last executing test programs: 24m56.012480613s ago: executing program 2 (id=1638): r0 = syz_open_dev$video(&(0x7f0000000080), 0xa3, 0x0) ioctl$VIDIOC_S_FMT(r0, 0xc0d05605, &(0x7f0000000180)={0x8, @raw_data="457a421d752d1c9064c13d07afb9324cc31b382a6bac83a78a4a935b28bba6af36d006612bf5fac56267dfa84fff177293385b265ed3d1a6ad4c2e6e004dfeacc42dda9f3c144968fa9dcda412b3aae159e10a59886af54cfd58b505cb70d865760fb9ffb62208dba3bee589f8d26c42b6b148e26bf1bc94863ba0da5c39ac6114da7e6804ce66c773aebab22c3937eb1fe6dcf34d83717ea41cb1e4a6e2de294e73aa8798871c85f6d67d3d110da3f9797624b8fb685fcea7041de0ca4190a95aa770399ed4f810"}) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x0, 0x0}) unshare(0x2a020400) rseq(&(0x7f0000000400), 0x20, 0x0, 0x0) unshare(0x20200) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, &(0x7f0000000040)={0x0, 0x2}, 0xa) syz_open_dev$sndctrl(&(0x7f0000000180), 0x2, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000040)={0x11, @private=0xa010100, 0x4e20, 0x2, 'none\x00', 0x10, 0x6, 0x43}, 0x2c) r1 = openat$tun(0xffffffffffffff9c, &(0x7f00000000c0), 0x48241, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000200)={'syzkaller1\x00', 0xc201}) r2 = socket$kcm(0x2, 0xa, 0x2) r3 = socket$nl_xfrm(0x10, 0x3, 0x6) setsockopt$netlink_NETLINK_ADD_MEMBERSHIP(r3, 0x10e, 0x1, &(0x7f0000000400)=0x1, 0x2c) r4 = socket$inet6(0xa, 0x3, 0x1) r5 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r5, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r5, 0x84, 0x75, &(0x7f0000000040)={0x0, 0xaf1}, 0x8) bind$inet6(r5, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) sendmmsg$inet6(r5, &(0x7f0000000200)=[{{&(0x7f00000000c0)={0xa, 0x4e23, 0x1, @loopback, 0x1}, 0x70, &(0x7f0000000580)=[{&(0x7f0000001680)='\t', 0x1}], 0x1}}], 0x1, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r5, 0x84, 0x77, &(0x7f0000000340)=ANY=[@ANYRES32=0x0, @ANYBLOB="21045655428e8593068699a616eecb39699bd96b2853a71a534b7ddafb5f647e3d50a94d49a6e69645800f2db5952368025d6f392a17cc24e9be44aa2c624a598a6424956e4e6146d3b65908"], 0x8) socket$nl_generic(0x10, 0x3, 0x10) setsockopt$inet_sctp6_SCTP_ADD_STREAMS(r5, 0x84, 0x79, &(0x7f00000001c0)={0x0, 0x8, 0x360}, 0x8) setsockopt$inet6_IPV6_XFRM_POLICY(r4, 0x29, 0x23, &(0x7f0000000180)={{{@in6=@rand_addr=' \x01\x00', @in=@empty, 0x4e22, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x1}, {0xfffffffffffffffd, 0x0, 0x6, 0x0, 0x5, 0x80000000, 0x0, 0x7fffffffffffffff}, {0x0, 0x0, 0xffffffffffffffff, 0x20000000000000}, 0x0, 0x0, 0x1}, {{@in=@empty, 0x4d5, 0x6c}, 0xa, @in=@private=0xa010102, 0x350a, 0x4, 0x0, 0x0, 0x0, 0x0, 0x200000}}, 0xe8) connect$inet6(r4, &(0x7f0000000000)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @dev}}, 0x1c) ioctl$SIOCSIFHWADDR(r2, 0x8914, &(0x7f0000000180)={'syzkaller1\x00', @link_local}) write$tun(r1, &(0x7f0000000040)=ANY=[@ANYBLOB="000008060000"], 0xfdef) 24m54.897786157s ago: executing program 1 (id=1641): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x1, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x2f}}}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000040)=0xffffffffffffffff, 0x4) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x1, &(0x7f0000000500)=@gcm_128={{0x304}, "e8ffff0700", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "12772541f8eb02bb"}, 0x28) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) sendfile(r0, r1, 0x0, 0x20000000002) openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) r2 = socket(0x10, 0x2, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_TIMEOUT_NEW(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000180)={0x34, 0x0, 0x8, 0x5, 0x0, 0x0, {0x3, 0x0, 0x1}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}, @CTA_TIMEOUT_DATA={0x4, 0x4, 0x0, 0x1, @fccp}, @CTA_TIMEOUT_L3PROTO={0x6, 0x2, 0x1, 0x0, 0xf5}, @CTA_TIMEOUT_L4PROTO={0x5, 0x3, 0x1}]}, 0x34}, 0x1, 0x0, 0x0, 0x1}, 0xc000) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(r3, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)={0x20, 0x2, 0x8, 0x201, 0x0, 0x0, {0x0, 0x0, 0x4}, [@CTA_TIMEOUT_NAME={0x9, 0x1, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x8014}, 0x4000) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x38, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x25dfdbff, {0x0, 0x0, 0x0, r4, {}, {0xffff, 0xffff}, {0xc, 0x3}}, [@qdisc_kind_options=@q_pie={{0x8}, {0xc, 0x2, [@TCA_PIE_TARGET={0x8, 0x1, 0x80000001}]}}]}, 0x38}, 0x1, 0x0, 0x0, 0x4011}, 0x2000400d) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000580)='./file0\x00', 0x2c41, 0x0) r7 = eventfd2(0x800, 0x0) io_setup(0x81, &(0x7f0000000400)=0x0) io_submit(r8, 0x1, &(0x7f0000000040)=[&(0x7f0000000000)={0x0, 0x0, 0x20, 0x7, 0xb, r6, 0x0, 0x0, 0x2000000000, 0x0, 0x1, r7}]) ioctl$TUNSETIFF(r5, 0x400454ca, &(0x7f0000000080)={'pimreg0\x00', 0x7c2}) ioctl$TUNATTACHFILTER(r5, 0x401054d5, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x60, 0x8, 0x0, 0xfffffffc}]}) 24m53.935201457s ago: executing program 2 (id=1643): syz_open_dev$vim2m(&(0x7f0000000080), 0x7, 0x2) socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket$unix(0x1, 0x1, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newqdisc={0x70, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2, 0x2}}, [@qdisc_kind_options=@q_cbs={{0x8}, {0x1c, 0x2, @TCA_CBS_PARMS={0x18, 0x1, {0x0, '\x00', 0x1, 0x7, 0x100, 0x8}}}}, @TCA_STAB={0x28, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x5, 0x9, 0x7ff, 0x1, 0x0, 0x75, 0x7fff, 0x1}}, {0x6, 0x2, [0x1]}}]}]}, 0x70}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r4) socket$nl_generic(0x10, 0x3, 0x10) r5 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='devices.list\x00', 0x275a, 0x0) write$FUSE_NOTIFY_RETRIEVE(r5, &(0x7f0000000740)={0x30, 0x5, 0x0, {0x0, 0x5, 0x3, 0x20009}}, 0x30) r6 = syz_open_procfs(0x0, &(0x7f0000000000)='fd\x00') fchdir(r6) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r5, 0x0) syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x88440) ioctl$SIOCSIFHWADDR(r4, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r9 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r9, &(0x7f00000005c0)="bad330", 0x3, 0x40, &(0x7f00000001c0)={0x11, 0x8100, r8, 0x1, 0xd8, 0x6, @multicast}, 0x14) r10 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000380)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_SET_CONTEXT_MGR_EXT(r10, 0x4018620d, &(0x7f00000000c0)={0x73622a85, 0x110b, 0x8000000000005}) r11 = openat$binderfs(0xffffffffffffff9c, &(0x7f0000000200)='./binderfs/binder0\x00', 0x0, 0x0) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) dup3(r11, r10, 0x0) ioctl$BINDER_WRITE_READ(r10, 0xc0306201, &(0x7f0000000280)={0x10, 0x0, &(0x7f0000000040)=[@request_death], 0x50, 0x0, &(0x7f0000000440)="06529338d1367b295158ba1f50a4ec08c36b68db4b93c92743fef05eb08e76164f0f9d6b03d2a811332a8f30c7589e3e72648c9a8a292291b24d61014aa77da6cfa77f07d5e61a175e77507689d8d8ac"}) ioctl$BINDER_WRITE_READ(r11, 0xc0306201, &(0x7f0000001680)={0xc, 0x0, &(0x7f0000000180)=[@dead_binder_done], 0x0, 0x0, 0x0}) syz_genetlink_get_family_id$batadv(&(0x7f0000000040), 0xffffffffffffffff) 24m53.449051483s ago: executing program 1 (id=1647): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f00000002c0), r0) sendmsg$NL80211_CMD_GET_WIPHY(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)={0x24, r1, 0x5707b563827c8365, 0x1000000, 0x0, {{}, {@val={0x8, 0x1, 0x74}, @val={0x8, 0x12a}, @void}}}, 0x24}}, 0x0) 24m53.416603722s ago: executing program 2 (id=1648): syz_open_dev$sndctrl(&(0x7f0000000000), 0x9, 0xa0080) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(&(0x7f00000000c0)) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, &(0x7f0000001040)=0x5d) syz_usb_connect(0x0, 0x12, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) writev(r2, &(0x7f0000002100)=[{&(0x7f0000002080)='T01\n', 0x4}], 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x2f) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b00000000002010400000000000000000700000608000940ffffffff080004400000008108000840000000032000018006"], 0xb0}, 0x1, 0x0, 0x0, 0x8004}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYRES8=r0], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000180)='./control\x00', 0xa4000960) unshare(0x40000000) r4 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x8, 0x200) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) futex(&(0x7f0000004000)=0x2, 0x8d, 0xfffffffd, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$tipc(r2, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x1, 0x4}}, 0x5) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000440)={'erspan0\x00', 0x0}) 24m45.940108272s ago: executing program 1 (id=1653): r0 = syz_open_dev$vim2m(&(0x7f00000002c0), 0x1, 0x2) r1 = socket$nl_rdma(0x10, 0x3, 0x14) (async) r2 = socket$nl_generic(0x10, 0x3, 0x10) (async) r3 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000080)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_SET_INTERFACE(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)={0x24, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_IFTYPE={0x8, 0x5, 0x7}]}, 0x24}}, 0x0) r5 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r5, 0x0, 0x40, &(0x7f00000003c0)=@nat={'nat\x00', 0x670, 0x5, 0x338, 0x0, 0x1ec, 0xfeffffff, 0x1ec, 0x1ec, 0x2a4, 0x2a4, 0xffffffff, 0x2a4, 0x2a4, 0x5, 0x0, {[{{@ip={@initdev={0xac, 0x1e, 0x0, 0x0}, @initdev={0xac, 0x1e, 0x0, 0x0}, 0x0, 0x0, 'veth0_to_bond\x00', 'veth1_to_team\x00', {}, {}, 0x1d}, 0x0, 0x70, 0xa4}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x1f, @multicast1, @loopback, @port=0x4e21, @port=0x4e21}}}}, {{@uncond, 0x0, 0x70, 0xa4}, @REDIRECT={0x34, 'REDIRECT\x00', 0x0, {0x1, {0x0, @broadcast, @remote, @icmp_id=0x4}}}}, {{@ip={@loopback, @rand_addr, 0x0, 0x0, 'lo\x00', 'ip6tnl0\x00'}, 0x0, 0x70, 0xa4}, @NETMAP={0x34, 'NETMAP\x00', 0x0, {0x1, {0x0, @remote, @initdev={0xac, 0x1e, 0x0, 0x0}, @icmp_id}}}}, {{@ip={@remote, @broadcast, 0x0, 0x0, 'pim6reg0\x00', 'wlan1\x00'}, 0x0, 0x70, 0xb8}, @unspec=@SNAT1={0x48, 'SNAT\x00', 0x1, {0x0, @ipv6=@private2, @ipv4=@dev, @port, @gre_key=0x2}}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x394) (async, rerun: 64) sendmsg$NL80211_CMD_JOIN_MESH(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="02000000", @ANYRES16=r3, @ANYBLOB="050000000000000000004400000008000300", @ANYRES32=r4, @ANYBLOB="0a0018000303030303030000080026006c090000"], 0x30}}, 0x0) (async, rerun: 64) sendmsg$NL80211_CMD_GET_MPP(r2, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000002c0)={0x28, r3, 0x5, 0x0, 0x0, {{}, {@val={0x8, 0x3, r4}, @void}}, [@NL80211_ATTR_MAC={0xa}]}, 0x28}}, 0x0) (async) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000340)={0x18, 0x1411, 0x101, 0x0, 0x0, "", [@RDMA_NLDEV_ATTR_STAT_RES={0x8, 0x4b, 0x28}]}, 0x18}}, 0x0) (async, rerun: 64) ioctl$vim2m_VIDIOC_ENUM_FRAMESIZES(r0, 0xc02c564a, &(0x7f0000000000)={0x8000, 0x33565348, 0x2, @discrete={0x6d26, 0x656}}) (async, rerun: 64) r6 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00', 0x0}) sendmsg$nl_route_sched(r6, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000500)=@newqdisc={0x54, 0x24, 0x3fe3aa0262d8c583, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xffff, 0xa}, {0x9, 0xfff1}}, [@qdisc_kind_options=@q_red={{0x8}, {0x28, 0x2, [@TCA_RED_MAX_P={0x8, 0x3, 0xffff}, @TCA_RED_MAX_P={0x8, 0x3, 0x7}, @TCA_RED_PARMS={0x14, 0x1, {0x1, 0x1, 0x371, 0xa, 0x1b, 0x11}}]}}]}, 0x54}, 0x1, 0x0, 0x0, 0x20000002}, 0x4) (async) connect$vsock_stream(r6, &(0x7f0000000300)={0x28, 0x0, 0x2711}, 0x10) 24m42.836804825s ago: executing program 1 (id=1656): r0 = socket$inet(0xa, 0x801, 0x84) (async, rerun: 32) r1 = socket$packet(0x11, 0x2, 0x300) (rerun: 32) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r1, 0x8933, &(0x7f00000001c0)={'batadv_slave_0\x00', 0x0}) setsockopt$packet_add_memb(r1, 0x107, 0x1, &(0x7f0000000200)={r2, 0x11, 0x6, @random="bdf19b71a0f9"}, 0x10) (async) setsockopt$packet_drop_memb(r1, 0x107, 0x2, &(0x7f0000000580)={r2, 0x1, 0x6, @local}, 0x10) (async) sendmmsg(r0, &(0x7f0000000940)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000180)=ANY=[@ANYBLOB="0c00000017010000000000000c00000084000000001accd26efcf6f284f40d83795beb229d6b46031b7cfb64005b7efeda60a969c933d2ceb465dadf7d673e95d776f9e0c76b5fe889610dc086e050098d423bbc05a7fb50863fcba5e4b97cf34dd86576e77c1063f71a6a19d47f0b40b43629fa5d2cc84de95f23097a83f7574487c119d8d937ddeb507257f18b7c74d571b3bd5acd2f897d80e915a56381a2f20f1d57c7cd15d03cb8ad6505ee71271da957260901e2b93fab527fc886ad0188e73fc00300"/207], 0x18}}], 0x1, 0x10) (async, rerun: 64) syz_mount_image$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x8, 0x0, 0x0, 0x0, 0x0) (async, rerun: 64) r3 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x28) r4 = openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) ioctl$SNDCTL_DSP_SETFMT(r4, 0x40045010, 0x0) ioctl$KVM_SET_CLOCK(r3, 0x4030ae7b, &(0x7f0000000080)={0x9, 0x2, 0x10001, 0x7, 0xac0}) (async) socket$inet_sctp(0x2, 0x5, 0x84) (async) r5 = socket$packet(0x11, 0x2, 0x300) setsockopt$packet_int(r5, 0x107, 0xa, &(0x7f0000000080)=0x1, 0x4) (async) r6 = syz_usb_connect(0x0, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="12010000d3750820c80a2103be6f000000010902120001000000000904"], 0x0) syz_usb_control_io$cdc_ecm(r6, 0x0, &(0x7f0000000540)={0x1c, &(0x7f0000000380)={0x40, 0xc}, 0x0, 0x0}) syz_usb_control_io(r6, 0x0, 0x0) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) (async, rerun: 32) syz_usb_control_io$hid(r6, 0x0, 0x0) (rerun: 32) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) (async) syz_usb_control_io$printer(r6, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) syz_usb_control_io$cdc_ncm(r6, 0x0, 0x0) (async) syz_usb_control_io(r6, 0x0, &(0x7f0000000a80)={0x84, &(0x7f0000000640)={0x0, 0xe, 0x1, "06"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$printer(r6, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r6, 0x0, 0x0) (async) syz_usb_control_io$cdc_ecm(r6, 0x0, &(0x7f0000000000)={0x1c, &(0x7f0000000f80)=ANY=[@ANYBLOB="00df19"], 0x0, 0x0}) setsockopt$packet_rx_ring(r5, 0x107, 0x5, &(0x7f0000000140)=@req3={0x1000, 0x3a, 0x1000, 0x3a, 0x800, 0x2, 0x4}, 0x1c) (async) socket$packet(0x11, 0x2, 0x300) (async) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000340)={'gretap0\x00'}) 24m41.264098958s ago: executing program 1 (id=1661): r0 = socket$inet6_mptcp(0xa, 0x1, 0x106) r1 = socket$inet(0x2, 0x80000, 0x7fff) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000080)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}, @IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8, 0x6, 0x0}]}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x5c}}, 0x20000000) setsockopt$inet6_tcp_int(r0, 0x6, 0x18, 0x0, 0x0) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000001c0), 0xe8001, 0x0) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller1\x00', 0x2}) ioctl$BINDER_WRITE_READ(0xffffffffffffffff, 0xc0306201, &(0x7f0000000080)={0x8, 0x0, &(0x7f0000000400)=[@increfs], 0x0, 0x0, 0x0}) r4 = dup3(0xffffffffffffffff, 0xffffffffffffffff, 0x0) ioctl$BINDER_WRITE_READ(r4, 0xc0306201, &(0x7f00000003c0)={0x8, 0x0, &(0x7f0000000000)=[@acquire], 0x0, 0x0, 0x0}) r5 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r5, 0x8933, &(0x7f0000000ec0)={'batadv0\x00', 0x0}) r7 = syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$BATADV_CMD_GET_BLA_BACKBONE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000440)={0x1c, r7, 0x303, 0x0, 0xfffffffc, {}, [@BATADV_ATTR_MESH_IFINDEX={0x8, 0x3, r6}]}, 0x1c}, 0x1, 0x0, 0x0, 0x1}, 0x0) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r1, 0x8933, &(0x7f0000000240)) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r0, 0x8933, &(0x7f0000000280)={'batadv_slave_1\x00', 0x0}) sendmsg$BATADV_CMD_TP_METER_CANCEL(r4, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x2000000}, 0xc, &(0x7f00000002c0)={&(0x7f0000000480)={0x54, r7, 0x8, 0x70bd26, 0x25dfdbff, {}, [@BATADV_ATTR_ISOLATION_MASK={0x8, 0x2c, 0x1}, @BATADV_ATTR_GW_BANDWIDTH_DOWN={0x8, 0x31, 0x9}, @BATADV_ATTR_FRAGMENTATION_ENABLED={0x5}, @BATADV_ATTR_HARD_IFINDEX={0x8, 0x6, r8}, @BATADV_ATTR_BRIDGE_LOOP_AVOIDANCE_ENABLED={0x5, 0x2e, 0x1}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5, 0x38, 0x4}, @BATADV_ATTR_NETWORK_CODING_ENABLED={0x5}, @BATADV_ATTR_DISTRIBUTED_ARP_TABLE_ENABLED={0x5}]}, 0x54}, 0x1, 0x0, 0x0, 0x4000000}, 0x20040000) r9 = socket$igmp6(0xa, 0x3, 0x2) r10 = syz_open_dev$vim2m(&(0x7f0000000100), 0x1, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r10, 0xc0145608, &(0x7f00000000c0)={0x8, 0x2, 0x1}) ioctl$vim2m_VIDIOC_CREATE_BUFS(r10, 0xc0f8565c, &(0x7f0000000000)={0x7b, 0xbd5, 0x1, {0x2, @pix_mp={0xe5, 0xd7a0, 0x494e4f4b, 0x8, 0xa, [{0x4, 0x2}, {0x3, 0x6}, {0x1, 0x2}, {0x3, 0xa88}, {0xae, 0x1}, {0x10001, 0x200}, {0x3ff, 0x5ecd}, {0x7fffffff, 0x6}], 0x1, 0x2b, 0x8}}, 0x400}) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r9, 0x8983, &(0x7f0000000300)={0x0, 'syzkaller1\x00'}) r11 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xc, 0x4, 0x4, 0x1, 0x0, 0xffffffffffffffff, 0x4, '\x00', r12, 0xffffffffffffffff, 0x0, 0xffffffff}, 0x50) openat$dlm_monitor(0xffffff9c, &(0x7f0000000000), 0x400241, 0x0) r13 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r13, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000500)=ANY=[@ANYBLOB="140000001000010000000000008200000000000a20000000000a03000000010403000000010000000900010073797a300000009f0cf82c21f52f38003c000000090a0100000000000100000008000a40000000000900020073797a32000000000900010073797a300000000008000540000000104c0000000c0a01020000000000000000010000000900020073797a32000000000900200003801c000080180001801400010000000055b0eb330678ba1fb6420c65c19b77f9e39ceb0f8171c2035182f6f9d4718fe155bbe0e1a70070a9137323573c580ae8ae9c98183c0ebd76f861d7ce2ea54b3c44885fdd7a639d009fbf9b6f03ffbc2263a141a282c2b6ed83f936914da36af866efe4941b529cc9a196e1478ccc4bd74f8d901491b0337d98275be741fd243481ca7ec8356dfa57ac9bf46295adcffd844bd22c2dd50d70587feffc15ad6154f0a22e71fdce4885ac6c7d8ae08fbd117586cd594cad88b03949d2b856009fed8ac6b286c53534bad7ab2a2be2a6d558f954748d633434acd34af504a583ae4ce17972e6a000b784be4b71a523e1b669065638e9e361"], 0xd0}}, 0x0) ioctl$TUNSETOFFLOAD(r3, 0x400454c9, 0xba98575a95aeb70d) ioctl$TUNSETLINK(r3, 0x400454cd, 0x337) 24m33.607610121s ago: executing program 32 (id=1648): syz_open_dev$sndctrl(&(0x7f0000000000), 0x9, 0xa0080) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(&(0x7f00000000c0)) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) getsockopt$CAN_RAW_LOOPBACK(0xffffffffffffffff, 0x65, 0x20, 0x0, &(0x7f0000001040)=0x5d) syz_usb_connect(0x0, 0x12, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) write$6lowpan_control(0xffffffffffffffff, 0x0, 0x0) r2 = openat$ocfs2_control(0xffffffffffffff9c, &(0x7f0000000000), 0x102, 0x0) writev(r2, &(0x7f0000002100)=[{&(0x7f0000002080)='T01\n', 0x4}], 0x1) write$RDMA_USER_CM_CMD_CREATE_ID(r2, 0x0, 0x2f) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x20000, 0x0) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b00000000002010400000000000000000700000608000940ffffffff080004400000008108000840000000032000018006"], 0xb0}, 0x1, 0x0, 0x0, 0x8004}, 0x10) r3 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYRES8=r0], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) inotify_add_watch(0xffffffffffffffff, &(0x7f0000000180)='./control\x00', 0xa4000960) unshare(0x40000000) r4 = syz_open_dev$sndctrl(&(0x7f0000000040), 0x8, 0x200) mmap(&(0x7f0000004000/0x4000)=nil, 0x4000, 0x0, 0x2172, 0xffffffffffffffff, 0x0) munmap(&(0x7f0000001000/0x4000)=nil, 0x4000) futex(&(0x7f0000004000)=0x2, 0x8d, 0xfffffffd, 0x0, 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0x40045532, 0x0) r5 = socket$inet_udp(0x2, 0x2, 0x0) bind$tipc(r2, &(0x7f00000001c0)=@nameseq={0x1e, 0x1, 0x3, {0x42, 0x1, 0x4}}, 0x5) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(r5, 0x89f1, &(0x7f0000000440)={'erspan0\x00', 0x0}) 24m26.674143397s ago: executing program 1 (id=1670): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0xc0000102, 0x0, 0x7}]}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0xbb7, 0x480009, 0x8, 0x7b5, 0xfffffff9}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r7, 0x0, 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, r7) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x2, @local}, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x2400c085}, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, &(0x7f0000000200)) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x4000004) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@bridge_newneigh={0x2c, 0x1c, 0x114236db3b607435, 0x70bd28, 0x25dfd3fe, {0x2, 0x0, 0x0, r9, 0x40, 0xa2, 0x4}, [@NDA_DST_IPV4={0x8, 0x1, @remote}, @NDA_MASTER={0x8, 0x9, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20040001}, 0x80c0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000440)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000003e000701feffffdf00000000017c0000040042800c00018006000600800a00148000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) syz_clone(0x42080000, 0x0, 0x0, 0x0, 0x0, 0x0) 24m22.092764836s ago: executing program 4 (id=1674): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x0) accept4(r2, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$cec(0x0, 0x0, 0x101) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005e00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/7, 0x7}, {&(0x7f0000000380)=""/101, 0x65}, {&(0x7f0000000400)=""/85, 0x55}, {&(0x7f0000000480)=""/101, 0x65}], 0x4}, 0x90f}, {{&(0x7f0000000500)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000240)=""/8, 0x8}, {&(0x7f0000000580)=""/46, 0x2e}, {&(0x7f00000005c0)=""/241, 0xf1}, {&(0x7f00000006c0)=""/213, 0xd5}, {&(0x7f00000007c0)=""/79, 0x4f}, {&(0x7f0000000840)=""/1, 0x1}, {&(0x7f0000000880)=""/231, 0xe7}, {&(0x7f0000000980)=""/27, 0x1b}], 0x8, &(0x7f0000000a40)=""/59, 0x3b}}, {{&(0x7f0000000a80)=@generic, 0x80, &(0x7f0000001c80)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/166, 0xa6}, {&(0x7f0000001bc0)=""/175, 0xaf}], 0x3, &(0x7f0000001cc0)=""/135, 0x87}, 0xd}, {{&(0x7f0000001d80)=@qipcrtr, 0x80, &(0x7f0000001f00)=[{&(0x7f0000001e00)=""/148, 0x94}, {&(0x7f0000001ec0)=""/2, 0x2}], 0x2, &(0x7f0000001f40)=""/24, 0x18}, 0x101}, {{&(0x7f0000001f80)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000005f00)=[{&(0x7f0000002000)=""/183, 0xb7}, {&(0x7f00000020c0)=""/4096, 0x1000}, {&(0x7f00000030c0)=""/182, 0xb6}, {&(0x7f0000003180)=""/246, 0xf6}, {&(0x7f0000003280)=""/227, 0xe3}, {&(0x7f0000003400)=""/67, 0x43}], 0x6, &(0x7f0000005f40)=""/4096, 0x1000}, 0x2}, {{&(0x7f00000044c0)=@nfc_llcp, 0x80, 0x0, 0x0, &(0x7f0000005640)=""/194, 0xc2}, 0xe}, {{0x0, 0x0, &(0x7f0000005dc0)=[{&(0x7f00000057c0)=""/156, 0x9c}, {0x0}, {&(0x7f0000005940)=""/39, 0x27}, {&(0x7f0000005980)=""/164, 0xa4}, {&(0x7f0000005a40)=""/248, 0xf8}, {&(0x7f0000005b40)=""/187, 0xbb}, {&(0x7f0000005c00)=""/187, 0xbb}, {&(0x7f0000005cc0)=""/239, 0xef}], 0x8}, 0x9}], 0x7, 0x2140, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x707c, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x12a8f, 0xf264, 0x40, 0x0, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000200)={0xf0f000, 0x800001}) write$dsp(0xffffffffffffffff, 0x0, 0x0) 24m17.783369028s ago: executing program 4 (id=1678): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r0, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r0, &(0x7f0000000200)={0xa, 0x0, 0x2, @loopback}, 0x1c) setsockopt$inet6_tcp_TCP_ULP(r0, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r0, 0x6, 0x14, &(0x7f00000004c0)=0x1, 0x4) writev(r0, &(0x7f0000001780)=[{&(0x7f00000006c0)="ba74d6a717d19f0797fde80e38", 0xd}], 0x1) setsockopt$inet6_tcp_TLS_TX(r0, 0x11a, 0x2, &(0x7f0000000680)=@gcm_128={{0x303}, "000037d7009400", "c0b6c5b29ca2b838d41ac2fc7ddf972d", "e9be1eae", "bb10000000000001"}, 0x28) pipe(&(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) socketpair$unix(0x1, 0x5, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r4 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$inet_tcp_int(r4, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) connect$inet(r4, &(0x7f0000000140)={0x2, 0x0, @remote}, 0x10) setsockopt$inet_tcp_TCP_REPAIR_OPTIONS(r4, 0x6, 0x16, &(0x7f0000000000), 0x20000328) setsockopt$inet_tcp_TCP_REPAIR_WINDOW(r4, 0x6, 0x1d, &(0x7f0000000040)={0x9, 0x8, 0x0, 0x100, 0x8}, 0x14) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, 0x0, 0x4000000) socket$nl_netfilter(0x10, 0x3, 0xc) splice(r0, 0x0, r1, 0x0, 0xf3a, 0x6) 24m16.656863946s ago: executing program 0 (id=1680): mmap(&(0x7f0000000000/0xfbe000)=nil, 0xfbe000, 0x8, 0x4010, 0xffffffffffffffff, 0x9ef43000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) getsockname$unix(r1, 0x0, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) (async) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0xb2d, 0x9, 0x0, 0x9fc, 0xfa15, 0xffffffff}, 0x0) (async) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0xb2d, 0x9, 0x0, 0x9fc, 0xfa15, 0xffffffff}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) fsopen(&(0x7f0000000180)='proc\x00', 0x1) syz_open_dev$usbfs(0x0, 0x1ff, 0x402) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f0000000140)={0x3, 'bond_slave_1\x00', {0xf7}, 0x6}) (async) ioctl$sock_SIOCGIFVLAN_SET_VLAN_EGRESS_PRIORITY_CMD(r1, 0x8982, &(0x7f0000000140)={0x3, 'bond_slave_1\x00', {0xf7}, 0x6}) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, &(0x7f00000000c0)=0xb0000) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000180)={{@host}, 0xe1, 0x800000000000002, 0x20007fff}) (async) ioctl$IOCTL_VMCI_QUEUEPAIR_SETVA(0xffffffffffffffff, 0x7a4, &(0x7f0000000180)={{@host}, 0xe1, 0x800000000000002, 0x20007fff}) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40046602, &(0x7f0000000040)=0x4) (async) ioctl$FS_IOC_SETFLAGS(0xffffffffffffffff, 0x40046602, &(0x7f0000000040)=0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, 0x0) socket$inet(0x2, 0x2, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) (async) writev(r2, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) writev(r2, &(0x7f0000000300)=[{&(0x7f00000001c0)="390000001300034700bb5be1c3e4feff06000000010000004500000025000000190004000400ad000d00000000000006040000000000f93132", 0x39}], 0x1) r3 = syz_open_procfs(0x0, &(0x7f0000000000)='mountinfo\x00') preadv(r3, &(0x7f0000000200)=[{&(0x7f0000000240)=""/198, 0xc6}], 0x1, 0x14a, 0x0) (async) preadv(r3, &(0x7f0000000200)=[{&(0x7f0000000240)=""/198, 0xc6}], 0x1, 0x14a, 0x0) r4 = syz_usb_connect(0x5, 0x24, &(0x7f0000000080)=ANY=[@ANYBLOB="1201000007794608cd0c39007b90000000010902120001fc0000000904"], 0x0) syz_usb_control_io$cdc_ecm(r4, 0x0, 0x0) r5 = syz_open_dev$I2C(&(0x7f0000000040), 0x1, 0x2603) ioctl$I2C_RDWR(r5, 0x707, &(0x7f00000000c0)={&(0x7f0000000200)}) 24m13.87883262s ago: executing program 4 (id=1681): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000080)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x458, 0x5017, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x40, 0xff}}}}}]}}]}}, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000000)={0x0}, 0x1, 0x0, 0x0, 0x4000811}, 0x0) r1 = socket$netlink(0x10, 0x3, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) socket(0x400000000010, 0x3, 0x0) socket(0x10, 0x3, 0x0) socket$unix(0x1, 0x1, 0x0) socket$nl_route(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg(r3, 0x0, 0x0, 0x4) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f00000000c0)=@pppol2tp={0x18, 0x1, {0x0, r4, {0x2, 0x4e20, @remote}, 0x4, 0x0, 0x2}}, 0x26) r6 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r7 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000001300)=@newtfilter={0x38, 0x2c, 0xd27, 0x70bd28, 0xfffff000, {0x0, 0x0, 0x0, r8, {0xf000, 0xffff}, {}, {0x7, 0xfff3}}, [@filter_kind_options=@f_fw={{0x7}, {0xc, 0x2, [@TCA_FW_CLASSID={0x8, 0x1, {0x0, 0xfff1}}]}}]}, 0x38}}, 0x200c8080) sendmmsg(r1, &(0x7f00000002c0), 0x40000000000009f, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f0000000300)={0x24, 0x0, 0x0, &(0x7f0000000140)=ANY=[@ANYBLOB="002205000000370988652655bfb4df2cd9ce424acf73"], 0x0}, 0x0) syz_usb_connect$cdc_ecm(0x3, 0x5e, &(0x7f0000000000)=ANY=[@ANYBLOB="12010000020000102505a1a440000000010109024c00010100c08109040000fe02020000052406000005240002000d240f01bfffffff000000000004241302042407"], 0x0) openat$loop_ctrl(0xffffff9c, &(0x7f00000000c0), 0x361fb71abc9d5ba9, 0x0) 24m12.461650244s ago: executing program 0 (id=1683): r0 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000080)=@newlink={0x5c, 0x10, 0xffffffffffffffff, 0x70bd25, 0x25dfdbff, {0x0, 0x0, 0x0, 0x0, 0xd6e0a8bb8df36d4e, 0x70823}, [@IFLA_LINKINFO={0x3c, 0x12, 0x0, 0x1, @ipip6={{0xb}, {0x2c, 0x2, 0x0, 0x1, [@IFLA_IPTUN_REMOTE={0x14, 0x3, @loopback={0xfec0ffffffffffff}}, @IFLA_IPTUN_LOCAL={0x14, 0x2, @ipv4={'\x00', '\xff\xff', @private=0xa010100}}]}}}]}, 0x5c}, 0x1, 0x0, 0x300}, 0x24000800) 24m12.280444315s ago: executing program 0 (id=1684): r0 = openat$vicodec0(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000780)=@newsa={0x144, 0x10, 0x1, 0xbffffffe, 0x100, {{@in6=@initdev={0xfe, 0x88, '\x00', 0x0, 0x0}, @in=@local, 0x1, 0x794, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@loopback, {0x0, 0x9, 0x6, 0xffff, 0x8251c, 0x2, 0xfffffffffffffff8}, {0xffffffffffffffff, 0x0, 0x1f, 0x1ff}, {0x2, 0xfffffffc}, 0x70bd2a, 0x3504, 0x2, 0x1, 0xfd, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}, @mark={0xc, 0x15, {0x35075a, 0x4}}]}, 0x144}, 0x1, 0x0, 0x0, 0x8801}, 0x10) r2 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x2) r3 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100, 0x10000, 0x2000000}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r3, 0x48e9, 0x0, 0x2, 0x0, 0x0) socket$nl_xfrm(0x10, 0x3, 0x6) r6 = open_tree(r2, &(0x7f0000000100)='./file0\x00', 0x1) sendmsg$nl_xfrm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000500)=@newsa={0x134, 0x18, 0x200, 0xfffffffe, 0x100, {{@in6=@ipv4={'\x00', '\xff\xff', @private=0xa410102}, @in6=@mcast1, 0x1, 0x71c, 0x4e23, 0x5, 0x0, 0x0, 0x0, 0x3a}, {@in6=@mcast2, 0x4d4, 0x6c}, @in=@broadcast, {0x0, 0x192, 0x9ba3, 0xffff, 0x8251c, 0x5, 0xfffffffffffffffc}, {0xffffffffffffffff, 0xfffffffffffffffc, 0x1f, 0xfffffffffffffffe}, {0xfffffffa, 0xfffffffc}, 0x80, 0x3500, 0x2, 0x1, 0x0, 0x20}, [@algo_comp={0x48, 0x3, {{'deflate\x00'}}}]}, 0x134}, 0x1, 0x0, 0x0, 0x8801}, 0x0) r7 = socket$pppl2tp(0x18, 0x1, 0x1) r8 = socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r7, &(0x7f0000000240)=@pppol2tpin6={0x18, 0x1, {0x0, r8, 0x8, 0x0, 0x0, 0x0, {0xa, 0x0, 0x0, @rand_addr=' \x01\x00'}}}, 0x32) writev(r7, &(0x7f0000000180)=[{&(0x7f0000000080)='v', 0x1fffa2}], 0x1) ioctl$VIDIOC_G_EXT_CTRLS(r0, 0xc0185648, &(0x7f0000000080)={0xf000000, 0x2, 0x0, 0xffffffffffffffff, 0x0, &(0x7f00000000c0)={0x98f909, 0x8002, '\x00', @p_u16=0x0}}) 24m12.01394883s ago: executing program 0 (id=1685): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_group_source_req(r0, 0x29, 0x2e, &(0x7f0000000200)={0x1, {{0xa, 0x0, 0x0, @mcast1={0xff, 0x7}}}, {{0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @local}}}}, 0x108) r1 = syz_open_procfs(0x0, &(0x7f00000003c0)='net/mcfilter6\x00') preadv(r1, &(0x7f0000000340)=[{&(0x7f0000000600)=""/117, 0x75}], 0x1, 0x9, 0x0) mmap$IORING_OFF_SQ_RING(&(0x7f0000bb9000/0x3000)=nil, 0x3000, 0x0, 0x4010, 0xffffffffffffffff, 0x0) socket(0xa, 0x3, 0x3a) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x3) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000140)=[{&(0x7f0000001880)="5c00000012006bab9e3de3d86e6c1dffff137e0300000000000000b68675f8001d000a00a0e69ee517d34460bc24eab556a7e6241e6182949a36c23d3b48dfd8cdbf9367b4fa51f60a64c9f408000300060100000800030011000000", 0x5c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) recvmsg(r4, &(0x7f0000000300)={0x0, 0x0, 0x0}, 0x2) madvise(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xf) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x2a) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) 24m11.057987134s ago: executing program 33 (id=1670): r0 = openat$kvm(0xffffffffffffff9c, 0x0, 0x2, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0x22040, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000000080)={0x1, 0x0, [{0xc0000102, 0x0, 0x7}]}) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x1, 0x0, 0xbb7, 0x480009, 0x8, 0x7b5, 0xfffffff9}, 0x0) r7 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_netfilter(r7, 0x0, 0x0) openat$dsp(0xffffffffffffff9c, 0x0, 0x42, 0x0) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(0x0, r7) connect$inet(0xffffffffffffffff, &(0x7f0000000040)={0x2, 0x2, @local}, 0x10) sendmsg$TIPC_NL_BEARER_ENABLE(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000240)=ANY=[], 0x14}, 0x1, 0x0, 0x0, 0x2400c085}, 0x0) ioctl$TIOCGISO7816(0xffffffffffffffff, 0x80285442, &(0x7f0000000200)) sendmsg$TIPC_NL_KEY_SET(0xffffffffffffffff, 0x0, 0x4000004) r8 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000040)={'lo\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000380)=@bridge_newneigh={0x2c, 0x1c, 0x114236db3b607435, 0x70bd28, 0x25dfd3fe, {0x2, 0x0, 0x0, r9, 0x40, 0xa2, 0x4}, [@NDA_DST_IPV4={0x8, 0x1, @remote}, @NDA_MASTER={0x8, 0x9, 0x7}]}, 0x2c}, 0x1, 0x0, 0x0, 0x20040001}, 0x80c0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000440)={&(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffe000/0x1000)=nil, &(0x7f0000ffe000/0x2000)=nil, &(0x7f0000fff000/0x1000)=nil, &(0x7f0000ffb000/0x4000)=nil, &(0x7f0000ffc000/0x1000)=nil, 0x0}, 0x68) r10 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)=ANY=[@ANYBLOB="2c0000003e000701feffffdf00000000017c0000040042800c00018006000600800a00148000000000000000"], 0x2c}, 0x1, 0x0, 0x0, 0x4048011}, 0xc000) syz_clone(0x42080000, 0x0, 0x0, 0x0, 0x0, 0x0) 24m10.630996692s ago: executing program 4 (id=1688): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x0) accept4(r2, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$cec(0x0, 0x0, 0x101) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005e00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/7, 0x7}, {&(0x7f0000000380)=""/101, 0x65}, {&(0x7f0000000400)=""/85, 0x55}, {&(0x7f0000000480)=""/101, 0x65}], 0x4}, 0x90f}, {{&(0x7f0000000500)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000240)=""/8, 0x8}, {&(0x7f0000000580)=""/46, 0x2e}, {&(0x7f00000005c0)=""/241, 0xf1}, {&(0x7f00000006c0)=""/213, 0xd5}, {&(0x7f00000007c0)=""/79, 0x4f}, {&(0x7f0000000840)=""/1, 0x1}, {&(0x7f0000000880)=""/231, 0xe7}, {&(0x7f0000000980)=""/27, 0x1b}], 0x8, &(0x7f0000000a40)=""/59, 0x3b}}, {{&(0x7f0000000a80)=@generic, 0x80, &(0x7f0000001c80)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/166, 0xa6}, {&(0x7f0000001bc0)=""/175, 0xaf}], 0x3, &(0x7f0000001cc0)=""/135, 0x87}, 0xd}, {{&(0x7f0000001d80)=@qipcrtr, 0x80, &(0x7f0000001f00)=[{&(0x7f0000001e00)=""/148, 0x94}, {&(0x7f0000001ec0)=""/2, 0x2}], 0x2, &(0x7f0000001f40)=""/24, 0x18}, 0x101}, {{&(0x7f0000001f80)=@in6={0xa, 0x0, 0x0, @loopback}, 0x80, &(0x7f0000005f00)=[{&(0x7f0000002000)=""/183, 0xb7}, {&(0x7f00000020c0)=""/4096, 0x1000}, {&(0x7f00000030c0)=""/182, 0xb6}, {&(0x7f0000003180)=""/246, 0xf6}, {&(0x7f0000003280)=""/227, 0xe3}, {0x0}, {&(0x7f0000003400)=""/67, 0x43}], 0x7, &(0x7f0000005f40)=""/4096, 0x1000}, 0x2}, {{&(0x7f00000044c0)=@nfc_llcp, 0x80, 0x0, 0x0, &(0x7f0000005640)=""/194, 0xc2}, 0xe}, {{0x0, 0x0, &(0x7f0000005dc0)=[{&(0x7f00000057c0)=""/156, 0x9c}, {0x0}, {&(0x7f0000005940)=""/39, 0x27}, {&(0x7f0000005980)=""/164, 0xa4}, {&(0x7f0000005a40)=""/248, 0xf8}, {&(0x7f0000005b40)=""/187, 0xbb}, {&(0x7f0000005c00)=""/187, 0xbb}, {&(0x7f0000005cc0)=""/239, 0xef}], 0x8}, 0x9}], 0x7, 0x2140, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x707c, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x12a8f, 0xf264, 0x40, 0x0, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000200)={0xf0f000, 0x800001}) write$dsp(0xffffffffffffffff, 0x0, 0x0) 24m5.738347827s ago: executing program 0 (id=1689): r0 = openat(0xffffffffffffff9c, &(0x7f0000000080)='./file1\x00', 0x2040, 0x0) fcntl$setlease(r0, 0x400, 0x0) r1 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) r2 = openat(0xffffffffffffff9c, &(0x7f0000000200)='./file1\x00', 0x88040, 0x0) fcntl$setlease(r2, 0x400, 0x0) r3 = syz_open_dev$swradio(&(0x7f00000046c0), 0x1, 0x2) ioctl$VIDIOC_S_FREQUENCY(r3, 0x402c5639, &(0x7f00000000c0)={0x2, 0x3, 0x8}) fcntl$setlease(r1, 0x400, 0x2) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f0000000100), 0x0) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) ioctl$SNDRV_SEQ_IOCTL_GET_SUBSCRIPTION(r4, 0xc0505350, &(0x7f0000000700)={{0x0, 0x1}, {0xf, 0x2f}, 0x40}) 24m3.903900635s ago: executing program 4 (id=1690): r0 = socket(0xa, 0x3, 0xff) connect$inet6(r0, &(0x7f00000000c0)={0xa, 0x4e22, 0x2, @initdev={0xfe, 0x88, '\x00', 0xff, 0x0}, 0x6}, 0x1c) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc01cf509, &(0x7f0000000000)={r0, 0x2, 0xe, 0x1c00000000000000}) ioctl$KVM_CAP_VM_DISABLE_NX_HUGE_PAGES(r1, 0x4068aea3, &(0x7f0000000140)) sendmsg$TIPC_NL_KEY_SET(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000001200)=ANY=[], 0x54}}, 0x0) 24m2.708649773s ago: executing program 0 (id=1691): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206010200000000000000000a0040007be459cb0e0003006269746d61703a697000000005000401000072413c9c93d36d6b7a30000000001c0007800c00028008000100e00000010c00018008000140ac1414aa050005000200000005001f1a06000000b32b5105c82570d1799c7ae31919963fd9357b6f4e556d28f7d0ca393b892991cea3fc4f8b9283f597eed093fd4154bf45cf8121306c86ee75c30729d705929092a8536156c3fb2d776adb1e114fabde3672eaf2a29c9b83d99bc7ce2ab76d061146fa5ee72daeb3b3c0f05c1b5a79bb4e0e4175269bf28ccc906688bed483bda981554915e36dd9e0e2c570d0577853e89f99"], 0x64}}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) r3 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$FBIOPAN_DISPLAY(r3, 0x4606, &(0x7f0000000200)={0x190, 0x640, 0x500, 0x280, 0x9, 0xfffffffd, 0x18, 0x1, {0x5, 0x8001}, {0x0, 0x7}, {0x9}, {0x29}, 0x1, 0x1, 0x7e, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x3, 0x8, 0xd, 0x7fff, 0x0, 0x0, 0x3, 0x5}) r4 = inotify_init1(0x800) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r5, 0x0, 0x17, 0x0, 0x0) inotify_rm_watch(r4, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x20000, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000001580), 0x403, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000000000)={0x2d, 0x1, 0x0, "3a8e00000034b52ba75066c27891ca55e21f0000000000b2b678d200", 0x32344d59}) lseek(r6, 0x8, 0x1) syz_open_procfs(0xffffffffffffffff, 0x0) r8 = socket$unix(0x1, 0x2, 0x0) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="0500000001ea2f3352c9a24cfb0fe8f3", @ANYRES64=r7, @ANYRES64, @ANYRES64=0x0, @ANYRES64=r8, @ANYBLOB="b7eb290aca38c21c4d3ea310d982810f42e7787e9f1e63f1e9c2a465c624c8b61cb1b27a775cde3d823c9f473e32395052fd2b26ee4c8a6b1e80a7d7b3ebad23b01308ca0bd1f19c5c4deb5ed2fb54e8c98b5fd2ec1933c0cb41102ca4f79cde72d9f474705e55926a2d255fc6791ec49aaf68a5977ca5cfd3b9c3e96f4da49be5b5addb2674d91912bfedff5a904d5d300179a578dd689304"], 0x20000600}}, 0x0) truncate(&(0x7f0000000200)='./mnt\x00', 0x4) socket$inet6(0xa, 0x3, 0x7ff) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7400, 0x0, 0x0, 0x0, 0x0, 0x0) 24m0.632824638s ago: executing program 4 (id=1692): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'macvlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x3, 0x39, {0x0, 0x0, 0x74, r2, {0x0, 0x7}, {0x0, 0x4}, {0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 23m47.188886945s ago: executing program 34 (id=1691): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r2, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000004c0)=ANY=[@ANYBLOB="640000000206010200000000000000000a0040007be459cb0e0003006269746d61703a697000000005000401000072413c9c93d36d6b7a30000000001c0007800c00028008000100e00000010c00018008000140ac1414aa050005000200000005001f1a06000000b32b5105c82570d1799c7ae31919963fd9357b6f4e556d28f7d0ca393b892991cea3fc4f8b9283f597eed093fd4154bf45cf8121306c86ee75c30729d705929092a8536156c3fb2d776adb1e114fabde3672eaf2a29c9b83d99bc7ce2ab76d061146fa5ee72daeb3b3c0f05c1b5a79bb4e0e4175269bf28ccc906688bed483bda981554915e36dd9e0e2c570d0577853e89f99"], 0x64}}, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) openat$ttyS3(0xffffffffffffff9c, 0x0, 0x0, 0x0) openat$fb0(0xffffffffffffff9c, &(0x7f00000001c0), 0x80, 0x0) r3 = pidfd_getfd(0xffffffffffffffff, r1, 0x0) ioctl$FBIOPAN_DISPLAY(r3, 0x4606, &(0x7f0000000200)={0x190, 0x640, 0x500, 0x280, 0x9, 0xfffffffd, 0x18, 0x1, {0x5, 0x8001}, {0x0, 0x7}, {0x9}, {0x29}, 0x1, 0x1, 0x7e, 0x4, 0x0, 0xffffffff, 0x0, 0x0, 0x3, 0x8, 0xd, 0x7fff, 0x0, 0x0, 0x3, 0x5}) r4 = inotify_init1(0x800) r5 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r5, 0x0, 0x17, 0x0, 0x0) inotify_rm_watch(r4, 0x0) r6 = openat(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x20000, 0x0) r7 = syz_open_dev$vim2m(&(0x7f0000001580), 0x403, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r7, 0xc0405602, &(0x7f0000000000)={0x2d, 0x1, 0x0, "3a8e00000034b52ba75066c27891ca55e21f0000000000b2b678d200", 0x32344d59}) lseek(r6, 0x8, 0x1) syz_open_procfs(0xffffffffffffffff, 0x0) r8 = socket$unix(0x1, 0x2, 0x0) r9 = socket$can_bcm(0x1d, 0x2, 0x2) connect$can_bcm(r9, &(0x7f0000000000), 0x10) sendmsg$can_bcm(r9, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000300)=ANY=[@ANYBLOB="0500000001ea2f3352c9a24cfb0fe8f3", @ANYRES64=r7, @ANYRES64, @ANYRES64=0x0, @ANYRES64=r8, @ANYBLOB="b7eb290aca38c21c4d3ea310d982810f42e7787e9f1e63f1e9c2a465c624c8b61cb1b27a775cde3d823c9f473e32395052fd2b26ee4c8a6b1e80a7d7b3ebad23b01308ca0bd1f19c5c4deb5ed2fb54e8c98b5fd2ec1933c0cb41102ca4f79cde72d9f474705e55926a2d255fc6791ec49aaf68a5977ca5cfd3b9c3e96f4da49be5b5addb2674d91912bfedff5a904d5d300179a578dd689304"], 0x20000600}}, 0x0) truncate(&(0x7f0000000200)='./mnt\x00', 0x4) socket$inet6(0xa, 0x3, 0x7ff) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) syz_clone(0x640c7400, 0x0, 0x0, 0x0, 0x0, 0x0) 23m44.676072288s ago: executing program 35 (id=1692): r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$packet(0x11, 0x2, 0x300) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000080)={'macvlan0\x00', 0x0}) sendmsg$nl_route_sched(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000004c00)=@newtfilter={0x24, 0x11, 0xd27, 0x3, 0x39, {0x0, 0x0, 0x74, r2, {0x0, 0x7}, {0x0, 0x4}, {0xc}}}, 0x24}, 0x1, 0xf0ffffffffffff}, 0x0) 23m18.43199935s ago: executing program 3 (id=1702): socket$nl_generic(0x10, 0x3, 0x10) ioctl$VIDIOC_G_CTRL(0xffffffffffffffff, 0xc008561b, &(0x7f0000000100)={0x7a72, 0x1}) syz_open_dev$vim2m(0x0, 0x1000001, 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f00000001c0)={0x0, 0x0}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$OBJ_GET_PROG(0x7, 0x0, 0x0) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000540)={0x26, 'skcipher\x00', 0x0, 0x0, 'ecb-twofish-avx\x00'}, 0x58) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000c18000)="ad56b6c5820fae9d6dcd3292ea54c7beef915d564c90c200", 0x18) r3 = accept4(r2, 0x0, 0x0, 0x80800) sendmsg$nl_route_sched(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000005c0)=@gettaction={0xe0, 0x32, 0x8, 0x70bd29, 0x25dfdbfb, {}, [@action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x4}, @action_gd=@TCA_ACT_TAB={0x14, 0x1, [{0x10, 0x1a, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}]}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x6}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8}, @action_dump_flags=@TCA_ROOT_TIME_DELTA={0x8, 0x4, 0x1}, @action_gd=@TCA_ACT_TAB={0x60, 0x1, [{0xc, 0x5, 0x0, 0x0, @TCA_ACT_KIND={0x8, 0x1, 'ife\x00'}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x2}}, {0xc, 0xa, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x8}}, {0xc, 0x1f, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0x10, 0x18, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}, {0xc, 0x3, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x3}}, {0x10, 0xb, 0x0, 0x0, @TCA_ACT_KIND={0x9, 0x1, 'vlan\x00'}}]}, @action_gd=@TCA_ACT_TAB={0x38, 0x1, [{0x10, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0xb, 0x1, 'sample\x00'}}, {0xc, 0x20, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x5}}, {0xc, 0x10, 0x0, 0x0, @TCA_ACT_INDEX={0x8, 0x3, 0x1000}}, {0xc, 0x13, 0x0, 0x0, @TCA_ACT_KIND={0x7, 0x1, 'xt\x00'}}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x4000}, 0xc050) recvmsg$can_bcm(r3, &(0x7f0000000300)={0x0, 0xf0ff, &(0x7f00000001c0)=[{&(0x7f00000003c0)=""/233, 0xe9}, {&(0x7f00000004c0)=""/74, 0x4a}], 0x2}, 0x20) 23m16.713119744s ago: executing program 3 (id=1703): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffb, 0x0, 0x4) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x4, 0x2004, @fd_index, 0x8456, 0x0, 0x0, 0x14, 0x1, {0x7}}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) accept4(0xffffffffffffffff, 0x0, 0x0, 0x800) 23m12.381094404s ago: executing program 3 (id=1704): r0 = socket$inet6_udp(0xa, 0x2, 0x0) sendmsg$inet6(r0, &(0x7f0000000400)={&(0x7f00000000c0)={0xa, 0x4e20, 0x0, @loopback, 0x4002}, 0x1c, 0x0, 0x0, &(0x7f0000000280)=[@dstopts={{0x154, 0x29, 0x37, {0x7, 0x27, '\x00', [@generic={0x0, 0xfa, "f9bcddba542ce97cbed1b084ecf5718eb3bbb886fbe9581fa77e586ea2742ff8f837a068b95ca0370e2ad3c7e68edb1420cbcc88d40174660274d409948bde0a3d42ed03ee42b108d7537a4fdb1bb6da88382a0708875336263214f25c98a85bceab4d8789dead744a1335083a7e76b788adb783f68245fd1b371fede70722bc1ed1f470ef365854010b462eecd75c9e7701f9e22318a201701ba2937ef1b4dc3ec5beffd97bb9cd0eda19e8e77e54432bf85b32f89c94b6a53ae90381cc3d1ba24d39b4b3319ad6cf1f42b6d5cd9cccc24fa2f0a7851b1820e4439fa2b8f1d14ef8c274dade44da23ebe779f5e0784ba383da08779054cb3bf6"}, @jumbo, @hao={0xc9, 0x10, @private0={0xfc, 0x0, '\x00', 0x1}}, @ra={0x5, 0x2, 0x7}, @hao={0xc9, 0x10, @private2}, @hao={0xc9, 0x10, @dev={0xfe, 0x80, '\x00', 0xa}}]}}}, @hoplimit={{0x10}}], 0x164}, 0x24004091) 23m11.613338771s ago: executing program 3 (id=1705): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x42, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000000)={0x79}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000300)=@abs, 0x6e) stat(&(0x7f0000000200)='./file1\x00', &(0x7f00000012c0)) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) unshare(0x22020400) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r3, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000040)='net/wireless\x00') bpf$PROG_LOAD(0x5, &(0x7f0000000240)={0x1, 0x4, &(0x7f0000000ac0)=ANY=[@ANYBLOB="b70500000000000061103000000000000fa000000000000095000000000000001f495ff727520cccddfad6fab92a770b445d050000006edc1b5613c5e35079725d19e88b662c2596b2f0b40aa9de45cf931a7ddaae7bdd97a9787684a5a6bbe879d6561715a194eb15d509b1837f6d317d12dd2c98f05e43aa14b3655a78009367bac65148a671b0ffd1c946b31202b7c73e0f1c5df29d57ed708602599a04fde318753c358d42ba7c52b4e20bc5c0e91fbc96da558c38891cd5bc38b6db9863a1273811976d15ba39fe2700"/218], &(0x7f00000002c0)='GPL\x00', 0x5, 0x3, &(0x7f0000000300)=""/188, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x1f3, 0x10, &(0x7f0000000080), 0xfffffffffffffc79, 0x0, 0xffffffffffffffff, 0xfffffffffffffe21}, 0x2a) preadv(r4, &(0x7f00000026c0)=[{&(0x7f0000000240)=""/4088, 0xff8}], 0x1, 0x15f, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r5, 0x0, 0xc8, &(0x7f0000000000), 0x4) setsockopt$MRT_ADD_VIF(r5, 0x0, 0xca, &(0x7f00000002c0)={0x1, 0x4, 0x10, 0x0, @vifc_lcl_addr=@multicast2, @remote}, 0x10) setsockopt$MRT_ADD_MFC_PROXY(r5, 0x0, 0xd2, &(0x7f0000000280)={@initdev={0xac, 0x1e, 0x0, 0x0}, @empty, 0x0, "614af285791a63abd0f993af8077b5cd01e03d64a831683fdc3fd440829c82ae"}, 0x3c) setsockopt$MRT_FLUSH(r5, 0x0, 0xd4, &(0x7f0000000040)=0x6, 0x4) syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), r4) openat$sysfs(0xffffff9c, &(0x7f00000000c0)='/sys/kernel/fscaps', 0x640000, 0xa8) r6 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r6, 0x4008ae89, &(0x7f0000001340)=ANY=[@ANYBLOB="0101000000000000710000400000000000000c0000473dbdb3ccefde8723be9cd42d996ff9e67b3ac701fe95bbd6c13819b632138562d1c14a5e6455da0c30c9b630222b734ddab066068acb246015616f81d85b83dd58b39548ee8d4c2d955b696aaec7cb7c9140cc69421884fbe61ab64c71e3084a25026a8eb1e0fe47ec193cf8b76b1b31161292ee511732cc8958afd3105cf41edca93cfa4a788fd2d3bbf8ab86186b837c9ae0a60ce2bb737468c9aea937f3caedf625fd24bd75d766309074a034a980a7ea09923991fb1b1de4991d1268dd26b4c2c6ff0db7aea5ddc0196cfa31d66eed4d0af9d2a8e1f5d95d5452351371d9d0c26446c4e9bc04b30aadc930ea245a92dff838777cb1d19bbb8491119457a1051f941a8555adc453b351a72f4e2b42827b9ff621a3578de3ae7ada7d9c34b649d8dfc5d21fdef6"]) openat$vcsa(0xffffff9c, 0x0, 0x80000, 0x0) 23m6.751485785s ago: executing program 3 (id=1706): r0 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) r1 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) connect$inet(r1, &(0x7f00000009c0)={0x2, 0x4e24, @dev={0xac, 0x14, 0x14, 0x21}}, 0x10) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r2, &(0x7f0000000140)={0x28, 0x0, 0x2710, @local}, 0x10) listen(r2, 0x0) accept4(r2, 0x0, 0x0, 0x0) timer_create(0x0, &(0x7f0000000200)={0x0, 0x21, 0x2, @tid=0xffffffffffffffff}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x25, &(0x7f0000000040)={0x0, 0x0, 0x60d3, 0x5}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) timer_settime(0x0, 0x1, &(0x7f0000000040)={{}, {0x0, 0x989680}}, 0x0) syz_open_dev$cec(0x0, 0x0, 0x101) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@abs={0x1, 0x0, 0x4e20}, 0x6e) sendmmsg$unix(0xffffffffffffffff, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(0xffffffffffffffff, &(0x7f0000005e00)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f0000000180)=""/7, 0x7}, {&(0x7f0000000380)=""/101, 0x65}, {&(0x7f0000000400)=""/85, 0x55}, {&(0x7f0000000480)=""/101, 0x65}], 0x4}, 0x90f}, {{&(0x7f0000000500)=@llc={0x1a, 0x0, 0x0, 0x0, 0x0, 0x0, @random}, 0x80, &(0x7f0000000a00)=[{&(0x7f0000000240)=""/8, 0x8}, {&(0x7f0000000580)=""/46, 0x2e}, {&(0x7f00000005c0)=""/241, 0xf1}, {&(0x7f00000006c0)=""/213, 0xd5}, {&(0x7f00000007c0)=""/79, 0x4f}, {&(0x7f0000000840)=""/1, 0x1}, {&(0x7f0000000880)=""/231, 0xe7}, {&(0x7f0000000980)=""/27, 0x1b}], 0x8, &(0x7f0000000a40)=""/59, 0x3b}}, {{&(0x7f0000000a80)=@generic, 0x80, &(0x7f0000001c80)=[{&(0x7f0000000b00)=""/4096, 0x1000}, {&(0x7f0000001b00)=""/166, 0xa6}, {&(0x7f0000001bc0)=""/175, 0xaf}], 0x3, &(0x7f0000001cc0)=""/135, 0x87}, 0xd}, {{&(0x7f0000001d80)=@qipcrtr, 0x80, &(0x7f0000001f00)=[{&(0x7f0000001e00)=""/148, 0x94}, {&(0x7f0000001ec0)=""/2, 0x2}], 0x2, &(0x7f0000001f40)=""/24, 0x18}, 0x101}, {{0x0, 0x0, &(0x7f0000005f00)=[{&(0x7f0000002000)=""/183, 0xb7}, {&(0x7f00000020c0)=""/4096, 0x1000}, {&(0x7f00000030c0)=""/182, 0xb6}, {&(0x7f0000003180)=""/246, 0xf6}, {&(0x7f0000003280)=""/227, 0xe3}, {&(0x7f0000003380)=""/80, 0x50}, {&(0x7f0000003400)=""/67, 0x43}], 0x7, &(0x7f0000005f40)=""/4096, 0x1000}, 0x2}, {{&(0x7f00000044c0)=@nfc_llcp, 0x80, 0x0, 0x0, &(0x7f0000005640)=""/194, 0xc2}, 0xe}, {{0x0, 0x0, &(0x7f0000005dc0)=[{&(0x7f00000057c0)=""/156, 0x9c}, {0x0}, {&(0x7f0000005940)=""/39, 0x27}, {&(0x7f0000005980)=""/164, 0xa4}, {&(0x7f0000005a40)=""/248, 0xf8}, {&(0x7f0000005b40)=""/187, 0xbb}, {&(0x7f0000005c00)=""/187, 0xbb}, {&(0x7f0000005cc0)=""/239, 0xef}], 0x8}, 0x9}], 0x7, 0x2140, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f00000000c0)={0x0, 0x707c, 0x400, 0x3, 0x288}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x12a8f, 0xf264, 0x40, 0x0, 0x0) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x47b, 0x2) ioctl$vim2m_VIDIOC_S_CTRL(r6, 0xc008561c, &(0x7f0000000200)={0xf0f000, 0x800001}) write$dsp(0xffffffffffffffff, 0x0, 0x0) 22m52.06756045s ago: executing program 3 (id=1707): r0 = socket$kcm(0xa, 0x3, 0x73) setsockopt$sock_attach_bpf(r0, 0x29, 0x21, &(0x7f0000000200), 0x4) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x41c2a, 0x10100, 0x0, 0x4, 0x0, r2}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) r8 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x5a79, 0x10100, 0x0, 0x0, 0x0, r7}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r6, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r8, 0x2ded, 0x4000, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, &(0x7f00000001c0), 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x2, 0xf, &(0x7f0000000000), 0x18) r11 = syz_clone(0x200000, 0x0, 0x0, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r11, 0x0, &(0x7f0000001780)=""/4096) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r3, 0x2ded, 0xad96, 0x24, 0x0, 0x0) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000040)={0x4, 0x3, 0x8100000, 0x1000, &(0x7f0000748000/0x1000)=nil}) r14 = ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r14, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYRESHEX=r10, @ANYRES64=r3, @ANYRES64, @ANYRESOCT=r12, @ANYRES16=r9, @ANYRESDEC=r1, @ANYRES8]) ioctl$KVM_RUN(r14, 0xae80, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) 22m24.816783556s ago: executing program 36 (id=1707): r0 = socket$kcm(0xa, 0x3, 0x73) setsockopt$sock_attach_bpf(r0, 0x29, 0x21, &(0x7f0000000200), 0x4) sendmsg$kcm(r0, 0x0, 0x0) sendmsg$inet6(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r2 = dup(r1) write$6lowpan_enable(r2, &(0x7f0000000000)='0', 0xfffffd2c) r3 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x41c2a, 0x10100, 0x0, 0x4, 0x0, r2}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) r6 = syz_open_dev$sndmidi(&(0x7f0000000040), 0x2, 0x141101) r7 = dup(r6) write$6lowpan_enable(r7, &(0x7f0000000000)='0', 0xfffffd2c) r8 = syz_io_uring_setup(0x239, &(0x7f0000000740)={0x0, 0x5a79, 0x10100, 0x0, 0x0, 0x0, r7}, &(0x7f0000000180)=0x0, &(0x7f00000001c0)=0x0) syz_io_uring_submit(r9, r10, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r6, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r8, 0x2ded, 0x4000, 0x0, 0x0, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={0xffffffffffffffff, 0x2000000, 0x0, 0x0, &(0x7f00000001c0), 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x4c) syz_open_dev$dri(&(0x7f0000000000), 0x1, 0x0) io_uring_enter(0xffffffffffffffff, 0x0, 0x2, 0xf, &(0x7f0000000000), 0x18) r11 = syz_clone(0x200000, 0x0, 0x0, &(0x7f0000000580), &(0x7f00000005c0), &(0x7f0000000600)) ptrace$PTRACE_SECCOMP_GET_FILTER(0x420c, r11, 0x0, &(0x7f0000001780)=""/4096) syz_io_uring_submit(r4, r5, &(0x7f0000000040)=@IORING_OP_POLL_ADD={0x6, 0x2, 0x0, @fd=r1, 0x0, 0x0, 0x0, {}, 0x1}) io_uring_enter(r3, 0x2ded, 0xad96, 0x24, 0x0, 0x0) r12 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) r13 = ioctl$KVM_CREATE_VM(r12, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r13, 0x4020ae46, &(0x7f0000000040)={0x4, 0x3, 0x8100000, 0x1000, &(0x7f0000748000/0x1000)=nil}) r14 = ioctl$KVM_CREATE_VCPU(r13, 0xae41, 0x0) ioctl$KVM_SET_MSRS(r14, 0x4008ae89, &(0x7f0000000080)=ANY=[@ANYRESHEX=r10, @ANYRES64=r3, @ANYRES64, @ANYRESOCT=r12, @ANYRES16=r9, @ANYRESDEC=r1, @ANYRES8]) ioctl$KVM_RUN(r14, 0xae80, 0x0) openat$ppp(0xffffffffffffff9c, &(0x7f0000001740), 0x101042, 0x0) 23.292688673s ago: executing program 6 (id=5902): r0 = socket(0x2b, 0x80801, 0x1) r1 = syz_open_dev$vim2m(&(0x7f0000000a40), 0xca83, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r1, 0xc0405602, &(0x7f0000000a80)={0x4000, 0xd, 0x0, "134600cea4dd512d97d4188cbf770637bc747721f37af54dd1dc03030096c337"}) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x0, 0x10000, @loopback, 0x1}, 0x1c) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a28000000000a030000000000000000000a00000708000240000000020900010073797a31000000002c000000030a010100000000000000000a0000070900010073797a31000000000900030073797a320000000014000000110001"], 0x7c}, 0x1, 0x0, 0x0, 0x4000}, 0x0) sendmsg$NFT_BATCH(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_NEWSET={0x48, 0x9, 0xa, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@NFTA_SET_TABLE={0x9, 0x1, 'syz1\x00'}, @NFTA_SET_KEY_LEN={0x8, 0x5, 0x1, 0x0, 0x2}, @NFTA_SET_NAME={0x9, 0x2, 'syz1\x00'}, @NFTA_SET_ID={0x8, 0xa, 0x1, 0x0, 0xfffffffc}, @NFTA_SET_EXPR={0xc, 0x11, 0x0, 0x1, @fib={{0x8}, @void}}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x1}}}, 0x70}, 0x1, 0x0, 0x0, 0x4000850}, 0x24000000) setsockopt$inet6_tcp_int(r0, 0x6, 0x6, &(0x7f0000000000)=0x1, 0x4) 23.170265284s ago: executing program 6 (id=5903): r0 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r0, 0x29, 0x31, &(0x7f0000000040)=0x4, 0x4) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) select(0x0, 0x0, 0x0, 0x0, 0x0) bind$inet6(r0, &(0x7f0000f65000)={0xa, 0x4e20, 0x97f, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0xfffffefffbfbbfbe, &(0x7f0000000100)={0xa, 0x4e20, 0x0, @empty}, 0x1c) getsockopt$inet6_buf(r0, 0x29, 0x6, 0x0, &(0x7f0000000080)) r1 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) r2 = syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, &(0x7f0000002880)={{'fd', 0x3d, r1}, 0x2c, {'rootmode', 0x3d, 0x4000}}, 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f0000000100)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r1, &(0x7f0000002140)={0x50, 0x0, r3, {0x7, 0x27, 0x0, 0x14a4014, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe}}, 0x50) read$FUSE(r1, &(0x7f000000b040)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INTERRUPT(r1, &(0x7f0000002240)={0x10, 0xffffffffffffffda, r4}, 0x10) syz_fuse_handle_req(r1, &(0x7f0000009040)="c9b6cf40d6a9928c6a8c0fdaba1e7bbd4ee597917b02ec4e8ff3bec8d7d8c08f8813039f40175e54e3d66ec19388ed788cf69c0c5b560f0401f1adb4b1f5198fe0bd7627cb9dc384db5b44495ba6094046fb2c8c7d0af7d67dbc3f5ef4aef8ec6bb01c52b6a10d4f9473987d0809b6a84f2ff8aae19a082abcb68b41c291add3ca2204a38c59e28c7c910aaa5a075676e541b6bb91de3854d2f97d3f80dc56c0705e74624a947f2c21ff936c6ba827742a24fd6d9e10b470ceb73a23fc57f5fa27cf073f2d0235e6fa4d1c29f9d0b6509c890ce0e7c3a2a4dd8b6336f02b9d7cc4c8e37f5f5a57f63aeec3228bd15b6d041eab97bccb14ee1ca6fbf7f7ed2e4dd0a32d41cc41c1031424b94621edcea1bddd40f3ad905202dfba3b912efd3468d2ad42b8a01bcb13b288afdc00b7e5857425d7919651160ec15447a26758f20653e69559f0892efc8f0715d8d79f52a44c79aba8ac58dc726ed721eeab3480eaacc2655d4b8831c9aff049c32709ab7adfb24ae767d45468dc0e42bc34b3568ce95e850eaabbf3a1be4d0f9b3e8781a2a9dc06374fe496a755b48abce67fd56de43816d64e883d9db51489ab8a81d1af3a180b6772d2bdac6313d3c183239d4c0bbbe76173f011f144ba71ac8043107f6533b3ef2f44924039b8587485749647315eb7bfe1e412e94f8cdaa937480fdd23769a69e14ea82d741484c99dd1ddd1edfb4faa51431f15531b61e59d68f9d189b27d0bf925970ac66fc35dbe1e430893cc60b28ca6d8e34931bf02154aee6f1fc58d0c0d8e48eaf8079ded67fdd9f19ebfa85d1ab6ec7f54e1963be353b34a6cb7fa35ddb60a9fc6bd1c6f11bf981b5a1bba81513fe447ff7eb2db0d27f1cfd04353e05f37d6c1bd6eb8219ce799338de3518bfec529373e4acfd644212be283856be064bac0f4926c02c0915816615f1f04d1d5136872029afee663f0bf1b6811c594e1465fba59f5727e5a826e3c60576bc2087f21521ffc90dcca39cbec7c0466c8fb7b1bcea7cffb333d2d16daa269d63f4911d10ed24462b37cdceb7c88e819489e1939e5e3cdcc5a858d09803c98d9e5fd617bc92c0880f072c54608f6ea69edba05b4edcd8d3f5e3c926220a191f2aa0d2f0c9158e298bc2e756ee091a0ac48752e4bb56fac67b02eb2c7b3380244ed66648482d8bc2a29bfc26ade0f4a5665282ea408254fd88e2812a184ee9af9c7769fba1ec380043d5cdf6056f89b4d7f12a441c3013b0fe0d8418fc47c13fbf4fc2b4a89496d4ab9d9826d0e586574e8dd15d4eb8b86ed372e37287fc818df5b6993b650fba844d960e3fd62db0bc7b12ab286d6492388a91ae4da6bdece6e101c13100eaba3b9998706fd4defaa3ed2965ce7fe6062b8c58f20c6b44b01121184ee1dda1cb66b3ababecfc0b7a9a12624e0b826c35d0149335149cfb49fbe68d1dbb7eef96d7956dc573d449847ff4bb7ba0ededd00c904130f1252c3dd4bdcdeccf6f8a83e3abfa14d12c753558022efa0704549b0571e31c4bc9f3e485f8d2d88189b4149569ef83e8feb2ad26c263b0f91f8975c86c8fa9c9457da5ef4a8a94844f824873576f722e32b376ba5f3ed0ea9818d86ddc35ba0e7f322594d9a0fea878af5c03d242bc7b0af89091f088245154391e75ab1b6b2730ccd01c28e9ec99428cc22c2d08ae2829537c34ebd1273327d0d18175698f9fe587e968d19f00ff98555fcfe95d00cb3abae32afcd48f3d4cd7c63c45581203a8a3040363d98bf9426493039fce7bb03493ab6e176cb45e2af461e77fc93d1202fe0bc7b77398c52bbc1c1436439f26cb2e17933a0ae309611e46bebd4d84a939d9b040a08cad90c2eda6ddc933edffc8e562aa64658f99a9ec8a47278edb828b5312a95ca34c0af428aac64d3fa1c4045885891fda7666dfb680da4dc2c02becb8303b76987b6d9be01174df88e41a48a42444caeae5e36118564e57209594285bc2915b222f99f016326430c38c9807994cfa1c3c85aa0f6375c716cd7f27be9b2cef6866d07c8ed00bc101a74219182562467ebbd43d2ba78a4b0eae22c67702f318bc55ccd92f5fd11557335f94ff6f38cfe9fbe31d3fac064dcd7d660d02fbeaa26acf8927c1e3bc71d9ed8ef2e93f0a42813526daa1fad36676734103bcc621a114b098295de578bf8d7df9034fb3ba86ea529bf639cde496b5e48145e4a814f894fb3bf3f41b49d0572dad5988348dad7a064b2d76d9092336cb404934790683b2b3576d3b75534df2c36bc78e05ed250b9aaede772a08bf5972444ecf4e447c062d95e556768e264813369465713834f6e239695b6bfca1b6108a09368688e212b7ba556df50c02486bf1b2196da3d4c0553923fe9b1bb4474d0f569bec1f35dce4be0f5e2408efa69aa66dda6bb1ef43295fe005f4a86840bb608796ce14bcc1134013bf741ad1aa70cc6579edbd42478d3054e1f7bdbd5b1131ded725041270e8a46bcc8bbfe89089f87105939deb2a9f10dd60d059679d4514bfbfc94b333c7dde79576426f07f24ab6a57290b0d723bf3bffa2f66fe191d0dee8b292c8c15eb42245b899ddde3c6afbbf0d7c301dd142878dbca579f387931460c8c37e186f60f8d9209dc98f1a27b84ecefd71de077017261ad6cc3072fe57ec589cd9498946fda8a834e3f02e8a91f7ce6e18e76f936f6f39d354b63dccc706e25b1d8b1a4830c46f249b5e5a40042fea920ed57a2415431f83c238113ee7d152c16f0780c502d5c995168e3f91113af11752f10434b8dc5ef0e46a276c683261aa73877ce96ebd0176977e124c5b93bbb02ef97a6f6a13c15c261f23014f4b13c8f18746727206b245bee70d7b94968141f104f0682a3df4242c6a60fa1b70c227306520b1b9fbd6c916b0edf5e2ce5220fc9ef10ab0a10e1bf259e91eb127d5a31b7633f15130fdb44ce2178a20d5dc3f91688090881c061d75b4b59c3b2b7eb7a3dd1564bfa6c883c217cb76c2a7516dec926add0a1886570531c32b6284b1e80fbde88905f67ea5cea41003325327000a7f7249a99986f19f423843e8dc791df8679a2ed2b024d7d8c79112644a4fbd32bef0cd1f9d55025708135ed34cbf52ce3a0af0f8cd985362ef6fceb6c72f241128b16dad7575558badb3847e051f38d7b5ca638a1f454054659d90b2c046e4f9e2ab127f257ccc92f887b3e0c4fb49d159741fc649638180addf3f23e5265015f6dad9b25cb86d8a33b802e55258749ec050d15d0d7d821f9615c7d8c12ce11c63fb1eb118455c4e2167f66e4eaf9dec0dd2f345a7e2bb369a66b0755003a9c89449393f71acd98afdf6347792251d669ff3c64c50d705a67e543cad95655d6a4cce233acdac5ffc96681772be3c04a1b36f5273815af65ef87c7ad0d51462bf337c2389a8eded875f75eeebe5e5efc26933948e623364d0dbad3402f659a93acaaa21bc8f559dca605aa6732d0eced5a21ee8a6403b1f91722fcbada24a3031d6aa221612a36584d5edc6ba0f64096e9b6eae1555a95945b937457c4c74371f474939d3c3f299f691316497951c646f142adbd6ee49182aec388ce2ca560a1f4b7d8a63e5cd25ba91ebc61175a6955895bcddae7bf1cefccac5c93dd669ab65a2f508adbcfd62ec46027efa396b9f69984d6adcb38fdddb616ec38929fedd97677c3d06060309db5a9cb5fc8919f4310f06bb40f1b76bc197798acbf8d3162257071e034174047006796fac6fbc95c28afd881e1197c20fea8b4be5c5de39a292bd1ff3819d4d4f48162ea1a57930d8f324ce54875d3ad09eea95c4c825765842f9bbb1957fa8188578e86081adfc87502e69c8841218b596d71c4ec49afa60408028012d974051559d924f5f8a59ee195fb01994b8710994d8201ae10f6e88e0e418489c47499b7efd2021f56a6c9fba761beaf79acb6087a496afe7524f2260e14a792cf1a1203d4b0cd8a11d2544293b7657fc393014295fa28e409ab8be0a02695223d17d7caf4f44cf5d0f416130067f28f3fc51c88ad7b53e401e658214abcc8f597f22d662144f878573d0370c874287698784b6ba9abf9b22da2eeb0ce8b817f85e429e799a5edd246d72d77228652b80c4949a85cd5131d851d9f9bda9afa0646de5e477e0fa999562cb46758502c7d63dd3e8b6f88c7ea44f41c4212d633f0160e738c6d36128e9e58c154b08460c899a26276dc1257dc5de18495573693674e40faf1dad49db8ac83baecf92f3aa5c23f639cdcf6e6864c14a8d6a3de95906813fd17f83c406ffd1d2d7bc75737b7b00172448b2ff167b9fa43649db32ab4094652cbb2e18c3bdb527f24049878bb44b82135009f9af22d24ffbee4b5289fa61bd0502f019b2f24a08542db818bffb7c1637b4f4cb9043952f88aa69d9431b8df2e3f9ef6e4a5ba58e79acf082bbd871aa0f0feef71ade8f921bb597ea28548f4116a281ab3542b732c4a8e9973409c75a0c6443d83547d0d314cc7bd62128e3b0db9c03c78b9d78ba714627866230414947523a6a239873f932c2b28c09cbdf182e856bf41598998150cbdd6d54f76c227fb1519f5afb0008e31d6a0b87818d0a2ca0dd6e953a5ba1a347dd927acd36f3fa3a68920eb9c36bce6cef857447aa733e4ffb7014e194993eb1399270b64151ddbb15478c2b762a14d1782608fb24199d9d311281c47726f565b3a3b7be584afb03d87cdc5eb8156772694ab422f59cd7b1e359583a7cc0695b9f64e6416c6b52de230afbc160d2e9384501b40645189434d416c0fbb034e9ffc654d0dee7ee7a878f9e559daac7ee5af769aeac7a92e85b1bc7983803d3bb572befe76184a46b76450feccffa753cc6123cba0686440a5ba81236458831031a4ba4c91d7aab3bb2514208a902face1c12b7dfe25318ab5ca2c1ef9769aa06ba0539f6904f95d3c8440617efc7858d3984f566b3390b9b1a0f2ec3c86dd77a0b82958c4b15278ffaf10e47e613545f4cf67ef7e8b31a6bda35022871840ae1536fb65bb11b932936db7a15642359bb6b157893d19e7918b11d3d3072b78c761c1784afa2214c865fc2aed860dcc17b69cfe9189bcd0767a84cb306a59966e5f96514a7d7182e6aa7204bbd1a84092ba645f86b68813debd5a2290acc93388e5eacc17db51d69604733ea9160a0e77ec5317194654313a9a8a0535c0bc49d0837e2821df92e8ee2f154cbea6b87ffc207aab4ea491e8aa75b90f70136d84ea2f5dfd138371dbdf8fe273956cb7411db6df48ebf56105da42b219b9dad387ca7be9ecd90508c62279a53bc9f7e2a845f9da42d8e85d2653854737948ce228b2d76d1b9fe2e0e456fdff24575939b82a3f6e1a4be6ffcf1c493c17dabbfa0859a87d259ae3931fb6da544589b9b6bb7cc93e078813ac94918942bf113aee5742498d86a70fff31d2a69507739317a9aa9e0289f053dad4eec63cd58e833027f0859fb4ab74e8fc742d03b5b6dca1168d3d47fd95b514a567e6518342d52b3c3bb6438b5aeacb95ff9001d2f5480f6a80a0685b5bda2ceba06925ab5ae0986954c3169e92fedaf3f1681247cb114202c0f728296a51396063fc64aad05662bf05a626b90f656b47069ca668bb96208c287e8f793d77d4fb1f1cc14e73406005e11a2c1c46ca7448be534c97738487527d79e284d7a0ae275bd4361ecf4a352e6dc8b8c8c8e132a3edb7d645f4943445f523fb28bbf857218a117f1288afec49f9def9aabc2381b38a315d5c927aeb96fa1ad3eb13b0151dd570f6734f004467171d2cdd609d1d09d115c9b42e1da3472ada98d3e1da90a8f373a98133fa708f5a62c75b5eb1b643c48de72143ffc8761ccffd7f3336b69faa277d364cdf2d4f2bc428bda8b76e4748d5ae02d9850ac6f2ed0ddcb874c25d210163d4da10c0d6cc5218a3558deee5519c94032158bca02fe1c1b8184fdf417e863352b224b7b06267486296ebd4100ad5f1108c78a7056979f5ad6f97794a0460bf371584d9b962034aa7449f4e6b0f925b7a648d4ed7f2442135629b0baee3385882682fde57e5eb9204647a898c566120e4b577ba215ed863f76d5ad9ed19a6b7465952292e7543110eac3dc436a16c85047f3ff10a00c917d5902d296c063c4b173775f2b612e407bce02c8647877abcc07b21b89a60e16ff5c5cdc3708f285d6e411036661e97f628c6c2bef7a6e297f0ea7db2aaceb87d13425e80c28cf095b1dd4e08122e89f58862c6466d79fe7d06e0038a9a1869cba0d1554bffc08b94bf3dc7ec4d108073a4dcb7a6a503b608e777f1ca6b64deec19072052cdab8e7222966170bd35cfa66d3d013c537e723bfa2f634b34edba64ee27ab814bf66c5943e5b7b4d2cbad0550982b2d68ea0633a48f24ef5a59da6e9671717afed4253db66afce693ab08e2b4343d9efd1705802393ba22af5f0e04fc559ddafd78bb1c013b2826cfd77591736cd8a1e079c00f72dc89ee419cf4cc5e867138e35372bb0854df45d2142ce56ea01465d7cf42d3beabbed8602ff568df5d8e53d22bbd897c0aa050165319ba28d6f861a128556e420275562b8a19c0a2112df4490925f52090c6c7ac79b8533936d4020af3ea5d383cc8e4f23cf275194887d42bde7061bc17246a91b735472c4dee6f2d159a4fb2cce10f0727a964658f6d60aa18bd474ce1e88114ce3c2a3acabd74175b82afc6126ed79d8d333ed993e3a0d67afba888c94cb266f906681d9595f2ca21946f32d8f07eb7cfc979cdd56a885e6a5deb1dc54ffbbbac728db4145056cc9b78386f1f17ad16856cc10b04038f0d835a5842584b6a9516a770abd839ade5d379db9889d22d9049dd13010ad612a64128f724f7a643505b8ca50bddc4ec4875beed2f8593b7382645625809bbc3591027d53bde8a16be5bb209cd49e71aaa435c923ef3c4d1aefec7111773b0d58b47efabc7a43b93cb7eab287cefe554a5b59e2a746081d0d875919df356504008374ef184be2f7ef7e644bf5535dedf5b969b30dcedcfbecb83173b0cea015efe45630880c303472daf1dc22b384e65078cb0ae21baa4834fcd4b4f7c995b700117e1448d041a7106277302fabf3a512ad4e802988c43e6cad0b4b74962e195b355b653acfab53d9f38337e46758c0f8c147333d30f8fbb508a889b84d4672e025b0d9adec09fd4e2d62bda0e0c40570d8fcf5487a59380584f7b85a8576985a4423cbdb1503ea4f93d4f3dbb2c384efcac84dd8649e6f09d2ac37e1d8268c3c07db365581c7c3752410909968598b8ea5ea05b68e6013965cc60be6f6b24e493655f5ddd572a84a924803a7df025914f4b57527841928d30c03b09aeee28c8b81860968f53a663f4f56b004e07cc380f5b0b0dad43869faeed5f240ce389a0fb0920073b8d3de611e54d4011f55ba28743a3b51af6293ed1376fcfe3592c877e2d81d14ee882410cf8207476409b5673eb65297155e91cbe089c8c043964063f9b469419bce6e59e0017e0f527d20eab5d9579208df9cc65389ca8fdb3d62618395bb0274b8094799cb4c36632488e79950ac3bd3d982d521614f56df1bd16c1f928481dd4580a796eb7892b3e4a33b748b16f96b1def674c2b70d0315b486a94a979292d635a2ad1fa877927de9355f38a612747fb982bccf12040d9a14a63c34b6f2b3b450a6401d4d0c96a9090ab80d30f7e7af84bade864791455402cbd278427c5a1e84e2e2286c4bf773da614e6705802c130ade8a3a67b309f9db1558372046ec276a34fb50f72c7df40e33f447ab5f0af05eece4e8f654b3c2dad6ea76ef6b694699f4ad8c6fdcbfd8bdc23d0c580631d0c95ac6ae9613dad680939db2ecf9e7a0d4d0f2f2b7f1c1d308cfaccacc2381e97bb278a53b14daf686c0541e56264c33d5176b830ac7d13c28edb2d8e77d7acbced061c4ec315cb1a259966ad997c7c7beae44d4d1b6955842d7fbba0bb0c461bb22db3e15f0fc1cd3fd997dac5e6a4bff6e2eb8310d828f15309b2c8feaa21281963d35ab2d5c099beb806cd384d304449c58d89910105df11225fb893e984734a8e5cba2e553f03ebd5ce4cae24826547df81db3f2bd7d930f785755c8b6311f221da59679ce50479adef1cc5dac984a5d2f9343fe4892b2b5640892892cfd50d0015c1f568792d8919943a578b62585081175237444d9542a2241c967bcfbc3dab4e8961ecad89165eaada2d759e844be5021aed42b971e9ffea8c08a3d6e4073ce4226b4e54b83f3d8ccd207a0cfcf9da7b5e55d1a26a90e03f7c3611c6562b65edb42fe110dc3970b44aa36660d1cdbc882495271f80816350b945aedb0d46ca6d160d5f0096e8263325e257dbb574932e32f1b28ce2b7f5b3ee6ccec64085496bb513ec168b53d79e6ecb72622a70b22e1f9116fa48815709b2080b27b31a6b26dde0701cd74c31b4e33a702f051ae07ad54ce23ae33e6060e5451a4171cc930af2ab70862044c5a0ff9e8aeebd3cc41c62d38e7b79596d3851430dd661b071c319751985d48eeea2afb463d7d9390ed4e68a60f90ad80aeca4b8d283ae0538e590668c857a526a264be238641eeb5f321248d829539efccf03dcefa54c6def8b7d4a8cdf6bc76d71eefaca1a7a33bd4b56e94b8e38f784b742bdd080faca4769e1aa91ff50d9374f3632cb7b66a0042beb802c6cedff0a3634aec072f57d38a6ea61439029ba5d921f57bfbc281d75f5ec322b8f8c90b4d3f65d00ef97dcffe7e07fa01af8e7f8da15532f0c18b73d7a183327aea46680651645782f4f318c00f2355c301fe2e805a22f8586119768b8424735f5495607d170f0818be232cec1d9e40daf79bcd63a26cbead93753b7171bcad462da2af68e9ea9c0b207200f1fcf3793283931603a719e745120273efb541a7af896f6eea7359939d7226896c8023cc963e4e0a7579bc83a37cb8d871324bb3e66b671d8df83d645495740c5b99aaf2edda3018e1895dda6744b1e6623cb62d4b80ac208f69a81caa0277a497e41bf637817518cbe0fcd2028d07be199a126f82641f2fd54e6b20287b912ee8d8dd72db5824ca9e464a94d45beda7f52932d1bb57a28a4e99ac32ea4c3650197613a87e4cec91d82f37069fde871575d3cb2220aaad9277511271a86377da5f2a9f94303e7151acb087ca549fd0cb9b1961954ddb28333a24b510b92cddc057ec5a147ccdd708a2db3c8cb3600756100b38b71f0676f6fc5a7f5912b5e81bf6d2b07e15fb5b1c96459110ceb22ba4f2fb0e531dcaa913a13437cc6276c8b4e1bdbc5365144c7abd2e2a6c93ef102e26b14e576ada244408d9db50aab045f9879bf95425eaa7b11d77e0dc503851c5c278c282aa736103adf5ca2b30724bde27f98e4e7a947f964b7abfe58a3da354e3008a2b86d50223d3077e151ce2e086172002eab7279ac1948361e172073184401d5650181547f1bacc1534f9ab2ad66fd9d200d867de79a92e465dda8d781b15881acc9bfdc53815f3fc3f064c830db3908cdb173e3e1295ea7dca280273ca99073d5663003f14c4f7ac9ef9bc735b2a413daaa7d97101553f90a0d33b043d1f2b0f131d35c9244808bb4b76213ff5c418053a569d760498518d701aae39cfbd7a052b586c53617dfaad1415c1cafbb41640d1650be9297dd42c803d8bfd443916310bb80a74c991cc26331ab70c0c4bc4f2295f069787f6759878e42ffbc76b34493f71d88a109b0813ebfcd24953b2b5f1f5164d9974bab7ed1f4d42f62b8379912dd7e9f35a19951e4d57b0c70fe516cd2059c4ef879d9f9b1191d5bb51b852d3e9462e4528b9c1f7c676e6039d1deb00442a482e297b08a67c79bb818d0316072d8174885de3413ae0505232100f217e424e0106811902d60ecc0e0aaca7c5f00f4f365e1360f10aa645b9215c93668a08be97cacd6b0f9c80ead76478846d12e8f24a53bfab01628afd199b2db332d38d5009d7a1437f0f5b2a0d36b5c98f3a35e5043ffd55bac325d3927888fa5d0e3569d9be002205b501b3e68d661515bb9eac9d4f234e22e4e5bd0b4c4530933aadd99f132794ce48e9a3220d2c17748c012fc5fd93d265cebb3edc3be29a1ba26f2adcf510663c28d29e28774c4ec1190fbfbf614aa8e2745f8605f7d7e94fdd06322454a08833f1a22c77deedb1337e380a8e18f85168e045d1e7cf32fda1a709d3eddf62909a9e580ed8abd605e07dbab79b5bcc2f4533e6fec589b976816471b1f11ac3c89336c52e03b72520995d05275024e9988727f2e1ac9421ccaaa0b736e9f7f296c2d27cbd774d7179f9c6921df68985998034862c15adc452666deb40c0c40cedf16f4d187524a0a5cdff6f7b2531eda54fbe15a7ad1aea46466a51642326c5d7d374fb38475d119027a3714598fe7307de94bece2741b7a742b053682dae9452eed3b820b1386b604fa647e392b35b205019cf1ad317d1441cbee2aea5ca95e56fd5e959689bf96c9f470acb8e4e630b13403e9459242b629fa28e1ba8eacf1ed572b1db735a20ee1a5b8500b6edf66cbe671c5938741ab2b36ccd4e92160f6df9e1d465cdaf3a7746e128e26e0e7a7aa4869b2a482c6e9bf7e58408411016740c547129e4f11d2317af3c5bb55b2468e6d08e75e5039c3bfdc9b6da06e7c27933a8c9d8ad0e4c74a093e6d57c02b1b49e995962c1046b5c8a3df0ea4c20049e300cbe41bd92a0ea5993ef6fd92ea74e28e1cfaf4a8533c224104d6081b64ae08b4e7a23a259b2b03655b987c23687c6e279bab469a3e0881a30620910566982945f8f86229fd614ca2bb2adcbdd49a5c579c0d1bbdefb9e33cd0641bb43f6ca3fab33dc4188e1508e4293e6de932040b895a97bc1f196467ad4a0d4899e6078c014f42521cf39411e2e4f1b5adc26f1f3bb2fcd27b89ac418c8251423de82c4b5980a4e66649b9f3ec48c833c35f8653ca510a0a1b049561e64a6938714c3a1946b3fa5079533698bb8f8f85bea8711ccda5cf01de150b055d3586a890d0654d2b4cfba25c434e2ff492b69798aa197dffbfe2bba77d4b4eea35c42e698221e971a4bca34e59c46084f48f2170b83db6719324ecb55e07a9cf74a84ee0fc3567fa5cd2f3937ad956b4ed2187e2026b7d4166d50fd9c937fb4dd5aa96f2731f1db1dda4eac4e589295ffe9b72a7b9533f6e23c82b57c8361c8cb3b15128235f65c84b99d93383b7398e936884542d0e73bdf37cadfb6c70da47af3c5a3cde0d8e381cdf9ec1a39d2fc963f0d8ee31b76d9668c0171967cb9ef2f15d5bbdbd1058328da7a60bbc7d77efed2de74a2ed5637a8a84e1163325dd22b584b15fe894c9b1ce89d24619a344a8987f6d21b7de7ccf6fad223134e1c389a8e6baa375dd142baf4a8852e984eb6c281cf86e2457a7f85782c7764564af26d331d3ddf4850d24742ef449cd5e32f5957d2ee10e05e7d3312215e4d36ac5c8c4bae3340f074f88a20e18b270b3baf05de1b0363f4c6f2ab9386d6034e8567e4828ad256cd250448c70147c318a621697be402c1e8365d2798084f968a8897242ff6756c2937e4d1300", 0x2000, &(0x7f0000006b80)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000002700)={0x90, 0x0, 0x0, {0x6, 0x0, 0x0, 0x0, 0x0, 0x0, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2000, 0x0, 0x0, 0x0, 0x0, 0x6}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) r5 = socket$rxrpc(0x21, 0x2, 0xa) bind$rxrpc(r5, &(0x7f00000000c0)=@in6={0x21, 0x4, 0x2, 0xfffffe9b, {0xa, 0x4e28, 0x100, @private1={0xfc, 0x1, '\x00', 0x1}, 0xffffffff}}, 0x24) open_by_handle_at(r2, &(0x7f00000021c0)=ANY=[@ANYBLOB="1c000000810000000000000006"], 0xfeffffff) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000100), 0xffffffffffffffff) sendmsg$TIPC_NL_LINK_SET(r6, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000140)=ANY=[@ANYRES32=r7, @ANYRES16=r7, @ANYBLOB="0100000000000000000009000000240004800c000780080006000000000013000100742d6c69c6c0db23a0e40a9af55cc9"], 0x38}}, 0x0) 22.258690933s ago: executing program 6 (id=5911): r0 = socket$nl_route(0x10, 0x3, 0x0) openat$misdntimer(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) r1 = syz_io_uring_setup(0x5169, &(0x7f0000000080)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r2, r3, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0}) syz_open_dev$media(&(0x7f0000000080), 0x1, 0x0) close(0x3) r4 = syz_open_dev$media(&(0x7f0000000180), 0xb3, 0x24001) ioctl$MEDIA_IOC_REQUEST_ALLOC(r4, 0x80047c05, 0x0) io_uring_enter(r1, 0x7368, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000080)=ANY=[@ANYRESOCT, @ANYRES32=0x0, @ANYBLOB="140001"], 0x34}, 0x1, 0x0, 0x0, 0x1}, 0x0) 22.041627653s ago: executing program 6 (id=5912): r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) ioctl$VHOST_SET_FEATURES(r0, 0x4008af00, &(0x7f0000000140)=0x200000000) (async) write$vhost_msg_v2(r0, &(0x7f0000000980)={0x2, 0x0, {0x0, 0x4b, 0x0, 0x0, 0x2}}, 0x48) (async) write$vhost_msg_v2(r0, &(0x7f0000000540)={0x2, 0x0, {&(0x7f0000000840)=""/256, 0xf4, 0x0, 0x3, 0x2}}, 0x8b) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) (async) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000040)='.\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) chroot(&(0x7f0000000300)='./file0/../file0/../file0/../file0\x00') (async) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x0) pivot_root(&(0x7f00000000c0)='./file0\x00', &(0x7f0000000200)='./file0/../file0/../file0/../file0/file0\x00') ioctl$VHOST_SET_VRING_ADDR(r1, 0x4028af11, &(0x7f0000000340)={0x2, 0x0, &(0x7f0000000240)=""/77, &(0x7f0000000440)=""/204, &(0x7f00000002c0)=""/19, 0x3000}) write$vhost_msg_v2(r0, &(0x7f00000003c0)={0x2, 0x0, {&(0x7f0000000180)=""/118, 0x76, 0x0, 0x0, 0x3}}, 0x48) r3 = shmget(0x1, 0x3000, 0x100, &(0x7f0000ffb000/0x3000)=nil) shmat(r3, &(0x7f0000ffa000/0x3000)=nil, 0x554a185aa9c986fd) (async) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000180)=ANY=[@ANYBLOB="3c00000010000104000010000000000000000000", @ANYRES32=0x0, @ANYBLOB="00000000000400001c00128009000100626f6e64000000000c00028008000a0000000400"], 0x3c}}, 0x0) 21.137204751s ago: executing program 6 (id=5914): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000240)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x400c081}, 0x4040040) sendmsg$NFT_BATCH(r0, &(0x7f0000009b40)={0x0, 0x0, &(0x7f0000009b00)={&(0x7f0000002100)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a5c000000090a010400000000000000000a0000040900010073797a310000000008000540000000040900020073797a310000000008000a40fffffffc200011800e000100636f6e6e6c696d69740000000c00028008000140fffff27414000000"], 0x84}, 0x1, 0x0, 0x0, 0x4000850}, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000580)=ANY=[], 0x7c}, 0x1, 0x0, 0x0, 0x4801}, 0x20000000) r2 = openat$audio1(0xffffff9c, &(0x7f0000000240), 0x105000, 0x0) ioctl$SNDCTL_DSP_GETFMTS(r2, 0x8004500b, &(0x7f0000000180)=0x2) sendmsg$NFT_BATCH(r0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000b00)=ANY=[@ANYRES32=r2], 0x178}, 0x1, 0x0, 0x0, 0x2000c090}, 0x20008880) socket$key(0xf, 0x3, 0x2) socket$inet6(0xa, 0x3, 0x3c) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) syz_open_dev$swradio(&(0x7f0000000000), 0x1, 0x2) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000200)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0xa3) sendmmsg$unix(r3, &(0x7f00000bd000), 0x0, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x2, 0xffffffffffffffff, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$sock_inet_udp_SIOCOUTQ(0xffffffffffffffff, 0x5411, &(0x7f00000002c0)) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(r5, 0xae60) ioctl$KVM_CAP_SPLIT_IRQCHIP(r5, 0x4068aea3, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x1) ioctl$KVM_SET_VCPU_EVENTS(r6, 0x4400ae8f, &(0x7f0000000140)=@arm64={0x8, 0x80, 0x0, '\x00', 0x5c8d}) r7 = fsopen(&(0x7f0000000380)='gfs2\x00', 0x0) fsconfig$FSCONFIG_SET_STRING(r7, 0x1, &(0x7f0000000180)='gid', &(0x7f0000000440)='\x05\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81F\xa9sz{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x8d\x84\'\xa3\xf1', 0x0) ioctl$KVM_RUN(r6, 0xae80, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) 20.89277767s ago: executing program 6 (id=5916): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x19c5498e, 0x103902) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x2c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000020305000000000000000000000000010800010001"], 0x1c}}, 0x0) close(0x4) poll(&(0x7f0000000180), 0x0, 0xffffffc0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x18, 0x0, 0x0, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0xd}, &(0x7f0000000500), 0x0}) socket(0x2b, 0x1, 0x0) r5 = socket(0x1e, 0x4, 0x0) r6 = openat$sysfs(0xffffff9c, 0x0, 0x210000, 0x1) fchdir(r6) fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, 0x0) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x1, 0x81, 0x1ff, 0x801, 0x1}, 0x1c) sendmmsg(r7, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) bind$tipc(r7, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) 20.332723333s ago: executing program 37 (id=5916): r0 = openat$uinput(0xffffffffffffff9c, &(0x7f0000000040), 0x802, 0x0) r1 = syz_open_dev$evdev(&(0x7f0000000000), 0x19c5498e, 0x103902) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETCHAIN(r2, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={0x0, 0x2c}}, 0x0) sendmsg$NFQNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000380)={&(0x7f0000000640)=ANY=[@ANYBLOB="1c000000020305000000000000000000000000010800010001"], 0x1c}}, 0x0) close(0x4) poll(&(0x7f0000000180), 0x0, 0xffffffc0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_usb_control_io$hid(0xffffffffffffffff, 0x0, &(0x7f00000005c0)={0x18, 0x0, 0x0, &(0x7f00000003c0)={0x0, 0x8, 0x1, 0xd}, &(0x7f0000000500), 0x0}) socket(0x2b, 0x1, 0x0) r5 = socket(0x1e, 0x4, 0x0) r6 = openat$sysfs(0xffffff9c, 0x0, 0x210000, 0x1) fchdir(r6) fspick(0xffffffffffffff9c, &(0x7f0000000000)='.\x00', 0x0) setsockopt$packet_tx_ring(r5, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x1, 0x1}, 0x1c) getsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(0xffffffffffffffff, 0x84, 0x75, 0x0, 0x0) r7 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r7, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x1, 0x81, 0x1ff, 0x801, 0x1}, 0x1c) sendmmsg(r7, &(0x7f00000030c0)=[{{0x0, 0xa9cc7003, &(0x7f0000000400)=[{&(0x7f00000000c0)="ee", 0x101d0}], 0x1}}], 0x400000000000181, 0x9200000000000000) bind$tipc(r7, 0x0, 0x0) close_range(r1, 0xffffffffffffffff, 0x0) ioctl$UI_SET_ABSBIT(r0, 0x40045567, 0x0) ioctl$UI_SET_EVBIT(r0, 0x40045564, 0x3) write$uinput_user_dev(r0, 0x0, 0x0) ioctl$UI_DEV_CREATE(r0, 0x5501) 13.332906959s ago: executing program 5 (id=5942): r0 = socket$netlink(0x10, 0x3, 0x10) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$nl80211(&(0x7f00000000c0), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f0000000680)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000003c0)={0x44, r2, 0x1, 0x70bd28, 0x25dfdbfd, {{}, {@void, @val={0x8, 0x3, r3}, @val={0xc, 0x99, {0x7ff, 0x70}}}}, [@NL80211_ATTR_IFNAME={0x14, 0x4, 'syzkaller0\x00'}, @NL80211_ATTR_IFTYPE={0x8, 0x5, 0xc}]}, 0x44}, 0x1, 0x0, 0x0, 0x81}, 0x24044884) bind$netlink(r0, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) r4 = socket$netlink(0x10, 0x3, 0x10) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) setsockopt$sock_int(r4, 0x1, 0x8, &(0x7f0000000300), 0x4) r5 = socket$kcm(0x10, 0x2, 0x0) ioctl$F2FS_IOC_RESERVE_COMPRESS_BLOCKS(r4, 0x8008f513, &(0x7f0000000000)) sendmsg$inet(r5, &(0x7f0000000140)={0x0, 0x2, &(0x7f0000000100)=[{&(0x7f0000000180)="5c00000013006bcd9e3fe3dc4e48aa31086b8703410000004000000000000000040014000d000a00100000009ee517d34460bc08eab556a705251e6182949a3651f60a84c9f5d1938837e786a6d0bdd7fcf50e4509c5bb5a00f69853", 0x5c}], 0x1, 0x0, 0x0, 0x1f000801}, 0x0) setsockopt$netlink_NETLINK_BROADCAST_ERROR(r4, 0x10e, 0x4, &(0x7f0000000640)=0x1800, 0x4) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000200), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r6, 0x8933, &(0x7f00000008c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_NEW_INTERFACE(r6, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000980)={&(0x7f00000003c0)=ANY=[@ANYBLOB='8\x00\x00\x00', @ANYRES16=r7, @ANYBLOB="010000000000000000000700000008000300", @ANYRES32=r8, @ANYBLOB="140004006e696376663000000000000000000000080005000a0000"], 0x38}, 0x1, 0x0, 0x0, 0x10}, 0x2400c890) sendmsg$IPCTNL_MSG_TIMEOUT_DELETE(0xffffffffffffffff, 0x0, 0x0) syz_genetlink_get_family_id$devlink(0x0, 0xffffffffffffffff) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, 0x0) socket$inet6(0xa, 0x8000e, 0x800000) 12.774356191s ago: executing program 5 (id=5946): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000000)={0xffffffffffffffff}) r1 = openat$hwrng(0xffffff9c, &(0x7f0000000040), 0xc0, 0x0) ioctl$F2FS_IOC_MOVE_RANGE(r0, 0xc01cf509, &(0x7f0000000080)={r1, 0x2, 0x6, 0xe69}) bpf$BPF_GET_PROG_INFO(0xf, &(0x7f0000000380)={r1, 0xe0, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, &(0x7f00000000c0)=[0x0, 0x0, 0x0, 0x0, 0x0], ""/16, 0x0, 0x0, 0x0, 0x0, 0x3, 0x4, &(0x7f0000000100)=[0x0, 0x0, 0x0], &(0x7f0000000140)=[0x0, 0x0, 0x0, 0x0], 0x0, 0x83, &(0x7f0000000180)=[{}, {}], 0x10, 0x10, &(0x7f00000001c0), &(0x7f0000000200), 0x8, 0xf1, 0x8, 0x8, &(0x7f0000000240)}}, 0x10) setsockopt$inet_mreqn(r1, 0x0, 0x20, &(0x7f00000003c0)={@multicast2, @multicast2, r3}, 0xc) ioctl$DRM_IOCTL_GET_CLIENT(r1, 0xc0186405, &(0x7f0000000400)={0x7, 0x2, {0x0}, {}, 0x7, 0xffff}) ioctl$BINDER_GET_FROZEN_INFO(r2, 0xc00c620f, &(0x7f0000000440)={r5}) r6 = socket$nl_generic(0x10, 0x3, 0x10) r7 = syz_genetlink_get_family_id$batadv(&(0x7f00000004c0), r1) sendmsg$BATADV_CMD_GET_ROUTING_ALGOS(r6, &(0x7f0000000580)={&(0x7f0000000480)={0x10, 0x0, 0x0, 0x8000}, 0xc, &(0x7f0000000540)={&(0x7f0000000500)={0x14, r7, 0x200, 0x70bd25, 0x25dfdbfc}, 0x14}, 0x1, 0x0, 0x0, 0x8801}, 0x20000000) ioctl$ifreq_SIOCGIFINDEX_batadv_hard(r6, 0x8933, &(0x7f0000000600)={'batadv_slave_1\x00', 0x0}) sendmsg$ETHTOOL_MSG_LINKINFO_GET(r2, &(0x7f0000000780)={&(0x7f00000005c0)={0x10, 0x0, 0x0, 0x4000000}, 0xc, &(0x7f0000000740)={&(0x7f0000000640)={0xe0, 0x0, 0x400, 0x70bd28, 0x25dfdbff, {}, [@HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x6}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}]}, @HEADER={0x6c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'team_slave_1\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x2}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'batadv_slave_1\x00'}]}, @HEADER={0x14, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}]}, @HEADER={0x2c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_virt_wifi\x00'}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}, @HEADER={0xc, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}]}]}, 0xe0}, 0x1, 0x0, 0x0, 0x4004c000}, 0x40080) r9 = bpf$ITER_CREATE(0x21, &(0x7f0000000ac0)={r2}, 0x8) bpf$PROG_LOAD(0x5, &(0x7f0000000b80)={0x1, 0x2d, &(0x7f00000007c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x8000}, {{0x18, 0x1, 0x1, 0x0, r2}}, {}, [@btf_id={0x18, 0xa, 0x3, 0x0, 0x2}, @exit, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @ringbuf_output={{0x18, 0x1, 0x1, 0x0, r2}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x7}, {}, {}, {}, {}, {0x7, 0x0, 0xb, 0x4, 0x0, 0x0, 0x1}}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}], {{}, {0x7, 0x0, 0xb, 0x2, 0x0, 0x0, 0x2}, {0x85, 0x0, 0x0, 0x84}}}, &(0x7f0000000940)='syzkaller\x00', 0x1e28, 0xa5, &(0x7f0000000980)=""/165, 0x41000, 0x4, '\x00', r3, @fallback=0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000a40)={0x5, 0x4}, 0x8, 0x10, &(0x7f0000000a80)={0x1, 0x4, 0x1270, 0x83f}, 0x10, r4, r9, 0x5, 0x0, &(0x7f0000000b00)=[{0x0, 0x2, 0xe, 0xa}, {0x4, 0x5, 0xd, 0x9}, {0x5, 0x8, 0x0, 0xb}, {0x0, 0x3, 0x1, 0x5}, {0x2, 0x4, 0x5}], 0x10, 0x7}, 0x94) ioctl$sock_TIOCOUTQ(r2, 0x5411, &(0x7f0000000c40)) ioctl$ifreq_SIOCGIFINDEX_team(r9, 0x8933, &(0x7f0000000c80)={'team0\x00', 0x0}) setsockopt$packet_add_memb(r9, 0x107, 0x1, &(0x7f0000000cc0)={r3, 0x1, 0x6, @multicast}, 0x10) r11 = syz_usb_connect(0x5, 0x957, &(0x7f0000000d00)={{0x12, 0x1, 0x250, 0x86, 0xf6, 0x29, 0xff, 0x1608, 0x1, 0x92ce, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x945, 0x4, 0xb, 0xc, 0xd0, 0x0, [{{0x9, 0x4, 0x9f, 0x2, 0x7, 0x4c, 0x40, 0x5f, 0xd, [@cdc_ecm={{0x6, 0x24, 0x6, 0x0, 0x0, '\''}, {0x5, 0x24, 0x0, 0xa}, {0xd, 0x24, 0xf, 0x1, 0x0, 0x6, 0x9, 0x66}, [@ncm={0x6, 0x24, 0x1a, 0x6, 0x2}, @dmm={0x7, 0x24, 0x14, 0x9, 0x7fff}]}], [{{0x9, 0x5, 0xf, 0x14, 0x400, 0x5, 0x1, 0xff, [@uac_iso={0x7, 0x25, 0x1, 0x82, 0x81, 0x69}, @generic={0x7a, 0x1, "fa4e8c7d48bacc742b65de7fe093f8c548c6084b0f5994dcc9acb72af7dfb76bfa1ea4bf1420e93a8341707d18174bb27b9da1ea07764a3ec3325fa68099ee05b29f58c2d540428538ea63c0074c730844469de43c69d5d75b281d4e806c051b5497f6a179fdb0dd5e43902bd409772ad33ce3e261074c8a"}]}}, {{0x9, 0x5, 0xd, 0x1, 0x8, 0x2, 0x8, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x81, 0x4, 0x9}]}}, {{0x9, 0x5, 0x7, 0x0, 0x200, 0x4, 0x2, 0x1, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0xb6, 0x8246}, @uac_iso={0x7, 0x25, 0x1, 0x3, 0x2, 0x9}]}}, {{0x9, 0x5, 0x80, 0x0, 0x400, 0xfd, 0x2, 0x7, [@generic={0xd2, 0x24, "e12b97690b012a00ed405e2d2782e3d5ba44890b12f06078f87c4148b999328e95bc728656330be58b52bf8a63a7bfaa58f90f74376b477bcacbdc8a8d52e6d936ec135215fe8717ef2218e20760a63e44f9657aff80c9222cb85d618c1b16048c173fe3885c635a7bb5a251b2f75ac88b3c4eda40eb564dab4ee5ca621e2b7070ce8e0749e5aa40f22087aa11d1edbc894efee336197e0ec6e5e8b37892e27cfb70836af06596bfbfdd96f179f13ea1289d1194d6a1f474f0b71051a3b5447022ce70918264dd0ec0173f7b3061fc87"}]}}, {{0x9, 0x5, 0x8, 0x10, 0x10, 0x2, 0xf, 0x0, [@generic={0xc4, 0x31, "15eb468004f306bfc96e02b282ead7c2b66c0ea466d8ab11c602aa2407b3bb7d6fc72854bfb1b1bdda358f0446bf4b2ce35db8c4ca321b8f6812e0bd967b04f904b971dc80352e1c0b7cc45015f9b83770d8407e010445dd10f1be6bd7737be761df924641e3634e7dc08741393709422b824a8f23b608820918b712f5bcf7115d8848708443b638e3c1300f71143db8eb7b2bf3cc97e912182a099fc45f76812e600cbaea827758710ed2d83a30929244801a55e8e39e4110d1c6134e8117c51a61"}, @generic={0xc8, 0x30, "a4c5481953704e77b902fbc07a2639fa1ed7f5413f96d503270019c8e6251b24521334752f7a57ebd291545325ae466ea32f846e63acb33c61f1c12575ebdd5615f405106b2dba02848ffc230de782fba7c2b1e4c65f4744c52d7bed70e4ab5f3bfd3556bc08327913cf63a0fd52f1481e4ef17be645fef472b1ce5908afdf0bf890255e82ffe81a7a83393a5d0a970b6270d808b460caf64f9eb053e12301aa19dd4d030ae5f36309933482429175ffa45cfb7ec015551be3c3879ff8513ba34a46a7b12f7e"}]}}, {{0x9, 0x5, 0x0, 0x3, 0x40, 0x5, 0x5, 0x5f, [@uac_iso={0x7, 0x25, 0x1, 0x1, 0x3, 0x3}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x5, 0xfffe}]}}, {{0x9, 0x5, 0x7, 0xc, 0x200, 0x1, 0x40, 0x2, [@generic={0x47, 0xd, "bbad67f23a4f9137ec120e9c827313b0706ae0583a3bd926d8511f2af5f1ce9d18d320b09fbb6664ce95b71da22200045bf6f87fb4345e8a384018e57f5557e1ab21d4ee93"}, @generic={0x50, 0x6, "31eceb8d982640afc10bdd5a5b885caf32a2babbebd0f7ce3e57456ce5a356ea5998ea2f9a7e773ffa26799abde45bb0ca6acdd99ab5765b65a725accf209108807aad1cb7c945e5401dc70404ea"}]}}]}}, {{0x9, 0x4, 0x2d, 0x3, 0x1, 0xff, 0x1, 0x3a, 0xbc, [@cdc_ecm={{0x8, 0x24, 0x6, 0x0, 0x0, "0ebd61"}, {0x5, 0x24, 0x0, 0x7}, {0xd, 0x24, 0xf, 0x1, 0x4, 0x9, 0x2259, 0x1}, [@country_functional={0x8, 0x24, 0x7, 0x2, 0x9b, [0x44b2]}]}, @generic={0x94, 0x24, "1e8396e84a301182f5af1ee04e818e3d54a8db2c9a9d985bbe7092f8eaeebd45fda7ec7598ea6992c1a009c54d3f2e14b893cac652c4f77c4babedeca0a141ba0c302ff868914ddb95e80993ded170137077bd5ef1b9fada6e59a90f365924162b5b08ab3b9dd4b8481066209038540889d7bd1fed79665e077a8189dff7c05be5df1bacadf56db91bad5b61eab4c218149a"}], [{{0x9, 0x5, 0x8, 0x1, 0x10, 0x0, 0x93, 0x2, [@generic={0x95, 0x30, "3165e553f566028ca898e5beae07fe530e6c5bad863f44ac934db25ca64ec0358a191fd1b49e88816e8ad9ce86178b25772f7f3b24eb61368c37b0bca7ac4a9fd018be430f6d083dcbdc739fdc0cebdc5eee63cce58fb716deaf18c3e42033521f8030f848b9a43f2dab6b82ea32110dfb298075ce9b6086db2a8e101fa585c3f293551ae381d43ba67ddd0649f305f64a7793"}, @uac_iso={0x7, 0x25, 0x1, 0x80, 0x40, 0x9}]}}]}}, {{0x9, 0x4, 0x1f, 0x4, 0x4, 0x8d, 0x7, 0x3, 0x25, [@cdc_ecm={{0x9, 0x24, 0x6, 0x0, 0x0, "9e75ed66"}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0xfb2200, 0x1, 0xfffd, 0x4}, [@mbim={0xc, 0x24, 0x1b, 0x1, 0x6, 0x8, 0x3, 0x8, 0x2}, @dmm={0x7, 0x24, 0x14, 0x914, 0xd5ea}]}, @uac_control={{0xa, 0x24, 0x1, 0x782, 0x1}, [@mixer_unit={0x5, 0x24, 0x4, 0x1, 0xd}, @extension_unit={0x9, 0x24, 0x8, 0x6, 0x0, 0x2, '|3'}, @extension_unit={0x9, 0x24, 0x8, 0x1, 0x1, 0xd, '_V'}]}], [{{0x9, 0x5, 0xf24eb5b0403a0418, 0x8, 0x40, 0x8, 0x0, 0x7, [@uac_iso={0x7, 0x25, 0x1, 0x2, 0x10, 0x5}, @uac_iso={0x7, 0x25, 0x1, 0x2, 0x3, 0x8}]}}, {{0x9, 0x5, 0x4, 0x0, 0x200, 0xf7, 0x0, 0x10, [@generic={0xf1, 0x21, "f5bf6926153f2613e35ca25a0808ae06f9fa70b4eb2764fb82c095626ea400eb72cc6c41f590f6bf27f71ccdab2746bc277c21e3f0a1473adace83223825453c5bc5999267044ad4fb690d03ca6218e4bb3df25c229b3211ba5f795f922832c99715a06670007e85621130aa23366103f3dd3cb4c689ae7606817ed4580dc50ace8246ce4e757aa2e14e3b322c228d3aadcc03171a3e1ecfa49309e344c41ecc4d28120f61e2c04495976b2994d249b89c28d484d13ecd380214c27be7439e5a3052106454ebcac2a32c0846b8121fc4f29525542d56c06cdfc0446362ccd1b59b1cb7b16b48c3723e23ad57e5b075"}, @generic={0x5, 0x24, "2fd862"}]}}, {{0x9, 0x5, 0x5, 0x0, 0x8, 0x3b, 0x6, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x2, 0x4}]}}, {{0x9, 0x5, 0xf, 0x0, 0x3ff, 0xb1, 0x0, 0x8, [@generic={0x5c, 0x21, "fb31de6b0782f030524d0831fa050989542c5458d7a114d3ad129538c9764ffff87d389e6e7c5bf7544a46065cc98b88a61e076ebfc9ab3bbf7a6d07c434edc76737734844e5020077aa9cd19a96c0533b5e5b8abfd40e93daaa"}]}}]}}, {{0x9, 0x4, 0xd5, 0xa, 0x3, 0x29, 0x7b, 0x57, 0x7, [@uac_as={[@format_type_ii_discrete={0xf, 0x24, 0x2, 0x2, 0xff01, 0x2, 0x6, "12e83271eac3"}, @as_header={0x7, 0x24, 0x1, 0x9, 0x5}, @as_header={0x7, 0x24, 0x1, 0xa, 0x0, 0x1006}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0xf0, 0x3, 0x5, 0xfe, "ac3abc", 'Y\n'}, @format_type_i_continuous={0xd, 0x24, 0x2, 0x1, 0x8, 0x2, 0xfa, 0x5, "7cf0", "e7f58e"}]}], [{{0x9, 0x5, 0x2, 0x2, 0x20, 0x4, 0x6, 0x1, [@generic={0xd6, 0x3, "9f364c4878e5e62c6e84d6ede9bb464614bf20de027abe0646bf2074546c1aa4a2b47bc768e94d6ad3c281ed8b90f8eef1771a3f069a2c39379c62a1804c0e481ae532e88f2ebc32f365f5bed5ea52fc415c71bf2e2248b7268c8b36f8f5721fd0ed5ea24550f1cfcc25dc119f0840b688d9c0467802cdea47e91c6123649e0d50260b0fc6aa7c92ded8defc643d06956e9681cfe453def08a5c8e339b894dffdce98d18613bfb6c071d8b280e7f71a2131af927864600e4f4971f58c22807c1d9cd17826fee6403fb28a9e032bd6d761b3245f0"}]}}, {{0x9, 0x5, 0x2, 0x0, 0x8, 0x81, 0x9, 0xc, [@generic={0x26, 0x7, "32e9eb5ae9592a42ceef3387d109c8a5db85e1926026696f0dfa505e60f77223ac358c3e"}, @generic={0x92, 0x11, "63bf23dd00954e361928ed07dcd0c54120c849137176fe33ae5c9955ff35697bcea9033c3e9a68ed64e2943746861fb94d9577fe25a953f2a988a47248b0a4c52aa5755169741a3464ff0fdb7a76eb2d4bd168b37b760346c80bacf095517f5d64a509679e84fbc3ddaa5c6bd0cd3d3368bc384c996f18243da79bfbe51aaf25d88184f8376aa1f22944a65aaa41983e"}]}}, {{0x9, 0x5, 0x0, 0x2, 0x48, 0xa, 0x7, 0x4, [@uac_iso={0x7, 0x25, 0x1, 0x80, 0x70, 0xfff7}]}}]}}]}}]}}, &(0x7f00000018c0)={0xa, &(0x7f0000001680)={0xa, 0x6, 0x201, 0x8, 0x1, 0x8, 0x40, 0x4}, 0x19, &(0x7f00000016c0)={0x5, 0xf, 0x19, 0x1, [@ss_container_id={0x14, 0x10, 0x4, 0x5, "b36542e2d6a76af16f27e7d26e41cbae"}]}, 0x2, [{0xa5, &(0x7f0000001700)=@string={0xa5, 0x3, "909f20489fb59af4ca58698e6d38e513f7fc94b98fdc75e6b06549c9c0a5cb5d0ca209dcbd13e4ca32f42346aab808d0191a96bf1af31defe29c4e4d79ae3df7d8b8dbca57a5f391424c6237e62732b421deb0b4518284b7e3520b668e5e35c2fb09530f358df6e1d7525ff0532272a5e61dcef3a4c924c9443879357627cf1eaaddc7506ecc19541dc53074e65b323b69a3b767bb3d1a2b2b575561548c451b61e83f"}}, {0xcf, &(0x7f00000017c0)=@string={0xcf, 0x3, "2b91e8dd4b9fa356b87b5d1b7b8fea820e1ce4da8262316acc87ae4e9438dee62a5521146660829f237760937ffc02496e57a4e285095f2741ef549e49292d56c94a6b81b942ff2131bf67fd4c6426d20952821e2369b196ac6fdfc1fdd8800bbe27c42fe18407953afe1c0f937b88a0f4dd2483ab5c5c6b6de501c43a9415bd0747d7cfb9d7bbf529bd03152c88f3a023166969423749797d33d83d73c0b04253080b8a552949747f18a101ef3ccea3273f9fe6b8361b91ae82cae2edf2ecea711bc6e642ad147dee10918052"}}]}) syz_usb_control_io$cdc_ncm(r11, &(0x7f0000001a40)={0xc, &(0x7f0000001900)={0x20, 0x11, 0xfa, {0xfa, 0x6, "e3582d444754b0ec12fc697b467bcce4cf5f1d2972210a38da90a00ead1e064038de09d6b4c03122c979841d218b430993f2683984d931b9537b91fde214b2f98c7537608b352ca4c9a88b986691d4ccb63358fb1d28ae80891e75410e7f731c1fda193c6790f347c4ab439258ab80d4ef5a53b71a9ab36c47e3c3edf60ce5e52a56a8d979476faa11367b93758bc909aea68d8c3fbce8872733a47656380fd25ed5e8fe2ae7aaf56b8d4fc2b4d65d196e88381ee72148d706faaba1d92709aae95a51d21ccf84191f21e82548655b921e841fb7089e07db1f041f38eaa1a4d6c26e7fa92d54f01c2e88aa168371c968d39ad7658fa7e878"}}, &(0x7f0000001a00)={0x0, 0x3, 0x1a, {0x1a}}}, &(0x7f0000001cc0)={0x24, &(0x7f0000001a80)={0x40, 0x11, 0x49, "8a42d4df52664bad147b08c6f57c91c103eee4ebb445469d20c07512ac7f6058483decfc6e50c2ffa08af71c30143d431f66e4c582d82d561939eb6b45c72ad7fba35f39995ff186dd"}, &(0x7f0000001b00)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000001b40)={0x0, 0x8, 0x1, 0x1d}, &(0x7f0000001b80)={0x20, 0x80, 0x1c, {0x2, 0x9, 0xfffffffb, 0x4, 0xb01, 0x4, 0x0, 0x6, 0x7, 0x3e1, 0x4eed, 0x3}}, &(0x7f0000001bc0)={0x20, 0x85, 0x4, 0x413}, &(0x7f0000001c00)={0x20, 0x83, 0x2, 0x1}, &(0x7f0000001c40)={0x20, 0x87, 0x2, 0x3}, &(0x7f0000001c80)={0x20, 0x89, 0x2}}) write$sysctl(r2, &(0x7f0000001d00)='2\x00', 0x2) add_key(&(0x7f0000001d40)='cifs.spnego\x00', &(0x7f0000001d80)={'syz', 0x3}, &(0x7f0000001dc0), 0x0, 0xfffffffffffffffc) ioctl$AUTOFS_DEV_IOCTL_TIMEOUT(0xffffffffffffffff, 0xc018937a, &(0x7f0000001e00)={{0x1, 0x1, 0x18, r6, {0x2}}, './file0\x00'}) r13 = syz_genetlink_get_family_id$ethtool(&(0x7f0000001e80), r6) sendmsg$ETHTOOL_MSG_CHANNELS_SET(r12, &(0x7f0000001f80)={&(0x7f0000001e40)={0x10, 0x0, 0x0, 0x40000}, 0xc, &(0x7f0000001f40)={&(0x7f0000001ec0)={0x70, r13, 0x2, 0x70bd27, 0x25dfdbfe, {}, [@ETHTOOL_A_CHANNELS_TX_COUNT={0x8, 0x7, 0x7d9f20a9}, @ETHTOOL_A_CHANNELS_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'bridge_slave_0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r10}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth1_to_hsr\x00'}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8}]}, @ETHTOOL_A_CHANNELS_COMBINED_COUNT={0x8, 0x9, 0x1}]}, 0x70}, 0x1, 0x0, 0x0, 0x10}, 0x20044814) sendmsg$IPSET_CMD_DEL(r1, &(0x7f0000002080)={&(0x7f0000001fc0)={0x10, 0x0, 0x0, 0x8}, 0xc, &(0x7f0000002040)={&(0x7f0000002000)={0x20, 0xa, 0x6, 0x101, 0x0, 0x0, {0x2, 0x0, 0x5}, [@IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}]}, 0x20}, 0x1, 0x0, 0x0, 0x41}, 0x44000) clock_gettime(0x3, &(0x7f00000020c0)) pselect6(0x40, &(0x7f0000002100)={0x7, 0x0, 0x9, 0x0, 0xfffffffffffffffe, 0x8, 0x3, 0x5}, &(0x7f0000002140)={0x3, 0x1, 0x79b, 0x80, 0x8000, 0x1, 0x3, 0xd5}, &(0x7f0000002180)={0x4, 0x4, 0xacc, 0x1, 0x3, 0x6, 0x7, 0x7}, &(0x7f00000021c0)={0x0, 0x3938700}, &(0x7f0000002240)={&(0x7f0000002200)={[0xffff, 0x5]}, 0x8}) bind$tipc(r2, &(0x7f0000002280)=@id={0x1e, 0x3, 0x2, {0x4e23, 0x4}}, 0x10) timer_create(0x3, &(0x7f0000002440)={0x0, 0x38, 0x4, @thr={&(0x7f00000022c0)="09bf6d63f08acaa334793f948022f131d2b777cbc7e21b4a6214af03631084e9d2472f3bf8bfa61a2b54583cfe87219792bd9a25535021dc9defc2233e6166c576ab499cbb01dd811d", &(0x7f0000002340)="69b46a97853db7eb05d763498e8dd9977a99d9211e06f9b68c55bb7395b99f8d481852ca2765b859be701b37ea99b858a64061c180a2cde761a4b8d6b35de4f08cf7f437cea3972130eb7a5a753615f4b4bd4881eb8ab70438e9d24223da5cf3c2c94779c7b4018f4b95014a9022336a80e186b4827c6da6d624d0d9e637dbf147c2e925adf339bdd9983974686409c74df85f7a6162c573c70da6277c1c192d1971a939251a71ecb49d375e301942683196fbb173c2a95c8265469fc081ec96bb4c674912"}}, &(0x7f0000002480)) clock_getres(0x6, &(0x7f00000024c0)) 12.051095481s ago: executing program 9 (id=5952): r0 = io_uring_setup(0x6503, 0x0) io_uring_register$IORING_REGISTER_ENABLE_RINGS(r0, 0xc, 0x0, 0x0) 11.860776446s ago: executing program 9 (id=5954): msgsnd(0x0, &(0x7f0000000040)=ANY=[], 0x8, 0x0) msgsnd(0x0, &(0x7f0000000d80)={0x2, "5691103be5d757f82fc3f85525d3c60842e1923f8b92ebcdbac3b1e20b94a9a56b4f757de0b63c58b70bdd38c36541ca5d0b6a647fc0da3d32e529c73c5531eb1c47c87a21a85bd0d7fe019c20c1308315e8b996ffa6733986eafaf94b6fad9aa3189203d98834d0f736035610dea02a7a2ff3144a8bed62ae6f048714b5c06593e2aaf8da2b9671942bd7642592194a7af132d84ee592d1250792da42390d1dc159584e42a8ca9bfa9bb572e764f3ff266b1fde68f687a3cd0277f128df9f4b06c6105a184aa5b0a291aadea3da380e45f983baeddba14d81a25c73c35f3124358649ad231adf6f0faa4b86cca11774b33f228902342cbc46de4ad2f9820d96ddcc7df1659bc62d2f753731b28a9c8472264639270e65e841d1214432b2e66ba66a91fbee5e760e48c4b8c0e75b222732d2d72bd66cd7dbf6704f26af3815bdc4540c3e92d8ec907dc24a759ad6cfc635fd1617c6308d27cbad79f765f8c4486d9d25b1a75b4029da67fe2b11ef6ab2069aae0f2206ae0c5ad06966d28a32b6d2026f1d56d96c374b178101e22110ad26b16cb466b9a30a8c0a7aafee25849ff1ede05aa0e0effa32d3b9c8c4a78551575dd47f0adaf6f8f773ff8a6f7e480bb8cf47207d4e0fa010305c3ca45377e4c6a32bd62e06a919dd68c7b5cc71f8e47f351c21cf4e0e2c8eb178552f5a8535d70c727becec8d1024f6927e4aa8ce5132a913c17596f5bbd043dc3d2cc165c2cbbbf21b96f7dc62b7ceadbc6d41cd6f8963be70667fc18224640e51ede6e57b87c1017e2d0ff80996717b14932033ab58efb1b5e53b404e369ac6e6a0c715819402e119d91cff10719f53b5fb129125584538fcef1e29bceac4029fca2c01062900dcb1449228faed8b4a09c0bb94d5017b178fc55e5f661738092ccc135490c13c"}, 0x296, 0x0) msgsnd(0x0, &(0x7f0000000240)={0x3}, 0x4, 0x0) msgrcv(0x0, &(0x7f0000000780)={0x0, ""/227}, 0xe7, 0x0, 0x3800) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = syz_open_dev$evdev(&(0x7f0000000000), 0x0, 0x0) r1 = msgget(0x0, 0x880) msgctl$MSG_INFO(r1, 0xc, &(0x7f0000000440)=""/142) ioctl$EVIOCGMASK(r0, 0x80104592, &(0x7f0000000300)={0x11, 0xfffffffffffffd9e, &(0x7f0000000200)='\x00\x00\x00\x00\x00\x00\x00\x00\x00'}) r2 = syz_open_dev$usbfs(&(0x7f0000000100), 0x76, 0x101801) ioctl$USBDEVFS_CLEAR_HALT(r2, 0x80045515, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$tipc2(&(0x7f0000001ec0), 0xffffffffffffffff) remap_file_pages(&(0x7f0000ffb000/0x2000)=nil, 0x2000, 0xe, 0xc46, 0x1000) sendmsg$TIPC_NL_PUBL_GET(r3, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000540)={0x48, r4, 0xf03, 0x0, 0x0, {}, [@TIPC_NLA_SOCK={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_SOCK_REF={0x8}, @TIPC_NLA_SOCK_HAS_PUBL={0x4}, @TIPC_NLA_SOCK_ADDR={0x8, 0x1, 0x7}, @TIPC_NLA_SOCK_CON={0x1c, 0x3, 0x0, 0x1, [@TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8}, @TIPC_NLA_CON_FLAG={0x8}]}]}]}, 0x48}}, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000500), 0xffffffffffffffff) syz_open_procfs(0xffffffffffffffff, &(0x7f0000000100)='mountinfo\x00') syz_io_uring_setup(0x252e, &(0x7f0000000280)={0x0, 0x3f4d, 0x40, 0xfffffffe, 0x25}, 0x0, 0x0) open(&(0x7f0000000200)='./bus\x00', 0x141a42, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000040), 0xea100, 0x0) ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) r8 = socket$nl_route(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r8, 0x10e, 0xc, &(0x7f0000000040)=0xe00000, 0x4) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000300)={'wlan0\x00', 0x0}) syz_usb_connect(0x0, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000e2b4fc4068a11806a4e3010203010902120001000000000904"], 0x0) sendmsg$NL80211_CMD_NEW_INTERFACE(r5, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000003c0)={&(0x7f0000000140)=ANY=[@ANYBLOB='X\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="090d2000000000f0ff000700000008000300", @ANYRES32=r9, @ANYBLOB="0800051d000000001400060076657468115f746f5f7465616d0000000400cc000800050007000000140004"], 0x58}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 11.534005085s ago: executing program 7 (id=5956): capset(&(0x7f0000000000)={0x20080522}, &(0x7f0000000280)) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000040)={0xffffffffffffffff}) sendmmsg$unix(r0, &(0x7f00000001c0)=[{{0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4008050}}, {{&(0x7f00000000c0)=@file={0x1, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x3ec0, 0x40080}}], 0x2, 0x0) 11.423383582s ago: executing program 7 (id=5957): openat$ptmx(0xffffffffffffff9c, 0x0, 0x100, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) mremap(&(0x7f00007f1000/0x4000)=nil, 0x4000, 0x800000, 0x0, &(0x7f0000130000/0x800000)=nil) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), 0xffffffffffffffff) r2 = openat$yama_ptrace_scope(0xffffff9c, &(0x7f0000000180), 0x2, 0x0) fstat64(r2, &(0x7f0000000240)) sendmsg$NL80211_CMD_SET_MULTICAST_TO_UNICAST(r1, &(0x7f0000000300)={&(0x7f00000000c0)={0x10, 0x0, 0x0, 0x200}, 0xc, &(0x7f00000002c0)={0x0}, 0x1, 0x0, 0x0, 0x40001}, 0x8000) getdents(0xffffffffffffffff, &(0x7f0000000140)=""/177, 0xb1) r3 = socket$alg(0x26, 0x5, 0x0) bind$alg(r3, &(0x7f0000000000)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-generic\x00'}, 0x58) setsockopt$ALG_SET_KEY(r3, 0x117, 0x1, &(0x7f0000000140)="2c385aa3d49100dc6626c892b6bc436a", 0x10) r4 = accept4(r3, 0x0, 0x0, 0x0) sendmsg$nl_route_sched_retired(r4, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000012100), 0xe078}}, 0x0) recvmmsg(r4, &(0x7f0000000180)=[{{0x0, 0x0, 0x0}}, {{0x0, 0x0, &(0x7f0000000340)=[{&(0x7f00000004c0)=""/168, 0xa8}, {&(0x7f0000000900)=""/106, 0x6a}, {&(0x7f00000000c0)=""/26, 0x1a}], 0x3}, 0x2000000}], 0x2, 0x101, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) r5 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) r6 = openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0xa0502, 0x49) sendmsg$IPSET_CMD_PROTOCOL(r6, &(0x7f00000003c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x8000000}, 0xc, &(0x7f0000000380)={&(0x7f0000000340)={0x34, 0x1, 0x6, 0x101, 0x0, 0x0, {0xd, 0x0, 0x1}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_PROTOCOL={0x5}]}, 0x34}, 0x1, 0x0, 0x0, 0x8000}, 0x80) io_setup(0x1, &(0x7f00000016c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x8, r7, &(0x7f0000000180)="282fa8c2", 0x4, 0x5}]) sendfile(r5, r6, 0x0, 0x20000023896) 9.92728677s ago: executing program 7 (id=5958): socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r1, 0x0, 0x0) preadv(0xffffffffffffffff, 0x0, 0x0, 0x7, 0x0) r2 = socket(0xa, 0x1, 0x0) setsockopt$inet6_group_source_req(r2, 0x29, 0x2b, 0x0, 0x0) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_SETCRTC(r3, 0xc06864a2, 0x0) r4 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) ptrace(0x10, r4) ptrace$pokeuser(0x6, r4, 0x28, 0x528ec475) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) syz_mount_image$fuse(&(0x7f0000000080), &(0x7f00000000c0)='./file0\x00', 0x0, 0x0, 0x0, 0x0, 0x0) r5 = socket$netlink(0x10, 0x3, 0x15) socketpair$unix(0x1, 0x5, 0x0, 0x0) sendmsg$nl_route(r5, 0x0, 0x800) lremovexattr(0x0, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) r7 = syz_io_uring_setup(0x497, &(0x7f0000000180)={0x0, 0x4885, 0x8, 0x4, 0xfb}, &(0x7f0000000340)=0x0, &(0x7f0000000600)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r7, 0x16, &(0x7f0000000040)={&(0x7f0000001000)={[{0x0, 0x6, 0x3, 0xf4}]}, 0x1, 0x1}, 0x1) syz_memcpy_off$IO_URING_METADATA_GENERIC(r8, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r10 = socket$inet_mptcp(0x2, 0x1, 0x106) syz_io_uring_submit(r8, r9, &(0x7f00000002c0)=@IORING_OP_RECV=@use_registered_buffer={0x1b, 0x20, 0x10, r10, 0x0, 0x0, 0x0, 0x12321, 0x1, {0x1}}) io_uring_enter(r7, 0x3516, 0x0, 0x0, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)=ANY=[@ANYBLOB="1400000042003303"], 0x14}, 0x1, 0x0, 0x0, 0x4015}, 0x24040004) recvmsg(r6, &(0x7f0000000500)={0x0, 0x0, &(0x7f0000002980)=[{&(0x7f0000000700)=""/35, 0x23}, {&(0x7f0000000740)=""/4096, 0x1000}], 0x2}, 0x40002122) 9.361226751s ago: executing program 5 (id=5959): r0 = socket(0x8000000010, 0x2, 0x0) r1 = openat$vcs(0xffffff9c, &(0x7f0000000040), 0x800, 0x0) r2 = socket$kcm(0x29, 0x7, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(r2, 0x89e0, &(0x7f0000000080)={r0, r1}) syz_usb_connect(0x0, 0x24, &(0x7f0000001080)={{0x12, 0x1, 0x0, 0xff, 0x0, 0x0, 0x40, 0x572, 0xcb01, 0x2665, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xaa, 0x75, 0xb7}}]}}]}}, 0x0) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000000c0), 0x101502, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r4, 0x4068aea3, &(0x7f0000000040)={0x79, 0x0, 0xc}) ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) r5 = openat$sysctl(0xffffffffffffff9c, &(0x7f0000000100)='/proc/self/clear_refs\x00', 0x1, 0x0) write$sysctl(r5, &(0x7f0000000180)='4\x00', 0x2) r6 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, &(0x7f0000000500)=@bpf_lsm={0x1d, 0x35, &(0x7f00000001c0)=@ringbuf={{0x18, 0x0, 0x0, 0x0, 0xebc5, 0x0, 0x0, 0x0, 0x1}, {{0x18, 0x1, 0x1, 0x0, r1}}, {}, [@ringbuf_query, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x400}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @kfunc={0x85, 0x0, 0x2, 0x0, 0x3}, @ldst={0x0, 0x3, 0x3, 0x1, 0xa, 0x20, 0x1}, @snprintf={{}, {}, {0x7, 0x0, 0xb, 0x8, 0x0, 0x0, 0x3}, {}, {}, {}, {}, {}, {}, {0x18, 0x3, 0x2, 0x0, r1}}, @ldst={0x2, 0x3, 0x6, 0x2, 0xa, 0xfffffffffffffff0, 0xfffffffffffffffc}, @tail_call={{0x18, 0x2, 0x1, 0x0, r1}}], {{}, {}, {0x85, 0x0, 0x0, 0x85}}}, &(0x7f0000000000)='GPL\x00', 0x5, 0x6e, &(0x7f0000000380)=""/110, 0x41000, 0x30, '\x00', 0x0, 0x1b, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, &(0x7f00000000c0)={0x1, 0xf, 0x7511, 0x4}, 0x10, 0x0, 0x0, 0x9, &(0x7f0000000440)=[r1, r1, r1, r1], &(0x7f0000000800)=[{0x5, 0x4, 0x1, 0xc}, {0x3, 0x2, 0x5, 0x6}, {0x0, 0x2, 0x6, 0x4}, {0x2, 0x2, 0x4, 0x8}, {0x2, 0x1, 0xb, 0x9}, {0x0, 0x2, 0xb, 0x3}, {0x5, 0x5, 0x1, 0x2}, {0x1, 0x5, 0x10, 0x3}, {0x1, 0x3, 0xd, 0x3}], 0x10, 0x9}, 0x94) pipe(&(0x7f0000000140)={0xffffffffffffffff, 0xffffffffffffffff}) r8 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r8, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r8, &(0x7f0000000080)={0xa, 0x0, 0x0, @loopback}, 0x1c) lstat64(0x0, 0x0) getsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r7, 0x84, 0x76, &(0x7f0000000480)={0x0, 0xde4}, &(0x7f00000004c0)=0x8) getsockopt$inet_sctp_SCTP_ENABLE_STREAM_RESET(r0, 0x84, 0x76, &(0x7f00000008c0)={r9, 0x4}, &(0x7f0000000900)=0x8) statx(r7, &(0x7f0000000180)='./file0\x00', 0x4000, 0x20, &(0x7f0000000700)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) getgroups(0x1, &(0x7f0000000400)=[r10]) setsockopt$inet6_tcp_TCP_ULP(r8, 0x6, 0x1f, &(0x7f00000002c0), 0x4) recvfrom$inet6(r8, &(0x7f00000000c0)=""/3, 0x3, 0x0, 0x0, 0x0) splice(r8, 0x0, r7, 0x0, 0x4, 0xa) ioctl$vim2m_VIDIOC_EXPBUF(r7, 0xc0405610, &(0x7f0000000100)={0x0, 0x7, 0x8}) write(r6, &(0x7f00000005c0)="fc0000001c00072437c4273197e8157be116129af309b868030002ab087a0100000007481093210001c0f0030584050060100000000000039815fa2c53c28648000000b9d95662537a00bc000c00f0ff7f0000b400600033d44000040560916a0033f436313012dafd5a32e273fc83ab82d710f7a09d0f6806f90d435ef8b29d3ef3d92c94170e5bba2e177312e081bea05d3a021e8ca062914a46ccfc510bb73c9455cdc8363ae44cfd6239ec2a0f0d1bcae5fa0f5f9dcdd51af51af850294300004bb102b2b8b2cfce2539fe33f5566791cf190201ded815b2ccd243f395ed94e0ad91bd6433802e0784f2013cd1890058a10000c880ac801fe4af000049f0d4796f0000090548de992a8b73a925c089ab8e0fed6ba1d2b80e4200000000", 0x11f) 7.60992849s ago: executing program 9 (id=5961): prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x3, &(0x7f0000000440)=[{0x4d, 0x0, 0x1, 0xfffffffc}, {0x4, 0x4}, {0x6, 0xff, 0x0, 0x7fff0000}]}) r0 = socket(0x10, 0x3, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) prlimit64(0x0, 0xe, 0x0, 0x0) chdir(0x0) sendmsg$nl_route_sched(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000001c0)=@newqdisc={0x48, 0x24, 0xd0f, 0x0, 0x0, {0x60, 0x0, 0x0, r2, {0x0, 0xc}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_prio={{0x9}, {0x18, 0x2, {0x8}}}]}, 0x48}}, 0x0) r3 = socket(0x400000000010, 0x3, 0x0) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000000)={'lo\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000900)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000180)=@newtfilter={0x3c, 0x2c, 0xd27, 0x70bd28, 0x0, {0x0, 0x0, 0x0, r5, {0xf000, 0xffff}, {}, {0x6}}, [@filter_kind_options=@f_route={{0xa}, {0xc, 0x2, [@TCA_ROUTE4_CLASSID={0x8, 0x1, {0x4}}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x80}, 0x0) r6 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$ifreq_SIOCGIFINDEX_wireguard(r6, 0x8933, &(0x7f0000001880)={'wg0\x00'}) sendmsg$nl_xfrm(0xffffffffffffffff, 0x0, 0x2090) socketpair$unix(0x1, 0x5, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r7, &(0x7f00000002c0)=@abs, 0x6e) sendmmsg$unix(r8, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r7, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x4000040) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) r9 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(0xffffffffffffffff, 0x7a0, 0x0) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4000}, 0x3500000000000000) r10 = userfaultfd(0x80001) ioctl$UFFDIO_API(r10, 0xc018aa3f, &(0x7f00000000c0)) ioctl$IOCTL_VMCI_DATAGRAM_SEND(r9, 0x7ab, &(0x7f0000000040)={&(0x7f0000000340)={{@hyper, 0x7fffffff}, {@local, 0x1}, 0x400, "af2d031cf82537fdeda63fa6d5ca2b9fb4a0b473fd5ec0296c07ca1952657bdc9493014129f36fa011e719af6d609be0aff0d18d545f5fef6a8b33789512b9aaabb86c2b9af1b652bd3e7ccd99e2386d5d8175cf705ac9ed909c46b4f056d58d3c2a392b144727b09f2992d1d260d5d6d9b63c6e00a026664b4de29a4a238c24912176e47febed7f8c38c69ec217f910396ba5fbd54ee32d06aa7c9b102e856d5526a1b66622d7f4be1f0fc37ab9dca057f1fdccb156e6335722c72fac3292612cf7f1e26a20b277e77161ad468a145b6e8c04a103d6962212d6994b1a77c3222e45125de6bbf825ff92a6c95215792b0745e93335e9fb40b50379beca7f1f9b72b0d4b04bf86731cfb114ca061744bd71582950e96a4d76fdacf157210e980e613878f0ceabf2f9fc454475804f5184acd4b974d09c04617d9af7142ff53f5c5ca1b0e627353aea132d38ec41e74a75cb19460fbf019f6adc799dfdeb62f1fddbb03f875a95c6ab2d16100417077a3b390b7fddb3356b81cc3c53f5d76e3b0887288734d37b92631db0157853d099c031e24b51eb400c2341f04624656bd6e4a3c8684a7b0821db587e4696a8549b177adb843c21475cb499d95787aeb3dcbb11f23fe5858796ddb07ba64f68ba39ac66c5b7fbde8a39e0e9d045dffe14f8f4ac4a1387130db55647e0b8e73734c5717962eecdf537502bc236e613ef6557cfe5aea1ecbf4869aacce2abec4622ebc9c8668dc96dad9b05473a6df619488b1435f829dbdbb3b77bfab4aded37ea9c58672c0da5ca7b53e7febb899661ceae0c22119a80639885fc7d337ac2a0b8b551e89940453a259442049463deab5eccf9a3cf363f35f7fe8d111b1f73c71702a59e8f233de51bbf32b2f730636993e30fcf3a4da9d022d67c69e5ecc155734eebf958b6db93336afcef5028ab8a0d7a44789e0ee642a193c962bdbde0079dd933651898d9a544f5b2789e3336ec7ee1d742b406998448f7fbdd2cab29e7838ab5724d604086acede22b9316f072f5decbcddca936e7cb09c518af6e07f6f725315f5145e9d5f63bbc00c37cc916bca11a981a1855efcc2b0f4bd2f961cdcb06afc0e27a5243a67bc1cc9411571fd98417c0ba49f8e91f258376a9e8b3812da4f9a13a9a2cb271d5ca529300c864fb0dca9d7989f361c2a05279a484dcabdafab6520b44d06a5fd93bfff7f14541c0542802bd4a8c3ea25764f3195f69f6f01b3d52cc201fa9836dfb3a02734182602563de1780f2e8d815bb78f66db0b2ba1790e388af1e45d584541760fa1cb795cfaa8da93fde11ce1d7d2a283d6993d483465ebfaecde7e20c6f4300bba942f89ab5e3a59ff36f6bf023c988a24b3d67b91ae3c191baceefcac43831228397238c11ddf98134bb18100b92410b6ac10bb50fad182e9576f3ee4bb65fd4d472ccdcc8"}, 0x418, 0x4}) ioctl$UFFDIO_REGISTER(r10, 0xc020aa00, &(0x7f0000000140)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_REGISTER(r10, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x0, 0x2}) 6.52760602s ago: executing program 9 (id=5964): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, &(0x7f0000000180)=ANY=[@ANYBLOB="ffff50ad45ffffffffaaaaaaaaaa3386dd6700000100513afffe880000000000000000000000000201ff0200"/54], 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000240)={0x38, 0x0, 0x8, 0x8001, 0x0, 0xaf, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) r2 = add_key$user(&(0x7f0000000000), &(0x7f0000000340)={'syz', 0x2}, &(0x7f0000000480)="d25a9850a9a91163f76c5357f3bbadf2656e10d77f85d1028e60ab4e45b931e71645d3d636e82cfdeaadb674e1693d4a7de63820fefc4f787e272b122e", 0x3d, 0xfffffffffffffffe) r3 = add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0xc9, 0xfffffffffffffffd) keyctl$dh_compute(0x17, &(0x7f0000000140)={r2, r3, r2}, &(0x7f00000000c0)=""/83, 0xfffffffffffffe4f, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) ioctl$ifreq_SIOCGIFINDEX_vcan(r4, 0x8933, &(0x7f0000000380)={'vcan0\x00', 0x0}) r6 = socket$can_j1939(0x1d, 0x2, 0x7) bind$can_j1939(r6, &(0x7f0000000080)={0x1d, r5}, 0x18) r7 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_int(r7, 0x0, 0x14, &(0x7f0000000000)=0x109, 0x4) listen(r7, 0x2) r8 = socket$netlink(0x10, 0x3, 0x8000000004) writev(r8, &(0x7f0000000280)=[{&(0x7f0000000480)="580000001400192340834b80040d8c560a067fbc45ff000000000000000458000b480400945f64009400050038925a010000000000fff5dd0000000800030006010000418e01400004fcff3e1a0c16ef7e1ac617b18164d3", 0x58}], 0x1) sendmsg$can_j1939(r6, &(0x7f00000001c0)={&(0x7f0000000040), 0x18, &(0x7f0000000180)={&(0x7f00000000c0)="92", 0x1a000}}, 0xee) r9 = socket(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000080)={'ip6tnl0\x00'}) sendmsg$nl_route_sched(r9, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000005c0)=@gettclass={0x24, 0x2a, 0x800, 0x70bd2c, 0x25dfdbfb, {0x0, 0x0, 0x0, r5, {0xfff1, 0xffe0}, {0x2, 0x2}, {0x4, 0x6}}, ["", "", "", ""]}, 0x24}, 0x1, 0x0, 0x0, 0x17}, 0x2000400c) recvmsg$kcm(r9, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)=[{&(0x7f0000000800)=""/4096, 0x1000}, {&(0x7f0000000280)=""/147, 0x93}, {&(0x7f0000000200)}, {&(0x7f0000000400)=""/3, 0x3}, {&(0x7f00000004c0)=""/136, 0x88}, {&(0x7f0000000580)=""/15, 0xf}, {&(0x7f0000001800)=""/193, 0xc1}], 0x7}, 0x40) bind$can_j1939(r6, &(0x7f0000000340)={0x1d, r5, 0x3, {0x3, 0xff, 0x4}, 0xfd}, 0x18) sendmsg$nl_route_sched(r4, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000240)={&(0x7f00000007c0)=@newtfilter={0x24, 0x11, 0x101, 0x70bd25, 0x100000, {0x0, 0x0, 0x74, r5, {0xa, 0x8}, {0x5, 0xfff3}, {0xfff1, 0x6}}}, 0x24}, 0x1, 0xf0ffffffffffff, 0x0, 0x40}, 0xc4) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x20003, 0x0) openat$kvm(0xffffff9c, &(0x7f0000000080), 0x45c0, 0x0) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) 6.100778947s ago: executing program 7 (id=5966): r0 = socket$inet6(0xa, 0x3, 0x3c) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e23, 0x432, @loopback, 0xb}, 0x1c) sendto$inet6(r0, &(0x7f0000000040)="3898", 0x2, 0x34004824, 0x0, 0x0) 5.769984114s ago: executing program 8 (id=5967): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) bpf$BPF_TASK_FD_QUERY(0x14, &(0x7f0000000240)={0x0, 0xffffffffffffffff, 0x0, 0x7, &(0x7f0000000000)='cgroup\x00'}, 0x30) r1 = openat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000), 0x200002, 0x0) r2 = openat$cgroup_int(r1, &(0x7f0000000080)='cpu.weight.nice\x00', 0x2, 0x0) write$cgroup_subtree(r2, &(0x7f0000000100)=ANY=[], 0x9) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000480)={{0x14}, [@NFT_MSG_NEWCHAIN={0x50, 0x3, 0xa, 0x3, 0x0, 0x0, {0x3}, [@NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}, @NFTA_CHAIN_TABLE={0x9, 0x1, 'syz0\x00'}, @NFTA_CHAIN_HOOK={0x24, 0x4, 0x0, 0x1, [@NFTA_HOOK_PRIORITY={0x8, 0x2, 0x1, 0x0, 0x1dd91698}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x2}, @NFTA_HOOK_HOOKNUM={0x8, 0x1, 0x1, 0x0, 0x3}, @NFTA_HOOK_HOOKNUM={0x8}]}]}], {0x14}}, 0x78}}, 0x0) r3 = socket(0x2d, 0x2, 0x0) sendto$packet(r3, 0x0, 0x0, 0x4, &(0x7f0000000140)={0x11, 0x4, 0x0, 0x1, 0x0, 0x6, @multicast}, 0x14) connect$rxrpc(r3, &(0x7f0000000000)=@in6={0x21, 0x2, 0x2, 0x1c, {0xa, 0x4e24, 0x1, @private0={0xfc, 0x0, '\x00', 0x1}, 0x10}}, 0x24) 5.449440532s ago: executing program 7 (id=5968): ioctl$VIDIOC_SUBDEV_ENUM_FRAME_INTERVAL(0xffffffffffffffff, 0xc040564b, &(0x7f0000000000)={0x80000001, 0x0, 0x2006, 0x7, 0x80000000, {0x6, 0x2}}) r0 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x1) fsconfig$FSCONFIG_CMD_CREATE(r0, 0x6, 0x0, 0x0, 0x0) r1 = fsmount(r0, 0x0, 0x86) fsconfig$FSCONFIG_CMD_RECONFIGURE(r0, 0x7, 0x0, 0x0, 0x0) syz_usb_connect$cdc_ncm(0x0, 0x72, &(0x7f0000000080)=ANY=[@ANYRES16=r1, @ANYBLOB="f7", @ANYRESOCT], 0x0) r2 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) write$char_usb(r2, 0x0, 0x59) 5.373015384s ago: executing program 5 (id=5969): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) munlockall() recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) socketpair(0x1, 0x100000005, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14) syz_open_procfs(0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x10, 0x0, @fd, 0x0, {}, 0xf0000, 0x8, 0x0, {0x0, r4}}) syz_io_uring_submit(0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000002c0)={'wg2\x00'}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="bc010000", @ANYRES16=r5, @ANYBLOB="05002abd7000fddbdf2501000000a00108807400008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240001000000000000000000000000000000000000000000000000000000000000000000200004000a004e2000000001ff010000000000000000000000000001020000000800030007000000e800008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc000098058000080060001000200000008000200ac1e00010500030001000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff050003000100000064000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414bb0500030002000000060001000a0000001400020000000000000000000000000000000001050003000200000040000080080003000000000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000300000008000100", @ANYBLOB="ed24c20a40103e9ed8d7ac4f4b7af0dce949431d4a8e85201213f2a750a0cd648b0081eafc3b81a5c759623af8bc3b48a350a6c8f219ab20cfd340e1428d6cd9f50117"], 0x1bc}, 0x1, 0x0, 0x0, 0x4000}, 0x40) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) unshare(0x64000600) socket$nl_route(0x10, 0x3, 0x0) r6 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r6, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) connect$can_bcm(r6, &(0x7f0000000040)={0x1d, r7}, 0x10) 5.177469559s ago: executing program 8 (id=5970): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) munlockall() recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) socketpair(0x1, 0x100000005, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14) syz_open_procfs(0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x10, 0x0, @fd, 0x0, {}, 0xf0000, 0x8, 0x0, {0x0, r4}}) syz_io_uring_submit(0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="bc010000", @ANYRES16=r5, @ANYBLOB="05002abd7000fddbdf2501000000a00108807400008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240001000000000000000000000000000000000000000000000000000000000000000000200004000a004e2000000001ff010000000000000000000000000001020000000800030007000000e800008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc000098058000080060001000200000008000200ac1e00010500030001000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff050003000100000064000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414bb0500030002000000060001000a0000001400020000000000000000000000000000000001050003000200000040000080080003000000000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000300000008000100", @ANYRES32=r6, @ANYBLOB="ed24c20a40103e9ed8d7ac4f4b7af0dce949431d4a8e85201213f2a750a0cd648b0081eafc3b81a5c759623af8bc3b48a350a6c8f219ab20cfd340e1428d6cd9f501"], 0x1bc}, 0x1, 0x0, 0x0, 0x4000}, 0x40) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) unshare(0x64000600) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) connect$can_bcm(r7, &(0x7f0000000040)={0x1d, r8}, 0x10) 3.821398404s ago: executing program 9 (id=5971): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0xe) connect$unix(0xffffffffffffffff, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) mlock2(&(0x7f0000549000/0x1000)=nil, 0x1000, 0x0) munlockall() recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) socketpair(0x1, 0x100000005, 0x0, 0x0) getpeername$packet(0xffffffffffffffff, &(0x7f0000000000)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @dev}, &(0x7f00000000c0)=0x14) syz_open_procfs(0xffffffffffffffff, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = io_uring_register$IORING_REGISTER_PERSONALITY(0xffffffffffffffff, 0x9, 0x0, 0x0) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_SPLICE={0x1e, 0x10, 0x0, @fd, 0x0, {}, 0xf0000, 0x8, 0x0, {0x0, r4}}) syz_io_uring_submit(0x0, 0x0, 0x0) r5 = syz_genetlink_get_family_id$wireguard(&(0x7f0000000040), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_wireguard(r2, 0x8933, &(0x7f00000002c0)={'wg2\x00', 0x0}) sendmsg$WG_CMD_SET_DEVICE(r3, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000000380)=ANY=[@ANYBLOB="bc010000", @ANYRES16=r5, @ANYBLOB="05002abd7000fddbdf2501000000a00108807400008024000100d1732899f611cd8994034d7f413dc957630e5493c285aca40065cb6311be696b240001000000000000000000000000000000000000000000000000000000000000000000200004000a004e2000000001ff010000000000000000000000000001020000000800030007000000e800008024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffc000098058000080060001000200000008000200ac1e00010500030001000000060001000a00000014000200fe8000000000000000000000000000bb0500030000000000060001000200000008000200ffffffff050003000100000064000080060001000a00000014000200000000000000000000000000000000010500030002000000060001000200000008000200ac1414bb0500030002000000060001000a0000001400020000000000000000000000000000000001050003000200000040000080080003000000000008000a000100000024000100dbffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff080003000300000008000100", @ANYRES32=r6, @ANYBLOB="ed24c20a40103e9ed8d7ac4f4b7af0dce949431d4a8e85201213f2a750a0cd648b0081eafc3b81a5c759623af8bc3b48a350a6c8f219ab20cfd340e1428d6cd9f501"], 0x1bc}, 0x1, 0x0, 0x0, 0x4000}, 0x40) timer_create(0x2, 0x0, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) clock_nanosleep(0x2, 0x0, &(0x7f0000000040)={0x0, 0x989680}, 0x0) unshare(0x64000600) socket$nl_route(0x10, 0x3, 0x0) r7 = socket$can_bcm(0x1d, 0x2, 0x2) ioctl$ifreq_SIOCGIFINDEX_vcan(r7, 0x8933, &(0x7f0000000100)={'vxcan0\x00', 0x0}) connect$can_bcm(r7, &(0x7f0000000040)={0x1d, r8}, 0x10) 3.615179883s ago: executing program 2 (id=5918): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000580), r0) r2 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r2, 0x8933, &(0x7f0000000100)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_DISCONNECT(r0, &(0x7f0000000640)={0x0, 0x0, &(0x7f0000000600)={&(0x7f00000005c0)=ANY=[@ANYBLOB='$\x00\x00@', @ANYRES16=r1, @ANYBLOB="01002dbd7000fddbdf253000000008000300", @ANYRES32=r3, @ANYBLOB="0600360031000000"], 0x24}, 0x1, 0x0, 0x0, 0x4000000}, 0x44000058) 3.394350589s ago: executing program 2 (id=5972): r0 = socket$kcm(0x10, 0x400000002, 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x400000000010, 0x3, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) sendmsg$nl_route_sched(r2, &(0x7f00000012c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x4040001}, 0x0) sendmsg$nl_route_sched(r1, 0x0, 0x0) r4 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000580)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000140)=@newtfilter={0x24, 0x2c, 0xd27, 0x30bd29, 0x21dfdbfc, {0x0, 0x0, 0x0, r5, {0xb, 0xf}}}, 0x24}, 0x1, 0x0, 0x0, 0x24000014}, 0x200c4004) sendmsg$inet(r0, &(0x7f0000000100)={0x0, 0x2, &(0x7f0000000080)=[{&(0x7f0000000140)="240000002e000d190a762d7f089e", 0xfca2}, {&(0x7f0000000280)="68cabf2dfb58fc0a1d6b689866f05d490d010088a8ffff0200258f2e4409b8f9e6aaeb88bea123dc2c6726e89b1ae2f6e8bcb5ee52dcd7298d39093c510293bca0b646a3ce904f6e6b788b3204c233e60ddc", 0x52}], 0x2}, 0x0) 2.953606999s ago: executing program 2 (id=5973): socket$nl_generic(0x10, 0x3, 0x10) r0 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x7cc2086465dc556, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe}, 0x0) r3 = socket$inet(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000300)={'bond0\x00', 0x0}) r5 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r5, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000100)=@newqdisc={0xdc, 0x24, 0xf0b, 0x70bd2b, 0x0, {0x0, 0x0, 0x12, r4, {}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x88, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x2, [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1], 0x0, [0x5, 0x4, 0x19, 0x0, 0x8, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3], [0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x8001]}}, @TCA_TAPRIO_ATTR_SCHED_ENTRY_LIST={0x24, 0x2, 0x0, 0x1, [{0xc, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x4000000}]}, {0x14, 0x1, 0x0, 0x1, [@TCA_TAPRIO_SCHED_ENTRY_GATE_MASK={0x8, 0x3, 0x9}, @TCA_TAPRIO_SCHED_ENTRY_INTERVAL={0x8, 0x4, 0x2c2a1f44}]}]}, @TCA_TAPRIO_ATTR_SCHED_CLOCKID={0x8, 0x5, 0x7}]}}, @TCA_STAB={0x24, 0x8, 0x0, 0x1, [{{0x1c, 0x1, {0x4, 0x6, 0x100, 0x5d, 0x0, 0x7ff, 0x1fe}}, {0x4}}]}]}, 0xdc}}, 0x0) memfd_create(0x0, 0xe) syz_usb_connect(0x0, 0x36, 0x0, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000400)={0x0, 0x0}) bpf$MAP_LOOKUP_BATCH(0x18, 0x0, 0x0) r6 = socket$inet6_udp(0xa, 0x2, 0x0) setsockopt$inet6_group_source_req(r6, 0x29, 0x2f, 0x0, 0x0) getsockopt$inet6_buf(r6, 0x29, 0x30, &(0x7f0000000000)=""/40, &(0x7f0000001000)=0x28) modify_ldt$write(0x1, 0x0, 0x0) r7 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) capset(&(0x7f0000000040)={0x20080522}, &(0x7f0000000000)={0x0, 0x400, 0x2, 0x1, 0xfffffffd, 0xffffff00}) connect$inet6(r7, &(0x7f0000000180)={0xa, 0x4e22, 0x40000004, @mcast2, 0x9}, 0x1c) setsockopt$SO_BINDTODEVICE(r7, 0x1, 0x19, 0x0, 0x0) close_range(r0, r0, 0x0) r8 = socket$inet(0x2, 0x2, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000080)={'veth0_virt_wifi\x00'}) r9 = openat$rtc(0xffffffffffffff9c, &(0x7f0000000000), 0x100, 0x0) ioctl$RTC_UIE_ON(r9, 0x7003) ioctl$RTC_AIE_ON(r9, 0x7001) 2.076140444s ago: executing program 7 (id=5974): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) pipe(&(0x7f00000000c0)) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb4b, 0x9, 0x8, 0x0, 0x400003}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) rt_sigaction(0x8, &(0x7f0000000080)={&(0x7f0000000200)="2437460f1c2bc4a2f99c9022000000c4a2f1002746c44179700d32233333a738e7c44240f29a3b470000a5c4c4a14d590c9736fe0d094e486ff5f5bb559a00000f75bed5370b1c2665d2950e000000db37", 0x88000007, 0x0}, 0x0, 0x8, &(0x7f0000000300)) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000140)='stat\x00') ioctl$FICLONE(r1, 0x40049409, r2) lseek(r2, 0x9, 0x0) r3 = syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) write$6lowpan_control(0xffffffffffffffff, &(0x7f0000000180)='connect aa:aa:aa:aa:aa:11 0', 0x1b) openat$adsp1(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = inotify_init1(0x0) inotify_add_watch(r4, &(0x7f0000000180)='./control\x00', 0x64000ba6) inotify_add_watch(r4, &(0x7f0000000180)='./control\x00', 0xa4000960) r5 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNISCRNMAP(r5, 0x4b46, &(0x7f00000000c0)) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)={0x3c, 0x2, 0x6, 0x5, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0xc, 0x3, 'hash:ip\x00'}, @IPSET_ATTR_REVISION={0x5, 0x4, 0x1}]}, 0x3c}, 0x1, 0x0, 0x0, 0x4004000}, 0x40080) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_FLUSH(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, 0x4, 0x6, 0x101, 0x0, 0x0, {}, [@IPSET_ATTR_PROTOCOL={0x5}]}, 0x1c}}, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) sched_setattr(r3, &(0x7f00000001c0)={0x38, 0x3, 0xc, 0x101, 0x6, 0x7, 0x6b4, 0x510000000, 0x6, 0x40}, 0x0) setsockopt$RXRPC_SECURITY_KEY(0xffffffffffffffff, 0x110, 0xffe, 0x0, 0x0) 2.070205281s ago: executing program 5 (id=5975): timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) fcntl$lock(0xffffffffffffffff, 0x7, &(0x7f0000000040)={0x0, 0x0, 0x8000, 0x3ff}) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r0 = socket$pppl2tp(0x18, 0x1, 0x1) socket$inet6_udp(0xa, 0x2, 0x0) connect$pppl2tp(r0, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0xffff, @remote}, 0x2, 0x0, 0x0, 0x400000}}, 0x2e) socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$l2tp(&(0x7f0000000080), 0xffffffffffffffff) r1 = socket$kcm(0x2d, 0x5, 0x0) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f0000000240)=ANY=[@ANYBLOB="0200000004000000080000000100000080000000", @ANYRES32=0x0, @ANYBLOB="00000025cd997c2511139c000002000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB='\x00'/28], 0x48) bpf$PROG_LOAD(0x2, &(0x7f00000003c0)={0x3, 0x10, &(0x7f00000007c0)=ANY=[], &(0x7f0000000500)='GPL\x00', 0x9, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0}, 0x94) io_setup(0x6, &(0x7f0000001380)=0x0) r3 = syz_open_procfs(0x0, &(0x7f0000000200)='fd/3\x00') io_submit(r2, 0x1, &(0x7f00000000c0)=[&(0x7f0000000100)={0x0, 0x0, 0x0, 0x5, 0x0, r3, 0x0}]) socket$kcm(0x21, 0x2, 0xa) sendmsg$kcm(0xffffffffffffffff, &(0x7f0000000080)={&(0x7f0000000100)=@can, 0x80, 0x0}, 0x20000010) socket$nl_generic(0x10, 0x3, 0x10) eventfd(0xdf) io_submit(r2, 0x0, &(0x7f0000001500)) setsockopt$kcm_KCM_RECV_DISABLE(r1, 0x11d, 0x1, 0x0, 0x0) r4 = socket$igmp(0x2, 0x3, 0x2) setsockopt$SO_BINDTODEVICE(0xffffffffffffffff, 0x1, 0x19, &(0x7f0000002140)='pimreg\x00', 0x10) setsockopt$netlink_NETLINK_TX_RING(0xffffffffffffffff, 0x10e, 0xc, &(0x7f0000000040)={0x200000c0, 0xffffffff, 0xfffffff8}, 0x10) r5 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r6 = ioctl$KVM_CREATE_VM(r5, 0xae01, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) ioctl$KVM_SET_MEMORY_ATTRIBUTES(r6, 0x4020aed2, &(0x7f0000000040)={0x3333e000, 0x7000, 0x8}) sendto$inet(r4, &(0x7f0000000040)="ab628f2b74e109bd", 0x8, 0x20044044, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) timer_create(0x0, &(0x7f00000000c0)={0x0, 0x21, 0x2, @thr={0x0, 0x0}}, &(0x7f0000000300)) 1.721706236s ago: executing program 8 (id=5976): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0500000004000000ff0f000007"], 0x48) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0, 0xff, r0, 0x20}, 0x38) r1 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000001c0)={0x20, 0x40, 0x9, 0xffffffff, 0x25dfdbfd, {0x2}, [@typed={0x4, 0x11f}, @nested={0x8, 0x9, 0x0, 0x1, [@nested={0x4, 0x3b}]}]}, 0x20}, 0x1, 0x0, 0x0, 0x8000}, 0x0) 969.454761ms ago: executing program 8 (id=5977): r0 = socket$inet(0x10, 0x3, 0x0) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) dup3(r1, r2, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2800001, 0xc3072, 0xffffffffffffffff, 0x0) mremap(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x400000, 0x3, &(0x7f0000c00000/0x400000)=nil) r3 = openat$sysfs(0xffffffffffffff9c, &(0x7f00000000c0)='/sys/kernel/config', 0x0, 0x0) fchown(r3, 0x0, 0x0) ioctl$UI_DEV_DESTROY(r3, 0x5502) read$FUSE(0xffffffffffffffff, &(0x7f0000001340)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_WRITE(r3, &(0x7f0000000080)={0x18, 0x0, r4, {0x4}}, 0x18) r5 = socket(0x10, 0x3, 0x0) setsockopt$netlink_NETLINK_NO_ENOBUFS(r5, 0x10e, 0x5, &(0x7f0000000040), 0x4) r6 = bpf$MAP_CREATE(0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000050000000100000007"], 0x50) bpf$MAP_UPDATE_BATCH(0x1a, &(0x7f00000004c0)={0x0, 0x0, &(0x7f0000000640), &(0x7f0000000740), 0x20075, r6}, 0x38) r7 = bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000380)={0x6, 0x1c, &(0x7f0000000940)=ANY=[@ANYBLOB="18110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000082000000b7080000000000007b8af8ff00000000b7080000030000007b8af0ff00000000bfa100000000000007010000f8ffffffbfa400000000000007040000f0ffffffb70200000800000018230000", @ANYRES32=r6, @ANYBLOB="0000000000000000b70500000800000085000000a50000006583040007000000950000000000000018440000fbffffff000000000000000018000000ff0000000000000000000000683666d830950868cc4985741fce2bc7c6c3e9f65cd63910a040bbfa2aa4d6728de230abf8d2a02155eb08753f8b3dfa7351565e8c34f584ceb279875436eacb0cc1"], &(0x7f0000000100)='GPL\x00', 0x7fff, 0xc5, &(0x7f0000000680)=""/197, 0x41100, 0xa038eafaba8b8970, '\x00', 0x0, 0x25, 0xffffffffffffffff, 0x8, &(0x7f0000000140)={0x6, 0x2}, 0x8, 0x10, &(0x7f00000001c0)={0x0, 0x4, 0x80000001, 0xff}, 0x10, 0x0, 0x0, 0x0, &(0x7f0000000200)=[r6, r6, r3, r3, r3, r6, r3, r6, r3], 0x0, 0x10, 0x7, @value=r3}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000300000095", @ANYRESHEX=0x0], 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x39, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r7, 0x0, 0x0, 0x0, 0x0}, 0x94) r8 = socket$packet(0x11, 0x2, 0x300) getegid() r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x1, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x10, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5}, 0x94) setsockopt$sock_attach_bpf(r8, 0x1, 0x32, &(0x7f0000000180)=r9, 0x4) sendmsg(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000040)=[{&(0x7f0000000600)="4c0000001200ff09ff3a150099a283ff04b8008000f0ffff0000000600401500240036001fc411a0b598bc593ab6821148a730cc33a49868c62b2ca654a6613b6aab14e39ba9bf6c4387ea1b", 0x4c}], 0x1}, 0x0) recvmmsg(r0, &(0x7f0000001300)=[{{0x0, 0x0, 0x0}}], 0x300, 0x48, 0x0) 898.129918ms ago: executing program 5 (id=5978): r0 = socket$inet_smc(0x2b, 0x1, 0x0) r1 = syz_open_dev$usbfs(&(0x7f0000000040), 0x6, 0x10200) mmap$usbfs(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x9, 0x10, r1, 0x3) r2 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000018c0), 0x0) ioctl$SNDRV_SEQ_IOCTL_SET_CLIENT_POOL(r2, 0x40bc5311, &(0x7f0000000140)={0x80, 0x1}) r3 = socket$nl_generic(0x10, 0x3, 0x10) r4 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) sendmsg$ETHTOOL_MSG_FEATURES_SET(r3, &(0x7f0000002540)={0x0, 0x0, &(0x7f0000002500)={&(0x7f0000002580)={0x40, r4, 0x1, 0x0, 0x0, {}, [@ETHTOOL_A_FEATURES_WANTED={0x14, 0x3, 0x0, 0x1, [@ETHTOOL_A_BITSET_VALUE={0x4}, @ETHTOOL_A_BITSET_SIZE={0x8, 0x2, 0x7ffd}, @ETHTOOL_A_BITSET_NOMASK={0x4}]}, @ETHTOOL_A_FEATURES_HEADER={0x18, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'veth0_to_bond\x00'}]}]}, 0x40}}, 0x0) connect$inet(r0, &(0x7f0000000000)={0x2, 0x4001, @dev={0xac, 0x14, 0x14, 0xd}}, 0x10) lsetxattr$security_capability(&(0x7f0000000080)='./file0\x00', &(0x7f00000000c0), &(0x7f0000000100)=@v1={0x1000000, [{0x6, 0xed}]}, 0xc, 0x1) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000240)=@newlink={0x48, 0x10, 0xffffffffffffffff, 0x70bd26, 0x25dfdbfd, {0x0, 0x0, 0x0, 0x0, 0x52a78, 0x823}, [@IFLA_LINKINFO={0x28, 0x12, 0x0, 0x1, @erspan={{0xb}, {0x18, 0x2, 0x0, 0x1, [@IFLA_GRE_ERSPAN_VER={0x5, 0x16, 0x5}, @IFLA_GRE_COLLECT_METADATA={0x4}, @IFLA_GRE_FWMARK={0x8, 0x14, 0x1}]}}}]}, 0x48}, 0x1, 0x0, 0x0, 0x80}, 0x4008000) shutdown(r0, 0x1) 389.466346ms ago: executing program 8 (id=5979): r0 = openat$sndseq(0xffffff9c, &(0x7f0000000000), 0x2040) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r0, 0xc08c5332, &(0x7f0000000040)={0x79, 0x8, 0x1, 'queue0\x00', 0x5}) r1 = socket$inet6(0xa, 0x6, 0x8000) ioctl$BTRFS_IOC_SUBVOL_CREATE(r1, 0x5000940e, &(0x7f0000000100)={{r0}, "7255388227c1db1b84b95dbe0a475b12bc6278ede8423561364addee63050c909ad6b874d7fb2c5ceb70074a99bac87d5524108185fbfdaf3a03ea6312db1d8108381fef4c4fe51bfbaa44ad8db71c6cbd7d426b4debd6a1e5904a72fa8a44d06c3865c134e2e685e0076932e45b4fb40d80e5124495d61ff858bad0e4a170bd0a3c75568b1655381c880733ffb7ae2f0088b16aad79ba2f76cccdf693c405c08a4393e02ca95ba8bfcd623bb719f380481164b9fa532705475038e350947264da1324e7656a586d1b072c31dfd4d9c84b86861a3e9985561340e01331267228d8a0af84fab576e891717fc93445aa8fc7e130df0bf2c9832c2287b6ca6e37c80c48fa8d541b03fcc8097ef3f72d452e604a545bfcaa51fd00a32703400e6ec3ba8345bac9608e4596f1defba59b9989905992abe5f755e0bfacf38bb26322f4514cc45a4fdfa74e86a0c63387d578a4087d5c381771708b366d97c0bb08dfb542d4e30c5455590e2b6bf7a19bd32e3b16cd94dac0519de1f14d9c5f94080abc1f2bd2690c313cbc1bbb66cfbb6cb8e7e9f2a715fcc5c8ee9144567a63720dfc8a2432d76bf320c714baa397dbe1efab78f1f4081e0eed1d150434d4cf7f3ad3351ff6031c287a9fd815c3f8930474202d13a41fd91904a4348b39541f6be7145fa6e6f3315ce55c428544c36c6f8428350e7e65db33c2f944a71ff1d0c0bc8b9a079d7b55bee40c08cd4b2675cb087abe916d2300c46a6ad2f3430c41cefa2a3c3beb5c46f169131fb17945f4d4628935d7d75b5cba2b9a93d20cb1dc08aad25f0d81799a6679459390c96518ae993adb23b59ab1d751915721e6597ad397ebfa400084faf38df445942ba208171b9b18bac1cc4f89b68f5908595aa7a764c811ce416bd5ecae8951f898361a5d855fe130ad576409e077bf061e78aad8eec12008e1f465e2e0c499d6f2e4327fdeca79cc8f7fc2419506575f2c9e221fb25ce3deb328eb0594cd247e3719301e3348541a323a99f24772f892e5a89903c17e5da36a30362e51212c3bbe380ccd9ae89d1110936cec8b5b28107bd88772300f6cc9eeab0f36db81c7a6e2d70ac341059dffc098ce7cc42c5c41b09cbbe830e28de378d38d58318671fe2522e01b9646b1c3552af5cc477c5400c4aa6b66fd3a2ae45cd110d2a3bc0b129b40f6879771b38fed8d6b63eaa6671a4693d34f77a682d6b10ab6b5d41a9bd615de86bf02f8364e9cfd2f4bf08d986c976bb077dad51f5d758b2cddcf4d813804fff64131f522a47a26632bcc6e3544834a993c51d7aca58afc370c5866178639a64e237df63f7c41f965d56d17313196aeec1135209e5cd8e3d51c50c0714e00c771505bc82a77b9737a89e6851ac1decc213adb537326833f6bd6af632e5f62a11452ebab7005b967f6fe1de26583b622aa19ca250ccfe87b878db3a016cca757b9771da80160d20db9fc53f086fc7bb157459776249303ddc0481c9c41203944a02f085ef6320252ec92fd6611ab53448ec82ff5ec98b68786db288a0299c3311af08f3348a84a3704d2cce7632b046c01b3123278510a424c506ff274b241bb5fdbc93538f0fab1cf201fa60edee256ac80ea3e3322aae3ee985f103e11b18b4013000facf6b8d2465877621f8ee9e007a0149002a31d148ddd705ffefeaa9cf932772dfa62403cd4899db088fddfb479e50f773740013becf3cab3ac5dd39fc507ac4ddb6028276c8baba9c8cba8a86fd5196d976ce38f602912387eb3f7f829a79abc84207ee8494c4d6f694cd80d7a03140bb352f91e49d7c2b6b95867e9a289e343f19c4fabbd1c930aff426aca776bd40187b489be134ec9786fbe15abd08b8deb9156ce9dcf08bb152f27c9d34762ae6501606238803db32aa2d0e45f1228b1cd06fc2b23731137519b7e714ba34a00fbfd3753596de054948e46030e2f43b8af3239e9d9be107ccc34254efca490be5718b1c3870a01a791a53401c37143c79b02884ca0af3515b31003bc1df23e4e2af408c8c9a4e9158375bbcfe0679f12c720f03089777784d87a45927dec70d9fa04ab6cf6f1a8a439869ddc65747bdd46c5d33d3087dc80622044c98416a0ddcbab51ec55053cd92de1ccca9fe9a0cb3b11129346ba2c97487d02fd91357b7e46620e1db5f4a1b365f5a3f22731f7f95488f44c5ff3b7eef4e74f0754fad8a982a0ca7f24c70ddc0559000adc1ad234fe7940280447f9d3e4394d8a37e6abde0112149539737f6be97592c8dd26330d1f6abbc859379e2019ae58f28f78dd4ebd9cef78b2b026b14d1e43d52ac3c1f3025bcf450d55c0d0da9009f75a54c7badd433516aa22dbacbeec6d69ef2caceeb48a1b03af1a0867b83cf8798f8ca138b333b810d37cd8c0174cd435d70e817197d23e3fcd9c71d179af7927d09479d18b192b327dd9e66af88bbb01f259b6a511eafe5d3c17114fb21768f488e65eba116970b62cc9e7ecbf74d2d00a9716af89c2642332ae7d9ef8bbcbacd23ffd31cedf2e2620242b8c9647279ff7c4aca878a8a24bf13f92513b62d5586c0c416e319489303852be6b9b52bbefcc5ca72585e3c9f1ecb073b7a5d102a87ab23440cc6b5ccf882d5a3252973145b4df8068622290fdde86c1efd5364d9f42e13a3ec07264da1130fa54d972154195185c213f5aeb9a35cf4431b190890d4d9697c27ab6e58d585b1f383f99a6b4c7e5e2b34b3411d2e6b2def0dce5b541b151da12f015ed5484edce32098821588bb83d6e3fb05fdc83e5b42a5b96bd1fd8210f7c6ece2698adadf0055fbfb28857144c2903c40205f18d56b29e1edab8a582170ebec2ad85683dbea3f5e7192c65cbadfabc99b6106662de9afdc331efc248e541a4928a2dc71cc30014b48aac137152c551be10b89d98a80307dbd9a58b679da6ac2415993d9ae3cbd8d83e3acce8ea873404d2bab815d2208be01c3f056d3973d1d6cf1ff72989a099729ba1921a7d7051defea38ab5c4a2af5495c27b2f5dc6ca713f45f2803926e4782974d13adb8ec6b5bec3cdc91eee3c29796a3c6dc2dfc109da106143ab4a8ab19b652820ca963bbbdfe9d5522f03728d23de9b73c4e3c560ca4b46661dc7666eae9367e45ff97dabde468b220de7e0627bb0d06806fb0a2e28128caa9601489e6ce8e39a1511d83e1333ee6e7ecb9668b70cdc1ece2a6c39dbad27cc3a149f0c88c9e45170cc98d9c55da070a477e0ed60a8b80704602d75a9898d3f22f6e7d1f808fe44ba7c14e3d257ca38ed3daf8ddb5b408d42ddde7cf08d918403a18ec2dcccfe410dae90aa8151b04eea96e340ccc7202aa2fbf1a4bbfe839f0292945db026d61c1cc33535fa02ce74c8825c641e6de1904b4b5080041fc8b5415aead7f38d8727d8d66e6dbc308584d27489bad0958112a90c234fe6f7158c34ba41f71845c6e39348c28bfbc7c0d4fa501b8c5915185c609702988b67173084819ba3d3d7bd1bdb2705555da9d10755f2fdb30ef174a123206ce185f0768577e759f6a410c82d894655f6c85ee1d1dc4792d1abb97f7a5c90c7becc6b8e0da6be643c1d7ff2bed1195e7e0cc15f05bd16f9554d391bbf6460e2852d494a6ea3ae000146eb60f57544108d512d6e41697d8ca5f1d12a0dc1294a3a7b8004bb3e4cfc6215326f8db746a1e181e21be837a2bf687b814e1650cc713e30e98e6ff2df7dfc6d3293ce245e95a7b52260623a0055c64d736fbc5dc156c063c11e9174dc36e71132de33569d0a6138a2b770b94835c47c7ff424ce84fa8306facb6850aa4dc8f49c7d6c9add10f50a9f0ce8acbf9a5d371eb20057641e92abf2f04a7494c3b62eec2f95cdb275003c161cdbd233d631664e061be2a698459b4f290a2e3a6b2628df2b4f30e9d52aa553b99574b311d360e07d8b0c4b502f0729a28d1b66f92d37d4d94911984ba7a8a1bdbd11194b881bb8f2b7a2977928c953287dcd2385a7e8b51e7ab9e10cc0ccb96b585683117cb2165467f0807339a0ded70543b21cf98dd46b3f1e99685e6d69ee8286d4b5b36ff2513db724807d8ea9ae55fcd7ae483260d2bee2e8a6379bd15933e6d2cddda42539972f52d43f314261825821d14dce4bb72a3871a428172dfa0cce2469124251c02110351afaefca27bb11470b12907ac102d35f2f7cd5b749b5ff33eb1a8f15c71f678b81ccf38d3e0f7b411d4b830d3acfc38d9918957967b8ccd1f9e1240f7d7be11d327a1f04cb5e36bd0bcabeee76def15014557520d4fb7fb8f43cbcaaf2d45c5339bc22bbdfee50b5ab2a1927c410d3cfd74cf6c8fe9dde36f353424f303ae11331d70ebfd1413fadbd1e60d8d4cedea8ecd7d19b5b7d70cbd794985d56419a25c392b0423ee340b07ab58c7a44dead46763c9881afb34dd584c8b20c4fc7cfe65834cafc779540eb11d33361b1235715a28d3feeaf6c6bf62cfc824d1f371fc56ed480e640fce2e7d413c9051baedb40e0266ca084cb00e5c7c31ef859795383ac1fa91ce83959cb867f45b2de7768b2179cdc0ab35f5dd1b08793de9011cf459d606563273b947c2f584c23e3ec7efd3337ee53ef790fd0076abef2c998911a4dfddab40bdb9403b80a140342d318eb7e6b1dd77584a76c818749b3134563ecd41a4f408924a5cc80e8d939168cb16d48435b2fa48cadea12e248cc271c75f261833fe6127231a1ed213f72e5fdec56146ded2b9ba47515de246d67f3b67576ed8827fba689b7dbf20074c4ad872b705069e56ad8b2965283db960a06502afd757e663a0fcb1a4603bb9c8c5660601a8d00d587b988ae8c742c8c251853bad03e6ce0676c7d90f19e15b1a0c8d8182b853a8dec3f9680f363862a1e6d0c2f4f79800444a5c77d1cde549789387813bbe11a89979e6f0d0f7ff57196f0959be92fa6468b5faf360c19e2e7669d73fa757c3932bf970e0e625ad47e86ba123f533c647950d5489be11dd6b6761c02093543642ad5c0da00fe15fb5bd425530933e66d36449286ccb27e11010bb6e6a49369aad298f6885791e610fea0597e1833393cd19a3e1fcecb3596f0839beba90f0bf6fca69edf442a831230bdedc71b1fd13372b989d16181e09c12e446e50789cc63a8fbf62541ac17aeab669809db652d7224c5582868427c9c025b1bd91f024a6b4664d7ed020d9a450bcdc7377491f29cc0a7c9f9366babd40460f4f6fca7a810073be4dc486885377308e263fedcbe367dcccf7f47fba9f0016efd1a52a68b1202b4f8f39c01e59161e651075e6bf0ac16002cdf5a1ee2b25722b947ab3e766f94f5f8cba663099b30069dbc38684afc2072bc79f5e27523da9a3596521f79a904fd1bd62e62a43ccf0ff07085b655ec80120f1aa5877d5aae394c8e0520cfc377e9a3ef587c3911ef921c852c42f4cf0dfad48b0487e93333e18dd87c4b6a288fc0134eefd535f489ba1b2d05f60ce6ab088233e3fc349716739106b3998bee0be73d303de3082a502529a9d2dca41ca432209cf2c295f0e8c2f34a7624a988a1c85206137a25c5682a7790cc8185895259d6098fef2fdab7f1cbb48e88fedfc75b4b3f0e1490183bf817696dea2fcf0baec59cb73b69f9fb20900ed34e46a3a0557f66d1cad63ffa07be2818c824f14c117f133aa0bd821eb847b122ec6cc633d089db6cce4a6ed870767418eaaa57d6007289bc4478ba3cf8dfb6e8bda3d7e95f083d6c5868a04247a664e5cca07deeaac498f30db73bc50787032c67d0de831f811c29247d"}) r2 = socket$packet(0x11, 0x3, 0x300) r3 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000001100)='net/llc/socket\x00') r4 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_RECVNXTINFO(r4, 0x84, 0x21, &(0x7f0000001140)=0x9a41, 0x4) ioctl$SNDRV_CTL_IOCTL_ELEM_LIST(r3, 0xc0485510, &(0x7f0000001200)={0xfffffff8, 0x2, 0x7ff, 0x3, &(0x7f0000001180)=[{}, {}]}) close(0xffffffffffffffff) r5 = getpgid(0x0) prctl$PR_SCHED_CORE(0x3e, 0x4, r5, 0x0, &(0x7f0000001280)) r6 = dup(r1) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(r6, &(0x7f00000013c0)={&(0x7f00000012c0)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000001380)={&(0x7f0000001300)=@deltclass={0x5c, 0x29, 0x4, 0x70bd29, 0x25dfdbfe, {0x0, 0x0, 0x0, 0x0, {0x6, 0x3}, {0xfff3, 0xa}, {0xffff, 0x4}}, [@tclass_kind_options=@c_sfb={0x8}, @TCA_RATE={0x6, 0x5, {0xc0, 0xd}}, @tclass_kind_options=@c_skbprio={0xc}, @TCA_RATE={0x6, 0x5, {0x40, 0xf9}}, @tclass_kind_options=@c_drr={{0x8}, {0xc, 0x2, @TCA_DRR_QUANTUM={0x8, 0x1, 0x8}}}]}, 0x5c}, 0x1, 0x0, 0x0, 0xc1}, 0x4) process_vm_writev(r5, &(0x7f00000017c0)=[{&(0x7f0000001400)=""/196, 0xc4}, {&(0x7f0000001500)=""/55, 0x37}, {&(0x7f0000001540)=""/132, 0x84}, {&(0x7f0000001600)=""/164, 0xa4}, {&(0x7f00000016c0)=""/225, 0xe1}], 0x5, &(0x7f0000001c00)=[{&(0x7f0000001800)=""/211, 0xd3}, {&(0x7f0000001900)=""/251, 0xfb}, {&(0x7f0000001a00)=""/66, 0x42}, {&(0x7f0000001a80)=""/53, 0x35}, {&(0x7f0000001ac0)=""/203, 0xcb}, {&(0x7f0000001bc0)=""/9, 0x9}], 0x6, 0x0) accept4(r2, &(0x7f0000001c40)=@generic, &(0x7f0000001cc0)=0x80, 0xc00) r7 = accept4$packet(r2, 0x0, &(0x7f0000001d00), 0x0) ioctl$sock_inet_SIOCGIFDSTADDR(r7, 0x8917, &(0x7f0000001d40)={'veth1_to_team\x00', {0x2, 0x0, @broadcast}}) socket(0x1a, 0x3, 0xff) r8 = openat2(0xffffffffffffffff, &(0x7f0000001d80)='./file0\x00', &(0x7f0000001dc0)={0x200000, 0x20, 0x46}, 0x18) ioctl$sock_ipv6_tunnel_SIOCGET6RD(r3, 0x89f8, &(0x7f0000001e40)={'tunl0\x00', &(0x7f0000001e00)={'gretap0\x00', 0x0, 0x1, 0x10, 0x5786, 0x5, {{0x7, 0x4, 0x3, 0x4, 0x1c, 0x68, 0x0, 0xd2, 0x29, 0x0, @local, @initdev={0xac, 0x1e, 0x0, 0x0}, {[@noop, @generic={0x44, 0x4, "c04a"}]}}}}}) setsockopt$packet_add_memb(r8, 0x107, 0x1, &(0x7f0000001e80)={r9, 0x1, 0x6, @broadcast}, 0x10) r10 = add_key$keyring(&(0x7f0000001f80), &(0x7f0000001fc0)={'syz', 0x2}, 0x0, 0x0, 0xfffffffffffffff8) request_key(&(0x7f0000001ec0)='ceph\x00', &(0x7f0000001f00)={'syz', 0x3}, &(0x7f0000001f40)='.\x00', r10) ioctl$VHOST_SET_VRING_KICK(r8, 0x4008af20, &(0x7f0000002000)={0x1, r6}) sendmsg$IPSET_CMD_LIST(r8, &(0x7f0000002140)={&(0x7f0000002040)={0x10, 0x0, 0x0, 0x80000}, 0xc, &(0x7f0000002100)={&(0x7f0000002080)={0x48, 0x7, 0x6, 0x401, 0x0, 0x0, {0xa, 0x0, 0x4}, [@IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_FLAGS={0x8, 0x6, 0x1, 0x0, 0x8}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz0\x00'}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz2\x00'}]}, 0x48}, 0x1, 0x0, 0x0, 0x40}, 0x20008004) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r1, 0x29, 0x37, &(0x7f0000002180)={0x2, 0x3, '\x00', [@enc_lim={0x4, 0x1, 0x1}, @calipso={0x7, 0x18, {0x2, 0x4, 0x6, 0x3, [0x8f, 0x9]}}]}, 0x28) ioctl$AUTOFS_DEV_IOCTL_ASKUMOUNT(r3, 0xc018937d, &(0x7f00000021c0)={{0x1, 0x1, 0x18, r1, {0x200}}, './file0\x00'}) io_uring_register$IORING_REGISTER_EVENTFD(r11, 0x4, &(0x7f0000002200)=r8, 0x1) 170.385978ms ago: executing program 8 (id=5980): r0 = socket$pppoe(0x18, 0x1, 0x0) connect$pppoe(r0, &(0x7f00000000c0)={0x18, 0x0, {0x6, @random="39c7902df7c7", 'wg0\x00'}}, 0x1e) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='blkio.bfq.io_queued\x00', 0x275a, 0x0) write$cgroup_int(r1, &(0x7f0000000000), 0xffffff6a) sendfile(r0, r1, 0x0, 0x9) 0s ago: executing program 9 (id=5981): r0 = syz_open_dev$vim2m(&(0x7f00000000c0), 0x220006, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r0, 0xc0405602, &(0x7f0000000200)={0x11, 0x2, 0x1, "bc57499e007105bf0000000100000000e40300", 0x50424752}) kernel console output (not intermixed with test programs): 1849.167095][T26872] should_fail_ex+0x414/0x560 [ 1849.167134][T26872] prepare_alloc_pages+0x213/0x610 [ 1849.167164][T26872] __alloc_frozen_pages_noprof+0x123/0x370 [ 1849.167193][T26872] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 1849.167226][T26872] ? policy_nodemask+0x27c/0x720 [ 1849.167290][T26872] ? __lock_acquire+0xab9/0xd20 [ 1849.167332][T26872] alloc_pages_mpol+0x232/0x4a0 [ 1849.167363][T26872] vma_alloc_folio_noprof+0xe4/0x200 [ 1849.167385][T26872] ? page_table_check_set+0x18d/0x730 [ 1849.167419][T26872] ? __pfx_vma_alloc_folio_noprof+0x10/0x10 [ 1849.167455][T26872] folio_prealloc+0x30/0x180 [ 1849.167489][T26872] __handle_mm_fault+0x2a8b/0x5400 [ 1849.167538][T26872] ? __pfx___handle_mm_fault+0x10/0x10 [ 1849.167584][T26872] ? follow_page_pte+0x7ef/0x13e0 [ 1849.167626][T26872] handle_mm_fault+0x40a/0x8e0 [ 1849.167668][T26872] __get_user_pages+0x165c/0x2a00 [ 1849.167744][T26872] populate_vma_page_range+0x29f/0x3a0 [ 1849.167779][T26872] ? __pfx_populate_vma_page_range+0x10/0x10 [ 1849.167804][T26872] ? apply_vma_lock_flags+0x31b/0x390 [ 1849.167834][T26872] ? down_read+0x1ad/0x2e0 [ 1849.167867][T26872] __mm_populate+0x24c/0x380 [ 1849.167895][T26872] ? __pfx___mm_populate+0x10/0x10 [ 1849.167923][T26872] ? up_write+0x1c4/0x420 [ 1849.167956][T26872] do_mlock+0x612/0x720 [ 1849.167989][T26872] ? __pfx_do_mlock+0x10/0x10 [ 1849.168024][T26872] ? __pfx_ksys_write+0x10/0x10 [ 1849.168057][T26872] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1849.168092][T26872] __ia32_sys_mlock+0x5f/0x70 [ 1849.168116][T26872] __do_fast_syscall_32+0xb6/0x2b0 [ 1849.168146][T26872] ? lockdep_hardirqs_on+0x9c/0x150 [ 1849.168178][T26872] do_fast_syscall_32+0x34/0x80 [ 1849.168207][T26872] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1849.168241][T26872] RIP: 0023:0xf705d539 [ 1849.168260][T26872] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1849.168279][T26872] RSP: 002b:00000000f544d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000096 [ 1849.168302][T26872] RAX: ffffffffffffffda RBX: 0000000080000000 RCX: 0000000000800000 [ 1849.168318][T26872] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1849.168330][T26872] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1849.168343][T26872] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1849.168356][T26872] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1849.168389][T26872] [ 1850.095853][T26877] syzkaller0: entered promiscuous mode [ 1850.101717][T26877] syzkaller0: entered allmulticast mode [ 1850.377255][T26886] input: syz0 as /devices/virtual/input/input275 [ 1851.251402][T26890] syz.7.5488 (26890): drop_caches: 2 [ 1851.358027][ T5920] usb 7-1: new high-speed USB device number 106 using dummy_hcd [ 1851.513421][ T5920] usb 7-1: config 0 has an invalid interface number: 1 but max is 0 [ 1851.521704][ T5920] usb 7-1: config 0 has no interface number 0 [ 1851.557469][ T5920] usb 7-1: New USB device found, idVendor=18b4, idProduct=fffb, bcdDevice=dc.7b [ 1851.582468][T26897] FAULT_INJECTION: forcing a failure. [ 1851.582468][T26897] name failslab, interval 1, probability 0, space 0, times 0 [ 1851.597378][T26897] CPU: 0 UID: 0 PID: 26897 Comm: syz.7.5490 Not tainted syzkaller #0 PREEMPT(full) [ 1851.597408][T26897] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1851.597421][T26897] Call Trace: [ 1851.597429][T26897] [ 1851.597438][T26897] dump_stack_lvl+0x189/0x250 [ 1851.597471][T26897] ? __pfx____ratelimit+0x10/0x10 [ 1851.597495][T26897] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1851.597522][T26897] ? __pfx__printk+0x10/0x10 [ 1851.597546][T26897] ? __pfx___might_resched+0x10/0x10 [ 1851.597568][T26897] ? fs_reclaim_acquire+0x7d/0x100 [ 1851.597604][T26897] should_fail_ex+0x414/0x560 [ 1851.597640][T26897] should_failslab+0xa8/0x100 [ 1851.597663][T26897] kmem_cache_alloc_noprof+0x74/0x6e0 [ 1851.597691][T26897] ? __kernfs_new_node+0xd7/0x7e0 [ 1851.597723][T26897] __kernfs_new_node+0xd7/0x7e0 [ 1851.597748][T26897] ? __lock_acquire+0xab9/0xd20 [ 1851.597775][T26897] ? __pfx___kernfs_new_node+0x10/0x10 [ 1851.597803][T26897] ? kernfs_root+0x1c/0x230 [ 1851.597834][T26897] ? kernfs_root+0x1c/0x230 [ 1851.597861][T26897] ? kernfs_root+0x1c/0x230 [ 1851.597884][T26897] ? kernfs_root+0x1c/0x230 [ 1851.597915][T26897] kernfs_new_node+0x102/0x210 [ 1851.597950][T26897] __kernfs_create_file+0x4b/0x2e0 [ 1851.597974][T26897] sysfs_add_file_mode_ns+0x238/0x300 [ 1851.598005][T26897] internal_create_group+0x66d/0x1110 [ 1851.598047][T26897] ? __pfx_internal_create_group+0x10/0x10 [ 1851.598085][T26897] sysfs_create_groups+0x59/0x120 [ 1851.598114][T26897] device_add_attrs+0xe0/0x5a0 [ 1851.598144][T26897] ? __pfx_device_add_attrs+0x10/0x10 [ 1851.598165][T26897] ? kobject_put+0x43f/0x480 [ 1851.598199][T26897] ? device_add_class_symlinks+0x21f/0x240 [ 1851.598226][T26897] device_add+0x496/0xb50 [ 1851.598254][T26897] device_create+0x25b/0x2f0 [ 1851.598283][T26897] ? format_decode+0x5ee/0xe30 [ 1851.598307][T26897] ? string+0x279/0x2b0 [ 1851.598325][T26897] ? widen_string+0x3b/0x2a0 [ 1851.598346][T26897] ? __pfx_device_create+0x10/0x10 [ 1851.598385][T26897] bdi_register_va+0x9c/0x740 [ 1851.598416][T26897] super_setup_bdi_name+0xe6/0x200 [ 1851.598446][T26897] ? fuse_dev_install+0x8d/0x1a0 [ 1851.598476][T26897] ? __pfx_super_setup_bdi_name+0x10/0x10 [ 1851.598515][T26897] ? do_raw_spin_unlock+0x122/0x240 [ 1851.598549][T26897] fuse_fill_super_common+0x754/0x1330 [ 1851.598585][T26897] ? __pfx_fuse_fill_super_common+0x10/0x10 [ 1851.598614][T26897] ? __init_swait_queue_head+0xa9/0x150 [ 1851.598646][T26897] ? shrinker_register+0x16b/0x230 [ 1851.598674][T26897] ? sget_fc+0x962/0xa40 [ 1851.598702][T26897] fuse_fill_super+0x176/0x1f0 [ 1851.598729][T26897] ? __pfx_fuse_fill_super+0x10/0x10 [ 1851.598758][T26897] get_tree_nodev+0xbb/0x150 [ 1851.598790][T26897] fuse_get_tree+0x2fb/0x4f0 [ 1851.598824][T26897] vfs_get_tree+0x92/0x2b0 [ 1851.598858][T26897] do_new_mount+0x302/0xa10 [ 1851.598889][T26897] ? apparmor_capable+0x137/0x1b0 [ 1851.598917][T26897] ? __pfx_do_new_mount+0x10/0x10 [ 1851.598949][T26897] ? ns_capable+0x8a/0xf0 [ 1851.598974][T26897] ? path_mount+0x61c/0xfe0 [ 1851.599003][T26897] ? kmem_cache_free+0x19b/0x690 [ 1851.599046][T26897] __se_sys_mount+0x313/0x410 [ 1851.599069][T26897] ? __pfx___se_sys_mount+0x10/0x10 [ 1851.599087][T26897] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1851.599109][T26897] ? lockdep_hardirqs_on+0x9c/0x150 [ 1851.599127][T26897] ? __ia32_sys_mount+0x20/0xc0 [ 1851.599142][T26897] __do_fast_syscall_32+0xb6/0x2b0 [ 1851.599164][T26897] ? lockdep_hardirqs_on+0x9c/0x150 [ 1851.599186][T26897] do_fast_syscall_32+0x34/0x80 [ 1851.599207][T26897] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1851.599226][T26897] RIP: 0023:0xf707d539 [ 1851.599240][T26897] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1851.599253][T26897] RSP: 002b:00000000f546d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000015 [ 1851.599270][T26897] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 0000000080002080 [ 1851.599280][T26897] RDX: 0000000080000040 RSI: 0000000000010000 RDI: 00000000800005c0 [ 1851.599290][T26897] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1851.599306][T26897] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1851.599315][T26897] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1851.599337][T26897] [ 1852.042332][ T5920] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1852.227349][ T5920] usb 7-1: Product: syz [ 1852.231872][ T5920] usb 7-1: Manufacturer: syz [ 1852.236519][ T5920] usb 7-1: SerialNumber: syz [ 1852.251122][ T5920] usb 7-1: config 0 descriptor?? [ 1852.269368][T11894] usb 9-1: USB disconnect, device number 109 [ 1852.473916][T26903] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5492'. [ 1852.483441][T26903] tc_dump_action: action bad kind [ 1852.635718][ T5920] usb 7-1: dvb_usb_v2: found a 'E3C EC168 reference design' in warm state [ 1852.664212][ T5920] usb 7-1: dvb_usb_v2: will pass the complete MPEG2 transport stream to the software demuxer [ 1852.693734][T26908] netlink: 'syz.7.5494': attribute type 21 has an invalid length. [ 1852.708272][T26908] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5494'. [ 1852.738470][ T5920] dvbdev: DVB: registering new adapter (E3C EC168 reference design) [ 1852.747041][ T5920] usb 7-1: media controller created [ 1852.879507][T26911] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5495'. [ 1852.965017][ T5920] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 1853.119854][T26920] netlink: 56 bytes leftover after parsing attributes in process `syz.7.5497'. [ 1853.136821][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1853.143356][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1853.892821][T26931] syz_tun: entered allmulticast mode [ 1853.911093][T26931] FAULT_INJECTION: forcing a failure. [ 1853.911093][T26931] name failslab, interval 1, probability 0, space 0, times 0 [ 1853.930050][T26931] CPU: 1 UID: 0 PID: 26931 Comm: syz.8.5501 Not tainted syzkaller #0 PREEMPT(full) [ 1853.930090][T26931] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1853.930104][T26931] Call Trace: [ 1853.930114][T26931] [ 1853.930124][T26931] dump_stack_lvl+0x189/0x250 [ 1853.930160][T26931] ? __pfx____ratelimit+0x10/0x10 [ 1853.930187][T26931] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1853.930219][T26931] ? __pfx__printk+0x10/0x10 [ 1853.930249][T26931] ? __lock_acquire+0xab9/0xd20 [ 1853.930278][T26931] should_fail_ex+0x414/0x560 [ 1853.930318][T26931] should_failslab+0xa8/0x100 [ 1853.930343][T26931] kmem_cache_alloc_noprof+0x74/0x6e0 [ 1853.930375][T26931] ? skb_clone+0x212/0x3a0 [ 1853.930404][T26931] skb_clone+0x212/0x3a0 [ 1853.930432][T26931] __netlink_deliver_tap+0x404/0x850 [ 1853.930481][T26931] ? netlink_deliver_tap+0x2e/0x1b0 [ 1853.930516][T26931] netlink_deliver_tap+0x19c/0x1b0 [ 1853.930552][T26931] netlink_unicast+0x7fa/0x9e0 [ 1853.930593][T26931] ? __pfx_netlink_unicast+0x10/0x10 [ 1853.930626][T26931] ? netlink_sendmsg+0x642/0xb30 [ 1853.930645][T26931] ? skb_put+0x11b/0x210 [ 1853.930669][T26931] netlink_sendmsg+0x805/0xb30 [ 1853.930700][T26931] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1853.930738][T26931] ? __import_iovec+0x5d4/0x7f0 [ 1853.930764][T26931] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1853.930800][T26931] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1853.930822][T26931] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1853.930858][T26931] __sock_sendmsg+0x21c/0x270 [ 1853.930890][T26931] ____sys_sendmsg+0x505/0x830 [ 1853.930921][T26931] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1853.930962][T26931] ___sys_sendmsg+0x21f/0x2a0 [ 1853.930989][T26931] ? __pfx____sys_sendmsg+0x10/0x10 [ 1853.931052][T26931] ? __fget_files+0x2a/0x420 [ 1853.931082][T26931] ? __fget_files+0x3a0/0x420 [ 1853.931115][T26931] __sys_sendmsg+0x164/0x220 [ 1853.931142][T26931] ? __pfx___sys_sendmsg+0x10/0x10 [ 1853.931175][T26931] ? __pfx_ksys_write+0x10/0x10 [ 1853.931211][T26931] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1853.931244][T26931] ? lockdep_hardirqs_on+0x9c/0x150 [ 1853.931277][T26931] __do_fast_syscall_32+0xb6/0x2b0 [ 1853.931309][T26931] ? lockdep_hardirqs_on+0x9c/0x150 [ 1853.931342][T26931] do_fast_syscall_32+0x34/0x80 [ 1853.931373][T26931] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1853.931401][T26931] RIP: 0023:0xf7fa2539 [ 1853.931421][T26931] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1853.931441][T26931] RSP: 002b:00000000f549655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1853.931465][T26931] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 00000000800000c0 [ 1853.931480][T26931] RDX: 000000000000c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1853.931493][T26931] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1853.931506][T26931] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1853.931519][T26931] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1853.931553][T26931] [ 1853.931688][T26931] netlink: zone id is out of range [ 1854.253061][T26931] netlink: get zone limit has 4 unknown bytes [ 1854.261005][T26930] syz_tun: left allmulticast mode [ 1854.268396][ T5920] i2c i2c-1: ec100: i2c rd failed=-71 reg=33 [ 1854.333096][ T5920] usb 7-1: USB disconnect, device number 106 [ 1854.496567][T26939] geneve2: entered allmulticast mode [ 1854.895957][T26946] input: syz0 as /devices/virtual/input/input276 [ 1855.697826][T26953] netlink: 'syz.8.5506': attribute type 4 has an invalid length. [ 1855.793388][T26955] Invalid logical block size (117440512) [ 1856.032696][T26962] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5509'. [ 1856.046106][T26960] netlink: zone id is out of range [ 1856.051355][T26960] netlink: zone id is out of range [ 1856.057079][T26960] netlink: zone id is out of range [ 1856.062301][T26960] netlink: zone id is out of range [ 1856.067494][T26960] netlink: zone id is out of range [ 1856.078103][T26960] netlink: zone id is out of range [ 1856.120529][T26960] netlink: get zone limit has 4 unknown bytes [ 1857.338021][T11894] usb 6-1: new high-speed USB device number 115 using dummy_hcd [ 1857.766909][T11894] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1857.779975][T11894] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.99 [ 1857.789287][T11894] usb 6-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 1857.797384][T11894] usb 6-1: Product: syz [ 1857.883957][T11894] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1857.998461][T11894] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1858.148485][T14856] udevd[14856]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1858.678075][ T5920] usb 9-1: new high-speed USB device number 110 using dummy_hcd [ 1859.013470][ T5920] usb 9-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1859.027282][ T5920] usb 9-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.99 [ 1859.036788][ T5920] usb 9-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 1859.099428][ T5920] usb 9-1: Product: syz [ 1859.129496][ T5920] usb 9-1: Quirk or no altset; falling back to MIDI 1.0 [ 1859.529801][ T5920] snd-usb-audio 9-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1859.711117][ T5913] usb 6-1: USB disconnect, device number 115 [ 1859.914684][T14856] udevd[14856]: error opening ATTR{/sys/devices/platform/dummy_hcd.8/usb9/9-1/9-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1860.032869][T27002] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5520'. [ 1860.522230][T27013] netlink: 'syz.6.5522': attribute type 6 has an invalid length. [ 1861.088286][T27025] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5525'. [ 1861.306746][ T5920] usb 9-1: USB disconnect, device number 110 [ 1862.513473][T27045] input: syz1 as /devices/virtual/input/input277 [ 1862.733670][T27050] netlink: 'syz.8.5531': attribute type 2 has an invalid length. [ 1863.932319][T27060] syzkaller0: entered promiscuous mode [ 1863.988032][T27060] syzkaller0: entered allmulticast mode [ 1864.478919][T27071] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5537'. [ 1864.636752][T27076] sch_tbf: peakrate 64 is lower than or equals to rate 17038211371681383082 ! [ 1864.860885][T27078] vhci_hcd vhci_hcd.0: pdev(6) rhport(0) sockfd(10) [ 1864.867565][T27078] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1864.898618][T27078] vhci_hcd vhci_hcd.0: Device attached [ 1864.916763][T27081] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1864.961433][T27078] vhci_hcd vhci_hcd.0: pdev(6) rhport(2) sockfd(12) [ 1864.968105][T27078] vhci_hcd vhci_hcd.0: devid(0) speed(4) speed_str(wireless) [ 1864.989326][T27078] vhci_hcd vhci_hcd.0: Device attached [ 1865.004661][T27078] vhci_hcd vhci_hcd.0: pdev(6) rhport(3) sockfd(16) [ 1865.011328][T27078] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1865.029884][T27078] vhci_hcd vhci_hcd.0: Device attached [ 1865.049749][T27078] vhci_hcd vhci_hcd.0: pdev(6) rhport(4) sockfd(18) [ 1865.056502][T27078] vhci_hcd vhci_hcd.0: devid(0) speed(2) speed_str(full-speed) [ 1865.068065][T27078] vhci_hcd vhci_hcd.0: Device attached [ 1865.075518][T27078] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1865.088008][ T5913] vhci_hcd: vhci_device speed not set [ 1865.090339][T27078] vhci_hcd: Failed attach request for unsupported USB speed: UNKNOWN [ 1865.124079][T27087] vhci_hcd: connection closed [ 1865.124627][T12735] vhci_hcd: stop threads [ 1865.134241][T27084] vhci_hcd: connection closed [ 1865.136016][T27082] vhci_hcd: connection closed [ 1865.141799][T27079] vhci_hcd: connection closed [ 1865.146758][T12735] vhci_hcd: release socket [ 1865.158847][ T5913] usb 45-1: new full-speed USB device number 3 using vhci_hcd [ 1865.158980][T12735] vhci_hcd: disconnect device [ 1865.173631][T27080] vhci_hcd: sendmsg failed!, ret=-32 for 48 [ 1865.192969][T12735] vhci_hcd: stop threads [ 1865.201838][T12735] vhci_hcd: release socket [ 1865.212152][T12735] vhci_hcd: disconnect device [ 1865.222801][T12735] vhci_hcd: stop threads [ 1865.237220][T12735] vhci_hcd: release socket [ 1865.241955][T12735] vhci_hcd: disconnect device [ 1865.246802][T12735] vhci_hcd: stop threads [ 1865.252822][T12735] vhci_hcd: release socket [ 1865.257441][T12735] vhci_hcd: disconnect device [ 1866.586820][T27104] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5542'. [ 1868.678419][ T5920] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 1868.798435][T27143] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5552'. [ 1869.042729][ T5920] usb 7-1: New USB device found, idVendor=13d8, idProduct=0011, bcdDevice=d0.62 [ 1869.053124][ T5920] usb 7-1: New USB device strings: Mfr=1, Product=6, SerialNumber=3 [ 1869.065067][ T5920] usb 7-1: Product: syz [ 1869.090127][ T5920] usb 7-1: Manufacturer: syz [ 1869.095109][ T5920] usb 7-1: SerialNumber: syz [ 1869.109350][ T5920] usb 7-1: config 0 descriptor?? [ 1869.283394][ T5920] usb 7-1: selecting invalid altsetting 1 [ 1869.301414][ T5920] comedi comedi5: could not switch to alternate setting 1 [ 1869.311046][ T5920] usbduxfast 7-1:0.0: driver 'usbduxfast' failed to auto-configure device. [ 1869.317978][T11894] usb 6-1: new high-speed USB device number 116 using dummy_hcd [ 1869.361117][ T5920] usb 7-1: USB disconnect, device number 107 [ 1869.933110][T27155] geneve2: entered allmulticast mode [ 1869.948480][T21149] netdevsim netdevsim8 : set [1, 1] type 2 family 0 port 20001 - 0 [ 1869.964438][ T12] netdevsim netdevsim8 netdevsim1: set [1, 1] type 2 family 0 port 20001 - 0 [ 1869.978165][ T12] netdevsim netdevsim8 netdevsim2: set [1, 1] type 2 family 0 port 20001 - 0 [ 1869.997584][ T12] netdevsim netdevsim8 netdevsim3: set [1, 1] type 2 family 0 port 20001 - 0 [ 1870.076853][T11894] usb 6-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1870.092430][T11894] usb 6-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.99 [ 1870.102019][T11894] usb 6-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 1870.202680][T11894] usb 6-1: Product: syz [ 1870.305369][T11894] usb 6-1: Quirk or no altset; falling back to MIDI 1.0 [ 1870.318188][ T5913] vhci_hcd: vhci_device speed not set [ 1871.065614][T11894] snd-usb-audio 6-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1871.221179][T14856] udevd[14856]: error opening ATTR{/sys/devices/platform/dummy_hcd.5/usb6/6-1/6-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1871.870018][ T5913] usb 6-1: USB disconnect, device number 116 [ 1872.139207][T27165] FAULT_INJECTION: forcing a failure. [ 1872.139207][T27165] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1872.248035][T27165] CPU: 1 UID: 0 PID: 27165 Comm: syz.8.5558 Not tainted syzkaller #0 PREEMPT(full) [ 1872.248066][T27165] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1872.248079][T27165] Call Trace: [ 1872.248088][T27165] [ 1872.248097][T27165] dump_stack_lvl+0x189/0x250 [ 1872.248131][T27165] ? __pfx____ratelimit+0x10/0x10 [ 1872.248156][T27165] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1872.248184][T27165] ? __pfx__printk+0x10/0x10 [ 1872.248206][T27165] ? __might_fault+0xb0/0x130 [ 1872.248246][T27165] should_fail_ex+0x414/0x560 [ 1872.248291][T27165] copy_fpstate_to_sigframe+0xa18/0xce0 [ 1872.248323][T27165] ? ktime_get+0x45/0x200 [ 1872.248353][T27165] ? copy_fpstate_to_sigframe+0x181/0xce0 [ 1872.248390][T27165] ? __pfx_copy_fpstate_to_sigframe+0x10/0x10 [ 1872.248426][T27165] ? read_tsc+0x9/0x20 [ 1872.248455][T27165] ? ktime_get+0x1d2/0x200 [ 1872.248499][T27165] ? fpu__alloc_mathframe+0xad/0x130 [ 1872.248534][T27165] get_sigframe+0x58d/0x7d0 [ 1872.248572][T27165] ? __pfx_get_sigframe+0x10/0x10 [ 1872.248602][T27165] ? irqentry_exit+0x74/0x90 [ 1872.248640][T27165] ia32_setup_rt_frame+0x106/0xb70 [ 1872.248667][T27165] ? _raw_spin_unlock_irq+0x29/0x50 [ 1872.248693][T27165] ? _raw_spin_unlock_irq+0x2e/0x50 [ 1872.248715][T27165] ? get_signal+0x1150/0x1340 [ 1872.248745][T27165] ? __pfx_ia32_setup_rt_frame+0x10/0x10 [ 1872.248772][T27165] ? arch_do_signal_or_restart+0x385/0x790 [ 1872.248809][T27165] arch_do_signal_or_restart+0x429/0x790 [ 1872.248844][T27165] ? __pfx_arch_do_signal_or_restart+0x10/0x10 [ 1872.248897][T27165] ? exit_to_user_mode_loop+0x40/0x130 [ 1872.248920][T27165] exit_to_user_mode_loop+0x72/0x130 [ 1872.248941][T27165] __do_fast_syscall_32+0x1f4/0x2b0 [ 1872.248971][T27165] ? asm_int80_emulation+0x1a/0x20 [ 1872.248991][T27165] ? do_int80_emulation+0x1f3/0x390 [ 1872.249024][T27165] do_fast_syscall_32+0x34/0x80 [ 1872.249053][T27165] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1872.249078][T27165] RIP: 0023:0xf7fa2539 [ 1872.249097][T27165] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1872.249116][T27165] RSP: 002b:00000000f5496590 EFLAGS: 00000206 ORIG_RAX: 0000000000000004 [ 1872.249138][T27165] RAX: 0000000000000001 RBX: 0000000000000005 RCX: 00000000f5496610 [ 1872.249151][T27165] RDX: 0000000000000001 RSI: 00000000f7435ff4 RDI: 0000000000000000 [ 1872.249164][T27165] RBP: 00000000f7464f80 R08: 0000000000000000 R09: 0000000000000000 [ 1872.249178][T27165] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1872.249190][T27165] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1872.249222][T27165] [ 1872.665448][T27172] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5560'. [ 1873.465883][T27184] netlink: 'syz.9.5565': attribute type 1 has an invalid length. [ 1873.820357][T27184] bond2: entered promiscuous mode [ 1873.846348][T27184] 8021q: adding VLAN 0 to HW filter on device bond2 [ 1873.897003][T27184] netlink: 'syz.9.5565': attribute type 1 has an invalid length. [ 1875.928075][ T5913] usb 10-1: new high-speed USB device number 104 using dummy_hcd [ 1876.243911][ T5913] usb 10-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1876.258624][ T5913] usb 10-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.99 [ 1876.268378][ T5913] usb 10-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 1876.278698][ T5913] usb 10-1: Product: syz [ 1876.585024][ T5913] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 1876.892734][T27225] binder: 27222:27225 ioctl c0306201 800001c0 returned -22 [ 1877.554197][ T5913] snd-usb-audio 10-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1877.637801][T14856] udevd[14856]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1878.334519][T27247] netlink: 40 bytes leftover after parsing attributes in process `syz.8.5578'. [ 1878.403163][T27243] bond3: option fail_over_mac: invalid value (10) [ 1878.423936][T27243] bond3 (unregistering): Released all slaves [ 1878.598514][T27249] netlink: 4 bytes leftover after parsing attributes in process `syz.6.5577'. [ 1878.924653][T27255] netdevsim netdevsim7 netdevsim0: entered promiscuous mode [ 1878.932242][T27255] macvlan2: entered promiscuous mode [ 1879.037957][T12103] usb 6-1: new full-speed USB device number 117 using dummy_hcd [ 1879.212070][T12103] usb 6-1: New USB device found, idVendor=0ccd, idProduct=00b3, bcdDevice=2d.ea [ 1879.221394][T12103] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1879.272430][T12103] usb 6-1: Product: syz [ 1879.310299][T12103] usb 6-1: Manufacturer: syz [ 1879.335370][T12103] usb 6-1: SerialNumber: syz [ 1879.498690][T11894] usb 10-1: USB disconnect, device number 104 [ 1879.541297][T12103] usb 6-1: config 0 descriptor?? [ 1879.679998][T17905] Bluetooth: hci1: ACL packet for unknown connection handle 201 [ 1879.780477][T12103] usb 6-1: dvb_usb_v2: found a 'TerraTec NOXON DAB Stick' in warm state [ 1880.708304][ T5920] usb 10-1: new high-speed USB device number 105 using dummy_hcd [ 1880.864356][ T5920] usb 10-1: Using ep0 maxpacket: 16 [ 1880.880904][ T5920] usb 10-1: too many endpoints for config 0 interface 0 altsetting 109: 65, using maximum allowed: 30 [ 1880.896555][ T5920] usb 10-1: config 0 interface 0 altsetting 109 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 1880.940719][ T5920] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1880.950896][ T5920] usb 10-1: New USB device found, idVendor=056e, idProduct=011c, bcdDevice= 0.00 [ 1880.995365][ T5920] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1881.021206][ T5920] usb 10-1: config 0 descriptor?? [ 1881.227475][T12103] dvb_usb_rtl28xxu 6-1:0.0: probe with driver dvb_usb_rtl28xxu failed with error -71 [ 1881.242623][T12103] usb 6-1: USB disconnect, device number 117 [ 1881.500284][T27282] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5589'. [ 1881.630920][ T5920] usbhid 10-1:0.0: can't add hid device: -71 [ 1881.640186][ T5920] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1881.674911][ T5920] usb 10-1: USB disconnect, device number 105 [ 1881.895195][ T897] usb 7-1: new high-speed USB device number 108 using dummy_hcd [ 1882.357212][ T897] usb 7-1: config 27 has an invalid descriptor of length 0, skipping remainder of the config [ 1882.372564][ T897] usb 7-1: New USB device found, idVendor=0582, idProduct=0014, bcdDevice=bb.99 [ 1882.382780][ T897] usb 7-1: New USB device strings: Mfr=0, Product=32, SerialNumber=0 [ 1882.398231][ T897] usb 7-1: Product: syz [ 1882.425725][ T897] usb 7-1: Quirk or no altset; falling back to MIDI 1.0 [ 1882.454024][ T897] snd-usb-audio 7-1:27.0: probe with driver snd-usb-audio failed with error -2 [ 1882.483061][T14856] udevd[14856]: error opening ATTR{/sys/devices/platform/dummy_hcd.6/usb7/7-1/7-1:27.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1882.518032][ T5920] usb 6-1: new high-speed USB device number 118 using dummy_hcd [ 1882.678161][ T5920] usb 6-1: Using ep0 maxpacket: 16 [ 1882.755483][ T5920] usb 6-1: too many endpoints for config 0 interface 0 altsetting 109: 65, using maximum allowed: 30 [ 1882.780884][ T5920] usb 6-1: config 0 interface 0 altsetting 109 has 1 endpoint descriptor, different from the interface descriptor's value: 65 [ 1882.876561][ T5920] usb 6-1: config 0 interface 0 has no altsetting 0 [ 1882.886361][ T5920] usb 6-1: New USB device found, idVendor=056e, idProduct=011c, bcdDevice= 0.00 [ 1882.895893][ T5920] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1882.947223][ T5920] usb 6-1: config 0 descriptor?? [ 1883.238759][T27289] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1883.248278][T27289] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1883.502095][ T5920] usbhid 6-1:0.0: can't add hid device: -71 [ 1883.509252][ T5920] usbhid 6-1:0.0: probe with driver usbhid failed with error -71 [ 1883.531610][ T5920] usb 6-1: USB disconnect, device number 118 [ 1884.194829][T27309] netlink: 'syz.5.5600': attribute type 1 has an invalid length. [ 1884.228022][ T897] usb 10-1: new high-speed USB device number 106 using dummy_hcd [ 1884.384254][T11894] usb 7-1: USB disconnect, device number 108 [ 1884.394208][ T897] usb 10-1: New USB device found, idVendor=172f, idProduct=0032, bcdDevice= 0.00 [ 1884.429034][ T897] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1884.453909][ T897] usb 10-1: config 0 descriptor?? [ 1884.500071][T27316] kvm: user requested TSC rate below hardware speed [ 1884.541484][T27322] syzkaller0: entered promiscuous mode [ 1884.547084][T27322] syzkaller0: entered allmulticast mode [ 1884.755314][T27325] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1884.761660][T27328] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5604'. [ 1884.894846][ T897] usbhid 10-1:0.0: can't add hid device: -71 [ 1884.910691][ T897] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1884.926123][ T897] usb 10-1: USB disconnect, device number 106 [ 1885.276423][T27344] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5608'. [ 1885.571920][T11894] usb 6-1: new high-speed USB device number 119 using dummy_hcd [ 1885.739870][T11894] usb 6-1: New USB device found, idVendor=17e9, idProduct=8b4e, bcdDevice=9c.08 [ 1885.751640][T11894] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1885.827667][T11894] usb 6-1: config 0 descriptor?? [ 1886.115901][T11894] udl 6-1:0.0: [drm] Unrecognized vendor firmware descriptor [ 1886.306418][T11894] [drm:udl_init] *ERROR* Selecting channel failed [ 1886.399431][T11894] [drm] Initialized udl 0.0.1 for 6-1:0.0 on minor 2 [ 1886.406193][T11894] [drm] Initialized udl on minor 2 [ 1886.420340][T27353] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5614'. [ 1886.470194][T11894] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1886.498837][T11894] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 1886.506404][T23617] udl 6-1:0.0: [drm] *ERROR* Read EDID byte 0 failed err ffffffb9 [ 1886.517820][T23617] udl 6-1:0.0: [drm] Cannot find any crtc or sizes [ 1886.544744][T11894] usb 6-1: USB disconnect, device number 119 [ 1887.139561][ T30] audit: type=1326 audit(1761331701.044:1737): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=27371 comm="syz.8.5620" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa2539 code=0x0 [ 1887.480419][T27383] input: syz0 as /devices/virtual/input/input278 [ 1889.330340][T27401] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5629'. [ 1889.350686][T27401] netlink: 8 bytes leftover after parsing attributes in process `syz.7.5629'. [ 1889.407690][T27405] netlink: zone id is out of range [ 1889.412999][T27405] netlink: zone id is out of range [ 1889.418742][T27405] netlink: zone id is out of range [ 1889.423955][T27405] netlink: zone id is out of range [ 1889.435778][T27405] netlink: zone id is out of range [ 1889.492765][T27405] netlink: zone id is out of range [ 1889.547119][T27405] netlink: zone id is out of range [ 1889.572388][T27405] netlink: zone id is out of range [ 1889.588076][T27405] netlink: zone id is out of range [ 1890.319598][T27425] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5637'. [ 1890.383036][T27427] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5637'. [ 1890.997975][T12103] usb 7-1: new high-speed USB device number 109 using dummy_hcd [ 1891.108302][T23617] usb 6-1: new high-speed USB device number 120 using dummy_hcd [ 1891.162788][T12103] usb 7-1: Using ep0 maxpacket: 8 [ 1891.203728][T27448] input: syz0 as /devices/virtual/input/input279 [ 1891.307950][T23617] usb 6-1: device descriptor read/64, error -71 [ 1891.339312][T12103] usb 7-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1891.358428][T12103] usb 7-1: config 0 interface 0 has no altsetting 0 [ 1891.392222][T12103] usb 7-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=bc.76 [ 1891.413707][T12103] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1891.432189][T12103] usb 7-1: Product: syz [ 1891.452150][T12103] usb 7-1: Manufacturer: syz [ 1891.467075][T12103] usb 7-1: SerialNumber: syz [ 1891.490343][T12103] usb 7-1: config 0 descriptor?? [ 1891.513707][T12103] snd_usb_toneport 7-1:0.0: Line 6 TonePort UX2 found [ 1891.598078][T23617] usb 6-1: new high-speed USB device number 121 using dummy_hcd [ 1891.717286][T12103] snd_usb_toneport 7-1:0.0: cannot get proper max packet size [ 1891.725416][T12103] snd_usb_toneport 7-1:0.0: Line 6 TonePort UX2 now disconnected [ 1891.734254][T23617] usb 6-1: device descriptor read/64, error -71 [ 1891.775407][T12103] snd_usb_toneport 7-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 1891.901625][T23617] usb usb6-port1: attempt power cycle [ 1892.337998][T23617] usb 6-1: new high-speed USB device number 122 using dummy_hcd [ 1892.433646][T23617] usb 6-1: device descriptor read/8, error -71 [ 1892.580058][T27439] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1892.589688][T27439] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1892.697966][T23617] usb 6-1: new high-speed USB device number 123 using dummy_hcd [ 1892.768809][T23617] usb 6-1: device descriptor read/8, error -71 [ 1892.889147][T23617] usb usb6-port1: unable to enumerate USB device [ 1893.037163][T27455] gtp0: entered promiscuous mode [ 1893.060072][T27455] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5645'. [ 1893.843371][T27492] FAULT_INJECTION: forcing a failure. [ 1893.843371][T27492] name failslab, interval 1, probability 0, space 0, times 0 [ 1893.859092][T27492] CPU: 0 UID: 0 PID: 27492 Comm: syz.7.5657 Not tainted syzkaller #0 PREEMPT(full) [ 1893.859122][T27492] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1893.859136][T27492] Call Trace: [ 1893.859146][T27492] [ 1893.859156][T27492] dump_stack_lvl+0x189/0x250 [ 1893.859192][T27492] ? __pfx____ratelimit+0x10/0x10 [ 1893.859220][T27492] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1893.859250][T27492] ? __pfx__printk+0x10/0x10 [ 1893.859277][T27492] ? __mutex_trylock_common+0x153/0x260 [ 1893.859314][T27492] should_fail_ex+0x414/0x560 [ 1893.859353][T27492] should_failslab+0xa8/0x100 [ 1893.859378][T27492] __kmalloc_cache_noprof+0x6f/0x6f0 [ 1893.859411][T27492] ? __hw_addr_add_ex+0x1f4/0x770 [ 1893.859441][T27492] __hw_addr_add_ex+0x1f4/0x770 [ 1893.859472][T27492] dev_addr_init+0x14f/0x230 [ 1893.859499][T27492] ? __pfx_dev_addr_init+0x10/0x10 [ 1893.859538][T27492] alloc_netdev_mqs+0x2b1/0x11b0 [ 1893.859569][T27492] ? __pfx_vxlan_setup+0x10/0x10 [ 1893.859605][T27492] rtnl_create_link+0x31f/0xd10 [ 1893.859644][T27492] rtnl_newlink_create+0x25c/0xb00 [ 1893.859672][T27492] ? __lock_acquire+0xab9/0xd20 [ 1893.859700][T27492] ? __pfx_rtnl_newlink_create+0x10/0x10 [ 1893.859727][T27492] ? __pfx___mutex_lock+0x10/0x10 [ 1893.859769][T27492] ? ns_capable+0x8a/0xf0 [ 1893.859798][T27492] rtnl_newlink+0x16e4/0x1c80 [ 1893.859834][T27492] ? netlink_deliver_tap+0x19c/0x1b0 [ 1893.859869][T27492] ? __pfx_rtnl_newlink+0x10/0x10 [ 1893.859910][T27492] ? kasan_quarantine_put+0xdd/0x220 [ 1893.859932][T27492] ? lockdep_hardirqs_on+0x9c/0x150 [ 1893.859956][T27492] ? nlmon_xmit+0xb0/0x100 [ 1893.859973][T27492] ? kmem_cache_free+0x19b/0x690 [ 1893.860003][T27492] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1893.860019][T27492] ? lockdep_hardirqs_on+0x9c/0x150 [ 1893.860039][T27492] ? __local_bh_enable_ip+0x12d/0x1c0 [ 1893.860055][T27492] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1893.860075][T27492] ? __dev_queue_xmit+0x27b/0x3b50 [ 1893.860095][T27492] ? __dev_queue_xmit+0x27b/0x3b50 [ 1893.860119][T27492] ? __dev_queue_xmit+0x27b/0x3b50 [ 1893.860145][T27492] ? __dev_queue_xmit+0x1d79/0x3b50 [ 1893.860169][T27492] ? kasan_save_track+0x3e/0x80 [ 1893.860200][T27492] ? __kasan_slab_alloc+0x6c/0x80 [ 1893.860238][T27492] ? __lock_acquire+0xab9/0xd20 [ 1893.860287][T27492] ? __pfx_rtnl_newlink+0x10/0x10 [ 1893.860318][T27492] rtnetlink_rcv_msg+0x7cf/0xb70 [ 1893.860354][T27492] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1893.860384][T27492] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1893.860413][T27492] ? ref_tracker_free+0x63a/0x7d0 [ 1893.860434][T27492] ? __asan_memcpy+0x40/0x70 [ 1893.860462][T27492] ? __pfx_ref_tracker_free+0x10/0x10 [ 1893.860482][T27492] ? __skb_clone+0x63/0x7a0 [ 1893.860515][T27492] netlink_rcv_skb+0x208/0x470 [ 1893.860549][T27492] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1893.860590][T27492] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1893.860637][T27492] ? netlink_deliver_tap+0x2e/0x1b0 [ 1893.860679][T27492] netlink_unicast+0x82f/0x9e0 [ 1893.860719][T27492] ? __pfx_netlink_unicast+0x10/0x10 [ 1893.860752][T27492] ? netlink_sendmsg+0x642/0xb30 [ 1893.860770][T27492] ? skb_put+0x11b/0x210 [ 1893.860794][T27492] netlink_sendmsg+0x805/0xb30 [ 1893.860826][T27492] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1893.860864][T27492] ? __import_iovec+0x5d4/0x7f0 [ 1893.860889][T27492] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1893.860923][T27492] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1893.860945][T27492] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1893.860981][T27492] __sock_sendmsg+0x21c/0x270 [ 1893.861013][T27492] ____sys_sendmsg+0x505/0x830 [ 1893.861042][T27492] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1893.861085][T27492] ___sys_sendmsg+0x21f/0x2a0 [ 1893.861110][T27492] ? __pfx____sys_sendmsg+0x10/0x10 [ 1893.861175][T27492] ? __fget_files+0x2a/0x420 [ 1893.861196][T27492] ? __fget_files+0x3a0/0x420 [ 1893.861228][T27492] __sys_sendmsg+0x164/0x220 [ 1893.861255][T27492] ? __pfx___sys_sendmsg+0x10/0x10 [ 1893.861288][T27492] ? __pfx_ksys_write+0x10/0x10 [ 1893.861325][T27492] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1893.861357][T27492] ? lockdep_hardirqs_on+0x9c/0x150 [ 1893.861390][T27492] __do_fast_syscall_32+0xb6/0x2b0 [ 1893.861419][T27492] ? lockdep_hardirqs_on+0x9c/0x150 [ 1893.861442][T27492] do_fast_syscall_32+0x34/0x80 [ 1893.861464][T27492] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1893.861483][T27492] RIP: 0023:0xf707d539 [ 1893.861497][T27492] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1893.861511][T27492] RSP: 002b:00000000f546d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1893.861527][T27492] RAX: ffffffffffffffda RBX: 000000000000000f RCX: 00000000800000c0 [ 1893.861538][T27492] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1893.861548][T27492] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1893.861562][T27492] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1893.861571][T27492] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1893.861594][T27492] [ 1894.070239][ T897] usb 7-1: USB disconnect, device number 109 [ 1894.779090][T27504] netlink: 52 bytes leftover after parsing attributes in process `syz.5.5660'. [ 1894.900978][T27507] input: syz0 as /devices/virtual/input/input280 [ 1895.089109][T27498] bond2: option coupled_control: mode dependency failed, not supported in mode balance-rr(0) [ 1895.269111][T27498] bond2 (unregistering): Released all slaves [ 1895.917379][T27523] netlink: 12 bytes leftover after parsing attributes in process `syz.5.5666'. [ 1896.141778][T27529] vxcan3: entered allmulticast mode [ 1896.395176][T27544] syz_tun: entered allmulticast mode [ 1896.463745][T27543] syz_tun: left allmulticast mode [ 1897.068007][T23617] usb 10-1: new high-speed USB device number 107 using dummy_hcd [ 1897.149436][ T897] usb 7-1: new high-speed USB device number 110 using dummy_hcd [ 1897.292651][T23617] usb 10-1: Using ep0 maxpacket: 16 [ 1897.308221][ T897] usb 7-1: Using ep0 maxpacket: 16 [ 1897.320762][ T897] usb 7-1: config 0 has an invalid interface number: 64 but max is 0 [ 1897.329174][ T897] usb 7-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1897.330939][T23617] usb 10-1: config 0 has an invalid interface number: 63 but max is 0 [ 1897.350349][ T897] usb 7-1: config 0 has no interface number 0 [ 1897.356517][ T897] usb 7-1: New USB device found, idVendor=0bd3, idProduct=05f4, bcdDevice= 0.5b [ 1897.401372][ T897] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1897.417904][T23617] usb 10-1: config 0 has no interface number 0 [ 1897.444285][ T897] usb 7-1: config 0 descriptor?? [ 1897.489176][T23617] usb 10-1: New USB device found, idVendor=0458, idProduct=7005, bcdDevice=22.a7 [ 1897.508105][T23617] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1897.509408][ T897] uvcvideo 7-1:0.64: Found UVC 0.00 device (0bd3:05f4) [ 1897.536099][T23617] usb 10-1: Product: syz [ 1897.544829][T23617] usb 10-1: Manufacturer: syz [ 1897.555042][T23617] usb 10-1: SerialNumber: syz [ 1897.561709][ T897] uvcvideo 7-1:0.64: No valid video chain found. [ 1897.578639][T23617] usb 10-1: config 0 descriptor?? [ 1897.747045][ T897] usb 7-1: USB disconnect, device number 110 [ 1898.287454][T27566] FAULT_INJECTION: forcing a failure. [ 1898.287454][T27566] name failslab, interval 1, probability 0, space 0, times 0 [ 1898.331135][ T5920] usb 9-1: new full-speed USB device number 111 using dummy_hcd [ 1898.342548][T27566] CPU: 1 UID: 0 PID: 27566 Comm: syz.7.5678 Not tainted syzkaller #0 PREEMPT(full) [ 1898.342579][T27566] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1898.342593][T27566] Call Trace: [ 1898.342602][T27566] [ 1898.342612][T27566] dump_stack_lvl+0x189/0x250 [ 1898.342642][T27566] ? __pfx____ratelimit+0x10/0x10 [ 1898.342668][T27566] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1898.342698][T27566] ? __pfx__printk+0x10/0x10 [ 1898.342728][T27566] ? __pfx___might_resched+0x10/0x10 [ 1898.342757][T27566] should_fail_ex+0x414/0x560 [ 1898.342792][T27566] should_failslab+0xa8/0x100 [ 1898.342810][T27566] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1898.342834][T27566] ? __alloc_skb+0x112/0x2d0 [ 1898.342877][T27566] __alloc_skb+0x112/0x2d0 [ 1898.342917][T27566] netlink_ack+0x146/0xa50 [ 1898.342945][T27566] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1898.342966][T27566] ? __asan_memcpy+0x40/0x70 [ 1898.342986][T27566] ? __pfx_ref_tracker_free+0x10/0x10 [ 1898.343018][T27566] netlink_rcv_skb+0x28c/0x470 [ 1898.343050][T27566] ? __lock_acquire+0xab9/0xd20 [ 1898.343071][T27566] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1898.343104][T27566] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1898.343142][T27566] ? down_read+0x1ad/0x2e0 [ 1898.343181][T27566] genl_rcv+0x28/0x40 [ 1898.343204][T27566] netlink_unicast+0x82f/0x9e0 [ 1898.343244][T27566] ? __pfx_netlink_unicast+0x10/0x10 [ 1898.343268][T27566] ? netlink_sendmsg+0x642/0xb30 [ 1898.343281][T27566] ? skb_put+0x11b/0x210 [ 1898.343297][T27566] netlink_sendmsg+0x805/0xb30 [ 1898.343332][T27566] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1898.343369][T27566] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1898.343402][T27566] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1898.343417][T27566] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1898.343442][T27566] __sock_sendmsg+0x21c/0x270 [ 1898.343474][T27566] __sys_sendto+0x3bd/0x520 [ 1898.343511][T27566] ? __pfx___sys_sendto+0x10/0x10 [ 1898.343557][T27566] ? __might_fault+0xb0/0x130 [ 1898.343596][T27566] __ia32_compat_sys_socketcall+0x71c/0x9c0 [ 1898.343619][T27566] ? __fget_files+0x3a0/0x420 [ 1898.343646][T27566] ? __pfx___ia32_compat_sys_socketcall+0x10/0x10 [ 1898.343669][T27566] ? fput+0xa0/0xd0 [ 1898.343693][T27566] ? ksys_write+0x22a/0x250 [ 1898.343722][T27566] ? __pfx_ksys_write+0x10/0x10 [ 1898.343746][T27566] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1898.343774][T27566] ? lockdep_hardirqs_on+0x9c/0x150 [ 1898.343807][T27566] __do_fast_syscall_32+0xb6/0x2b0 [ 1898.343837][T27566] ? lockdep_hardirqs_on+0x9c/0x150 [ 1898.343867][T27566] do_fast_syscall_32+0x34/0x80 [ 1898.343889][T27566] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1898.343908][T27566] RIP: 0023:0xf707d539 [ 1898.343927][T27566] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1898.343948][T27566] RSP: 002b:00000000f546c430 EFLAGS: 00000206 ORIG_RAX: 0000000000000066 [ 1898.343970][T27566] RAX: ffffffffffffffda RBX: 000000000000000b RCX: 00000000f546c444 [ 1898.343985][T27566] RDX: 0000000000000000 RSI: 00000000f546c560 RDI: 00000000f7415ff4 [ 1898.343998][T27566] RBP: 00000000f546c560 R08: 0000000000000000 R09: 0000000000000000 [ 1898.344013][T27566] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1898.344022][T27566] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1898.344046][T27566] [ 1898.818279][ T5920] usb 9-1: device descriptor read/64, error -71 [ 1899.068022][ T5920] usb 9-1: new full-speed USB device number 112 using dummy_hcd [ 1899.316149][T27577] input: syz0 as /devices/virtual/input/input281 [ 1899.347972][ T5920] usb 9-1: device descriptor read/64, error -71 [ 1899.458692][ T5920] usb usb9-port1: attempt power cycle [ 1899.822834][ T5920] usb 9-1: new full-speed USB device number 113 using dummy_hcd [ 1899.830918][ T5913] usb 6-1: new high-speed USB device number 124 using dummy_hcd [ 1899.859052][ T5920] usb 9-1: device descriptor read/8, error -71 [ 1899.949431][T23617] gspca_main: sn9c2028-2.14.0 probing 0458:7005 [ 1899.956417][T23617] gspca_sn9c2028: read1 error -71 [ 1899.967952][T23617] gspca_sn9c2028: read1 error -71 [ 1899.983881][T23617] gspca_sn9c2028: read1 error -71 [ 1899.997971][T23617] sn9c2028 10-1:0.63: probe with driver sn9c2028 failed with error -71 [ 1900.042925][T23617] usb 10-1: USB disconnect, device number 107 [ 1900.168115][ T5920] usb 9-1: new full-speed USB device number 114 using dummy_hcd [ 1900.250869][ T5920] usb 9-1: device descriptor read/8, error -71 [ 1900.272482][ T5913] usb 6-1: New USB device found, idVendor=a168, idProduct=0618, bcdDevice=e3.a4 [ 1900.287622][ T5913] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1900.316908][T27588] cgroup: fork rejected by pids controller in /syz9 [ 1900.848287][ T5920] usb usb9-port1: unable to enumerate USB device [ 1900.919051][ T5913] usb 6-1: Product: syz [ 1900.923276][ T5913] usb 6-1: Manufacturer: syz [ 1900.976568][ T5913] usb 6-1: SerialNumber: syz [ 1901.388879][ T5913] usb 6-1: config 0 descriptor?? [ 1901.424482][ T5913] gspca_main: gspca_sn9c20x-2.14.0 probing a168:0618 [ 1901.564414][T29095] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5685'. [ 1901.821409][T27579] netlink: 'syz.5.5682': attribute type 11 has an invalid length. [ 1901.943443][ T5913] gspca_sn9c20x: Write register 1000 failed -71 [ 1901.968644][ T5913] gspca_sn9c20x: Device initialization failed [ 1901.988491][ T5913] gspca_sn9c20x 6-1:0.0: probe with driver gspca_sn9c20x failed with error -71 [ 1902.028172][ T5913] usb 6-1: USB disconnect, device number 124 [ 1902.422259][ T5920] usb 7-1: new high-speed USB device number 111 using dummy_hcd [ 1902.588009][ T5920] usb 7-1: Using ep0 maxpacket: 16 [ 1902.601531][ T5920] usb 7-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 1902.623836][ T5920] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 1902.658326][ T5920] usb 7-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 1902.667928][ T5920] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1902.682741][ T5920] usb 7-1: Product: syz [ 1902.692073][ T5920] usb 7-1: Manufacturer: syz [ 1902.700330][ T5920] usb 7-1: SerialNumber: syz [ 1902.727797][ T5920] usb 7-1: config 0 descriptor?? [ 1902.761149][ T5920] em28xx 7-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 1902.784114][ T5920] em28xx 7-1:0.0: Audio interface 0 found (Vendor Class) [ 1902.974039][T29201] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1903.041808][T29201] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1903.047568][T29214] net_ratelimit: 1 callbacks suppressed [ 1903.047592][T29214] ip6_tunnel: non-ECT from fe88:0000:0000:0000:0000:0000:0000:0109 with DS=0x92 [ 1903.138110][T23617] usb 6-1: new high-speed USB device number 125 using dummy_hcd [ 1903.242872][T29216] pim6reg1: entered promiscuous mode [ 1903.250682][T29216] pim6reg1: entered allmulticast mode [ 1903.308412][T23617] usb 6-1: device descriptor read/64, error -71 [ 1903.514732][ T5920] em28xx 7-1:0.0: unknown em28xx chip ID (0) [ 1903.533441][ T5920] em28xx 7-1:0.0: Config register raw data: 0x56 [ 1903.548000][T23617] usb 6-1: new high-speed USB device number 126 using dummy_hcd [ 1903.594706][T29226] netlink: 'syz.9.5695': attribute type 2 has an invalid length. [ 1903.610445][T29226] : entered promiscuous mode [ 1903.774663][T23617] usb 6-1: device descriptor read/64, error -71 [ 1903.805405][ T5920] em28xx 7-1:0.0: AC97 chip type couldn't be determined [ 1903.849883][ T5920] em28xx 7-1:0.0: No AC97 audio processor [ 1903.895030][T23617] usb usb6-port1: attempt power cycle [ 1904.238176][T23617] usb 6-1: new high-speed USB device number 127 using dummy_hcd [ 1904.268637][T23617] usb 6-1: device descriptor read/8, error -71 [ 1904.594378][T29235] IPv6: NLM_F_CREATE should be specified when creating new route [ 1904.648805][T23617] usb 6-1: new high-speed USB device number 2 using dummy_hcd [ 1904.668685][T23617] usb 6-1: device descriptor read/8, error -71 [ 1904.778470][T23617] usb usb6-port1: unable to enumerate USB device [ 1905.118373][T23617] usb 9-1: new high-speed USB device number 115 using dummy_hcd [ 1905.217323][T11980] usb 7-1: USB disconnect, device number 111 [ 1905.233115][T11980] em28xx 7-1:0.0: Disconnecting em28xx [ 1905.269839][T11980] em28xx 7-1:0.0: Freeing device [ 1905.281242][T23617] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1905.304270][T23617] usb 9-1: New USB device found, idVendor=0a07, idProduct=0064, bcdDevice=ad.aa [ 1905.327913][T23617] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1905.353462][T23617] usb 9-1: Product: syz [ 1905.364020][T23617] usb 9-1: Manufacturer: syz [ 1905.372340][T23617] usb 9-1: SerialNumber: syz [ 1905.401393][T23617] usb 9-1: config 0 descriptor?? [ 1905.411234][T23617] adutux 9-1:0.0: interrupt endpoints not found [ 1905.670362][T11980] usb 7-1: new high-speed USB device number 112 using dummy_hcd [ 1905.827958][T11980] usb 7-1: Using ep0 maxpacket: 8 [ 1905.839265][T11980] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1905.850179][T11980] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1905.860791][T11980] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 32 [ 1905.899783][T11980] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1905.918011][T11980] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1905.933516][T11980] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1906.148317][ T5920] usb 9-1: USB disconnect, device number 115 [ 1906.227464][T11980] usb 7-1: GET_CAPABILITIES returned 0 [ 1906.251396][T11980] usbtmc 7-1:16.0: can't read capabilities [ 1906.437554][ T5920] usb 7-1: USB disconnect, device number 112 [ 1906.558147][T29259] syzkaller0: entered promiscuous mode [ 1906.563720][T29259] syzkaller0: entered allmulticast mode [ 1906.587695][T29259] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5705'. [ 1906.681025][T23617] usb 6-1: new high-speed USB device number 3 using dummy_hcd [ 1906.815548][T29262] ptrace attach of "./syz-executor exec"[23370] was attempted by "./syz-executor exec"[29262] [ 1906.849941][T23617] usb 6-1: Using ep0 maxpacket: 8 [ 1906.876011][T23617] usb 6-1: New USB device found, idVendor=0402, idProduct=5602, bcdDevice=35.76 [ 1906.901560][T23617] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1906.921864][T23617] usb 6-1: Product: syz [ 1906.928961][T23617] usb 6-1: Manufacturer: syz [ 1906.941297][T23617] usb 6-1: SerialNumber: syz [ 1906.958126][T23617] usb 6-1: config 0 descriptor?? [ 1906.994066][T23617] gspca_main: ALi m5602-2.14.0 probing 0402:5602 [ 1907.086525][T29267] netlink: 4 bytes leftover after parsing attributes in process `syz.8.5707'. [ 1907.170323][T29257] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1907.180484][T29257] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1907.278032][T23617] gspca_m5602: Failed to find a sensor [ 1907.285538][T23617] ALi m5602 6-1:0.0: ALi m5602 webcam failed [ 1907.377632][T23617] usb 6-1: USB disconnect, device number 3 [ 1908.897505][T29275] netlink: 20 bytes leftover after parsing attributes in process `syz.5.5712'. [ 1909.008070][T11980] usb 7-1: new high-speed USB device number 113 using dummy_hcd [ 1909.158018][T11980] usb 7-1: device descriptor read/64, error -71 [ 1909.298357][ T5920] usb 10-1: new high-speed USB device number 108 using dummy_hcd [ 1909.867986][T11980] usb 7-1: new high-speed USB device number 114 using dummy_hcd [ 1909.978014][ T5920] usb 10-1: Using ep0 maxpacket: 8 [ 1909.996333][ T5920] usb 10-1: config 0 interface 0 altsetting 2 endpoint 0x1 has invalid maxpacket 512, setting to 64 [ 1910.009539][ T5920] usb 10-1: config 0 interface 0 has no altsetting 0 [ 1910.018214][T11980] usb 7-1: device descriptor read/64, error -71 [ 1910.096196][ T5920] usb 10-1: New USB device found, idVendor=0e41, idProduct=4142, bcdDevice=bc.76 [ 1910.106165][ T5920] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1910.124778][ T5920] usb 10-1: Product: syz [ 1910.136068][ T5920] usb 10-1: Manufacturer: syz [ 1910.142004][T11980] usb usb7-port1: attempt power cycle [ 1910.148836][T12103] usb 9-1: new high-speed USB device number 116 using dummy_hcd [ 1910.158008][ T5920] usb 10-1: SerialNumber: syz [ 1910.218975][ T5920] usb 10-1: config 0 descriptor?? [ 1910.234985][ T5920] snd_usb_toneport 10-1:0.0: Line 6 TonePort UX2 found [ 1910.388188][T12103] usb 9-1: Using ep0 maxpacket: 8 [ 1910.399710][T12103] usb 9-1: New USB device found, idVendor=0ccd, idProduct=0099, bcdDevice=95.0d [ 1910.409117][T12103] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1910.518067][T11980] usb 7-1: new high-speed USB device number 115 using dummy_hcd [ 1910.529573][ T5920] snd_usb_toneport 10-1:0.0: cannot get proper max packet size [ 1910.537749][ T5920] snd_usb_toneport 10-1:0.0: Line 6 TonePort UX2 now disconnected [ 1910.554534][T11980] usb 7-1: device descriptor read/8, error -71 [ 1910.562855][ T5920] snd_usb_toneport 10-1:0.0: probe with driver snd_usb_toneport failed with error -22 [ 1910.569057][T12103] usb 9-1: Product: syz [ 1910.602980][T12103] usb 9-1: Manufacturer: syz [ 1910.613329][T12103] usb 9-1: SerialNumber: syz [ 1910.634157][T12103] usb 9-1: config 0 descriptor?? [ 1910.798184][T11980] usb 7-1: new high-speed USB device number 116 using dummy_hcd [ 1910.818843][T11980] usb 7-1: device descriptor read/8, error -71 [ 1910.928456][T11980] usb usb7-port1: unable to enumerate USB device [ 1910.956703][T12103] usb 9-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1910.969035][T12103] dvb_usb_af9015 9-1:0.0: probe with driver dvb_usb_af9015 failed with error -22 [ 1911.005534][T12103] usb 9-1: dvb_usb_v2: usb_bulk_msg() failed=-22 [ 1911.032917][T12103] dvb_usb_af9035 9-1:0.0: probe with driver dvb_usb_af9035 failed with error -22 [ 1911.083653][T12103] usb 9-1: USB disconnect, device number 116 [ 1911.394042][T29293] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1911.414123][T29293] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1912.895821][T12103] usb 10-1: USB disconnect, device number 108 [ 1913.117414][ T30] audit: type=1326 audit(1761331727.024:1738): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.186947][T26209] usb 7-1: new high-speed USB device number 117 using dummy_hcd [ 1913.286016][ T30] audit: type=1326 audit(1761331727.024:1739): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.355732][ T30] audit: type=1326 audit(1761331727.054:1740): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=384 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.378312][T26209] usb 7-1: Using ep0 maxpacket: 16 [ 1913.438037][ T30] audit: type=1326 audit(1761331727.054:1741): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.484483][T26209] usb 7-1: config 0 has an invalid interface number: 63 but max is 0 [ 1913.495960][T26209] usb 7-1: config 0 has no interface number 0 [ 1913.544805][T26209] usb 7-1: New USB device found, idVendor=0458, idProduct=7005, bcdDevice=22.a7 [ 1913.554191][ T30] audit: type=1326 audit(1761331727.054:1742): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.555016][T26209] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1913.589773][T26209] usb 7-1: Product: syz [ 1913.606702][ T30] audit: type=1326 audit(1761331727.054:1743): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.647369][ T30] audit: type=1326 audit(1761331727.054:1744): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=102 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.702273][ T30] audit: type=1326 audit(1761331727.054:1745): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.730693][T26209] usb 7-1: Manufacturer: syz [ 1913.755165][T26209] usb 7-1: SerialNumber: syz [ 1913.845317][T26209] usb 7-1: config 0 descriptor?? [ 1913.849418][ T30] audit: type=1326 audit(1761331727.054:1746): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1913.991415][ T30] audit: type=1326 audit(1761331727.054:1747): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=29323 comm="syz.9.5721" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf705d539 code=0x7ffc0000 [ 1914.578439][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1914.586054][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1914.603339][T29353] netlink: zone id is out of range [ 1914.632678][T29353] netlink: zone id is out of range [ 1914.700206][T29353] netlink: zone id is out of range [ 1914.705450][T29353] netlink: zone id is out of range [ 1914.711013][T29353] netlink: zone id is out of range [ 1914.757657][T29353] netlink: zone id is out of range [ 1914.765448][T29353] netlink: zone id is out of range [ 1914.858323][T29353] netlink: zone id is out of range [ 1914.865264][T29353] netlink: zone id is out of range [ 1914.921937][T29353] netlink: zone id is out of range [ 1914.937661][T29353] FAULT_INJECTION: forcing a failure. [ 1914.937661][T29353] name failslab, interval 1, probability 0, space 0, times 0 [ 1914.968389][T29353] CPU: 0 UID: 0 PID: 29353 Comm: syz.9.5731 Not tainted syzkaller #0 PREEMPT(full) [ 1914.968418][T29353] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1914.968442][T29353] Call Trace: [ 1914.968448][T29353] [ 1914.968455][T29353] dump_stack_lvl+0x189/0x250 [ 1914.968483][T29353] ? __pfx____ratelimit+0x10/0x10 [ 1914.968502][T29353] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1914.968524][T29353] ? __pfx__printk+0x10/0x10 [ 1914.968544][T29353] ? __pfx___might_resched+0x10/0x10 [ 1914.968564][T29353] should_fail_ex+0x414/0x560 [ 1914.968591][T29353] should_failslab+0xa8/0x100 [ 1914.968608][T29353] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1914.968630][T29353] ? __alloc_skb+0x112/0x2d0 [ 1914.968657][T29353] __alloc_skb+0x112/0x2d0 [ 1914.968701][T29353] netlink_ack+0x146/0xa50 [ 1914.968723][T29353] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1914.968744][T29353] ? __asan_memcpy+0x40/0x70 [ 1914.968764][T29353] ? __pfx_ref_tracker_free+0x10/0x10 [ 1914.968785][T29353] netlink_rcv_skb+0x28c/0x470 [ 1914.968807][T29353] ? __lock_acquire+0xab9/0xd20 [ 1914.968822][T29353] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1914.968842][T29353] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1914.968879][T29353] ? down_read+0x1ad/0x2e0 [ 1914.968904][T29353] genl_rcv+0x28/0x40 [ 1914.968921][T29353] netlink_unicast+0x82f/0x9e0 [ 1914.968949][T29353] ? __pfx_netlink_unicast+0x10/0x10 [ 1914.968972][T29353] ? netlink_sendmsg+0x642/0xb30 [ 1914.968984][T29353] ? skb_put+0x11b/0x210 [ 1914.969001][T29353] netlink_sendmsg+0x805/0xb30 [ 1914.969023][T29353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1914.969055][T29353] ? __import_iovec+0x5d4/0x7f0 [ 1914.969073][T29353] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1914.969097][T29353] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1914.969112][T29353] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1914.969137][T29353] __sock_sendmsg+0x21c/0x270 [ 1914.969160][T29353] ____sys_sendmsg+0x505/0x830 [ 1914.969189][T29353] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1914.969218][T29353] ___sys_sendmsg+0x21f/0x2a0 [ 1914.969236][T29353] ? __pfx____sys_sendmsg+0x10/0x10 [ 1914.969279][T29353] ? __fget_files+0x2a/0x420 [ 1914.969293][T29353] ? __fget_files+0x3a0/0x420 [ 1914.969315][T29353] __sys_sendmsg+0x164/0x220 [ 1914.969333][T29353] ? __pfx___sys_sendmsg+0x10/0x10 [ 1914.969356][T29353] ? __pfx_ksys_write+0x10/0x10 [ 1914.969381][T29353] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1914.969404][T29353] ? lockdep_hardirqs_on+0x9c/0x150 [ 1914.969427][T29353] __do_fast_syscall_32+0xb6/0x2b0 [ 1914.969449][T29353] ? lockdep_hardirqs_on+0x9c/0x150 [ 1914.969472][T29353] do_fast_syscall_32+0x34/0x80 [ 1914.969493][T29353] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1914.969513][T29353] RIP: 0023:0xf705d539 [ 1914.969527][T29353] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1914.969541][T29353] RSP: 002b:00000000f544d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1914.969558][T29353] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 1914.969569][T29353] RDX: 000000000000c000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1914.969579][T29353] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1914.969588][T29353] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1914.969597][T29353] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1914.969620][T29353] [ 1915.687582][T26209] gspca_main: sn9c2028-2.14.0 probing 0458:7005 [ 1915.695270][T26209] gspca_sn9c2028: read1 error -71 [ 1915.700978][T26209] gspca_sn9c2028: read1 error -71 [ 1915.710640][T26209] gspca_sn9c2028: read1 error -71 [ 1915.715735][T26209] sn9c2028 7-1:0.63: probe with driver sn9c2028 failed with error -71 [ 1915.762151][T26209] usb 7-1: USB disconnect, device number 117 [ 1916.639254][T29357] fuse: Bad value for 'fd' [ 1916.889632][T29377] netlink: 4 bytes leftover after parsing attributes in process `syz.7.5736'. [ 1916.944126][T26209] usb 6-1: new high-speed USB device number 4 using dummy_hcd [ 1917.110682][T26209] usb 6-1: config 0 has an invalid interface number: 229 but max is 0 [ 1917.127318][T26209] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1917.145055][T26209] usb 6-1: config 0 has no interface number 0 [ 1917.174185][T26209] usb 6-1: config 0 interface 229 altsetting 0 endpoint 0x1 has invalid wMaxPacketSize 0 [ 1917.194505][T26209] usb 6-1: config 0 interface 229 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 8 [ 1917.238661][T26209] usb 6-1: New USB device found, idVendor=0c72, idProduct=0013, bcdDevice=b3.49 [ 1917.284279][T26209] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1917.320362][T26209] usb 6-1: config 0 descriptor?? [ 1917.812697][T26209] peak_usb 6-1:0.229 can0: unable to request usb[type=0 value=1] err=-71 [ 1917.822961][T26209] peak_usb 6-1:0.229: unable to read PCAN-Chip USB firmware info (err -71) [ 1917.922897][T26209] peak_usb 6-1:0.229: probe with driver peak_usb failed with error -71 [ 1917.970913][T26209] usb 6-1: USB disconnect, device number 4 [ 1919.197597][T29411] input: syz0 as /devices/virtual/input/input282 [ 1919.557461][T29402] FAULT_INJECTION: forcing a failure. [ 1919.557461][T29402] name failslab, interval 1, probability 0, space 0, times 0 [ 1919.607530][T29402] CPU: 0 UID: 0 PID: 29402 Comm: syz.6.5743 Not tainted syzkaller #0 PREEMPT(full) [ 1919.607552][T29402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1919.607562][T29402] Call Trace: [ 1919.607569][T29402] [ 1919.607576][T29402] dump_stack_lvl+0x189/0x250 [ 1919.607609][T29402] ? __pfx____ratelimit+0x10/0x10 [ 1919.607628][T29402] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1919.607650][T29402] ? __pfx__printk+0x10/0x10 [ 1919.607671][T29402] ? __pfx___might_resched+0x10/0x10 [ 1919.607687][T29402] ? fs_reclaim_acquire+0x7d/0x100 [ 1919.607715][T29402] should_fail_ex+0x414/0x560 [ 1919.607743][T29402] should_failslab+0xa8/0x100 [ 1919.607760][T29402] __kmalloc_cache_noprof+0x6f/0x6f0 [ 1919.607783][T29402] ? ____ip_mc_inc_group+0x528/0xde0 [ 1919.607805][T29402] ____ip_mc_inc_group+0x528/0xde0 [ 1919.607840][T29402] ip_mc_up+0x125/0x300 [ 1919.607864][T29402] inetdev_event+0xfb3/0x15b0 [ 1919.607894][T29402] ? __pfx_del_netdev_default_ips_join+0x10/0x10 [ 1919.607918][T29402] ? __pfx_is_eth_port_inactive_slave_filter+0x10/0x10 [ 1919.607940][T29402] ? __pfx_is_ndev_for_default_gid_filter+0x10/0x10 [ 1919.607963][T29402] ? __pfx_inetdev_event+0x10/0x10 [ 1919.607990][T29402] notifier_call_chain+0x1b6/0x3e0 [ 1919.608015][T29402] __dev_notify_flags+0x18d/0x2e0 [ 1919.608033][T29402] ? __pfx___dev_notify_flags+0x10/0x10 [ 1919.608046][T29402] ? __dev_change_flags+0x4cc/0x6d0 [ 1919.608065][T29402] ? __pfx___dev_change_flags+0x10/0x10 [ 1919.608089][T29402] netif_change_flags+0xe8/0x1a0 [ 1919.608108][T29402] do_setlink+0xc55/0x41c0 [ 1919.608121][T29402] ? rcu_is_watching+0x15/0xb0 [ 1919.608141][T29402] ? __schedule+0x17ae/0x4cc0 [ 1919.608163][T29402] ? __lock_acquire+0xab9/0xd20 [ 1919.608179][T29402] ? __pfx_do_setlink+0x10/0x10 [ 1919.608192][T29402] ? __lock_acquire+0xab9/0xd20 [ 1919.608223][T29402] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 1919.608241][T29402] ? lockdep_hardirqs_on+0x9c/0x150 [ 1919.608261][T29402] ? _raw_spin_unlock_irqrestore+0xad/0x110 [ 1919.608279][T29402] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 1919.608300][T29402] ? rcu_is_watching+0x15/0xb0 [ 1919.608320][T29402] ? __mutex_lock+0xd3b/0x1350 [ 1919.608343][T29402] ? __mutex_lock+0x5bb/0x1350 [ 1919.608372][T29402] ? apparmor_capable+0x137/0x1b0 [ 1919.608391][T29402] ? bpf_lsm_capable+0x9/0x20 [ 1919.608409][T29402] ? security_capable+0x7e/0x2e0 [ 1919.608431][T29402] ? ns_capable+0x8a/0xf0 [ 1919.608449][T29402] ? ipvlan_nl_changelink+0x258/0x2e0 [ 1919.608468][T29402] rtnl_newlink+0x1619/0x1c80 [ 1919.608499][T29402] ? __pfx_rtnl_newlink+0x10/0x10 [ 1919.608541][T29402] ? preempt_schedule+0xae/0xc0 [ 1919.608557][T29402] ? __dev_queue_xmit+0x27b/0x3b50 [ 1919.608575][T29402] ? preempt_schedule_common+0x83/0xd0 [ 1919.608594][T29402] ? preempt_schedule+0xae/0xc0 [ 1919.608617][T29402] ? __pfx_preempt_schedule+0x10/0x10 [ 1919.608634][T29402] ? nlmon_xmit+0xb0/0x100 [ 1919.608654][T29402] ? preempt_schedule_notrace_thunk+0x16/0x30 [ 1919.608675][T29402] ? preempt_schedule_thunk+0x16/0x30 [ 1919.608696][T29402] ? __local_bh_enable_ip+0x13e/0x1c0 [ 1919.608713][T29402] ? __pfx___local_bh_enable_ip+0x10/0x10 [ 1919.608733][T29402] ? __dev_queue_xmit+0x27b/0x3b50 [ 1919.608750][T29402] ? __dev_queue_xmit+0x27b/0x3b50 [ 1919.608766][T29402] ? __dev_queue_xmit+0x27b/0x3b50 [ 1919.608784][T29402] ? __dev_queue_xmit+0x1d79/0x3b50 [ 1919.608806][T29402] ? __lock_acquire+0xab9/0xd20 [ 1919.608840][T29402] ? __pfx_rtnl_newlink+0x10/0x10 [ 1919.608862][T29402] rtnetlink_rcv_msg+0x7cf/0xb70 [ 1919.608888][T29402] ? rtnetlink_rcv_msg+0x1ab/0xb70 [ 1919.608910][T29402] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1919.608938][T29402] ? __pfx_rcu_preempt_deferred_qs_irqrestore+0x10/0x10 [ 1919.608968][T29402] netlink_rcv_skb+0x208/0x470 [ 1919.608990][T29402] ? rcu_is_watching+0x15/0xb0 [ 1919.609009][T29402] ? __pfx_rtnetlink_rcv_msg+0x10/0x10 [ 1919.609032][T29402] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1919.609065][T29402] ? netlink_deliver_tap+0x2e/0x1b0 [ 1919.609095][T29402] netlink_unicast+0x82f/0x9e0 [ 1919.609123][T29402] ? __pfx_netlink_unicast+0x10/0x10 [ 1919.609146][T29402] ? netlink_sendmsg+0x642/0xb30 [ 1919.609159][T29402] ? skb_put+0x11b/0x210 [ 1919.609175][T29402] netlink_sendmsg+0x805/0xb30 [ 1919.609197][T29402] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1919.609223][T29402] ? __import_iovec+0x5d4/0x7f0 [ 1919.609241][T29402] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1919.609265][T29402] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1919.609280][T29402] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1919.609305][T29402] __sock_sendmsg+0x21c/0x270 [ 1919.609328][T29402] ____sys_sendmsg+0x505/0x830 [ 1919.609348][T29402] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1919.609377][T29402] ___sys_sendmsg+0x21f/0x2a0 [ 1919.609394][T29402] ? __pfx____sys_sendmsg+0x10/0x10 [ 1919.609438][T29402] ? __fget_files+0x2a/0x420 [ 1919.609452][T29402] ? __fget_files+0x3a0/0x420 [ 1919.609475][T29402] __sys_sendmsg+0x164/0x220 [ 1919.609492][T29402] ? __pfx___sys_sendmsg+0x10/0x10 [ 1919.609515][T29402] ? __pfx_ksys_write+0x10/0x10 [ 1919.609539][T29402] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1919.609561][T29402] ? lockdep_hardirqs_on+0x9c/0x150 [ 1919.609583][T29402] __do_fast_syscall_32+0xb6/0x2b0 [ 1919.609609][T29402] ? lockdep_hardirqs_on+0x9c/0x150 [ 1919.609632][T29402] do_fast_syscall_32+0x34/0x80 [ 1919.609653][T29402] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1919.609673][T29402] RIP: 0023:0xf705d539 [ 1919.609686][T29402] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1919.609701][T29402] RSP: 002b:00000000f544d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1919.609717][T29402] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000080 [ 1919.609729][T29402] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1919.609738][T29402] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1919.609747][T29402] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1919.609757][T29402] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1919.609780][T29402] [ 1923.396783][T29451] fuse: Bad value for 'fd' [ 1923.984734][T29460] cgroup: fork rejected by pids controller in /syz8 [ 1924.872638][T29534] netlink: 24 bytes leftover after parsing attributes in process `syz.6.5753'. [ 1924.933599][T30059] netlink: 28 bytes leftover after parsing attributes in process `syz.6.5753'. [ 1924.986820][T30059] netlink: 8 bytes leftover after parsing attributes in process `syz.6.5753'. [ 1925.113330][T30109] tipc: Enabled bearer , priority 0 [ 1925.144852][T30109] syzkaller0: entered promiscuous mode [ 1925.162382][T30109] syzkaller0: entered allmulticast mode [ 1925.294671][T30109] tipc: Resetting bearer [ 1925.450042][T30108] tipc: Resetting bearer [ 1925.805395][T30108] tipc: Disabling bearer [ 1926.488027][T11894] usb 10-1: new high-speed USB device number 109 using dummy_hcd [ 1926.669759][T11894] usb 10-1: Using ep0 maxpacket: 16 [ 1926.693880][T32185] netlink: 'syz.7.5760': attribute type 11 has an invalid length. [ 1926.694253][T11894] usb 10-1: config 0 has an invalid descriptor of length 167, skipping remainder of the config [ 1926.737469][T11894] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 5 [ 1926.772562][T32183] net_ratelimit: 7 callbacks suppressed [ 1926.772576][T32183] openvswitch: netlink: Duplicate or invalid key (type 0). [ 1926.795944][T11894] usb 10-1: New USB device found, idVendor=046a, idProduct=0027, bcdDevice= 0.00 [ 1926.817912][T11894] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1926.862567][T11894] usb 10-1: config 0 descriptor?? [ 1926.907330][T32183] openvswitch: netlink: Flow actions may not be safe on all matching packets. [ 1926.942583][T11894] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 1926.967120][T32187] binder: 32186:32187 ioctl 4018620d 0 returned -22 [ 1927.328945][T32183] loop6: detected capacity change from 0 to 524279808 [ 1927.401237][T32183] loop6: detected capacity change from 524279808 to 1 [ 1927.444078][T14856] Dev loop6: unable to read RDB block 1 [ 1927.472042][T14856] loop6: unable to read partition table [ 1927.499592][T14856] loop6: partition table beyond EOD, truncated [ 1927.517617][T32194] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1927.539820][T32194] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1927.542015][T32183] Dev loop6: unable to read RDB block 1 [ 1927.578032][T32183] loop6: unable to read partition table [ 1927.583964][T32183] loop6: partition table beyond EOD, truncated [ 1927.618567][T32183] loop_reread_partitions: partition scan of loop6 (u0v ) failed (rc=-5) [ 1928.014015][ T5198] Dev loop6: unable to read RDB block 1 [ 1928.029151][ T5198] loop6: unable to read partition table [ 1928.046487][ T5198] loop6: partition table beyond EOD, truncated [ 1928.448294][T32214] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1928.527486][T32214] bond0: (slave bond1): Enslaving as an active interface with an up link [ 1928.616812][T32210] fuse: Bad value for 'fd' [ 1928.947646][T32223] input: syz0 as /devices/virtual/input/input283 [ 1929.192681][T32227] ip6t_REJECT: ECHOREPLY is not supported [ 1929.225655][T11894] usb 10-1: USB disconnect, device number 109 [ 1929.477571][T11980] usb 9-1: new high-speed USB device number 117 using dummy_hcd [ 1929.507263][T32235] netlink: 'syz.7.5772': attribute type 11 has an invalid length. [ 1929.679968][T11980] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1929.691369][T11980] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1930.235569][T11980] usb 9-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 21 [ 1930.251455][T11980] usb 9-1: New USB device found, idVendor=047f, idProduct=ffff, bcdDevice= 0.00 [ 1930.434814][T11980] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1930.451608][T11980] usb 9-1: config 0 descriptor?? [ 1930.880290][T11980] plantronics 0003:047F:FFFF.0073: reserved main item tag 0xd [ 1931.140155][T11980] plantronics 0003:047F:FFFF.0073: hiddev0,hidraw0: USB HID v0.40 Device [HID 047f:ffff] on usb-dummy_hcd.8-1/input0 [ 1931.780561][T32265] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5777'. [ 1932.219395][T32267] input: syz0 as /devices/virtual/input/input286 [ 1932.348832][T11894] usb 7-1: new high-speed USB device number 118 using dummy_hcd [ 1932.425649][T26209] usb 9-1: USB disconnect, device number 117 [ 1932.659036][T11894] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1932.679526][T11894] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1932.708782][T11894] usb 7-1: New USB device found, idVendor=0c70, idProduct=f014, bcdDevice= 0.00 [ 1932.742690][T11894] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1932.844260][T11894] usb 7-1: config 0 descriptor?? [ 1933.275813][T11894] aquacomputer_d5next 0003:0C70:F014.0074: hidraw0: USB HID v0.00 Device [HID 0c70:f014] on usb-dummy_hcd.6-1/input0 [ 1933.320620][T26209] usb 6-1: new high-speed USB device number 5 using dummy_hcd [ 1933.575384][T11894] usb 7-1: USB disconnect, device number 118 [ 1933.600241][T26209] usb 6-1: Using ep0 maxpacket: 16 [ 1933.845796][ T5913] IPVS: starting estimator thread 0... [ 1933.978020][T32285] IPVS: using max 25 ests per chain, 60000 per kthread [ 1933.997882][T32282] fido_id[32282]: Failed to open report descriptor at '/sys/devices/platform/dummy_hcd.6/usb7/report_descriptor': No such file or directory [ 1934.035207][T32288] netlink: 'syz.6.5783': attribute type 1 has an invalid length. [ 1934.096449][T32292] netlink: zone id is out of range [ 1934.102701][T32292] netlink: zone id is out of range [ 1934.108149][T32292] netlink: zone id is out of range [ 1934.115448][T32292] netlink: zone id is out of range [ 1934.120773][T32292] netlink: zone id is out of range [ 1934.131278][T32292] netlink: zone id is out of range [ 1934.192385][T32292] netlink: zone id is out of range [ 1934.198345][T32292] netlink: zone id is out of range [ 1934.219192][T32292] netlink: zone id is out of range [ 1934.236567][T32292] netlink: zone id is out of range [ 1934.449688][T32288] 8021q: adding VLAN 0 to HW filter on device bond1 [ 1934.699251][T32295] netlink: 'syz.8.5784': attribute type 11 has an invalid length. [ 1936.704755][T32317] input: syz0 as /devices/virtual/input/input287 [ 1937.195457][T26209] usb 6-1: unable to get BOS descriptor or descriptor too short [ 1937.289315][T26209] usb 6-1: unable to read config index 0 descriptor/start: -71 [ 1937.296946][T26209] usb 6-1: can't read configurations, error -71 [ 1938.668207][T26209] usb 7-1: new high-speed USB device number 119 using dummy_hcd [ 1938.830953][T26209] usb 7-1: New USB device found, idVendor=0eb1, idProduct=7007, bcdDevice= 2.04 [ 1938.883362][T26209] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1938.971273][T26209] usb 7-1: config 0 descriptor?? [ 1939.127467][T26209] go7007 7-1:0.0: probe with driver go7007 failed with error -12 [ 1939.343471][T32347] input: syz0 as /devices/virtual/input/input288 [ 1939.527137][T32354] input: syz1 as /devices/virtual/input/input289 [ 1939.838104][ T5913] usb 7-1: USB disconnect, device number 119 [ 1941.596518][T32380] netlink: 'syz.7.5807': attribute type 10 has an invalid length. [ 1942.598428][T26209] usb 6-1: new low-speed USB device number 7 using dummy_hcd [ 1942.637547][T32414] fuse: Unknown parameter 'fX0x0000000000000003' [ 1942.666126][T32415] tipc: Enabling of bearer rejected, failed to enable media [ 1942.797987][T26209] usb 6-1: config 0 has an invalid interface number: 1 but max is 0 [ 1942.807883][T26209] usb 6-1: config 0 has no interface number 0 [ 1942.826622][T26209] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 10 [ 1942.948406][T26209] usb 6-1: config 0 interface 1 altsetting 0 endpoint 0x82 has invalid maxpacket 159, setting to 8 [ 1942.978175][T26209] usb 6-1: New USB device found, idVendor=07c0, idProduct=1512, bcdDevice=30.22 [ 1943.007893][T26209] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1943.058330][T26209] usb 6-1: config 0 descriptor?? [ 1943.078382][T32401] raw-gadget.0 gadget.5: fail, usb_ep_enable returned -22 [ 1943.121030][T26209] iowarrior 6-1:0.1: IOWarrior product=0x1512, serial= interface=1 now attached to iowarrior0 [ 1943.277958][T11894] usb 10-1: new high-speed USB device number 110 using dummy_hcd [ 1943.329064][T26209] usb 6-1: USB disconnect, device number 7 [ 1943.335012][ C0] iowarrior 6-1:0.1: iowarrior_callback - usb_submit_urb failed with result -19 [ 1943.427993][T11894] usb 10-1: Using ep0 maxpacket: 16 [ 1943.435195][T11894] usb 10-1: config 0 has an invalid interface number: 249 but max is 0 [ 1943.451826][T11894] usb 10-1: config 0 has no interface number 0 [ 1943.462964][T11894] usb 10-1: config 0 interface 249 has no altsetting 0 [ 1943.473472][T11894] usb 10-1: New USB device found, idVendor=16ca, idProduct=1502, bcdDevice= 5.c1 [ 1943.486007][T11894] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1943.554886][T11894] usb 10-1: Product: syz [ 1943.559638][T11894] usb 10-1: Manufacturer: syz [ 1943.564656][T11894] usb 10-1: SerialNumber: syz [ 1943.576625][T11894] usb 10-1: config 0 descriptor?? [ 1943.801920][T32418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1943.811779][T32418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1943.921054][T32418] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1943.934605][T32418] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1944.097121][T11894] usb 10-1: USB disconnect, device number 110 [ 1944.390257][T32437] input: syz0 as /devices/virtual/input/input290 [ 1946.558546][T32464] FAULT_INJECTION: forcing a failure. [ 1946.558546][T32464] name failslab, interval 1, probability 0, space 0, times 0 [ 1946.580027][T32464] CPU: 0 UID: 0 PID: 32464 Comm: syz.5.5830 Not tainted syzkaller #0 PREEMPT(full) [ 1946.580049][T32464] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1946.580059][T32464] Call Trace: [ 1946.580066][T32464] [ 1946.580073][T32464] dump_stack_lvl+0x189/0x250 [ 1946.580114][T32464] ? __pfx____ratelimit+0x10/0x10 [ 1946.580132][T32464] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1946.580152][T32464] ? __pfx__printk+0x10/0x10 [ 1946.580171][T32464] ? __pfx___might_resched+0x10/0x10 [ 1946.580186][T32464] ? fs_reclaim_acquire+0x7d/0x100 [ 1946.580213][T32464] should_fail_ex+0x414/0x560 [ 1946.580238][T32464] should_failslab+0xa8/0x100 [ 1946.580254][T32464] kmem_cache_alloc_node_noprof+0x77/0x710 [ 1946.580274][T32464] ? __alloc_skb+0x112/0x2d0 [ 1946.580295][T32464] ? netlink_autobind+0xdb/0x300 [ 1946.580313][T32464] __alloc_skb+0x112/0x2d0 [ 1946.580343][T32464] netlink_sendmsg+0x5c6/0xb30 [ 1946.580363][T32464] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1946.580388][T32464] ? __import_iovec+0x5d4/0x7f0 [ 1946.580406][T32464] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1946.580429][T32464] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1946.580443][T32464] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1946.580467][T32464] __sock_sendmsg+0x21c/0x270 [ 1946.580488][T32464] ____sys_sendmsg+0x505/0x830 [ 1946.580507][T32464] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1946.580534][T32464] ___sys_sendmsg+0x21f/0x2a0 [ 1946.580551][T32464] ? __pfx____sys_sendmsg+0x10/0x10 [ 1946.580591][T32464] ? __fget_files+0x2a/0x420 [ 1946.580604][T32464] ? __fget_files+0x3a0/0x420 [ 1946.580625][T32464] __sys_sendmsg+0x164/0x220 [ 1946.580641][T32464] ? __pfx___sys_sendmsg+0x10/0x10 [ 1946.580663][T32464] ? __pfx_ksys_write+0x10/0x10 [ 1946.580686][T32464] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1946.580707][T32464] ? lockdep_hardirqs_on+0x9c/0x150 [ 1946.580729][T32464] __do_fast_syscall_32+0xb6/0x2b0 [ 1946.580749][T32464] ? lockdep_hardirqs_on+0x9c/0x150 [ 1946.580771][T32464] do_fast_syscall_32+0x34/0x80 [ 1946.580791][T32464] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1946.580809][T32464] RIP: 0023:0xf7fe5539 [ 1946.580822][T32464] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1946.580835][T32464] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1946.580851][T32464] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000380 [ 1946.580862][T32464] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1946.580870][T32464] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1946.580879][T32464] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1946.580888][T32464] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1946.580909][T32464] [ 1947.384607][T32466] syz.8.5831 (32466): drop_caches: 2 [ 1948.051168][T26209] usb 9-1: new high-speed USB device number 118 using dummy_hcd [ 1948.208142][T26209] usb 9-1: Using ep0 maxpacket: 32 [ 1948.281104][T32495] input: syz0 as /devices/virtual/input/input291 [ 1948.344436][T26209] usb 9-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1948.376110][T26209] usb 9-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1948.412675][T26209] usb 9-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1948.435752][T26209] usb 9-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1948.513152][T26209] usb 9-1: Product: syz [ 1948.517641][T26209] usb 9-1: Manufacturer: syz [ 1948.538017][T26209] hub 9-1:4.0: USB hub found [ 1948.819306][T26209] hub 9-1:4.0: 2 ports detected [ 1949.257712][T26209] hub 9-1:4.0: set hub depth failed [ 1949.270252][T26209] usb 9-1: USB disconnect, device number 118 [ 1949.806159][ T30] kauditd_printk_skb: 16 callbacks suppressed [ 1949.806176][ T30] audit: type=1800 audit(1761331763.664:1764): pid=32507 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.5.5842" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1951.188303][ T30] audit: type=1326 audit(1761331765.054:1765): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32517 comm="syz.8.5846" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7fa2539 code=0x0 [ 1952.857988][ T5920] usb 6-1: new high-speed USB device number 8 using dummy_hcd [ 1953.010330][T32553] netlink: 8 bytes leftover after parsing attributes in process `syz.8.5857'. [ 1953.048327][T32553] netlink: 20 bytes leftover after parsing attributes in process `syz.8.5857'. [ 1953.068035][ T5920] usb 6-1: New USB device found, idVendor=249c, idProduct=9002, bcdDevice=de.ad [ 1953.147911][ T5920] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1953.224047][ T5920] usb 6-1: config 0 descriptor?? [ 1953.230030][T32553] netlink: 20 bytes leftover after parsing attributes in process `syz.8.5857'. [ 1953.294818][T32553] netlink: 12 bytes leftover after parsing attributes in process `syz.8.5857'. [ 1953.529245][ T5920] snd-usb-hiface 6-1:0.0: probe with driver snd-usb-hiface failed with error -22 [ 1953.750952][T32549] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1953.789476][T32549] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1953.871107][ T5920] usb 6-1: USB disconnect, device number 8 [ 1954.108664][T11980] usb 10-1: new low-speed USB device number 111 using dummy_hcd [ 1954.148127][ T5913] usb 9-1: new high-speed USB device number 119 using dummy_hcd [ 1954.270461][T11980] usb 10-1: config 0 has an invalid interface number: 55 but max is 0 [ 1954.279229][T11980] usb 10-1: config 0 has no interface number 0 [ 1954.285557][T11980] usb 10-1: config 0 interface 55 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1954.309272][ T5913] usb 9-1: Using ep0 maxpacket: 8 [ 1954.317656][ T5913] usb 9-1: config 3 has an invalid interface number: 251 but max is 0 [ 1954.326474][ T5913] usb 9-1: config 3 has no interface number 0 [ 1954.364263][ T5913] usb 9-1: config 3 interface 251 altsetting 5 endpoint 0x7 has invalid maxpacket 1024, setting to 64 [ 1954.388149][T11980] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0xE has invalid maxpacket 32, setting to 8 [ 1954.440287][ T5913] usb 9-1: config 3 interface 251 has no altsetting 0 [ 1954.448646][T11980] usb 10-1: config 0 interface 55 altsetting 0 has an endpoint descriptor with address 0xAB, changing to 0x8B [ 1954.460988][T11980] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has an invalid bInterval 0, changing to 10 [ 1954.473403][T11980] usb 10-1: config 0 interface 55 altsetting 0 endpoint 0x8B has invalid maxpacket 120, setting to 8 [ 1954.486410][ T5913] usb 9-1: New USB device found, idVendor=12d1, idProduct=1442, bcdDevice=72.c7 [ 1954.496030][ T5913] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1954.574172][ T5913] usb 9-1: Product: Ь [ 1954.579020][ T5913] usb 9-1: Manufacturer: 飚䫸⋆啙঒均쾲呂ꘙ舂꒠ù葤앩䅰灉픹䨡栘쉲유뭌Ⱕ䨲ꤳ閑ꪠ黊狘觔首藍甐Ǻ㐛 [ 1954.593044][T11980] usb 10-1: config 0 interface 55 altsetting 0 has 3 endpoint descriptors, different from the interface descriptor's value: 2 [ 1954.607600][ T5913] usb 9-1: SerialNumber: 擳雠ꬎ䜕숸᝔咫朗뷟芸퇓鮼榅齫︴ݾ螺伧셷ﷷ礭>騏䳚˪燅⑱힦鹢邆㳡栟ꭖ縧僀⵩䘌૥豝띖碃Ხ퉅쟿㦂☰᭐긌쭑鰕殔釶⽖さ釹ﶸ鐎㪹ʩ編톪ḩ獞氬욦悝഼웟㸛ﱜ߲ꓖ㤪秛쓫鋭㭯䩓䭟⢇鏙ہᨩ햑흢겑ꮮ⥮⎈흔碬햩欴ᙽ [ 1954.648297][T11980] usb 10-1: New USB device found, idVendor=0f11, idProduct=1080, bcdDevice=fc.6a [ 1954.657538][T11980] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1954.688967][T11980] usb 10-1: config 0 descriptor?? [ 1954.695593][T32566] raw-gadget.2 gadget.9: fail, usb_ep_enable returned -22 [ 1954.703378][T32566] raw-gadget.2 gadget.9: fail, usb_ep_enable returned -22 [ 1954.725817][T11980] ldusb 10-1:0.55: LD USB Device #0 now attached to major 180 minor 0 [ 1954.954072][T26209] usb 10-1: USB disconnect, device number 111 [ 1954.956104][ C1] ldusb 10-1:0.55: usb_submit_urb failed (-19) [ 1954.971024][T26209] ldusb 10-1:0.55: LD USB Device #0 now disconnected [ 1955.021249][T32568] sg_write: data in/out 209152/12 bytes for SCSI command 0x89-- guessing data in; [ 1955.021249][T32568] program syz.8.5860 not setting count and/or reply_len properly [ 1955.151889][ T5913] rndis_host 9-1:3.251: skipping garbage [ 1955.178689][ T5913] usb 9-1: bad CDC descriptors [ 1955.197196][ T5913] option 9-1:3.251: GSM modem (1-port) converter detected [ 1955.215641][ T5913] usb 9-1: USB disconnect, device number 119 [ 1955.230413][ T5913] option 9-1:3.251: device disconnected [ 1955.516336][T32592] syz.7.5868 (32592): drop_caches: 2 [ 1955.609594][T32592] syz.7.5868 (32592): drop_caches: 2 [ 1956.201796][T32611] FAULT_INJECTION: forcing a failure. [ 1956.201796][T32611] name failslab, interval 1, probability 0, space 0, times 0 [ 1956.235388][T32611] CPU: 1 UID: 0 PID: 32611 Comm: syz.5.5876 Not tainted syzkaller #0 PREEMPT(full) [ 1956.235419][T32611] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1956.235433][T32611] Call Trace: [ 1956.235442][T32611] [ 1956.235452][T32611] dump_stack_lvl+0x189/0x250 [ 1956.235488][T32611] ? __pfx____ratelimit+0x10/0x10 [ 1956.235514][T32611] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1956.235544][T32611] ? __pfx__printk+0x10/0x10 [ 1956.235578][T32611] ? __pfx___might_resched+0x10/0x10 [ 1956.235606][T32611] should_fail_ex+0x414/0x560 [ 1956.235645][T32611] should_failslab+0xa8/0x100 [ 1956.235669][T32611] __kmalloc_cache_noprof+0x6f/0x6f0 [ 1956.235702][T32611] ? fuse_init_fs_context+0x55/0x210 [ 1956.235737][T32611] fuse_init_fs_context+0x55/0x210 [ 1956.235763][T32611] ? __pfx_fuse_init_fs_context+0x10/0x10 [ 1956.235794][T32611] alloc_fs_context+0x651/0x7d0 [ 1956.235827][T32611] do_new_mount+0x172/0xa10 [ 1956.235858][T32611] ? apparmor_capable+0x137/0x1b0 [ 1956.235885][T32611] ? security_capable+0x7e/0x2e0 [ 1956.235912][T32611] ? __pfx_do_new_mount+0x10/0x10 [ 1956.235943][T32611] ? ns_capable+0x8a/0xf0 [ 1956.235968][T32611] ? path_mount+0x61c/0xfe0 [ 1956.235998][T32611] ? kmem_cache_free+0x19b/0x690 [ 1956.236060][T32611] __se_sys_mount+0x313/0x410 [ 1956.236088][T32611] ? __pfx___se_sys_mount+0x10/0x10 [ 1956.236113][T32611] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1956.236146][T32611] ? lockdep_hardirqs_on+0x9c/0x150 [ 1956.236171][T32611] ? __ia32_sys_mount+0x20/0xc0 [ 1956.236194][T32611] __do_fast_syscall_32+0xb6/0x2b0 [ 1956.236225][T32611] ? lockdep_hardirqs_on+0x9c/0x150 [ 1956.236258][T32611] do_fast_syscall_32+0x34/0x80 [ 1956.236288][T32611] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1956.236315][T32611] RIP: 0023:0xf7fe5539 [ 1956.236336][T32611] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1956.236355][T32611] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000015 [ 1956.236379][T32611] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00000000800020c0 [ 1956.236394][T32611] RDX: 0000000080002100 RSI: 0000000000000000 RDI: 00000000800003c0 [ 1956.236409][T32611] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1956.236422][T32611] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1956.236436][T32611] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1956.236469][T32611] [ 1956.818271][T26209] usb 7-1: new high-speed USB device number 120 using dummy_hcd [ 1957.191415][T26209] usb 7-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1957.246218][T26209] usb 7-1: config 1 interface 1 altsetting 1 bulk endpoint 0x82 has invalid maxpacket 1024 [ 1957.319580][T26209] usb 7-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1957.360150][T32626] netlink: 36 bytes leftover after parsing attributes in process `syz.5.5879'. [ 1957.369809][T26209] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1957.468709][T26209] usb 7-1: Product: syz [ 1957.487973][T26209] usb 7-1: Manufacturer: syz [ 1957.529705][T26209] usb 7-1: SerialNumber: syz [ 1957.534164][T32623] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1957.558304][T32623] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1957.585231][T26209] cdc_mbim 7-1:1.0: skipping garbage [ 1957.598264][T32623] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1957.605686][T32623] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1957.618476][T32623] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1957.757252][T32615] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1958.103818][T32641] netlink: 'syz.9.5882': attribute type 10 has an invalid length. [ 1958.112054][T32641] netlink: 40 bytes leftover after parsing attributes in process `syz.9.5882'. [ 1958.154578][T32641] team0: Port device geneve0 added [ 1958.389255][T32615] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1958.415663][T26209] cdc_mbim 7-1:1.0: dwNtbInMaxSize=0 is too small. Using 2048 [ 1958.428479][T26209] cdc_mbim 7-1:1.0: setting rx_max = 2048 [ 1958.619989][T26209] cdc_mbim 7-1:1.0: setting tx_max = 184 [ 1958.632494][T26209] cdc_mbim 7-1:1.0: cdc-wdm0: USB WDM device [ 1958.703368][T26209] wwan wwan0: port wwan0mbim0 attached [ 1958.773479][T26209] cdc_mbim 7-1:1.0 wwan0: register 'cdc_mbim' at usb-dummy_hcd.6-1, CDC MBIM, 2e:b9:bc:d7:69:cf [ 1959.023655][T26209] usb 7-1: USB disconnect, device number 120 [ 1959.061371][T26209] cdc_mbim 7-1:1.0 wwan0: unregister 'cdc_mbim' usb-dummy_hcd.6-1, CDC MBIM [ 1959.313149][T17905] Bluetooth: hci5: command 0x0406 tx timeout [ 1959.447068][T26209] wwan wwan0: port wwan0mbim0 disconnected [ 1959.602243][T32662] mac80211_hwsim hwsim38 wlan0: entered promiscuous mode [ 1959.613386][T32656] netlink: 'syz.7.5887': attribute type 10 has an invalid length. [ 1959.621473][T17905] Bluetooth: hci3: command 0x0406 tx timeout [ 1959.621498][T32625] Bluetooth: hci2: command 0x0406 tx timeout [ 1959.629325][T17905] Bluetooth: hci0: command 0x0406 tx timeout [ 1959.654998][T32662] macsec1: entered promiscuous mode [ 1959.688286][T17905] Bluetooth: hci1: command 0x0c1a tx timeout [ 1959.721273][T32662] macsec1: entered allmulticast mode [ 1959.727453][T32662] mac80211_hwsim hwsim38 wlan0: entered allmulticast mode [ 1959.838906][T32656] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1960.117979][T11980] usb 10-1: new full-speed USB device number 112 using dummy_hcd [ 1960.222853][T32678] bridge0: entered promiscuous mode [ 1960.248214][T11980] usb 10-1: device descriptor read/64, error -71 [ 1960.518445][T11980] usb 10-1: new full-speed USB device number 113 using dummy_hcd [ 1960.658194][T11980] usb 10-1: device descriptor read/64, error -71 [ 1960.737203][T32695] net_ratelimit: 6 callbacks suppressed [ 1960.737223][T32695] netlink: zone id is out of range [ 1960.754048][T32695] netlink: set zone limit has 8 unknown bytes [ 1960.782008][T11980] usb usb10-port1: attempt power cycle [ 1961.128799][T11980] usb 10-1: new full-speed USB device number 114 using dummy_hcd [ 1961.143899][T32710] FAULT_INJECTION: forcing a failure. [ 1961.143899][T32710] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1961.157288][T32710] CPU: 0 UID: 0 PID: 32710 Comm: syz.5.5907 Not tainted syzkaller #0 PREEMPT(full) [ 1961.157314][T32710] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1961.157328][T32710] Call Trace: [ 1961.157336][T32710] [ 1961.157345][T32710] dump_stack_lvl+0x189/0x250 [ 1961.157378][T32710] ? __pfx____ratelimit+0x10/0x10 [ 1961.157404][T32710] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1961.157433][T32710] ? __pfx__printk+0x10/0x10 [ 1961.157453][T32710] ? __might_fault+0xb0/0x130 [ 1961.157494][T32710] should_fail_ex+0x414/0x560 [ 1961.157531][T32710] _copy_from_user+0x2d/0xb0 [ 1961.157558][T32710] __sys_sendto+0x25c/0x520 [ 1961.157593][T32710] ? __pfx___sys_sendto+0x10/0x10 [ 1961.157622][T32710] ? __mutex_unlock_slowpath+0x1a1/0x740 [ 1961.157663][T32710] ? __fget_files+0x3a0/0x420 [ 1961.157694][T32710] ? ksys_write+0x22a/0x250 [ 1961.157721][T32710] ? exc_page_fault+0x82/0x100 [ 1961.157748][T32710] ? __pfx_ksys_write+0x10/0x10 [ 1961.157783][T32710] __ia32_sys_sendto+0xdd/0x100 [ 1961.157824][T32710] __do_fast_syscall_32+0xb6/0x2b0 [ 1961.157853][T32710] ? lockdep_hardirqs_on+0x9c/0x150 [ 1961.157883][T32710] do_fast_syscall_32+0x34/0x80 [ 1961.157912][T32710] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1961.157937][T32710] RIP: 0023:0xf7fe5539 [ 1961.157956][T32710] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1961.157975][T32710] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000171 [ 1961.157996][T32710] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000000000000 [ 1961.158011][T32710] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000080000040 [ 1961.158024][T32710] RBP: 000000000000001c R08: 0000000000000000 R09: 0000000000000000 [ 1961.158036][T32710] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1961.158049][T32710] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1961.158099][T32710] [ 1961.169212][T11980] usb 10-1: device descriptor read/8, error -71 [ 1961.582581][T32721] netlink: 8 bytes leftover after parsing attributes in process `syz.5.5909'. [ 1961.608141][T11980] usb 10-1: new full-speed USB device number 115 using dummy_hcd [ 1961.638981][T11980] usb 10-1: device descriptor read/8, error -71 [ 1961.748360][T11980] usb usb10-port1: unable to enumerate USB device [ 1962.042216][ T30] audit: type=1800 audit(1761331775.954:1766): pid=32727 uid=0 auid=4294967295 ses=4294967295 subj=unconfined op=collect_data cause=failed comm="syz.6.5912" name="SYSV00000000" dev="tmpfs" ino=0 res=0 errno=0 [ 1962.280337][T32721] bond0: entered promiscuous mode [ 1962.292560][T32721] batadv0: entered promiscuous mode [ 1962.304894][T32721] hsr1: Slave A (bond0) is not up; please bring it up to get a fully working HSR network [ 1962.319862][T32721] 8021q: adding VLAN 0 to HW filter on device hsr1 [ 1962.371257][T32728] bond2: option arp_all_targets: invalid value (262144) [ 1962.382608][T32728] bond2 (unregistering): Released all slaves [ 1963.034196][T32734] tipc: Started in network mode [ 1963.052233][T32734] tipc: Node identity 2a86794fe8f6, cluster identity 4711 [ 1963.062506][T32734] tipc: Enabled bearer , priority 0 [ 1963.193695][T32735] syzkaller0: entered promiscuous mode [ 1963.234194][T32735] syzkaller0: entered allmulticast mode [ 1963.267548][T32734] sch_tbf: burst 0 is lower than device syzkaller0 mtu (1514) ! [ 1963.334390][T32735] tipc: Resetting bearer [ 1963.825861][T32733] tipc: Resetting bearer [ 1963.868835][T32733] tipc: Disabling bearer [ 1964.429189][T32718] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1964.438916][T11980] usb 10-1: new high-speed USB device number 116 using dummy_hcd [ 1964.569988][T32663] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 1964.580842][T32663] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 1964.592442][T32663] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 1964.600930][T11980] usb 10-1: Using ep0 maxpacket: 32 [ 1964.608461][T32663] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 1964.619280][T32663] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 1964.636081][T11980] usb 10-1: config 4 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1964.655159][T11980] usb 10-1: config 4 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1964.672916][T11980] usb 10-1: New USB device found, idVendor=046d, idProduct=c314, bcdDevice= 0.40 [ 1964.698520][T11980] usb 10-1: New USB device strings: Mfr=255, Product=255, SerialNumber=0 [ 1964.707007][T11980] usb 10-1: Product: syz [ 1964.718593][T11980] usb 10-1: Manufacturer: syz [ 1964.742029][T11980] hub 10-1:4.0: USB hub found [ 1964.875611][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1964.926409][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1964.945766][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1964.958304][T11980] hub 10-1:4.0: 2 ports detected [ 1964.978455][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1964.985787][ T5913] rtc rtc0: __rtc_set_alarm: err=-22 [ 1965.093107][ T302] netlink: 40 bytes leftover after parsing attributes in process `syz.8.5927'. [ 1965.237769][T32760] chnl_net:caif_netlink_parms(): no params data found [ 1965.375252][T11980] hub 10-1:4.0: set hub depth failed [ 1965.386296][ T305] netlink: 4 bytes leftover after parsing attributes in process `syz.5.5928'. [ 1965.443585][T11980] usb 10-1: USB disconnect, device number 116 [ 1965.630990][T32760] bridge0: port 1(bridge_slave_0) entered blocking state [ 1965.641335][T32760] bridge0: port 1(bridge_slave_0) entered disabled state [ 1965.654383][T32760] bridge_slave_0: entered allmulticast mode [ 1965.656321][ T311] netlink: 'syz.8.5929': attribute type 10 has an invalid length. [ 1965.663487][T32760] bridge_slave_0: entered promiscuous mode [ 1965.678940][T32760] bridge0: port 2(bridge_slave_1) entered blocking state [ 1965.686358][T32760] bridge0: port 2(bridge_slave_1) entered disabled state [ 1965.694391][T32760] bridge_slave_1: entered allmulticast mode [ 1965.704031][T32760] bridge_slave_1: entered promiscuous mode [ 1965.713999][ T311] netlink: 40 bytes leftover after parsing attributes in process `syz.8.5929'. [ 1965.782586][ T311] team0: Port device geneve0 added [ 1965.794822][ T312] FAULT_INJECTION: forcing a failure. [ 1965.794822][ T312] name failslab, interval 1, probability 0, space 0, times 0 [ 1965.812071][ T312] CPU: 0 UID: 0 PID: 312 Comm: syz.8.5929 Not tainted syzkaller #0 PREEMPT(full) [ 1965.812098][ T312] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1965.812111][ T312] Call Trace: [ 1965.812120][ T312] [ 1965.812130][ T312] dump_stack_lvl+0x189/0x250 [ 1965.812164][ T312] ? __pfx____ratelimit+0x10/0x10 [ 1965.812189][ T312] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1965.812227][ T312] ? __pfx__printk+0x10/0x10 [ 1965.812255][ T312] ? __pfx___might_resched+0x10/0x10 [ 1965.812283][ T312] should_fail_ex+0x414/0x560 [ 1965.812320][ T312] should_failslab+0xa8/0x100 [ 1965.812343][ T312] kmem_cache_alloc_lru_noprof+0x79/0x6d0 [ 1965.812378][ T312] ? __d_alloc+0x36/0x7a0 [ 1965.812408][ T312] __d_alloc+0x36/0x7a0 [ 1965.812436][ T312] d_alloc_parallel+0xe1/0x1610 [ 1965.812474][ T312] ? kasan_save_track+0x4f/0x80 [ 1965.812501][ T312] ? kasan_save_track+0x3e/0x80 [ 1965.812528][ T312] ? __kasan_slab_alloc+0x6c/0x80 [ 1965.812557][ T312] ? kmem_cache_alloc_noprof+0x367/0x6e0 [ 1965.812583][ T312] ? inode_init_always_gfp+0x9ed/0xdc0 [ 1965.812628][ T312] ? alloc_inode+0x82/0x1b0 [ 1965.812656][ T312] ? new_inode+0x22/0x170 [ 1965.812683][ T312] ? __lock_acquire+0xab9/0xd20 [ 1965.812711][ T312] ? __pfx_d_alloc_parallel+0x10/0x10 [ 1965.812744][ T312] ? __raw_spin_lock_init+0x45/0x100 [ 1965.812777][ T312] ? __init_waitqueue_head+0xa9/0x150 [ 1965.812812][ T312] __lookup_slow+0x116/0x3d0 [ 1965.812842][ T312] ? __pfx___lookup_slow+0x10/0x10 [ 1965.812879][ T312] ? d_lookup+0x8a/0xa0 [ 1965.812905][ T312] ? lookup_noperm+0x112/0x220 [ 1965.812944][ T312] simple_start_creating+0xfd/0x1e0 [ 1965.812967][ T312] ? __pfx_simple_start_creating+0x10/0x10 [ 1965.813004][ T312] debugfs_start_creating+0x10f/0x180 [ 1965.813047][ T312] __debugfs_create_file+0x79/0x4f0 [ 1965.813085][ T312] debugfs_create_file_short+0x3f/0x60 [ 1965.813121][ T312] ieee80211_debugfs_recreate_netdev+0x268/0x1460 [ 1965.813162][ T312] ? __pfx_ieee80211_debugfs_recreate_netdev+0x10/0x10 [ 1965.813198][ T312] ? ieee80211_setup_sdata+0x8cd/0xb50 [ 1965.813234][ T312] ieee80211_if_add+0xc17/0x1390 [ 1965.813275][ T312] ieee80211_add_iface+0xb5/0x5c0 [ 1965.813309][ T312] ? __pfx_ieee80211_add_iface+0x10/0x10 [ 1965.813346][ T312] nl80211_new_interface+0x893/0x11a0 [ 1965.813383][ T312] ? __pfx_nl80211_new_interface+0x10/0x10 [ 1965.813421][ T312] ? nl80211_pre_doit+0x4fb/0x930 [ 1965.813451][ T312] genl_family_rcv_msg_doit+0x215/0x300 [ 1965.813502][ T312] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 1965.813544][ T312] ? bpf_lsm_capable+0x9/0x20 [ 1965.813570][ T312] ? security_capable+0x7e/0x2e0 [ 1965.813608][ T312] genl_rcv_msg+0x60e/0x790 [ 1965.813641][ T312] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1965.813665][ T312] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 1965.813685][ T312] ? __pfx_nl80211_new_interface+0x10/0x10 [ 1965.813707][ T312] ? __pfx_nl80211_post_doit+0x10/0x10 [ 1965.813731][ T312] ? __asan_memcpy+0x40/0x70 [ 1965.813759][ T312] ? __pfx_ref_tracker_free+0x10/0x10 [ 1965.813789][ T312] netlink_rcv_skb+0x208/0x470 [ 1965.813819][ T312] ? __lock_acquire+0xab9/0xd20 [ 1965.813840][ T312] ? __pfx_genl_rcv_msg+0x10/0x10 [ 1965.813867][ T312] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 1965.813922][ T312] ? down_read+0x1ad/0x2e0 [ 1965.813956][ T312] genl_rcv+0x28/0x40 [ 1965.813980][ T312] netlink_unicast+0x82f/0x9e0 [ 1965.814021][ T312] ? __pfx_netlink_unicast+0x10/0x10 [ 1965.814053][ T312] ? netlink_sendmsg+0x642/0xb30 [ 1965.814071][ T312] ? skb_put+0x11b/0x210 [ 1965.814096][ T312] netlink_sendmsg+0x805/0xb30 [ 1965.814127][ T312] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1965.814164][ T312] ? __import_iovec+0x5d4/0x7f0 [ 1965.814189][ T312] ? aa_sock_msg_perm+0xf1/0x1d0 [ 1965.814223][ T312] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 1965.814243][ T312] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1965.814278][ T312] __sock_sendmsg+0x21c/0x270 [ 1965.814317][ T312] ____sys_sendmsg+0x505/0x830 [ 1965.814346][ T312] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1965.814394][ T312] ___sys_sendmsg+0x21f/0x2a0 [ 1965.814420][ T312] ? __pfx____sys_sendmsg+0x10/0x10 [ 1965.814489][ T312] ? __fget_files+0x2a/0x420 [ 1965.814509][ T312] ? __fget_files+0x3a0/0x420 [ 1965.814542][ T312] __sys_sendmsg+0x164/0x220 [ 1965.814567][ T312] ? __pfx___sys_sendmsg+0x10/0x10 [ 1965.814601][ T312] ? __pfx_ksys_write+0x10/0x10 [ 1965.814636][ T312] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1965.814668][ T312] ? lockdep_hardirqs_on+0x9c/0x150 [ 1965.814699][ T312] __do_fast_syscall_32+0xb6/0x2b0 [ 1965.814731][ T312] ? lockdep_hardirqs_on+0x9c/0x150 [ 1965.814764][ T312] do_fast_syscall_32+0x34/0x80 [ 1965.814793][ T312] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1965.814820][ T312] RIP: 0023:0xf7fa2539 [ 1965.814846][ T312] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1965.814865][ T312] RSP: 002b:00000000f547555c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1965.814888][ T312] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800004c0 [ 1965.814904][ T312] RDX: 000000002400c890 RSI: 0000000000000000 RDI: 0000000000000000 [ 1965.814918][ T312] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1965.814930][ T312] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1965.814943][ T312] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1965.814978][ T312] [ 1966.402627][T32760] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 1966.503364][T32760] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 1966.748117][T32663] Bluetooth: hci0: command tx timeout [ 1966.773143][T32760] team0: Port device team_slave_0 added [ 1966.798763][T32760] team0: Port device team_slave_1 added [ 1967.232112][T32760] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 1967.260371][T32760] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1967.377027][T32760] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 1967.520710][T32760] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 1967.552475][T32760] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 1967.600013][T32760] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 1967.684277][T26570] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1967.783353][ T336] mac80211_hwsim hwsim45 wlan0: entered promiscuous mode [ 1967.790910][ T336] macsec1: entered promiscuous mode [ 1967.796462][ T336] macsec1: entered allmulticast mode [ 1967.802935][ T336] mac80211_hwsim hwsim45 wlan0: entered allmulticast mode [ 1968.092218][ T344] fuse: Bad value for 'fd' [ 1968.107533][T26570] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1968.256740][T26570] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1968.343266][T32760] hsr_slave_0: entered promiscuous mode [ 1968.350818][T32760] hsr_slave_1: entered promiscuous mode [ 1968.363574][T32760] debugfs: 'hsr0' already exists in 'hsr' [ 1968.374241][T32760] Cannot create hsr debugfs directory [ 1968.440858][T26570] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 1968.808984][T32663] Bluetooth: hci0: command tx timeout [ 1968.923949][T26570] bridge_slave_1: left allmulticast mode [ 1968.930633][T26570] bridge_slave_1: left promiscuous mode [ 1968.936780][T26570] bridge0: port 2(bridge_slave_1) entered disabled state [ 1968.974433][T26570] bridge_slave_0: left allmulticast mode [ 1968.980708][T26570] bridge_slave_0: left promiscuous mode [ 1968.986994][T26570] bridge0: port 1(bridge_slave_0) entered disabled state [ 1969.240453][ T350] FAULT_INJECTION: forcing a failure. [ 1969.240453][ T350] name failslab, interval 1, probability 0, space 0, times 0 [ 1969.255151][ T350] CPU: 1 UID: 0 PID: 350 Comm: syz.9.5940 Not tainted syzkaller #0 PREEMPT(full) [ 1969.255181][ T350] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 1969.255195][ T350] Call Trace: [ 1969.255204][ T350] [ 1969.255214][ T350] dump_stack_lvl+0x189/0x250 [ 1969.255250][ T350] ? __pfx____ratelimit+0x10/0x10 [ 1969.255276][ T350] ? __pfx_dump_stack_lvl+0x10/0x10 [ 1969.255307][ T350] ? __pfx__printk+0x10/0x10 [ 1969.255336][ T350] ? __pfx___might_resched+0x10/0x10 [ 1969.255360][ T350] ? fs_reclaim_acquire+0x7d/0x100 [ 1969.255399][ T350] should_fail_ex+0x414/0x560 [ 1969.255445][ T350] should_failslab+0xa8/0x100 [ 1969.255469][ T350] __kmalloc_noprof+0xcb/0x7f0 [ 1969.255499][ T350] ? sock_kmalloc+0xd6/0x160 [ 1969.255528][ T350] sock_kmalloc+0xd6/0x160 [ 1969.255552][ T350] cmsghdr_from_user_compat_to_kern+0x2c9/0x800 [ 1969.255573][ T350] ? __might_fault+0xb0/0x130 [ 1969.255608][ T350] ? __pfx_cmsghdr_from_user_compat_to_kern+0x10/0x10 [ 1969.255643][ T350] ____sys_sendmsg+0x20f/0x830 [ 1969.255672][ T350] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1969.255710][ T350] ___sys_sendmsg+0x21f/0x2a0 [ 1969.255735][ T350] ? __pfx____sys_sendmsg+0x10/0x10 [ 1969.255794][ T350] ? __fget_files+0x2a/0x420 [ 1969.255813][ T350] ? __fget_files+0x3a0/0x420 [ 1969.255844][ T350] __sys_sendmsg+0x164/0x220 [ 1969.255868][ T350] ? __pfx___sys_sendmsg+0x10/0x10 [ 1969.255899][ T350] ? __pfx_ksys_write+0x10/0x10 [ 1969.255932][ T350] ? syscall_enter_from_user_mode_prepare+0x8f/0x110 [ 1969.255961][ T350] ? lockdep_hardirqs_on+0x9c/0x150 [ 1969.255999][ T350] __do_fast_syscall_32+0xb6/0x2b0 [ 1969.256029][ T350] ? lockdep_hardirqs_on+0x9c/0x150 [ 1969.256060][ T350] do_fast_syscall_32+0x34/0x80 [ 1969.256089][ T350] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 1969.256116][ T350] RIP: 0023:0xf705d539 [ 1969.256136][ T350] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 1969.256156][ T350] RSP: 002b:00000000f544d55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 1969.256179][ T350] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000400 [ 1969.256194][ T350] RDX: 0000000024004091 RSI: 0000000000000000 RDI: 0000000000000000 [ 1969.256208][ T350] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 1969.256221][ T350] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 1969.256234][ T350] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 1969.256267][ T350] [ 1969.919046][T26570] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 1969.930986][T26570] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 1969.941524][T26570] bond0 (unregistering): Released all slaves [ 1970.094550][ T335] Bluetooth: hci5: Opcode 0x0c1a failed: -110 [ 1970.094597][T32663] Bluetooth: hci5: command 0x0406 tx timeout [ 1970.111425][T26570] bond1 (unregistering): Released all slaves [ 1970.234039][ T335] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1970.246475][T26570] tipc: Disabling bearer [ 1970.263077][ T335] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1970.271566][T26570] tipc: Left network mode [ 1970.283230][ T335] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1970.304753][ T335] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1970.313549][ T335] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1970.335306][ T335] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 1970.598799][T26209] usb 10-1: new high-speed USB device number 117 using dummy_hcd [ 1970.771940][T26209] usb 10-1: Using ep0 maxpacket: 8 [ 1970.794196][T26209] usb 10-1: unable to get BOS descriptor or descriptor too short [ 1970.813826][T26209] usb 10-1: config 8 interface 0 altsetting 7 endpoint 0x83 has invalid wMaxPacketSize 0 [ 1970.847299][T26209] usb 10-1: config 8 interface 0 altsetting 7 bulk endpoint 0x83 has invalid maxpacket 0 [ 1970.879981][T26209] usb 10-1: config 8 interface 0 has no altsetting 0 [ 1970.896739][ T366] netlink: 'syz.5.5942': attribute type 10 has an invalid length. [ 1970.917347][T26209] usb 10-1: New USB device found, idVendor=07fd, idProduct=0001, bcdDevice=6a.e5 [ 1970.932256][ T366] netlink: 40 bytes leftover after parsing attributes in process `syz.5.5942'. [ 1970.954166][T26209] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1970.988530][T26209] usb 10-1: Product: syz [ 1970.993193][T26209] usb 10-1: Manufacturer: syz [ 1971.008097][T26209] usb 10-1: SerialNumber: syz [ 1971.138453][ T366] team0: Port device geneve0 added [ 1971.384393][T26209] usb 10-1: Quirk or no altset; falling back to MIDI 1.0 [ 1971.459836][T26209] usb 10-1: selecting invalid altsetting 0 [ 1971.539491][T26209] snd-usb-audio 10-1:8.0: probe with driver snd-usb-audio failed with error -12 [ 1971.572718][T26209] usb 10-1: USB disconnect, device number 117 [ 1971.610576][T26570] mac80211_hwsim hwsim38 wlan0 (unregistering): left allmulticast mode [ 1971.677514][T12229] udevd[12229]: error opening ATTR{/sys/devices/platform/dummy_hcd.9/usb10/10-1/10-1:8.0/sound/card3/controlC3/../uevent} for writing: No such file or directory [ 1971.707936][T12103] usb 6-1: new high-speed USB device number 9 using dummy_hcd [ 1971.712094][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.730120][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.740197][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.748989][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.760905][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.811404][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.819602][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.827055][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.836065][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.850860][ T5913] hid-generic 0002:0004:0009.0075: unknown main item tag 0x0 [ 1971.858040][T12103] usb 6-1: device descriptor read/64, error -71 [ 1971.867412][ T5913] hid-generic 0002:0004:0009.0075: hidraw0: HID v0.04 Device [syz0] on syz0 [ 1971.887568][T26570] hsr_slave_0: left promiscuous mode [ 1971.913701][T26570] hsr_slave_1: left promiscuous mode [ 1971.938716][T26570] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1971.956404][T26570] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 1971.976724][T26570] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1971.988456][ T391] fido_id[391]: Failed to open report descriptor at '/sys/devices/virtual/misc/uhid/report_descriptor': No such file or directory [ 1972.007923][T26570] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 1972.056095][T26570] veth1_macvtap: left promiscuous mode [ 1972.070412][T26570] veth0_macvtap: left promiscuous mode [ 1972.076480][T26570] veth1_vlan: left promiscuous mode [ 1972.084369][T26570] veth0_vlan: left promiscuous mode [ 1972.127948][T12103] usb 6-1: new high-speed USB device number 10 using dummy_hcd [ 1972.158131][ T5913] usb 9-1: new high-speed USB device number 120 using dummy_hcd [ 1972.168381][T32663] Bluetooth: hci2: command 0x0406 tx timeout [ 1972.276715][T12103] usb 6-1: device descriptor read/64, error -71 [ 1972.329202][T32663] Bluetooth: hci0: command 0x0419 tx timeout [ 1972.335315][T32663] Bluetooth: hci1: command 0x0c1a tx timeout [ 1972.338452][T17905] Bluetooth: hci3: command 0x0406 tx timeout [ 1972.370468][ T5913] usb 9-1: New USB device found, idVendor=0af0, idProduct=7a05, bcdDevice=f6.00 [ 1972.380398][ T5913] usb 9-1: New USB device strings: Mfr=0, Product=2, SerialNumber=3 [ 1972.388335][T12103] usb usb6-port1: attempt power cycle [ 1972.388733][ T5913] usb 9-1: Product: syz [ 1972.398203][ T5913] usb 9-1: SerialNumber: syz [ 1972.408944][ T5913] usb 9-1: config 0 descriptor?? [ 1972.658280][T11894] usb 10-1: new high-speed USB device number 118 using dummy_hcd [ 1972.738010][T12103] usb 6-1: new high-speed USB device number 11 using dummy_hcd [ 1972.785007][T12103] usb 6-1: device descriptor read/8, error -71 [ 1972.872265][T11894] usb 10-1: New USB device found, idVendor=a168, idProduct=0618, bcdDevice=e3.a4 [ 1972.892738][T11894] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1972.907448][T11894] usb 10-1: Product: syz [ 1972.927155][T11894] usb 10-1: Manufacturer: syz [ 1973.004699][T11894] usb 10-1: SerialNumber: syz [ 1973.089566][T12103] usb 6-1: new high-speed USB device number 12 using dummy_hcd [ 1973.201697][T12103] usb 6-1: device descriptor read/8, error -71 [ 1973.279312][T11894] usb 10-1: config 0 descriptor?? [ 1973.305027][T11894] gspca_main: gspca_sn9c20x-2.14.0 probing a168:0618 [ 1973.398502][T12103] usb usb6-port1: unable to enumerate USB device [ 1973.564663][ T402] netlink: 'syz.9.5954': attribute type 11 has an invalid length. [ 1973.675329][T26570] team0 (unregistering): Port device team_slave_1 removed [ 1973.818217][T11894] gspca_sn9c20x: Write register 1000 failed -110 [ 1973.824610][T11894] gspca_sn9c20x: Device initialization failed [ 1973.832268][T11894] gspca_sn9c20x 10-1:0.0: probe with driver gspca_sn9c20x failed with error -110 [ 1974.476613][T17905] Bluetooth: hci0: command 0x0419 tx timeout [ 1975.718016][T11980] usb 6-1: new high-speed USB device number 13 using dummy_hcd [ 1975.801672][ T5913] usb 9-1: USB disconnect, device number 120 [ 1975.879654][T32760] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 1975.882981][T11980] usb 6-1: New USB device found, idVendor=0572, idProduct=cb01, bcdDevice=26.65 [ 1975.918678][T11980] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1975.936683][T11980] usb 6-1: Product: syz [ 1975.944996][T11980] usb 6-1: Manufacturer: syz [ 1975.959826][T32760] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 1975.962598][T11980] usb 6-1: SerialNumber: syz [ 1975.982660][T11980] usb 6-1: config 0 descriptor?? [ 1976.013177][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 1976.023339][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 1976.036000][T32760] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 1976.096771][T32760] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 1976.154491][ T5913] usb 10-1: USB disconnect, device number 118 [ 1976.488352][T17905] Bluetooth: hci0: command 0x0419 tx timeout [ 1976.815495][T32760] 8021q: adding VLAN 0 to HW filter on device bond0 [ 1976.972887][T32760] 8021q: adding VLAN 0 to HW filter on device team0 [ 1977.121114][T26569] bridge0: port 1(bridge_slave_0) entered blocking state [ 1977.128364][T26569] bridge0: port 1(bridge_slave_0) entered forwarding state [ 1977.225041][T12735] bridge0: port 2(bridge_slave_1) entered blocking state [ 1977.232287][T12735] bridge0: port 2(bridge_slave_1) entered forwarding state [ 1977.566820][T32760] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 1977.804661][T32760] veth0_vlan: entered promiscuous mode [ 1977.858873][T32760] veth1_vlan: entered promiscuous mode [ 1977.950933][ T468] netlink: 4 bytes leftover after parsing attributes in process `syz.9.5964'. [ 1978.109644][T32760] veth0_macvtap: entered promiscuous mode [ 1978.147490][T32760] veth1_macvtap: entered promiscuous mode [ 1978.214069][T32760] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 1978.263032][T32760] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 1978.339593][T26570] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 1978.406618][T26570] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 1978.454081][T26570] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 1978.573750][T17905] Bluetooth: hci0: command 0x0419 tx timeout [ 1978.584218][T11980] cx82310_eth 6-1:0.0: probe with driver cx82310_eth failed with error -22 [ 1978.605649][T11980] cxacru 6-1:0.0: usbatm_usb_probe: bind failed: -19! [ 1978.610985][T26569] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 1978.630872][T11980] usb 6-1: USB disconnect, device number 13 [ 1979.246980][T12735] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1979.350384][T12735] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1979.859304][T21158] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 1979.867155][T21158] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 1983.179868][ T533] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 1983.189209][ T533] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1983.204916][ T533] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1983.216865][ T533] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1983.226418][ T533] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1984.536294][ T568] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5983'. [ 1984.917128][ T572] netlink: 16 bytes leftover after parsing attributes in process `syz.5.5983'. [ 1984.968568][ T568] netlink: 68 bytes leftover after parsing attributes in process `syz.5.5983'. [ 1985.293075][T32663] Bluetooth: hci0: command 0x0419 tx timeout [ 1985.299594][T32663] Bluetooth: hci1: command 0x0c1a tx timeout [ 1985.320818][T32663] Bluetooth: hci3: command 0x0406 tx timeout [ 1985.327150][T32663] Bluetooth: hci2: command 0x0406 tx timeout [ 1985.333247][T32663] Bluetooth: hci5: command 0x0406 tx timeout [ 1985.545087][ T520] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1985.873803][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1986.067407][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1986.205424][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1986.303828][ T5913] rtc_cmos 00:00: Alarms can be up to one day in the future [ 1986.311955][ T5913] rtc rtc0: __rtc_set_alarm: err=-22 [ 1988.179858][ T897] usb 3-1: new high-speed USB device number 65 using dummy_hcd [ 1988.331430][ T897] usb 3-1: device descriptor read/64, error -71 [ 1988.588193][ T897] usb 3-1: new high-speed USB device number 66 using dummy_hcd [ 1988.758215][ T897] usb 3-1: device descriptor read/64, error -71 [ 1988.880669][ T897] usb usb3-port1: attempt power cycle [ 1989.218829][ T897] usb 3-1: new high-speed USB device number 67 using dummy_hcd [ 1989.258582][ T897] usb 3-1: device descriptor read/8, error -71 [ 1989.507980][ T897] usb 3-1: new high-speed USB device number 68 using dummy_hcd [ 1989.543875][ T897] usb 3-1: device descriptor read/8, error -71 [ 1989.658279][ T897] usb usb3-port1: unable to enumerate USB device [ 2027.208219][ C1] ip6_tunnel: ip6gre1 xmit: Local address not yet configured! [ 2037.462810][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 2037.469320][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 2098.891645][ T1301] ieee802154 phy0 wpan0: encryption failed: -22 [ 2098.898201][ T1301] ieee802154 phy1 wpan1: encryption failed: -22 [ 2104.012591][T12104] kworker/0:9 (12104) used greatest stack depth: 15864 bytes left [ 2148.168099][ T31] INFO: task kworker/1:8:5974 blocked for more than 143 seconds. [ 2148.176041][ T31] Not tainted syzkaller #0 [ 2148.181246][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 2148.190031][ T31] task:kworker/1:8 state:D stack:23048 pid:5974 tgid:5974 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 2148.202165][ T31] Workqueue: usb_hub_wq hub_event [ 2148.207229][ T31] Call Trace: [ 2148.210747][ T31] [ 2148.213701][ T31] __schedule+0x1798/0x4cc0 [ 2148.218284][ T31] ? __pfx_do_raw_spin_lock+0x10/0x10 [ 2148.223684][ T31] ? __pfx___schedule+0x10/0x10 [ 2148.228658][ T31] ? schedule+0x91/0x360 [ 2148.232930][ T31] schedule+0x165/0x360 [ 2148.237104][ T31] usb_kill_urb+0x1be/0x2d0 [ 2148.241708][ T31] ? __pfx_usb_kill_urb+0x10/0x10 [ 2148.247081][ T31] ? __pfx_autoremove_wake_function+0x10/0x10 [ 2148.253383][ T31] usb_start_wait_urb+0x18c/0x4c0 [ 2148.258490][ T31] ? __pfx_usb_start_wait_urb+0x10/0x10 [ 2148.264072][ T31] ? usb_alloc_urb+0x46/0x150 [ 2148.268865][ T31] usb_control_msg+0x232/0x3e0 [ 2148.273680][ T31] hub_port_init+0xbf9/0x2800 [ 2148.278462][ T31] hub_event+0x2532/0x4a20 [ 2148.282948][ T31] ? __pfx_hub_event+0x10/0x10 [ 2148.287717][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 2148.293521][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2148.298788][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 2148.304543][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 2148.310368][ T31] process_scheduled_works+0xae1/0x17b0 [ 2148.315957][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 2148.322021][ T31] worker_thread+0x8a0/0xda0 [ 2148.326646][ T31] ? __kthread_parkme+0x7b/0x200 [ 2148.331715][ T31] kthread+0x711/0x8a0 [ 2148.335819][ T31] ? __pfx_worker_thread+0x10/0x10 [ 2148.341004][ T31] ? __pfx_kthread+0x10/0x10 [ 2148.345616][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2148.351344][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2148.356583][ T31] ? __pfx_kthread+0x10/0x10 [ 2148.361251][ T31] ret_from_fork+0x4bc/0x870 [ 2148.365864][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2148.371030][ T31] ? __switch_to_asm+0x39/0x70 [ 2148.375805][ T31] ? __switch_to_asm+0x33/0x70 [ 2148.380629][ T31] ? __pfx_kthread+0x10/0x10 [ 2148.385250][ T31] ret_from_fork_asm+0x1a/0x30 [ 2148.390089][ T31] [ 2148.393216][ T31] [ 2148.393216][ T31] Showing all locks held in the system: [ 2148.401043][ T31] 1 lock held by khungtaskd/31: [ 2148.405911][ T31] #0: ffffffff8df3d2e0 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 2148.418461][ T31] 1 lock held by klogd/5187: [ 2148.423080][ T31] #0: ffff8880b883a058 (&rq->__lock){-.-.}-{2:2}, at: raw_spin_rq_lock_nested+0xad/0x140 [ 2148.433082][ T31] 2 locks held by getty/5587: [ 2148.437821][ T31] #0: ffff88814e05b0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 2148.447618][ T31] #1: ffffc9000332b2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 2148.458323][ T31] 5 locks held by kworker/1:8/5974: [ 2148.463549][ T31] #0: ffff88801d6f9148 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 2148.474921][ T31] #1: ffffc9000485fba0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 2148.486832][ T31] #2: ffff8881463dc198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 2148.495782][ T31] #3: ffff8881463df518 (&port_dev->status_lock){+.+.}-{4:4}, at: hub_event+0x21b8/0x4a20 [ 2148.505806][ T31] #4: ffff88814638c368 (hcd->address0_mutex){+.+.}-{4:4}, at: hub_event+0x21e5/0x4a20 [ 2148.515564][ T31] 6 locks held by kworker/u8:12/12729: [ 2148.521124][ T31] [ 2148.523499][ T31] ============================================= [ 2148.523499][ T31] [ 2148.531985][ T31] NMI backtrace for cpu 0 [ 2148.532002][ T31] CPU: 0 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 2148.532024][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 2148.532037][ T31] Call Trace: [ 2148.532047][ T31] [ 2148.532056][ T31] dump_stack_lvl+0x189/0x250 [ 2148.532094][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 2148.532126][ T31] ? __pfx__printk+0x10/0x10 [ 2148.532162][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 2148.532187][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 2148.532213][ T31] ? __pfx__printk+0x10/0x10 [ 2148.532278][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 2148.532318][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 2148.532344][ T31] watchdog+0xf60/0xfa0 [ 2148.532372][ T31] ? watchdog+0x1e2/0xfa0 [ 2148.532401][ T31] kthread+0x711/0x8a0 [ 2148.532434][ T31] ? __pfx_watchdog+0x10/0x10 [ 2148.532456][ T31] ? __pfx_kthread+0x10/0x10 [ 2148.532488][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 2148.532514][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 2148.532541][ T31] ? __pfx_kthread+0x10/0x10 [ 2148.532571][ T31] ret_from_fork+0x4bc/0x870 [ 2148.532598][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 2148.532628][ T31] ? __switch_to_asm+0x39/0x70 [ 2148.532647][ T31] ? __switch_to_asm+0x33/0x70 [ 2148.532664][ T31] ? __pfx_kthread+0x10/0x10 [ 2148.532695][ T31] ret_from_fork_asm+0x1a/0x30 [ 2148.532730][ T31] [ 2148.532739][ T31] Sending NMI from CPU 0 to CPUs 1: [ 2148.678606][ C1] NMI backtrace for cpu 1 [ 2148.678623][ C1] CPU: 1 UID: 0 PID: 0 Comm: swapper/1 Not tainted syzkaller #0 PREEMPT(full) [ 2148.678643][ C1] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/02/2025 [ 2148.678655][ C1] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 2148.678682][ C1] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d 33 21 22 00 f3 0f 1e fa fb f4 c8 e6 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 2148.678698][ C1] RSP: 0018:ffffc90000197de0 EFLAGS: 000002c6 [ 2148.678714][ C1] RAX: 27adbe1ed875c300 RBX: ffffffff81967b87 RCX: 27adbe1ed875c300 [ 2148.678728][ C1] RDX: 0000000000000001 RSI: ffffffff8d70bd6a RDI: ffffffff8bbf0460 [ 2148.678741][ C1] RBP: ffffc90000197f10 R08: ffff8880b8932fdb R09: 1ffff110171265fb [ 2148.678754][ C1] R10: dffffc0000000000 R11: ffffed10171265fc R12: ffffffff8f7cd370 [ 2148.678768][ C1] R13: 0000000000000001 R14: 0000000000000001 R15: 1ffff11003951b58 [ 2148.678779][ C1] FS: 0000000000000000(0000) GS:ffff88812623e000(0000) knlGS:0000000000000000 [ 2148.678794][ C1] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 2148.678805][ C1] CR2: 0000555b6ad63168 CR3: 000000000dd38000 CR4: 00000000003526f0 [ 2148.678821][ C1] DR0: 0000000000000000 DR1: 0000000000000000 DR2: 0000000000000000 [ 2148.678832][ C1] DR3: 000000000000000e DR6: 00000000ffff0ff0 DR7: 0000000000000400 [ 2148.678843][ C1] Call Trace: [ 2148.678851][ C1] [ 2148.678858][ C1] default_idle+0x13/0x20 [ 2148.678883][ C1] default_idle_call+0x73/0xb0 [ 2148.678909][ C1] do_idle+0x1e7/0x510 [ 2148.678928][ C1] ? asm_sysvec_call_function_single+0x1a/0x20 [ 2148.678950][ C1] ? __pfx_do_idle+0x10/0x10 [ 2148.678973][ C1] ? do_idle+0x4e7/0x510 [ 2148.678993][ C1] cpu_startup_entry+0x44/0x60 [ 2148.679013][ C1] start_secondary+0x101/0x110 [ 2148.679039][ C1] common_startup_64+0x13e/0x147 [ 2148.679072][ C1]