 interface 0 has no altsetting 0 [ 1690.466514][ T9368] bond2: entered promiscuous mode [ 1690.480543][ T4805] usb 13-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1690.504721][ T9368] bond2: entered allmulticast mode [ 1690.514321][ T4805] usb 13-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1690.519926][ T9368] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1690.544053][ T4805] usb 13-1: Product: syz [ 1690.557777][ T4805] usb 13-1: Manufacturer: syz [ 1690.571864][ T4805] usb 13-1: SerialNumber: syz [ 1690.591283][ T9373] erspan1: entered allmulticast mode [ 1690.594584][ T4805] usb 13-1: config 0 descriptor?? [ 1690.637459][ T4805] yurex 13-1:0.0: Could not find endpoints [ 1690.653755][ T9373] bond2: (slave erspan1): making interface the new active one [ 1690.676770][ T9373] erspan1: entered promiscuous mode [ 1690.690930][ T9373] bond2: (slave erspan1): Enslaving as an active interface with an up link [ 1690.755825][T31373] usb 6-1: new high-speed USB device number 60 using dummy_hcd [ 1690.975161][ T9366] Process accounting resumed [ 1691.074741][T31373] usb 6-1: Using ep0 maxpacket: 8 [ 1691.175243][ T9376] syzkaller1: entered promiscuous mode [ 1691.188107][ T9376] syzkaller1: entered allmulticast mode [ 1691.272754][ T9376] wg2 speed is unknown, defaulting to 1000 [ 1691.294803][ T43] usb 9-1: new high-speed USB device number 52 using dummy_hcd [ 1691.302061][ T9376] lo speed is unknown, defaulting to 1000 [ 1691.464780][ T43] usb 9-1: Using ep0 maxpacket: 8 [ 1691.470984][ T43] usb 9-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1691.480763][ T43] usb 9-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1691.489323][ T43] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1691.933368][ T9398] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1692.474179][T31373] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1692.476986][ T43] usb 13-1: USB disconnect, device number 23 [ 1692.477627][T31373] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 1692.482039][T31373] usb 6-1: can't read configurations, error -71 [ 1693.154881][ T9409] netlink: 'syz.1.6945': attribute type 1 has an invalid length. [ 1693.171030][ T9409] netlink: 28 bytes leftover after parsing attributes in process `syz.1.6945'. [ 1693.190380][ T9409] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6945'. [ 1693.205155][ T9409] netlink: 4 bytes leftover after parsing attributes in process `syz.1.6945'. [ 1693.676989][ T9412] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1694.017892][ T4638] Bluetooth: hci1: unexpected event for opcode 0x0809 [ 1694.020819][ T9417] input: syz1 as /devices/virtual/input/input75 [ 1694.063229][ T43] usb 9-1: USB disconnect, device number 52 [ 1694.068805][ T9417] db_root: cannot be changed because it's in use [ 1694.120613][ T9419] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1694.127317][ T9419] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1694.137305][ T9419] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1694.146429][ T9419] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1694.656391][T28372] usb 7-1: new high-speed USB device number 92 using dummy_hcd [ 1694.840135][T28372] usb 7-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 1694.871458][T28372] usb 7-1: New USB device found, idVendor=0525, idProduct=127a, bcdDevice= 1.00 [ 1694.891251][T28372] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=0 [ 1694.905789][T28372] usb 7-1: Product: syz [ 1694.915971][T28372] usb 7-1: Manufacturer: syz [ 1694.941956][T28372] usb_debug 7-1:1.0: debug converter detected [ 1694.971302][T28372] usb 7-1: debug converter now attached to ttyUSB0 [ 1695.165739][ T9444] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1695.187211][ T9444] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1695.198561][ T9444] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1695.216240][ T9444] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1695.240261][ T43] usb 7-1: USB disconnect, device number 92 [ 1695.268831][ T43] debug ttyUSB0: debug converter now disconnected from ttyUSB0 [ 1695.289862][ T43] usb_debug 7-1:1.0: device disconnected [ 1695.639789][ T42] audit: type=1804 audit(2207.267:1188): pid=9449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.4.6956" name="bus" dev="ramfs" ino=129168 res=1 errno=0 [ 1695.654250][ T42] audit: type=1804 audit(2207.267:1189): pid=9449 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.4.6956" name="bus" dev="ramfs" ino=129168 res=1 errno=0 [ 1695.890920][ T9452] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1696.008243][ T4638] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1696.014481][ T9458] input: syz1 as /devices/virtual/input/input76 [ 1696.040223][ T9458] db_root: cannot be changed because it's in use [ 1696.144765][ T4805] usb 7-1: new high-speed USB device number 93 using dummy_hcd [ 1696.294700][ T4805] usb 7-1: Using ep0 maxpacket: 8 [ 1696.299677][ T4805] usb 7-1: config 179 has an invalid descriptor of length 0, skipping remainder of the config [ 1696.306288][ T4805] usb 7-1: New USB device found, idVendor=12ab, idProduct=90a3, bcdDevice=1e.eb [ 1696.314905][ T4805] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1696.533717][ T9463] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1696.541361][ T9463] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1696.545149][ T9463] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1696.553681][ T9463] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1696.664534][ T9465] i801_smbus 0000:00:1f.3: SMBus is busy, can't use it! [ 1696.912397][ T9476] netlink: 8 bytes leftover after parsing attributes in process `syz.1.6964'. [ 1696.960103][ T9477] program syz.4.6963 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1697.265646][ T42] audit: type=1800 audit(2208.907:1190): pid=9482 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.8.6966" name="pnp_string" dev="configfs" ino=128911 res=0 errno=0 [ 1697.940435][ T9494] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1697.948043][ T9494] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1697.954960][ T9494] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1697.960859][ T9494] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1698.012317][ T9500] binder: 9485:9500 ioctl c0306201 80000080 returned -14 [ 1698.455459][ T4638] Bluetooth: hci1: unexpected event for opcode 0x0809 [ 1698.462915][ T9507] input: syz1 as /devices/virtual/input/input77 [ 1698.493585][ T9507] db_root: cannot be changed because it's in use [ 1698.977573][ T4805] usb 7-1: USB disconnect, device number 93 [ 1699.063609][ T9516] wg2 speed is unknown, defaulting to 1000 [ 1699.067168][ T9516] lo speed is unknown, defaulting to 1000 [ 1699.227149][ T4638] Bluetooth: hci6: unexpected subevent 0x1a length: 30 > 6 [ 1699.289889][ T9523] program syz.4.6977 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1699.872150][ T9534] input: syz1 as /devices/virtual/input/input78 [ 1699.894063][ T9534] db_root: cannot be changed because it's in use [ 1700.004925][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1700.007678][ T4638] Bluetooth: hci6: command 0x0406 tx timeout [ 1700.010154][ T4638] Bluetooth: hci2: command 0x0c1a tx timeout [ 1700.282810][ T9538] syzkaller0: entered promiscuous mode [ 1700.287797][ T9538] syzkaller0: entered allmulticast mode [ 1700.944900][ T4805] usb 7-1: new full-speed USB device number 94 using dummy_hcd [ 1701.116887][ T4805] usb 7-1: config 0 has an invalid interface number: 8 but max is 0 [ 1701.126756][ T4805] usb 7-1: config 0 has no interface number 0 [ 1701.140106][ T4805] usb 7-1: config 0 interface 8 altsetting 0 has an endpoint descriptor with address 0x9F, changing to 0x8F [ 1701.173615][ T4805] usb 7-1: config 0 interface 8 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1701.221261][ T4805] usb 7-1: config 0 interface 8 altsetting 0 endpoint 0x8F has invalid wMaxPacketSize 0 [ 1701.239659][ T4805] usb 7-1: New USB device found, idVendor=0d8c, idProduct=000e, bcdDevice=8e.8f [ 1701.247717][ T4805] usb 7-1: New USB device strings: Mfr=0, Product=24, SerialNumber=3 [ 1701.254132][ T4805] usb 7-1: Product: syz [ 1701.259743][ T4805] usb 7-1: SerialNumber: syz [ 1701.289537][ T4805] usb 7-1: config 0 descriptor?? [ 1701.318488][ T4805] cm109 7-1:0.8: invalid payload size 0, expected 4 [ 1701.342193][ T4805] input: CM109 USB driver as /devices/platform/dummy_hcd.2/usb7/7-1/7-1:0.8/input/input79 [ 1701.753703][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.760752][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.763505][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.766185][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.768501][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.770942][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.773538][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.776184][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.778637][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.781169][ C0] cm109 7-1:0.8: cm109_urb_ctl_callback: urb status -71 [ 1701.784555][ T10] usb 7-1: USB disconnect, device number 94 [ 1701.786951][ C0] cm109 7-1:0.8: cm109_submit_buzz_toggle: usb_submit_urb (urb_ctl) failed -19 [ 1701.840975][ T10] cm109 7-1:0.8: cm109_toggle_buzzer_sync: usb_control_msg() failed -19 [ 1701.850484][ T9556] binder: BINDER_SET_CONTEXT_MGR already set [ 1701.869216][ T9556] binder: 9555:9556 ioctl 4018620d 80000300 returned -16 [ 1701.949341][ T9559] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1702.073671][ T9562] binder: 9548:9562 ioctl c0306201 80000080 returned -14 [ 1702.470133][ T9568] input: syz1 as /devices/virtual/input/input80 [ 1702.518650][ T9568] db_root: cannot be changed because it's in use [ 1702.652135][ T42] audit: type=1804 audit(2214.287:1191): pid=9573 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.6996" name="bus" dev="ramfs" ino=130466 res=1 errno=0 [ 1702.677445][ T42] audit: type=1804 audit(2214.297:1192): pid=9573 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.6996" name="bus" dev="ramfs" ino=130466 res=1 errno=0 [ 1702.750622][ T9578] netlink: 8 bytes leftover after parsing attributes in process `syz.4.6997'. [ 1702.888675][ T9579] syzkaller1: entered promiscuous mode [ 1702.892888][ T9579] syzkaller1: entered allmulticast mode [ 1704.003169][ T9607] binder: 9593:9607 ioctl c0306201 80000080 returned -14 [ 1704.251657][ T9615] input: syz1 as /devices/virtual/input/input81 [ 1704.269309][ T9615] db_root: cannot be changed because it's in use [ 1704.531845][ T9620] gadgetfs: bound to dummy_udc driver [ 1704.598263][ T9626] FAULT_INJECTION: forcing a failure. [ 1704.598263][ T9626] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1704.614020][ T9626] CPU: 2 UID: 0 PID: 9626 Comm: syz.1.7009 Tainted: G L syzkaller #0 PREEMPT(full) [ 1704.614041][ T9626] Tainted: [L]=SOFTLOCKUP [ 1704.614045][ T9626] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1704.614052][ T9626] Call Trace: [ 1704.614057][ T9626] [ 1704.614062][ T9626] dump_stack_lvl+0x100/0x190 [ 1704.614081][ T9626] should_fail_ex.cold+0x5/0xa [ 1704.614095][ T9626] _copy_from_user+0x2e/0xd0 [ 1704.614113][ T9626] kstrtouint_from_user+0xd6/0x1d0 [ 1704.614126][ T9626] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1704.614139][ T9626] ? __lock_acquire+0x49f/0x1a40 [ 1704.614162][ T9626] proc_fail_nth_write+0x83/0x220 [ 1704.614179][ T9626] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1704.614198][ T9626] vfs_write+0x2aa/0x1050 [ 1704.614209][ T9626] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1704.614226][ T9626] ? __pfx_vfs_write+0x10/0x10 [ 1704.614235][ T9626] ? find_held_lock+0x2b/0x80 [ 1704.614248][ T9626] ? __fget_files+0x215/0x3d0 [ 1704.614262][ T9626] ? __fget_files+0x21f/0x3d0 [ 1704.614276][ T9626] ksys_write+0x12a/0x250 [ 1704.614286][ T9626] ? __pfx_ksys_write+0x10/0x10 [ 1704.614301][ T9626] do_int80_emulation+0x14b/0x720 [ 1704.614317][ T9626] asm_int80_emulation+0x1a/0x20 [ 1704.614329][ T9626] RIP: 0023:0xf71b73eb [ 1704.614339][ T9626] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1704.614350][ T9626] RSP: 002b:00000000f544c4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000004 [ 1704.614362][ T9626] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000f544c5d0 [ 1704.614369][ T9626] RDX: 0000000000000001 RSI: 0000000000000000 RDI: 0000000000000000 [ 1704.614375][ T9626] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1704.614381][ T9626] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1704.614387][ T9626] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1704.614401][ T9626] [ 1704.743762][ T9632] binder: BINDER_SET_CONTEXT_MGR already set [ 1704.752623][ T9632] binder: 9630:9632 ioctl 4018620d 80000300 returned -16 [ 1704.818567][ T42] audit: type=1804 audit(2216.457:1193): pid=9637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.2.7012" name="bus" dev="ramfs" ino=129549 res=1 errno=0 [ 1704.835163][ T43] usb 5-1: new full-speed USB device number 50 using dummy_hcd [ 1704.837828][T28372] usb 9-1: new high-speed USB device number 53 using dummy_hcd [ 1704.840517][ C2] gadgetfs: connected [ 1704.842000][ T43] gadgetfs: disconnected [ 1704.994776][T28372] usb 9-1: Using ep0 maxpacket: 32 [ 1704.996497][ C2] gadgetfs: connected [ 1705.004489][ T43] usb 5-1: config 1 has 0 interfaces, different from the descriptor's value: 1 [ 1705.007641][ T43] usb 5-1: New USB device found, idVendor=0525, idProduct=a4a0, bcdDevice= 1.00 [ 1705.010778][ T43] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1705.015507][T28372] usb 9-1: config 0 has no interfaces? [ 1705.018924][T28372] usb 9-1: New USB device found, idVendor=12d8, idProduct=0001, bcdDevice=de.79 [ 1705.021946][T28372] usb 9-1: New USB device strings: Mfr=1, Product=236, SerialNumber=2 [ 1705.032428][T28372] usb 9-1: Product: syz [ 1705.033868][T28372] usb 9-1: Manufacturer: syz [ 1705.035580][T28372] usb 9-1: SerialNumber: syz [ 1705.114417][ T42] audit: type=1804 audit(2216.457:1194): pid=9637 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.2.7012" name="bus" dev="ramfs" ino=129549 res=1 errno=0 [ 1705.114941][T28372] usb 9-1: config 0 descriptor?? [ 1705.123503][ T43] usb 5-1: Device is not authorized for usage [ 1705.333006][ T9625] gadgetfs: suspended from state 3 [ 1705.335354][ T9625] gadgetfs: disconnected [ 1705.337636][T28372] usb 5-1: USB disconnect, device number 50 [ 1705.400384][ T4805] usb 9-1: USB disconnect, device number 53 [ 1705.571669][ T9664] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1705.573948][ T9664] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1705.577583][ T9664] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1705.579836][ T9664] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1705.790712][ T9670] vhci_hcd vhci_hcd.0: pdev(1) rhport(0) sockfd(6) [ 1705.793290][ T9670] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1705.802457][ T9670] vhci_hcd vhci_hcd.0: Device attached [ 1705.974821][ T10] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1706.000350][ T9674] input: syz1 as /devices/virtual/input/input82 [ 1706.015027][ T9674] db_root: cannot be changed because it's in use [ 1706.038445][ T10] usb 39-1: new full-speed USB device number 3 using vhci_hcd [ 1706.045355][ T4805] usb 6-1: new low-speed USB device number 62 using dummy_hcd [ 1706.196167][ T4805] usb 6-1: config 0 has no interfaces? [ 1706.198447][ T4805] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1706.205619][ T4805] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1706.214069][ T4805] usb 6-1: config 0 descriptor?? [ 1706.424384][ T9671] vhci_hcd: cannot find a urb of seqnum 1 max seqnum 2 [ 1706.434341][ T4805] usb 6-1: USB disconnect, device number 62 [ 1706.442508][ T4835] vhci_hcd vhci_hcd.1: stop threads [ 1706.444354][ T4835] vhci_hcd vhci_hcd.1: release socket [ 1706.458415][ T4835] vhci_hcd vhci_hcd.1: disconnect device [ 1707.052669][ T9693] binder: 9679:9693 ioctl c0306201 80000080 returned -14 [ 1707.237158][ T9702] FAULT_INJECTION: forcing a failure. [ 1707.237158][ T9702] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1707.241359][ T9702] CPU: 2 UID: 0 PID: 9702 Comm: syz.2.7025 Tainted: G L syzkaller #0 PREEMPT(full) [ 1707.241376][ T9702] Tainted: [L]=SOFTLOCKUP [ 1707.241381][ T9702] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1707.241388][ T9702] Call Trace: [ 1707.241393][ T9702] [ 1707.241407][ T9702] dump_stack_lvl+0x100/0x190 [ 1707.241428][ T9702] should_fail_ex.cold+0x5/0xa [ 1707.241441][ T9702] _copy_to_user+0x32/0xd0 [ 1707.241460][ T9702] simple_read_from_buffer+0xcb/0x170 [ 1707.241480][ T9702] proc_fail_nth_read+0x1af/0x230 [ 1707.241496][ T9702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1707.241511][ T9702] ? rw_verify_area+0xce/0x6d0 [ 1707.241527][ T9702] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1707.241542][ T9702] vfs_read+0x1e4/0xb40 [ 1707.241553][ T9702] ? __pfx_vfs_read+0x10/0x10 [ 1707.241562][ T9702] ? find_held_lock+0x2b/0x80 [ 1707.241578][ T9702] ? __fget_files+0x215/0x3d0 [ 1707.241591][ T9702] ? __fget_files+0x21f/0x3d0 [ 1707.241605][ T9702] ksys_read+0x12a/0x250 [ 1707.241615][ T9702] ? __pfx_ksys_read+0x10/0x10 [ 1707.241629][ T9702] do_int80_emulation+0x14b/0x720 [ 1707.241645][ T9702] asm_int80_emulation+0x1a/0x20 [ 1707.241657][ T9702] RIP: 0023:0xf71873eb [ 1707.241671][ T9702] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1707.241682][ T9702] RSP: 002b:00000000f54464bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1707.241693][ T9702] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54465d0 [ 1707.241700][ T9702] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1707.241706][ T9702] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1707.241712][ T9702] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1707.241719][ T9702] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1707.241732][ T9702] [ 1707.393696][ T9704] fuse: fd is not a fuse device [ 1707.443426][ T42] audit: type=1804 audit(2219.077:1195): pid=9711 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.7027" name="bus" dev="ramfs" ino=129635 res=1 errno=0 [ 1707.449468][ T9704] netlink: 120 bytes leftover after parsing attributes in process `syz.1.7026'. [ 1707.468726][ T42] audit: type=1804 audit(2219.077:1196): pid=9711 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.7027" name="bus" dev="ramfs" ino=129635 res=1 errno=0 [ 1707.523645][ T4665] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1707.558706][ T9715] input: syz1 as /devices/virtual/input/input83 [ 1707.564860][ T4665] Bluetooth: hci2: command 0x0c1a tx timeout [ 1707.592354][ T9715] db_root: cannot be changed because it's in use [ 1707.645390][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1707.647472][ T4665] Bluetooth: hci1: command 0x0c1a tx timeout [ 1707.911827][ T9722] FAULT_INJECTION: forcing a failure. [ 1707.911827][ T9722] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1707.921657][ T9722] CPU: 2 UID: 0 PID: 9722 Comm: syz.1.7031 Tainted: G L syzkaller #0 PREEMPT(full) [ 1707.921677][ T9722] Tainted: [L]=SOFTLOCKUP [ 1707.921681][ T9722] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1707.921688][ T9722] Call Trace: [ 1707.921693][ T9722] [ 1707.921698][ T9722] dump_stack_lvl+0x100/0x190 [ 1707.921717][ T9722] should_fail_ex.cold+0x5/0xa [ 1707.921730][ T9722] _copy_to_user+0x32/0xd0 [ 1707.921750][ T9722] simple_read_from_buffer+0xcb/0x170 [ 1707.921774][ T9722] proc_fail_nth_read+0x1af/0x230 [ 1707.921791][ T9722] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1707.921807][ T9722] ? rw_verify_area+0xce/0x6d0 [ 1707.921823][ T9722] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1707.921837][ T9722] vfs_read+0x1e4/0xb40 [ 1707.921849][ T9722] ? __pfx_vfs_read+0x10/0x10 [ 1707.921859][ T9722] ? find_held_lock+0x2b/0x80 [ 1707.921873][ T9722] ? __fget_files+0x215/0x3d0 [ 1707.921886][ T9722] ? __fget_files+0x21f/0x3d0 [ 1707.921900][ T9722] ksys_read+0x12a/0x250 [ 1707.921910][ T9722] ? __pfx_ksys_read+0x10/0x10 [ 1707.921924][ T9722] do_int80_emulation+0x14b/0x720 [ 1707.921941][ T9722] asm_int80_emulation+0x1a/0x20 [ 1707.921952][ T9722] RIP: 0023:0xf71b73eb [ 1707.921963][ T9722] Code: 57 56 53 8b 44 24 14 f6 00 08 75 23 8b 44 24 18 8b 5c 24 1c 8b 4c 24 20 8b 54 24 24 8b 74 24 28 8b 7c 24 2c 8b 6c 24 30 cd 80 <5b> 5e 5f 5d c3 5b 5e 5f 5d e9 f7 a1 ff ff 66 90 66 90 66 90 90 53 [ 1707.921974][ T9722] RSP: 002b:00000000f546d4bc EFLAGS: 00000246 ORIG_RAX: 0000000000000003 [ 1707.921986][ T9722] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f546d5d0 [ 1707.921993][ T9722] RDX: 000000000000000f RSI: 0000000000000000 RDI: 0000000000000000 [ 1707.922000][ T9722] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1707.922006][ T9722] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1707.922012][ T9722] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1707.922026][ T9722] [ 1708.224704][T28372] usb 9-1: new high-speed USB device number 54 using dummy_hcd [ 1708.407459][T28372] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1708.410539][T28372] usb 9-1: config 1 interface 0 altsetting 0 bulk endpoint 0x1 has invalid maxpacket 0 [ 1708.422098][T28372] usb 9-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1708.433538][ T9732] binder: 9730:9732 ioctl c0306201 80000080 returned -14 [ 1708.441414][T28372] usb 9-1: New USB device found, idVendor=0525, idProduct=a4a8, bcdDevice= 0.40 [ 1708.446954][T28372] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1708.458714][T28372] usb 9-1: Product: syz [ 1708.463245][T28372] usb 9-1: Manufacturer: syz [ 1708.465958][T28372] usb 9-1: SerialNumber: syz [ 1708.470284][T28372] hub 9-1:1.0: bad descriptor, ignoring hub [ 1708.474217][T28372] hub 9-1:1.0: probe with driver hub failed with error -5 [ 1708.574994][ T9743] netlink: 12 bytes leftover after parsing attributes in process `syz.8.7037'. [ 1708.581618][ T9737] /dev/sr0: Can't open blockdev [ 1708.593388][ T9742] FAULT_INJECTION: forcing a failure. [ 1708.593388][ T9742] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 1708.598756][ T9742] CPU: 0 UID: 0 PID: 9742 Comm: syz.2.7039 Tainted: G L syzkaller #0 PREEMPT(full) [ 1708.598775][ T9742] Tainted: [L]=SOFTLOCKUP [ 1708.598779][ T9742] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1708.598786][ T9742] Call Trace: [ 1708.598791][ T9742] [ 1708.598796][ T9742] dump_stack_lvl+0x100/0x190 [ 1708.598815][ T9742] should_fail_ex.cold+0x5/0xa [ 1708.598826][ T9742] ? prepare_alloc_pages+0x16d/0x5f0 [ 1708.598846][ T9742] should_fail_alloc_page+0xeb/0x140 [ 1708.598863][ T9742] prepare_alloc_pages+0x1f0/0x5f0 [ 1708.598881][ T9742] __alloc_frozen_pages_noprof+0x1af/0x2dc0 [ 1708.598895][ T9742] ? __pfx_stack_trace_save+0x10/0x10 [ 1708.598911][ T9742] ? stack_depot_save_flags+0x27/0x9d0 [ 1708.598946][ T9742] ? kasan_save_stack+0x3f/0x50 [ 1708.598959][ T9742] ? kasan_save_stack+0x30/0x50 [ 1708.598972][ T9742] ? kasan_save_track+0x14/0x30 [ 1708.598985][ T9742] ? __kasan_slab_alloc+0x89/0x90 [ 1708.598998][ T9742] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1708.599011][ T9742] ? ptlock_alloc+0x1f/0x70 [ 1708.599021][ T9742] ? pte_alloc_one+0x82/0x3d0 [ 1708.599038][ T9742] ? __pte_alloc+0x6d/0x3e0 [ 1708.599051][ T9742] ? do_anonymous_page+0x13ae/0x2080 [ 1708.599061][ T9742] ? __handle_mm_fault+0x1d2c/0x2a00 [ 1708.599072][ T9742] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1708.599084][ T9742] ? asm_exc_page_fault+0x26/0x30 [ 1708.599095][ T9742] ? kvm_get_dirty_log_protect+0x517/0x7e0 [ 1708.599115][ T9742] ? __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1708.599131][ T9742] ? __do_fast_syscall_32+0xe7/0x970 [ 1708.599146][ T9742] ? do_fast_syscall_32+0x32/0x70 [ 1708.599160][ T9742] ? entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1708.599181][ T9742] ? __lock_acquire+0x49f/0x1a40 [ 1708.599199][ T9742] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1708.599216][ T9742] ? policy_nodemask+0xed/0x4f0 [ 1708.599233][ T9742] alloc_pages_mpol+0x1fb/0x540 [ 1708.599249][ T9742] ? __pfx_alloc_pages_mpol+0x10/0x10 [ 1708.599264][ T9742] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 1708.599276][ T9742] ? find_held_lock+0x2b/0x80 [ 1708.599289][ T9742] ? find_held_lock+0x2b/0x80 [ 1708.599303][ T9742] folio_alloc_mpol_noprof+0x36/0x260 [ 1708.599322][ T9742] vma_alloc_folio_noprof+0xed/0x1d0 [ 1708.599339][ T9742] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1708.599362][ T9742] ? __lock_acquire+0x49f/0x1a40 [ 1708.599396][ T9742] do_anonymous_page+0xb2b/0x2080 [ 1708.599409][ T9742] ? __pfx_pgd_none+0x10/0x10 [ 1708.599424][ T9742] __handle_mm_fault+0x1d2c/0x2a00 [ 1708.599438][ T9742] ? mt_find+0x45e/0x8e0 [ 1708.599454][ T9742] ? __pfx___handle_mm_fault+0x10/0x10 [ 1708.599464][ T9742] ? __pfx_mt_find+0x10/0x10 [ 1708.599486][ T9742] ? find_vma+0xbf/0x140 [ 1708.599519][ T9742] ? __pfx_find_vma+0x10/0x10 [ 1708.599536][ T9742] handle_mm_fault+0x37b/0xa30 [ 1708.599551][ T9742] do_user_addr_fault+0x74c/0x12f0 [ 1708.599569][ T9742] exc_page_fault+0x6f/0xd0 [ 1708.599590][ T9742] asm_exc_page_fault+0x26/0x30 [ 1708.599601][ T9742] RIP: 0010:_copy_to_user+0x9f/0xd0 [ 1708.599618][ T9742] Code: 89 ee 48 89 ef e8 31 d0 ed fc 4d 85 ff 75 26 e8 47 d6 ed fc 89 de 4c 89 e7 e8 cd 69 5d fd 0f 01 cb 48 89 d9 48 89 ef 4c 89 e6 a4 0f 1f 00 0f 01 ca 48 89 cb e8 21 d6 ed fc 48 89 d8 5b 5d 41 [ 1708.599629][ T9742] RSP: 0018:ffffc90006927cc8 EFLAGS: 00050246 [ 1708.599640][ T9742] RAX: 0000000000000001 RBX: 00000000007ae000 RCX: 00000000007ae000 [ 1708.599647][ T9742] RDX: 0000000000000001 RSI: ffffc90028001000 RDI: 0000000080ffa000 [ 1708.599666][ T9742] RBP: 0000000080ffa000 R08: 0000000000000000 R09: fffff520050f5dff [ 1708.599673][ T9742] R10: ffffc900287aefff R11: 0000000000000000 R12: ffffc90028001000 [ 1708.599680][ T9742] R13: 00000000817a8000 R14: 00007ffffffff000 R15: 0000000000000000 [ 1708.599694][ T9742] ? _copy_to_user+0x93/0xd0 [ 1708.599711][ T9742] kvm_get_dirty_log_protect+0x517/0x7e0 [ 1708.599727][ T9742] kvm_vm_compat_ioctl+0x388/0x3f0 [ 1708.599742][ T9742] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 1708.599758][ T9742] ? find_held_lock+0x2b/0x80 [ 1708.599771][ T9742] ? hook_file_ioctl_common+0x140/0x440 [ 1708.599797][ T9742] ? __fget_files+0x21f/0x3d0 [ 1708.599811][ T9742] ? __pfx_kvm_vm_compat_ioctl+0x10/0x10 [ 1708.599826][ T9742] __ia32_compat_sys_ioctl+0x2cf/0x360 [ 1708.599844][ T9742] __do_fast_syscall_32+0xe7/0x970 [ 1708.599858][ T9742] ? lockdep_hardirqs_on+0x78/0x100 [ 1708.599872][ T9742] do_fast_syscall_32+0x32/0x70 [ 1708.599886][ T9742] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1708.599899][ T9742] RIP: 0023:0xf7f83fec [ 1708.599914][ T9742] Code: Unable to access opcode bytes at 0xf7f83fc2. [ 1708.599919][ T9742] RSP: 002b:00000000f544650c EFLAGS: 00000292 ORIG_RAX: 0000000000000036 [ 1708.599929][ T9742] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000004010ae42 [ 1708.599936][ T9742] RDX: 00000000800000c0 RSI: 0000000000000000 RDI: 0000000000000000 [ 1708.599942][ T9742] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1708.599948][ T9742] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1708.599954][ T9742] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1708.599967][ T9742] [ 1708.825802][T28372] usblp 9-1:1.0: usblp0: USB Unidirectional printer dev 54 if 0 alt 0 proto 1 vid 0x0525 pid 0xA4A8 [ 1709.184929][T28372] usb 9-1: USB disconnect, device number 54 [ 1709.245608][T28372] usblp0: removed [ 1709.269115][ T9750] program syz.2.7041 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1709.423707][ T4665] Bluetooth: hci6: unexpected event for opcode 0x0809 [ 1709.434546][ T9762] input: syz1 as /devices/virtual/input/input84 [ 1709.446989][ T9762] db_root: cannot be changed because it's in use [ 1709.518585][ T42] audit: type=1804 audit(2221.157:1197): pid=9764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=open_writers comm="syz.8.7045" name="bus" dev="ramfs" ino=130001 res=1 errno=0 [ 1709.530509][ T42] audit: type=1804 audit(2221.167:1198): pid=9764 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=invalid_pcr cause=ToMToU comm="syz.8.7045" name="bus" dev="ramfs" ino=130001 res=1 errno=0 [ 1710.074694][T28372] usb 9-1: new high-speed USB device number 55 using dummy_hcd [ 1710.236310][T28372] usb 9-1: unable to get BOS descriptor or descriptor too short [ 1710.242913][T28372] usb 9-1: config 228 has an invalid interface number: 86 but max is 0 [ 1710.249943][T28372] usb 9-1: config 228 has no interface number 0 [ 1710.253498][T28372] usb 9-1: config 228 interface 86 has no altsetting 0 [ 1710.261513][T28372] usb 9-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1710.266137][T28372] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1710.269461][T28372] usb 9-1: Product: syz [ 1710.271224][T28372] usb 9-1: Manufacturer: syz [ 1710.273069][T28372] usb 9-1: SerialNumber: syz [ 1710.380862][ T9773] kernel profiling enabled (shift: 7) [ 1710.557190][ T9773] rdma_rxe: rxe_newlink: failed to add team_slave_1 [ 1711.154756][ T10] vhci_hcd vhci_hcd.1: vhci_device speed not set [ 1711.179310][T28372] usbhid 9-1:228.86: couldn't find an input interrupt endpoint [ 1711.195900][T28372] usb 9-1: USB disconnect, device number 55 [ 1711.600763][ T9786] binder: 9781:9786 ioctl c0306201 80000080 returned -14 [ 1711.859792][ T9790] program syz.4.7052 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1712.000079][ T9795] netlink: 8 bytes leftover after parsing attributes in process `syz.1.7054'. [ 1712.002928][ T9795] netlink: 12 bytes leftover after parsing attributes in process `syz.1.7054'. [ 1712.015698][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x7 [ 1712.018220][T31373] hid-generic 0000:0000:0000.008A: ignoring exceeding usage max [ 1712.021140][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.023547][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.026495][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.028889][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.031131][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.033398][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.036177][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.040253][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.042666][T31373] hid-generic 0000:0000:0000.008A: unknown main item tag 0x0 [ 1712.046969][T31373] hid-generic 0000:0000:0000.008A: hidraw1: HID v0.00 Device [syz0] on syz0 [ 1712.250198][ T9337] Bluetooth: hci3: Frame reassembly failed (-84) [ 1712.264853][ T4805] usb 6-1: new high-speed USB device number 63 using dummy_hcd [ 1712.415449][ T4805] usb 6-1: too many configurations: 9, using maximum allowed: 8 [ 1712.421711][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.429671][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.434805][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.443431][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.448181][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.452135][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.458970][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.466978][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.473866][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.478155][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.486284][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.492954][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.503903][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.507024][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.513287][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.524000][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.529708][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.534439][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.542171][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.545822][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.549120][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.554891][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.563105][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.571187][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.577838][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.582627][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.590911][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.610024][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.618466][ T4805] usb 6-1: config 0 has 1 interface, different from the descriptor's value: 9 [ 1712.622061][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has an invalid bInterval 236, changing to 11 [ 1712.633199][ T4805] usb 6-1: config 0 interface 0 altsetting 2 endpoint 0x8D has invalid maxpacket 26246, setting to 1024 [ 1712.640873][ T4805] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1712.648602][ T4805] usb 6-1: New USB device found, idVendor=0c45, idProduct=1010, bcdDevice=49.8e [ 1712.654812][ T4805] usb 6-1: New USB device strings: Mfr=41, Product=64, SerialNumber=168 [ 1712.659074][ T4805] usb 6-1: Product: syz [ 1712.661790][ T4805] usb 6-1: Manufacturer: syz [ 1712.664741][ T4805] usb 6-1: SerialNumber: syz [ 1712.672509][ T4805] usb 6-1: config 0 descriptor?? [ 1712.675264][ T9795] raw-gadget.0 gadget.1: fail, usb_ep_enable returned -22 [ 1712.682864][ T4805] yurex 6-1:0.0: USB YUREX device now attached to Yurex #0 [ 1713.046766][T28372] usb 13-1: new high-speed USB device number 24 using dummy_hcd [ 1713.197871][T28372] usb 13-1: unable to get BOS descriptor or descriptor too short [ 1713.201352][T28372] usb 13-1: config 228 has an invalid interface number: 86 but max is 0 [ 1713.204082][T28372] usb 13-1: config 228 has no interface number 0 [ 1713.206582][T28372] usb 13-1: config 228 interface 86 has no altsetting 0 [ 1713.211634][T28372] usb 13-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1713.216632][T28372] usb 13-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1713.220104][T28372] usb 13-1: Product: syz [ 1713.221569][T28372] usb 13-1: Manufacturer: syz [ 1713.223180][T28372] usb 13-1: SerialNumber: syz [ 1713.391727][ T9822] program syz.2.7061 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1713.801361][T28372] usbhid 13-1:228.86: couldn't find an input interrupt endpoint [ 1713.806388][T28372] usb 13-1: USB disconnect, device number 24 [ 1714.285044][ T4638] Bluetooth: hci3: command 0x1003 tx timeout [ 1714.287683][ T4665] Bluetooth: hci3: Opcode 0x1003 failed: -110 [ 1714.844204][ T9833] netlink: 32 bytes leftover after parsing attributes in process `syz.8.7063'. [ 1714.925485][ C0] usb 6-1: yurex_control_callback - control failed: -2 [ 1714.945975][T28372] usb 6-1: USB disconnect, device number 63 [ 1714.959232][T28372] yurex 6-1:0.0: USB YUREX #0 now disconnected [ 1715.766678][ T9854] program syz.1.7070 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1715.850735][ T9856] netlink: 'syz.4.7072': attribute type 1 has an invalid length. [ 1715.854566][ T9856] loop2: detected capacity change from 0 to 32768 [ 1715.905128][ T1483] usb 7-1: new high-speed USB device number 95 using dummy_hcd [ 1716.007603][ T9856] md: could not open device unknown-block(0,0). [ 1716.013467][ T9856] md: md_import_device returned -6 [ 1716.021768][ T9858] md: loop1 has zero or unknown size, marking faulty! [ 1716.024083][ T9858] md: md_import_device returned -22 [ 1716.050617][ T9861] md: invalid raid superblock magic on loop2 [ 1716.052697][ T9861] md: loop2 does not have a valid v0.0 superblock, not importing! [ 1716.055579][ T9861] md: md_import_device returned -22 [ 1716.080188][ T1483] usb 7-1: unable to get BOS descriptor or descriptor too short [ 1716.094451][ T1483] usb 7-1: config 228 has an invalid interface number: 86 but max is 0 [ 1716.108136][ T1483] usb 7-1: config 228 has no interface number 0 [ 1716.111431][ T1483] usb 7-1: config 228 interface 86 has no altsetting 0 [ 1716.132617][ T1483] usb 7-1: New USB device found, idVendor=0b57, idProduct=9de3, bcdDevice=87.f6 [ 1716.141065][ T1483] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1716.150668][ T1483] usb 7-1: Product: syz [ 1716.159706][ T1483] usb 7-1: Manufacturer: syz [ 1716.163579][ T1483] usb 7-1: SerialNumber: syz [ 1716.203144][ T9867] sctp: [Deprecated]: syz.4.7074 (pid 9867) Use of struct sctp_assoc_value in delayed_ack socket option. [ 1716.203144][ T9867] Use struct sctp_sack_info instead [ 1717.378439][ T1483] usbhid 7-1:228.86: couldn't find an input interrupt endpoint [ 1717.394760][ T1483] usb 7-1: USB disconnect, device number 95 [ 1717.796998][ T42] audit: type=1800 audit(2229.437:1199): pid=9890 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.7080" name="id" dev="configfs" ino=131579 res=0 errno=0 [ 1718.189783][ T9898] wg2 speed is unknown, defaulting to 1000 [ 1718.195722][ T9898] lo speed is unknown, defaulting to 1000 [ 1718.927811][ T9911] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1718.948276][ T42] audit: type=1800 audit(2230.577:1200): pid=9913 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.4.7087" name="pnp_string" dev="configfs" ino=132152 res=0 errno=0 [ 1719.278330][ T9921] input: syz1 as /devices/virtual/input/input85 [ 1719.298367][ T9921] db_root: cannot be changed because it's in use [ 1719.951309][ T9938] netlink: 'syz.1.7095': attribute type 1 has an invalid length. [ 1720.397543][ T9928] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1720.400160][ T9928] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1720.402310][ T9928] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1720.404421][ T9928] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1720.473044][ T9948] x_tables: duplicate underflow at hook 1 [ 1720.536695][ T9950] overlayfs: fs on './file0' does not support file handles, falling back to index=off,nfs_export=off. [ 1720.558015][ T4665] Bluetooth: hci2: unexpected event for opcode 0x0809 [ 1720.568860][ T9952] input: syz1 as /devices/virtual/input/input86 [ 1720.577767][ T9952] db_root: cannot be changed because it's in use [ 1720.732241][ T9959] netlink: 20 bytes leftover after parsing attributes in process `syz.8.7102'. [ 1721.642537][ T9972] [ 1721.643386][ T9972] ====================================================== [ 1721.645591][ T9972] WARNING: possible circular locking dependency detected [ 1721.647808][ T9972] syzkaller #0 Tainted: G L [ 1721.649754][ T9972] ------------------------------------------------------ [ 1721.651959][ T9972] syz.1.7106/9972 is trying to acquire lock: [ 1721.653847][ T9972] ffff888063586450 (sb_writers#5){.+.+}-{0:0}, at: path_openat+0xad9/0x4280 [ 1721.656601][ T9972] [ 1721.656601][ T9972] but task is already holding lock: [ 1721.658919][ T9972] ffff88806c5fb920 (&common->filesem){++++}-{4:4}, at: fsg_store_file+0x193/0x450 [ 1721.661776][ T9972] [ 1721.661776][ T9972] which lock already depends on the new lock. [ 1721.661776][ T9972] [ 1721.664989][ T9972] [ 1721.664989][ T9972] the existing dependency chain (in reverse order) is: [ 1721.667791][ T9972] [ 1721.667791][ T9972] -> #5 (&common->filesem){++++}-{4:4}: [ 1721.670209][ T9972] lock_acquire+0x1b9/0x370 [ 1721.671825][ T9972] down_write+0x8b/0x1f0 [ 1721.673359][ T9972] fsg_store_file+0x193/0x450 [ 1721.674671][ T42] audit: type=1800 audit(2233.277:1201): pid=9972 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.1.7106" name="file" dev="configfs" ino=131870 res=0 errno=0 [ 1721.675017][ T9972] configfs_write_iter+0x302/0x4e0 [ 1721.682830][ T9972] vfs_write+0x6ac/0x1050 [ 1721.684396][ T9972] ksys_write+0x12a/0x250 [ 1721.685955][ T9972] __do_fast_syscall_32+0xe7/0x970 [ 1721.687728][ T9972] do_fast_syscall_32+0x32/0x70 [ 1721.689429][ T9972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1721.691507][ T9972] [ 1721.691507][ T9972] -> #4 (&p->frag_sem){++++}-{4:4}: [ 1721.693794][ T9972] lock_acquire+0x1b9/0x370 [ 1721.695388][ T9972] down_read+0x99/0x4c0 [ 1721.696898][ T9972] __configfs_open_file+0xe8/0x9c0 [ 1721.698612][ T9972] do_dentry_open+0x6ab/0x14d0 [ 1721.700300][ T9972] vfs_open+0x82/0x3f0 [ 1721.701772][ T9972] dentry_open+0x71/0xd0 [ 1721.703294][ T9972] ima_calc_file_hash+0xe1/0x380 [ 1721.704966][ T9972] ima_collect_measurement+0x94f/0xb30 [ 1721.706872][ T9972] process_measurement+0xdfe/0x2350 [ 1721.708688][ T9972] ima_file_check+0xcc/0x120 [ 1721.710319][ T9972] security_file_post_open+0xc4/0x210 [ 1721.712234][ T9972] path_openat+0x985/0x4280 [ 1721.713820][ T9972] do_file_open+0x20e/0x430 [ 1721.715421][ T9972] do_sys_openat2+0x10f/0x1e0 [ 1721.717073][ T9972] __ia32_compat_sys_openat+0x12d/0x210 [ 1721.718999][ T9972] __do_fast_syscall_32+0xe7/0x970 [ 1721.720788][ T9972] do_fast_syscall_32+0x32/0x70 [ 1721.722516][ T9972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1721.724702][ T9972] [ 1721.724702][ T9972] -> #3 (&ima_iint_mutex_key[depth]){+.+.}-{4:4}: [ 1721.727544][ T9972] lock_acquire+0x1b9/0x370 [ 1721.729167][ T9972] __mutex_lock+0x1a4/0x1bd0 [ 1721.730789][ T9972] process_measurement+0x5ab/0x2350 [ 1721.732593][ T9972] ima_file_check+0xcc/0x120 [ 1721.734166][ T9972] security_file_post_open+0xc4/0x210 [ 1721.735997][ T9972] path_openat+0x985/0x4280 [ 1721.737603][ T9972] do_file_open_root+0x2f6/0x5a0 [ 1721.739333][ T9972] file_open_root+0x1c6/0x3f0 [ 1721.740949][ T9972] kernel_read_file_from_path_initns+0x189/0x260 [ 1721.743121][ T9972] _request_firmware+0x733/0x13c0 [ 1721.744904][ T9972] request_firmware+0x35/0x50 [ 1721.746545][ T9972] reg_reload_regdb+0x85/0x460 [ 1721.748170][ T9972] genl_family_rcv_msg_doit+0x214/0x300 [ 1721.749987][ T9972] genl_rcv_msg+0x560/0x800 [ 1721.751557][ T9972] netlink_rcv_skb+0x159/0x420 [ 1721.753258][ T9972] genl_rcv+0x28/0x40 [ 1721.754642][ T9972] netlink_unicast+0x585/0x850 [ 1721.756316][ T9972] netlink_sendmsg+0x8b0/0xda0 [ 1721.757987][ T9972] ____sys_sendmsg+0xa4d/0xbe0 [ 1721.759669][ T9972] ___sys_sendmsg+0x190/0x1e0 [ 1721.761325][ T9972] __sys_sendmsg+0x160/0x210 [ 1721.762979][ T9972] __do_fast_syscall_32+0xe7/0x970 [ 1721.764763][ T9972] do_fast_syscall_32+0x32/0x70 [ 1721.766471][ T9972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1721.768651][ T9972] [ 1721.768651][ T9972] -> #2 (cb_lock){++++}-{4:4}: [ 1721.770822][ T9972] lock_acquire+0x1b9/0x370 [ 1721.772439][ T9972] down_read+0x99/0x4c0 [ 1721.773936][ T9972] genl_rcv+0x19/0x40 [ 1721.775407][ T9972] netlink_unicast+0x585/0x850 [ 1721.777104][ T9972] netlink_sendmsg+0x8b0/0xda0 [ 1721.778819][ T9972] sock_sendmsg+0x394/0x410 [ 1721.780455][ T9972] splice_to_socket+0xb3c/0x11a0 [ 1721.782206][ T9972] do_splice+0x109c/0x1f90 [ 1721.783803][ T9972] __do_splice+0x33b/0x370 [ 1721.785378][ T9972] __ia32_sys_splice+0x189/0x250 [ 1721.787114][ T9972] __do_fast_syscall_32+0xe7/0x970 [ 1721.788909][ T9972] do_fast_syscall_32+0x32/0x70 [ 1721.790613][ T9972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1721.792789][ T9972] [ 1721.792789][ T9972] -> #1 (&pipe->mutex){+.+.}-{4:4}: [ 1721.795102][ T9972] lock_acquire+0x1b9/0x370 [ 1721.796717][ T9972] __mutex_lock+0x1a4/0x1bd0 [ 1721.798361][ T9972] pipe_lock+0x69/0x80 [ 1721.800128][ T9972] iter_file_splice_write+0x1fd/0x10b0 [ 1721.802485][ T9972] do_splice+0x109c/0x1f90 [ 1721.804362][ T9972] __do_splice+0x33b/0x370 [ 1721.806184][ T9972] __ia32_sys_splice+0x189/0x250 [ 1721.808184][ T9972] __do_fast_syscall_32+0xe7/0x970 [ 1721.810235][ T9972] do_fast_syscall_32+0x32/0x70 [ 1721.812446][ T9972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1721.815005][ T9972] [ 1721.815005][ T9972] -> #0 (sb_writers#5){.+.+}-{0:0}: [ 1721.817367][ T9972] check_prev_add+0xeb/0xe60 [ 1721.819005][ T9972] __lock_acquire+0x136c/0x1a40 [ 1721.820713][ T9972] lock_acquire+0x1b9/0x370 [ 1721.822369][ T9972] mnt_want_write+0x6f/0x410 [ 1721.824003][ T9972] path_openat+0xad9/0x4280 [ 1721.825599][ T9972] do_file_open+0x20e/0x430 [ 1721.827191][ T9972] file_open_name+0x1c3/0x3e0 [ 1721.828851][ T9972] filp_open+0x2e/0x50 [ 1721.830335][ T9972] fsg_lun_open+0x6b/0x7b0 [ 1721.831918][ T9972] fsg_store_file+0x1e7/0x450 [ 1721.833584][ T9972] configfs_write_iter+0x302/0x4e0 [ 1721.835363][ T9972] vfs_write+0x6ac/0x1050 [ 1721.836913][ T9972] ksys_write+0x12a/0x250 [ 1721.838477][ T9972] __do_fast_syscall_32+0xe7/0x970 [ 1721.840251][ T9972] do_fast_syscall_32+0x32/0x70 [ 1721.841960][ T9972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1721.844152][ T9972] [ 1721.844152][ T9972] other info that might help us debug this: [ 1721.844152][ T9972] [ 1721.847341][ T9972] Chain exists of: [ 1721.847341][ T9972] sb_writers#5 --> &p->frag_sem --> &common->filesem [ 1721.847341][ T9972] [ 1721.851253][ T9972] Possible unsafe locking scenario: [ 1721.851253][ T9972] [ 1721.853615][ T9972] CPU0 CPU1 [ 1721.855306][ T9972] ---- ---- [ 1721.857003][ T9972] lock(&common->filesem); [ 1721.858440][ T9972] lock(&p->frag_sem); [ 1721.860548][ T9972] lock(&common->filesem); [ 1721.862769][ T9972] rlock(sb_writers#5); [ 1721.864125][ T9972] [ 1721.864125][ T9972] *** DEADLOCK *** [ 1721.864125][ T9972] [ 1721.866641][ T9972] 5 locks held by syz.1.7106/9972: [ 1721.868258][ T9972] #0: ffff88802414f430 (&f->f_pos_lock){+.+.}-{4:4}, at: fdget_pos+0x2aa/0x380 [ 1721.870964][ T9972] #1: ffff888022168450 (sb_writers#20){.+.+}-{0:0}, at: ksys_write+0x12a/0x250 [ 1721.873801][ T9972] #2: ffff888025073680 (&buffer->mutex#2){+.+.}-{4:4}, at: configfs_write_iter+0x76/0x4e0 [ 1721.876942][ T9972] #3: ffff8880217d1170 (&p->frag_sem){++++}-{4:4}, at: configfs_write_iter+0x218/0x4e0 [ 1721.879977][ T9972] #4: ffff88806c5fb920 (&common->filesem){++++}-{4:4}, at: fsg_store_file+0x193/0x450 [ 1721.883011][ T9972] [ 1721.883011][ T9972] stack backtrace: [ 1721.884881][ T9972] CPU: 2 UID: 0 PID: 9972 Comm: syz.1.7106 Tainted: G L syzkaller #0 PREEMPT(full) [ 1721.884898][ T9972] Tainted: [L]=SOFTLOCKUP [ 1721.884902][ T9972] Hardware name: QEMU Standard PC (Q35 + ICH9, 2009), BIOS 1.16.3-debian-1.16.3-2 04/01/2014 [ 1721.884909][ T9972] Call Trace: [ 1721.884917][ T9972] [ 1721.884923][ T9972] dump_stack_lvl+0x100/0x190 [ 1721.884939][ T9972] print_circular_bug.cold+0x178/0x1c7 [ 1721.884957][ T9972] check_noncircular+0x146/0x160 [ 1721.884974][ T9972] ? __lock_acquire+0x49f/0x1a40 [ 1721.884992][ T9972] check_prev_add+0xeb/0xe60 [ 1721.885008][ T9972] __lock_acquire+0x136c/0x1a40 [ 1721.885026][ T9972] ? try_to_unlazy+0x296/0x910 [ 1721.885042][ T9972] lock_acquire+0x1b9/0x370 [ 1721.885057][ T9972] ? path_openat+0xad9/0x4280 [ 1721.885068][ T9972] ? __pfx___might_resched+0x10/0x10 [ 1721.885086][ T9972] mnt_want_write+0x6f/0x410 [ 1721.885102][ T9972] ? path_openat+0xad9/0x4280 [ 1721.885113][ T9972] path_openat+0xad9/0x4280 [ 1721.885125][ T9972] ? finish_task_switch.isra.0+0x2c5/0x10c0 [ 1721.885137][ T9972] ? __pfx_path_openat+0x10/0x10 [ 1721.885147][ T9972] ? kasan_save_stack+0x3f/0x50 [ 1721.885161][ T9972] ? kasan_save_stack+0x30/0x50 [ 1721.885174][ T9972] ? kasan_save_track+0x14/0x30 [ 1721.885186][ T9972] ? __kasan_slab_alloc+0x89/0x90 [ 1721.885199][ T9972] ? kmem_cache_alloc_noprof+0x26b/0x6a0 [ 1721.885213][ T9972] ? do_getname_kernel+0x5d/0x250 [ 1721.885225][ T9972] ? filp_open+0x1d/0x50 [ 1721.885237][ T9972] ? fsg_lun_open+0x6b/0x7b0 [ 1721.885251][ T9972] do_file_open+0x20e/0x430 [ 1721.885262][ T9972] ? __pfx_do_file_open+0x10/0x10 [ 1721.885278][ T9972] ? rcu_is_watching+0x12/0xc0 [ 1721.885292][ T9972] file_open_name+0x1c3/0x3e0 [ 1721.885307][ T9972] ? __pfx_file_open_name+0x10/0x10 [ 1721.885319][ T9972] ? do_getname_kernel+0x5d/0x250 [ 1721.885332][ T9972] ? __asan_memcpy+0x3c/0x60 [ 1721.885343][ T9972] ? do_getname_kernel+0x1be/0x250 [ 1721.885355][ T9972] filp_open+0x2e/0x50 [ 1721.885368][ T9972] fsg_lun_open+0x6b/0x7b0 [ 1721.885381][ T9972] ? __pfx_down_read+0x10/0x10 [ 1721.885397][ T9972] fsg_store_file+0x1e7/0x450 [ 1721.885411][ T9972] configfs_write_iter+0x302/0x4e0 [ 1721.885423][ T9972] vfs_write+0x6ac/0x1050 [ 1721.885433][ T9972] ? __pfx_configfs_write_iter+0x10/0x10 [ 1721.885444][ T9972] ? __pfx_vfs_write+0x10/0x10 [ 1721.885453][ T9972] ? find_held_lock+0x2b/0x80 [ 1721.885469][ T9972] ksys_write+0x12a/0x250 [ 1721.885478][ T9972] ? __pfx_ksys_write+0x10/0x10 [ 1721.885489][ T9972] __do_fast_syscall_32+0xe7/0x970 [ 1721.885506][ T9972] do_fast_syscall_32+0x32/0x70 [ 1721.885519][ T9972] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1721.885533][ T9972] RIP: 0023:0xf707efec [ 1721.885552][ T9972] Code: Unable to access opcode bytes at 0xf707efc2. [ 1721.885557][ T9972] RSP: 002b:00000000f546d50c EFLAGS: 00000292 ORIG_RAX: 0000000000000004 [ 1721.885568][ T9972] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000380 [ 1721.885575][ T9972] RDX: 0000000000000002 RSI: 0000000000000000 RDI: 0000000000000000 [ 1721.885582][ T9972] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1721.885588][ T9972] R10: 0000000000000000 R11: 0000000000000292 R12: 0000000000000000 [ 1721.885595][ T9972] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1721.885604][ T9972] [ 1722.032546][ T9972] mass_storage.0/lun.0: unable to open backing file: fi [ 1722.444750][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1722.446755][ T1566] Bluetooth: hci6: command 0x0406 tx timeout [ 1722.448725][ T4665] Bluetooth: hci1: command 0x0c1a tx timeout [ 1722.725559][ T9974] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1722.727746][ T9974] Bluetooth: hci6: Opcode 0x0c1a failed: -4 [ 1722.729701][ T9974] Bluetooth: hci7: Opcode 0x0c1a failed: -4 [ 1722.731651][ T9974] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1724.124822][ T4665] Bluetooth: hci2: command 0x0c1a tx timeout [ 1724.764722][ T4665] Bluetooth: hci1: command 0x0c1a tx timeout [ 1724.764794][ T4638] Bluetooth: hci7: command 0x0c1a tx timeout [ 1724.766959][ T4665] Bluetooth: hci6: command 0x0406 tx timeout