last executing test programs: 47m45.492402849s ago: executing program 32 (id=17): r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, 0x0) sendmsg$nl_route_sched(r0, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f0000000480)=@abs={0x0, 0x0, 0x8004e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$tipc(&(0x7f0000000000), 0xffffffffffffffff) sendmsg$TIPC_CMD_GET_NODES(r4, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000480)={0x6f, r5, 0x1, 0x0, 0x0, {{}, {0x0, 0x6}}}, 0xfd53}, 0x1, 0x0, 0x0, 0x40000}, 0x0) 47m19.95261361s ago: executing program 33 (id=64): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x800008b}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000002000)=""/102400, 0x19000) ioctl$IOCTL_VMCI_SET_NOTIFY(0xffffffffffffffff, 0x7cb, &(0x7f0000000040)={0x2, 0x80, 0x3}) ioctl$sock_ipv6_tunnel_SIOCCHGTUNNEL(0xffffffffffffffff, 0x89f3, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x15) semget$private(0x0, 0x20000000102, 0x0) 46m40.98315474s ago: executing program 34 (id=97): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_open_dev$char_usb(0xc, 0xb4, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0x14, 0x0, 0x0) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xf, 0x0, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x4e22, @multicast1}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) 25m20.379735836s ago: executing program 35 (id=5831): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000280), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x111, 0x6}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000380)={0x3, 0x40, 0xfa00, {{0xa, 0x4e20, 0xb, @empty, 0x1}, {0xa, 0x4e22, 0x2, @remote, 0x80000000}, r1, 0xfffffe4d}}, 0x48) syz_emit_ethernet(0x2a, &(0x7f0000000040)=ANY=[@ANYBLOB="bbc3bbbbbbbb00000000000008060001080006040001000000000000ac1414"], 0x0) 24m32.249012166s ago: executing program 36 (id=5910): setsockopt$netlink_NETLINK_NO_ENOBUFS(0xffffffffffffffff, 0x10e, 0xc, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000380), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r3, 0xae60) ioctl$KVM_SET_USER_MEMORY_REGION(r3, 0x4020ae46, &(0x7f0000000400)={0x1ff, 0x1, 0x0, 0x1000, &(0x7f0000001000/0x1000)=nil}) r4 = ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) ioctl$KVM_SET_VAPIC_ADDR(r4, 0x4008ae93, &(0x7f0000000040)=0x4) ioctl$KVM_RUN(r4, 0xae80, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x101901, 0x0) ioctl$KVM_SET_GSI_ROUTING(0xffffffffffffffff, 0x4008ae6a, &(0x7f00000005c0)={0x1, 0x0, [{0x2, 0x2, 0x1, 0x0, @sint={0x4, 0x5a}}]}) ioctl$KVM_SET_LAPIC(r4, 0x4400ae8f, &(0x7f0000000440)={"db4c1421593cb4d3f8fe6094dc821bbbe06520701fc6de7b0349f34b0f8c556a9e9aff1355aab8d6da26d74608530f150f127f9e3f0a2f1fff0be9774c95d6c007c91903f78616596487bf50017c56b15385ab264cba5b168c62d971e67e6f3e73d60b5a8adbaaf2af8610c6a91c0a116f619adce4aa91d5a68faf8ee98693d32d8d8244381b5720ef596600e39491d216c22d0725904bab7d90fa8afb8fa04b707410aa300ef098609b4fa6dd77b1b7c321b1fc6356564ce3f90826be3a9a5be186ffc48eb13824e9dae77ed212a0f802074ff4f1725c4ad88cf5bbd36e3406bc59d96e82047631d8be9462ee7e54e5b2897c3fff38eabf67e1e160c2b5e18be06457844d89c9a606b7d25fbde713f4759da0bee1fabe3f71dcca63540f113a2b5edc4b327d1f9610377b97265d4aa875b4bc3c44bf8110d5df1beb1fe54794a0aa52dfc80df1caf7d812b4f1cdba1a6836b45ea2180d08439d411ce8e0755868cc839eaeac73e5d28f9f1990584038cf5fa6bee0c4095a27cc8c7b59519bf2a9bf1fedf54cc2dc6aea6c42c32de40c291e5f422f5c7792a08926af160fb379576dd81bac746232fb246817fc3248097914b75e83cc5eb518ce8fb643b34ca69c3b61f0d94e7db62dd480198d41e0862f1ec4429ab637569884a5ba446a0b09edfd986a2b3e15ee35bbd18610dad6271681ed240b0ffab9199b541013c0aadc36484da57511896c14776a41602aa1426edfbb828897d9c218b7936a0572840ebbc796e888a439b24e640324b511deb6ed0b2ce2f7567447826944b4f34101e492e8d20a2deda950e96e78f86d6d4c976f0c99041c94944309e6ce08d84a7c96677d570d9a57ec0506a4321d9e049b55be883ca3648c27772fc5dbaea5e6c2ded2ce72fb68989ae381fe1394cf6966ab04285d5ff8256bc2e85462b8d89aeeebd5432157c945b5dc1960d9282c6cc007fe029325d6078aef94d4954f956c71bcdf846f41392ebe0d3b289438d24ec4bc073617459a6b232445dd636a9f21140e14b162fd5ef1d626b0ff84884fd63d22cc1b05befb77ea937f3045cc15b125479b262c1e32fca75a5468423288c5776efee744b1fccb5e6d661d9d287cfa8582c96ea34a33c1bbc29c0035657da66a87150bbb885be5ee123e431fd793ea179a0fc77aaee66d874c0616cb32324826b36d0e27d14217ad1131cace3bae4ef82dfbc790e78de53a9bfbdb468bf0eb3ff134073b380858965de2d108862daf3fc6b49ad46f20832238aeaa5d010cf08e37938f0bb7bbeaa970c39ce9327a16fe07565708266ce9ef639bfa08538693b456228aa1c370d64ef9795b7cc208a2c528d381a042d149ed5c7f34ed26a7d5a4401b86434f054389e5dac7a4ee896e406d7b27240d925d478e0eb2202797832d3e2c74f4925ad58377b0d6ae9b97034f94"}) ioctl$KVM_RUN(r4, 0xae80, 0x0) ioctl$KVM_RUN(r4, 0xae80, 0x0) mprotect(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1) 23m20.46666459s ago: executing program 37 (id=6186): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000840)={0x18, 0x3, &(0x7f0000000380)=ANY=[@ANYRESDEC], &(0x7f0000000000)='GPL\x00', 0x2, 0xba, &(0x7f0000000140)=""/186, 0x41000, 0x2b, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x37}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) fsconfig$FSCONFIG_SET_STRING(0xffffffffffffffff, 0x1, &(0x7f0000000000)='source', &(0x7f00000000c0)='%(:2', 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, &(0x7f0000000280)={0x3, 0x7}, 0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r1, &(0x7f0000000040), 0x80002c1, 0x2, 0x0) mkdir(&(0x7f0000000400)='./file0\x00', 0x0) mount$9p_virtio(&(0x7f00000001c0), &(0x7f0000000480)='./file0\x00', 0x0, 0x8c, 0x0) setsockopt$inet_sctp6_SCTP_SOCKOPT_BINDX_ADD(0xffffffffffffffff, 0x84, 0x64, &(0x7f0000000040), 0x0) ioctl$vim2m_VIDIOC_QUERYBUF(0xffffffffffffffff, 0xc044560f, 0x0) mount(0x0, 0x0, &(0x7f00000000c0)='debugfs\x00', 0x1214040, 0x0) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', 0x0, 0x0, &(0x7f00000003c0)={[], [], 0x2f}) mount$overlay(0x0, &(0x7f0000000140)='./file0\x00', &(0x7f0000000180), 0x0, &(0x7f0000000040)={[{@xino_on}, {@lowerdir={'lowerdir', 0x3d, './file0'}, 0x3a}], [], 0x2f}) getdents64(0xffffffffffffffff, &(0x7f0000000400)=""/4096, 0x1000) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_int(r4, 0x29, 0x1a, &(0x7f0000000000)=0x6, 0x4) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000600)=ANY=[@ANYBLOB="5c0000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000420000003c00128008000100677470003000028008000200", @ANYRES32=r4], 0x5c}, 0x1, 0xba01}, 0x20000010) close(r4) 22m54.550601789s ago: executing program 38 (id=6267): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000300)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x2, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) ioctl$VHOST_SET_LOG_BASE(0xffffffffffffffff, 0x4004af61, &(0x7f0000000200)=0x0) r2 = socket(0x1e, 0x4, 0x0) setsockopt$packet_tx_ring(r2, 0x10f, 0x87, &(0x7f0000000140)=@req3={0x7813, 0x3, 0x0, 0x81, 0x1ff, 0x80000007, 0x1}, 0x1c) r3 = syz_io_uring_setup(0x110, &(0x7f0000000140)={0x0, 0xfad7, 0x10000, 0x3}, 0x0, &(0x7f0000000280)) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f00000003c0), 0x2, 0x0) r5 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x26e1, 0x0) close(r5) r6 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_ENABLE_STREAM_RESET(r6, 0x84, 0x76, &(0x7f0000000100)={0x0, 0x7}, 0x8) setsockopt$inet_sctp6_SCTP_RECONFIG_SUPPORTED(r6, 0x84, 0x75, &(0x7f0000000040)={0x0, 0x6d207ee5}, 0x8) bind$inet6(r6, &(0x7f00000002c0)={0xa, 0x4e23, 0x0, @loopback}, 0x1c) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=@newlink={0x28, 0x10, 0x1, 0x70bd25, 0x25dfdbfa, {0x0, 0x0, 0x0, 0x0, 0x40810}, [@IFLA_GROUP={0x8}]}, 0x28}, 0x1, 0x0, 0x0, 0x4008011}, 0x4004) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r6, 0x84, 0x77, &(0x7f00000003c0)={0x0, 0x3}, 0x8) setsockopt$inet_sctp6_SCTP_RESET_STREAMS(r6, 0x84, 0x77, &(0x7f0000000140)={0x0, 0xce13}, 0x8) r8 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) r9 = socket$inet_tcp(0x2, 0x1, 0x0) setsockopt$IPT_SO_SET_REPLACE(r9, 0x0, 0x40, &(0x7f00000015c0)=@raw={'raw\x00', 0x8, 0x3, 0x1208, 0x90, 0x11, 0x148, 0x90, 0x0, 0x1174, 0x2a8, 0x2a8, 0x1174, 0x2a8, 0x3, 0x0, {[{{@uncond, 0x0, 0x70, 0x90}, @unspec=@TRACE={0x20}}, {{@uncond, 0x0, 0x10c4, 0x10e4, 0x0, {}, [@common=@ttl={{0x24}, {0x2, 0x40}}, @common=@unspec=@cgroup1={{0x1030}, {0x0, 0x1, 0x1, 0x0, './cgroup.net/syz0\x00', 0x1, {0x8}}}]}, @unspec=@TRACE={0x20}}], {{'\x00', 0x0, 0x70, 0x94}, {0x24}}}}, 0x1264) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000040)={0xfffffeff}) close(r8) io_uring_enter(r3, 0x1f85, 0x40110a, 0x4d, 0x0, 0xa6) recvmmsg$unix(r2, &(0x7f00000007c0)=[{{0x0, 0x0, &(0x7f00000001c0)=[{&(0x7f00000005c0)=""/227, 0xe3}], 0x1}}, {{0x0, 0x0, &(0x7f00000002c0)=[{&(0x7f0000000340)=""/156, 0x9c}], 0x1}}], 0x2, 0x40000000, 0x0) 21m23.830257671s ago: executing program 39 (id=6545): set_mempolicy(0x3, &(0x7f0000000000)=0x7, 0x7) madvise(&(0x7f0000bdc000/0x4000)=nil, 0x86ac726dff2f4713, 0xa) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) set_mempolicy(0x4000, &(0x7f00000001c0)=0x5, 0x5) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x20040844) setsockopt$inet_sctp6_SCTP_STREAM_SCHEDULER(0xffffffffffffffff, 0x84, 0x7b, 0x0, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000000)='hugetlb.1GB.usage_in_bytes\x00', 0x275a, 0x0) write$binfmt_script(r2, &(0x7f00000004c0), 0x208e24b) madvise(&(0x7f0000000000/0x600000)=nil, 0x600003, 0x15) cachestat(r2, &(0x7f0000000040), &(0x7f000009de80), 0x0) 18m48.364942331s ago: executing program 40 (id=7067): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000001880)={{r0}, 0x0, 0x0}, 0x20) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x400000) ioctl$F2FS_IOC_GARBAGE_COLLECT_RANGE(r3, 0x4018f50b, &(0x7f0000000200)={0x1, 0x3, 0x6}) syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x10, 0x4, 0x3cc}, &(0x7f0000000040)=0x0, &(0x7f0000000140)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) socket$inet_sctp(0x2, 0x5, 0x84) r5 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x14d802, 0x0) r6 = dup(r5) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000002, 0x28011, r6, 0x2c93a000) ioctl$BLKFLSBUF(r5, 0x1261, 0x0) socket(0x2, 0x3, 0xff) 17m58.192493905s ago: executing program 41 (id=7210): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) connect$unix(r1, &(0x7f00000004c0)=@abs={0x1, 0x0, 0x4e20}, 0x6e) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$inet(0x2, 0x3, 0x9) pipe2$watch_queue(&(0x7f0000000480), 0x80) shutdown(r2, 0x0) recvmmsg(r2, &(0x7f00000066c0), 0xa0d, 0x0, 0x0) openat$audio(0xffffffffffffff9c, &(0x7f0000000140), 0x40000000040201, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r3 = fsopen(&(0x7f00000000c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_SET_BINARY(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) r5 = openat$cgroup_subtree(r4, &(0x7f0000000100), 0x2, 0x0) write$cgroup_subtree(r5, &(0x7f0000000040)={[{0x2b, 'cpuset'}]}, 0x8) r6 = socket$nl_xfrm(0x10, 0x3, 0x6) syz_clone(0x8a140600, &(0x7f00000001c0)="07b5e42d30226aba87697ce3ff665d7cb4bdf0381b74230609ad5a0c5b8a9d5c2f3277994317083b76b0aedef0afef4267cf265f61c257cdf6b2b4f80e41dc603103f166f30d40ea85dfe1e8e66067ed6f2943db878e74532cf26a3f8ca5", 0x5e, &(0x7f0000000240), &(0x7f0000000340), &(0x7f0000000380)="646a21c1314836dab1375dc5370b85967842427f74c7fdda0fb7ef9233f6099289037fa8ede14a0147999b5b523275ef4abe7ff27941f54759b8ecf4d9f02b8e7d4d9dfadc80893ce8f09ba0bcc31b1ba7191c0c1c71e4bb4b162e670308b4d33e0f02aa5e24636f9c2d0db8a006018c1225f05d35d6e969f5fabf0a8c6ba2ea8675fa596d5d008285bc2bc52fea5fdafb52bfa310ecb3056c7f32881c0305e3ea74da8d09229309241efeed6eb72cf772") sendmsg$nl_xfrm(r6, 0x0, 0x0) syz_open_dev$dmmidi(&(0x7f0000000300), 0x6, 0x70202) socket$nl_route(0x10, 0x3, 0x0) openat$audio(0xffffffffffffff9c, 0x0, 0x80802, 0x0) syz_genetlink_get_family_id$nl80211(0x0, 0xffffffffffffffff) syz_usb_connect(0x0, 0x58, &(0x7f00000011c0)={{0x12, 0x1, 0x201, 0x12, 0xa9, 0x3c, 0x20, 0x4e2, 0x1420, 0x273, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x46, 0x1, 0xe, 0x80, 0xa0, 0x6, [{{0x9, 0x4, 0x73, 0x8, 0x0, 0x2, 0x40, 0x11, 0x22, [@cdc_ecm={{0x5}, {0x5, 0x24, 0x0, 0x2}, {0xd, 0x24, 0xf, 0x1, 0x8, 0x0, 0xb, 0x3}}, @cdc_ncm={{0x5}, {0x5, 0x24, 0x0, 0xf06}, {0xd, 0x24, 0xf, 0x1, 0x12ad1665, 0x6, 0x9, 0x10}, {0x6, 0x24, 0x1a, 0x7, 0x5}}]}}]}}]}}, &(0x7f0000002440)={0x0, 0x0, 0x0, 0x0}) 17m28.039939836s ago: executing program 42 (id=7257): r0 = socket$pptp(0x18, 0x1, 0x2) bind$pptp(r0, &(0x7f0000000140)={0x18, 0x2, {0x2, @remote}}, 0x1e) bind$pptp(r0, &(0x7f0000000100)={0x18, 0x2, {0x7ff, @loopback}}, 0x1e) r1 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xd, &(0x7f0000000700)=ANY=[@ANYBLOB="18000000000000000000000000000000850000006100000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000009800000095"], &(0x7f0000000680)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000000)={r2, 0x18000000000002a0, 0xd, 0x0, &(0x7f0000000080)="d21183c5520da24477c30e0000", 0x0, 0x95b2, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x4c) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) setsockopt$inet_tcp_int(0xffffffffffffffff, 0x6, 0x2, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000380)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x8000fb00) bpf$BPF_BTF_GET_FD_BY_ID(0x13, &(0x7f0000000240), 0x4) 14m57.828621169s ago: executing program 43 (id=7693): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) execve(0x0, 0x0, &(0x7f0000000440)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, 0x0, 0x0) r3 = syz_io_uring_setup(0x598, &(0x7f0000000240)={0x0, 0x2000b728, 0x3180, 0x8000, 0xb}, &(0x7f0000000180)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000000)=0xffb, 0x0, 0x4) r6 = syz_open_dev$vim2m(&(0x7f0000000000), 0x9, 0x2) syz_io_uring_submit(r4, r5, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x40, 0x4000, @fd=r6, 0x1, 0x0, 0x0, 0x16, 0x1}) socket$inet_mptcp(0x2, 0x1, 0x106) ioctl$sock_SIOCSIFVLAN_SET_VLAN_FLAG_CMD(r1, 0x8983, &(0x7f0000000980)={0x7, 'rose0\x00', {0x4}, 0x2}) sendmsg$NL80211_CMD_GET_WIPHY(0xffffffffffffffff, 0x0, 0xc040) io_uring_enter(r3, 0x627, 0x4c1, 0x43, 0x0, 0x30) 13m39.578427082s ago: executing program 44 (id=7921): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000002240)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_io_uring_setup(0x837, &(0x7f0000000180)={0x0, 0x679a, 0x10, 0x4, 0x3cc}, &(0x7f0000000040)=0x0, &(0x7f0000000140)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) r5 = socket$inet_sctp(0x2, 0x5, 0x84) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_CONNECT={0x10, 0x40, 0x0, r5, 0x80, &(0x7f00000000c0)=@in6={0xa, 0x4e21, 0x200052, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010101}, 0x8}}) io_uring_enter(r2, 0x3514, 0x9141, 0x69, 0x0, 0x0) 13m33.189616282s ago: executing program 45 (id=7931): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$netlink(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='*'], 0x50) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) 11m13.733118915s ago: executing program 46 (id=8232): syz_open_dev$vim2m(0x0, 0xd, 0x2) socket$inet_tcp(0x2, 0x1, 0x0) sendfile(0xffffffffffffffff, 0xffffffffffffffff, 0x0, 0x4000000053d2) syz_open_procfs(0xffffffffffffffff, 0x0) truncate(0x0, 0x4) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, 0x0, 0x0) socket$netlink(0x10, 0x3, 0x0) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ffc000/0x4000)=nil, &(0x7f0000ffc000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ffa000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ff3000/0x4000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r2 = io_uring_setup(0x1195, &(0x7f0000000040)={0x0, 0x2150, 0xc000, 0x3, 0xc4}) writev(0xffffffffffffffff, &(0x7f0000000000)=[{&(0x7f0000001480)}], 0x1) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB='*'], 0x50) io_uring_enter(r2, 0x2219, 0xcf74, 0x16, 0x0, 0x0) 10m21.810918467s ago: executing program 47 (id=8385): r0 = socket$kcm(0x10, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) mbind(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x2, &(0x7f0000000000)=0x9, 0x8, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) sendmsg$key(0xffffffffffffffff, 0x0, 0x40010) r3 = openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x80082, 0x0) write$vga_arbiter(r3, &(0x7f00000002c0)=ANY=[], 0xa) r4 = syz_open_dev$sndctrl(&(0x7f0000000100), 0x0, 0x0) ioctl$SNDRV_CTL_IOCTL_ELEM_UNLOCK(r4, 0xc1105511, &(0x7f0000000040)={0xb, 0x3, 0x8, 0xfff, 'syz1\x00', 0x53}) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(r4, 0xc1105511, &(0x7f0000000040)) bpf$PROG_LOAD(0x5, 0x0, 0x0) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) listen(r5, 0x0) r6 = socket$alg(0x26, 0x5, 0x0) bind$alg(r6, &(0x7f0000000300)={0x26, 'skcipher\x00', 0x0, 0x0, 'cbc(blowfish)\x00'}, 0x58) setsockopt$ALG_SET_KEY(0xffffffffffffffff, 0x117, 0x1, 0x0, 0x0) r7 = accept4(r6, 0x0, 0x0, 0x800) sendmmsg$alg(r7, &(0x7f0000000040)=[{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)=[@assoc={0x18, 0x117, 0x4, 0x3}, @iv={0x70, 0x117, 0x2, 0x57, "f0cadde07a1b66b146347658264c1e619738a8599d9cbd85db259ea47085ac6903ee80fdf4423732bcab36f58f86c626331614b1f43854bf0fd6e73378dc6fba11b78a74da094decad87e1590686f056a1a4e7060b5157"}], 0x88}], 0x1, 0x40800) openat$dlm_plock(0xffffffffffffff9c, &(0x7f0000000000), 0x41, 0x0) sendmsg$kcm(r0, &(0x7f0000000040)={0x0, 0x3, &(0x7f0000000000)=[{&(0x7f00000000c0)="d8000000140081044e81f782db44b9040a87080211000000040000a118000200e000000000000e1208000f0100810401a80016ea1f000940032e5f54c92011148ed08734843cb12b00000803600cfab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef075c0100000000000000cb090000001fb791643a5ee4001b146218a07445d6d930dfe1d9d322fe7c9fd68775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e0060000000000000080bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd68adbef", 0xd8}], 0x1, 0x0, 0x0, 0x7400}, 0x0) 9m59.319185623s ago: executing program 48 (id=8446): openat$rtc(0xffffffffffffff9c, &(0x7f0000000280), 0x40000, 0x0) socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) ioctl$EVIOCGRAB(0xffffffffffffffff, 0x40044590, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) fsconfig$FSCONFIG_SET_BINARY(0xffffffffffffffff, 0x2, 0x0, 0x0, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x0, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) syz_fuse_handle_req(0xffffffffffffffff, &(0x7f0000006140)="7672139f6dfe7e10c37e3d50cbf562f2d282560a8454436f47e3f8ebc8e1fd792cee485f0bbe04efd996204a61c0d0772d8e489b6f4c7f78727738db2cd945bd9c9e3acea680ff3cf19e93fecd8832112f3ba0c952d39a0ec4e181e428d2a0b3a0e2da56673973a046eeb1bbb5190f22b2bca28b7bbe31ad76a1f78b6a029a8af489f6504b065915d63ac878725830e46aaad9db413d3d077bd674f5378f86e919a9fe9048a31f6534cacee89e88089851073c7b83642426efe63bf03edb870437a89f8b3f969cd80fe93dd4c55de2ff8560e72be3bbcd5ab399a7804abda51819a6d7b4083ae0371595ed9d6039787398c95617fa2db5bc3d786635de6777ec73518ec0d34e57683465c813e1ced803af62718f6b048d766174900789c3c0bdbe13e1cc48923c418402a93685f777c66e358c1fca553960565574f7c4d9167774a6347df159c4f3ad0caa4af45e4f0a9aaff419e85187cdcd8e38b5983997a926167e2287f8d9e1c8204734d3dc1e25b551cdfa566bac00ad849bf423bef21fc2197f2388bb3b347933bab61425787ff52577f3805e2d1f1bb20d2f288f88b9859db8208e2608eef52e573c36e5109d39826354dc3a562c23d87c585d968fde51ebf91911cd4f33a84f75b7731fac2eed48257bd054d6182f8cdbcd8a722ef32a8597f437e763db99dd7ebb43d9f3882451c24f66ca50ec0ad9058b24601685308133d367c480b7f4999a82ddd179051b43da6b98272928872c19a49834d79726aaac3724dc160d15cf92846a41ecc92948cc5a9cc4f7d6bdd01ceb79cd673cda60a56ff4bd75d8ad6a2bbeefce74f3480496196bf0b74388b7307bd57cc6c67dae4e621766614a4b0adf03aafa2c692b7d200276cb6720c4c00b0f16d0554a13feb1d9b95b5a8596cdcffcb5f43620ad0bb5ee700833aeacb20fe79059e3151d2ff31d737f9b1ebdafb0dbb75aa1b7f426670af32935ccd077137f0ed698b18013d9ca8d4fdb9c1ad59332726db8429af47775d7427bc6d49fdbdfb90daaa1b7e4997082296aad53f8044d26bb56989d0361d83175eedfb10dd3b54bcac20c3222e10af2853085b6d9c2a3132df8678d6cfdb6378bea6f9d308ad85e64d6b1adbacf190135003812c501df017a335cf80ed58ff3f237c9a7bc50dc411059056f00fdd4957cfb0d6cab6e7d24f240ff0530779f9daa7ab351149f0a2666bae744d6c56a67c259eba851cb114aad7f7529ef3eba66a5ddc3bfdc1168c76bb8eb7d0d4a6895b20dec236ef791078e97c480a01e7b2ef2bcb1da0bc493d6cb6cabc6e188a64835fbe1bb56fd0445df647ec41249db6efb4d68adf66449154e04c8cd7348ef02cd0afdec17ace65c2dfc4e024e0e2f3539508821b6cab7f1648d7b5b1a18ff301377f4f98f56ef05328d9fc62fd719cfaf49855f60272cddae74db365623efff3963e40e094a099b5b67fb8f9576be4549b1545d3231203aa30b4a5387860e8487be93bf13e7fdf70a92c4f9d2369f6ed84e2fc4ed938b512f6d5de28f020d7757ced0a7257794b634987d573250639fe66905e7713693de3a7870813803df631d626f4cec977ddc9f6cd62b1e425e9290ebe017c1f563452145a620d52663967cb3f29251607ca9b334e1334967e72d8c89cbbd4059705e6fca7124250f1338a3cb6a1b06c9b3624bbfb4b05dfbf397ff788499ebd2d2800ca5e22c12746041d04699728cf90e4441b82f45ee75bebb6aedcebef826c3b7b177104db327c78b90bee755f0b37fab27853a861108880864c123a70877e649e848abcfb94d4b996ace0734103cdf877e6669019d6017183406335b218858e0330de80f6860030d21e5cc29f165a38df3e5a63ecafc5d50ff4d93339af3a10ba1ab4aa89243b8c9d886a127c93bb946a7c80b6144673483653680dd7adbc25e7841ca9f393c42e9cf6b1fdfa91549c0d6a205dd7eef3a6b4e8dff9fd6c4f5e2b2511990fb38439392c9fda618a1f7dd797e3db4f6651956cd465aaee32ea18c02b9a3e2301dfc63289af5762bbe7e639f6ed0a19cc5acbdb3571c7fbb10f01a1d33038b75c762b6f0ea20d564fc1c7fff81cfd16bcddb051f93057584f4c17afc2c353c90570b71c856113cb58a2e514e75f8b06b2e55b9474199f21a848a4b18d34b1c0eb851be03467d79a40dbcc6ae670cbd1895bc46e6d27bfd9959512e8b4634dc498c63e42331f34a0707e486dc810f361d97953d5eaa0783f3a856081a6e41c057ca2d70c7f44623898af8d39841727a80ac1368135ee5024ff51868ba82fe618433666de64944892783761ec674d05f16f7828b9b24c95210c94fedcc20f58c638c74c12ae14c1287d3bcff75764aecc79aa71ce1c18deb39a4f2274ad661ccb703dc70249eed802577e4d6258010d53294bde2cd2e8167adbf9cb8db10f009a57b29ca1f22a3091638ec9087f35f22cdd359f3a1d102e2cbc7423ec4a6a1a4f8cf6358b8112656d5019d74aede5f7fa4778498fa9414519626e89d1cc09a1ec07e67f984b15d9fbccee6d50acc83a817024f503687df684c768dc96c90941f3279d68d8c804508f7a79d92e7bb8c22520847ced2f1f0ec71cabf96feedcec35ee52326fc45fff73673547e8e55f452c9dfd29231eb9b4f9a70d4e11b43112bc7cb457d371a93f53e2f7d96cf24839bc19b4c9b741aa565128064a92caf8338bf1a05a371684dbab7b45742d2735fc089c0dc740ebd14e70628de5eabc01fdd3080647fa283e95726f3ea9aef5537a534eb8741a7a47c675be8d65d17ef204a12757e8d4eec0d2a7df77f735be0ee6ef8dfe777571fc17acd0b1b9ee1a0845a5a1167ebbd9f771b83c2a5bbbc015a97091225319e13bf0985778da02e51c1909da0dbad32f00b400f1489880cec6237e36d3c1a50a13119aface904090e58f8707ab93f3b565d446568f68d4b3b62ffec0d7ff62191f5c9fcb8219abf1df71c7a5e7a1025e32ea576a01b0e0cf69d3af1b39f6a6896371a7bc1be6c51d971030b1b9ed6d8ae653f5c57368248280129c084122c50b2172c4f905e09dd0301cd2825806fcc6765ac6df707412b3be6a1d05557634d79eb41630ebd71b11434b68ab631a46855e19d71fefb77a01d3a9f8a43e978de8885394c3f5ca51dedb7bcd99b596e8beb2ea4ebd1079cd1e74f3642940119b1173f1ef3cce44c93516d52fa6da11158a432484e8a0b90152c8d4cf5012d48ad4b8ab1bf76e9ef921ece129be5834acf8b93e5816a4db2203f27f3255a83a8dcb457b8ffaccd6598fcf507b30c385c3df4aa47519c3d70f8683025cbca6e5b103e39280ba7a7ba33eddf5ace5065380747e8cbca9a2cd0781f9c9b93fef674a53935c5cb5f3e38cea7155eb959ad241cc635f4e86297c839d48288065a6bd45eb717b1b6ea20a213dc4834a297119eac95ba0ed4ec2245c4692653d670f45261bd54d7772d8d052efafe4486f37c54a94d7022b4b78c4bc7a567fe965d49639004a57b0e45e017bbb149026bcfc12092717dc468cad62bcaa18979582636ce88305140254f7b334b55200f5047387381ffd1f7d34b0fb7bff311f613d7e1b0cf6d8b38702ce9b650350abdcc5a81d0cc97a2b0a5aa11d945c9c302fd23272aef4bf3eece57c765a241893969a3e7d195eaded5af7f1f2845866aeee79a84907bfe6e78526c3b1f107cc28b3732b52bfa8859bceab06263bc8e85e96cf482044bc7516e42583a5b2139b0393c6fac2965b07944d954e74a2430def8ccf574fdc54ddfe5a1d167a0d791cdf202bf99a62bbbfb7c1aac776bde76dc3541228d3230a15fb7c6f687e262bc85a1b1508019369062ca77933b9afccc35f0f8265ee5eae168ece37324de2538a9721934332112f54402d244c82940bcda0a867dfc11d2a99dcd54c7d3b32fcb6eb19ed8950336eeddbf372c91a66f31f7f065a8ab86ec6d40350591bdc0cbf3aa9cad447c4906b00bfd376ca489d48bd49401b5d25f5852d0eff001502ec6fc869c9d5791b3161df0dfc0d6f4994cf277cbce6bbc99e9d409d2a293cbb37ab3d8655b88abdd34ad47bc035dfd504c9ec8b88d657b6376853a1933d4a0f4828aa020cfef3e518fdfacd3d9900b5b9a482dd593c01788ddbd6978f1a7ba80471a3891050451b1f170943181de415f0907b798bc701aaae564e30724c167ab58bed0ab85a75a957a196d2a51f3c6ff01fe57199fa8c526526b552d29b6cb0a41112aee4aa54a7aab1fd5504f7a3c5db2a7c1afcc840991d929a7faecf2e7dc0688f07da2981ca8a78db871ba770c971c561e4521932bf7c08ac554ecc531bfa16e767ee3e2fc54d45d8ff5ec92dd846632f140f9f7a70c4eab2b194317835f3b1e8d4064c2d564d0d61639b9c62d1ad04f76dec2d3251ae4685e152f3b0940ef6d02c81307de3e98bbcbdc1db14b8ba68baaeb3c3d387b4ac0e6b7e9ed144d85565c95120e3548fa1836dfc444ade6be458d9d43f6192d9d83cd7b2aa0f5ae9c238297787b91ac72bb9218f810d00006b2091f2b8a95cdaf60e9e79dbcfe52dccc93efcb729c15323e21ceb886252339dda73d9f07aba55ccc88af838c4ee739b13794884cd12ad6ccb02e821100f03b200af7e4bea30fc88a057622b71b13ef7f99c46f662b344dd4a6c1a6645ec552e2bd329f30cb4c4a06447f6741596e53a2f7d095a2ac618722543de728602d8bd65e6ea442c7e7353c497368107002bd10a50a752d18b90292aefd5e0b40c31b162914bd60d4a80d6ea36b008c795de53e0114b658d75b08c1279541c0e27971e65d6770bf8ecaacd8f0d16eda72167e5028582fb9873e2b55bd1d248d77e8d95aeb5d4ae46e8e9acb0726e1147374e344e22af5d5aa304a8d628e511f3a42a014ef500234147a817b8e34acc3c34ab3df1765a7d767c97bf71ced449b0d4af0a484205447d5129a6c5854a3597ba7aed9fe762dde593b85099f613f8ee8e9306786cb54a0d4aee73f45a1d53c91480a73b110fc366f95805dbb87556316241aa71856358910109931dcca820d10b783238e43dafac54666b73096722d415b6dabbc97795ac8ffccdc507ef3b232a13fb6c5a813eebd72060b8d99eda46e23a97ebf718f7ebff1e2a98c9af045e8474c0c94cbadd9097b36c6df5de20d2496b4048422a8e15097e6ce16145b737f84e7e86441496d1363273bcddc634b5fd9497091214fd7c5d5ea576f0035a8ecb207669a502020483f65b105c1ec0f2f43c45923a5fe1bef8e98a8a391c95b5f29afa2dc0257e073ad354d58ace6f74f6ad65dcb54a2e052b28a61ae06da59e993a14c39962f8a8fd02ad04c1d98503f3aec3b77426d460bf7bf5384ca02353c850db2fffe47e64d476a79583db1a53c98fb1492dd9a91031ff56a44594453b6f2f1ad96e4c8d19e434fbaff9451a73149942b612e4b85a02112ee67b323c1157b0da54045e44a859ecc7c0bd38ff4a26dc249ada967b7fe85fd0c82af5009b75da343422ed8bbb30dc6896b33ff4f0b3b29093f34fb782654827b45479f3c7b7839acd519c45442d7ba3a0cfd3cbba10a5a465608831054499f71ae35edd44d1ce9ef7b064f6790c8689854cd0c766c08c8307b57b1f4c956ad081c064e656d1582c56ed9fdd577f84fbf3ee451acd4d10f0c0a4dc1e6ab1f85261ec686580ecdbbfeb6fb0d291f7e08477fd3935142c2ed8caa847b9d19299c32f62d320cc5237fce666d181777568521e1d5e93c78dd99fc0301335b61cec3f8ae050175f0f07812793ab5025b7f16115789f4519ea79775ceeb2b9ee339b0a80ea2eecd4edf2393a28e0ca4c1252bb24fa7420bab46e2937095e5b9f96cde111de110213dade07359aadfd74c7ee3b893d713662ed204bb9a77b8e9cb4c3ea253ed400f068f5eb84d192ec1bf8d0cb311b875e097e924f5444e748d540fb40ab800b06f5de0c11fef6af640835b552d0b9cd95cf7f79aa9610b850f597372f4334513f4bdb8155cfc2831ba6fff1c8d66fe1372fc211906e816bb4d6c5dc765d49a57d130bcb9734e53bad549d35b53028211e532583e4c1f05d2d3ff0ad57747b57b8004492988dccaa5c3dc7edaa1f3e23c614f897da273648807a50fff28b3ab314966277f76ff5be2a708971c1ca494fd50e0c64e43671b1b07b4e5e0c51732e3dee53ff4d10cfd75bb6f0e09fcc5a7f32d073b1b9bd610d5189c8178af7d52dd7f91b8f9e292b87b320163e6374fcf874db938c17351f43be3f641e92812d72bca591f809ba06349572c1b063e37a59571599bbbbfe6989fcee3d27b7466357a8a5ba48e643a2899f92b208bc0dd48f553dd1f2a6fc95621f4c68067d7dd5ba691b99b3addd839c6391c1ffcdd2832941e2fe7c25490f7a1580ff17a62d4063a8feb35ceef20ad6bfe252697d4631156f8dc8b03107cd1640e1fe8450a89f0565f011b47b9536f6c639b67a32a45542be789cd7aa4e08dbf6e1a8a87f7a74248a976d14eeb7c7139ff00f5cf3e0d0557051a75348ac3c1418ec78ebd3ae32bec0b1e9bc4043f74453b86bc2c6099ab8425a0d2cc9e56879b8fe50b41002af7b3b851860a8108ee284c6f21a25985678e555c2ab5fce4c614dc01c45b943c5045773d314b3aae06f696620d5341b20729c971f0944e86cb012c90ddc315e12572e3517d2e5d4df33c60f30e84cb1ba94125d13e38fff920e292660a32a9a1ee693201be938419a92e6d73a939fbaef1c2d463be57d555902292855ac250cb68429aae8e9f0f6dbfb960e51ca48c1b49e6d2780f2a123d943abf0dd93150d41380b3d99dabf27a7212e86a741650a6634c4e569cc5a8c5d97ec6d70e5cd66f5848e8a09f2a76cd11482f6d3717eef5bab444cb90d7360237bfa65dc75ba3d864d688c2d4e983de7d978a6222e2c0bdf4111f645ce8e409124844455b347415142c886fc95ba869fb4b770dbfad34e267590341ce287ee591f6cd5b6e4a5604b6b0f57cdca1b457c66d1c731ee1002839a1263d8b75b256c90eab7b43d36b7495e50e0865c2a14bfb87713b9ada89bdd453791f6c18046d220bd9e16bbe021df828d2deca20cbb77553e3f54c418179283b236bc231e478558c25af5cd14cd3dabb1cf3e359f7389ee84fad8c98faf560da9b36694e86a80c8d9d3261900bc195d441770774653bd78e66e0999a0f99c9675ed3030c74499c67d869d14cf3ac4df406ea91799de18b129be5d3eb8409047778d063f3bb6e6e6a5820e899ebf43049a079997ff8e36d36e5ccf49cbeb52e5db213c5e46654428cb773a72c6bb01454133aab163b537675e4ace88579c840fcb555e96e3b362869650194b654762b10d0d490b9a4ef1f91f6c32aad575b5cbccb6bb1666476985534ab3159c42c1545bfc1018fb5279c049467a8a46c16f8ba86e1d4041828e68a6c7d7c9a0481718da4ff29ed21f3956f7afa84c54369ac4d85fd93c60491cb5155a751e17dd1bea07854b6fddfeb6eebef32029e8353fca32c0d8831e0c33aca792c71a2792067442c1964c69b7ae56d80abb62dacb502bba580af066d851d69f47012433bfd02fc681c6687261d7709da82a2cdfbe46e2157c54166ce2e041d97f5a824b7ed4b9f25067072617a27ce4f74c574b435da03c2afa4acbd8c1d2d43bffe4570d236e2374fbeb85fd8672bf62b89f8d3cefd63aaaf0054db14d23c4df208bff4d211299d547f5f3b4c7f57d79c1983ac0f2b6fdc60acc7bbdcafc5eebe1ece85bc31e57e9f553444e20d22b7578df116b83d34a91caae699c770e14af09c1cb9814381294f3c7d6e13735e982b2ab17d6bdb74cf7328a7d3b3e963cae944dbc9f91aa1ca629e471ecbffe8c573885209b772e5de04ca6954a9fa196733066d1219380bac92cf297ddc4aab061406fa5f4e73e16398316934be86be4feb69b94ba4ded5996fa17abee2d8015f41b293bc643826672a4d4b007baa9cb93754efa0d5a08b153a1f389e6c1753cb248ea21a18c7e7d58e54f61b6d07c400b105d1364a091c7ac92309e8951a840edd590dde3a3994b53a5c3302fb404094c8787da420c3034d3b289d3667276d2220de8cc8f94989f900483acda9b6d878bf360477dd59cce976e0a4ab29129492e35adc83b41ae4f84483bb89876ec4955e83f9a22a0c506f5532e5390f3d548d327516e5fa7ef8d613be77b4967dd8602de27f28a97cab485f2ccd97f244df27f5969c3626b5e50d7cc802bdb6203494f7cc4d7e1ffc31a6df947f91f1ad8f8110d773840ad3beec8197e7516467b62882af0b7cd0db18e18d86535cca2d00b8d4b1ac22f8f264d22c36a50c8a342da8b0222f657b04b17a1e282d366e6799cfbbd6d8429c79cd989d6cfffcd83790803cc608c3815cf4013a54f07100db8770b7deb1873905ae9d29d0918e06fe0ff42020940ae136a1b01cc283507a051ac23795736213421ac88ea2f7cc3a84bf63ca45957a14986e906a73a9b4f578064d3e34eb3952e01b7b8d239e31c95756539028cbaeba975134b7fde393f0b365f01f5757c89f8db7ff6fa90efa0c4c8a4696f26ae8f6241c4d5672fac434ee547579b08f8e5418590cf526e8aa46b7329e45c41c58680b348562b10de4cbd9d88b22e8e206bb53a54e51c62d4701d2f87f1e2c91f4c78bfd0e29ff05fbc5c2ffe252332c775745aa8b09345906452ef8eafdaf7aa63d9abdc6707454710c73faa131032ce6d760e3b545887cd63188cfccd629e8f17ba7265f67c6e9db46843da5873726563763c08c33a389aff7be2a73da702a56650e9f1e3ea48f7467075d51a6b4dcf943079eccfe67c2fefb16be5216263548029e5754e7c74164e38e4fe3f26d5fad42fc6dfce5618e17bcb978b752106a36436f5be59f960b334c4d6533ac9d0705e84e4c8c90eaffded330482e689dfb788ba3dbf3280de075227a6eab2423ba6331801e1c95913fa37b0d6614ac7e286de82002cfec99d212bcdb4916f82248d1724c0479091d3a95538f6f370f1c8a0d120cc2fa8037003d8555602bf434128b73c06210cda0b49b789d232cc5d25bd6f3028d0ab8d7cb4b4b2555ed819ae6a15c23a7398f72320b924007f16d7e814be30907c24ac5196d84c00adfa449adf3c53a94a8f64f184d42fdacc05492b3f7324f444d13860053dcf877fe2486932248c9e0cc54e4b119a995b00e73d61958fef582bcf52b9e316594e67929ef69d2c2cf36f4c0e6c31a9c740f8caafa31e10a36fda851d6d28ef2442930960497a33cf10c85b5312512325b41865441a8e93c89fe694f133b79e3eef37fc4dbff0fbaa56b699520da1bfae1dd39f0ba9dcffca01188903f46341c815aa54898b87a4e049c8ff28bcb9b69132fda3fc3d10268c480bb76ecb12b48b9808e8e67e42a9bca0c32a48f310c890f9cf61d5e1c09b08f0eb983c765e98acd139cdd5561b0ee4c0e8331a18112037ec39bb29df24ead90a809ea9d57fde46acc2ada50843d9e88575889770d1b407c3f290b353e757fc349bda8fb4add1041e0fff3810a0a3cdddb4e816d8d4682d4e275ae9f2dd1bc06905040a955bd8da336e211a0bdf1b8e1abc8457102d0ba3461bca211e0e47ae82f9ebbaac20a9ed91a96c3d0516844cac3304bdb85c94d1cb703a0c05afdb1db104b2a45a68c198face83a313aecf1da56fcd111123690a1410aa6fa2402ad11fa5331d784beaa49c4cfa74f68dfcb6a9cf6e91e5602ee9439adb5b3cefbe9a9e93c25febe17e8ce47db7846c9b950b55111a676ca855c90e8e82c8adf70cd76bd344085045486f8bbc119d8c24e89ceaca34ac36be0f6f1e1bf1b05c249d0f11cfb1d03b33eee4d94bcbdfa6e659bb109b1262532ab8d54a1dc46645e97496183d88f89b59271a0a8335d1ec1b136e1d4165e5c97c37b336ea5d14f57fd0dcae894254db8d86cd8c2630f944189f4633f1fc373b4e8fd9595a46193eba0fbbfa4f58d5fdf8790c51305065005a61f0e9026eed4f704084b996e2976c883b88818d6b74c2e61c1c41bdc8a34e3a3c792a7652fdb5f4f22ca9e20be548938e174974b28704378cb771b6af910cce6d2e406bb3af4f12033b9d56fcad8307215c812eeccbbad484618c4d0b14d560aedf62e9f6d4b10f0732a559b1d213005434f1ea025e2efae734f10acc42b999a1639e053551aa0fe356431ab7bb6a7beee9b573ce290f8876250962a57d380104d6c800e86e89e1d511d28d3808efcd62a1c6d809ed7507b640de32f432b8ef96255942867c1953fa10d97c5927a277141449a57ddc34521908fd04cfb32ff464a1c4d1935a660bc572f73750102e3ee1a9c6d2abc1b709952cabf6ff4e6d08a2953172d6d9a7a2004cfee1f3b44c6846968cc382238b10846e84a8def3381046193d699434493b136a439c97cb8059fa957e2e80e8598ecf358acb0c07c46411a8c3cdcbd2a40fead2d33be7cd9f447ce0183c166fcff90fa4d50993f1b40743dd8f85ec95185fa64fe1c65900c4a08e5fd4158e413d72a801f128fcc580d22e0994cefb23819804fb55ab7a6e82d47ab108c112bd9d94a48f934d9fbe49672298b91405b3993e61b9bfe4cdd26cf69ba37a8a60d45ff87eb98f8a01a49474d8b7b2e14f6685cad0c4cf60fb9239b5b70208ad5ad6c151c375ccfb09d55c8b140ede7e51a48a33c13724eeb51bd7bcf3767186a1de9e54e0aebec316f6f677e9f244e9350efc6feeef3a606d4527e1aecad2ca6b6222decc0ac034b3efcf6fc653d7e2b95b9fc2d3bb58e1bdc47318fce4928fce7fc1dff89f908495dbd41fa03e976a65bc36d968188fd0d44ac1c4200be82ca3c9db1d0c3c0333a0e817f14565f2771955e0107db94bb790f079ff8fd55afafaaf8b346bf80dba79a74b0129a8d6370344363faf41f40d1e45591ef9677e5745ff5b0e5f76a2053c773cfff2bb1ccc7061cfa0c041d68feb12c56ab3a3b795efc0881d9ffe06caf9a3430bc60e9d716f11d3672b1403416c14b4f8a9caa1b54f7e616d0fd1cf9bb3b52bdb1945074dfef4e6a4a8069084a674414b74c972aca7513cf068ca99da6bfd1cec93cb8769f52bc06366b32bf6cbf6c46919b0da4ed6ba16a2a0cd123ea31634ce07081d593684c61cefa577196c6656d374000945ceedbdb8dbc0b01894edc8d7cab1b635ea248b9742efd6e094b40ab5b97701433c1cc5dbf6041f8f2f41437469518ebef65b7bdb6a0b1e06e7ed405e97c229849aa476647f02521abad910c018cd4eff3f43da9eaebf849575fa0135a697d7571f6cc305652a1cf014d2b97ab7cd254a29fa0f35d122b289c2dbcba9e01af7332c405acf55954b6a81af2a19484339943b08103e6d81b46fdbce53c16baa142bc2ac948b692c3d0006ecf6d2f24e89acd8c1167668657d3a0a4689a69c221619fb9c898b244b442032ffdb63d42ded7850409faeba18af67bcc8e3b8801e55e83e45243f2ce64d2dab507b9d20dca219b55c74e767702e0dc0ecdbfbc00fa5683007d68992bc9080feb8e16ad2528e6afa59217eeff0bf75247caacc5e4c38680478897c360", 0x2000, 0x0) r2 = socket(0x40000000015, 0x5, 0x0) connect$inet(r2, &(0x7f0000000040)={0x2, 0x4e20, @loopback}, 0x10) setsockopt$SO_RDS_TRANSPORT(r2, 0x114, 0x8, &(0x7f00000008c0)=0x2, 0x4) bind$inet(r2, &(0x7f0000000340)={0x2, 0x4e20, @loopback}, 0x57) setsockopt$SO_TIMESTAMP(r2, 0x1, 0x1d, 0x0, 0x0) sendmsg$xdp(r2, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000200)='\x00', 0x1}], 0x1}, 0x0) fsetxattr$security_capability(r0, &(0x7f00000001c0), &(0x7f0000000200)=@v3={0x3000000, [{0x10, 0x10000}, {0x7fff, 0x3}]}, 0x18, 0x2) r3 = syz_open_dev$usbmon(&(0x7f0000000080), 0x4, 0x0) dup3(r3, 0xffffffffffffffff, 0x0) openat$ptmx(0xffffffffffffff9c, 0x0, 0x121301, 0x0) epoll_create(0x8) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x0, 0x0, 0x7fff0000}]}) close_range(r4, 0xffffffffffffffff, 0x0) 9m25.404545589s ago: executing program 49 (id=8518): r0 = socket$inet_udp(0x2, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e22}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) socket$nl_sock_diag(0x10, 0x3, 0x4) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x1000000) socket$nl_xfrm(0x10, 0x3, 0x6) syz_memcpy_off$IO_URING_METADATA_GENERIC(0x0, 0x4, 0x0, 0x0, 0x4) syz_io_uring_submit(0x0, 0x0, &(0x7f0000000100)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd, 0xc000001, &(0x7f0000000a00)=[{&(0x7f0000000c80)=""/197, 0xc5}, {&(0x7f00000004c0)=""/192, 0xc0}, {&(0x7f0000000580)=""/152, 0x98}, {&(0x7f0000000b80)=""/220, 0xdc}, {&(0x7f00000003c0)=""/192, 0xc0}, {&(0x7f0000000800)=""/203, 0xcb}, {&(0x7f0000000900)=""/182, 0xb6}, {&(0x7f0000000140)=""/125, 0x7d}, {&(0x7f00000009c0)=""/44, 0x2c}], 0x9, 0x12}) r3 = fsopen(&(0x7f00000003c0)='cgroup2\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r3, 0x6, 0x0, 0x0, 0x0) r4 = fsmount(r3, 0x0, 0x0) ioctl$sock_inet_SIOCSIFADDR(r2, 0x8916, &(0x7f0000000240)={'veth1_to_bond\x00', {0x2, 0x4e23, @multicast2}}) r5 = openat$cgroup_int(r4, &(0x7f00000001c0)='cgroup.max.descendants\x00', 0x2, 0x0) write$cgroup_int(r5, &(0x7f0000000140)=0x100000001, 0x12) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r6 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r6, &(0x7f0000000000)={0x40000000, 0x0, &(0x7f0000000040)={&(0x7f00000000c0)=ANY=[@ANYRESHEX=r6], 0x10}}, 0x0) connect$inet(r0, &(0x7f0000000480)={0x2, 0x4e23, @multicast2}, 0x10) stat(&(0x7f0000000200)='./file0\x00', &(0x7f0000000640)={0x0, 0x0, 0x0, 0x0, 0x0}) setsockopt$inet_IP_XFRM_POLICY(r0, 0x0, 0x11, &(0x7f00000002c0)={{{@in=@multicast2, @in6=@mcast1, 0x4e20, 0x4, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, r7}, {0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x3, 0xfffffffffffffffe}, {0x0, 0x0, 0xfffffffffffffffc, 0xff}, 0x0, 0x0, 0x1, 0x0, 0x2}, {{@in=@dev={0xac, 0x14, 0x14, 0x3c}, 0x0, 0x32}, 0x0, @in=@private=0xa010100, 0x0, 0x2, 0x0, 0xb7, 0xfffffffe, 0xffffff7e}}, 0xe8) sendmmsg(r0, &(0x7f0000007fc0), 0x800001d, 0x1c) 8m28.445037149s ago: executing program 50 (id=8625): socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x0, 0x24, &(0x7f0000000280)={{0x12, 0x1, 0x0, 0xc3, 0xa1, 0xd7, 0x8, 0xccd, 0x99, 0x950d, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x0, 0xbc, 0x71, 0xf9}}]}}]}}, 0x0) openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) r0 = socket$packet(0x11, 0x3, 0x300) socket$nl_netfilter(0x10, 0x3, 0xc) r1 = dup(r0) openat$procfs(0xffffffffffffff9c, &(0x7f0000000000)='/proc/crypto\x00', 0x0, 0x0) openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) socket$inet_udp(0x2, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) userfaultfd(0x80001) r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="640000000001010400000000141a000002000000240001801400018008000100e000000108000200e00000010c00028005000100000000002400028014000180080001000000000008000200ac1e00010c00028005000100000000000800074000000001"], 0x64}}, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(r2, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000340)=ANY=[@ANYBLOB="5c00000000010104000000000000000002001000240002801400018008000100e000000108000200e00000010c00028005000100000000001c0010800800014000000000d97405010000000008000240000000000800", @ANYRES64=r2], 0x5c}, 0x1, 0x0, 0x0, 0x4000}, 0x4000) setsockopt$SO_TIMESTAMP(r1, 0x1, 0x23, 0x0, 0x0) 8m27.925250038s ago: executing program 51 (id=8600): r0 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r0, 0xaf01, 0x0) sendto$inet(0xffffffffffffffff, 0x0, 0x0, 0xb, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0xc, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) add_key(0x0, 0x0, &(0x7f00000001c0), 0x0, 0xfffffffffffffffe) ioctl$VIDIOC_S_SELECTION(0xffffffffffffffff, 0xc040565f, 0x0) ioctl$IOCTL_VMCI_VERSION2(0xffffffffffffffff, 0x7a7, 0x0) r3 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x3c00, 0x2, 0xbfdffffc}, &(0x7f0000000000)=0x0, &(0x7f00000000c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x1223}}) io_uring_enter(r3, 0x47f6, 0x0, 0x700000000000000, 0x0, 0x0) 7m27.866497456s ago: executing program 52 (id=8738): socket(0x10, 0x3, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) r0 = syz_open_dev$MSR(&(0x7f0000000200), 0x0, 0x0) read$msr(r0, &(0x7f0000002700)=""/102392, 0x18ff8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = openat$hwrng(0xffffffffffffff9c, &(0x7f00000002c0), 0x0, 0x0) preadv(r1, &(0x7f0000000240), 0x0, 0x0, 0x0) read$FUSE(r1, &(0x7f00000024c0)={0x2020}, 0xfffffec1) preadv(0xffffffffffffffff, 0x0, 0x0, 0x39c5, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x7, 0x0, 0x0) setsockopt$inet_int(0xffffffffffffffff, 0x0, 0x6, 0x0, 0x0) recvmmsg(0xffffffffffffffff, 0x0, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_QUERY_ROUTE(0xffffffffffffffff, 0x0, 0x0) r2 = bpf$MAP_CREATE(0x0, 0x0, 0x48) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f00000008c0)={{r2}, &(0x7f0000000840), &(0x7f0000000880)}, 0x20) r3 = socket$inet_tcp(0x2, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000180)={'syz_tun\x00'}) 7m27.08090769s ago: executing program 53 (id=8741): socket$l2tp6(0xa, 0x2, 0x73) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, 0x0, 0x0) landlock_restrict_self(0xffffffffffffffff, 0x0) mknod$loop(0x0, 0x0, 0x1) r2 = socket(0x8000000010, 0x2, 0x0) write(r2, &(0x7f00000002c0), 0x0) r3 = syz_open_procfs$pagemap(0x0, 0x0) ioctl$PAGEMAP_SCAN(r3, 0xc0606610, 0x0) r4 = socket(0x840000000002, 0x3, 0x100) connect$inet(r4, &(0x7f0000000400)={0x2, 0x4e20, @remote}, 0x10) sendmmsg$inet(r4, &(0x7f0000005240)=[{{0x0, 0x0, 0x0}, 0xfffffdef}], 0x4000095, 0x0) 6m5.492471361s ago: executing program 7 (id=8889): socket$inet6_tcp(0xa, 0x1, 0x0) getpid() splice(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0xfea8, 0xa) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) getsockopt$inet6_mptcp_buf(0xffffffffffffffff, 0x11c, 0x3, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_kvm_setup_syzos_vm$x86(0xffffffffffffffff, &(0x7f0000bff000/0x400000)=nil) getsockopt$inet6_IPV6_FLOWLABEL_MGR(0xffffffffffffffff, 0x29, 0x20, &(0x7f0000000100)={@private2, 0x0, 0x2, 0x0, 0x2, 0x4101}, 0x0) r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) ioctl$FS_IOC_GETFSLABEL(r0, 0x400452c8, &(0x7f0000000100)) syz_genetlink_get_family_id$wireguard(0x0, 0xffffffffffffffff) openat$vhost_vsock(0xffffffffffffff9c, 0x0, 0x2, 0x0) openat$kvm(0xffffffffffffff9c, 0x0, 0x0, 0x0) 6m5.097569124s ago: executing program 54 (id=8869): r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000280), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000000c0)={0xc, 0x0, 0x0}) epoll_create1(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x3d, &(0x7f0000000040)={0x1, &(0x7f0000000080)=[{0x6, 0x0, 0x0, 0x7ffffdbd}]}) shmget$private(0x0, 0x3000, 0x2, &(0x7f0000ffd000/0x3000)=nil) shmdt(0x0) r4 = socket(0x10, 0x3, 0x0) ioctl$sock_ipv6_tunnel_SIOCADDTUNNEL(r4, 0x89f7, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={0x0}, 0x18) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f0000724000/0x4000)=nil, 0x4000, 0x4000, 0x3, &(0x7f0000290000/0x4000)=nil) syz_emit_ethernet(0x95, &(0x7f0000000240)=ANY=[@ANYBLOB="ffffffffffffbbbbbbbbbbbb810013000805000817a2f1ff80114502115efa2edffe20909cab2da7c0ba8cc356fcdb59c3048b9ae94577115ca496e8207377a0b02da9b6b5f9dbacf68e1ecd9b71d26b036bef2c5ce88ea55818abc98ace892033dfe821fa6263b648e2bd1fcc2e0f5a7088bd59ef54b91786f90f4626dd33800b261e2f6292f759b1c6d900000000"], &(0x7f00000001c0)={0x1, 0x1, [0xf74, 0x4e0, 0xe4b, 0xa20]}) syz_open_dev$usbfs(&(0x7f0000000100), 0x775, 0x8000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) dup(r2) r5 = openat$rfkill(0xffffffffffffff9c, &(0x7f0000000040), 0x801, 0x0) write$rfkill(r5, &(0x7f0000000080)={0x0, 0x1, 0x3, 0x1}, 0x8) r6 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="12013f00000000407f04ffff000000000001090224000100000000090400001503000000092140000001220f000905", @ANYRES16], 0x0) syz_usb_control_io$hid(r6, 0x0, 0x0) syz_usb_control_io$hid(r6, &(0x7f0000000280)={0x24, 0x0, 0x0, 0x0, 0x0}, 0x0) r7 = syz_open_dev$hiddev(&(0x7f0000000540), 0x0, 0x0) ioctl$HIDIOCGUSAGE(r7, 0xc018480b, &(0x7f0000000040)={0x1, 0xffffffff, 0x6f94, 0x5, 0xa45a2b2e, 0x7fff}) ioctl$IOMMU_TEST_OP_ADD_RESERVED(r0, 0x3ba0, &(0x7f00000003c0)={0x48, 0xc, r1, 0x0, 0x0, 0x200000000}) socket$kcm(0x10, 0x2, 0x0) 6m0.719123001s ago: executing program 7 (id=8895): sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000024d00)={0x0, 0x0, &(0x7f0000024cc0)={&(0x7f0000003c40)=@newchain={0xe88, 0x64, 0x300, 0x70bd2e, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x7, 0x1}, {0x5, 0x10}, {0xf, 0x2}}, [@f_rsvp={{0x9}, {0xe58, 0x2, [@TCA_RSVP_ACT={0xe54, 0x6, [@m_pedit={0xe50, 0x3, 0x0, 0x0, {{0xa}, {0xe24, 0x2, 0x0, 0x1, [@TCA_PEDIT_PARMS={0xe20, 0x2, {{{0x2, 0x7, 0x10000000, 0x9, 0x1}, 0xf1, 0x2}, [{0x2, 0xfffffffb, 0x752b, 0x9, 0x5, 0x2}, {0x6507b03b, 0x1, 0x7, 0xfffffffe, 0x6, 0x5}, {0x4, 0x1, 0x3, 0x8a, 0x6, 0x2}, {0x7, 0x1200000, 0x88d, 0x2, 0x4, 0x2}, {0xffff5cff, 0x4, 0x0, 0x1, 0x40, 0x8001}, {0x6, 0x9, 0x3, 0x0, 0x8, 0xf}, {0x5, 0x9, 0x2, 0x2, 0x3, 0x4}, {0x3, 0x7fffffff, 0x39cbefbf, 0x3, 0x3, 0x8}, {0x6, 0x0, 0xf, 0x1, 0x9, 0x1000}, {0x80000000, 0xffff, 0x4, 0x4, 0x80}, {0x3ff, 0x4, 0x3a14, 0x56d5, 0x2, 0x2}, {0x2, 0x2, 0x8, 0x7, 0xffffff81}, {0x3, 0xc9d, 0x3, 0x13ee, 0x4, 0x6}, {0xcd4, 0x1, 0x8, 0x4e80000, 0xf950, 0x9873}, {0x3772, 0x1182, 0x6, 0x6ae9, 0x79, 0xfb28}, {0x8, 0x6962, 0x0, 0x6, 0x4, 0x157}, {0x12968238, 0x0, 0xffffffff, 0x101, 0x0, 0x6}, {0x8, 0x9, 0xa68c, 0x2, 0x1, 0x80000000}, {0x1, 0x80000001, 0x8, 0x1000, 0x7, 0xa}, {0x6, 0x7, 0x9, 0x7fff, 0x6ffb, 0x7}, {0x2, 0x7bb, 0x10, 0xb6c, 0x9, 0x9}, {0x6, 0x5, 0x80000000, 0x9759, 0x40, 0x1c}, {0xfffff2e7, 0x7, 0x3, 0x7, 0xa2, 0xfffffff9}, {0x7, 0x2, 0xd, 0x5, 0x6, 0x7fffffff}, {0xb30, 0xfffffff8, 0xc767, 0x2, 0x3, 0x805a0}, {0xffff3594, 0x7, 0x8, 0x2, 0xfffff1f2, 0x4}, {0x4, 0x1, 0x3, 0x1ff, 0x3, 0x3ff}, {0xa0d0, 0xffffff30, 0x0, 0x1, 0x5, 0x5}, {0x0, 0x8, 0x3d, 0x4, 0xfffffffd, 0xde0}, {0x6, 0x8, 0xfffffffc, 0x4, 0x9, 0x10000}, {0x0, 0x80000000, 0x85, 0x9, 0x30ba, 0xfc}, {0x6, 0x2, 0xf, 0x7, 0x7f, 0x1efb}, {0xfffffbff, 0x0, 0x3, 0xe8f6, 0x4, 0x98d}, {0x8, 0x7d0, 0x8, 0xff, 0x7, 0x1}, {0x5, 0x3, 0x7ff, 0x0, 0x2, 0x613}, {0x0, 0xfff, 0x4c3c, 0x5, 0x2, 0x2}, {0x8, 0x2, 0x0, 0xfffffffd, 0xdb1c, 0x3ff}, {0x5, 0xfffffffd, 0x8001, 0x81, 0x9, 0x1}, {0x3, 0x4175, 0x0, 0x2, 0x9, 0x5}, {0x1, 0x3, 0x4, 0x9, 0x100, 0x2}, {0x7, 0x10, 0x0, 0x9, 0xdc}, {0xfffffffb, 0x8, 0xff, 0x6, 0x3, 0x8}, {0x5, 0xff, 0x401, 0x6, 0x7, 0x3}, {0x18, 0x1, 0x4, 0xfff, 0xa, 0x2}, {0x6, 0x9, 0x10000, 0x3f, 0xab9, 0xfffffff5}, {0x7fffffff, 0x2, 0x94c, 0x9dee, 0xffff1483, 0x8}, {0x6fce8c73, 0x81, 0x7, 0x3ff, 0x0, 0x1}, {0x7fff, 0xad, 0x4, 0x0, 0x4, 0x7ff}, {0x1, 0xe364, 0x100, 0x9, 0x3, 0x2}, {0x5, 0x4, 0x80000000, 0x6, 0xb, 0x8}, {0xb95c, 0x80000001, 0x9, 0x6, 0xc, 0xb}, {0x3, 0x3, 0xc1, 0x0, 0x7f7, 0xfffff530}, {0x1, 0x0, 0x40, 0x2, 0x5}, {0x0, 0x3, 0x7, 0x82b, 0x0, 0x5}, {0xfff, 0x98, 0x6a4c, 0x101, 0x9, 0x40}, {0xffff, 0x7, 0x38, 0xb, 0x8, 0x8000}, {0x1, 0x0, 0x0, 0x6, 0x5, 0xf8}, {0x1, 0x6, 0xef0, 0x0, 0x101, 0x2}, {0x8, 0x7, 0x6f, 0x7, 0x6, 0x3}, {0x3f, 0x5, 0x3, 0x8, 0x9, 0x1}, {0x80000001, 0xfffffff9, 0x5, 0x800, 0x543, 0x1}, {0x22a, 0x201, 0x3, 0x0, 0x4, 0x8}, {0xad, 0x7, 0xfffffffa, 0x7b9, 0x164, 0x9}, {0x4, 0x7, 0x9, 0x7, 0x5, 0xc66}, {0x9, 0x3, 0x5, 0x3, 0x54, 0x6}, {0xf, 0x5, 0x9, 0x9, 0xe, 0x7}, {0x2a0d, 0x5, 0x4, 0x7, 0x9, 0x4}, {0x17, 0x200, 0xffff8001, 0x6, 0x62a, 0x4}, {0xc, 0x24000, 0x7f, 0x6b, 0x4, 0xd}, {0x7329e723, 0x4, 0x2, 0x1, 0x2, 0x5}, {0x10000, 0x80, 0x581f, 0x0, 0x5, 0x4}, {0x6, 0x3, 0x2, 0x7, 0x3, 0xcb14}, {0x7, 0x25b, 0x2, 0x6, 0x4, 0x9}, {0x8, 0x7, 0x4, 0xfffffffe, 0x7, 0x9}, {0x7, 0x7, 0x0, 0x648, 0x5, 0x100}, {0x1, 0x0, 0x59a0, 0x1, 0x7, 0x401}, {0x10000, 0x7ff, 0xfffffcca, 0xff, 0x8, 0x3}, {0x1, 0x4, 0x5, 0x7, 0x5}, {0x4, 0x2, 0x6, 0xd, 0x7, 0xb152}, {0x47, 0x9, 0x5, 0xfffffff9, 0x7fffffff, 0xa00000}, {0x4, 0x26c, 0x9, 0x8bab, 0xbc5d}, {0x1, 0x7, 0x5, 0x7, 0x8000, 0x40009}, {0x5f, 0x8, 0x5, 0x200, 0x8, 0x10001}, {0x8, 0x2, 0x80000000, 0x6, 0x101, 0x8}, {0x80000003, 0xfff, 0x10, 0xfffffff3, 0x8, 0x4}, {0x800, 0xffff, 0x5, 0x7, 0x2, 0x2b25}, {0x8, 0x7, 0x6, 0x1, 0x3, 0x8e02}, {0x1, 0x9e6, 0x8, 0x400, 0x6, 0x3}, {0x8, 0x0, 0x1, 0x7, 0x1, 0x3}, {0x9, 0x2, 0x2, 0x8, 0x3, 0x4}, {0x6, 0xfffffec4, 0x200, 0x8, 0x8, 0x9}, {0xffffffff, 0x8, 0x500, 0x400, 0xc52b, 0x4}, {0x9, 0x1, 0x100, 0xb6a, 0x9, 0x32b5}, {0x8, 0x1, 0x4, 0x0, 0xd73, 0x870}, {0xe08c, 0x7ff, 0x2, 0x6, 0x40, 0x9}, {0xffff, 0x4428, 0x3, 0x6, 0x8, 0x9}, {0x1000, 0x10001, 0x5, 0x4, 0x3, 0xb}, {0xfffff0aa, 0x9, 0xfffffffa, 0x5, 0x2, 0x4}, {0xd, 0xfffffff0, 0x4, 0x0, 0x8, 0x101}, {0xd, 0x2, 0x686, 0xfffffffa, 0x4, 0x4}, {0x7fff, 0x6, 0x200, 0x6, 0x4, 0x8}, {0x96, 0x6, 0x7, 0x7, 0x226, 0x8}, {0x6, 0x3, 0x5, 0x6, 0x7, 0xfff}, {0x3, 0xffffffff, 0x2, 0x568, 0x4, 0xffffffeb}, {0x2, 0x200, 0x2, 0x7, 0x6, 0x6}, {0x4, 0x566, 0x10001, 0xb, 0x4, 0x5594fdf3}, {0x423303a3, 0x9, 0x6, 0x3, 0x6, 0x3}, {0x100, 0x3, 0x0, 0x9, 0x8, 0x25}, {0x8, 0x100d47, 0x0, 0x0, 0x6, 0x8f6d}, {0xff, 0x0, 0x0, 0x1, 0x7, 0xe}, {0xce1, 0x9, 0x0, 0x4, 0xffffffff, 0x200}, {0x4, 0x1000e, 0x3, 0x5e0, 0x8, 0x1}, {0x0, 0x1, 0x1, 0x1, 0x9, 0x8}, {0x4f75, 0x8, 0x3c, 0xa, 0x4, 0x5}, {0x3, 0xd64, 0x1, 0x6, 0x8, 0x6}, {0x3, 0x401, 0x6, 0x4, 0x80, 0x640a525a}, {0x5, 0x0, 0x8, 0xfffffffe, 0xe, 0x6cd4}, {0x9, 0x0, 0x8, 0xa9ba, 0x100, 0x5}, {0x15, 0xfffffeff, 0x2, 0x5, 0x5fc0, 0xfffffff1}, {0x39d, 0x9, 0x1, 0x0, 0xfc, 0x7}, {0x6, 0xe69, 0xe, 0xffffff81, 0xbe7e, 0x401}, {0xfffffffa, 0x4, 0x0, 0x0, 0x6, 0xfffff001}, {0xcf2d, 0x8, 0x9176, 0x0, 0x4f, 0x1}, {0x0, 0x9, 0x5, 0xfff, 0x9030}, {0x4, 0x4, 0x800, 0x41e, 0x8000}, {0x6, 0xfffffffa, 0x0, 0x9a, 0x6, 0x8}, {0x3, 0xb, 0xf079, 0x7fffffff, 0x200, 0x7}, {0x65f, 0x100, 0x8, 0x1, 0x400, 0x2}], [{0x3}, {0x1, 0x1}, {0x5, 0x1}, {}, {}, {0x5}, {0x4, 0x1}, {0x1}, {0x3, 0x1}, {0x4}, {0x3}, {0x0, 0x1}, {0x2}, {0x1, 0x1}, {0x3, 0x1}, {0x3}, {0x1, 0x1}, {0x3}, {0x3, 0x1}, {0x3}, {0x0, 0x1}, {0x4}, {0x3}, {0x4}, {0x5, 0x1}, {0x3, 0x1}, {0x1}, {0x2}, {0x3, 0x1}, {0x3}, {0x2}, {0x3}, {0x3}, {0x1}, {0x0, 0x1}, {0x3}, {0x0, 0x1}, {}, {0x5, 0x1}, {0x5}, {}, {0x4, 0x1}, {0x2}, {}, {0x2}, {0x2, 0x1}, {0x6, 0x1}, {0x4, 0x1}, {0x1, 0x1}, {0x5, 0x1}, {0x5, 0x1}, {}, {}, {0x5, 0x649fb4c58d4cf3cc}, {0x0, 0x1}, {0x2, 0x1}, {0x5, 0x1}, {0x2}, {0x0, 0x1}, {0x1, 0x1}, {0x1}, {0x3}, {0x1, 0x1}, {0x3}, {0x4, 0x1}, {0x5}, {0x0, 0x1}, {0x3, 0x1}, {0x0, 0x1}, {0x2, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x4}, {0x1, 0x1}, {0x2, 0x1}, {}, {0x1}, {0x3}, {0x3, 0x1}, {0x2}, {0x1, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x1, 0x1}, {0x0, 0x1}, {0x1, 0x1}, {0x2}, {0x3}, {0x3, 0x1}, {0x4, 0x1}, {0x7, 0x1}, {0x3}, {0x1}, {0x2, 0xd2cd4f2f2bcaea07}, {0x5fee40d1ae85c2c8}, {0x2, 0x1}, {0x1}, {0x2, 0x1}, {0x1, 0x1}, {0x1}, {0x2, 0x1}, {0x4, 0x1}, {0x3, 0x1}, {0x3, 0x1}, {0x1}, {0x4, 0x1}, {0x1}, {0x2}, {0x1}, {0x2, 0x8dafc58315d2bbb3}, {0x2}, {}, {0x0, 0x1}, {0x3, 0x1}, {0x3}, {0x5, 0x1}, {0x5}, {0x5, 0x1}, {0x1}, {0x3, 0x9889dd74d1bcf2ee}, {0x1, 0x1}, {0x7}, {0x3}, {0x4}, {}, {0x3}, {0x3}, {0x1}], 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x3, 0x2}}}}]}]}}]}, 0xe88}, 0x1, 0x0, 0x0, 0x810}, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 5m58.67508684s ago: executing program 7 (id=8899): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=ANY=[@ANYBLOB="1b00000000000000000000000080"], 0x48) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000002c80)={0x3, 0xd, &(0x7f0000000b40)=ANY=[@ANYBLOB="18020000000000000000000000000000850000002e00000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7"], &(0x7f0000000680)='syzkaller\x00'}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={r1, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed387dbe9abc89b6f5bec", 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) 5m55.991921687s ago: executing program 7 (id=8902): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r2, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r2, 0x0) preadv(r2, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r2, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r3, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r2, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r3, 0xae80, 0x0) 5m51.777608015s ago: executing program 7 (id=8908): syz_open_dev$sndctrl(0x0, 0x0, 0x800) mkdir(0x0, 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f00000000c0)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) syz_emit_ethernet(0x2e, &(0x7f0000000100)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c20000000800450000200000000000119078ac1414bbac1014bb00004e21000c907801000000"], 0x0) r2 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$PIO_UNIMAP(r2, 0x4b67, &(0x7f0000000040)={0x0, 0x0}) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) socket$qrtr(0x2a, 0x2, 0x0) connect$unix(r3, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r5 = fsopen(&(0x7f0000000600)='devpts\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r5, 0x6, 0x0, 0x0, 0x0) r6 = fsmount(r5, 0x1, 0x1) fchdir(r6) fremovexattr(0xffffffffffffffff, &(0x7f0000000000)=@known='user.syz\x00') 5m48.339411482s ago: executing program 7 (id=8913): socket$pppoe(0x18, 0x1, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x2010, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) r4 = msgget$private(0x0, 0x0) msgsnd(r4, &(0x7f0000000340)=ANY=[@ANYRES16], 0x2000, 0x0) msgrcv(r4, 0x0, 0x0, 0x2, 0x3000) msgctl$IPC_SET(r4, 0x1, &(0x7f00000004c0)={{0x0, 0xee00, 0x0, 0x0, 0x0, 0x0, 0xfffe}, 0x0, 0x0, 0xb, 0x6f76, 0x7, 0x0, 0x1, 0x8, 0x7f, 0x3}) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000100)={0x0, 0x0, 0xfffffffffffffffd, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="370000001000010000000000000000000000000a78000000060a0b04000000000000000002000000500004804c00018011000100666c6f775f6f66666c6f616400000000340002800900010073797a30000000000900010073797a30000000000900010073797a30000000000900010073797a32000000000900010073797a300000000008000a7f61d68f0acb6d69001100010000000000000000000300000a"], 0xa0}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0xa0502, 0x49) io_setup(0x1, &(0x7f00000016c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x8, r7, &(0x7f0000000180)="282fa8c2", 0x4, 0x5}]) 5m31.641922738s ago: executing program 55 (id=8913): socket$pppoe(0x18, 0x1, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) mmap(&(0x7f0000ff9000/0x4000)=nil, 0x4000, 0xe, 0x2010, r0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0xa, 0x8000, 0x0, 0x9, 0x1, 0xfffffdffffffffff, 0xfa0f, 0xffffffff}, 0x0) syz_open_dev$dri(&(0x7f0000000040), 0x1, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x2982, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) r3 = getpid() sched_setscheduler(r3, 0x1, &(0x7f0000000100)=0x5) r4 = msgget$private(0x0, 0x0) msgsnd(r4, &(0x7f0000000340)=ANY=[@ANYRES16], 0x2000, 0x0) msgrcv(r4, 0x0, 0x0, 0x2, 0x3000) msgctl$IPC_SET(r4, 0x1, &(0x7f00000004c0)={{0x0, 0xee00, 0x0, 0x0, 0x0, 0x0, 0xfffe}, 0x0, 0x0, 0xb, 0x6f76, 0x7, 0x0, 0x1, 0x8, 0x7f, 0x3}) openat$procfs(0xffffffffffffff9c, &(0x7f00000001c0)='/proc/timer_list\x00', 0x0, 0x0) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r6, &(0x7f0000000100)={0x0, 0x0, 0xfffffffffffffffd, 0x1, 0x0, 0x0, 0x4000850}, 0x24044010) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000680)=ANY=[@ANYBLOB="14000000100001000000000000b890c1a000000a80000000160a01030000000000000000020000000900020073797a30000000000900010073797a30000000005400038008000240000000000800014000000000400003801400010076657468315f746f5f6272696467650014000100776732000000000000000000000000000b00010076657468305f746f5f7465616d00"], 0xa8}}, 0x0) sendmsg$NFT_BATCH(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=ANY=[@ANYBLOB="370000001000010000000000000000000000000a78000000060a0b04000000000000000002000000500004804c00018011000100666c6f775f6f66666c6f616400000000340002800900010073797a30000000000900010073797a30000000000900010073797a30000000000900010073797a32000000000900010073797a300000000008000a7f61d68f0acb6d69001100010000000000000000000300000a"], 0xa0}, 0x1, 0x0, 0x0, 0x2000094}, 0x4000800) r7 = openat$sysfs(0xffffffffffffff9c, &(0x7f0000000240)='/sys/power/mem_sleep', 0xa0502, 0x49) io_setup(0x1, &(0x7f00000016c0)=0x0) io_submit(r8, 0x1, &(0x7f0000000140)=[&(0x7f0000000000)={0x0, 0x0, 0x0, 0x1, 0x8, r7, &(0x7f0000000180)="282fa8c2", 0x4, 0x5}]) 5m9.006103313s ago: executing program 1 (id=8971): mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) r0 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_RECVRCVINFO(r0, 0x84, 0x20, 0x0, &(0x7f0000000080)) 5m8.368840092s ago: executing program 1 (id=8974): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)=ANY=[@ANYBLOB="1201000000000020ec13060000000000000109022400010000000009040000010300000009210000000122020009058103"], 0x0) syz_usb_control_io(r0, &(0x7f0000000900)={0x2c, &(0x7f0000000e80)=ANY=[@ANYBLOB="20014c0000004c22"], 0x0, 0x0, 0x0, 0x0}, 0x0) 5m5.399525743s ago: executing program 1 (id=8978): bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="0e000000040000000800000008"], 0x48) socket$nl_route(0x10, 0x3, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socket$vsock_stream(0x28, 0x1, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) openat$vnet(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) pselect6(0x40, &(0x7f00000001c0)={0x0, 0x0, 0x3, 0xfffffffffffffffd, 0x0, 0x80, 0x4}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x8, 0x9, 0x0, 0x0, 0x7}, 0x0, 0x0) 5m3.224773937s ago: executing program 1 (id=8981): sendmsg$nl_route_sched_retired(0xffffffffffffffff, &(0x7f0000024d00)={0x0, 0x0, &(0x7f0000024cc0)={0x0}, 0x1, 0x0, 0x0, 0x810}, 0x1) prctl$PR_SET_MM_MAP(0x23, 0xe, &(0x7f0000000080)={&(0x7f0000ff7000/0x1000)=nil, &(0x7f0000ff1000/0xf000)=nil, &(0x7f0000ff1000/0x2000)=nil, &(0x7f0000ff5000/0x3000)=nil, &(0x7f0000ff8000/0x4000)=nil, &(0x7f0000ff8000/0x3000)=nil, &(0x7f0000ffd000/0x3000)=nil, &(0x7f0000ffb000/0x3000)=nil, &(0x7f0000ff5000/0x1000)=nil, &(0x7f0000ffa000/0x1000)=nil, &(0x7f0000ffa000/0x2000)=nil, 0x0}, 0x68) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, 0x0}, 0x24004045) r0 = io_uring_setup(0x524, &(0x7f0000000040)={0x0, 0x3cb1, 0x1c080, 0xa, 0x20002f7}) sendmsg$nl_route(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[], 0x30}, 0x1, 0x0, 0x0, 0x4040000}, 0x0) io_uring_enter(r0, 0x2219, 0x7721, 0x16, 0x0, 0x0) 5m2.517098082s ago: executing program 1 (id=8983): r0 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) connect$bt_sco(r0, &(0x7f0000000000)={0x1f, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}}, 0x8) r1 = epoll_create(0x5) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, 0x0) 5m1.490361453s ago: executing program 1 (id=8985): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr, 0x8000}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0xfdff) r4 = creat(&(0x7f00000001c0)='./bus\x00', 0x77) dup3(0xffffffffffffffff, r4, 0x80000) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_IBSS(r6, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r7 = eventfd(0x8000) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000180)={r7, 0x6}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={r7, 0x6, 0x1}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @private=0xa010101}}, 0xe0, 0x68}, 0x90) 4m46.043140874s ago: executing program 56 (id=8985): socket$nl_route(0x10, 0x3, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r2, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="0000000000000000000000000000400000000000000000000000000000000000000000000000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000010000000000000044000500000000000000000000000000000000000000000033"], 0xfc}}, 0x0) r3 = socket$inet6(0xa, 0x2, 0x0) connect$inet6(r3, &(0x7f00000002c0)={0xa, 0x4e24, 0x0, @rand_addr, 0x8000}, 0x1c) sendmmsg(r3, &(0x7f00000092c0), 0x4ff, 0xfdff) r4 = creat(&(0x7f00000001c0)='./bus\x00', 0x77) dup3(0xffffffffffffffff, r4, 0x80000) r5 = socket$inet6_sctp(0xa, 0x5, 0x84) r6 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NL80211_CMD_JOIN_IBSS(r6, 0x0, 0x0) ioctl$KVM_CREATE_IRQCHIP(0xffffffffffffffff, 0xae60) r7 = eventfd(0x8000) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000180)={r7, 0x6}) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000140)={r7, 0x6, 0x1}) setsockopt$inet_sctp6_SCTP_PEER_ADDR_THLDS(r5, 0x84, 0x1f, &(0x7f0000000240)={0x0, @in={{0x2, 0x4e24, @private=0xa010101}}, 0xe0, 0x68}, 0x90) 4m33.433329841s ago: executing program 2 (id=9025): r0 = openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) socket$nl_generic(0x10, 0x3, 0x10) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r2 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000340)=@newqdisc={0x4c, 0x24, 0x4ee4e6a52ff56541, 0x1, 0x25dfdbfd, {0x0, 0x0, 0x0, r3, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff2}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x1c, 0x2, {{0x3, 0x3, 0x6361, 0x7, 0xffffffff, 0x3}}}}]}, 0x4c}, 0x1, 0x0, 0x0, 0x40088c1}, 0x0) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000940)=@newqdisc={0x3c, 0x24, 0x4ee4e6a52ff56541, 0x70b926, 0x25dfdbff, {0x0, 0x0, 0x0, r3, {0x0, 0xd}, {0x5, 0xb}, {0xfff3, 0x4}}, [@qdisc_kind_options=@q_codel={{0xa}, {0xc, 0x2, [@TCA_CODEL_CE_THRESHOLD={0x8}]}}]}, 0x3c}, 0x1, 0x0, 0x0, 0x240040e0}, 0x40000) r4 = socket$packet(0x11, 0x3, 0x300) sendto$packet(r4, &(0x7f00000005c0)="bad330fbc9b55400040000ea0756", 0xe, 0x40, &(0x7f00000001c0)={0x11, 0x16, r3, 0x1, 0xda, 0x6, @multicast}, 0x14) 4m30.064274328s ago: executing program 2 (id=9034): r0 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f00000008c0)={'bridge_slave_1\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000040)=ANY=[@ANYBLOB, @ANYRES32=r1, @ANYBLOB="d9d2d5610a000200aaaaaaaaaa1c"], 0x30}, 0x1, 0x0, 0x0, 0x1}, 0x4040000) 4m29.404498859s ago: executing program 2 (id=9036): r0 = socket$netlink(0x10, 0x3, 0x0) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000001480)={0xffffffffffffffff, 0xffffffffffffffff}) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000400)=@newqdisc={0x30, 0x24, 0x4ee4e6a52ff56541, 0x170b923, 0x80000, {0x0, 0x0, 0x0, 0x0, {0x0, 0xd}, {0xb, 0xb}, {0xa, 0xfff3}}, [@qdisc_kind_options=@q_hhf={{0xfec5}, {0x4}}]}, 0x30}, 0x1, 0x0, 0x0, 0x24014031}, 0x4090) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000340)={'bridge_slave_0\x00'}) sendmsg$nl_route(r0, 0x0, 0x14) 4m28.790740148s ago: executing program 2 (id=9038): r0 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000040), 0x1a9041, 0x0) write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) poll(0x0, 0x0, 0x5) io_setup(0x8, &(0x7f0000004200)=0x0) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f0000000080)={0x0, 0xf4, 0x8, 0x3, 0x2, "5fe85ef060b2427092c704aafbe58ffc2c2ca6", 0x6, 0x9}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r3, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x2}]) 4m27.82232716s ago: executing program 2 (id=9041): r0 = getpgrp(0x0) sched_setaffinity(r0, 0x8, &(0x7f0000000040)=0x5) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000080)=0x6) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x1b5cb000) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) get_robust_list(r2, &(0x7f0000000200)=0x0, &(0x7f0000000240)) 4m20.708027164s ago: executing program 2 (id=9044): socket$caif_stream(0x25, 0x1, 0x4) mkdirat(0xffffffffffffff9c, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00') read$FUSE(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmmsg$unix(r3, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) 4m5.100180684s ago: executing program 57 (id=9044): socket$caif_stream(0x25, 0x1, 0x4) mkdirat(0xffffffffffffff9c, 0x0, 0x10) syz_genetlink_get_family_id$gtp(&(0x7f0000000040), 0xffffffffffffffff) syz_open_procfs$namespace(0xffffffffffffffff, &(0x7f0000000000)='ns/net\x00') read$FUSE(0xffffffffffffffff, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='memory.current\x00', 0x26e1, 0x0) close(r1) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000300)={0x26, 'aead\x00', 0x0, 0x0, 'aegis128-aesni\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x80000) setsockopt$ALG_SET_KEY(r2, 0x117, 0x1, &(0x7f0000000200)="ad00"/16, 0x10) sendmmsg$unix(r3, &(0x7f0000003dc0)=[{{&(0x7f0000000000)=@file={0x0, './file0\x00'}, 0x6e, 0x0, 0x0, 0x0, 0x0, 0x9802}}, {{&(0x7f0000000280)=@file={0x0, './file0\x00'}, 0x6e, 0x0}}], 0x299, 0x0) 3m13.588007794s ago: executing program 8 (id=9160): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec8500000050000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r0}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB, @ANYRESHEX]) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xb, 0x0, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000005c0)=ANY=[@ANYBLOB="1201500000000010d90481a000000000000109022400010000000009040100010300000009210000000122080009058103"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000002c0)={0x24, &(0x7f00000000c0)={0x20, 0x4, 0x2, {0x2, 0xf}}, 0x0, &(0x7f0000000640)={0x0, 0x22, 0xc, {[@main=@item_4={0x3, 0x0, 0x0, "601d9c7a"}, @main=@item_012={0x0, 0x0, 0xa}, @local=@item_012={0x0, 0x2, 0x3}, @main=@item_4={0x3, 0x0, 0xa, "6d64ff9c"}]}}, 0x0}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed36adbe9abc89b6f5bec", 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 3m9.958002919s ago: executing program 8 (id=9170): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r1 = syz_open_dev$sg(0x0, 0x0, 0x8002) fcntl$dupfd(r0, 0x0, r1) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x3e, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000300)=0x17) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) r4 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x8, &(0x7f0000000040)={0x1, &(0x7f0000000000)=[{0x6, 0x0, 0x0, 0x7fc00100}]}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, 0x0) ioctl$SECCOMP_IOCTL_NOTIF_RECV(r4, 0xc0502100, &(0x7f0000002780)={0x0}) ioctl$SECCOMP_IOCTL_NOTIF_ADDFD(r4, 0x40182103, &(0x7f0000000080)={r5, 0x3, r3}) 3m8.704649711s ago: executing program 8 (id=9172): socket$inet6(0xa, 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) shutdown(0xffffffffffffffff, 0x0) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$pfkey(0xffffffffffffff9c, 0x0, 0x40, 0x0) r2 = socket$rxrpc(0x21, 0x2, 0xa) r3 = socket$unix(0x1, 0x2, 0x0) bind$unix(r3, &(0x7f0000000100)=@file={0x1, '\xe9\x1fq\x89Y\x1e\x923aK\x00'}, 0x6e) setsockopt$SO_TIMESTAMP(r3, 0x1, 0x1d, &(0x7f0000000080)=0x7, 0x4) recvmmsg(r3, &(0x7f0000000f00)=[{{0x0, 0x0, 0x0, 0x0, &(0x7f0000000600)}, 0xc7ab}], 0x1, 0x1000400000de, 0x0) bind$rxrpc(r2, 0x0, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, 0x0, 0x0) ioctl$IOMMU_GET_HW_INFO(0xffffffffffffffff, 0x3b8a, &(0x7f0000000380)={0x28, 0x0, 0x0, 0x1d, &(0x7f0000019080)=""/29}) r5 = socket$inet6_mptcp(0xa, 0x1, 0x106) shmget(0x1, 0x4000, 0x200, &(0x7f0000ffb000/0x4000)=nil) syz_usb_control_io(0xffffffffffffffff, 0x0, 0x0) r6 = syz_io_uring_setup(0x8d2, &(0x7f0000000240)={0x0, 0x0, 0x1000, 0x6}, &(0x7f0000000040)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r7, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r7, r8, &(0x7f0000000200)=@IORING_OP_SENDMSG={0x9, 0x40, 0x0, r5, 0x0, &(0x7f00000002c0)={0x0, 0x0, 0x0}, 0x0, 0x20000044}) io_uring_enter(r6, 0x2afd, 0x308b, 0xc, 0x0, 0x0) 3m5.464070227s ago: executing program 8 (id=9177): openat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x40, 0x0) r0 = openat$fuse(0xffffffffffffff9c, &(0x7f00000000c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000000100), 0x10, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r0, &(0x7f0000002980)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r0, &(0x7f0000000040)={0x50, 0x0, r1, {0x7, 0x1f, 0x6, 0xa68d7c519f800ff1, 0xffbc, 0x6, 0x4, 0x4, 0x0, 0x0, 0x40}}, 0x50) syz_fuse_handle_req(r0, &(0x7f0000008380)="00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000060000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001354c4b600", 0x2000, &(0x7f00000001c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000006340)={0x20, 0x0, 0x68cc, {0x0, 0x14}}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = openat(0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x2001, 0x8e) r3 = socket(0x1, 0x2, 0x0) getsockopt$sock_cred(r3, 0x1, 0x11, &(0x7f0000caaffb)={0x0, 0x0}, &(0x7f0000cab000)=0xc) setresuid(0x0, r4, r4) close(r0) writev(r2, &(0x7f0000001840)=[{&(0x7f00000002c0)="ca", 0x1}], 0x1) 3m4.188409209s ago: executing program 8 (id=9180): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000004b64ffec8500000050000000850000000f00000095"], &(0x7f0000000080)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x80) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000100)='kfree\x00', r0}, 0x10) r1 = bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[@ANYBLOB="16000000000000000400000001"], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r1, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x90) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x2f, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000f00)='kfree\x00', r2}, 0x10) mount$9p_fd(0x0, &(0x7f0000000000)='./file0\x00', &(0x7f0000000040), 0x10, &(0x7f0000000600)=ANY=[@ANYBLOB, @ANYRESHEX]) setsockopt$packet_int(0xffffffffffffffff, 0x107, 0xb, 0x0, 0x0) sendto$packet(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0) r3 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000005c0)=ANY=[@ANYBLOB="1201500000000010d90481a000000000000109022400010000000009040100010300000009210000000122080009058103"], 0x0) syz_usb_control_io(r3, 0x0, 0x0) syz_usb_control_io$hid(r3, &(0x7f00000002c0)={0x24, &(0x7f00000000c0)={0x20, 0x4, 0x2, {0x2, 0xf}}, 0x0, &(0x7f0000000640)={0x0, 0x22, 0xc, {[@main=@item_4={0x3, 0x0, 0x0, "601d9c7a"}, @main=@item_012={0x0, 0x0, 0xa}, @local=@item_012={0x0, 0x2, 0x3}, @main=@item_4={0x3, 0x0, 0xa, "6d64ff9c"}]}}, 0x0}, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f0000000180)={0xffffffffffffffff, 0x0, 0xe, 0x0, &(0x7f0000000100)="e0b9547ed36adbe9abc89b6f5bec", 0x0, 0xf, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4}, 0x50) 2m57.310926002s ago: executing program 8 (id=9188): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, 0x0) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x8840, 0x0) fcntl$setownex(r3, 0xf, &(0x7f0000000340)={0x2, 0xffffffffffffffff}) fcntl$lock(r3, 0x11, &(0x7f0000003c80)={0x2, 0x5, 0x80000000, 0x6}) 2m41.42455977s ago: executing program 58 (id=9188): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f0000000300)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb47, 0x9, 0x8, 0x80000001, 0x3}, 0x0) r2 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r2, 0x400454ca, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) ioctl$sock_inet_SIOCDELRT(0xffffffffffffffff, 0x890c, 0x0) mq_open(&(0x7f0000000480)='!sel\x00\x00\x00\x10\x00\x00\x00\x00\xd7\\P\xc1\xde.O\xcb]0y\x00\x00\x00\x00\x00\x00\x00\x00', 0x6e93ebbbcc0884f2, 0x196, 0x0) r3 = openat$vcsu(0xffffffffffffff9c, &(0x7f0000000000), 0x8840, 0x0) fcntl$setownex(r3, 0xf, &(0x7f0000000340)={0x2, 0xffffffffffffffff}) fcntl$lock(r3, 0x11, &(0x7f0000003c80)={0x2, 0x5, 0x80000000, 0x6}) 1m52.150300435s ago: executing program 9 (id=9299): r0 = socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r0, 0x8933, &(0x7f0000000080)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r0, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000380)={0x40, r1, 0x101, 0x20000, 0x0, {{}, {@val={0x8, 0x3, r2}, @void}}, [@NL80211_ATTR_PRIVACY={0x4}, @NL80211_ATTR_SSID={0xa, 0x34, @default_ibss_ssid}, @NL80211_ATTR_KEYS={0x14, 0x51, 0x0, 0x1, [{0x10, 0x0, 0x0, 0x1, [@NL80211_KEY_DATA_WEP40={0x9, 0x1, "4ff47cf928"}]}]}]}, 0x40}, 0x1, 0x0, 0x0, 0x4010}, 0x0) 1m51.518582523s ago: executing program 9 (id=9302): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="04"], 0x9) bpf$PROG_LOAD(0x5, &(0x7f0000000940)={0x1a, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe0b6f853d296e9f, '\x00', 0x0, @fallback=0x18}, 0x94) 1m50.390696593s ago: executing program 9 (id=9304): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) r2 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, 0x0}, 0x0) r3 = socket$unix(0x1, 0x1, 0x0) r4 = socket$kcm(0x11, 0x3, 0x0) r5 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r5) socket$unix(0x1, 0x2, 0x0) ioctl$SIOCSIFHWADDR(r5, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) r9 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCGIFINDEX(r9, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r9, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000a40)=@newqdisc={0x2c, 0x24, 0x4ee4e6a52ff56541, 0x70bd28, 0xfffffffc, {0x0, 0x0, 0x0, r10, {0x0, 0x9}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_drr={0x8}]}, 0x2c}}, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000300)={&(0x7f0000001300)=@newtfilter={0x478, 0x2c, 0xd3f, 0x30bd29, 0x25dfdbfd, {0x0, 0x0, 0x0, r11, {0xb, 0xfff3}, {}, {0x8, 0x300}}, [@filter_kind_options=@f_basic={{0xa}, {0x448, 0x2, [@TCA_BASIC_POLICE={0x444, 0x4, [@TCA_POLICE_TBF={0x3c, 0x1, {0x40ff, 0x2, 0x3, 0x4, 0x0, {0x4, 0x1, 0x8, 0x8, 0x4, 0x5}, {0xe, 0x2, 0xfff, 0xff00, 0x10}, 0xb72, 0x8001, 0xdb}}, @TCA_POLICE_RATE={0x404, 0x2, [0xf, 0x1, 0x2, 0x800, 0x40, 0xfffff801, 0x79, 0x8001, 0xf22, 0x0, 0x1, 0x0, 0x8, 0x4a7, 0x1, 0x2, 0x81, 0x4, 0x7, 0x2, 0xd5d, 0x5268, 0x7e, 0x3, 0x0, 0x6, 0x5, 0x8, 0x2, 0x4455, 0xffffffff, 0xfffeffff, 0x8, 0x45e, 0xff, 0x2, 0x0, 0x7f, 0x7fd, 0x2, 0x7, 0x8, 0xffffff45, 0x4, 0xc, 0x6, 0x6cff1733, 0xd39, 0x4, 0x7, 0x7, 0x8, 0x8001, 0x8, 0x3, 0x2, 0x1, 0x200, 0x12000000, 0x2, 0x9c, 0x7, 0x1, 0x2, 0x5, 0x2, 0x5, 0x9, 0x96, 0x37, 0xb6, 0x6, 0x1, 0x7, 0x7d, 0x2, 0xe2b, 0x10001, 0xfff, 0x3a, 0x100002, 0x10000, 0x81, 0x2, 0x7, 0x9, 0xd317, 0x9de, 0x6, 0x840, 0x1, 0x43, 0xff, 0x4, 0x0, 0x7fffffff, 0x8, 0x6, 0x8, 0x9, 0x5, 0x7, 0xd, 0x9e5, 0x0, 0x4, 0x76, 0x5, 0xffffffff, 0x7, 0x2, 0x5f, 0x0, 0x6, 0x865feb0b, 0x400002, 0x0, 0x1fb, 0x7fffffff, 0x401, 0x400, 0x5, 0xa2, 0x2, 0x195, 0x7, 0x3, 0x5, 0x6, 0xffff8c56, 0xfffffffb, 0x8, 0x2, 0x5, 0x7fffffff, 0x1, 0x6, 0x2, 0x7, 0x2, 0x4, 0x7a0, 0x1, 0x48, 0x10001, 0x5, 0x1, 0x6, 0x5, 0x7, 0x7f, 0x36800, 0x0, 0x0, 0x3, 0xfffffffe, 0x6, 0xe000, 0xb1, 0x5, 0x8, 0x8001, 0xffffffff, 0x1000, 0x7ff, 0xb, 0x80, 0x1, 0x5, 0x80000000, 0x53, 0x6, 0x4, 0x0, 0x3ff, 0x838, 0x9, 0xfffffffc, 0x7, 0x9, 0x2, 0x2, 0x50001, 0x1, 0xfffffff8, 0x5, 0x80000001, 0xfffffffe, 0x4, 0x2, 0x400, 0x800, 0x4, 0xfffff4bb, 0x8, 0x6, 0xc, 0x6, 0x2001, 0x2006, 0x9, 0x0, 0x944, 0x70, 0x6, 0x5, 0x10000, 0x5, 0x3, 0xb52f, 0xfe, 0x0, 0xa0, 0x8, 0x203, 0x4, 0x6, 0x0, 0xff, 0x3, 0x0, 0x5c, 0x6, 0x8, 0x0, 0x15, 0xffff, 0xfffffffe, 0x9, 0x7f, 0x4, 0x6, 0x6, 0x7, 0x0, 0xa, 0x8, 0x5, 0x4, 0x9, 0xfffc, 0x9d1, 0x1, 0xf, 0x8, 0x40, 0x10000, 0xd3ae, 0x5f5a, 0x1, 0x6, 0xd00, 0x0, 0x24e00b6d, 0x8f3, 0x2]}]}]}}]}, 0x478}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$sock_attach_bpf(r4, 0x107, 0xf, 0x0, 0x0) sendmsg$kcm(r4, &(0x7f0000000280)={&(0x7f0000000380)=@xdp={0x2c, 0x0, r6, 0x3e}, 0x80, &(0x7f0000000140)=[{&(0x7f0000000180)="27030200000214000e00002fb96dffff1144ee163cddcb00"/38, 0x26}, {&(0x7f00000004c0)="f058fe7dad777f8f", 0x8}], 0x2}, 0x5) 1m48.379035021s ago: executing program 9 (id=9307): r0 = openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000000200)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r0, @ANYBLOB=',rootmode=00000000000000000040000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) write$FUSE_NOTIFY_STORE(r0, &(0x7f0000000000)=ANY=[@ANYBLOB="2800000009000000000000000000000001"], 0x28) 1m47.985114616s ago: executing program 9 (id=9309): syz_init_net_socket$bt_l2cap(0x1f, 0x1, 0x3) r0 = getpgrp(0x0) sched_setaffinity(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x8, 0x80000100008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000300)=0x7) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000000)=0x3) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) r2 = syz_clone(0x8000, 0x0, 0xfffffffffffffe7e, 0x0, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, r2, 0x1, 0x0) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000019680)=""/102392, 0x18ff8) syz_io_uring_submit(0x0, 0x0, 0x0) r4 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={0x0, r4}, 0x18) rt_sigprocmask(0x0, &(0x7f0000000000)={[0xfffffffffffffffd]}, 0x0, 0x8) 1m40.243730038s ago: executing program 9 (id=9313): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0409"], 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) 1m21.874457334s ago: executing program 59 (id=9313): syz_emit_vhci(&(0x7f0000000000)=ANY=[@ANYBLOB="0409"], 0x9) bpf$PROG_LOAD(0x5, 0x0, 0x0) 49.431174891s ago: executing program 6 (id=9408): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000340)={0x50, 0x2, 0x6, 0x801, 0x0, 0x0, {}, [@IPSET_ATTR_FAMILY={0x5, 0x5, 0xa}, @IPSET_ATTR_PROTOCOL={0x5}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x50}}, 0x0) sendmsg$IPSET_CMD_ADD(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000780)=ANY=[@ANYBLOB="74000000090601020000000000000000030000000900020073797a310000000005000100070000004c0007801800018014000240fe8000000000000000000000000000aa1800148014000240fc000000000000000000000000000000060004404e1f0000050007008400000006000540"], 0x74}, 0x1, 0x0, 0x0, 0x10040003}, 0x0) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_ADD(r1, &(0x7f00000002c0)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x10040003}, 0x0) 48.848084012s ago: executing program 6 (id=9410): setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, &(0x7f0000000000)={0x0, 0x1, 0x0, 0x0, @vifc_lcl_ifindex, @local}, 0x10) syz_emit_ethernet(0xb6, &(0x7f0000000000)={@broadcast, @dev, @void, {@ipv4={0x800, @icmp={{0x5, 0x4, 0x0, 0x0, 0xa8, 0x0, 0x0, 0x0, 0x1, 0x0, @initdev={0xac, 0x1e, 0x0, 0x0}, @local}, @dest_unreach={0x3, 0x0, 0x0, 0x0, 0x0, 0x0, {0x23, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x89, 0x0, @dev, @local, {[@noop, @generic={0x86, 0xd, "c045d45768dc37efa0fc58"}, @timestamp_prespec={0x44, 0xc, 0x0, 0x3, 0x0, [{@loopback}]}, @ssrr={0x89, 0xf, 0x0, [@empty, @broadcast, @broadcast]}, @timestamp_addr={0x44, 0x44, 0x0, 0x1, 0x0, [{}, {@private}, {@local}, {@loopback}, {@private}, {@multicast2}, {@broadcast}, {@broadcast}]}, @timestamp={0x44, 0x8, 0x0, 0x0, 0x0, [0x0]}]}}}}}}}, 0x0) 48.380465607s ago: executing program 6 (id=9411): socket$inet_sctp(0x2, 0x5, 0x84) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00'}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$usbfs(&(0x7f0000000180), 0x205, 0x2581) r4 = fcntl$dupfd(r3, 0x0, r3) ioctl$USBDEVFS_REAPURB(r4, 0x4008550c, 0x0) 45.168760081s ago: executing program 6 (id=9416): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) mount(&(0x7f0000000140)=@nullb, &(0x7f0000000000)='./cgroup\x00', &(0x7f0000000040)='nilfs2\x00', 0x208000, 0x0) 41.444245292s ago: executing program 6 (id=9421): r0 = syz_usb_connect(0x0, 0x2d, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io(r0, 0x0, &(0x7f0000000800)={0x84, &(0x7f00000002c0)={0x0, 0x6, 0x4, "dd8dd290"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) 40.314047574s ago: executing program 6 (id=9425): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000a40), 0x5d, 0x4000000) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x60, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) syz_usb_connect(0x5, 0x0, 0x0, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x1, 0x2}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000000080)) syz_usb_connect$cdc_ecm(0x6, 0x5a, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = socket(0x10, 0x1, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000001200010a27bd7000fdffffff800000001400a800fe80000000000000000000000000ffffad8b19fc299aa4ec222d5ad3651a326a175b2e1ba82e1675d3d0e3b5b008c0570400b4ebf31a585fd14b29242bc92047080de64c5f16d40f5f76c60bf39bdc84eebeaae7f8f1dfbfac48db129321e15c58330d9ad91f2a7cddd8722a32da62c6a3f777558612d20d4f2eb60e345aa09e8fe7b2d6836594b25f2bb7d8a84e6cccee637f5038c90b3a4887c38a7d55000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000050}, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_GET_PIT2(r8, 0x8070ae9f, &(0x7f00000003c0)) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x2000000, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff3}}}, 0x24}}, 0x0) openat$rfkill(0xffffff9c, 0x0, 0x60041, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 23.955464567s ago: executing program 60 (id=9425): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f0000000a40), 0x5d, 0x4000000) recvfrom(0xffffffffffffffff, 0x0, 0x0, 0x60, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$nl_route(0x10, 0x3, 0x0) r3 = socket$inet_udplite(0x2, 0x2, 0x88) syz_usb_connect(0x5, 0x0, 0x0, 0x0) ioctl$KVM_IRQFD(0xffffffffffffffff, 0x4020ae76, &(0x7f0000000000)={0xffffffffffffffff, 0x1, 0x2}) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(0xffffffffffffffff, 0x84, 0x1d, 0x0, &(0x7f0000000080)) syz_usb_connect$cdc_ecm(0x6, 0x5a, 0x0, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f00000000c0)={'bridge0\x00', 0x0}) r5 = socket(0x10, 0x80002, 0x0) sendmsg$nl_route(r5, &(0x7f0000000000)={0x0, 0x10, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[@ANYBLOB="440000001300290a000000000000000007000000", @ANYRES32=r4, @ANYBLOB="00000000000000001c001a800800028008000200080000003e120000080002001040e5"], 0x44}}, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x3, &(0x7f0000000240)=ANY=[@ANYBLOB], &(0x7f0000000000)='syzkaller\x00'}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, 0x0, 0x0) r6 = socket(0x10, 0x1, 0x0) setsockopt$netlink_NETLINK_TX_RING(r6, 0x10e, 0xc, 0x0, 0x0) sendmsg$nl_generic(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[@ANYBLOB="280000001200010a27bd7000fdffffff800000001400a800fe80000000000000000000000000ffffad8b19fc299aa4ec222d5ad3651a326a175b2e1ba82e1675d3d0e3b5b008c0570400b4ebf31a585fd14b29242bc92047080de64c5f16d40f5f76c60bf39bdc84eebeaae7f8f1dfbfac48db129321e15c58330d9ad91f2a7cddd8722a32da62c6a3f777558612d20d4f2eb60e345aa09e8fe7b2d6836594b25f2bb7d8a84e6cccee637f5038c90b3a4887c38a7d55000000"], 0x28}, 0x1, 0x0, 0x0, 0x4000050}, 0x0) r7 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r8 = ioctl$KVM_CREATE_VM(r7, 0xae01, 0x0) ioctl$KVM_CREATE_IRQCHIP(r8, 0xae60) ioctl$KVM_CREATE_PIT2(r8, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_GET_PIT2(r8, 0x8070ae9f, &(0x7f00000003c0)) sendmsg$nl_route_sched(r2, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x2000000, {0x0, 0x0, 0x0, r4, {}, {}, {0xfff3}}}, 0x24}}, 0x0) openat$rfkill(0xffffff9c, 0x0, 0x60041, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000180)={0x0, 0x2, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) 22.069678561s ago: executing program 4 (id=9459): io_uring_setup(0x539c, &(0x7f0000000280)={0x0, 0x93d2, 0x2, 0x45, 0x227}) socket(0x15, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x14, 0x2}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={0x0, 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 21.427664837s ago: executing program 4 (id=9460): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000005c0)=ANY=[@ANYBLOB="1201500000000010d90481a000000000000109022400010000000009040100010300000009210000000122080009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00\"\f'], 0x0}, 0x0) 17.715810231s ago: executing program 4 (id=9466): r0 = openat$ptmx(0xffffffffffffff9c, 0x0, 0x1a9041, 0x0) write$binfmt_aout(r0, &(0x7f00000003c0)=ANY=[], 0xff2e) ioctl$TCSETS(r0, 0x40045431, &(0x7f0000000dc0)={0x0, 0x0, 0x0, 0x0, 0x0, "0062ba7d82000000000000000000f7ffffff00"}) r1 = syz_open_pts(r0, 0x0) r2 = dup3(r1, r0, 0x0) io_setup(0x8, &(0x7f0000004200)=0x0) ioctl$TCSETSW2(r2, 0x402c542c, &(0x7f0000000080)={0x0, 0xf4, 0x8, 0x3, 0x2, "5fe85ef060b2427092c704aafbe58ffc2c2ca6", 0x6, 0x9}) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') io_submit(r3, 0x1, &(0x7f0000004540)=[&(0x7f0000004280)={0x0, 0x0, 0x0, 0x5, 0x0, r4, 0x0, 0x0, 0x0, 0x0, 0x2}]) 15.035290305s ago: executing program 4 (id=9469): io_uring_setup(0x539c, &(0x7f0000000280)={0x0, 0x93d2, 0x2, 0x45, 0x227}) socket(0x15, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x14, 0x2}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 14.564837522s ago: executing program 4 (id=9470): r0 = socket$inet6(0xa, 0x400000000001, 0x0) bind$inet6(r0, &(0x7f0000fa0fe4)={0xa, 0x4e20, 0x0, @loopback}, 0x1c) sendto$inet6(r0, 0x0, 0x0, 0x20004808, &(0x7f00000001c0)={0xa, 0x4e20, 0xf, @empty, 0x8000004}, 0x1c) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, &(0x7f0000000200)=0x3fd0, 0x4) sendmmsg$inet6(r0, &(0x7f0000001780)=[{{0x0, 0x0, &(0x7f0000000180)=[{&(0x7f0000000240)="79151d", 0x3}], 0x1}}], 0x1, 0x10) r1 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x800, 0xffffffff, 0xbfe00000}, &(0x7f0000000000)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r2, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r2, r3, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3}) io_uring_enter(r1, 0x47f6, 0x0, 0x2, 0x0, 0x300) 13.529541894s ago: executing program 3 (id=9472): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x1, 0x2000) socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x14, 0x2}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) pwrite64(r0, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 13.25133541s ago: executing program 4 (id=9474): r0 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) syz_emit_ethernet(0x87, 0x0, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) epoll_create1(0x80000) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0x0) sendmmsg$inet6(0xffffffffffffffff, 0x0, 0x0, 0x4048894) setsockopt$EBT_SO_SET_COUNTERS(0xffffffffffffffff, 0x0, 0x81, 0x0, 0x0) r3 = openat$ttyprintk(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$TIOCSETD(r3, 0x5423, 0x0) setsockopt$IP_VS_SO_SET_ZERO(0xffffffffffffffff, 0x0, 0x48f, &(0x7f0000000740)={0xba, @broadcast, 0x4e24, 0x8, 'sed\x00', 0x39, 0x7fb, 0x29}, 0x2c) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) openat$uhid(0xffffffffffffff9c, &(0x7f0000000400), 0x2, 0x0) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r0, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r0, 0xc01064b5, &(0x7f0000000180)={&(0x7f00000000c0)=[0x0], 0x1}) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000002c0)=@newtaction={0x68, 0x30, 0x1, 0x0, 0x0, {}, [{0x54, 0x1, [@m_ife={0x50, 0x1, 0x0, 0x0, {{0x8}, {0x28, 0x2, 0x0, 0x1, [@TCA_IFE_TYPE={0x6, 0x5, 0x6}, @TCA_IFE_PARMS={0x1c, 0x1, {{0x9, 0xd, 0x0, 0x8000, 0x80080001}, 0x1}}]}, {0x4}, {0xc}, {0xc, 0x8, {0x1, 0x1}}}}]}]}, 0x68}, 0x1, 0x0, 0x0, 0x8804}, 0x10) 13.154845145s ago: executing program 0 (id=9475): r0 = syz_usb_connect$hid(0x0, 0x36, &(0x7f00000005c0)=ANY=[@ANYBLOB="1201500000000010d90481a000000000000109022400010000000009040100010300000009210000000122080009058103"], 0x0) syz_usb_control_io(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000002c0)={0x24, 0x0, 0x0, &(0x7f0000000640)=ANY=[@ANYBLOB='\x00\"\f'], 0x0}, 0x0) 12.718037559s ago: executing program 3 (id=9476): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) sendmsg$MPTCP_PM_CMD_GET_LIMITS(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0xffffffffffffffb4, 0x0, 0x1, 0x0, 0x0, 0x41}, 0x809d) openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r0 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000300)='blkio.bfq.io_merged_recursive\x00', 0x275a, 0x0) syz_emit_ethernet(0x36, &(0x7f0000000100)=ANY=[@ANYBLOB="000002f0d31209000000bc2e79e995"], 0x0) write$binfmt_script(r0, &(0x7f0000000100), 0x208e24b) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x2, 0x28011, r0, 0x0) preadv(r0, &(0x7f00000015c0)=[{&(0x7f0000000080)=""/124, 0xffffff23}], 0x3e, 0x0, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r0, &(0x7f0000499000/0x18000)=nil, &(0x7f0000000040)=[@text16={0x10, &(0x7f0000000180)="66b9800000c00f326635000800000f300f0f1c9a65660ff3b20618baa000ec672e660f38803d004000000f285473f61366b9800000c00f320f300f20e06635800000000f22e02b6aa6c8", 0x4a}], 0x1, 0x0, 0x0, 0x0) r1 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x20004840}, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, r1, &(0x7f0000000000/0x18000)=nil, &(0x7f0000000140)=[@text32={0x20, 0x0}], 0x1, 0x0, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000600)={0x11, 0x0, 0x0, &(0x7f0000000000)='GPL\x00', 0x2a7, 0x0, 0x0, 0x41100, 0x24, '\x00', 0x0, 0x0, r0, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x3ff}, 0x94) ioctl$KVM_RUN(r1, 0xae80, 0x0) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) 9.705477637s ago: executing program 3 (id=9477): r0 = socket$nl_generic(0x10, 0x3, 0x10) syz_usb_connect(0x5, 0x0, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', 0xffffffffffffffff, 0x0, 0xffffffffffffffff}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) openat$fuse(0xffffffffffffff9c, &(0x7f0000002080), 0x2, 0x0) syz_emit_ethernet(0x0, 0x0, 0x0) setsockopt$MRT_FLUSH(0xffffffffffffffff, 0x0, 0xd4, &(0x7f0000000040)=0x9, 0x4) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000001ac0)={&(0x7f0000001b00)={0x14, 0x2e, 0x1, 0xf0bd26, 0x25dfdbfc, {0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 9.054237106s ago: executing program 0 (id=9478): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0xfff3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x10, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xfff2}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x1a}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xb0c0}]}}]}, 0xfffffffffffffded}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 8.1050436s ago: executing program 0 (id=9480): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e0001002bbd7000ffdbdf2500"], 0x1c}}, 0x20024090) 4.240104719s ago: executing program 3 (id=9482): openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) r0 = openat$vicodec0(0xffffffffffffff9c, &(0x7f0000000100), 0x2, 0x0) r1 = epoll_create1(0x80000) epoll_ctl$EPOLL_CTL_ADD(r1, 0x1, r0, &(0x7f0000000040)={0x2010}) close(0x3) 3.890253825s ago: executing program 3 (id=9483): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x20, 0x17ef, 0x60ee, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x9, 0x1, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x1, 0x0, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0x0, 0xf}}}}}]}}]}}, 0x0) syz_usb_control_io(r0, 0x0, 0x0) 3.669841485s ago: executing program 0 (id=9484): r0 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000340)=ANY=[@ANYBLOB="12010000000018105704da0700000000000109022400010000ba0009040000090300000009210000000122220009058103"], 0x0) syz_usb_control_io$hid(0xffffffffffffffff, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="0022220000009523b31ce93ee907000000002990370900be008300"], 0x0}, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, &(0x7f00000001c0)={0x24, 0x0, 0x0, &(0x7f0000000080)=ANY=[@ANYBLOB="00222200000049e9b31c073f000200000b09007a15b3"], 0x0}, 0x0) 3.564077491s ago: executing program 5 (id=9485): socket$nl_netfilter(0x10, 0x3, 0xc) socket$inet6_udplite(0xa, 0x2, 0x88) bpf$PROG_LOAD(0x5, &(0x7f00000004c0)={0x0, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000800000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b7080000000000047b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000007b00000095"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x21, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f0000000280)={0x1f, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="18090000000000000000000000000000850000006d0000001801000020696c2500000000002020207b1a"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x1b, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200}, 0x94) bpf$PROG_LOAD(0x5, &(0x7f00000010c0)={0x16, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x19, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) syz_open_dev$sndpcmp(&(0x7f00000001c0), 0x1, 0x2000) socket$nl_generic(0x10, 0x3, 0x10) socket$l2tp6(0xa, 0x2, 0x73) r0 = socket$l2tp6(0xa, 0x2, 0x73) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x14, 0x2}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000240)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[@ANYRES32, @ANYRES16=0x0, @ANYRES8=r1], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[], 0x50) pwrite64(r0, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r2 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r2, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r2, &(0x7f0000000000), 0xd) 3.052500961s ago: executing program 5 (id=9486): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) ioctl$KVM_CAP_EXIT_HYPERCALL(r1, 0x4068aea3, &(0x7f0000000040)={0x79}) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x800) ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x400) 1.908858625s ago: executing program 5 (id=9487): r0 = socket(0x2b, 0x2, 0x0) socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x5) socket$nl_route(0x10, 0x3, 0x0) socket$packet(0x11, 0x3, 0x300) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) mount$fuse(0x0, 0x0, &(0x7f0000000200), 0x0, 0x0) read$FUSE(0xffffffffffffffff, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) read$msr(0xffffffffffffffff, &(0x7f0000001a40)=""/102392, 0x18ff8) r1 = socket$tipc(0x1e, 0x2, 0x0) bind$tipc(r1, &(0x7f0000000000)=@nameseq={0x1e, 0x1, 0x0, {0x42}}, 0x10) setsockopt$TIPC_GROUP_JOIN(0xffffffffffffffff, 0x10f, 0x87, &(0x7f0000000180)={0x42, 0x0, 0x2}, 0x10) sendmsg$tipc(0xffffffffffffffff, &(0x7f0000000540)={&(0x7f00000001c0)=@name={0x1e, 0x2, 0x1, {{0x40}, 0x1}}, 0x10, 0x0, 0x0, 0x0, 0x0, 0x48800}, 0x4800) setsockopt$TIPC_GROUP_LEAVE(0xffffffffffffffff, 0x10f, 0x88) r2 = memfd_create(&(0x7f0000000040)='dev [\x1dx#l', 0x8) fsetxattr$security_capability(r2, &(0x7f0000000000), &(0x7f0000000080)=@v2, 0x14, 0x0) ioctl$FS_IOC_RESVSP(r2, 0x40305828, &(0x7f0000000b40)={0x0, 0x0, 0x0, 0xc5c}) 1.513592875s ago: executing program 3 (id=9488): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000005c0), 0x0, 0x0, 0x0, 0x20048000}, 0x0) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000780)=ANY=[@ANYBLOB="12010000cf8bed20d90f25004029000000010902120001000000000904"], 0x0) syz_usb_control_io$uac1(r1, 0x0, &(0x7f0000000580)={0x24, &(0x7f0000000700)=ANY=[@ANYBLOB="201109"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r2 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) syz_open_dev$video4linux(0x0, 0x3, 0x68c42) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r3, 0x6, 0x13, &(0x7f0000000040)=0x100000001, 0x76dc) connect$inet6(r3, &(0x7f0000000080), 0x1c) setsockopt$inet6_tcp_TCP_ULP(r3, 0x6, 0x1f, &(0x7f00000002c0), 0x4) r4 = fcntl$dupfd(r3, 0x0, r3) setsockopt$inet6_tcp_TCP_REPAIR_QUEUE(r3, 0x6, 0x14, &(0x7f0000000000)=0x1, 0x4) setsockopt$inet6_tcp_TLS_TX(r3, 0x11a, 0x2, &(0x7f00000000c0)=@gcm_128={{0x304}, "9204ed15b82f9286", "9cf36baca5e0dea959e6562ad90dd7fd", "0ac1c07f", "ccc1f789eeef906d"}, 0x28) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f00000003c0)={0x0, 0x0, &(0x7f0000000140)={0x0}, 0x1, 0x0, 0x0, 0x8801}, 0x8080) r5 = syz_io_uring_setup(0xbda, &(0x7f0000000640)={0x0, 0x356e, 0x800, 0x2001, 0x40000334}, &(0x7f0000000100)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r6, r7, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f0000000600)=[{&(0x7f0000001800)=""/216, 0xd8}], 0x1}) io_uring_enter(r5, 0x847ba, 0x0, 0xe, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000000)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0xfffffffffffffffe) r8 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) signalfd4(0xffffffffffffffff, 0x0, 0x0, 0x800) ioctl$EVIOCSABS20(r4, 0x401845e0, &(0x7f0000001640)={0x5, 0x3, 0x81, 0x8, 0x2, 0x2}) read$msr(r8, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$I2C_SMBUS(r2, 0x720, &(0x7f0000000200)={0x1, 0xd9, 0x2, &(0x7f0000000040)={0x3, "810556c721393f4084cc9efc7ddb01702fb9a7f77d040b00"}}) 1.375676173s ago: executing program 5 (id=9489): sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f0000000240)=@delchain={0x24, 0x65, 0x400, 0x70bd29, 0x25dfdbfc, {0x0, 0x0, 0x0, 0x0, {0x509d884560ba1ba6, 0xfff3}, {}, {0x8, 0x10}}}, 0x24}}, 0x10) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000100)=@newqdisc={0x44, 0x24, 0x10, 0x80000000, 0x4, {0x0, 0x0, 0x0, 0x0, {0x8, 0x3}, {0xa, 0xfff2}, {0xfff1, 0x9}}, [@qdisc_kind_options=@q_fq_pie={{0xb}, {0x14, 0x8002, [@TCA_FQ_PIE_ECN_PROB={0x8, 0x9, 0x1a}, @TCA_FQ_PIE_FLOWS={0x8, 0x2, 0xb0c0}]}}]}, 0xfffffffffffffded}}, 0x20004055) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000080)={0x0, 0x48}, 0x1, 0x0, 0x0, 0x10}, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000340)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000100)=ANY=[], 0x50}, 0x1, 0x0, 0x0, 0x13d33d22cca65c15}, 0x4008840) r0 = socket$netlink(0x10, 0x3, 0x0) sendmmsg(r0, &(0x7f00000002c0), 0x40000000000009f, 0x0) 1.036476827s ago: executing program 0 (id=9490): io_uring_setup(0x539c, &(0x7f0000000280)={0x0, 0x93d2, 0x2, 0x45, 0x227}) socket(0x15, 0x5, 0x0) syz_open_procfs(0x0, &(0x7f0000000000)='net/fib_trie\x00') socket(0x200000000000011, 0x4000000000080002, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(0xffffffffffffffff, 0x4010640d, &(0x7f0000000000)={0x14, 0x2}) sendmsg$NL80211_CMD_CONNECT(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000000)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20000844}, 0x48885) bpf$MAP_CREATE(0x0, &(0x7f0000000000)=ANY=[@ANYBLOB="1400000007"], 0x50) pwrite64(0xffffffffffffffff, &(0x7f0000000000)='L', 0x1, 0x7ffffffe) r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f0000000040)={0x1f, 0xffff, 0x3}, 0x6) write$binfmt_misc(r0, &(0x7f0000000000), 0xd) 841.017453ms ago: executing program 5 (id=9491): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x80000000000002, &(0x7f00000004c0)=0x79, 0x4) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) ioctl$sock_inet_tcp_SIOCOUTQNSD(r0, 0x894b, &(0x7f0000000000)) 401.043134ms ago: executing program 0 (id=9492): r0 = socket(0xa, 0x5, 0x0) io_uring_setup(0x1612, &(0x7f0000000840)={0x0, 0x0, 0x2, 0x1, 0x396}) io_uring_setup(0x1778, &(0x7f00000000c0)={0x0, 0x4, 0x3000}) poll(&(0x7f0000000740), 0x0, 0xed) close_range(r0, 0xffffffffffffffff, 0x0) 0s ago: executing program 5 (id=9493): r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="1c0000005e0001002bbd7000ffdbdf2500"], 0x1c}}, 0x20024090) kernel console output (not intermixed with test programs): ng attributes in process `syz.6.8717'. [ 2636.259551][T30755] 9p: Bad value for 'rfdno' [ 2638.404715][ T30] audit: type=1326 audit(2638.364:4003): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30771 comm="syz.5.8724" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f497618f749 code=0x0 [ 2639.217023][T23959] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2639.226566][T23959] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2639.246204][T30785] netlink: 8 bytes leftover after parsing attributes in process `syz.3.8728'. [ 2639.390134][ T3595] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2639.404001][ T3595] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2639.703602][T30790] random: crng reseeded on system resumption [ 2640.372118][T30792] CIFS: Unable to determine destination address [ 2641.076644][T30800] netlink: 35 bytes leftover after parsing attributes in process `syz.9.8628'. [ 2644.166304][T30823] netlink: 8 bytes leftover after parsing attributes in process `syz.5.8739'. [ 2646.490102][T30834] CIFS: Unable to determine destination address [ 2651.147150][T30853] netlink: 16 bytes leftover after parsing attributes in process `syz.1.8750'. [ 2652.150766][ T30] audit: type=1326 audit(2652.084:4004): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=30844 comm="syz.3.8747" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f64ad78f749 code=0x0 [ 2652.442471][T30857] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8751'. [ 2653.758107][T30862] CIFS: Unable to determine destination address [ 2654.298119][T30860] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 2658.142914][T30883] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8762'. [ 2663.608124][T15154] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2663.632135][T15154] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2663.655048][T15154] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2663.722682][T15154] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2663.744182][T15154] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2664.889246][T30900] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 2665.068281][T15154] Bluetooth: hci6: unexpected cc 0x0c03 length: 249 > 1 [ 2665.078603][T15154] Bluetooth: hci6: unexpected cc 0x1003 length: 249 > 9 [ 2665.092188][T15154] Bluetooth: hci6: unexpected cc 0x1001 length: 249 > 9 [ 2665.140385][T15154] Bluetooth: hci6: unexpected cc 0x0c23 length: 249 > 4 [ 2665.163685][T15154] Bluetooth: hci6: unexpected cc 0x0c38 length: 249 > 2 [ 2665.273333][T30894] chnl_net:caif_netlink_parms(): no params data found [ 2665.850863][T21594] Bluetooth: hci4: command tx timeout [ 2667.265508][T23942] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2667.292361][T21594] Bluetooth: hci6: command tx timeout [ 2667.518074][T23942] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2667.733447][T23942] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2667.904341][T23942] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2667.931179][T21594] Bluetooth: hci4: command tx timeout [ 2667.988911][T30894] bridge0: port 1(bridge_slave_0) entered blocking state [ 2667.997862][T30894] bridge0: port 1(bridge_slave_0) entered disabled state [ 2668.007488][T30894] bridge_slave_0: entered allmulticast mode [ 2668.017121][T30894] bridge_slave_0: entered promiscuous mode [ 2668.030805][T20195] usb 10-1: new high-speed USB device number 4 using dummy_hcd [ 2668.066407][T30905] chnl_net:caif_netlink_parms(): no params data found [ 2668.099538][T30894] bridge0: port 2(bridge_slave_1) entered blocking state [ 2668.108875][T30894] bridge0: port 2(bridge_slave_1) entered disabled state [ 2668.117566][T30894] bridge_slave_1: entered allmulticast mode [ 2668.126774][T30894] bridge_slave_1: entered promiscuous mode [ 2668.211143][T20195] usb 10-1: Using ep0 maxpacket: 16 [ 2668.238380][T20195] usb 10-1: too many endpoints for config 0 interface 0 altsetting 0: 129, using maximum allowed: 30 [ 2668.250860][T20195] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2668.265878][T20195] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 129 [ 2668.285084][T20195] usb 10-1: New USB device found, idVendor=6666, idProduct=8801, bcdDevice= 0.00 [ 2668.296289][T20195] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2668.898031][T20195] usb 10-1: config 0 descriptor?? [ 2668.950972][T30894] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2669.717318][T21594] Bluetooth: hci6: command tx timeout [ 2669.781841][T30934] overlayfs: failed lookup in lower (newroot/8, name='bus', err=-40): overlapping layers [ 2669.936138][T30894] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2670.036467][T21594] Bluetooth: hci4: command tx timeout [ 2670.136383][T20195] smartjoyplus 0003:6666:8801.003F: global environment stack underflow [ 2670.146024][T20195] smartjoyplus 0003:6666:8801.003F: item 0 1 1 11 parsing failed [ 2670.333160][T20195] smartjoyplus 0003:6666:8801.003F: parse failed [ 2670.340947][T20195] smartjoyplus 0003:6666:8801.003F: probe with driver smartjoyplus failed with error -22 [ 2670.982069][T30934] netlink: 666 bytes leftover after parsing attributes in process `syz.9.8777'. [ 2671.015001][T30894] team0: Port device team_slave_0 added [ 2671.028442][T23942] bridge_slave_1: left allmulticast mode [ 2671.036463][T23942] bridge_slave_1: left promiscuous mode [ 2671.048309][T23942] bridge0: port 2(bridge_slave_1) entered disabled state [ 2671.142738][T23942] bridge_slave_0: left allmulticast mode [ 2671.154664][T23942] bridge_slave_0: left promiscuous mode [ 2671.162013][T23942] bridge0: port 1(bridge_slave_0) entered disabled state [ 2671.809279][T21594] Bluetooth: hci6: command tx timeout [ 2671.919183][T23942] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2671.939279][T23942] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2671.979962][T23942] bond0 (unregistering): Released all slaves [ 2672.006007][T30894] team0: Port device team_slave_1 added [ 2672.026553][T30946] sch_tbf: burst 0 is lower than device lo mtu (65550) ! [ 2672.111635][T21594] Bluetooth: hci4: command tx timeout [ 2672.292171][T30894] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2672.299975][T30894] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2672.328940][T30894] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2672.398894][T13164] usb 10-1: USB disconnect, device number 4 [ 2672.540027][T30894] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2672.548094][T30894] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2672.582632][T30894] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2672.952696][T23942] hsr_slave_0: left promiscuous mode [ 2673.005555][T23942] hsr_slave_1: left promiscuous mode [ 2673.013980][T23942] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2673.022911][T23942] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2673.059787][T23942] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2673.068219][T23942] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2673.155670][T23942] veth1_macvtap: left promiscuous mode [ 2673.162047][T23942] veth0_macvtap: left promiscuous mode [ 2673.168274][T23942] veth1_vlan: left promiscuous mode [ 2673.175801][T23942] veth0_vlan: left promiscuous mode [ 2673.886800][T21594] Bluetooth: hci6: command tx timeout [ 2674.016569][T23942] team0 (unregistering): Port device team_slave_1 removed [ 2674.058751][T23942] team0 (unregistering): Port device team_slave_0 removed [ 2677.206043][T30905] bridge0: port 1(bridge_slave_0) entered blocking state [ 2677.214308][T30905] bridge0: port 1(bridge_slave_0) entered disabled state [ 2677.222877][T30905] bridge_slave_0: entered allmulticast mode [ 2677.232183][T30905] bridge_slave_0: entered promiscuous mode [ 2677.331633][T30905] bridge0: port 2(bridge_slave_1) entered blocking state [ 2677.339653][T30905] bridge0: port 2(bridge_slave_1) entered disabled state [ 2677.348321][T30905] bridge_slave_1: entered allmulticast mode [ 2677.357597][T30905] bridge_slave_1: entered promiscuous mode [ 2677.436714][T30894] hsr_slave_0: entered promiscuous mode [ 2677.447992][T30894] hsr_slave_1: entered promiscuous mode [ 2677.456565][T30894] debugfs: 'hsr0' already exists in 'hsr' [ 2677.463087][T30894] Cannot create hsr debugfs directory [ 2677.591734][T23942] IPVS: stop unused estimator thread 0... [ 2677.637348][T30905] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2677.743281][T30905] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2678.097071][T30905] team0: Port device team_slave_0 added [ 2678.158875][T30905] team0: Port device team_slave_1 added [ 2678.455500][T30905] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2678.463487][T30905] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2678.494658][T30905] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2678.649568][T30905] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2678.657553][T30905] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2678.686549][T30905] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2679.019929][T30905] hsr_slave_0: entered promiscuous mode [ 2679.038284][T30905] hsr_slave_1: entered promiscuous mode [ 2679.047040][T30905] debugfs: 'hsr0' already exists in 'hsr' [ 2679.053540][T30905] Cannot create hsr debugfs directory [ 2679.306073][T30894] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 2679.433963][T30894] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 2679.552722][T30894] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 2679.664019][T30894] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 2680.514640][T30894] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2680.529854][T30905] netdevsim netdevsim4 netdevsim0: renamed from eth0 [ 2680.624094][T30905] netdevsim netdevsim4 netdevsim1: renamed from eth1 [ 2680.659337][T30894] 8021q: adding VLAN 0 to HW filter on device team0 [ 2680.712952][T30905] netdevsim netdevsim4 netdevsim2: renamed from eth2 [ 2680.747350][T23952] bridge0: port 1(bridge_slave_0) entered blocking state [ 2680.755448][T23952] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2680.775712][T30905] netdevsim netdevsim4 netdevsim3: renamed from eth3 [ 2680.992309][T23952] bridge0: port 2(bridge_slave_1) entered blocking state [ 2681.000584][T23952] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2681.276391][T30894] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2682.116966][T30905] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2682.325085][T30905] 8021q: adding VLAN 0 to HW filter on device team0 [ 2682.429968][ T61] bridge0: port 1(bridge_slave_0) entered blocking state [ 2682.438066][ T61] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2682.843875][T30905] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 2682.856847][T30905] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2682.982655][ T61] bridge0: port 2(bridge_slave_1) entered blocking state [ 2682.990880][ T61] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2683.409620][T31009] binder: 31005:31009 ioctl 4018620d 0 returned -22 [ 2683.497835][T31009] bridge0: port 2(bridge_slave_1) entered disabled state [ 2683.510647][T31009] bridge0: port 1(bridge_slave_0) entered disabled state [ 2686.474981][T30894] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2688.593623][T30894] veth0_vlan: entered promiscuous mode [ 2688.687217][T30894] veth1_vlan: entered promiscuous mode [ 2688.993371][T30894] veth0_macvtap: entered promiscuous mode [ 2689.044346][T30894] veth1_macvtap: entered promiscuous mode [ 2689.278000][T30894] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2689.415843][T30894] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2689.960679][ T3838] netdevsim netdevsim7 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2690.012649][ T3838] netdevsim netdevsim7 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2690.045136][ T3838] netdevsim netdevsim7 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2690.156679][ T3838] netdevsim netdevsim7 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2690.342851][T30905] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2693.154978][T31045] kvm: kvm [31044]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x1000011bc [ 2697.890878][T30905] veth0_vlan: entered promiscuous mode [ 2698.028856][T30905] veth1_vlan: entered promiscuous mode [ 2698.415763][T30905] veth0_macvtap: entered promiscuous mode [ 2698.504960][T30905] veth1_macvtap: entered promiscuous mode [ 2698.705707][T30905] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2698.835461][T30905] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2699.015752][T19559] netdevsim netdevsim4 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2699.124516][T19559] netdevsim netdevsim4 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2699.642611][ T1096] netdevsim netdevsim4 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2699.697565][ T1096] netdevsim netdevsim4 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2704.115044][ T12] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2704.128068][ T12] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2704.357869][T30943] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2704.367056][T30943] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2704.648746][T31116] binder_alloc: 31115: pid 31115 spamming oneway? 1 buffers allocated for a total size of 4096 [ 2706.615840][T30943] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2706.858225][T30943] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2707.029738][T30943] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2707.229331][T30943] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2707.712438][T30943] bridge_slave_1: left allmulticast mode [ 2707.719598][T30943] bridge_slave_1: left promiscuous mode [ 2707.729232][T30943] bridge0: port 2(bridge_slave_1) entered disabled state [ 2707.807514][T30943] bridge_slave_0: left allmulticast mode [ 2707.814952][T30943] bridge_slave_0: left promiscuous mode [ 2707.824117][T30943] bridge0: port 1(bridge_slave_0) entered disabled state [ 2709.373089][T30943] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2709.492546][T30943] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2710.082633][T31158] NILFS (nullb0): couldn't find nilfs on the device [ 2710.210960][T30943] bond0 (unregistering): Released all slaves [ 2712.138172][T30943] hsr_slave_0: left promiscuous mode [ 2712.163016][T30943] hsr_slave_1: left promiscuous mode [ 2712.187322][T30943] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2712.199938][T30943] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2712.215661][T20195] usb 10-1: new high-speed USB device number 5 using dummy_hcd [ 2712.245646][T30943] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2712.258230][T30943] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2712.286931][T30943] veth1_macvtap: left promiscuous mode [ 2712.297064][T30943] veth0_macvtap: left promiscuous mode [ 2712.314961][T30943] veth1_vlan: left promiscuous mode [ 2712.477417][T20195] usb 10-1: New USB device found, idVendor=04fc, idProduct=504a, bcdDevice=43.02 [ 2712.488173][T20195] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2712.501287][T20195] usb 10-1: Product: syz [ 2712.506147][T20195] usb 10-1: Manufacturer: syz [ 2712.511588][T20195] usb 10-1: SerialNumber: syz [ 2712.659074][T20195] usb 10-1: config 0 descriptor?? [ 2712.742894][T20195] gspca_main: sunplus-2.14.0 probing 04fc:504a [ 2713.389641][T30943] team0 (unregistering): Port device vlan0 removed [ 2713.655534][T30943] team0 (unregistering): Port device team_slave_1 removed [ 2713.705282][T30943] team0 (unregistering): Port device team_slave_0 removed [ 2714.449778][ T4196] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2714.462912][ T4196] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2714.594935][ T4196] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2714.603996][ T4196] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2714.685471][T30943] IPVS: stop unused estimator thread 0... [ 2714.777133][T20195] gspca_sunplus: reg_w_riv err -71 [ 2714.785285][T20195] sunplus 10-1:0.0: probe with driver sunplus failed with error -71 [ 2714.815167][T20195] usb 10-1: USB disconnect, device number 5 [ 2715.008424][T31188] CIFS: Unable to determine destination address [ 2716.167747][T20195] usb 10-1: new high-speed USB device number 6 using dummy_hcd [ 2716.422964][T20195] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2716.435557][T20195] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2716.446923][T20195] usb 10-1: New USB device found, idVendor=06cb, idProduct=2968, bcdDevice= 0.00 [ 2716.457472][T20195] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2716.608311][T20195] usb 10-1: config 0 descriptor?? [ 2716.698004][T15154] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2716.715841][T15154] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2716.732362][T15154] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2716.753434][T15154] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2716.767510][T15154] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2717.753429][T31203] loop4: detected capacity change from 0 to 32768 [ 2717.881694][T20195] itetech 0003:06CB:2968.0040: hidraw0: USB HID v2.00 Device [HID 06cb:2968] on usb-dummy_hcd.9-1/input0 [ 2717.955492][T31203] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 2718.054919][T20195] usb 10-1: USB disconnect, device number 6 [ 2718.763482][T31203] XFS (loop4): Ending clean mount [ 2718.920668][T15154] Bluetooth: hci0: command tx timeout [ 2718.927902][T30905] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 2719.661644][T31200] chnl_net:caif_netlink_parms(): no params data found [ 2720.457319][T23963] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2720.636478][T23963] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2720.879690][T23963] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2720.971261][T15154] Bluetooth: hci0: command tx timeout [ 2721.054520][T23963] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2721.622376][T31200] bridge0: port 1(bridge_slave_0) entered blocking state [ 2721.637124][T31200] bridge0: port 1(bridge_slave_0) entered disabled state [ 2721.646493][T31200] bridge_slave_0: entered allmulticast mode [ 2721.659610][T31200] bridge_slave_0: entered promiscuous mode [ 2721.735893][T31200] bridge0: port 2(bridge_slave_1) entered blocking state [ 2721.744429][T31200] bridge0: port 2(bridge_slave_1) entered disabled state [ 2721.753325][T31200] bridge_slave_1: entered allmulticast mode [ 2721.763165][T31200] bridge_slave_1: entered promiscuous mode [ 2721.809166][T23963] bridge_slave_1: left allmulticast mode [ 2721.820061][T23963] bridge_slave_1: left promiscuous mode [ 2721.826927][T23963] bridge0: port 2(bridge_slave_1) entered disabled state [ 2721.854489][T23963] bridge_slave_0: left allmulticast mode [ 2721.861577][T23963] bridge_slave_0: left promiscuous mode [ 2721.868716][T23963] bridge0: port 1(bridge_slave_0) entered disabled state [ 2722.011675][T23963] bond_slave_0: left promiscuous mode [ 2722.019876][T23963] bond_slave_1: left promiscuous mode [ 2723.007791][T23963] bond5 (unregistering): (slave macvlan0): Releasing active interface [ 2723.050838][T15154] Bluetooth: hci0: command tx timeout [ 2723.081606][T23963] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2723.167439][T23963] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2723.216118][T23963] bond0 (unregistering): Released all slaves [ 2723.237659][T23963] bond1 (unregistering): Released all slaves [ 2723.258376][T23963] bond2 (unregistering): Released all slaves [ 2723.279634][T23963] bond3 (unregistering): Released all slaves [ 2723.297559][T23963] bond4 (unregistering): Released all slaves [ 2723.314663][T23963] bond5 (unregistering): Released all slaves [ 2723.889344][T31200] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2723.903729][T23963] tipc: Left network mode [ 2723.996437][T31200] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2724.235834][T23963] hsr_slave_0: left promiscuous mode [ 2724.283185][T23963] hsr_slave_1: left promiscuous mode [ 2724.298115][T23963] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2724.306566][T23963] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2724.336549][T23963] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2724.345129][T23963] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2724.403011][T23963] veth1_macvtap: left promiscuous mode [ 2724.409276][T23963] veth0_macvtap: left promiscuous mode [ 2724.415798][T23963] veth1_vlan: left promiscuous mode [ 2724.422137][T23963] veth0_vlan: left promiscuous mode [ 2725.157139][T15154] Bluetooth: hci0: command tx timeout [ 2725.582954][T23963] team0 (unregistering): Port device team_slave_1 removed [ 2725.631202][T23963] team0 (unregistering): Port device team_slave_0 removed [ 2728.411137][T31200] team0: Port device team_slave_0 added [ 2728.548968][T31200] team0: Port device team_slave_1 added [ 2728.836920][T31200] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2728.848792][T31200] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2728.877977][T31200] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2728.941498][T31200] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2728.949328][T31200] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2728.978427][T31200] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2729.134896][T31262] Bluetooth: MGMT ver 1.23 [ 2729.404824][T31200] hsr_slave_0: entered promiscuous mode [ 2729.423301][T31200] hsr_slave_1: entered promiscuous mode [ 2729.435053][T31200] debugfs: 'hsr0' already exists in 'hsr' [ 2729.441606][T31200] Cannot create hsr debugfs directory [ 2729.846796][T31276] netlink: 7 bytes leftover after parsing attributes in process `syz.4.8867'. [ 2729.857568][T31276] netlink: 24 bytes leftover after parsing attributes in process `syz.4.8867'. [ 2730.506719][T28490] Bluetooth: hci5: command 0x0406 tx timeout [ 2730.514054][T28490] Bluetooth: hci1: command 0x0406 tx timeout [ 2734.193047][T31200] netdevsim netdevsim1 netdevsim0: renamed from eth0 [ 2734.246656][T31200] netdevsim netdevsim1 netdevsim1: renamed from eth1 [ 2734.273832][T31200] netdevsim netdevsim1 netdevsim2: renamed from eth2 [ 2734.314277][T31200] netdevsim netdevsim1 netdevsim3: renamed from eth3 [ 2738.084045][T31200] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2738.305394][T31200] 8021q: adding VLAN 0 to HW filter on device team0 [ 2738.847735][T31315] loop4: detected capacity change from 0 to 32768 [ 2738.943937][T23981] bridge0: port 1(bridge_slave_0) entered blocking state [ 2738.944153][T31315] XFS (loop4): Mounting V5 Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 2738.953997][T23981] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2738.981895][T23981] bridge0: port 2(bridge_slave_1) entered blocking state [ 2738.991119][T23981] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2739.081126][T25600] usb 10-1: new high-speed USB device number 7 using dummy_hcd [ 2739.332014][T25600] usb 10-1: Using ep0 maxpacket: 16 [ 2739.360235][T25600] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2739.372883][T25600] usb 10-1: New USB device found, idVendor=04d8, idProduct=c002, bcdDevice= 0.00 [ 2739.375210][T31200] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2739.383420][T25600] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2739.600025][T31315] XFS (loop4): Ending clean mount [ 2739.642117][T25600] usb 10-1: config 0 descriptor?? [ 2739.768547][T30905] XFS (loop4): Unmounting Filesystem bfdc47fc-10d8-4eed-a562-11a831b3f791 [ 2740.127893][T25600] hid_parser_main: 22 callbacks suppressed [ 2740.127993][T25600] hid-picolcd 0003:04D8:C002.0041: unknown main item tag 0x0 [ 2740.148413][T25600] hid-picolcd 0003:04D8:C002.0041: unknown main item tag 0x0 [ 2740.158004][T25600] hid-picolcd 0003:04D8:C002.0041: item fetching failed at offset 4/5 [ 2740.330292][T25600] hid-picolcd 0003:04D8:C002.0041: device report parse failed [ 2740.342034][T25600] hid-picolcd 0003:04D8:C002.0041: probe with driver hid-picolcd failed with error -22 [ 2740.382489][T25600] usb 10-1: USB disconnect, device number 7 [ 2745.329992][T31200] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2745.362179][T31345] netlink: 91 bytes leftover after parsing attributes in process `syz.4.8885'. [ 2745.808468][T31342] kvm: kvm [31341]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x1000011bc [ 2746.313352][T31200] veth0_vlan: entered promiscuous mode [ 2746.446312][T31200] veth1_vlan: entered promiscuous mode [ 2746.787214][T31200] veth0_macvtap: entered promiscuous mode [ 2746.869802][T31200] veth1_macvtap: entered promiscuous mode [ 2746.998455][T31200] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2747.184055][T15154] Bluetooth: hci2: unexpected cc 0x0c03 length: 249 > 1 [ 2747.201272][T31200] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2747.250121][T15154] Bluetooth: hci2: unexpected cc 0x1003 length: 249 > 9 [ 2747.265623][T15154] Bluetooth: hci2: unexpected cc 0x1001 length: 249 > 9 [ 2747.282714][T15154] Bluetooth: hci2: unexpected cc 0x0c23 length: 249 > 4 [ 2747.305686][T15154] Bluetooth: hci2: unexpected cc 0x0c38 length: 249 > 2 [ 2747.494340][T23952] netdevsim netdevsim1 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2747.504692][T23952] netdevsim netdevsim1 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2747.514794][T23952] netdevsim netdevsim1 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2747.527550][T23981] netdevsim netdevsim1 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2749.532747][T21594] Bluetooth: hci2: command tx timeout [ 2749.541273][T31355] chnl_net:caif_netlink_parms(): no params data found [ 2751.704256][T21594] Bluetooth: hci2: command tx timeout [ 2753.254142][T31355] bridge0: port 1(bridge_slave_0) entered blocking state [ 2753.262461][T31355] bridge0: port 1(bridge_slave_0) entered disabled state [ 2753.276677][T31355] bridge_slave_0: entered allmulticast mode [ 2753.287129][T31355] bridge_slave_0: entered promiscuous mode [ 2753.805618][T21594] Bluetooth: hci2: command tx timeout [ 2753.841137][T31355] bridge0: port 2(bridge_slave_1) entered blocking state [ 2753.849404][T31355] bridge0: port 2(bridge_slave_1) entered disabled state [ 2753.858603][T31355] bridge_slave_1: entered allmulticast mode [ 2753.871488][T31355] bridge_slave_1: entered promiscuous mode [ 2754.152740][T31355] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2754.255892][T31355] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2754.768415][T23981] netdevsim netdevsim3 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2754.784568][T30641] usb 5-1: new high-speed USB device number 48 using dummy_hcd [ 2755.031549][T30641] usb 5-1: Using ep0 maxpacket: 32 [ 2755.123808][T30641] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2755.136430][T30641] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2755.147636][T30641] usb 5-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 2755.157960][T30641] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2755.242066][T31355] team0: Port device team_slave_0 added [ 2755.275777][T23981] netdevsim netdevsim3 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2755.390181][T31355] team0: Port device team_slave_1 added [ 2755.447716][T30641] usb 5-1: config 0 descriptor?? [ 2755.528515][T23981] netdevsim netdevsim3 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2755.759272][T23981] netdevsim netdevsim3 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2755.880001][T21594] Bluetooth: hci2: command tx timeout [ 2756.012199][T31355] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2756.026296][T31355] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2756.062312][T31355] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2756.096410][T30641] zydacron 0003:13EC:0006.0042: item fetching failed at offset 1/2 [ 2756.200731][T31404] kvm: kvm [31403]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x1000011bc [ 2756.207971][T30641] zydacron 0003:13EC:0006.0042: parse failed [ 2756.218801][T30641] zydacron 0003:13EC:0006.0042: probe with driver zydacron failed with error -22 [ 2756.259333][T31355] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2756.268390][T31355] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2756.298219][T31355] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2756.329969][T23981] bridge_slave_1: left allmulticast mode [ 2756.339025][T23981] bridge_slave_1: left promiscuous mode [ 2756.353585][T23981] bridge0: port 2(bridge_slave_1) entered disabled state [ 2756.368937][ T5873] usb 5-1: USB disconnect, device number 48 [ 2756.394609][T23981] bridge_slave_0: left allmulticast mode [ 2756.401348][T23981] bridge_slave_0: left promiscuous mode [ 2756.408843][T23981] bridge0: port 1(bridge_slave_0) entered disabled state [ 2756.974864][T23981] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2757.034954][T23981] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2757.089693][T23981] bond0 (unregistering): Released all slaves [ 2757.824400][T31416] input: syz1 as /devices/virtual/input/input39 [ 2757.863412][T31355] hsr_slave_0: entered promiscuous mode [ 2757.874527][T31355] hsr_slave_1: entered promiscuous mode [ 2757.888591][T31355] debugfs: 'hsr0' already exists in 'hsr' [ 2757.895246][T31355] Cannot create hsr debugfs directory [ 2758.332653][T23981] hsr_slave_0: left promiscuous mode [ 2758.363587][T23981] hsr_slave_1: left promiscuous mode [ 2758.372538][T23981] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2758.380943][T23981] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2758.466040][T23981] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2758.480731][T23981] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2758.568160][T23981] veth1_macvtap: left promiscuous mode [ 2758.580613][T23981] veth0_macvtap: left promiscuous mode [ 2758.587243][T23981] veth1_vlan: left promiscuous mode [ 2758.598804][T23981] veth0_vlan: left promiscuous mode [ 2759.390971][T23981] team0 (unregistering): Port device team_slave_1 removed [ 2759.434623][T23981] team0 (unregistering): Port device team_slave_0 removed [ 2762.706174][ T3838] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2762.716702][ T3838] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2762.862266][T31446] netlink: 35 bytes leftover after parsing attributes in process `syz.7.8913'. [ 2763.107304][T31355] netdevsim netdevsim0 netdevsim0: renamed from eth0 [ 2763.146887][T31355] netdevsim netdevsim0 netdevsim1: renamed from eth1 [ 2763.215399][ T4196] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2763.224407][ T4196] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2763.274253][T31355] netdevsim netdevsim0 netdevsim2: renamed from eth2 [ 2763.376865][T31355] netdevsim netdevsim0 netdevsim3: renamed from eth3 [ 2764.836868][T31355] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2765.415385][T31355] 8021q: adding VLAN 0 to HW filter on device team0 [ 2765.492806][T31457] kvm: kvm [31456]: vcpu0, guest rIP: 0x18e Unhandled WRMSR(0xc2) = 0x1000011bc [ 2767.442692][T18345] bridge0: port 1(bridge_slave_0) entered blocking state [ 2767.450991][T18345] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2767.668595][T18345] bridge0: port 2(bridge_slave_1) entered blocking state [ 2767.676908][T18345] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2775.546545][T31355] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2776.057932][T31355] veth0_vlan: entered promiscuous mode [ 2776.144630][T31355] veth1_vlan: entered promiscuous mode [ 2776.535436][T31355] veth0_macvtap: entered promiscuous mode [ 2776.644258][T31355] veth1_macvtap: entered promiscuous mode [ 2776.816455][T31355] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2776.883568][T31355] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2776.943990][T18345] netdevsim netdevsim0 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2776.962756][T18345] netdevsim netdevsim0 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2776.991747][T18345] netdevsim netdevsim0 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2777.003715][T23952] netdevsim netdevsim0 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2780.738356][T15154] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2780.758011][T15154] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2780.782775][T15154] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2780.821153][T15154] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2780.846293][T15154] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2781.499844][T31524] Cannot find set identified by id 0 to match [ 2782.896454][T21594] Bluetooth: hci3: command tx timeout [ 2783.111438][T31539] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8938'. [ 2783.197198][T31539] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8938'. [ 2783.356228][T31517] chnl_net:caif_netlink_parms(): no params data found [ 2784.975309][T21594] Bluetooth: hci3: command tx timeout [ 2785.242796][T31517] bridge0: port 1(bridge_slave_0) entered blocking state [ 2785.251184][T31517] bridge0: port 1(bridge_slave_0) entered disabled state [ 2785.259622][T31517] bridge_slave_0: entered allmulticast mode [ 2785.269446][T31517] bridge_slave_0: entered promiscuous mode [ 2785.354622][T31517] bridge0: port 2(bridge_slave_1) entered blocking state [ 2785.362998][T31517] bridge0: port 2(bridge_slave_1) entered disabled state [ 2785.374881][T31517] bridge_slave_1: entered allmulticast mode [ 2785.384029][T31517] bridge_slave_1: entered promiscuous mode [ 2785.491946][T31564] netlink: 8 bytes leftover after parsing attributes in process `syz.1.8946'. [ 2785.611606][T30168] usb 5-1: new high-speed USB device number 49 using dummy_hcd [ 2785.830765][T30168] usb 5-1: Using ep0 maxpacket: 32 [ 2785.840345][T31517] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2785.931844][T30168] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2785.946972][T30168] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2785.954006][T31517] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2785.958803][T30168] usb 5-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 2785.978310][T30168] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2786.122421][T30168] usb 5-1: config 0 descriptor?? [ 2786.565513][T31517] team0: Port device team_slave_0 added [ 2786.573355][T21594] Bluetooth: hci4: command 0x0406 tx timeout [ 2786.619034][T30168] usbhid 5-1:0.0: can't add hid device: -71 [ 2786.626440][T30168] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2786.696417][T30168] usb 5-1: USB disconnect, device number 49 [ 2786.705693][T31517] team0: Port device team_slave_1 added [ 2786.860274][T31248] netdevsim netdevsim7 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2787.065934][T21594] Bluetooth: hci3: command tx timeout [ 2787.154292][T31248] netdevsim netdevsim7 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2788.244145][T31248] netdevsim netdevsim7 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2788.270005][T31517] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2788.285698][T31517] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2788.316510][T31517] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2788.342981][T31517] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2788.352209][T31517] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2788.389049][T31517] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2788.550392][T31248] netdevsim netdevsim7 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2788.738325][T18345] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2788.748429][T18345] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2789.003910][T31517] hsr_slave_0: entered promiscuous mode [ 2789.022519][T31517] hsr_slave_1: entered promiscuous mode [ 2789.032293][T31517] debugfs: 'hsr0' already exists in 'hsr' [ 2789.038874][T31517] Cannot create hsr debugfs directory [ 2789.091314][T23942] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2789.100333][T23942] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2789.181959][T15154] Bluetooth: hci3: command tx timeout [ 2789.325511][T31248] bridge_slave_1: left allmulticast mode [ 2789.332089][T31248] bridge_slave_1: left promiscuous mode [ 2789.339160][T31248] bridge0: port 2(bridge_slave_1) entered disabled state [ 2789.385749][T31248] bridge_slave_0: left allmulticast mode [ 2789.392424][T31248] bridge_slave_0: left promiscuous mode [ 2789.424642][T31248] bridge0: port 1(bridge_slave_0) entered disabled state [ 2789.881408][T20195] usb 1-1: new high-speed USB device number 45 using dummy_hcd [ 2790.051483][T20195] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2790.062080][T20195] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2790.118254][T20195] usb 1-1: config 0 descriptor?? [ 2790.249664][T31248] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2790.309453][T31248] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2790.356125][T31248] bond0 (unregistering): Released all slaves [ 2790.389472][T31596] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8955'. [ 2790.521481][T25600] usb 2-1: new high-speed USB device number 7 using dummy_hcd [ 2790.780706][T25600] usb 2-1: Using ep0 maxpacket: 32 [ 2790.872034][T25600] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2790.884558][T25600] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2790.897257][T25600] usb 2-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 2790.908753][T25600] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2790.976303][T25600] usb 2-1: config 0 descriptor?? [ 2791.438616][T25600] usbhid 2-1:0.0: can't add hid device: -71 [ 2791.452590][T25600] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 2791.513243][T31248] hsr_slave_0: left promiscuous mode [ 2791.523661][T25600] usb 2-1: USB disconnect, device number 7 [ 2791.560790][T31248] hsr_slave_1: left promiscuous mode [ 2791.575691][T31248] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2791.584107][T31248] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2791.625398][T31248] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2791.634292][T31248] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2791.687734][T31248] veth1_macvtap: left promiscuous mode [ 2791.694227][T31248] veth0_macvtap: left promiscuous mode [ 2791.694555][T21594] Bluetooth: hci6: command 0x0406 tx timeout [ 2791.700698][T31248] veth1_vlan: left promiscuous mode [ 2791.713300][T31248] veth0_vlan: left promiscuous mode [ 2792.072770][T20195] usb 1-1: Cannot set autoneg [ 2792.083208][T20195] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 2792.205629][T20195] usb 1-1: USB disconnect, device number 45 [ 2792.735881][T31248] team0 (unregistering): Port device team_slave_1 removed [ 2792.836782][T31248] team0 (unregistering): Port device team_slave_0 removed [ 2794.241462][T31627] netlink: 'syz.0.8966': attribute type 9 has an invalid length. [ 2801.114585][T31631] netlink: 20 bytes leftover after parsing attributes in process `syz.1.8968'. [ 2801.725647][T31517] netdevsim netdevsim2 netdevsim0: renamed from eth0 [ 2801.801855][T31517] netdevsim netdevsim2 netdevsim1: renamed from eth1 [ 2801.901744][T31517] netdevsim netdevsim2 netdevsim2: renamed from eth2 [ 2802.064368][T31517] netdevsim netdevsim2 netdevsim3: renamed from eth3 [ 2802.899677][T30641] usb 2-1: new high-speed USB device number 8 using dummy_hcd [ 2803.074882][T30641] usb 2-1: Using ep0 maxpacket: 32 [ 2803.104904][T30641] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2803.118153][T30641] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2803.134793][T30641] usb 2-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 2803.151959][T30641] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2803.201968][T30641] usb 2-1: config 0 descriptor?? [ 2804.094251][T31517] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2804.126745][T30641] usbhid 2-1:0.0: can't add hid device: -71 [ 2804.134074][T30641] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 2804.195918][T30641] usb 2-1: USB disconnect, device number 8 [ 2804.376628][T31517] 8021q: adding VLAN 0 to HW filter on device team0 [ 2804.475595][T23965] bridge0: port 1(bridge_slave_0) entered blocking state [ 2804.483892][T23965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2804.562276][T23965] bridge0: port 2(bridge_slave_1) entered blocking state [ 2804.570605][T23965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2807.343056][T31661] netlink: 20 bytes leftover after parsing attributes in process `syz.4.8980'. [ 2807.865193][T31517] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2808.402471][T31674] syzkaller0: entered promiscuous mode [ 2808.409263][T31674] syzkaller0: entered allmulticast mode [ 2808.550098][T31517] veth0_vlan: entered promiscuous mode [ 2808.788940][T31517] veth1_vlan: entered promiscuous mode [ 2809.118531][T31517] veth0_macvtap: entered promiscuous mode [ 2809.203994][T31517] veth1_macvtap: entered promiscuous mode [ 2809.499608][T31517] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2809.701881][T31517] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2809.839370][T30943] netdevsim netdevsim2 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2809.918061][T30943] netdevsim netdevsim2 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2809.935151][T20195] usb 5-1: new high-speed USB device number 50 using dummy_hcd [ 2809.967223][T30943] netdevsim netdevsim2 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2810.056013][T30943] netdevsim netdevsim2 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2810.141000][T20195] usb 5-1: Using ep0 maxpacket: 32 [ 2810.188724][T20195] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2810.201262][T20195] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2810.214710][T20195] usb 5-1: New USB device found, idVendor=13ec, idProduct=0006, bcdDevice= 0.00 [ 2810.225728][T20195] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2817.334580][T20195] usb 5-1: config 0 descriptor?? [ 2818.053767][T20195] usbhid 5-1:0.0: can't add hid device: -71 [ 2818.061453][T20195] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 2818.162022][T20195] usb 5-1: USB disconnect, device number 50 [ 2819.987165][T31706] netlink: 8 bytes leftover after parsing attributes in process `syz.9.8994'. [ 2821.081507][T31712] syzkaller0: entered promiscuous mode [ 2821.087665][T31712] syzkaller0: entered allmulticast mode [ 2822.832016][T31731] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.9000'. [ 2823.203622][T20195] usb 5-1: new high-speed USB device number 51 using dummy_hcd [ 2823.421216][T20195] usb 5-1: Using ep0 maxpacket: 32 [ 2823.450965][T20195] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 2823.461639][T20195] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2823.570343][T20195] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 2824.191041][T31731] netlink: 'syz.4.9000': attribute type 1 has an invalid length. [ 2824.478680][T18345] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2824.487576][T18345] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2824.736739][T20195] gspca_nw80x: reg_w err -71 [ 2824.742491][T20195] nw80x 5-1:3.0: probe with driver nw80x failed with error -71 [ 2824.792098][T20195] usb 5-1: USB disconnect, device number 51 [ 2824.855785][T18345] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2824.864943][T18345] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2825.571080][T21594] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 2825.580963][T21594] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 2825.590646][T21594] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 2825.633207][T21594] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 2825.663138][T21594] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 2827.396791][T31762] syzkaller0: entered promiscuous mode [ 2827.403133][T31762] syzkaller0: entered allmulticast mode [ 2827.770966][T15154] Bluetooth: hci4: command tx timeout [ 2827.994647][T31749] chnl_net:caif_netlink_parms(): no params data found [ 2830.076800][T21594] Bluetooth: hci4: command tx timeout [ 2833.157069][T23981] netdevsim netdevsim1 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2833.548720][T21594] Bluetooth: hci4: command tx timeout [ 2834.314042][T31788] netlink: 16178 bytes leftover after parsing attributes in process `syz.9.9014'. [ 2834.389575][T23981] netdevsim netdevsim1 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2834.641030][T20195] usb 10-1: new high-speed USB device number 8 using dummy_hcd [ 2834.688998][T23981] netdevsim netdevsim1 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2834.812929][T20195] usb 10-1: Using ep0 maxpacket: 32 [ 2834.825260][T23981] netdevsim netdevsim1 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2834.847342][T20195] usb 10-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 2834.858155][T20195] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2834.861083][T31749] bridge0: port 1(bridge_slave_0) entered blocking state [ 2834.901812][T31749] bridge0: port 1(bridge_slave_0) entered disabled state [ 2834.910593][T31749] bridge_slave_0: entered allmulticast mode [ 2834.920893][T31749] bridge_slave_0: entered promiscuous mode [ 2834.953263][T31749] bridge0: port 2(bridge_slave_1) entered blocking state [ 2834.962054][T31749] bridge0: port 2(bridge_slave_1) entered disabled state [ 2834.978954][T31749] bridge_slave_1: entered allmulticast mode [ 2834.998157][T31749] bridge_slave_1: entered promiscuous mode [ 2835.002633][T20195] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 2835.530343][T23981] bridge_slave_1: left allmulticast mode [ 2835.537124][T23981] bridge_slave_1: left promiscuous mode [ 2835.544293][T23981] bridge0: port 2(bridge_slave_1) entered disabled state [ 2835.568375][T23981] bridge_slave_0: left allmulticast mode [ 2835.579588][T23981] bridge_slave_0: left promiscuous mode [ 2835.594430][T23981] bridge0: port 1(bridge_slave_0) entered disabled state [ 2835.604135][T31788] netlink: 'syz.9.9014': attribute type 1 has an invalid length. [ 2835.621566][T21594] Bluetooth: hci4: command tx timeout [ 2836.262431][T20195] gspca_nw80x: reg_w err -71 [ 2836.267974][T20195] nw80x 10-1:3.0: probe with driver nw80x failed with error -71 [ 2836.283766][T20195] usb 10-1: USB disconnect, device number 8 [ 2836.805925][T23981] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2836.952073][T23981] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2837.076225][T23981] bond0 (unregistering): Released all slaves [ 2837.246814][T31749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2837.391499][T31810] syzkaller0: entered promiscuous mode [ 2837.397719][T31810] syzkaller0: entered allmulticast mode [ 2837.703928][T31749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2838.179192][T31749] team0: Port device team_slave_0 added [ 2838.249815][T23981] hsr_slave_0: left promiscuous mode [ 2838.355571][T23981] hsr_slave_1: left promiscuous mode [ 2838.371190][T23981] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2838.379847][T23981] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2838.422825][T23981] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2838.431307][T23981] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2838.543331][T23981] veth1_macvtap: left promiscuous mode [ 2838.553889][T23981] veth0_macvtap: left promiscuous mode [ 2838.560314][T23981] veth1_vlan: left promiscuous mode [ 2838.566552][T23981] veth0_vlan: left promiscuous mode [ 2839.662933][T23981] team0 (unregistering): Port device team_slave_1 removed [ 2839.701634][T23981] team0 (unregistering): Port device team_slave_0 removed [ 2839.991021][T20195] usb 5-1: new high-speed USB device number 52 using dummy_hcd [ 2840.017955][T31749] team0: Port device team_slave_1 added [ 2840.100185][T31856] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.9032'. [ 2840.220968][T20195] usb 5-1: Using ep0 maxpacket: 32 [ 2840.282979][T20195] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 2840.295782][T20195] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2840.378859][T20195] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 2840.389436][T31749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2840.400777][T31749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2840.431036][T31749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2840.502096][T31749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2840.511299][T31749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2840.545300][T31749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2840.893028][T31749] hsr_slave_0: entered promiscuous mode [ 2840.904119][T31749] hsr_slave_1: entered promiscuous mode [ 2840.920063][T31749] debugfs: 'hsr0' already exists in 'hsr' [ 2840.931477][T31749] Cannot create hsr debugfs directory [ 2840.980279][T31855] netlink: 'syz.4.9032': attribute type 1 has an invalid length. [ 2841.504414][T20195] gspca_nw80x: reg_w err -71 [ 2841.509873][T20195] nw80x 5-1:3.0: probe with driver nw80x failed with error -71 [ 2841.561693][T20195] usb 5-1: USB disconnect, device number 52 [ 2849.719380][T31749] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 2850.075015][T31749] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 2850.232170][T31749] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 2850.314569][T31749] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 2851.578177][T31749] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2851.738613][T31749] 8021q: adding VLAN 0 to HW filter on device team0 [ 2851.903715][T31249] bridge0: port 1(bridge_slave_0) entered blocking state [ 2851.911974][T31249] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2852.097725][T31249] bridge0: port 2(bridge_slave_1) entered blocking state [ 2852.105986][T31249] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2852.705667][T31749] hsr0: Slave A (hsr_slave_0) is not up; please bring it up to get a fully working HSR network [ 2852.717466][T31749] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 2854.285015][T25600] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 2854.559791][T25600] usb 1-1: New USB device found, idVendor=0fe9, idProduct=db55, bcdDevice=69.fb [ 2854.570586][T25600] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=201 [ 2854.579774][T25600] usb 1-1: Product: syz [ 2854.587126][T25600] usb 1-1: Manufacturer: syz [ 2854.592501][T25600] usb 1-1: SerialNumber: syz [ 2854.655014][T25600] usb 1-1: config 0 descriptor?? [ 2854.707423][T25600] dvb-usb: found a 'DigitalNow DVB-T Dual USB' in warm state. [ 2854.716098][T25600] dvb-usb: bulk message failed: -22 (2/0) [ 2854.767476][T25600] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2854.782317][T25600] dvbdev: DVB: registering new adapter (DigitalNow DVB-T Dual USB) [ 2854.791963][T25600] usb 1-1: media controller created [ 2854.870167][T25600] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2854.891386][T31911] cxusb: i2c rd: len=245 is too big! [ 2854.891386][T31911] [ 2855.069399][T31927] netlink: 20 bytes leftover after parsing attributes in process `syz.9.9056'. [ 2855.146762][T25600] cxusb: set interface failed [ 2855.152307][T25600] dvb-usb: bulk message failed: -22 (1/0) [ 2855.591546][T25600] DVB: Unable to find symbol mt352_attach() [ 2855.598411][T25600] dvb-usb: bulk message failed: -22 (5/0) [ 2855.605185][T25600] zl10353_read_register: readreg error (reg=127, ret==-121) [ 2855.613848][T25600] dvb-usb: no frontend was attached by 'DigitalNow DVB-T Dual USB' [ 2855.840029][T31749] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2856.321241][T25600] rc_core: IR keymap rc-dvico-mce not found [ 2856.327994][T25600] Registered IR keymap rc-empty [ 2856.335482][T25600] rc rc0: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0 [ 2856.348613][T25600] input: DigitalNow DVB-T Dual USB as /devices/platform/dummy_hcd.0/usb1/1-1/rc/rc0/input40 [ 2856.480841][T30641] usb 5-1: new high-speed USB device number 53 using dummy_hcd [ 2856.557518][T25600] dvb-usb: schedule remote query interval to 100 msecs. [ 2856.565694][T25600] dvb-usb: DigitalNow DVB-T Dual USB successfully initialized and connected. [ 2856.664953][T25600] usb 1-1: USB disconnect, device number 46 [ 2856.732200][T30641] usb 5-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 2856.742874][T30641] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2856.752044][T30641] usb 5-1: Product: syz [ 2856.756800][T30641] usb 5-1: Manufacturer: syz [ 2856.762194][T30641] usb 5-1: SerialNumber: syz [ 2856.925492][T30641] usb 5-1: config 0 descriptor?? [ 2856.945172][T30641] hub 5-1:0.0: bad descriptor, ignoring hub [ 2856.952094][T30641] hub 5-1:0.0: probe with driver hub failed with error -5 [ 2857.092877][ T5873] usb 10-1: new full-speed USB device number 9 using dummy_hcd [ 2857.122297][T25600] dvb-usb: DigitalNow DVB-T Dual USB successfully deinitialized and disconnected. [ 2857.192392][T30641] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 2857.232761][T30641] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2857.262949][T30641] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 2857.272785][T30641] usb 5-1: media controller created [ 2857.350254][T30641] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2857.384717][ T5873] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 2857.399874][ T5873] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 2857.419814][ T5873] usb 10-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 2857.431743][ T5873] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2857.508366][ T5873] usb 10-1: config 0 descriptor?? [ 2857.535672][ T5873] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 2857.581820][T25600] usb 1-1: new high-speed USB device number 47 using dummy_hcd [ 2857.749632][T25600] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2857.756755][T31954] i2c i2c-1: Invalid block size returned: 239 [ 2857.760050][T25600] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2857.883540][T30641] DVB: Unable to find symbol dib7000p_attach() [ 2857.890878][T30641] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 2857.949313][T25600] usb 1-1: config 0 descriptor?? [ 2857.993408][T31749] veth0_vlan: entered promiscuous mode [ 2858.145122][T31749] veth1_vlan: entered promiscuous mode [ 2858.338171][T30641] rc_core: IR keymap rc-dib0700-rc5 not found [ 2858.346104][T30641] Registered IR keymap rc-empty [ 2858.353091][T30641] dvb-usb: could not initialize remote control. [ 2858.360086][T30641] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 2858.394117][T31749] veth0_macvtap: entered promiscuous mode [ 2858.453148][T30641] usb 5-1: USB disconnect, device number 53 [ 2858.497032][T31749] veth1_macvtap: entered promiscuous mode [ 2858.678432][T31749] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2859.075120][T31749] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2859.117393][T30641] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 2859.302792][T31248] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2859.392819][T31248] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2859.445596][T31248] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2859.520222][T31248] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2859.797161][T25600] usb 1-1: Cannot set autoneg [ 2859.803462][T25600] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 2860.006545][T25600] usb 1-1: USB disconnect, device number 47 [ 2860.059756][T20195] usb 10-1: USB disconnect, device number 9 [ 2860.445204][T31971] binder: 31966:31971 ioctl c0306201 200000000140 returned -11 [ 2863.492066][T31982] netlink: 20 bytes leftover after parsing attributes in process `syz.9.9067'. [ 2864.092438][T20195] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 2864.289879][T20195] usb 1-1: Using ep0 maxpacket: 16 [ 2864.327770][T20195] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 2864.338433][T20195] usb 1-1: config 0 has no interface number 0 [ 2864.345594][T20195] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2864.359587][T20195] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2864.371260][T20195] usb 1-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 2864.383390][T20195] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2864.546225][T20195] usb 1-1: config 0 descriptor?? [ 2864.967841][T20195] holtek_mouse 0003:04D9:A081.0043: unknown main item tag 0x0 [ 2864.979545][T20195] holtek_mouse 0003:04D9:A081.0043: item fetching failed at offset 7/8 [ 2865.070313][T20195] holtek_mouse 0003:04D9:A081.0043: hid parse failed: -22 [ 2865.081552][T20195] holtek_mouse 0003:04D9:A081.0043: probe with driver holtek_mouse failed with error -22 [ 2865.289995][T25600] usb 1-1: USB disconnect, device number 48 [ 2866.704493][T25600] usb 1-1: new high-speed USB device number 49 using dummy_hcd [ 2866.750241][T32011] usb usb8: usbfs: process 32011 (syz.9.9072) did not claim interface 0 before use [ 2866.793585][T15154] Bluetooth: hci0: unexpected cc 0x0c03 length: 249 > 1 [ 2866.803638][T15154] Bluetooth: hci0: unexpected cc 0x1003 length: 249 > 9 [ 2866.818566][T15154] Bluetooth: hci0: unexpected cc 0x1001 length: 249 > 9 [ 2866.837259][T15154] Bluetooth: hci0: unexpected cc 0x0c23 length: 249 > 4 [ 2866.849059][T15154] Bluetooth: hci0: unexpected cc 0x0c38 length: 249 > 2 [ 2867.458938][T25600] usb 1-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 2867.469154][T25600] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2867.478265][T25600] usb 1-1: Product: syz [ 2867.482986][T25600] usb 1-1: Manufacturer: syz [ 2867.488114][T25600] usb 1-1: SerialNumber: syz [ 2867.563889][T32019] IPVS: sync thread started: state = BACKUP, mcast_ifn = ip6_vti0, syncid = 1, id = 0 [ 2867.801980][T25600] usb 1-1: config 0 descriptor?? [ 2867.916456][T25600] hub 1-1:0.0: bad descriptor, ignoring hub [ 2867.924375][T25600] hub 1-1:0.0: probe with driver hub failed with error -5 [ 2868.244473][T25600] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 2868.409153][T32008] chnl_net:caif_netlink_parms(): no params data found [ 2868.688571][T25600] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2868.960907][T15154] Bluetooth: hci0: command tx timeout [ 2868.995475][T25600] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 2869.005276][T25600] usb 1-1: media controller created [ 2869.148225][T25600] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2869.545735][ T30] audit: type=1326 audit(2869.294:4005): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32028 comm="syz.9.9074" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fd0d0d8f749 code=0x0 [ 2870.119436][T25600] DVB: Unable to find symbol dib7000p_attach() [ 2870.126574][T25600] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 2870.657563][T30943] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2870.666782][T30943] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2870.685181][T25600] rc_core: IR keymap rc-dib0700-rc5 not found [ 2870.696262][T25600] Registered IR keymap rc-empty [ 2870.708773][T25600] dvb-usb: could not initialize remote control. [ 2870.717486][T25600] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 2871.050935][T19559] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2871.059695][T19559] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2871.068059][T15154] Bluetooth: hci0: command tx timeout [ 2871.261111][T25600] usb 1-1: USB disconnect, device number 49 [ 2872.303953][T32008] bridge0: port 1(bridge_slave_0) entered blocking state [ 2872.312284][T32008] bridge0: port 1(bridge_slave_0) entered disabled state [ 2872.320962][T32008] bridge_slave_0: entered allmulticast mode [ 2872.329867][T32008] bridge_slave_0: entered promiscuous mode [ 2872.622188][T32008] bridge0: port 2(bridge_slave_1) entered blocking state [ 2872.630265][T32008] bridge0: port 2(bridge_slave_1) entered disabled state [ 2872.638926][T32008] bridge_slave_1: entered allmulticast mode [ 2872.655060][T32008] bridge_slave_1: entered promiscuous mode [ 2873.010103][T32051] netlink: 20 bytes leftover after parsing attributes in process `syz.9.9078'. [ 2873.130755][T21594] Bluetooth: hci0: command tx timeout [ 2873.189592][T25600] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 2873.232089][T32008] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2873.411065][T32008] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2873.610866][T21594] Bluetooth: hci2: command 0x0406 tx timeout [ 2873.870779][T25600] usb 1-1: new high-speed USB device number 50 using dummy_hcd [ 2874.051937][T32008] team0: Port device team_slave_0 added [ 2874.277570][T32008] team0: Port device team_slave_1 added [ 2874.431353][T25600] usb 1-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2874.441883][T25600] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2874.650110][T32008] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2874.658783][T32008] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2874.687768][T32008] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2874.786694][T25600] usb 1-1: config 0 descriptor?? [ 2874.945173][T32008] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2874.953699][T32008] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2874.982685][T32008] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2875.237914][T15154] Bluetooth: hci0: command tx timeout [ 2875.633512][T32008] hsr_slave_0: entered promiscuous mode [ 2875.646056][T32008] hsr_slave_1: entered promiscuous mode [ 2875.654620][T32008] debugfs: 'hsr0' already exists in 'hsr' [ 2875.661317][T32008] Cannot create hsr debugfs directory [ 2876.473135][T20195] usb 10-1: new high-speed USB device number 10 using dummy_hcd [ 2876.778385][T20195] usb 10-1: New USB device found, idVendor=2304, idProduct=023e, bcdDevice=d7.69 [ 2876.789038][T20195] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 2876.798547][T20195] usb 10-1: Product: syz [ 2876.803789][T20195] usb 10-1: Manufacturer: syz [ 2876.809082][T20195] usb 10-1: SerialNumber: syz [ 2876.838058][T25600] usb 1-1: Cannot set autoneg [ 2876.843917][T25600] MOSCHIP usb-ethernet driver 1-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 2877.035291][T20195] usb 10-1: config 0 descriptor?? [ 2877.089390][T20195] hub 10-1:0.0: bad descriptor, ignoring hub [ 2877.096289][T20195] hub 10-1:0.0: probe with driver hub failed with error -5 [ 2877.116640][T25600] usb 1-1: USB disconnect, device number 50 [ 2877.289532][T20195] dvb-usb: found a 'Pinnacle PCTV Hybrid Stick Solo' in warm state. [ 2877.376234][T20195] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 2877.407527][T20195] dvbdev: DVB: registering new adapter (Pinnacle PCTV Hybrid Stick Solo) [ 2877.417702][T20195] usb 10-1: media controller created [ 2877.491318][T20195] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 2878.497907][T32008] netdevsim netdevsim6 netdevsim0: renamed from eth0 [ 2878.533179][T32008] netdevsim netdevsim6 netdevsim1: renamed from eth1 [ 2878.622901][T32008] netdevsim netdevsim6 netdevsim2: renamed from eth2 [ 2878.669665][T32008] netdevsim netdevsim6 netdevsim3: renamed from eth3 [ 2879.159297][T20195] DVB: Unable to find symbol dib7000p_attach() [ 2879.166937][T20195] dvb-usb: no frontend was attached by 'Pinnacle PCTV Hybrid Stick Solo' [ 2879.766367][T32081] netlink: 16 bytes leftover after parsing attributes in process `syz.9.9088'. [ 2879.884934][T32082] netlink: 16 bytes leftover after parsing attributes in process `syz.9.9088'. [ 2880.642549][T32086] netlink: 20 bytes leftover after parsing attributes in process `syz.0.9089'. [ 2880.710694][T32008] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2880.981541][T32008] 8021q: adding VLAN 0 to HW filter on device team0 [ 2881.926980][T23965] bridge0: port 1(bridge_slave_0) entered blocking state [ 2881.935195][T23965] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2882.375637][T23965] bridge0: port 2(bridge_slave_1) entered blocking state [ 2882.383763][T23965] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2882.821093][ T30] audit: type=1326 audit(2882.734:4006): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=32078 comm="syz.4.9087" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7f62a458f749 code=0x0 [ 2883.165967][T20195] rc_core: IR keymap rc-dib0700-rc5 not found [ 2883.172956][T20195] Registered IR keymap rc-empty [ 2883.179000][T20195] dvb-usb: could not initialize remote control. [ 2883.186089][T20195] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully initialized and connected. [ 2883.329633][T20195] usb 10-1: USB disconnect, device number 10 [ 2883.771559][T20195] dvb-usb: Pinnacle PCTV Hybrid Stick Solo successfully deinitialized and disconnected. [ 2884.801108][T20195] usb 10-1: new high-speed USB device number 11 using dummy_hcd [ 2885.092694][T20195] usb 10-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2885.103609][T20195] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2885.177553][T20195] usb 10-1: config 0 descriptor?? [ 2886.857125][T20195] usb 10-1: Cannot set autoneg [ 2886.863477][T20195] MOSCHIP usb-ethernet driver 10-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 2886.994083][T20195] usb 10-1: USB disconnect, device number 11 [ 2887.453526][T32008] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2887.541969][T32123] netlink: 20 bytes leftover after parsing attributes in process `syz.8.9100'. [ 2893.597655][T32008] veth0_vlan: entered promiscuous mode [ 2893.714766][T32008] veth1_vlan: entered promiscuous mode [ 2894.091398][T32008] veth0_macvtap: entered promiscuous mode [ 2894.227897][T32008] veth1_macvtap: entered promiscuous mode [ 2897.093103][T32008] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 2897.258504][T32008] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 2897.500099][T28916] netdevsim netdevsim6 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 2897.567852][T28916] netdevsim netdevsim6 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 2897.662516][T28916] netdevsim netdevsim6 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 2897.752324][ T1096] netdevsim netdevsim6 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 2900.837380][T32198] netlink: 'syz.8.9121': attribute type 21 has an invalid length. [ 2900.846787][T32198] netlink: 132 bytes leftover after parsing attributes in process `syz.8.9121'. [ 2903.782027][ T9] usb 5-1: new full-speed USB device number 54 using dummy_hcd [ 2904.037718][ T9] usb 5-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 9 [ 2904.053173][ T9] usb 5-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 2904.063546][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2904.294735][ T9] usb 5-1: config 0 descriptor?? [ 2904.367462][ T9] usbhid 5-1:0.0: couldn't find an input interrupt endpoint [ 2905.860970][ T5873] usb 10-1: new high-speed USB device number 12 using dummy_hcd [ 2906.100778][ T5873] usb 10-1: Using ep0 maxpacket: 16 [ 2906.187288][ T5873] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 2906.196632][ T5873] usb 10-1: config 0 has no interface number 0 [ 2906.207145][ T5873] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2906.219857][ T5873] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2906.231139][ T5873] usb 10-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 2906.245569][ T5873] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2906.319401][ T5873] usb 10-1: config 0 descriptor?? [ 2906.364757][T32244] netlink: 'syz.0.9135': attribute type 21 has an invalid length. [ 2906.374332][T32244] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9135'. [ 2906.792497][ T5873] holtek_mouse 0003:04D9:A081.0044: unknown main item tag 0x0 [ 2906.801349][ T5873] holtek_mouse 0003:04D9:A081.0044: item fetching failed at offset 7/8 [ 2906.916093][ T9] usb 5-1: USB disconnect, device number 54 [ 2907.249134][ T5873] holtek_mouse 0003:04D9:A081.0044: hid parse failed: -22 [ 2907.257661][ T5873] holtek_mouse 0003:04D9:A081.0044: probe with driver holtek_mouse failed with error -22 [ 2908.011164][ T5873] usb 10-1: USB disconnect, device number 12 [ 2909.535951][T23965] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2909.545011][T23965] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2909.844391][T23942] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 2909.853426][T23942] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 2917.574671][T32316] netlink: 20 bytes leftover after parsing attributes in process `syz.6.9158'. [ 2918.098740][ T5873] usb 1-1: new high-speed USB device number 51 using dummy_hcd [ 2918.884941][ T5873] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2918.896124][ T5873] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2918.910730][ T5873] usb 1-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 2918.921113][ T5873] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2919.287513][ T5873] usb 1-1: config 0 descriptor?? [ 2919.641981][T32332] netlink: 'syz.6.9165': attribute type 21 has an invalid length. [ 2919.656375][T32332] netlink: 132 bytes leftover after parsing attributes in process `syz.6.9165'. [ 2920.058091][ T5873] usbhid 1-1:0.0: can't add hid device: -71 [ 2920.071972][ T5873] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 2920.557990][ T5873] usb 1-1: USB disconnect, device number 51 [ 2920.845595][T32340] tipc: Started in network mode [ 2920.851220][T32340] tipc: Node identity b2d79eda1ad8, cluster identity 4711 [ 2920.859714][T32340] tipc: Enabled bearer , priority 0 [ 2920.924397][T32344] syzkaller0: entered promiscuous mode [ 2920.930713][T32344] syzkaller0: entered allmulticast mode [ 2921.032060][T32345] netlink: 12 bytes leftover after parsing attributes in process `syz.4.9169'. [ 2921.078910][T32340] tipc: Resetting bearer [ 2921.250312][T32339] tipc: Resetting bearer [ 2921.380030][T32339] tipc: Disabling bearer [ 2923.872951][T32364] netlink: 20 bytes leftover after parsing attributes in process `syz.6.9175'. [ 2925.587074][T20195] usb 5-1: new high-speed USB device number 55 using dummy_hcd [ 2925.896006][T20195] usb 5-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 2925.908710][T20195] usb 5-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 2925.924339][T20195] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 2925.937324][T20195] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 52, changing to 9 [ 2925.950947][T20195] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8241, setting to 1024 [ 2926.268778][T20195] usb 5-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 2926.279093][T20195] usb 5-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 2926.288184][T20195] usb 5-1: Product: syz [ 2926.293168][T20195] usb 5-1: Manufacturer: syz [ 2926.545825][T20195] cdc_wdm 5-1:1.0: skipping garbage [ 2926.552012][T20195] cdc_wdm 5-1:1.0: skipping garbage [ 2926.572722][ T9] usb 10-1: new full-speed USB device number 13 using dummy_hcd [ 2926.650853][T20195] cdc_wdm 5-1:1.0: cdc-wdm0: USB WDM device [ 2926.657464][T20195] cdc_wdm 5-1:1.0: Unknown control protocol [ 2926.789547][ T9] usb 10-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 2926.801495][ T9] usb 10-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 2926.816182][ T9] usb 10-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 2926.829503][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2927.307414][ T9] usb 10-1: usb_control_msg returned -32 [ 2927.314238][ T9] usbtmc 10-1:16.0: can't read capabilities [ 2927.321782][T32378] netlink: 'syz.0.9178': attribute type 21 has an invalid length. [ 2927.335759][T32378] netlink: 132 bytes leftover after parsing attributes in process `syz.0.9178'. [ 2928.838120][T20195] usb 5-1: USB disconnect, device number 55 [ 2929.400734][T20195] usb 7-1: new high-speed USB device number 43 using dummy_hcd [ 2929.433977][ T9] usb 10-1: USB disconnect, device number 13 [ 2929.641401][T20195] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2929.652996][T20195] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2929.667731][T20195] usb 7-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 2929.677963][T20195] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2929.858266][T20195] usb 7-1: config 0 descriptor?? [ 2930.053418][T32392] xt_TPROXY: Can be used only with -p tcp or -p udp [ 2930.747438][T20195] usbhid 7-1:0.0: can't add hid device: -71 [ 2930.756450][T20195] usbhid 7-1:0.0: probe with driver usbhid failed with error -71 [ 2932.013115][T20195] usb 7-1: USB disconnect, device number 43 [ 2932.174728][T32393] netlink: 20 bytes leftover after parsing attributes in process `syz.9.9186'. [ 2935.092683][T15154] Bluetooth: hci3: command 0x0406 tx timeout [ 2936.040238][T32413] netlink: 'syz.6.9192': attribute type 21 has an invalid length. [ 2936.049213][T32413] netlink: 132 bytes leftover after parsing attributes in process `syz.6.9192'. [ 2942.352092][T20195] usb 1-1: new high-speed USB device number 52 using dummy_hcd [ 2943.687264][T32437] binder: 32429:32437 ioctl 4018620d 0 returned -22 [ 2943.794630][T32434] binder: 32432:32434 ioctl c0306201 0 returned -14 [ 2946.731046][T32449] netlink: 'syz.9.9205': attribute type 21 has an invalid length. [ 2946.740062][T32449] netlink: 132 bytes leftover after parsing attributes in process `syz.9.9205'. [ 2947.536131][T23959] netdevsim netdevsim2 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2947.924435][T23959] netdevsim netdevsim2 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2948.276201][T23959] netdevsim netdevsim2 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2948.743170][T23959] netdevsim netdevsim2 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2949.751471][T32464] binder: 32461:32464 ioctl c0306201 0 returned -14 [ 2949.870967][T23959] bridge_slave_1: left allmulticast mode [ 2949.882685][T23959] bridge_slave_1: left promiscuous mode [ 2949.889734][T23959] bridge0: port 2(bridge_slave_1) entered disabled state [ 2950.011750][T23959] bridge_slave_0: left allmulticast mode [ 2950.018148][T23959] bridge_slave_0: left promiscuous mode [ 2950.025542][T23959] bridge0: port 1(bridge_slave_0) entered disabled state [ 2950.175402][T30641] usb 10-1: new high-speed USB device number 14 using dummy_hcd [ 2950.501579][T30641] usb 10-1: Using ep0 maxpacket: 16 [ 2950.551047][T21594] Bluetooth: hci4: command 0x0406 tx timeout [ 2950.570713][T30641] usb 10-1: config 0 has an invalid interface number: 1 but max is 0 [ 2950.583132][T30641] usb 10-1: config 0 has no interface number 0 [ 2950.590023][T30641] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 2950.606026][T30641] usb 10-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2950.618169][T30641] usb 10-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 2950.628544][T30641] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2950.978936][T30641] usb 10-1: config 0 descriptor?? [ 2951.661766][T30641] holtek_mouse 0003:04D9:A081.0045: unknown main item tag 0x0 [ 2951.670362][T30641] holtek_mouse 0003:04D9:A081.0045: item fetching failed at offset 7/8 [ 2951.724617][T23959] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2951.789457][T30641] holtek_mouse 0003:04D9:A081.0045: hid parse failed: -22 [ 2951.797912][T30641] holtek_mouse 0003:04D9:A081.0045: probe with driver holtek_mouse failed with error -22 [ 2951.921991][T23959] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2952.149245][T23959] bond0 (unregistering): Released all slaves [ 2952.231866][ T9] usb 10-1: USB disconnect, device number 14 [ 2952.637371][T21594] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 2952.653851][T21594] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 2952.668533][T21594] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 2952.682965][T21594] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 2952.694321][T21594] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 2952.811104][T32478] input: syz0 as /devices/virtual/input/input44 [ 2953.718021][T32488] netlink: 'syz.6.9219': attribute type 21 has an invalid length. [ 2953.977311][T32488] netlink: 132 bytes leftover after parsing attributes in process `syz.6.9219'. [ 2954.253050][T23959] hsr_slave_0: left promiscuous mode [ 2954.340870][T23959] hsr_slave_1: left promiscuous mode [ 2954.349730][T23959] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2954.358345][T23959] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2954.633405][T23959] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2954.641871][T23959] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2954.739144][T21594] Bluetooth: hci3: command tx timeout [ 2954.964457][T32497] Bluetooth: MGMT ver 1.23 [ 2957.051499][T21594] Bluetooth: hci3: command tx timeout [ 2957.072368][T23959] veth1_macvtap: left promiscuous mode [ 2957.078890][T23959] veth0_macvtap: left promiscuous mode [ 2957.086973][T23959] veth1_vlan: left promiscuous mode [ 2957.093593][T23959] veth0_vlan: left promiscuous mode [ 2958.253632][T32500] binder: 32498:32500 ioctl c0306201 0 returned -14 [ 2959.141207][T21594] Bluetooth: hci3: command tx timeout [ 2959.970305][T23959] team0 (unregistering): Port device team_slave_1 removed [ 2960.138794][T23959] team0 (unregistering): Port device team_slave_0 removed [ 2961.312427][T21594] Bluetooth: hci3: command tx timeout [ 2964.250091][T32476] chnl_net:caif_netlink_parms(): no params data found [ 2964.887169][T32526] netlink: 'syz.6.9233': attribute type 21 has an invalid length. [ 2965.002673][T32526] netlink: 132 bytes leftover after parsing attributes in process `syz.6.9233'. [ 2970.912269][T32476] bridge0: port 1(bridge_slave_0) entered blocking state [ 2970.920943][T32476] bridge0: port 1(bridge_slave_0) entered disabled state [ 2970.929545][T32476] bridge_slave_0: entered allmulticast mode [ 2970.939155][T32476] bridge_slave_0: entered promiscuous mode [ 2971.194072][T32476] bridge0: port 2(bridge_slave_1) entered blocking state [ 2971.202565][T32476] bridge0: port 2(bridge_slave_1) entered disabled state [ 2971.211299][T32476] bridge_slave_1: entered allmulticast mode [ 2971.221556][T32476] bridge_slave_1: entered promiscuous mode [ 2971.494858][T23967] netdevsim netdevsim8 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2971.821204][T32559] netlink: 'syz.4.9247': attribute type 21 has an invalid length. [ 2972.053763][T23967] netdevsim netdevsim8 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2972.157602][T32559] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9247'. [ 2972.185109][T32476] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 2972.294360][T23967] netdevsim netdevsim8 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2972.439758][T32476] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 2972.586303][T23967] netdevsim netdevsim8 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 2973.196949][T32476] team0: Port device team_slave_0 added [ 2973.339951][T32476] team0: Port device team_slave_1 added [ 2974.007518][T32476] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 2974.015535][T32476] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2974.053153][T32476] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 2974.091187][T23967] bridge_slave_1: left allmulticast mode [ 2974.097580][T23967] bridge_slave_1: left promiscuous mode [ 2974.105137][T23967] bridge0: port 2(bridge_slave_1) entered disabled state [ 2974.266318][T23967] bridge_slave_0: left allmulticast mode [ 2974.272933][T23967] bridge_slave_0: left promiscuous mode [ 2974.279931][T23967] bridge0: port 1(bridge_slave_0) entered disabled state [ 2974.454906][T25600] usb 10-1: new full-speed USB device number 15 using dummy_hcd [ 2975.093468][T25600] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 2975.106123][T25600] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2975.117287][T25600] usb 10-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 2975.133455][T25600] usb 10-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 2975.144128][T25600] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2975.165197][T25600] usb 10-1: config 0 descriptor?? [ 2976.475720][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.489582][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.499255][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.513010][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.522955][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.531769][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.540311][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.548959][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.557620][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.566351][T25600] hid-multitouch 0003:0457:07DA.0046: unknown main item tag 0x0 [ 2976.773325][T23967] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 2977.063227][T23967] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 2977.364769][T23967] bond0 (unregistering): Released all slaves [ 2977.457185][T25600] hid-multitouch 0003:0457:07DA.0046: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.9-1/input0 [ 2977.667009][T25600] usb 10-1: USB disconnect, device number 15 [ 2977.699228][T32476] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 2977.707867][T32476] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 2977.749328][T32476] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 2978.807816][T32589] netlink: 'syz.9.9259': attribute type 21 has an invalid length. [ 2978.931689][T32589] netlink: 132 bytes leftover after parsing attributes in process `syz.9.9259'. [ 2979.312140][T23967] hsr_slave_0: left promiscuous mode [ 2979.423453][T23967] hsr_slave_1: left promiscuous mode [ 2979.433702][T23967] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 2979.442185][T23967] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 2979.601521][T23967] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 2979.610045][T23967] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 2980.047129][T23967] veth1_macvtap: left promiscuous mode [ 2980.054093][T23967] veth0_macvtap: left promiscuous mode [ 2980.060818][T23967] veth1_vlan: left promiscuous mode [ 2980.072435][T23967] veth0_vlan: left promiscuous mode [ 2980.902240][ T9] usb 10-1: new high-speed USB device number 16 using dummy_hcd [ 2981.186274][ T9] usb 10-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 2981.199689][ T9] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2981.437103][ T9] usb 10-1: config 0 descriptor?? [ 2981.748039][T23967] team0 (unregistering): Port device team_slave_1 removed [ 2981.924900][T23967] team0 (unregistering): Port device team_slave_0 removed [ 2982.753201][T32476] hsr_slave_0: entered promiscuous mode [ 2982.764235][T32476] hsr_slave_1: entered promiscuous mode [ 2982.773697][T32476] debugfs: 'hsr0' already exists in 'hsr' [ 2982.780152][T32476] Cannot create hsr debugfs directory [ 2982.798045][ T9] usb 10-1: Cannot set autoneg [ 2982.804415][ T9] MOSCHIP usb-ethernet driver 10-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -32 [ 2983.223126][T25600] usb 7-1: new high-speed USB device number 44 using dummy_hcd [ 2983.460284][T25600] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 2983.475650][T25600] usb 7-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 2983.491827][T25600] usb 7-1: New USB device found, idVendor=1020, idProduct=0006, bcdDevice= 0.00 [ 2983.502222][T25600] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2983.607880][T25600] usb 7-1: config 0 descriptor?? [ 2984.042690][T25600] hid_parser_main: 5 callbacks suppressed [ 2984.042789][T25600] belkin 0003:1020:0006.0047: unknown main item tag 0x0 [ 2984.057401][T25600] belkin 0003:1020:0006.0047: unknown main item tag 0x0 [ 2984.207695][T25600] belkin 0003:1020:0006.0047: hidraw0: USB HID v0.00 Device [HID 1020:0006] on usb-dummy_hcd.6-1/input0 [ 2984.221324][T20195] usb 10-1: USB disconnect, device number 16 [ 2984.289360][T25600] usb 7-1: USB disconnect, device number 44 [ 2984.511939][T32618] netlink: 'syz.9.9271': attribute type 21 has an invalid length. [ 2984.521178][T32618] netlink: 132 bytes leftover after parsing attributes in process `syz.9.9271'. [ 2984.994852][T32476] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 2985.152265][T32476] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 2985.288084][T32476] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 2985.692099][T32476] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 2987.371798][T32633] geneve2: entered promiscuous mode [ 2987.818495][T21594] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 2988.732554][T32476] 8021q: adding VLAN 0 to HW filter on device bond0 [ 2989.254796][T32641] netlink: 'syz.9.9281': attribute type 21 has an invalid length. [ 2989.263954][T32641] netlink: 132 bytes leftover after parsing attributes in process `syz.9.9281'. [ 2989.538110][T32476] 8021q: adding VLAN 0 to HW filter on device team0 [ 2989.759437][ T1130] bridge0: port 1(bridge_slave_0) entered blocking state [ 2989.767965][ T1130] bridge0: port 1(bridge_slave_0) entered forwarding state [ 2990.061435][ T1130] bridge0: port 2(bridge_slave_1) entered blocking state [ 2990.069651][ T1130] bridge0: port 2(bridge_slave_1) entered forwarding state [ 2990.970151][T32651] netlink: 16178 bytes leftover after parsing attributes in process `syz.9.9285'. [ 2991.311566][T25600] usb 10-1: new high-speed USB device number 17 using dummy_hcd [ 2991.384050][T21594] Bluetooth: hci0: command 0x0406 tx timeout [ 2991.711282][T25600] usb 10-1: Using ep0 maxpacket: 32 [ 2991.864291][T25600] usb 10-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 2991.876267][T25600] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 2991.989979][T25600] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 2992.114083][T32659] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9287'. [ 2992.407524][T25600] gspca_nw80x: reg_r err -32 [ 2992.418522][T25600] nw80x 10-1:3.0: probe with driver nw80x failed with error -32 [ 2993.544510][T32666] syzkaller0: entered promiscuous mode [ 2993.550881][T32666] syzkaller0: entered allmulticast mode [ 2994.050623][T32476] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 2994.111936][T15154] Bluetooth: hci6: Received unexpected HCI Event 0x00 [ 2994.209978][ T9] usb 10-1: USB disconnect, device number 17 [ 2994.852968][T32682] fuse: Bad value for 'fd' [ 2998.300786][T32694] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9297'. [ 2999.242577][T32704] netlink: 16178 bytes leftover after parsing attributes in process `syz.4.9301'. [ 2999.370223][T15154] Bluetooth: hci1: Received unexpected HCI Event 0x00 [ 2999.620246][T30641] usb 5-1: new high-speed USB device number 56 using dummy_hcd [ 2999.791612][T32476] veth0_vlan: entered promiscuous mode [ 2999.890789][T30641] usb 5-1: Using ep0 maxpacket: 32 [ 2999.990164][T30641] usb 5-1: New USB device found, idVendor=055f, idProduct=d001, bcdDevice=88.92 [ 3000.000846][T30641] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3000.045849][T32476] veth1_vlan: entered promiscuous mode [ 3000.249264][T30641] gspca_main: nw80x-2.14.0 probing 055f:d001 [ 3000.682833][T30641] gspca_nw80x: reg_r err -32 [ 3000.688285][T30641] nw80x 5-1:3.0: probe with driver nw80x failed with error -32 [ 3000.726730][T32476] veth0_macvtap: entered promiscuous mode [ 3000.862072][T32713] syzkaller0: entered promiscuous mode [ 3000.868292][T32713] syzkaller0: entered allmulticast mode [ 3000.918218][T32476] veth1_macvtap: entered promiscuous mode [ 3001.330156][T32476] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3001.554371][T32476] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3001.774080][ T61] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3001.802407][ T3838] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3001.870732][ T3838] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3001.952145][ T61] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3002.079587][T32720] syzkaller0: entered promiscuous mode [ 3002.101425][T32720] syzkaller0: entered allmulticast mode [ 3002.467548][ T9] usb 5-1: USB disconnect, device number 56 [ 3009.994673][T32736] netlink: 24 bytes leftover after parsing attributes in process `syz.4.9310'. [ 3010.782991][T32744] netlink: 'syz.4.9315': attribute type 21 has an invalid length. [ 3010.795904][T32744] netlink: 132 bytes leftover after parsing attributes in process `syz.4.9315'. [ 3011.281411][T32746] syzkaller0: entered promiscuous mode [ 3011.287644][T32746] syzkaller0: entered allmulticast mode [ 3011.601857][T21594] Bluetooth: hci4: unexpected cc 0x0c03 length: 249 > 1 [ 3011.616318][T21594] Bluetooth: hci4: unexpected cc 0x1003 length: 249 > 9 [ 3011.635738][T21594] Bluetooth: hci4: unexpected cc 0x1001 length: 249 > 9 [ 3011.652237][T21594] Bluetooth: hci4: unexpected cc 0x0c23 length: 249 > 4 [ 3011.669665][T21594] Bluetooth: hci4: unexpected cc 0x0c38 length: 249 > 2 [ 3011.744374][T32755] netlink: 32 bytes leftover after parsing attributes in process `syz.4.9318'. [ 3012.553321][T32760] syzkaller0: entered promiscuous mode [ 3012.559658][T32760] syzkaller0: entered allmulticast mode [ 3013.101765][T32753] chnl_net:caif_netlink_parms(): no params data found [ 3013.269178][T25600] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 3013.776211][T30217] Bluetooth: hci4: command tx timeout [ 3014.176772][T25600] usb 1-1: unable to get BOS descriptor or descriptor too short [ 3014.284087][ T308] netlink: 20 bytes leftover after parsing attributes in process `syz.6.9323'. [ 3014.547178][T25600] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 3014.558719][T25600] usb 1-1: config 0 has no interfaces? [ 3014.712137][T25600] usb 1-1: New USB device found, idVendor=0cf3, idProduct=1010, bcdDevice=26.db [ 3014.722691][T25600] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 3014.731796][T25600] usb 1-1: Product: syz [ 3014.736540][T25600] usb 1-1: Manufacturer: syz [ 3014.741998][T25600] usb 1-1: SerialNumber: syz [ 3014.989824][T25600] usb 1-1: config 0 descriptor?? [ 3015.253110][T25600] usb 1-1: USB disconnect, device number 53 [ 3015.881566][T30217] Bluetooth: hci4: command tx timeout [ 3016.503081][T32753] bridge0: port 1(bridge_slave_0) entered blocking state [ 3016.511589][T32753] bridge0: port 1(bridge_slave_0) entered disabled state [ 3016.523641][T32753] bridge_slave_0: entered allmulticast mode [ 3016.535193][T32753] bridge_slave_0: entered promiscuous mode [ 3016.650171][ T12] netdevsim netdevsim5 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3016.748504][T32753] bridge0: port 2(bridge_slave_1) entered blocking state [ 3016.757568][T32753] bridge0: port 2(bridge_slave_1) entered disabled state [ 3016.766333][T32753] bridge_slave_1: entered allmulticast mode [ 3016.776755][T32753] bridge_slave_1: entered promiscuous mode [ 3017.045609][ T12] netdevsim netdevsim5 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3017.175660][ T320] fuse: Unknown parameter 'grou00000000000000000000' [ 3018.591264][T30217] Bluetooth: hci4: command tx timeout [ 3019.076367][ T12] netdevsim netdevsim5 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3019.148211][T32753] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3019.277193][ T12] netdevsim netdevsim5 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3019.398089][T32753] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3019.745318][ T334] syzkaller0: entered promiscuous mode [ 3019.751760][ T334] syzkaller0: entered allmulticast mode [ 3019.776139][T32753] team0: Port device team_slave_0 added [ 3019.911442][T32753] team0: Port device team_slave_1 added [ 3020.063798][ T12] bridge_slave_1: left allmulticast mode [ 3020.070248][ T12] bridge_slave_1: left promiscuous mode [ 3020.078162][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 3020.197143][ T12] bridge_slave_0: left allmulticast mode [ 3020.203985][ T12] bridge_slave_0: left promiscuous mode [ 3020.215534][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 3027.820770][T30217] Bluetooth: hci4: command tx timeout [ 3030.340186][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3030.431525][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3030.452647][ T12] bond0 (unregistering): Released all slaves [ 3030.689139][T21594] Bluetooth: hci1: unexpected cc 0x0c03 length: 249 > 1 [ 3030.713005][T21594] Bluetooth: hci1: unexpected cc 0x1003 length: 249 > 9 [ 3030.730269][T21594] Bluetooth: hci1: unexpected cc 0x1001 length: 249 > 9 [ 3030.765874][T21594] Bluetooth: hci1: unexpected cc 0x0c23 length: 249 > 4 [ 3030.786526][T21594] Bluetooth: hci1: unexpected cc 0x0c38 length: 249 > 2 [ 3030.855690][T32753] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3030.867147][T32753] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3030.906198][T32753] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3031.261120][ T12] hsr_slave_0: left promiscuous mode [ 3031.282010][ T12] hsr_slave_1: left promiscuous mode [ 3031.295014][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3031.303532][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3031.366722][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3031.379296][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3031.479034][ T12] veth1_macvtap: left promiscuous mode [ 3031.487704][ T12] veth0_macvtap: left promiscuous mode [ 3031.499669][ T12] veth1_vlan: left promiscuous mode [ 3031.505873][ T12] veth0_vlan: left promiscuous mode [ 3032.249768][ T12] team0 (unregistering): Port device team_slave_1 removed [ 3032.352081][ T12] team0 (unregistering): Port device team_slave_0 removed [ 3032.555924][T32753] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3032.565000][T32753] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3032.596550][T32753] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3032.901042][T21594] Bluetooth: hci1: command tx timeout [ 3033.202733][ T369] netlink: 12 bytes leftover after parsing attributes in process `syz.6.9347'. [ 3034.101358][T32753] hsr_slave_0: entered promiscuous mode [ 3034.112416][T32753] hsr_slave_1: entered promiscuous mode [ 3034.121999][T32753] debugfs: 'hsr0' already exists in 'hsr' [ 3034.128464][T32753] Cannot create hsr debugfs directory [ 3034.810176][ T12] netdevsim netdevsim9 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3034.982041][T21594] Bluetooth: hci1: command tx timeout [ 3035.046186][ T12] netdevsim netdevsim9 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3035.226731][ T12] netdevsim netdevsim9 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3035.432869][ T12] netdevsim netdevsim9 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3035.510807][ T353] chnl_net:caif_netlink_parms(): no params data found [ 3035.984135][ T388] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9354'. [ 3036.218843][ T12] bridge_slave_1: left allmulticast mode [ 3036.227396][ T12] bridge_slave_1: left promiscuous mode [ 3036.238099][ T12] bridge0: port 2(bridge_slave_1) entered disabled state [ 3036.330783][ T12] bridge_slave_0: left allmulticast mode [ 3036.337190][ T12] bridge_slave_0: left promiscuous mode [ 3036.344356][ T12] bridge0: port 1(bridge_slave_0) entered disabled state [ 3037.059926][T21594] Bluetooth: hci1: command tx timeout [ 3037.686289][ T12] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3037.784199][ T12] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3037.836715][ T12] bond0 (unregistering): Released all slaves [ 3038.365192][ T398] syzkaller0: entered promiscuous mode [ 3038.371487][ T398] syzkaller0: entered allmulticast mode [ 3038.985841][ T12] hsr_slave_0: left promiscuous mode [ 3038.999765][ T12] hsr_slave_1: left promiscuous mode [ 3039.008931][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3039.017459][ T12] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3039.029836][ T12] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3039.038444][ T12] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3039.129054][ T12] veth1_macvtap: left promiscuous mode [ 3039.139478][T21594] Bluetooth: hci1: command tx timeout [ 3039.139478][ T12] veth0_macvtap: left promiscuous mode [ 3039.139772][ T12] veth1_vlan: left promiscuous mode [ 3039.161994][ T12] veth0_vlan: left promiscuous mode [ 3039.317357][ T430] netlink: 16 bytes leftover after parsing attributes in process `syz.0.9364'. [ 3040.137608][ T12] team0 (unregistering): Port device team_slave_1 removed [ 3040.171714][ T12] team0 (unregistering): Port device team_slave_0 removed [ 3041.822615][T32753] netdevsim netdevsim5 netdevsim0: renamed from eth0 [ 3041.856821][ T353] bridge0: port 1(bridge_slave_0) entered blocking state [ 3041.866842][ T353] bridge0: port 1(bridge_slave_0) entered disabled state [ 3041.875469][ T353] bridge_slave_0: entered allmulticast mode [ 3041.885697][ T353] bridge_slave_0: entered promiscuous mode [ 3041.901825][T32753] netdevsim netdevsim5 netdevsim1: renamed from eth1 [ 3041.961818][T32753] netdevsim netdevsim5 netdevsim2: renamed from eth2 [ 3041.998645][ T353] bridge0: port 2(bridge_slave_1) entered blocking state [ 3042.007068][ T353] bridge0: port 2(bridge_slave_1) entered disabled state [ 3042.016019][ T353] bridge_slave_1: entered allmulticast mode [ 3042.031069][ T353] bridge_slave_1: entered promiscuous mode [ 3042.062340][T32753] netdevsim netdevsim5 netdevsim3: renamed from eth3 [ 3042.360199][ T353] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3042.396770][ T353] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3042.692125][ T353] team0: Port device team_slave_0 added [ 3042.770260][ T353] team0: Port device team_slave_1 added [ 3043.069444][ T353] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3043.077655][ T353] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3043.106741][ T353] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3043.326045][T32753] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3043.341528][ T353] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3043.353006][ T353] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3043.386178][ T353] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3043.682651][T32753] 8021q: adding VLAN 0 to HW filter on device team0 [ 3045.432993][T32735] bridge0: port 1(bridge_slave_0) entered blocking state [ 3045.441393][T32735] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3045.534477][ T353] hsr_slave_0: entered promiscuous mode [ 3045.545391][ T353] hsr_slave_1: entered promiscuous mode [ 3045.554979][ T353] debugfs: 'hsr0' already exists in 'hsr' [ 3045.561536][ T353] Cannot create hsr debugfs directory [ 3045.635283][T32735] bridge0: port 2(bridge_slave_1) entered blocking state [ 3045.643561][T32735] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3047.935205][ T353] netdevsim netdevsim3 netdevsim0: renamed from eth0 [ 3047.991186][T32753] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3048.005612][ T353] netdevsim netdevsim3 netdevsim1: renamed from eth1 [ 3048.065960][ T353] netdevsim netdevsim3 netdevsim2: renamed from eth2 [ 3048.169099][ T353] netdevsim netdevsim3 netdevsim3: renamed from eth3 [ 3049.049463][ T353] 8021q: adding VLAN 0 to HW filter on device bond0 [ 3049.185461][ T353] 8021q: adding VLAN 0 to HW filter on device team0 [ 3049.269329][T13841] bridge0: port 1(bridge_slave_0) entered blocking state [ 3049.277794][T13841] bridge0: port 1(bridge_slave_0) entered forwarding state [ 3049.390343][T13841] bridge0: port 2(bridge_slave_1) entered blocking state [ 3049.398624][T13841] bridge0: port 2(bridge_slave_1) entered forwarding state [ 3052.066025][T32753] veth0_vlan: entered promiscuous mode [ 3052.178609][T32753] veth1_vlan: entered promiscuous mode [ 3052.598940][T32753] veth0_macvtap: entered promiscuous mode [ 3052.675284][T32753] veth1_macvtap: entered promiscuous mode [ 3052.795974][T32753] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3052.942309][T32753] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3053.107319][ T1151] netdevsim netdevsim5 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3053.165825][ T1151] netdevsim netdevsim5 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3053.209188][ T353] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 3053.258756][ T1151] netdevsim netdevsim5 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3053.315154][ T1151] netdevsim netdevsim5 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3053.472415][ T540] 9pnet_virtio: no channels available for device syz [ 3053.489063][ T540] overlayfs: overlapping lowerdir path [ 3054.363857][ T353] veth0_vlan: entered promiscuous mode [ 3054.536141][ T353] veth1_vlan: entered promiscuous mode [ 3055.091930][ T353] veth0_macvtap: entered promiscuous mode [ 3055.192783][ T353] veth1_macvtap: entered promiscuous mode [ 3056.731614][ T353] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 3056.780313][ T353] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 3056.853614][ T4196] netdevsim netdevsim3 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 3056.864233][ T4196] netdevsim netdevsim3 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 3056.894351][ T4196] netdevsim netdevsim3 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 3056.951288][ T4196] netdevsim netdevsim3 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 3058.585774][ T561] fuse: Bad value for 'fd' [ 3066.246550][ T627] NILFS (nullb0): couldn't find nilfs on the device [ 3069.031116][ T4101] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3069.040009][ T4101] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3069.143078][ T4101] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3069.152160][ T4101] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3069.612894][T16633] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3069.622020][T16633] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3069.810938][ T3838] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 3069.819956][ T3838] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 3072.954455][ T663] netlink: 4 bytes leftover after parsing attributes in process `syz.6.9425'. [ 3074.011371][ T663] bridge_slave_1: left allmulticast mode [ 3074.017767][ T663] bridge_slave_1: left promiscuous mode [ 3074.024697][ T663] bridge0: port 2(bridge_slave_1) entered disabled state [ 3074.426791][ T663] bridge_slave_0: left allmulticast mode [ 3074.437244][ T663] bridge_slave_0: left promiscuous mode [ 3074.444244][ T663] bridge0: port 1(bridge_slave_0) entered disabled state [ 3077.030948][ T679] md: async del_gendisk mode will be removed in future, please upgrade to mdadm-4.5+ [ 3077.046535][ T679] block device autoloading is deprecated and will be removed. [ 3077.500844][T30168] usb 4-1: new high-speed USB device number 3 using dummy_hcd [ 3077.660838][T30168] usb 4-1: device descriptor read/64, error -71 [ 3077.661366][T25600] usb 1-1: new full-speed USB device number 54 using dummy_hcd [ 3078.354629][T25600] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 3078.367284][T25600] usb 1-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3078.379971][T25600] usb 1-1: config 0 interface 0 has no altsetting 0 [ 3078.388340][T25600] usb 1-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 3078.402781][T25600] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3078.539214][T25600] usb 1-1: config 0 descriptor?? [ 3078.871480][T30168] usb 4-1: new high-speed USB device number 4 using dummy_hcd [ 3079.020675][T30168] usb 4-1: device descriptor read/64, error -71 [ 3079.166187][T30168] usb usb4-port1: attempt power cycle [ 3079.196745][T25600] lenovo 0003:17EF:60EE.0048: unknown main item tag 0x0 [ 3079.205959][T25600] lenovo 0003:17EF:60EE.0048: unknown main item tag 0x0 [ 3079.222415][T25600] lenovo 0003:17EF:60EE.0048: unknown main item tag 0x0 [ 3079.230352][T25600] lenovo 0003:17EF:60EE.0048: unknown main item tag 0x0 [ 3079.239180][T25600] lenovo 0003:17EF:60EE.0048: unknown main item tag 0x0 [ 3079.431253][T25600] lenovo 0003:17EF:60EE.0048: hidraw0: USB HID v0.01 Device [HID 17ef:60ee] on usb-dummy_hcd.0-1/input0 [ 3079.481539][T25600] lenovo 0003:17EF:60EE.0048: Failed to switch middle button: -71 [ 3079.539249][T25600] lenovo 0003:17EF:60EE.0048: Fn-lock setting failed: -71 [ 3079.556977][T30168] usb 4-1: new high-speed USB device number 5 using dummy_hcd [ 3079.583712][T25600] lenovo 0003:17EF:60EE.0048: Sensitivity setting failed: -71 [ 3079.612559][T30168] usb 4-1: device descriptor read/8, error -71 [ 3079.678764][T25600] usb 1-1: USB disconnect, device number 54 [ 3079.890167][T30168] usb 4-1: new high-speed USB device number 6 using dummy_hcd [ 3079.951573][T30168] usb 4-1: device descriptor read/8, error -71 [ 3080.061595][T30168] usb usb4-port1: unable to enumerate USB device [ 3088.523620][T30217] Bluetooth: hci3: unexpected cc 0x0c03 length: 249 > 1 [ 3088.554850][T30217] Bluetooth: hci3: unexpected cc 0x1003 length: 249 > 9 [ 3088.572880][T30217] Bluetooth: hci3: unexpected cc 0x1001 length: 249 > 9 [ 3088.587766][T30217] Bluetooth: hci3: unexpected cc 0x0c23 length: 249 > 4 [ 3088.618790][T30217] Bluetooth: hci3: unexpected cc 0x0c38 length: 249 > 2 [ 3089.560788][T30168] usb 5-1: new high-speed USB device number 57 using dummy_hcd [ 3089.848198][T30168] usb 5-1: Using ep0 maxpacket: 16 [ 3090.774600][T21594] Bluetooth: hci3: command tx timeout [ 3090.851218][T30168] usb 5-1: config 0 has an invalid interface number: 1 but max is 0 [ 3090.860319][T30168] usb 5-1: config 0 has no interface number 0 [ 3090.882349][T30168] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3090.901434][T30168] usb 5-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3090.915580][T30168] usb 5-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 3090.926334][T30168] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3091.224442][T30168] usb 5-1: config 0 descriptor?? [ 3092.693913][T30168] usbhid 5-1:0.1: can't add hid device: -71 [ 3092.701185][T30168] usbhid 5-1:0.1: probe with driver usbhid failed with error -71 [ 3092.746754][ T749] chnl_net:caif_netlink_parms(): no params data found [ 3092.820689][T30168] usb 5-1: USB disconnect, device number 57 [ 3092.890927][T21594] Bluetooth: hci3: command tx timeout [ 3094.872326][T20195] usb 1-1: new full-speed USB device number 55 using dummy_hcd [ 3095.216952][T20195] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 3095.229444][T20195] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3095.240370][T20195] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3095.255003][T20195] usb 1-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3095.265171][T20195] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3095.360190][T20195] usb 1-1: config 0 descriptor?? [ 3095.850906][T30217] Bluetooth: hci3: command tx timeout [ 3095.866221][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.875816][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.891656][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.905469][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.914923][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.923595][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.932308][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.941006][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.949540][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3095.958312][T20195] hid-multitouch 0003:0457:07DA.0049: unknown main item tag 0x0 [ 3096.057364][T20195] hid-multitouch 0003:0457:07DA.0049: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.0-1/input0 [ 3096.151033][T20195] usb 1-1: USB disconnect, device number 55 [ 3096.622216][ T749] bridge0: port 1(bridge_slave_0) entered blocking state [ 3096.630553][ T749] bridge0: port 1(bridge_slave_0) entered disabled state [ 3096.639250][ T749] bridge_slave_0: entered allmulticast mode [ 3096.649930][ T749] bridge_slave_0: entered promiscuous mode [ 3096.742814][ T749] bridge0: port 2(bridge_slave_1) entered blocking state [ 3096.752026][ T749] bridge0: port 2(bridge_slave_1) entered disabled state [ 3096.760717][ T749] bridge_slave_1: entered allmulticast mode [ 3096.770173][ T749] bridge_slave_1: entered promiscuous mode [ 3097.271214][ T796] netlink: 4 bytes leftover after parsing attributes in process `syz.5.9473'. [ 3097.306728][ T749] bond0: (slave bond_slave_0): Enslaving as an active interface with an up link [ 3097.490235][ T749] bond0: (slave bond_slave_1): Enslaving as an active interface with an up link [ 3097.810802][T25600] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 3097.876607][ T749] team0: Port device team_slave_0 added [ 3097.919761][ T749] team0: Port device team_slave_1 added [ 3097.932992][T30217] Bluetooth: hci3: command tx timeout [ 3098.070686][T25600] usb 1-1: Using ep0 maxpacket: 16 [ 3098.161257][T25600] usb 1-1: config 0 has an invalid interface number: 1 but max is 0 [ 3098.170801][T25600] usb 1-1: config 0 has no interface number 0 [ 3098.177677][T25600] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 3098.190001][T25600] usb 1-1: config 0 interface 1 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3098.201127][T25600] usb 1-1: New USB device found, idVendor=04d9, idProduct=a081, bcdDevice= 0.00 [ 3098.211360][T25600] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3099.241887][ T749] batman_adv: batadv0: Adding interface: batadv_slave_0 [ 3099.250184][ T749] batman_adv: batadv0: The MTU of interface batadv_slave_0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3099.285802][ T749] batman_adv: batadv0: Not using interface batadv_slave_0 (retrying later): interface not active [ 3099.488969][ T749] batman_adv: batadv0: Adding interface: batadv_slave_1 [ 3099.496952][ T749] batman_adv: batadv0: The MTU of interface batadv_slave_1 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1532 would solve the problem. [ 3099.525775][ T749] batman_adv: batadv0: Not using interface batadv_slave_1 (retrying later): interface not active [ 3099.609537][T25600] usb 1-1: config 0 descriptor?? [ 3100.150869][T32735] netdevsim netdevsim6 netdevsim3 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3100.215786][T25600] holtek_mouse 0003:04D9:A081.004A: hidraw0: USB HID v0.00 Device [HID 04d9:a081] on usb-dummy_hcd.0-1/input1 [ 3100.226349][ T749] hsr_slave_0: entered promiscuous mode [ 3100.238862][ T749] hsr_slave_1: entered promiscuous mode [ 3100.247809][ T749] debugfs: 'hsr0' already exists in 'hsr' [ 3100.254486][ T749] Cannot create hsr debugfs directory [ 3100.378853][T32735] netdevsim netdevsim6 netdevsim2 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3100.589774][T32735] netdevsim netdevsim6 netdevsim1 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3100.620534][T25600] usb 1-1: USB disconnect, device number 56 [ 3100.971455][T32735] netdevsim netdevsim6 netdevsim0 (unregistering): unset [1, 0] type 2 family 0 port 6081 - 0 [ 3101.862493][T32735] bond0 (unregistering): (slave bond_slave_0): Releasing backup interface [ 3101.948395][T32735] bond0 (unregistering): (slave bond_slave_1): Releasing backup interface [ 3102.006631][T32735] bond0 (unregistering): Released all slaves [ 3106.584776][T32735] hsr_slave_0: left promiscuous mode [ 3106.610716][T32735] hsr_slave_1: left promiscuous mode [ 3106.619380][T32735] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 3106.628019][T32735] batman_adv: batadv0: Removing interface: batadv_slave_0 [ 3106.705977][T32735] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 3106.717068][T32735] batman_adv: batadv0: Removing interface: batadv_slave_1 [ 3106.844567][T32735] veth1_macvtap: left promiscuous mode [ 3106.851134][T32735] veth0_macvtap: left promiscuous mode [ 3106.861077][T32735] veth1_vlan: left promiscuous mode [ 3106.867120][T32735] veth0_vlan: left promiscuous mode [ 3106.950851][T25600] usb 4-1: new full-speed USB device number 7 using dummy_hcd [ 3107.332768][T30168] usb 1-1: new full-speed USB device number 57 using dummy_hcd [ 3107.417832][T25600] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 3107.430529][T25600] usb 4-1: config 0 interface 0 altsetting 9 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3107.441607][T25600] usb 4-1: config 0 interface 0 has no altsetting 0 [ 3107.449114][T25600] usb 4-1: New USB device found, idVendor=17ef, idProduct=60ee, bcdDevice= 0.00 [ 3107.462389][T25600] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3107.540324][T25600] usb 4-1: config 0 descriptor?? [ 3107.568298][T30168] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 3107.583604][T30168] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 3107.595668][T30168] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 3107.610901][T30168] usb 1-1: New USB device found, idVendor=0457, idProduct=07da, bcdDevice= 0.00 [ 3107.621231][T30168] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3107.832829][T30168] usb 1-1: config 0 descriptor?? [ 3108.008599][T32735] team0 (unregistering): Port device team_slave_1 removed [ 3108.091791][T32735] team0 (unregistering): Port device team_slave_0 removed [ 3108.100275][T25600] usbhid 4-1:0.0: can't add hid device: -71 [ 3108.107732][T25600] usbhid 4-1:0.0: probe with driver usbhid failed with error -71 [ 3108.201253][T25600] usb 4-1: USB disconnect, device number 7 [ 3108.399485][T30168] hid_parser_main: 13 callbacks suppressed [ 3108.399591][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.415654][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.424560][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.435582][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.446167][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.455473][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.464237][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.473002][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.489343][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.504777][T30168] hid-multitouch 0003:0457:07DA.004B: unknown main item tag 0x0 [ 3108.710372][T30168] hid-multitouch 0003:0457:07DA.004B: hidraw0: USB HID v0.00 Device [HID 0457:07da] on usb-dummy_hcd.0-1/input0 [ 3108.757804][T30168] usb 1-1: USB disconnect, device number 57 [ 3109.538131][T30168] usb 4-1: new high-speed USB device number 8 using dummy_hcd [ 3109.567134][ T749] netdevsim netdevsim7 netdevsim0: renamed from eth0 [ 3109.632810][ T749] netdevsim netdevsim7 netdevsim1: renamed from eth1 [ 3109.693607][ T749] netdevsim netdevsim7 netdevsim2: renamed from eth2 [ 3109.730082][T30168] usb 4-1: Using ep0 maxpacket: 32 [ 3109.765769][T30168] usb 4-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 3109.777162][T30168] usb 4-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 3109.794775][ T749] netdevsim netdevsim7 netdevsim3: renamed from eth3 [ 3109.850072][T30168] usb 4-1: config 0 descriptor?? [ 3110.095305][T30168] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 3110.138764][T30168] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 3110.198011][T30168] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 3110.207801][T30168] usb 4-1: media controller created [ 3110.269791][T30168] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 3110.743201][ T852] ===================================================== [ 3110.753230][ T852] BUG: KMSAN: kernel-infoleak in _copy_to_user+0xcc/0x120 [ 3110.761855][ T852] _copy_to_user+0xcc/0x120 [ 3110.766992][ T852] i2cdev_ioctl_smbus+0x586/0x660 [ 3110.772886][ T852] i2cdev_ioctl+0xa14/0xf40 [ 3110.778048][ T852] __se_sys_ioctl+0x23c/0x400 [ 3110.783401][ T852] __x64_sys_ioctl+0x97/0xe0 [ 3110.788623][ T852] x64_sys_call+0x18a7/0x3e70 [ 3110.794094][ T852] do_syscall_64+0xd3/0xf80 [ 3110.799292][ T852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3110.806180][ T852] [ 3110.808871][ T852] Uninit was stored to memory at: [ 3110.815332][ T852] __i2c_smbus_xfer+0x24ce/0x2eb0 [ 3110.821282][ T852] i2c_smbus_xfer+0x2cd/0x460 [ 3110.826696][ T852] i2cdev_ioctl_smbus+0x4a1/0x660 [ 3110.837939][ T852] i2cdev_ioctl+0xa14/0xf40 SYZFAIL: failed to recv rpc fd=3 want=4 recv=0 n=0 (errno 9: Bad file descriptor) [ 3110.844774][ T852] __se_sys_ioctl+0x23c/0x400 [ 3110.853224][ T852] __x64_sys_ioctl+0x97/0xe0 [ 3110.858437][ T852] x64_sys_call+0x18a7/0x3e70 [ 3110.868513][ T852] do_syscall_64+0xd3/0xf80 [ 3110.873846][ T852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3110.880593][ T852] [ 3110.883232][ T852] Local variable msgbuf1.i created at: [ 3110.889331][ T852] __i2c_smbus_xfer+0x830/0x2eb0 [ 3110.897196][ T852] i2c_smbus_xfer+0x2cd/0x460 [ 3110.903774][ T852] [ 3110.906401][ T852] Byte 0 of 1 is uninitialized [ 3110.911771][ T852] Memory access of size 1 starts at ffff88804db57d06 [ 3110.919185][ T852] Data copied to user address 0000200000000040 [ 3110.926195][ T852] [ 3110.928894][ T852] CPU: 0 UID: 0 PID: 852 Comm: syz.3.9488 Tainted: G L syzkaller #0 PREEMPT(none) [ 3110.943440][ T852] Tainted: [L]=SOFTLOCKUP [ 3110.948237][ T852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3110.963562][ T852] ===================================================== [ 3110.973299][ T852] Disabling lock debugging due to kernel taint [ 3110.980311][ T852] Kernel panic - not syncing: kmsan.panic set ... [ 3110.987484][ T852] CPU: 0 UID: 0 PID: 852 Comm: syz.3.9488 Tainted: G B L syzkaller #0 PREEMPT(none) [ 3110.999485][ T852] Tainted: [B]=BAD_PAGE, [L]=SOFTLOCKUP [ 3111.005647][ T852] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 10/25/2025 [ 3111.016809][ T852] Call Trace: [ 3111.020465][ T852] [ 3111.023725][ T852] __dump_stack+0x26/0x30 [ 3111.028624][ T852] dump_stack_lvl+0x50/0x1c0 [ 3111.033761][ T852] ? dump_stack+0x12/0x25 [ 3111.038692][ T852] dump_stack+0x1e/0x25 [ 3111.043403][ T852] vpanic+0x435/0xd30 [ 3111.047874][ T852] panic+0x15d/0x160 [ 3111.052269][ T852] kmsan_report+0x31c/0x320 [ 3111.057333][ T852] ? kmsan_internal_check_memory+0x1e1/0x230 [ 3111.064093][ T852] ? kmsan_copy_to_user+0xf1/0x190 [ 3111.069808][ T852] ? _copy_to_user+0xcc/0x120 [ 3111.075028][ T852] ? i2cdev_ioctl_smbus+0x586/0x660 [ 3111.080853][ T852] ? i2cdev_ioctl+0xa14/0xf40 [ 3111.086147][ T852] ? __se_sys_ioctl+0x23c/0x400 [ 3111.091555][ T852] ? __x64_sys_ioctl+0x97/0xe0 [ 3111.096862][ T852] ? x64_sys_call+0x18a7/0x3e70 [ 3111.102286][ T852] ? do_syscall_64+0xd3/0xf80 [ 3111.107517][ T852] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3111.114262][ T852] ? kmsan_get_metadata+0xfb/0x160 [ 3111.119988][ T852] ? __pfx_az6027_i2c_xfer+0x10/0x10 [ 3111.125899][ T852] ? __i2c_transfer+0x1179/0x3110 [ 3111.131536][ T852] ? kmsan_internal_set_shadow_origin+0x7a/0x110 [ 3111.138604][ T852] ? kmsan_get_metadata+0xfb/0x160 [ 3111.144398][ T852] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 3111.150911][ T852] ? __i2c_smbus_xfer+0x1e54/0x2eb0 [ 3111.156725][ T852] ? kmsan_get_metadata+0xfb/0x160 [ 3111.162532][ T852] ? kmsan_get_shadow_origin_ptr+0x4a/0xb0 [ 3111.169038][ T852] kmsan_internal_check_memory+0x1e1/0x230 [ 3111.175534][ T852] kmsan_copy_to_user+0xf1/0x190 [ 3111.181071][ T852] _copy_to_user+0xcc/0x120 [ 3111.186186][ T852] i2cdev_ioctl_smbus+0x586/0x660 [ 3111.191901][ T852] i2cdev_ioctl+0xa14/0xf40 [ 3111.196967][ T852] ? kmsan_get_shadow_origin_ptr+0x89/0xb0 [ 3111.203459][ T852] ? __pfx_i2cdev_ioctl+0x10/0x10 [ 3111.209098][ T852] __se_sys_ioctl+0x23c/0x400 [ 3111.214386][ T852] __x64_sys_ioctl+0x97/0xe0 [ 3111.219530][ T852] x64_sys_call+0x18a7/0x3e70 [ 3111.224783][ T852] do_syscall_64+0xd3/0xf80 [ 3111.229866][ T852] ? clear_bhb_loop+0x40/0x90 [ 3111.235090][ T852] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 3111.241660][ T852] RIP: 0033:0x7fad3ff8f749 [ 3111.246638][ T852] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 3111.268293][ T852] RSP: 002b:00007fad3e1f6038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 3111.277647][ T852] RAX: ffffffffffffffda RBX: 00007fad401e6090 RCX: 00007fad3ff8f749 [ 3111.286472][ T852] RDX: 0000200000000200 RSI: 0000000000000720 RDI: 0000000000000006 [ 3111.295286][ T852] RBP: 00007fad40013f91 R08: 0000000000000000 R09: 0000000000000000 [ 3111.304097][ T852] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000000 [ 3111.312912][ T852] R13: 00007fad401e6128 R14: 00007fad401e6090 R15: 00007ffede104058 [ 3111.321789][ T852] [ 3111.325577][ T852] Kernel Offset: disabled [ 3111.330374][ T852] Rebooting in 86400 seconds..