last executing test programs: 18m56.820048155s ago: executing program 0 (id=1089): sendmsg$FOU_CMD_DEL(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000280)=ANY=[], 0x1c}, 0x1, 0x0, 0x0, 0x20004800}, 0x20000000) bpf$PROG_LOAD(0x5, &(0x7f000000e000)={0x1, 0x0, 0x0, 0x0, 0xa}, 0x94) socket$nl_generic(0x10, 0x3, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) r0 = socket$netlink(0x10, 0x3, 0x0) sendmsg$nl_route(r0, 0x0, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000100)={0x4, 0x8c}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = socket$inet6(0xa, 0x3, 0x5) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x4e22, 0x0, @loopback, 0x5}, 0x1c) r2 = socket$inet6_sctp(0xa, 0x5, 0x84) r3 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r3, &(0x7f0000002000)=""/102400, 0x19000) setsockopt$IP6T_SO_SET_REPLACE(r2, 0x29, 0x40, &(0x7f0000000340)=@raw={'raw\x00', 0x8, 0x3, 0x428, 0xd0, 0xffffffff, 0xffffffff, 0xd0, 0xffffffff, 0x358, 0xffffffff, 0xffffffff, 0x358, 0xffffffff, 0x3, 0x0, {[{{@ipv6={@private0, @mcast2, [], [], 'veth0_macvtap\x00', 'dvmrp1\x00', {}, {0xff}}, 0x0, 0xa8, 0xd0}, @common=@unspec=@NFQUEUE0={0x28}}, {{@ipv6={@remote, @ipv4={'\x00', '\xff\xff', @dev}, [], [], 'wg1\x00', 'gre0\x00'}, 0x0, 0x258, 0x288, 0x0, {}, [@common=@inet=@hashlimit1={{0x58}, {'pim6reg\x00', {0x0, 0x0, 0x5, 0x0, 0x10, 0x7, 0x3ff}}}, @common=@inet=@hashlimit3={{0x158}, {'wg1\x00', {0x3, 0x0, 0x41, 0x0, 0x0, 0x1000, 0x6, 0x3}}}]}, @common=@unspec=@CONNMARK={0x30}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28, '\x00', 0x7}}}}, 0x488) sendmmsg$inet6(r1, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4000000) 18m55.794464338s ago: executing program 0 (id=1091): r0 = socket$nl_rdma(0x10, 0x3, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x33, 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x200) r2 = socket(0x28, 0x5, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DISCONNECT(r1, 0xab08) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000380)='hugetlb.2MB.rsvd.failcnt\x00', 0x2, 0x0) setrlimit(0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) r5 = eventfd(0xc) ioctl$VHOST_SET_LOG_FD(r4, 0x4004af07, &(0x7f0000000240)=r5) ioctl$VHOST_SET_VRING_KICK(r4, 0x4008af20, 0x0) ioctl$VHOST_SET_VRING_ADDR(r4, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r6 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) read$msr(r6, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000040)={&(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, 0x0, 0xcccccccc}) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="2800000011146ff90000050000000000080001000000000008004b0028"], 0x28}}, 0x800) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000200000008450c0b7600000000000109022400010000000009040000ff0300000009210400000122850009058103"], 0x0) 18m51.985796449s ago: executing program 0 (id=1104): bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000000)={&(0x7f0000000500)={{0xeb9f, 0x1, 0x0, 0x18, 0x0, 0x28, 0x28, 0xa, [@struct={0x8, 0x1, 0x0, 0xf, 0x0, 0x10005, [{0x2, 0x5, 0xa}]}, @var={0x4, 0x0, 0x0, 0xe, 0x2}]}, {0x0, [0x30, 0x0, 0x0, 0xcf, 0x0, 0x0, 0x0, 0x2e]}}, &(0x7f00000001c0)=""/257, 0x4a, 0x101, 0x6}, 0x28) syz_usb_connect(0x0, 0x3d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320800980070705ab0b"], 0x0) (async) syz_usb_connect(0x0, 0x3d, &(0x7f00000000c0)=ANY=[@ANYBLOB="12010000bdce4208110f80106afc0000000109022b00010000000009043700022ee5cd0009058010ff037f790209050e0320800980070705ab0b"], 0x0) r0 = memfd_create(&(0x7f00000002c0)='\x103q}2\x9a\xce\xaf\x03\x86\xe7\xc0\x14\x8f^\xd5\xfd\xa9\r\xac7A\x94\xeb\xcd\t\x00\x90k\xd6\x05\r\x84\x87\x1c\b\x8c`\xea\x13A\x90m\xb6&\xd0\x9daA\xc5\xb8_\xd4\x18,\f\xd4s\xb2\x99/\xc0\x9a\xf2_\xdb\xc0\x8b\x19\x17\xb7Rvd\xcb:\b\xeeC0\xa3\xa6\xcf\x00\x00\xac\xc5h&+\t\x98\'\xfd|\x11\x99\xa2*6{\xd2C>2\x0e\"\xbc\xda\xee\xb0\xd8\xbf\xaf)\xf58c\x189K\x82\xd1(\xceY*\xcb\x9b\xbdn\x8e\x98m\x10L\xec\xfdWF\x7fj\x19\xb8<\xd2\x9d\xf0\xe9Qy\xe32\xed\x16f\xfe&\x1a\xdb\xeb\xad\xaaE\b\xa9\xf8\xa9s\xc4d\xd4\x03\xf1\xb7xO\x99\x804m[Ai\x13\x02\xf0\x84c2s\xd5P\t`\x9b\x12&\x8cx\x8eg\x9d\xe6g', 0x0) mmap(&(0x7f0000200000/0x400000)=nil, 0x400000, 0x1000000, 0x2012, r0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r1 = syz_usb_connect(0x0, 0x24, &(0x7f0000000000)={{0x12, 0x1, 0x0, 0xe7, 0xcc, 0x61, 0x20, 0x10c4, 0x818a, 0x7d8f, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x12, 0x1, 0x0, 0x0, 0xc0, 0x5, [{{0x9, 0x4, 0x23, 0x0, 0x0, 0x3}}]}}]}}, 0x0) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000bc0)={0x0, 0x15, 0x3, "c39242"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) (async) syz_usb_control_io$cdc_ncm(r1, 0x0, &(0x7f0000000dc0)={0x44, &(0x7f0000000bc0)={0x0, 0x15, 0x3, "c39242"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000002a82, 0x0) r2 = syz_io_uring_setup(0x416e, &(0x7f0000000780)={0x0, 0xfffffffd, 0x10100, 0x200, 0x11a}, &(0x7f0000000100)=0x0, &(0x7f00000000c0)=0x0) syz_io_uring_submit(r3, r4, &(0x7f0000000180)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, &(0x7f00000004c0)=[{&(0x7f0000000000)=""/4, 0x4}], 0x27}) bpf$MAP_CREATE(0x0, &(0x7f0000000640)=@base={0x16, 0x0, 0x4, 0x1, 0x0, 0x1, 0x1}, 0x50) io_uring_enter(r2, 0x567, 0x1000a387, 0x0, 0x0, 0x0) userfaultfd(0x80001) (async) r5 = userfaultfd(0x80001) ioctl$UFFDIO_API(r5, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_REGISTER(r5, 0xc020aa00, &(0x7f0000000080)={{&(0x7f00000e2000/0xc00000)=nil, 0xc00000}, 0x1}) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00004bd000/0x3000)=nil, 0x3000}}) (async) ioctl$UFFDIO_ZEROPAGE(r5, 0xc020aa04, &(0x7f0000000000)={{&(0x7f00004bd000/0x3000)=nil, 0x3000}}) syz_open_procfs$pagemap(0x0, &(0x7f00000003c0)) (async) r6 = syz_open_procfs$pagemap(0x0, &(0x7f00000003c0)) ioctl$PAGEMAP_SCAN(r6, 0xc0606610, &(0x7f0000000440)={0x60, 0x0, &(0x7f000027d000/0x1000)=nil, &(0x7f0000ffa000/0x3000)=nil, 0xfa0, &(0x7f0000000400), 0x0, 0xfffffffffffffff7, 0xb0, 0x50, 0x2, 0x18}) socket$nl_route(0x10, 0x3, 0x0) (async) r7 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r7, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000040)=ANY=[@ANYBLOB="3000000018000900000005000000d03d6ee94200fe00000100000000040012000000f1b9a81697008d68a0328c49d2eeac786b7163f69379dd97ac5854d75998ff272dfb7ded2a89a8f4"], 0x30}}, 0x0) socket$inet_mptcp(0x2, 0x1, 0x106) (async) socket$inet_mptcp(0x2, 0x1, 0x106) 18m51.772744684s ago: executing program 0 (id=1106): r0 = openat$kvm(0x0, &(0x7f00000004c0), 0x2182, 0x0) ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x11, 0x12, &(0x7f0000000080)=ANY=[@ANYBLOB="18080000d0ff000002000000000061fdf801be700400001531000006", @ANYRES32, @ANYBLOB="00000000000000006608000000000000180000000000000000000000000000019500000000000000180100002020782500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000008000000b50a00000000000085000000940000009500000000000000"], &(0x7f0000000000)='GPL\x00', 0x2, 0x0, 0x0, 0x0, 0x8}, 0x94) syz_open_dev$video4linux(&(0x7f0000000080), 0x5d7, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x161) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000300)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) r2 = socket$netlink(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000080)={'bridge_slave_0\x00', 0x0}) sendmsg$nl_route(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f0000000200)=ANY=[@ANYBLOB="300000001d000100000000000000000007000000", @ANYRES32=r3, @ANYBLOB="000000000a0002000080c200000000000700"], 0x30}, 0x1, 0x0, 0x0, 0x44040}, 0x0) mount$bind(&(0x7f00000000c0)='.\x00', 0x0, 0x0, 0x80700a, 0x0) umount2(&(0x7f00000001c0)='./file0/file0/file0\x00', 0x2) socket$nl_netfilter(0x10, 0x3, 0xc) r4 = bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0xb, 0x7, 0x10001, 0x9, 0x1}, 0x48) prlimit64(0x0, 0xe, &(0x7f00000007c0)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000300), 0x0, 0x0) r5 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) writev(r5, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) r6 = socket$l2tp6(0xa, 0x2, 0x73) bind$l2tp6(r6, &(0x7f0000000000)={0xa, 0x0, 0x3, @empty, 0x0, 0x3}, 0x20) r7 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r7, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000480)=ANY=[@ANYBLOB="fc0000001900674c0000000000000000e0000001000000000000000000000000e000000200000000000000000000000000000000000000000a00000000000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB="000000000000000000000000000040000000000000000000000000000000000000000000000000000100000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0xfc}}, 0x0) connect$l2tp6(r6, &(0x7f0000000f40)={0xa, 0x0, 0x0, @empty}, 0x20) sendmmsg$inet6(r6, &(0x7f0000000ac0)=[{{&(0x7f0000000180)={0xa, 0x0, 0x0, @empty}, 0x1b, 0x0}}], 0x17fd147c801ae9af, 0xff00) bpf$PROG_LOAD(0x5, &(0x7f0000000540)={0x11, 0xd, &(0x7f0000000680)=ANY=[@ANYBLOB="18000d0000000000000000000000000018110000f79f54bb9dee849f41ad49f667fc85fafc317f7a2824c368e5348cf83aa2643b1e757d96f1253eb947dd3c419fe824e812970fb2f5511fae229850c3e207b44cba173891a7cce94dd5f832c900020000000000008febc08c94a6bedd20c825b4f8bd07000000000000901e1561bb940ef547a06126fcf9d85f9fdfc8e9f284766356e87447a1c508cf33c84e59f803eff677b006aae390b91bf03b", @ANYRES32=r4, @ANYBLOB="0000000000000000b7080000080000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000010000008500000003000000850000000e000000950000000000"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) 18m49.84091881s ago: executing program 0 (id=1111): prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) r1 = fsopen(&(0x7f0000000100)='configfs\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r1, 0x6, 0x0, 0x0, 0x0) r2 = fsmount(r1, 0x0, 0xd) fchdir(r2) open$dir(0x0, 0x0, 0x0) 18m48.981037386s ago: executing program 0 (id=1116): bpf$OBJ_GET_PROG(0x7, 0x0, 0xfffffffffffffd87) syz_emit_vhci(&(0x7f0000000800)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0x0, 0x80b}}}, 0x7) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a34000000140a0703000000000000000002000009080003400000000a0900010073797a30000000000c0006"], 0x70}}, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000004c40)=0x5e, 0x12) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x8, 0x12) 18m48.598809376s ago: executing program 32 (id=1116): bpf$OBJ_GET_PROG(0x7, 0x0, 0xfffffffffffffd87) syz_emit_vhci(&(0x7f0000000800)=@HCI_EVENT_PKT={0x4, @hci_ev_cmd_status={{0xf, 0x4}, {0x1, 0x0, 0x80b}}}, 0x7) ioctl$sock_SIOCGIFVLAN_GET_VLAN_VID_CMD(0xffffffffffffffff, 0x8982, 0x0) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000000c0)=ANY=[@ANYBLOB="140000001000010600000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff1b000000020000000900010073797a30000001000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000240)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000280)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a3c000000120a01020000000000100000020000000900020073797a310000000008000440000000000900010073797a3000000000080003400000000a14000000110001"], 0x64}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000000680)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a34000000140a0703000000000000000002000009080003400000000a0900010073797a30000000000c0006"], 0x70}}, 0x0) write$cgroup_int(0xffffffffffffffff, &(0x7f0000004c40)=0x5e, 0x12) r1 = openat$vcsa(0xffffffffffffff9c, &(0x7f0000000000), 0x202000, 0x0) write$cgroup_int(r1, &(0x7f0000000040)=0x8, 0x12) 18m33.232170884s ago: executing program 5 (id=1155): openat$binderfs(0xffffffffffffff9c, &(0x7f0000000000)='./binderfs/binder1\x00', 0x2, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = socket$can_j1939(0x1d, 0x2, 0x7) ioctl$ifreq_SIOCGIFINDEX_vcan(r2, 0x8933, &(0x7f0000000040)={'vxcan1\x00', 0x0}) bind$can_j1939(r2, &(0x7f0000000000)={0x1d, r3}, 0x18) setsockopt$inet_sctp6_SCTP_PEER_ADDR_PARAMS(0xffffffffffffffff, 0x84, 0x9, &(0x7f00000000c0)={0x0, @in={{0x2, 0x1000, @empty}}, 0x7fff, 0x0, 0xd78e, 0x0, 0x5a1, 0x0, 0x7}, 0x9c) sendmsg$can_j1939(r2, &(0x7f00000002c0)={&(0x7f00000000c0)={0x1d, 0x0, 0x0, {0x0, 0x1ee}}, 0x18, &(0x7f00000004c0)={&(0x7f0000000140)='\x00', 0x8}}, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x0, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0x7, 0xffffffff}, 0x0) fsetxattr$security_capability(0xffffffffffffffff, 0x0, 0x0, 0x0, 0x1) getsockopt$inet_pktinfo(0xffffffffffffffff, 0x0, 0x50, 0x0, &(0x7f0000000040)=0x54) socket$l2tp6(0xa, 0x2, 0x73) clock_adjtime(0x0, &(0x7f0000000100)={0x0, 0x20000000000006a, 0x55cd, 0x8, 0x400, 0x5, 0xd, 0xb446, 0x2, 0xffffffffffffffff, 0x100000000f423f, 0xfffffffffffffff9, 0x7, 0x2, 0x1000000081, 0x5, 0x0, 0xff, 0x4, 0x9220000000000000, 0x3, 0x0, 0x80000001, 0x0, 0x5, 0xc84}) write$USERIO_CMD_SEND_INTERRUPT(0xffffffffffffffff, 0x0, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000ffe000/0x2000)=nil, 0x2000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) process_mrelease(0xffffffffffffffff, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) remap_file_pages(&(0x7f0000ffd000/0x2000)=nil, 0x2000, 0x0, 0x1, 0x0) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) r4 = fsopen(&(0x7f0000000240)='jfs\x00', 0x1) fsconfig$FSCONFIG_SET_STRING(r4, 0x1, &(0x7f0000000ac0)='gid', &(0x7f0000000440)='0\x00#\x00\xd0\x00 \x00\x00qS\x00\x00\x00\x00\x00\x00\x00\x00$\xf6_\xbdI\x1c\xf2\xa9]\xcc\xe0*\xef\x01\x8d\x15\xd2h\x93\xc9\xb57\xc3\xea\\Eb\xf8\xe6,\xdf\xd4\xfae\x84\xcc\xd5\"d\xf0D-\x98\x9f\x81{\xfc$\xc4\xbcF\xf8\xc8\x8d\xcb\xb8\xf2\x1e\xe4\'U\xb3\xb8\xd3\xe6\xd7\x80Y\xc2\xeb\n\xb8_\xe8\x96YY\xe3\xc7\xe6\xf28\x19\xa6\xa7\xfa\xdb\x1ce\xc1\x03\x86J\xb2fh\x19\xee#\xcc\x0f\xed\xfea\xdc\x88\xcb%bW\xd35\xda=\xac\x1d\xae\x93\xfd\'T6\x94\n\xa4\x9cU\xc4\fA~[\xbf\x8b\x90\xfe\x04\xe7U\xf3h\x81\x14l7u\x95\x96t\\\x0f\xef;\x03\xa4C\xbc(Vc!a\xc1\xe39\xc6b\x905\xf8\xc9@h\x01\xf5\xcb\x88\xdf9\xaf5\xc8a:z\xe4\xcbag&67\x814\xf6}\xe10v6l\xd6,\x1e\xa0\xcc\xbf\xfdkm\b?\x839\x85N\x1c\xc1\xcb\xfc\x85\xd2\n\x02\"\xf2\x81g\x90\x01n%\x7f_\xe1.f>>\xa5\xfb\"\xab\xdb\x06\x12e\x14\x11~\x9a\bR-\x85\xc3\xa9\xe6\xf6R\x11\"\xc3\xc9\xfc\x14s X\xec\xdd\xc2qB\x85\xf0\xd7\x04\xdd<\x9a\x84\'\xa3\xf1\xd9<\xb9k', 0x0) 18m30.579510653s ago: executing program 5 (id=1163): r0 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x4048aecb, &(0x7f0000000080)) 18m30.41181667s ago: executing program 5 (id=1164): mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000180)={0x18, 0x5, &(0x7f0000000140)=ANY=[@ANYBLOB], &(0x7f0000000280)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) prlimit64(0x0, 0xe, &(0x7f0000000080)={0x8, 0x8b}, 0x0) r0 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r0, 0x3b81, &(0x7f00000002c0)={0xc, 0x0, 0x0}) ioctl$IOMMU_IOAS_MAP$PAGES(r0, 0x3b85, &(0x7f0000000100)={0x28, 0x7, r1, 0x0, &(0x7f0000ffc000/0x3000)=nil, 0x3000}) mincore(&(0x7f0000550000/0x1000)=nil, 0x1000, &(0x7f0000000440)=""/56) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x2, 0x4c831, 0xffffffffffffffff, 0x0) ioctl$IOMMU_TEST_OP_CREATE_ACCESS(r0, 0x3ba0, 0x0) ioctl$IOMMU_TEST_OP_ACCESS_RW(r0, 0x3ba0, &(0x7f0000000540)={0x48, 0x8, 0xffffffffffffffff, 0x0, 0x2fff, 0x0, 0x0, 0x4}) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x1) sched_getattr(0x0, 0x0, 0x0, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000200)=0x400000bce) prctl$PR_CAP_AMBIENT(0x2f, 0x2, 0x1c) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000002000)=""/102400, 0x19000) openat$tun(0xffffffffffffff9c, 0x0, 0x0, 0x0) sendmsg$IPCTNL_MSG_CT_NEW(0xffffffffffffffff, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000400)={0x6c, 0x0, 0x1, 0x401, 0x0, 0x1a14, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TUPLE_REPLY={0x24, 0x2, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8}, {0x8, 0x2, @initdev={0xac, 0x1e, 0x0, 0x0}}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}, @CTA_TIMEOUT={0x8, 0x7, 0x1, 0x0, 0x1}, @CTA_LABELS={0x8, 0x16, 0x1, 0x0, [0x4]}]}, 0x6c}}, 0x0) r3 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPCTNL_MSG_CT_NEW(r3, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000140)={0x38, 0x3, 0x1, 0x401, 0x0, 0x0, {0x2}, [@CTA_TUPLE_ORIG={0x24, 0x1, 0x0, 0x1, [@CTA_TUPLE_IP={0x14, 0x1, 0x0, 0x1, @ipv4={{0x8, 0x1, @multicast1}, {0x8, 0x2, @multicast1}}}, @CTA_TUPLE_PROTO={0xc, 0x2, 0x0, 0x1, {0x5}}]}]}, 0x38}}, 0x0) 18m29.742414076s ago: executing program 5 (id=1167): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) r0 = socket$key(0xf, 0x3, 0x2) sendmsg$key(r0, &(0x7f0000000000)={0x400000000000000, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYBLOB="020300090a0000000000000000000200030006000000000002000000ac14904900000000000000000200010000000000fd000501feffff4b03000500ff00000002"], 0x50}}, 0x50) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) syz_emit_vhci(&(0x7f0000000500)=ANY=[@ANYBLOB="043e061244"], 0x9) getresuid(0x0, 0x0, 0x0) mkdir(&(0x7f0000000100)='./file0/file0\x00', 0x105) r1 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r1, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) io_setup(0xb, &(0x7f00000001c0)) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f00000002c0)='./file0\x00', &(0x7f0000000240)='./file0\x00', 0x0, 0x2143899, 0x0) umount2(&(0x7f00000000c0)='./file0\x00', 0x1) 18m29.4760818s ago: executing program 5 (id=1169): socket$inet_udp(0x2, 0x2, 0x0) syz_emit_ethernet(0xbe, &(0x7f0000000300)=ANY=[@ANYBLOB="aaaaaaaaaaaa0180c200040008"], 0x0) r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000200)=0x7) socket$inet_mptcp(0x2, 0x1, 0x106) r1 = getpid() sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b703000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r4 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r4, &(0x7f0000000240)={0x2, 0x0, @dev={0xac, 0x14, 0x14, 0xf}}, 0x10) sendmmsg$inet(r4, &(0x7f0000001480)=[{{&(0x7f0000000100)={0x2, 0x6e20, @multicast1}, 0x10, 0x0}}], 0x1, 0x2000c044) sendto$inet(r4, &(0x7f0000000c80)="e8", 0x6200, 0x12000000, 0x0, 0x0) syz_init_net_socket$nl_generic(0x10, 0x3, 0x10) 18m28.644879742s ago: executing program 5 (id=1172): r0 = socket$nl_rdma(0x10, 0x3, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x33, 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x200) r2 = socket(0x28, 0x5, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DISCONNECT(r1, 0xab08) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000380)='hugetlb.2MB.rsvd.failcnt\x00', 0x2, 0x0) setrlimit(0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000040)={&(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, 0x0, 0xcccccccc}) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="2800000011146ff90000050000000000080001000000000008004b0028"], 0x28}}, 0x800) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000200000008450c0b7600000000000109022400010000000009040000ff0300000009210400000122850009058103"], 0x0) 18m28.17342385s ago: executing program 33 (id=1172): r0 = socket$nl_rdma(0x10, 0x3, 0x14) syz_kvm_setup_cpu$x86(0xffffffffffffffff, 0xffffffffffffffff, &(0x7f0000fde000/0x18000)=nil, &(0x7f00000002c0)=[@text64={0x40, 0x0}], 0x1, 0x33, 0x0, 0x0) r1 = syz_open_dev$ndb(&(0x7f0000000100), 0x0, 0x200) r2 = socket(0x28, 0x5, 0x0) ioctl$NBD_SET_SOCK(r1, 0xab00, r2) ioctl$NBD_DISCONNECT(r1, 0xab08) r3 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r3, 0xc01064b5, 0x0) ioctl$DRM_IOCTL_MODE_GETPLANE(r3, 0xc02064b6, 0x0) openat$cgroup_int(0xffffffffffffffff, &(0x7f0000000380)='hugetlb.2MB.rsvd.failcnt\x00', 0x2, 0x0) setrlimit(0x1, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000140)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(0xffffffffffffffff, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, 0x0, &(0x7f00000000c0)=""/87, 0x0}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) r4 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) bind$inet(0xffffffffffffffff, &(0x7f0000000340)={0x2, 0x4e21, @initdev={0xac, 0x1e, 0x1, 0x0}}, 0x10) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) ioctl$DRM_IOCTL_MODE_GET_LEASE(r3, 0xc01064c8, &(0x7f0000000280)={0x1, 0x0, &(0x7f0000000200)=[0x0]}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r3, 0xc02064b9, &(0x7f0000000040)={&(0x7f0000000300)=[0x0, 0x0, 0x0], &(0x7f0000000040), 0x3, 0x0, 0xcccccccc}) sendmsg$RDMA_NLDEV_CMD_STAT_GET(r0, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000580)=ANY=[@ANYBLOB="2800000011146ff90000050000000000080001000000000008004b0028"], 0x28}}, 0x800) syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000280)=ANY=[@ANYBLOB="1201000200000008450c0b7600000000000109022400010000000009040000ff0300000009210400000122850009058103"], 0x0) 13m52.650182819s ago: executing program 3 (id=2252): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000500)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f00000002c0)={{0x14, 0x10, 0x1, 0x0, 0x0, {0x5}}, [@NFT_MSG_DELFLOWTABLE={0x2c, 0x18, 0xa, 0x5, 0x0, 0x0, {0x2}, [@NFTA_FLOWTABLE_NAME={0x9, 0x2, 'syz0\x00'}, @NFTA_FLOWTABLE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14, 0x11, 0x1, 0x0, 0x0, {0x3}}}, 0x54}, 0x1, 0x0, 0x0, 0x24040089}, 0x20008000) (fail_nth: 8) 13m52.606971751s ago: executing program 3 (id=2253): r0 = syz_init_net_socket$bt_l2cap(0x1f, 0x5, 0x0) bind$bt_l2cap(r0, &(0x7f0000000000)={0x1f, 0x0, @any, 0x4, 0x1}, 0xe) unshare(0x20000600) r1 = socket$kcm(0x29, 0xd39d03606646ba65, 0x0) sendmsg$kcm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000000900)="5725687a32d914403d6b9bf45362efbe8e237644deb68de9bc75582b2544d8f3cea6e995f2256b4f3f979a6741c916a04d702604679783f2c7889d9dafe2a54bd6960bdade5c24b15d61496efb88a009949de3c847a5fd90f995314b38868e1470a4209866c1b01667fdb157ea7a7950a4ace4f1252e93ae74e1d67e2fa403339ce96d44c273ab4db085fddbc2f5c776125e446178e2f0202ddb147cb0e8f8facb472d252ddef02d29453d0e6e649df5305755a79d5bcb4c36075c73fe6dfedc8163da", 0xc3}, {&(0x7f0000000080)="9eb19698bf2f369fd1532b5d0e6bdc9a6b2cdc6a71c8a769e3a7283c32635d7b7646fd7418afbd5a8296aea83e611e863f6bc6b656086adef278a4e39749", 0x3e}, {&(0x7f0000000280)="257b9d848801d302f4eb460acc939101d768ec070c4bd9fa4af62bee6e829a6dcf9985cb4fcb72554d3325ccf0e022827b96ca82f0c758827006be310bc779ac8f7347be384939a4ffde9ef151292b76f0192c256245a5acba842154d0d429dca28fcd7d7fa8a16aedefba7714f1c80698493ced64662a61a1e73e410710dfa5429031f2e08208fb8ad3c279855d0719410e8b1ea4ddd1b447bd7a1e3654483db26886868bf4d4b76cc91b97", 0xac}, {&(0x7f0000000340)="f1013316c9cd03b5845014df8dc627049de6e4", 0x13}, {&(0x7f0000000380)="3a3644522592b139ab3010b36468d6a859e20f708f873e2165de12cb3233028f02c4b6e2d9f17ef2517079ab55bebfeaa23c5cbdf1b716264e71401bf703b095c7aa2a74db8e4c6ef4a0bb48e770c806eb1a6edcaaab3524", 0x58}], 0x5, &(0x7f0000000580)=ANY=[@ANYBLOB="6800000000000000010100006afcffff8cfead46ac72ff11e60b613689984b506a0144559d4cbb3a2c082018c967c9eb2893a45a3ac9528c1afdfb254619232a3d6cb35bb52078c535643bdefa65328761129917e8f9a3c381953993d84f6a3a5d000000000000002000000000000000840000000008000042a89f94d26ccb2ecfa1c22754d1000068000000000000000301000000000000f91a2c7eda49e4a14266dc52d9364799d1be1282e82810eab3fe3df92958ffe56db3487c0629fcf9d0b3f4bab311c7ba2afffc3e69e13b92d673ac577ec0396144989d205822cfd4e8b60356ff3fa646afb377fabf812a00e00000000000000000000000090000002e4e3f318d15465eb38219be77225477af02c586abd7b553b2ac935252e0a6a0ffa6bd6d9a39b81612be23641d5000c4c238857a75704605e98cc7d3fcfeffffffffffffff0a74ebb6d18fd5c8fbaca6b69a2ca5ad04af12c116984d0e42dfc3ca268f0fe8422f12adb42c15d4a063c16c52bf7f5a66cd68e8cdf530ac1ee237c41519cec95e60c92f8dbc0000000000000000edd16d43190a224b2345b4896618db672732701230c6835773d1a3c7ba3fc0d9385e6a3972178fb9f46804c51979607c70d8e288ffa5c74491730000005000000000000000120100000700000000e0929afd4343b99bac08f7c83da4b517347ac6988c4c570522695167159ced0b3dff410867c52dd2a3872f67889cc28261bec144d1b9bb60d0e3d38f00000038000000000000000100000004000000f3acb1e54718ac3e89effee3bc47b7bab64ef9e1b62dfd2278da7cf1d0ee9650538fc60000000000180000000000000016010000060000007328bbe149ff0000e0000000000000000b01000004000000cbac416d60c5a0803b501d0762d1e0347f0ae6afe4956bba937853cae5f512a4d0ba32643f9ff393fcf2deba74cca2775990e148ab207b0452f7ab1a9a8f012e4c5c6e0e9790d1059ad40d0432b5ef7e807ddcf233d8634c7989365b04f00bcf87c4407f7424141659d06cf978a2520c50fd68ddfaf6b504b132f33902df8ac157371b7851a95930fca9e6a0746407c871125b5dd35dc8e91c410df9b6323d3be4457232a0449a4cb6de54e88fd977500197ece4267057777350c0bf5be81a43b6276fa94deafc8c3f3c570141000000"], 0x350}, 0x4000000) r2 = openat$vcs(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) epoll_pwait(r2, 0x0, 0x0, 0x7, 0x0, 0x0) setsockopt$inet6_tcp_TCP_CONGESTION(r2, 0x6, 0xd, &(0x7f0000000240)='scalable\x00', 0x9) sched_setscheduler(0x0, 0x61cd34c17478a33e, &(0x7f0000000040)=0x5) r3 = socket$inet6(0xa, 0x2, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x6, &(0x7f00000003c0)={0x11, {{0x29, 0x0, 0x37000000, @mcast1, 0x3}}}, 0x88) r4 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x60301, 0x0) r5 = ioctl$KVM_CREATE_VM(r4, 0xae01, 0x0) r6 = ioctl$KVM_CREATE_VCPU(r5, 0xae41, 0x0) ioctl$KVM_SET_VCPU_EVENTS(r6, 0xc008aec1, &(0x7f00000000c0)=@arm64={0x9, 0xfc, 0xe, '\x00', 0x3}) r7 = syz_io_uring_setup(0x4ba8, &(0x7f0000000380)={0x0, 0xfde6, 0x13290, 0x0, 0x1}, &(0x7f00000022c0), &(0x7f0000000080)) syz_usb_connect(0x5, 0x24, &(0x7f0000000180)=ANY=[@ANYBLOB="12010000965d06403e131508667e010203010902120001000000000904000000ff872800b4d0d41d52e78acd22425b4433e77078368e03ca9bb523c1da1f0a8c6c522fa572a98b12ee491363a4947c6be9b91563da01db6a8247c8c4d6b6c03cdc27da85793dae7da97057fcdaf213083a3c3dd5b5ac96239d80c3315d4348028243c1a57b8c36eb8819c5ab324830923ff47e7be3c2b839eea94e71ef88c17ef6c8bf14657a6281f6db8d"], 0x0) socket$inet6(0x10, 0x3, 0x0) pselect6(0x40, &(0x7f0000000040)={0xffffffffffffffff, 0x0, 0x0, 0x8000000, 0x0, 0x85}, 0x0, 0x0, 0x0, 0x0) io_uring_register$IORING_REGISTER_RESIZE_RINGS(r7, 0x21, &(0x7f0000000000)={0x0, 0x2bf5, 0x1000, 0x2, 0xf3, 0x0, r7}, 0x1) listen(r0, 0x3) accept(r0, 0x0, 0x0) syz_emit_vhci(&(0x7f0000000540)=ANY=[@ANYBLOB="043e130100c900", @ANYBLOB=' '], 0x16) 13m48.068962317s ago: executing program 3 (id=2266): socket$nl_netfilter(0x10, 0x3, 0xc) r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="02000000040000000500000002"], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000180)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000010007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b704000000000000850000000100000095"], &(0x7f0000000000)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000300)={&(0x7f0000000040)='kmem_cache_free\x00', r1}, 0x10) socket$inet6(0xa, 0x80002, 0x88) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdir(&(0x7f00000021c0)='./file1\x00', 0x13b) mkdir(&(0x7f0000000400)='./file1\x00', 0x0) socket$nl_route(0x10, 0x3, 0x0) socket$nl_route(0x10, 0x3, 0x0) r2 = openat$cuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) read$FUSE(r2, &(0x7f00000000c0)={0x2020}, 0x2020) mq_open(&(0x7f0000001500)='#\x00', 0x40, 0x120, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000002180)={0x0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r3 = getpid() sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f00000001c0)={{0x1, 0x1, 0x18, 0xffffffffffffffff, {0x1}}, './file0\x00'}) ioctl$TUNGETFILTER(0xffffffffffffffff, 0x801054db, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) syz_io_uring_setup(0x42d7, &(0x7f0000000300)={0x0, 0x0, 0x1, 0x2, 0x0, 0x0, r6}, &(0x7f0000002100), &(0x7f0000000080)) r7 = syz_open_dev$vbi(&(0x7f0000000000), 0x0, 0x2) semctl$IPC_STAT(0x0, 0x0, 0x13, 0x0) ioctl$VIDIOC_ENUM_DV_TIMINGS(r7, 0xc0945662, &(0x7f00000003c0)={0x5, 0x0, '\x00', {0x0, @reserved}}) 13m47.12061157s ago: executing program 3 (id=2271): socket$nl_generic(0x10, 0x3, 0x10) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000340)='./file1\x00', 0x0) mkdir(&(0x7f0000000300)='./bus\x00', 0x0) memfd_create(&(0x7f00000000c0)='[\v\xdbX\xae[\x1a\xa9\xfd\xfa\xad\xd1md\xc8\x85HX\xa9%\f\x1ae\xe0\xa2\x82\x1eb;(\xb5\xe1jS\xd6\x91%||\xa0\x8ez\xadT\xc8\f\xe5\x89\xbf#2\x99\x1e\xa1`\xc3\xcf\xd3\xae\xd2\a\x11\xa9\xa5^\xff\xf5\x95\f<\x8f\xc1\x99\x89r\xe1u\x98\xc3\xf8\xd2Q#\xc6g\xa0\x85\xd6G\x85\x11X\x8d,\x02\xd45\xb8\xca\x97\x9d\xcb\x1e\x80\xd6\xd5>N&\xf8#\x80z8Z\xd2}\xf5\xe4\x9f5\x9b\x01\xf9t\xbb\x1er\x14\xdb\xd3\xcd\xfd\xbdnC\xec\x8aog\x87BR\x9d\xad\xd4FcB\xda\x95\xc3\xdd\x9d\x8f\x1a\xce\x18\x80\"j\xe1\xba\x1e\x97uX\xccv\xd6\vcz\x92A^\xbc\xdeF\xf7\xe5:\xaf\xc5~\xbcJ e\r\x88c\x9d\xb92\xb6i4zq\xb3c\x0f\xb2t\x93\xf2E6b\xfa\xcdJ5\xe3W]`4\xd8D\x05\v\xfc)\xca\xedQ\xd0]Ot\'\xc2tDF\xf9\xa7\xb5(\x83\xa5\x0f\x1d\x1d\x06Dg\x13>\x19\xe85#\aaT\x89=\x104\xd5\x85l\x96\x91\xea\x172P\xb3:\xadZ\xbc\xbe\x00\xf0\x14\x96\xd9M\xd7\x88QZs\xb2\xe1+$jfQodH\x05/y`~7\x16\x02\x00(v\xe6`\"6\xfcgC\xb5\xf0\x13.zj\xc5bj+@\x00\x00\x00\x00\x00\x00\x00.\xd4`=z\xd1n\x8d\x8f\xa5hS\x8e[\xb3\xa3\x87\xb9\xe2_Z\x11\xef\xc2\x03\x00\x00\x00\x94\xb9\xe1\xa68\x8d\x7f\xe5\xef\xacpM\xf0\xa6\x04\x10\xb7\xc0t\x83\\\xf7\x12k\x9f\x10\xd5Z\x19\xc1\xc1\x80\\o\x97\xce=U\xdd\xaa\x1b\x05\x14\x13\xa6\xbd#\xde\x04\xe6$\xec$3\xf6\x97\xc6\xeaSL\xb7#Z\x00\x00\x00\x00\x00\x00\xa3\n&\x1e\xc84\xa9\xe2\xccM\x906\x95xQ-2p\xd62\'\xec\x0f\x13;I\x95fE_\r\xe7\t!A\x05\xe4\x8f\x9eH\xf8/T\x18\xf7\xa1\x9f\xde1\xd5\x80<\xf5\b\xa9\xec\x85\xaeW\xb3\xd8#)bn \xfb\xf2\x88\xfaR\xff\xdd\x80\x96_\xec5\xf0\x1c\a\x8a\x80\x00@=\r8u+%f:\x1e\x82\xfap\xf6\x89\xea\xba\xe3\xbbM%F\xdb\\\xd1eJJ*\xc67\xca\x03\xa3\xf7(\xbb\xecN\xd4\xe7\xf2:u\x8a\b\xd5\v\xca\xfd\\\xd6\xe3\x05\xb3\x03\xd5\xe0\xd2\xf2{\'\x8b\xf3\xa1\xbe}\xb2\xe4y\xbb\xe6\x1f\x10c\xf5WQ\x82\x04\x01C\x83,\x90\x1a\xfa\x8e\x17\x89\xe2\xedX\x8d\rmq\t\xb5$\xb4\x9b\x92z\xd6/-\x13,\xb5%\x8eM/\x04\xa7\x7f\x1b\x85\xf1\xa4X\x17\xbb\x1cR14\xfb!\b\x10\xe8\xb2\xd41gK\xe4\xea\xe39d\bL\xe5\x1b\xbd[\x9bWD:\r&\xe9\vn~\xcc\x86\xe3\xce1>3{\xaa{\xbd0P\x9f\xa68\xf5\x82\xb8\x9aD\x9c{\xa6\xf8\xcbD\xb5aJ\xb0\x92\x89\xbc\x82\x1ch\x89\xe7\xdd]q,\xec\xc4\xa5\x93\xe5,\x0e,>/\xaf|\xf0\x01V\x7f\xc9?\xba\x16\xe4$+}5dy\xb1\xef\xf1m\xa5\x94d9\xaf\xcfq\x8b=\x026\xef\r\x91\x18\xc5\xb6\xb9fM\x8ayZ\xbcd\xa5\x8a\x88\x98\xc3\xfc`\xa6\xaa\x1f\x17\v$\x88g\xb4\xad\b\xc1\xddW\xa6\xc1\xb7\xb0\xa3\x84Q\x13GoU\xe2\xb7\x03\x9c\xd5\x0f\xa8\x0ef\"\x15\x82\xe7\xbd\xf8\xca\x10f\xfe6h\xe9\xc3\xc2\xa0O:\xac~\x1a\xf7\xbeF\xbe\xe5\xf0\x81\xd6&\xc0\x8d\xb5n*\r\xd4\xec\x14S\xa8\xbfO)\xef\x92\xf6\x8c\xfa=\x83\xdfHSxIo5\xf2\xff\xc1s\xacn#\xcc&F\xc4m?\x0ed\x8a\xc5V\xe9\xbd\xa3\xf9hn\xfa\xfd\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00+\x86\xa6mU\xacb\xe7H\x9de\x94yZ\xbeKj\x8a', 0x3) mount$overlay(0x0, &(0x7f00000000c0)='./bus\x00', &(0x7f0000000080), 0x1000000, &(0x7f0000000380)={[{@upperdir={'upperdir', 0x3d, './file1'}}, {@lowerdir={'lowerdir', 0x3d, './file0'}}, {@workdir={'workdir', 0x3d, './bus'}}, {@userxattr}]}) timer_create(0x5, &(0x7f0000000200)={0x0, 0x26, 0x2}, &(0x7f0000000240)) chdir(&(0x7f00000003c0)='./bus\x00') r0 = syz_usb_connect(0x0, 0x3f, &(0x7f0000000600)=ANY=[@ANYBLOB="11010000733336088dee1adb23610000000109022d0001100000000904000003fe03010009cd8d1f000200000009050502000000001009058b1e20"], 0x0) ioctl$IOCTL_VMCI_DATAGRAM_RECEIVE(0xffffffffffffffff, 0x7ac, 0x0) syz_usb_connect$uac1(0x0, 0xac, &(0x7f0000000680)={{0x12, 0x1, 0x310, 0x0, 0x0, 0x0, 0x70, 0x1d6b, 0x101, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x9a, 0x3, 0x1, 0x1, 0x50, 0x6, {{0x9, 0x4, 0x0, 0x0, 0x0, 0x1, 0x1, 0x0, 0x0, {{0xa, 0x24, 0x1, 0xf800, 0xbe}}}, {}, {0x9, 0x4, 0x1, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@as_header={0x7, 0x24, 0x1, 0x5, 0xa7, 0x1}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0x31, 0x4, 0x81, 0xe, "9e"}, @as_header={0x7, 0x24, 0x1, 0x8, 0x5, 0x5}, @format_type_i_discrete={0xd, 0x24, 0x2, 0x1, 0x33, 0x4, 0x5, 0x9, "ec2fb2197e"}]}, {{0x9, 0x5, 0x1, 0x9, 0x39e, 0x65, 0x5, 0x5, {0x7, 0x25, 0x1, 0x1c2, 0x8, 0x40}}}}, {}, {0x9, 0x4, 0x2, 0x1, 0x1, 0x1, 0x2, 0x0, 0x0, {[@format_type_i_discrete={0xe, 0x24, 0x2, 0x1, 0x4, 0x4, 0x80, 0xf9, "b7b795542ea7"}, @format_type_i_discrete={0x9, 0x24, 0x2, 0x1, 0xe, 0x2, 0x4, 0x4, 'A'}]}, {{0x9, 0x5, 0x82, 0x9, 0x3ff, 0x40, 0xff, 0x6, {0x7, 0x25, 0x1, 0x2, 0xfb, 0xfff8}}}}}}}]}}, &(0x7f0000000940)={0xa, &(0x7f0000000740)={0xa, 0x6, 0x310, 0xa, 0x7, 0x2, 0x40, 0x6}, 0x5, &(0x7f0000000780)={0x5, 0xf, 0x5}, 0x3, [{0x4, &(0x7f00000007c0)=@lang_id={0x4, 0x3, 0x1c01}}, {0x4, &(0x7f0000000800)=@lang_id={0x4, 0x3, 0x1001}}, {0xc7, &(0x7f0000000840)=@string={0xc7, 0x3, "d9abc8376045ebcd235845af43383e135d7ae83970e0321cf1c4e52830e12282b7491aff9027e703f4b8011a0a8de1c41da42140c181142a56875ab31026597dd72d3d59fd56ca683b2c6ed13522ab356bb51a1c1830b950e1a85137e6114c24b0acdbb61e6374b9fae4be76734036fe3278945e1733522148697df61b5228962e37d9878d06ee868dc9f76928f043ad3d24c183c8e8f4d8cbacfd621ed161c395cc49e55deefd70b28a46b549e69dfe510dd8aa022396f44f260296872e31a0dda0032f5c"}}]}) syz_usb_control_io(r0, 0x0, &(0x7f0000001340)={0x84, &(0x7f0000001400)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) r1 = syz_open_dev$char_usb(0xc, 0xb4, 0x0) read(r1, 0x0, 0x0) ioctl$FS_IOC_GETVERSION(r1, 0xc0045b0f, &(0x7f0000000040)) mknod$loop(&(0x7f0000000140)='./file0\x00', 0xfff, 0x1) r2 = openat$fuse(0xffffffffffffff9c, &(0x7f00000001c0), 0x42, 0x0) mount$fuse(0x0, &(0x7f00000020c0)='./file0\x00', &(0x7f0000002100), 0x0, &(0x7f0000002140)=ANY=[@ANYBLOB='fd=', @ANYRESHEX=r2, @ANYBLOB=',rootmode=000000000100000,user_id=', @ANYRESDEC=0x0, @ANYBLOB=',group_id=', @ANYRESDEC=0x0]) read$FUSE(r2, &(0x7f0000006300)={0x2020, 0x0, 0x0}, 0x2020) write$FUSE_INIT(r2, &(0x7f0000000040)={0x50, 0x0, r3, {0x7, 0x1f, 0x20000000, 0x4041}}, 0x50) syz_fuse_handle_req(r2, &(0x7f00000021c0)="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000300000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc4e00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ba045abcd5dfc67d00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000081000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000230000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000050000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000dc000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000008000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000209bfd66eea210560000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000003dc150f4000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f50000000000000000000000000000000000000000000000000000000000000000000000000000000000c6d90000000000001354c4b6000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f8000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000001a00", 0x2000, &(0x7f00000062c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000300)={0x20}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) ioctl$EXT4_IOC_GROUP_EXTEND(r2, 0x40046607, &(0x7f0000000640)) r4 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x80101, 0x0) r5 = syz_open_dev$loop(&(0x7f0000000000), 0x4, 0x2080) ioctl$LOOP_SET_FD(r5, 0x4c00, r4) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000780)={&(0x7f00000005c0)=ANY=[@ANYBLOB="000100001800dd8d0000000000000000021000000000ff0900080000080010006f9fffff06001c004e23000008000f00010000000800070000000000ab000880d0c14ecaeec15fabb297101ddf7a432effb98dfb2b7dc8c54730578ba5a59f98736c16dac62449089a3134fe72e77ab32531925a1196c0c34fb525c942f0d4bd19b076686729b3a09cd25706e5ed7dd3de4cf928dd2fcb3766af66c0dcfaae1e0594d7c821144772a505d577d69d93659877c7c355423572230b3f4220056ff08dc0fa9d644fa7c5015d3d9bfd7bf88b25193b79f3d0b511f93a4dfdebfb80da873bca123271850006001d004e240000080005000a"], 0x100}, 0x1, 0x0, 0x0, 0x4000011}, 0x0) syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r7 = socket$kcm(0x10, 0x2, 0x0) sendmsg$kcm(r7, &(0x7f0000000940)={0x0, 0x9, &(0x7f0000000180)=[{&(0x7f00000001c0)="d8000000100081044e81f782db44b904021d080c30000000e8fe55a1190015000600142603600e120900180000000401a80016000a0004400a080000036010fab94dcf5c0461c1d67f6f94007134cf6ee08000a0e408e8d8ef52a98516277ce06bbace8017cbec4c2ee5a7cef4090000001fb791643a5ee4ce1b14d6d930dfe1d9d322fe7c9f8775730d16a4683f5aeb4edbb57a5025ccca9e00360db70100000040fad95667e006dcdf63951f215ce3bb9ad809d5e1cace81ed0bffece0b42a9ecbee5de6ccd40dd6e4edef3d93452a92954b43370e9701", 0xd8}], 0x1}, 0x0) 13m42.779086681s ago: executing program 3 (id=2283): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, 0x0, &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x3, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000380)=0x4) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mknod(&(0x7f00000001c0)='./file0\x00', 0x400, 0x1) sendmsg$nl_route_sched(0xffffffffffffffff, 0x0, 0x0) setsockopt$IP_VS_SO_SET_ADD(0xffffffffffffffff, 0x0, 0x482, &(0x7f0000000000)={0x6, @local, 0x0, 0x0, 'lblcr\x00'}, 0x2c) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) bpf$BPF_BTF_LOAD(0x12, &(0x7f0000000140)={&(0x7f0000000000)=ANY=[@ANYBLOB="9feb01001800a3a3000000000c0000030000000000000000000000000000009060"], &(0x7f0000000040)=""/193, 0x26, 0xc1, 0x1}, 0x20) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xe, 0xe, &(0x7f0000001300)=ANY=[@ANYBLOB="b7020000f53f6314bfa300000000000024020000fffeff7f7a0300fef0ffffff79a4f0ff00000000b7060000ffffffff2e640500000000007502faff07cd02020404000000247d60b7030000030a00006a0a00fe0000000c8500000032000000b70000000000002995000000000000001da5ad3548ebb63d18db6a1c7e821c9b767ac8308fbcd5c5e4a5ad1065b572c2c9ff215ac60c2ceaea4c0ec908abb6e7325ec1956bd8660bf3664148a2c96752fe2bb328dff1a15750ab9a780001000000000000d4bf20c2bd152d814f01f2cd519e078d4ffab418e4682b2aec5e4a35629e8ef040c50287c37a7f4182f32333b08c6e497687e10a4daea5cac0ceafdbb126eb02a1f5104d16ddb64963d84d91814cd5817e0b8f6f5e6ee7a39e180b5a18ed786b782ab1321ea5e82ae5ba2c42a5e23ea6253d5df768d0cb9f35e4f41a6211e52bb3598e9b5d4f22d8c19f958e8b34de35949a7a48ce18799ee53da177a81ea65e652c1d71b7ee86a75b0100000042127a8f84538a9a311c757f7169f006f3f5c95177fbd0b14b36259e2905ef911785c88a16aae46084d676d8ef8aa6ecc2d32e3f4ee367c5a769c0a606636c9f4a4413c098f4fcc96623b7c373b0ef04d55b846b094bf97e2ef5987b6e09a6a7cab79bffda141f65e7d9ebe3be70c436432b70a80cce69df30d3d67d84ccf3f9db9b690111de2ddc4b153c989ef100bbf76063d3f6ffffb73d70e9c3d7b90aecf48e7565efff2dbbb512218c98442406333c890923a797e00b75481739952fe87fde27ce81893f54ec0ea8e792414f639bc9ce1fea3f6ac0d7025759d4b45576c205c70631e8ad585951950e521f4e210b6494e3c52d927195737945cc03d5668483151710de246420a1b6c55b73876a6ed7fd0d9338923789a1edcd8043fe83919088383268324a25df14010c8ed6b8d43400eaa00ff9bc46e1cfecbdc0e451ac53b409d04544d3a7edd4d447d2fb431e226ae182b8dcc86fe09b404e0b7c723d3b19c3dc382fa91fb0fb8f9f3f13296bb1758b24aad0922091d49e2bc408a5a37deee7a60b903d2d9fe9d451cafcc8dc389671c2d08b6e264150a6b9445b00cee4585af04fa69e0380be0d66649dcf3bf8a906b029faca75ce34c41aec7aa86e596119109ea8b3f7c65c902499227c087301643baab1c95bb22cedd913b22dcaa197ccc34586dc50bd9f4628e3e77a0de32e356521df06f995cb57f97052fc4158250ccecfb67ea8faf509593fadc7eafb613327b052397af1ede94d87590ce90a0a7579766f7ec4fcd3cb0b1a8c531724d5ef6b334803cedaa9cedf16dc3af6e0b67f62a83a256474c97c925d9d447175b535c87dbdeb0dcca5303eed6689ea91e1665c691df736368dde47e6672e93a314c5f60e7b68c2242bd0f0d8c66449d8687dcf2d0f76668b2b9bf8b32b99b7daf34b2d825d192ade90a1162acfe9749d516d014cef5f99126324ea02baea5808c430985749901b09e4902a6f5addc0103756b894418e4591c624a9b206abbfb888d413d923b0d7c9d997d6d8e64787c4d397f57a15b6d5b4212b6cb55b9c207bbe08f483b1bea05f41b9a1d3af087047c568ae6ebfc0bb5ec10b6290dc757a4903a88fb2c035b2349b6d2f0c051b8b7718384eebd5fc19928cea713ff09e179c308fbe9bd64374d96ef2447a2a4af5ca0c39e7ca2e801e57560a55e9cfa095cf3f74398219ad1030a79517a88de7596429a20793e12616aa32b3e720c6521fbe93963e9536d16f3db211fca7dd99c0a0125ff8c18119a6926083f4a2c008a9f2a29e30823bf0ec3639cadaf9be9608358e1e5ab17eea477b1754f78f45468c9568471667f82f5e250b979b9f2bd0d1b6bc03d11811ac6eec9a3ecd9e3c3299ee5eb3c6cac8fbd06514b7ee743ece79c04566d02a08fd5fcabbab3d129c0cced3ce11dafa387a8077927a1ad367c114d0b423e64c6157fac5e4e2168f33541daeff9983d0e488a78bef538f870b84798272b2101e0abf1cd64500b79e01e11d727389653bd80a39d5bbe2e23d2f5ff10047423429981bd9b4ce680e174c266391e3e7689452654e5cd5ada6e025327a1942b5a068f15fa58eaa267d4e0881783dddbdd777f8be0824ffdf6d06c621880dbbe9534f15e8c2e364d3ec67deb6ab9f2a0f03212972dbd38500000008173553a67be48633103809eee0be51d67d7ce230b389607b4c3b18da1c48f3180f2e0d79e54565fdd9a099b5b5ba2761905b88b7cbfc39c35dd153609da3da263438f12769602c2195245ff83e249119d4f6cabfbdef84ada19ef4a67ed66d7043036515d0be5a231f99e71aba5d5ae04676eff3e85f0844c41bbcfde7a931d1ec55c01f703bfd1b97756bfe55a91f6b379f34a018906339771157c66dbd7471d1beec7f029ef552cf5e92a1a0db21b59355763967ce26a577bc514b6d22a09c385c5ba6caf524e1688fc0f20002b35ae7bc8eb5ba51aebdf7d972c3267cedbe77ed70d9c539bc455a6f88b39196c8a224b0acf4d796fea59a07baa34cc270fb096ef330fbebdf872d7d0bc4f9a963355c554abc5cdb91464faabcd09cd9a53f5d1b2ea7e96f428f7cd6735c19c61dc9942d30bf29ef85ed01c2fcd6060aa40eeff971477b4fde48507b7bad95a496540adff7e4a72fd1f94d7c703ab1525c946c54e0da3d7ebfcc8c367d1bfd1aea2e84c3b310aaea5a1627df898c00a9aaf2d88a36afa4c5b1816384310600001c33125ad7f7970beeb256aec06e39fc6c66544e1d1dc5fea4b68a82dc568ca30aea9a1d097f06f11dc362f4bae5ef57c67686a15855cd351bf26f40fb1348cfce79897682228e6d9643530c81bab27bf7b1c4a76a5be180bb830cf06827c3f38a9c9c580c732c30aaceda78b0297de35a922b1375b129655beb31899e26052cc216f832fdb0a0015f93c9cff77f59cda1ec5f3e358848756cebb074266a47e39ae26e80e8c65aaf73c24925458520a9ca98760d1005c9f81846459ae6d5baa4f02807939ddc29c3520f7c58ed9bc5a569c7a1bc33cf4f330a18276ffb4550b9166c3939e8041094bec034aa0ec6638b74fe34f0f1ec6903a1135808d5d8d26c9203c3f87e66c407b7c5c0888d4558dd657cc0213efad68e76fdd7b23e68064fd4b271ed79c50abacdd2871b0c1f8c971df59a5a1901ddf804bed43e391f882d2a45c51cdbba86b2a1b7c0c4923642a731ea4dcbad2b6ebbebe787a8e28e781d75beee924b3b1e390750f316648133922c021f98fd2d5d71a7a3679397ef6cf432837b7e264831ec01c4c3146ba0caac3b13d55945ec00e978a1c1712cd51187936200606c9cd6877b2f72125295c54721f8e15df2ae282a8becb99a726fd92acc92141e1f574b4b0b3c992a61af3372d0d9217776b1a42cd2cee816a70bf1ddd69b590d53e28ba356e74b38e23e50d898e95cdc7cc809e462c884b53f672aab1411ecfd4c91e7a9782fc6763f0efd4bcbaf1fc3a00000000000000000000000000000000000000000000000000000000048e510340087caf22439d5304bd704a6a78a512269a9b1cbd13bea78c807bbc73853ae187cbb768673e9d1bf74a3b0a6c234accd8506adf314f4c5e08174540b69d3c0da660052b43b86baf49e7ac6f09c21598b1e01dc1e1b5a53626b090496dbf7af441e397016c3c094d5c91ffe0a7ceacfd225ed9a6c905f79ad7052747dd6cceef4c310e0e935311118bc6bf0e5ca6c7cca7d5c03be570308da8a40578b4db14961fbccf6e2f2d56e9509c434126515b56d032e20c12e830d1bc64826fc9b318da5911e466878dbb81edeff69363fb75af5cd80536f14d2eaa7764db23acdbd394bbbbccf5e882602897a85bf8523d891080593d831d758deb4f2c7e49c6d6b35d8fd92601c8500febb0c5fe0be294bf6bbbecad444695277a9e3992a354492513b43091d161c7c7cdbbe44e8e83b4cf333238a52f214b278c6485236ea880db2f113f6381187679a4620d6149808b0af024b3b3e6ba99b4b15ca"], &(0x7f0000000340)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0x143}, 0x48) bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="0f000000ff07000007000000070000000100000074f5524217e01108487016d90ae3b77a56b0728e0514abdb0867f0744031f0fa5ffd3e926abb2d1183a90ac109c88603402cf1dd58f2b8c81b536b556e641c64f838f9ff4f91e460875822003273d4cd924cab5a8c5e7511d8bcf10727d7a867ce13cae2e958f5e5b411f5f0318d14d2ef99caf1ab6cbfe41083ee709f451ddb5c65f9ab6bf0f2b5fef2f6939ac1501090fba864c3474d4b8a4cdf5977f332adcc497a175e0e1b7a49b489c08c3a5f730887e1184f304ef418a6dcf2f9542b6d00", @ANYRES32=0x1, @ANYBLOB="0300"/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="01000000010000000500"/28], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000001c0)={0xd, 0x4, &(0x7f0000000080)=ANY=[@ANYBLOB="1800000000000000000000000000000061199c0000000000950000000000000029ed6ecacfb62765c947304906239e71ac7ad5bb007e22035909bd8dca765d67d86c17da512d67b5accf11a2ef0daa08152e92a2222545cc7717761155faab193ee987ab8ea3aa576a3c34739f7fd2c1e554fdc1f9c6577a6e6a95d743f697bc2c2b900022d0642619fe603210225fd6ce1995f9f70b41047ac46d635d37f624600a2c7cc824228ea74703b4e4364c5ecde92bb678e3d20255e7323efe9accbb2b50da02917790d6c9d12087b099672c9e6d93865f7e7f5059bbacca93d598e421efc1d8ac03"], &(0x7f0000000040)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0xb}, 0x90) statx(0xffffffffffffffff, &(0x7f0000000040)='./file0\x00', 0x1000, 0x4, &(0x7f0000000280)) r4 = socket$nl_rdma(0x10, 0x3, 0x14) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000000), 0xffffffffffffffff) ioctl$sock_SIOCGIFINDEX_80211(r5, 0x8933, &(0x7f0000000040)={'wlan1\x00', 0x0}) sendmsg$NL80211_CMD_JOIN_IBSS(r5, &(0x7f0000000300)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=ANY=[@ANYBLOB="3d886d538b840bf2f3de72118b3ae2c77b0886794962ca099f5e0243e66395997f1fc563a079292553c35587de4b75a08e3283f3f718fe6ad88cfad8a54ec27ce8aae5620c4704c23f6289fdb05171578b485d056ebddb303a5dbfa7c0409fef2c39762766e559798e11a8da752ba996e2c1c4df8be81ebcf2daf38d46ea873b64c1662750fc5f78f1c418b9e819f7a5740d8f3692d12d07bee01ce899e9099d45e0e403123ecc3d41c4ced50ad75e5fff2dda4c5f4780cb28a8a05db6ba", @ANYRES16=r6, @ANYBLOB="010100000000000000002b00000008000300", @ANYRES32=r7, @ANYBLOB="040046000a0034000202020202020000080026006c090000140051801000008009000100e1950186ad000000"], 0x48}}, 0x4800) sendmsg$NL80211_CMD_SET_MCAST_RATE(0xffffffffffffffff, &(0x7f0000000480)={&(0x7f00000003c0)={0x10, 0x0, 0x0, 0x100}, 0xc, &(0x7f0000000440)={&(0x7f0000000400)=ANY=[@ANYBLOB='\t\x00\x00\x00', @ANYRES16=r6, @ANYBLOB="20002cbd7000fbdbdf255c0000000c009900030000004600000008006b004803000008006b0052000000"], 0x30}, 0x1, 0x0, 0x0, 0x4004}, 0x20000000) sendmsg$RDMA_NLDEV_CMD_RES_PD_GET(r4, &(0x7f0000000540)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000300)=ANY=[], 0x20}, 0x1, 0x0, 0x0, 0x8014}, 0x9ee9fd74460f2f8e) 13m42.000819146s ago: executing program 3 (id=2285): io_setup(0x3, &(0x7f0000000000)=0x0) r1 = timerfd_create(0x0, 0x0) io_submit(r0, 0x1, &(0x7f00000009c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x1, 0xbfdffffc}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) timerfd_settime(r1, 0x3, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x3fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}) openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x240) 13m41.362946932s ago: executing program 34 (id=2285): io_setup(0x3, &(0x7f0000000000)=0x0) r1 = timerfd_create(0x0, 0x0) io_submit(r0, 0x1, &(0x7f00000009c0)=[&(0x7f00000000c0)={0x0, 0x0, 0x0, 0x5, 0x0, r1, 0x0}]) r2 = syz_io_uring_setup(0x88f, &(0x7f0000000140)={0x0, 0xaee2, 0x0, 0x1, 0xbfdffffc}, &(0x7f00000000c0)=0x0, &(0x7f0000000040)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r3, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r3, r4, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {0x85c3}}) io_uring_enter(r2, 0x47f6, 0x0, 0x0, 0x0, 0x0) timerfd_settime(r1, 0x3, &(0x7f0000000080)={{0x0, 0x3938700}, {0x77359400}}, 0x0) clock_adjtime(0x0, &(0x7f00000001c0)={0x3fd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100}) openat$sysfs(0xffffffffffffff9c, &(0x7f00000002c0)='/sys/power/resume', 0x149a82, 0x240) 11m55.508001312s ago: executing program 1 (id=2664): r0 = syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) ioctl$USBDEVFS_GET_CAPABILITIES(r0, 0x8004551a, 0xfffffffffffffffd) keyctl$unlink(0x9, 0x0, 0x0) socket$inet_udplite(0x2, 0x2, 0x88) 11m55.459888562s ago: executing program 1 (id=2665): r0 = syz_open_dev$tty20(0xc, 0x4, 0x0) ioctl$TCSETSW(r0, 0x5403, &(0x7f0000000080)={0x3, 0x0, 0x0, 0x2e69a, 0x0, "00120dd608f500001e20000080c90a008000"}) ioctl$TIOCSTI(r0, 0x5412, &(0x7f0000000000)=0xa) 11m55.340909908s ago: executing program 1 (id=2666): r0 = syz_genetlink_get_family_id$nl80211(&(0x7f0000000140), 0xffffffffffffffff) r1 = socket$nl_generic(0x10, 0x3, 0x10) ioctl$sock_SIOCGIFINDEX_80211(r1, 0x8933, &(0x7f00000000c0)={'wlan0\x00', 0x0}) sendmsg$NL80211_CMD_LEAVE_IBSS(r1, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000100)={0x1c, r0, 0x1, 0x70bd27, 0x25dfdbfe, {{}, {@val={0x8, 0x3, r2}, @void}}}, 0x1c}, 0x1, 0x0, 0x0, 0x20000800}, 0x0) 11m55.33583767s ago: executing program 1 (id=2667): setsockopt$packet_fanout(0xffffffffffffffff, 0x107, 0x12, 0x0, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x0) mount$nfs4(&(0x7f0000000040)='/', &(0x7f0000000080)='./file0\x00', 0x0, 0x197841, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, 0x0, 0xffffffffffffff9c, 0x0, 0x0) mount$fuse(0x0, &(0x7f0000000000)='./file0\x00', 0x0, 0x84000, 0x0) 11m55.302607934s ago: executing program 1 (id=2668): fcntl$setstatus(0xffffffffffffffff, 0x4, 0x40800) r0 = socket$netlink(0x10, 0x3, 0x0) r1 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_buf(r1, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c070400000000000003ff23353d8b2fc6a3ae1ebfcb49004a3ccd3560ae01010000079c60ed7449b842f3e253be8a62b37f820fe75a9ea937ea4efbfb9b4a128f2dbe2837496d00ad7765abaac2ec0f91c88a1ea1ff6ee308c72febedcf00798d41991ac25bb6fce2220c25ea380c7e112ab358c3a6bd8a59c100000001b4e82cb03419544a3988bc226a85abe6eb60cd7cf8d103d38c31c7c86d16c4d86cbe4ab190c092d077ce70590fbbd4f8bf4d6ab1cea6dbe9d4a54c17aac0db6e3845", 0x118) connect$inet6(r1, &(0x7f00000000c0)={0xa, 0x0, 0x0, @loopback={0xfec0ffff00000000}}, 0x1c) ioctl$sock_SIOCGIFINDEX(r0, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) sendmsg$nl_route(r0, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000880)=ANY=[@ANYBLOB="300000001300f5d10300"/20, @ANYRES32=r2, @ANYBLOB='\x00\x00\x00\x00\x00\x00\x00\x00\b\x00\r'], 0x30}, 0x1, 0x0, 0x0, 0x20040010}, 0x0) 11m55.212541574s ago: executing program 1 (id=2669): syz_open_dev$evdev(0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, 0x0, 0x0) getpid() bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r1, 0x40383d0c, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r2, 0x0, 0xc, &(0x7f0000000040)=0xfffffffc, 0x4) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000180)=0x8, 0x4) recvmmsg(r2, 0x0, 0x0, 0x40002000, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r4, {0xd}, {0xffff}, {0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 11m55.095347471s ago: executing program 35 (id=2669): syz_open_dev$evdev(0x0, 0x0, 0x0) r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$SO_BINDTODEVICE(r0, 0x1, 0x19, 0x0, 0x0) sendto$inet(r0, 0x0, 0x0, 0x200007fd, 0x0, 0x0) setsockopt$SO_TIMESTAMPING(r0, 0x1, 0x41, 0x0, 0x0) getpid() bind$inet(0xffffffffffffffff, 0x0, 0x0) r1 = openat$ptp0(0xffffffffffffff9c, 0x0, 0x80042, 0x0) ioctl$PTP_PEROUT_REQUEST2(r1, 0x40383d0c, 0x0) r2 = socket$inet_udp(0x2, 0x2, 0x0) setsockopt$SO_TIMESTAMPING(r2, 0x1, 0x25, &(0x7f0000000200)=0x474c, 0x4) bind$inet(r2, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x10) connect$inet(r2, &(0x7f0000000480)={0x2, 0x0, @multicast2}, 0x10) sendmmsg(r2, &(0x7f0000007fc0), 0x800001d, 0x0) setsockopt$inet_int(r2, 0x0, 0xc, &(0x7f0000000040)=0xfffffffc, 0x4) setsockopt$inet_int(r2, 0x0, 0x8, &(0x7f0000000180)=0x8, 0x4) recvmmsg(r2, 0x0, 0x0, 0x40002000, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, &(0x7f0000000340)={'syz_tun\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f0000000200)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000180)=@getchain={0x24, 0x11, 0x1, 0x2000000, 0x0, {0x0, 0x0, 0x0, r4, {0xd}, {0xffff}, {0xfff3}}}, 0x24}, 0x1, 0x0, 0x0, 0x20000080}, 0x0) 10m29.508789761s ago: executing program 7 (id=2999): socket$inet6_tcp(0xa, 0x1, 0x0) r0 = openat$ppp(0xffffffffffffff9c, 0x0, 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r0, 0xc004743e, &(0x7f0000000140)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x0, 0x4, 0x316}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f00000002c0)=@IORING_OP_WRITEV={0x2, 0x0, 0xf0cfbc5d1cbe1900, @fd_index=0x4, 0x5, 0x0}) io_uring_enter(r3, 0x3516, 0x0, 0x0, 0x0, 0x0) ioctl$TIOCPKT(0xffffffffffffffff, 0x5420, &(0x7f0000000040)=0x4) mkdirat(0xffffffffffffff9c, &(0x7f0000002040)='./file0\x00', 0x0) r6 = openat$fuse(0xffffffffffffff9c, &(0x7f0000000300), 0x2, 0x0) read$FUSE(r6, &(0x7f0000002140)={0x2020}, 0x2020) syz_fuse_handle_req(r6, &(0x7f0000004180)="92756f43b31ffe542788ef586b7c5a344424e3acac2590be6bbe37adface4a8f2e534ffe76a83a93f0b3680a72fddfde83f96d01982384e8d689219cb9669b14dbaa1b799f82ea1fc926126a4163618e16d4f94143a4e0f27c44fcef3920a0b3805ed4e78098d8689cc7791bd86648070718d238664332948d87866c8d2590fc0f017f9853abd9ed60b99f1aa6ae2dbd24ab6dbcebdb055246815ace147cc50fa3b2861148fcda374d5b203e51d72c45e4dde3e9ee9a47ffe458baf7bb49035135a8194aa1f0a83fa2abed56398f90daff679634619453f533f22583a6e0a4dc09e9de46684d5e0136e229510f3702cf3a4cd0065d3e5d3c419e38a80b070ca55010e082a9c510fd18cc0b26bb5e8e459e747befbc5c6b60ace80bf41417b7b78cf57e5b3984f0cdddc615c5e0000454d3f4a196fb6d18aa629cf0b0245f95ba958d86dc175616f8cd3ac473057dc3a5ff7107973326350107f4468e7ecd48d689b82c12d22ae5f1858302a1b4cfde8fd347a99ddcde40d1c49d9b5099fbccf09e782212be4b2ce36a2bc3c9ee794abffe72a5501e6c4f3f7f68b74761ffd6620609224a3bf11f655dadb5c8a5813b02fb46830e9ac6825f5d0e89910352eb3a58c0dd82d094f94dd2c85666f684a8f437bbd0e66b9f4d366117b67a054d212c4fbc287848cb0578391335d5d616b14d99a2e3df8e8a152d5de99bcefcaab5bb5cc71f3ddd66b379c104648e190e0b28a180d3aecc5423575d4ba7dbf31215c717da7b87dd454b6efcd36c91aaa631127f5bd88723d221752f102bc0c7ac6c5c7a1ad6747af40d01b6d39eab7b0e1292b44683c586386ad00acf60fb8f9bac551a6eb5bab7317b5d89f64db10bd9018dfa6d65d93862e851afbc30fd70fe5f0de322462045177231852ca80e4e78da4fea0c79ba354333026c8bc77d308a8d256a19ec45d2088c196691d3f9aac28ded36004a65ee1ce49ba9599ceee84534bb61d02d04a6732f1e27d72962f74b59f3522bf844c5022986d55934e48b8681b7f5b7532391448caeef00315d28320a46d8bd7813544e1e4bf994e14a519c2654ff20b42bdb69c262897e28eca528f0999840b00ed8256597d27cfc20d71d5f40d0bbca759f7594c6034aa1e16a84ed152fad0fdc1c303a7f61225712714f823afc5ea241d482d3585759623af8c97ca6a84a2033b3d7314ea0ef7ba9b288b362a294c92c8b9736829c16f61c5a1ee04aca965d71162292274595ea62c9c2918e8279c99f5d2830c617c58211fd7452330184b9428d5ec1d5cd75ddcc6de3326fdc70e891104b3b013c30ff0000000000003ced1f6b080a930dac2052c6f39817a662121d90d40d6a1facfb50bec7d408030b6d0ae3e744f3bcc327c35dc43cf86b743db78ff2e593b19923235ed6467f299b08718fe1840c16a748935dff941150fb08b30573b37bf9af5c86cc8d9e229a832e4ef25ec91f71120f2b3e9062485976c280a2d172386029e2f2a4801197fca0a13514edacf5ddbac5a62e8bb13dd1572657a821a8739297f72e29239d1cdddf3e30cbe9af3141f2275ee4ae85d86ec888fe9a6751f252057e95b8beb055e276439581afee93cd44f1e92f70e5f725451d3ab662918ffbb1269509fbd511e95a00ec717f9d60d643864abd6ad1cc4dd7f933379a6078a86c2158db8076e7b660366fca7b1c46d09d2c8e67a6494bfb4c2c6750e76593895b5e2b2bc78093840c3c4a807826bc2750a96b4e1dd5b82b492bb2215518c92064d1763c37132604e52e73fac3f4511f791753aeecfbb19816e0da7a1bfbea9eeaa0f256eaedcb119a61f7d0ea0f5cd4969d45cb014800f2c888d5c2217cf0f69a7507779883b57352bb8883cc584891950d6e792537074f4fc4337aa19b9bf60e18edd939d289fb4a6b7aa6c66da20774e249ca4f779d3c910b1a9a8e4c38af6adecc87d5481d181fd66023ffff246f4e2556b218fe8110acebe20b1675f1de6f265b6d1d8514a53522396bf0e2f2b153c498e48b36d16f8b9bd56f45d7f5b9397d7f1339117a176d0bad0b68e800682416d3e18fe2197c7f8dc20600feb95cc6ba86ad47f113e159bd4389e30eab2874bd27eebc56020c4dab9973b13f3e82aa62a7e0a151d73de48cb811e32be63ffd303f5a6ea6f097ed763fbf36c430821e451146de79922348354ce285af0997bf3c66e6ef02942e24b8f1ccdd542f09cfe65c0da0094c0b5fd26bbc061538b41e5ed2cbb390ee29b10a4b7a696009e1b5b86c44c0a561a257c15415feaeb1433ea275ed6e4b228503fe71ee5942665164faaed6697112206be0fe7863aebd4bbe951d5dea1da294dba0793196385f4d5141c9d6c4b0fa22b2e200cfb70b52aca31655e71e5a576ccb8ccb5b1364748aa981edbb81a813b1aebc67be1f7619e7e197622d981280429f6ca5145c5b3b05e6bace9191e5c58fbf140f71f594cbfd4db0e9f6923f1758ff9474a61a720a5d4f09c622c3ce3f5d0d3a1d191111168108f41f12b16e9eaf3617c353715cd35260560cbfd0555d51ce5c40bbdb7c95ceaeadadb8902974de50b0863348183864f5ea682e678286a06a6f396af29a7c7fb33a3579e25835963612f3c0d4cf369d85959a0adeda94d35824050e6fba7f83f90867583f713d7783323c7010e94c9be331f860db395dbde6face5bfdb616fcefa9c6b01f6963daa840a358c0c50cb5e09f91f54f63234589decaf45bbfbaef0dcbff4ae6e65ca26a530261c491ef8eb9a855a1d7463391c9b66be96cf24c3c321ee5a5bdc857f60b582683c6ae1e3775b62a9f19ff8fa51380ca8a2a3c6de79012f5727ba12025e7e6723a23a81e067ca6e54c7b38ff64880d235d21e7ee5258953dcbf9e2a962f006ca4ffe870859242c850cbae4222b3b72c4f86934379ba2ead1dcde906241b994d95c88355af5a9a30ace9c933a6942f341ad221dd825846a8fd44c03e2eaa9311c26e15a1bd7cbba961a22ef23d7ebba0e34cec5ef09b1ce72814a97e33bd29f3d9ec80a4f45d1d29486accf15c11f1a800bd84918e7626f678275d7c7acb02cc0e6e34bb766ba6b75c3ad14fca9352e09c3b69390c045cfc842ff9ade8ca693c07fadc7047a946e6e570c3afc5b501c964103397f5ddadc2d59a048348dd42f07cfe31bc9b5ae453f5086bb41bba4c8a3e518e30b0855184b053f923025dd72ce1bcbf41231978b34a8547c71d7313992165078903c61d312b0d9469413c9fd97ccdf0ea270fb6c47ec8861a1c8d909eeace761b5a06ba46e25785ff87f867777abb237c6c980687991f1ed0157d58492260c712cec34c1fc0962103955db4d5090b6e8409cf3c3c79d0e691cf4fbc0b2251a016dcd456969cd32e5429533bf0d6f8bda84c05f0e2040de8b53bfb8676eec4b76c3df6f46b1e43732035dda577e75f640777f6ae90fd2f1af42ba462dac732019c599bfef01acd6a0d4d1796bcb8f58519d6f9ad9a3206704a94d472516b988141f44ecd2e6f28a49aa0c449db87972fc995a97379914546ea43143ea2cf779a9cbe81f111fe89129db3610492164ab2598eca7e60d9a6963d8ba03a86729db86e420fd96d61b8fb11edc2b339b57a740074ae5b775eaf60cd85dc934e604bf2b4bd58ee01205b4df57ac20ff8db45a05982b579643882407050c005102a2e71f1e56dc76dbf5331112e83e48bfb5cf2a78a893190d78426175c162ffaa7278a43b9932318fc17fb8cb0dfac610b1ad235b91f9cb7623b155117e07f7b876a3c37627aa31eafed141cc0c5491c4f621a66b6d837a144d78719c46511c04a093cf65fce9fabe5bd6d499eceb63538ece3cf19053550a239bf978c08c879f9954485a4e3e0d5bedb84b407ced85c4dfc4d75af116815992c29f0bc927c4a990c38ae4fcc9feb90fec1b1b555e04d010423010855394d5ccfc8ed21164190cd8f83be5debb70290c3547f07e4dc42814f1e001798e6ceee2558b0c6ff8c1759f90269ee226131116332b99ac8dd104c92088e1f91ace3198c0f59bfb75c4e4a697660eed43a29c831a552de37fce6dce96fa51b6e2111f3071a4e94422d15e102e5f67da7ca6cae6bed7743ebffacb8a811a143605791d17232181a517e872f71262c3c73668f0ef83aad498f67fa26bae698cf78f24c2dbecd399a190e6b8d0684e929f2e8083765eb2c67793a1adbb89d36b58bfb197cdc5f3c894ac9d886e8f3b0936fabd233c09de8fab8099f72a74d908ba5c5e4d39790b0bf9e45b710f5587b7c937c76690c5c5fce621a53a9fd03b0a4ee6d8d1abbe2ed561820a77f12a08cad0755540ab6dd1604b7c30a8652995ab80b85e919011de9438a4637eb0291124ed4b745e782cff98510cb03be79c2a81351abf276584d75cdd96b9c97e73eb71000b3ab7c3c19c2cab4497298fcb3052b5d4503d05e7f310318be6f848547b1a4f4db82caee190801478be28065036aa4d91f290c1f396343e73a5fe8bb5ccf0a317177ed1f77acda1a4a49dccfcab8d1b5d79f015f788b6d5e9f8228a8bcdc0696e6b19f5edffbcd7e9509c87fbe1f726b93bf8c6d8d37428763e142560c46c9e894f7317859000c25abc4f3691ebcd020171e0d4911b5d97a238109aedeb00b2eb475c1e7b45175f8aa85193b5c0f43b434c15de01610c4d022646cd6e3637f349a434a77f571ac1c5d698452d1b991e267f78dca5e592ecd31ccafcad84e4e98d134b4adc525b81bd6843428883023a6ea407201738c8bf16b541ff7280274a34d4cf14819f2dbae167ca0cae8471c495e006b45194ad91c4516f21cbb10e0d26fd5d734cd7725df5b3fbe92955f4a9bb3b9b813aeeff79d6ed5db92def19d060a208c3ec8c42c110786f1e1496c50a7249b03fc792764366894a35320b99d0bef9fd0b6a246c36a357c6b985dc83a37a8d9b8b9ad643dea94860cbe763bb73cc8422b69d4d12332242c8954075fb7117a6679638073617abcdb4619855b2036af160647f66b3531645a3bf047ae290d6ae2249f114e7a8464278bae1486022bcc7c37390c8d9a0efb0e1cfa0da8ef7a5e072f99a47ecc75e4e442880375193db49bb82ba34901286ca473ed5b63e4048db4dc455e74b3fdd2e7898ca3f4c3a02d435cde6141eea645055123a7dcf0d22057f8d425701afc55859f5147954e719d58c7486b1e02ac16cb799b77632c66bb78e6e52e11017c1736424fa4d433f1e19b4c881d23f0b2a12d5fae3ae24339088088d9b496ad97bd9f6e20a8597d1452a0c72dcf43dbbda8f18166585c06d21fbffe5fe7b55f71c9b9f1b34a02bd05ca63c7c1b1bebbb9dd24fb10291b04c665d45154dd28b85d821ce7e613119128996785e1006a8dabc4899b10d2671107d5a0658ed363b9d4b39d02f8cc5e350fbf0a31048adecd1f9e2ca749bd86f195eb48e9b4605f050de03d642940d79184618f7f88a9a0a4683ad84d6134e395305bc1d4d9d17cc334b97653529d6682a87a5fac80a6d46d6e72fc22e58be7b8f8617b3372ef2622110ab1ec448717118b257acffe55d18c7855e9e8710ad977a6792b2315a189eb4468c68641e9b60c0dab7016ac1ad63cd8004b6eca8fc88b1e4263acc00499255c16b11487a0af858075f9c892dc8044c4146e5a5677c4a2cb24bde5e078985020d4ab1e4c87492e76b7e6f4bbd71d84bab1885c9702849e70cf728776b1a94c2a8fb8c7ca01b6111ef6f2032a290949bfe473fe215273b8b5b3ad540f187490f63077dccbca6f62f0a7a66717c596cdef412f2560b10685ede967b3ee68b8c951959aeb1d7564c3b9d806b2ce858381393a79916b78f7e90beadae30ffc0b2b614380f1c2cc551a44565209db3516be379ef566ab00c673fd8aaeeecdcf1168c1960e9a477b9e13757498a44ff089351d1f27abf9fd76816f924504647d1247715ca861ebe624172c322146d66eb2b247f8ecb3e1b5ddca89b287c57510cec40fcf89d802cf4368a861af320e01e34f7a6177d4bc549181b5e87ecdfe02f78c9a59a3bf91ebb6364023ec06410e7b4476ec4e3685bfa3bfe9ef9ecc12dcd899abe0f3c7f16b4686801c0c0a949aa26bed57df56f2bc54ef19af7fcbc7b0d691075f42a4a67acf980b568acb2342f42249f7c1ee3527c13182b096064ecd250887a942d26f637e1c4041b139659d2462a68680bb04387a3b399e396b9fe74de10356125fa47d0a20827370cbf36a79b6fffade91c439dd6cfff4bbe0dd3efefb61c491ee32f935d62307cba369ac8c20f6fe3d4857ce6d240ece5e4d149f0587155a8350fcc18efae2ff11cdbe15218a82499a1996df8b5462ee170b284321e76bbe5c3f4158387644d95f087c598e3d46fbe27f63fa784bda239512113424045a2c5dbc6bc3662ca730a86d13cf8f6fe2743224ca7b535caf6b4701a7dae9cfad3d7290104bbba15b6a064ae6e909a099f75fbe47c9e654d8e3b8dc0f3dbffe829e6c56f7a241e565136812a857f59ab565a9991c6b1d8abcc94c6b33bba314f6e5060e657e4647f969a551dd6c51dfca0ff5d9e4f401fedbc2c927eb1ed95ef25f4e5accba4999322ba1539499310dd5875433a22835cfd42fd77fd4680b7fe767d7aa5c33acde04a65bd3a663fcde4c80e9f2af498f13bf9abbaa1c1265edc691e94abdcc92270c05811cd2a8104eb18efbfec9e4ba9ae5cde211b9b93082ce034b6cd5fbe9cfbac4f7e2404ef159766124f73017cc3600f3c81cd78db25fc3459629eaf20dfdb062c7e502aa69412381d847a9d254d5befc451cda3606f0bc8ae62e0aee928f9ed0b21d705a8d31b899e16445ee064563d32f7b6bb5ad197023cf528d9b329ec67815c6ddf27d2a6ffa7328bb993407cde3d166159fd49fe469254b84c2916daea8df9d69bef019f1351b9bce193e30278835b82ea5f60dc0bdd7f7452b7a820ae7cd6dc29d7ac6a6c1b6411711a96338b1e769146b2a385d282bfaae61b041166efafab2d89a4567b9460cc22d752f8e9aacaaa0db7c84879f5359662d55df6570d4214740851c74574ced733807cbb54571110410892394c3dea07bd4154d0e5689d57c3360207dac951f96a358e9c466a5c5113f3a632e184f57f075edef4dcc9721b963beb95df09dedf848260cbc1ebfdc7408218eaba6d2c51928cd37c4c0c9f321fbb0994a56947cfd9643056db5dbea60a241f8f004c932bc8e645b2ec2eb9bc4e9e2f4156293234d05e70cb26b8a370b0206c756bda6defc11c5eb386640f535a4ffb714168defc6d82f40d8f5ba8768537ead5773c53bd779ca899a2dd31c9138569ff5107c2fb12b804375c3b3dc9b828bfd550328adf358f71e86a0c49fb119f5ef9e06c13855cbfc7d1a62ca2ea655ed912a6dc7bb8b18656e8923fc7a1702ab36947d79384d681c31923e98cf40209f776bc2b219a7ccd139e756a905aa351e6eaae90770c8a193f96cd5c66e4d77a357985556e14333716d80204a5c390e0d76f4081afe917f99ad8a0976b3342f51854b374b4baa9a7f22124d2b82749446e30d9795acb9c3c3a305a6d273ac528e8e9c95c37a78e765fdda55982c2961fbc85a14fc095a78b4654ee6dfc3298749a639ab9c8e155af3a77f8a409ce174532a492ef550a140f774d77d732b3b4ca5bc41fa4488ce5957ce219b032ae1f585273748d81b19edcf3e6cb9a93ec24e41c6b3c472f9baf3ca46cb8b9a91df18acebe7d83bd4473750c4f26806da2f95b9ea48b342460af729ab15e9f033eda67feec645f985d4b9489cf6ceec1b100d007bf46c74be53c7ea17296f9c5b5cbae736491213c93b513009ebdecfcd60d46d7b86c6e3b5e288f2ba5867c07936e7bd1b00de52191eb8630ff82ccafb27a59295164751811bf74eff1e5e2abdf3c93bc5dc9814be83b2562477935e2fa30db7ebb6ec380170cf10c1f98f8c5eb71c730c2b31b55a1dd1c12a64802ab95b63c529e0a96cec8f38680221d6089926d8309796c79994d63b67bfb62f66b4a502f30ed12be41e896e88bc45a160a526fbd5f002e677322f116ec5740d7563cd23ee853c008b84998e38fdf158556e28a532573956e7c00f91f08ca245c295a3d5e003a99ea727f61d12893b435d4c8f2f5cce00c6a3091e2a47f290c07168975c53d7529b71d10faf42d2bac9db8d53669cf59c709c25e9e40b5feaed4c37dde8b84c4961c00712326fb6aaa06e80d766b40b72480f3971def61d1d129676df2478e778d899ed317426ec33e496d1fdd2ec27128f8faee92828e13da72d6aee8330a7988ea1cc8b64ec4d8b20990864c16c52c4be6d00b304b87d97bffdd9c66a740b517223089d9f3f414abedc53c768dab9220b980e6c18d5f20ba8994cc8886d7bdee213442f456d79fce1b1eb48fbf600a666c8ade24d118e6328251cf7b57a6285c650e019850f392b1c29aec5c8fc489a3819d60d5de377d4c11b8ee5625b7c02c5d50d2af3397006f2e2a41a06f039229eef5878ed91f9f6be7e988924dbaeb8455f616275e8698d93fb536e2c839b203aa69bceceddbf9c53f8addba53d50ca0f7a4729a42ac6eb757f1b408ad4a0147546173e62f7621eb18a9e1681510cceb48e0a30ab7a1bf71d56742d5f034f2d725e7ea68a011dbb100fa6eefe4ee093873de366d34f4240ca027a25c5b979c9ac47dd1dcb6ed82c4aee09dcc23cf329a8644f89b5cf00e5683934b1837574e9b39b31b1009f276e15aa040959fdf100838ca3f5ab17e45036668d06044e3a13f3a0a6f68579e50d5b0164f900d7bcfcde78396cf30f0b1dff76dc397ab1a5a44b207eb1eaaf73b945c575029ae2dce20724991e6550155ded6a42672609f2439c5aab4882b2ffaf7da787b71d05d15516bd68c6f1a9d79b675395845f24ee853f877e72c14b6c6702f7b8775ca1bfabbbcf4019f7bccf07f1c211531dfc66a7a1df79e92a20dd1cbe1b22e1209e7e3ecb9d3c2450fc22a57bfe09bd735f61c361cdac2488ae0adc7885edc0712655daaf535e1de96ccbe7869d531d8bf3db512fbd17c772332a3f8cf1e052ee0202eb99a36a0f8d7219888acbb57090cdaf3b28e1e62e8fc2ec237bdf18592a7afe4d8390dcb5e7fcc31bf4f797e6f5710070902265cc2e8c459b7da1451046abd6c8c5b02c0be2d2f505a65376266563ac7b59ef3b4e2570a6cb0bd94d46ad861317c743ce1de12bfa2295a98cdded4414d87a1580b1e4675bbdf73a22cac4a1d8d456d089e0b60cbfd16158f073bd1dac481db49fa5d8801d0fb0844b4afec1bab4e61fa0f381fa667880a1cd8163953be7b591cc9dfd7f91902370b783ae8a0f3c7cbefa7d229a37c00f523529e159b11d2e240629b64af2d11404773e991207a722c320221ce23baed7cbe40a440c5680814b122cfba9092fe03478f85adcbdeacb76d6cbf2491eafae98327b278e267821a0e1cd06ef90cb0328e246c19d8c63b9332291a89bc9f989effc675c79a870ac024756c6f5a7e32babd69625d61487ae7399490b70dd0fade7d70ad9b0757300a2dde77abaff4f63a0303853589d44efa968e10d36561f04408ad0cc227fc6b2f904cead189a0fcca9b2e6cbde5498652e0b3bc9d8b7921474403718feb5cc750dc70f5a9b1a0ae2c642015b6a1a8ab0572182b4e39e0c869cbdc60c9465f5d564d18ba2f5b3bc3e05a458744077430c5ea031ee02dd8f0a65d7dd8d90dd9b8717f77d202239a5778719423fb2aec7ca86eb07c39de65a34b988d65377a7473e9145f16d79593e96903330bbf3a8024fc15519d9baa0fae2018786f4b1846fca355ff0fccf65cccad1896309a5ccf2056dd542c929850cc91cd655962360fe316557ab3fb378328f77a07d9da24447d3fa2020b382ed2e808ec9529a01273434c64b0b7c35a06a019e4ab51cdc9c0f266ab25b6984338a0ba910d1060283b636c5d7e8a3f969c1ee1c99b54bba7ff3679fbeecbb70349f076480a867cc4ee4cacaea39c80f642533599486d2ffb77b8c9109a9d25fa0b06e58eca764f7d56469eb9547036bbea9d5c3d35b4c1fbc3d39a372c2b7ad184965cad3819c8928f1588d00949949c0c4c93d30ac7f6665247c0108bd89dff3aafe780ac66febfacc8c6a3cc387d09da6de700487a80e2c8d56df94d7ebd3e1d9e06411a6c5f7eb6da41c6f52997b5ad47ba985261103fdf12eb4a2828b248f652ef00b6abccab2eb161b878b9dbc0aa911405b6f67adda83c16187748d7b524ffe6381f489f432d592e6171bd9ccb2cd52f977143f57fbf2ab0b823d449ae55f02440972334344cda01837b93afa4f46a2fdefe27e92764cf9596780846de2e3b1ea83e62ee43b1c05aee675e25363504addfaa68e7c53ed685413f5ba951f120d0a646e474872c81e5a887464c19f8460ae814ffff24cb51dd2dca28d597ab2ea60949f8dbbe67f263e722fdb51bce4e328a19f5ff1218e1f63b8da6d40dbd5490964499b2522ea323310634893ead661407966207a66ab13adfcf1a725ed14339c46011c0e0401f2386b47cd9f902fdf84bc85e74d3ae7cc544e4d65670a554a537712c6ee9f75191631d2a4c4da06fc38423b1d5b828d7201235b2974164f52aa16bee70ee509250752f4fdd6b9f8d021943df8320682a6f80ff0d67ab7a4ceea807bd5b3b7b6380b0c7f0caa67b0208ba71317f0355a3b755af0e2c007186389438615df80b7b25104a733fc90625b62682198733c0f1625dfaa08cf81e3df043094b7b5a098b3b36f803b5b0f10a057bf814ae3579932c0a5f208985bab3d817f975283b8838ae5cb709be72b58df7425e059fdbf4e0ee51b3da01fe0b44963c1196baee5ec5909ad80d9d1660f3edd90374952a0bf8b3bece2c2f944593f4de7de5e05ded096b8f4f05d65dfc2e806f78220d84b3db564fb12f4e5e8f5eab316591f004e9374cce8e787263bc3827affe6793c130b8621d3bbb2a86fd87f070ea21718281ee7aec4bb3bb71af4bf5721cecd139c4be8c9df4ec8dfb09a5cf1d86a25d39faa9f064a997c214f334e4410917fc3b4d67ada8d87a38c0f86b02bf653dddaeb5b75b300f8bcfd792858bef8ab23e063421939c59212964c9ed5dd56e215db58cef53d31a966bb8ce4ed56287fecb3a85ba435e0b41b20ba1164b9c9f2c49fa0f7b17a89e0ec47eefe992d63ee29c8c0a1ece2664fee8edadd43636a54c48519b4fcf55b0d9103602b92441a5f85cf8c5e406d0f5815f8f37309934bd78fbc2acf0a03b051b4528db4f7c09de7d0aabafca3736b8259c818ca338ca6754e0747717c2794d664a1cacc1e9c52764a308e6df73d975638630b74cce6c49b1bac16454e96852c4f9d8ed118e86d2f1c8dc33bccd4a07be128db5e80f5684ddcc1158e744411acde590f902f0987cfb750bb5bfeed53bff076868986b566d7701f48ddfcacbd325c8d930bcef26713bf60585d5c991e2a6cc33ccbc27f7ddfba18f998497c2eb378cc8f2cc07a1b4f141c5e0fb6f52e18242e505bcf6dd20e33a469d056a0b4fd5e72d0da9d0bcce1e2f9e9dc7d1c7b6cb0f3604287eca00", 0x2000, &(0x7f00000000c0)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, &(0x7f0000000440)={0x90, 0x0, 0x2, {0x2, 0x0, 0x0, 0xa6, 0x4000, 0x0, {0x3, 0x0, 0x101, 0xfffffffffffffffe, 0x1, 0x0, 0x0, 0x1, 0x3ff, 0x6000, 0x0, 0x0, 0xee01, 0x801}}}, 0x0, 0x0, 0x0, 0x0, 0x0}) 10m25.58742121s ago: executing program 7 (id=3015): r0 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r0, &(0x7f0000000080)={&(0x7f0000000000)=@rxrpc=@in4={0x21, 0xfffc, 0x2, 0x10, {0x2, 0x4e20, @remote}}, 0x80, 0x0, 0x0, &(0x7f0000000540)=ANY=[@ANYBLOB, @ANYRESDEC=r0], 0x18}, 0x0) r1 = syz_open_dev$admmidi(0x0, 0x20, 0x0) r2 = openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000080), 0x80383, 0x0) read$midi(r1, 0x0, 0x0) socket$nl_generic(0x10, 0x3, 0x10) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000480)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x2, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r3}, 0x10) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x100}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) kcmp(r4, r4, 0x4, r0, r1) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) ioctl$SNDCTL_SEQ_PANIC(r2, 0x5100) read$midi(r1, &(0x7f0000000380)=""/246, 0xf6) 10m24.614852827s ago: executing program 7 (id=3017): r0 = socket(0xa, 0x3, 0x3a) setsockopt$MRT6_ADD_MFC_PROXY(r0, 0x29, 0xd2, 0x0, 0x0) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000001c0)={0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="01000000000000005e0000000000000000000f300f222566baf80c7741364a81143a3d420f07b8010000000f01c1f20f22e666b8530000000000d95d22dcaf15e8da00000000000000000000000000000000000000000000000000000000ac"], 0x5e}) (async) r1 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x80202, 0x0) r2 = ioctl$KVM_CREATE_VM(r1, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r2, 0x4020ae46, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x20002000, &(0x7f0000000000/0x2000)=nil}) fsetxattr$trusted_overlay_origin(r2, &(0x7f0000000200), &(0x7f0000000380), 0x2, 0x0) (async) r3 = ioctl$KVM_CREATE_VCPU(r2, 0xae41, 0x0) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async) ioctl$KVM_CAP_HYPERV_SYNIC2(r3, 0x4068aea3, &(0x7f0000000300)) syz_kvm_add_vcpu$x86(0x0, &(0x7f0000000100)={0x0, &(0x7f0000000840)=ANY=[@ANYBLOB="0100000000000000530000358c30"], 0x53}) (async) ioctl$KVM_SET_USER_MEMORY_REGION(0xffffffffffffffff, 0x4020ae46, &(0x7f0000000040)={0x0, 0x5, 0xd000, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_IRQCHIP(0xffffffffffffffff, 0x8208ae63, &(0x7f0000000600)={0x0, 0x0, @pic={0x2a, 0xc0, 0x7, 0x6, 0xfb, 0x0, 0xf, 0x4, 0x3, 0x0, 0x3, 0x58, 0x90, 0x5, 0x9, 0x7f}}) (async, rerun: 32) syz_kvm_add_vcpu$x86(0x0, &(0x7f00000000c0)={0x0, &(0x7f0000000280)=ANY=[@ANYBLOB="00000000000000001800000000000000070000000000000001000000000000006b00000000000000c463"], 0x2de}) (async, rerun: 32) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) (async, rerun: 64) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) (async, rerun: 64) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) r4 = syz_open_dev$MSR(&(0x7f0000000580), 0xa, 0x0) read$msr(r4, &(0x7f0000019680)=""/102392, 0x18ff8) connect$bt_sco(0xffffffffffffffff, &(0x7f00000007c0), 0x8) (async, rerun: 64) ioctl$KVM_RUN(r3, 0xae80, 0x0) (async, rerun: 64) r5 = syz_open_procfs(0x0, &(0x7f0000000000)='sched\x00') writev(r5, &(0x7f00000001c0)=[{&(0x7f0000000240)="e869", 0x2}], 0x1) (async) syz_usb_connect(0x0, 0x24, &(0x7f0000000700)=ANY=[@ANYRESDEC], 0x0) r6 = syz_genetlink_get_family_id$ethtool(&(0x7f00000003c0), r5) r7 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r7, 0x8933, &(0x7f0000000000)={'bond0\x00', 0x0}) sendmsg$nl_route(r7, &(0x7f0000000440)={0x0, 0x0, &(0x7f0000000580)={&(0x7f00000001c0)=ANY=[@ANYBLOB="5c00000010000304000000000000000000000400", @ANYRES32=r8, @ANYBLOB="60bc010004a701003c00128009000100626f6e64000000002c"], 0x5c}, 0x1, 0x0, 0x0, 0x11}, 0x4000044) sendmsg$ETHTOOL_MSG_RINGS_GET(r0, &(0x7f00000004c0)={&(0x7f0000000080)={0x10, 0x0, 0x0, 0x4000}, 0xc, &(0x7f0000000480)={&(0x7f0000000440)={0x34, r6, 0x8, 0x70bd2d, 0x25dfdbfd, {}, [@HEADER={0x20, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r8}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'vlan0\x00'}]}]}, 0x34}, 0x1, 0x0, 0x0, 0xf4a6d1ba7b469c21}, 0x20000000) 10m20.504968357s ago: executing program 7 (id=3023): mkdirat(0xffffffffffffff9c, &(0x7f0000000040)='./file0\x00', 0x0) mount$bind(&(0x7f0000000380)='./file0\x00', &(0x7f0000000200)='./file0\x00', 0x0, 0x2125099, 0x0) mount$bind(0x0, &(0x7f00000005c0)='./file0\x00', 0x0, 0x100000, 0x0) r0 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r0, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000040)={0x2, 0x4e22, @broadcast}, 0x10) setsockopt$sock_int(r1, 0x1, 0x800000000f, &(0x7f0000000080)=0x7, 0x4) r2 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$sock_int(r2, 0x1, 0xf, &(0x7f0000000000)=0x2, 0x4) bind$inet6(r2, &(0x7f00000000c0)={0xa, 0x4e22, 0x3, @ipv4={'\x00', '\xff\xff', @broadcast}, 0x35}, 0x1c) listen(r1, 0x0) listen(r2, 0x0) mount$bind(&(0x7f0000000000)='./file0/../file0\x00', &(0x7f0000000340)='./file0/file0\x00', 0x0, 0x891018, 0x0) mount$bind(0x0, &(0x7f0000000140)='./file0/file0\x00', 0x0, 0x80000, 0x0) mount$bind(&(0x7f0000000100)='./file0\x00', &(0x7f0000000280)='./file0/../file0\x00', 0x0, 0x1adc51, 0x0) mount$bind(&(0x7f00000002c0)='./file0/file0\x00', &(0x7f0000000240)='./file0/../file0\x00', 0x0, 0x101091, 0x0) 10m20.378438962s ago: executing program 7 (id=3026): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000140)=ANY=[@ANYBLOB="170000"], 0x1c}, 0x1, 0x0, 0x0, 0x40}, 0x24040000) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x1) add_key(&(0x7f0000000140)='encrypted\x00', 0x0, &(0x7f0000000100), 0x0, 0xfffffffffffffffe) 10m19.464875566s ago: executing program 7 (id=3029): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newtaction={0x18, 0x30, 0x800, 0x70bd2b, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() openat$sysfs(0xffffffffffffff9c, 0x0, 0x212282, 0x2d) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$sock_timeval(r0, 0x1, 0x42, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/mnt\x00') r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020025797a31000000000900010073797a3000000000080005400000001c"], 0xe8}}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) 10m19.327559692s ago: executing program 36 (id=3029): socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=@newtaction={0x18, 0x30, 0x800, 0x70bd2b, 0x0, {}, [{0x4}]}, 0x18}, 0x1, 0x0, 0x0, 0x804}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) getpid() openat$sysfs(0xffffffffffffff9c, 0x0, 0x212282, 0x2d) r0 = syz_init_net_socket$bt_rfcomm(0x1f, 0x3, 0x3) setsockopt$sock_timeval(r0, 0x1, 0x42, 0x0, 0x0) socket$can_raw(0x1d, 0x3, 0x1) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r1 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r1, &(0x7f0000019680)=""/102392, 0x18ff8) syz_open_procfs$namespace(0x0, &(0x7f0000000240)='ns/mnt\x00') r2 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r2, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20000000000a03000000000000000000070000000900010073797a30000000004c000000090a010400000000000000000700000008000a40000000000900020025797a31000000000900010073797a3000000000080005400000001c"], 0xe8}}, 0x0) sendmmsg$unix(0xffffffffffffffff, &(0x7f0000000000), 0x400000000000041, 0x0) socket$inet6_udp(0xa, 0x2, 0x0) 21.576620736s ago: executing program 9 (id=4819): socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$batadv(&(0x7f0000000400), 0xffffffffffffffff) prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r0 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000180)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xc, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b70800006509dc5f558d29ca679cf6070000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b70400295a00000085000000820000009500000000000000"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x3a, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) socket(0x2, 0x80805, 0x0) shutdown(0xffffffffffffffff, 0x0) getsockopt$inet_sctp6_SCTP_PRIMARY_ADDR(0xffffffffffffffff, 0x84, 0x7a, &(0x7f0000000340)={0x0, @in6={{0xa, 0x3, 0x4, @mcast1}}}, &(0x7f0000000040)=0x84) connect$netrom(0xffffffffffffffff, &(0x7f0000000000)={{0x6, @null}, [@netrom={0xbb, 0xbb, 0xbb, 0xbb, 0xbb, 0x0, 0x0}, @bcast, @null, @null, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @default, @bcast]}, 0x48) connect$netrom(0xffffffffffffffff, &(0x7f0000000080)={{0x6, @rose}, [@rose={0xbb, 0xbb, 0xbb, 0x1, 0x0}, @bcast, @default, @default, @remote={0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0xcc, 0x0}, @rose={0xbb, 0xbb, 0xbb, 0x8, 0x0}, @default, @bcast]}, 0x10) r3 = syz_open_dev$tty1(0xc, 0x4, 0x1) ioctl$VT_RESIZEX(r3, 0x560a, &(0x7f00000006c0)={0x6600, 0x0, 0x0, 0x20, 0x132, 0x3}) 17.34887309s ago: executing program 9 (id=4835): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40000000e, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000000)={0x3e, 0x2, 0x457f1c9146f8f874, "464905e100000000000000007f00", 0xb5315241}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@newtaction={0x13c, 0x30, 0x100, 0x70bd2b, 0x25dfdbff, {}, [{0x128, 0x1, [@m_gact={0x74, 0xb, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x2, 0x16fb, 0x2}}]}, {0x39, 0x6, "7a26c822056c1c92d4a391d4edd403e7c642c1fad2a36600ccbe7be76abd06be0c4b006715609ea9569047075943f1943d7ddf491f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_sample={0xb0, 0x10, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x3}]}, {0x79, 0x6, "5c284c3a3976241974df53e1d3b1cccfebd3f123dec3f372dd21566159734af29ce5d14ed6f7073420a1d585c18bbb14dabd87303b46d5802bd94ac81b53ad5bb23b64e5f966aeb3d264d2a1b41a1911920ce0a01624236b1a6243c02b4d0154443183978c1a333bb541216eef42a751f212ed3cf3"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x13c}}, 0x0) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x13}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) syz_init_net_socket$ax25(0x3, 0x3, 0xcc) fanotify_mark(0xffffffffffffffff, 0x601, 0x30, 0xffffffffffffffff, 0x0) socket$kcm(0x2c, 0x3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r5, 0x0, 0x0) recvmsg(r5, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r6 = syz_open_dev$radio(&(0x7f0000000140), 0x0, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r6, 0xc0405665, &(0x7f00000000c0)={0x0, 0x1, 0x7, 0x8, 0x2, 0x100059a, 0xbfc4bb97dfede4bd}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) socket$nl_route(0x10, 0x3, 0x0) 16.239192822s ago: executing program 9 (id=4838): prlimit64(0x0, 0xe, 0x0, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs={0x0, 0x0, 0xfffffffe}, 0x6e) sendmmsg$unix(r2, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r3 = syz_open_dev$vcsa(&(0x7f0000000040), 0x1, 0x40002) writev(r3, &(0x7f0000000c40)=[{0x0}, {&(0x7f00000005c0)="c21cfb", 0x3}, {&(0x7f00000007c0), 0x300}, {&(0x7f0000000900), 0x4000}], 0xe) 11.796990708s ago: executing program 8 (id=4851): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xd, &(0x7f0000000d40)=ANY=[@ANYBLOB="180000000000e3ff000000000000000018110000", @ANYRES32=r0, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000001000000850000000700000095"], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r2 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000080)='attr/fscreate\x00') socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x6, 0x8b}, 0x0) r4 = syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') ioctl$sock_inet6_tcp_SIOCINQ(r4, 0x541b, 0x0) dup(r4) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=@bloom_filter={0x1e, 0x5, 0x5, 0x3ff, 0x6, r4, 0x7, '\x00', 0x0, r2, 0x3, 0x0, 0x1, 0xc}, 0x50) r5 = bpf$MAP_CREATE(0x0, &(0x7f00000009c0)=ANY=[], 0x50) socketpair$unix(0x1, 0x1, 0x0, &(0x7f0000000280)) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000400)={0x11, 0xd, &(0x7f00000004c0)=ANY=[@ANYBLOB="1800000000000000000000000100000018110000", @ANYRES32=r5, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000000008500000003000000850000002300000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$MAP_UPDATE_BATCH(0x1a, 0x0, 0x0) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='tlb_flush\x00', r6}, 0x10) ioctl$PPPIOCNEWUNIT(0xffffffffffffffff, 0xc004743e, &(0x7f0000000140)) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x2) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r7 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r7, &(0x7f0000019680)=""/102392, 0x18ff8) r8 = socket$inet6(0xa, 0x80002, 0x0) setsockopt$inet6_udp_int(r8, 0x11, 0x67, &(0x7f0000000200)=0x3, 0x4) connect$inet6(r8, &(0x7f00000001c0)={0xa, 0x4e23, 0x0, @ipv4={'\x00', '\xff\xff', @dev={0xac, 0x14, 0x14, 0x20}}, 0x400}, 0x1c) setsockopt$sock_linger(r8, 0x1, 0x3c, &(0x7f0000000180)={0x200000000000001}, 0x8) connect$inet6(r8, &(0x7f0000000000)={0xa, 0x0, 0xfffffffd, @local, 0x2}, 0x1c) sendmmsg$inet6(r8, &(0x7f0000003cc0)=[{{0x0, 0x0, &(0x7f0000003980), 0x171}}], 0x400000000000172, 0x4001c00) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000600)={&(0x7f00000005c0)='sys_enter\x00', r1}, 0x10) ioperm(0x9, 0x9, 0x7) 11.089879291s ago: executing program 9 (id=4854): socket$nl_generic(0x10, 0x3, 0x10) r0 = socket$alg(0x26, 0x5, 0x0) bind$alg(r0, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cbcmac(des-generic)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r0, 0x117, 0x1, &(0x7f0000000080)="4dc07f947163300c", 0x8) getrusage(0x0, 0x0) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) r1 = syz_init_net_socket$bt_l2cap(0x1f, 0x2, 0x0) connect$bt_l2cap(r1, &(0x7f0000000080)={0x1f, 0x0, @fixed={'\xaa\xaa\xaa\xaa\xaa', 0x10}, 0x7ff}, 0xe) r2 = syz_init_net_socket$bt_hidp(0x1f, 0x3, 0x6) ioctl$sock_bt_hidp_HIDPCONNADD(r2, 0x400448c8, &(0x7f0000000340)={r1, r1, 0x8, 0x0, 0x0, 0x82, 0x4a, 0x15c2, 0x5886, 0x801, 0x0, 0x8, 'syz1\x00'}) shutdown(r1, 0x1) r3 = creat(&(0x7f0000000200)='./file1\x00', 0x12e) r4 = syz_usb_connect$hid(0x0, 0x36, &(0x7f0000000040)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x8, 0x41e, 0x2801, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x4, 0x0, 0x0, 0x1, 0x3, 0x0, 0x0, 0x0, {0x9, 0x21, 0x0, 0x2, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x200, 0x3}}}}}]}}]}}, 0x0) syz_usb_control_io$hid(r4, 0x0, 0x0) syz_usb_control_io(r4, &(0x7f00000001c0)={0x2c, &(0x7f00000000c0)=ANY=[@ANYBLOB="0000058cfd3204869e7ae55c247d0d76d436861f4c7501d487dd00"/42], 0x0, 0x0, 0x0, 0x0}, 0x0) close(r3) r5 = socket(0x2, 0x80802, 0x0) shutdown(r5, 0x0) r6 = socket(0x10, 0x803, 0x0) ioctl$sock_SIOCETHTOOL(r6, 0x8946, 0x0) r7 = fsopen(&(0x7f0000000140)='mqueue\x00', 0x0) fsconfig$FSCONFIG_CMD_CREATE(r7, 0x6, 0x0, 0x0, 0x0) r8 = fsmount(r7, 0x0, 0x0) fchdir(r8) r9 = inotify_init1(0x80800) inotify_add_watch(r9, &(0x7f0000000080)='.\x00', 0x2000434) mq_open(&(0x7f00000004c0)='!\x7f\x00\xca\x00\x00\x00\f\x00\x00\x01E!T\xednux\x02\xc7\x12\xec\xca7\xbc\x1fS\x1c\x05y\x91\xe5\x9aL\xa9u\b\x00\x00\x00\xa0pC\x19\x9b\vY\x186\xa4\xe7\x1eg{`\xfa\xf3n\x8fIj6f\xfb\x13-g\x19(a6\x18\xe24nz\x83w8\xff\xfb\x83\f\x9a\xda\xc5w\x8eo\x02\xa3\xc1\x83\x91\xc6\xfd\x8c\xc4s\x03\x16\xa4+\xce|^\x98K_0\x8a\xb0\xff~\x1e\xd92\xb4r\xd8\xe7', 0x40, 0x110, 0x0) r10 = fsopen(&(0x7f00000002c0)='ext4\x00', 0x0) mount$9p_fd(0x0, &(0x7f0000000000)='./file1\x00', &(0x7f0000001200), 0xa, &(0x7f0000000180)=ANY=[@ANYBLOB="66646ee200", @ANYRESHEX=r3, @ANYBLOB=',wfdno=', @ANYRESHEX=r10, @ANYBLOB=',\x00']) 10.62405411s ago: executing program 8 (id=4855): openat$iommufd(0xffffffffffffff9c, &(0x7f0000000000), 0x28000, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$vim2m(&(0x7f0000000040), 0x40000000e, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r2, 0xc0405602, &(0x7f0000000000)={0x3e, 0x2, 0x457f1c9146f8f874, "464905e100000000000000007f00", 0xb5315241}) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f00000004c0), 0x0, 0x0) ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000480)={&(0x7f0000001fc0)=@newtaction={0x13c, 0x30, 0x100, 0x70bd2b, 0x25dfdbff, {}, [{0x128, 0x1, [@m_gact={0x74, 0xb, 0x0, 0x0, {{0x9}, {0x10, 0x2, 0x0, 0x1, [@TCA_GACT_PROB={0xc, 0x3, {0x2, 0x16fb, 0x2}}]}, {0x39, 0x6, "7a26c822056c1c92d4a391d4edd403e7c642c1fad2a36600ccbe7be76abd06be0c4b006715609ea9569047075943f1943d7ddf491f"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x2, 0x1}}}}, @m_sample={0xb0, 0x10, 0x0, 0x0, {{0xb}, {0xc, 0x2, 0x0, 0x1, [@TCA_SAMPLE_PSAMPLE_GROUP={0x8, 0x5, 0x3}]}, {0x79, 0x6, "5c284c3a3976241974df53e1d3b1cccfebd3f123dec3f372dd21566159734af29ce5d14ed6f7073420a1d585c18bbb14dabd87303b46d5802bd94ac81b53ad5bb23b64e5f966aeb3d264d2a1b41a1911920ce0a01624236b1a6243c02b4d0154443183978c1a333bb541216eef42a751f212ed3cf3"}, {0xc, 0x7, {0x1}}, {0xc, 0x8, {0x1, 0x2}}}}]}]}, 0x13c}}, 0x0) r4 = socket(0x10, 0x803, 0x0) sendto(r4, &(0x7f0000000740)="120000001200e7ef007b00000000000000a1", 0x12, 0x0, 0x0, 0x0) recvmmsg(r4, &(0x7f00000037c0)=[{{&(0x7f00000004c0)=@ethernet={0x0, @random}, 0xfdf4, &(0x7f0000000380)=[{&(0x7f0000000140)=""/100, 0x365}, {&(0x7f0000000280)=""/85, 0x7c}, {&(0x7f0000000fc0)=""/4096, 0x197}, {&(0x7f0000000400)=""/106, 0x645}, {&(0x7f0000000980)=""/73, 0x1b}, {&(0x7f0000000200)=""/77, 0x334}, {&(0x7f00000007c0)=""/154, 0x13}, {&(0x7f00000001c0)=""/17, 0x1d8}], 0x21, &(0x7f0000000600)=""/191, 0x41}}], 0x4000000000003b4, 0x0, &(0x7f0000003700)={0x77359400}) syz_init_net_socket$ax25(0x3, 0x3, 0xcc) fanotify_mark(0xffffffffffffffff, 0x601, 0x30, 0xffffffffffffffff, 0x0) socket$kcm(0x2c, 0x3, 0x0) r5 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r5, 0x0, 0x0) recvmsg(r5, &(0x7f0000000980)={0x0, 0x0, 0x0}, 0x0) sendmsg(r1, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x8) r6 = syz_open_dev$radio(&(0x7f0000000140), 0x0, 0x2) ioctl$VIDIOC_ENUM_FREQ_BANDS(r6, 0xc0405665, &(0x7f00000000c0)={0x0, 0x1, 0x7, 0x8, 0x2, 0x100059a, 0xbfc4bb97dfede4bd}) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) munlockall() madvise(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x15) socket$nl_route(0x10, 0x3, 0x0) 8.852939333s ago: executing program 4 (id=4859): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) connect$inet6(0xffffffffffffffff, 0x0, 0x0) ioctl$SG_IO(0xffffffffffffffff, 0x2285, 0x0) write$sndseq(0xffffffffffffffff, 0x0, 0x0) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000300)=ANY=[], 0x50) bpf$MAP_LOOKUP_ELEM(0x1, 0x0, 0x0) epoll_create1(0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000880)={0x3, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r1) openat$ppp(0xffffffffffffff9c, 0x0, 0x0, 0x0) 8.381383463s ago: executing program 8 (id=4860): prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f00000020c0)={0x0, 0x0, &(0x7f0000002080)={&(0x7f0000001f40)=ANY=[@ANYBLOB="4c0000001f000101fbcc4d8ffcdbdf25030000000000000000000000000000bb000004d30a00330000000000040000000000ffff000000000b000000003500000c00150059073500a153ffff"], 0x4c}, 0x1, 0x0, 0x0, 0x200048c1}, 0x20000840) r1 = bpf$PROG_LOAD(0x5, &(0x7f0000010a80)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000001afc180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000002000000b703000000090000850000000400000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x4, '\x00', 0x0, @fallback=0x2a, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3c}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000000c0)={&(0x7f0000000080)='sched_switch\x00', r1}, 0x10) r2 = bpf$PROG_LOAD(0x5, &(0x7f0000000b40)={0x11, 0x8, &(0x7f0000005c00)=ANY=[@ANYBLOB="620af8ff0c200021bfa100000000000007010000f8ffffffb702000003000000bd120000000000008500000006000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4f698393aa0f3881f9c24aa56f15199fad0093c59d66b5ece9f36c70d0f13905ea23c22624c9f87f9793f50bb546000677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64f751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07a72c234664c0af9360a1f7a5e6b607130c89f18c0c1089d8b853289d01aa27ae8b09e00e79ab20b0b8e1148f49faf2ad0000000000000006fa03c6468972089b302d7bf6023cdcedb5e0125ebbc08dee510cb2364149215108333719acd97cfa107d40224edc5467a932b77674e802a0d42bc6099ad238af770b5ed8925161729298700000080006ef6c1ff0900000000000010c63a949e8b7955394ffa82b8e942c89112f4ab87b1bfeda7be586602d985430cea0162ab3fcf4591c926abfb076719237c8d0e60b0eea24492a660583eecdbf5bcd3de3ac3209da17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c95c25a573dc2edcaea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b5b7632f32030916f89c6dad7603f2ba2a790d62d6faec2fed44da4928b30142ba11de6c5d50b83bae613402216b5054d1e7c13b135ab6f4a8245ffa4997da9c77af4c0eb97fca585ec6bf58351d564beb6d952aab9c70764b0a8a7583c90b3433b809b5b9fbd48bc873495cbff8a326eea31ae4e0f7505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223a0eb4fa39f6b5c02e6d6d90756ff57902a8f57000000009700cf0b4b8bc2294133000000000000000000030000000000000000000000000010008bc0d9559711e6e8861c46495ba585a4b2d02edc3e28dd271c896249ed3957f813567f7a95435ac15fc0288d9b2a169cdcacc413b48dafb7a2c8cb482bac0ac559eaf39027ceb379a902d9ba96ffffff7f0000100000000000007d5ad897ef3b7cda42013d53046da21b40216e14ba2d6ad5656bfff17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385beef3282830689da6b53b263339863297771429d120000003341bf4abacac94500fca0493cf29b33dcc9ffffffffffffffd39f6ce0c6ff01589646efd1cf870cd7bb2366fdf870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d10a64c1083d5e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78100788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4ce0232fcea69c271d7fa29822aea68a660e717a04becff0f719197724f4fce1293b62d7e8c7123d8ec571be54c72d978cf906df0042e36acd37d7f9e119f2c06f815312e0cfe222a06f56dd000c074eb8a322fb0bf47c0a8d154b405c37feaf3dd95f6ef2acd1fe582786105c7df8be5877050c91301fb997316dbf17866fb84d4173731efe895ff2e1c55ef08235a0126e01254c44060926e90109b598502d3e959efc71f665c4d75cf2458e3542c9062ece84c99a861887a20639b41c8c12ee86c50804042b3eac1f879b136345cf67ca3fb5aac518a75f9e7d7101d5e186c489b3a06fb99e0aa7f23a054de2f4d92d6bd72ee2c9fdc74aaaf1e3e483b4ad05573af40326993947d9a631bcbf3583784acbda216550d7ad333545794f37331766e472391e358c3b377327ac9ecc34f24c9ae153ec60ac0694dc55bff9f5f4df90400000000000000d6b2c5ea139376f24285bf16b99c9cc0ad1857216f1a985f369191ae954febb3df464bfe0f7f3ee9afe7befb89d2777399f5874c553aeb3729cffe86e66964ae09bb6d163118e4cbe024fd4500f8e3070000001e48418046c216c1f895778cb25122a2a998de0842a486721737390cbf3a74cb2003016f1514216bdf57d2a40d40b51ab63e96ec84ac3571f02f647b3385b3b8a8c9ae3d14f93100c2e0893862eef552fcde2981f48c482bde8a168c3f5db2fea6f26e4a4304e50c349f4f9ecee27defc93871c5f99b355b72d538ba2f58ea8e4aa37094191e10096e7e60fc3541a2c905a1a95e9571bf38ae1981c4238ecaee6f75cd0a6881bd1517a8250df986741517abf11389b751f4e109b60000000000000000d6d5210d7560eb92d6a97a27602b81f76386f1535bef1497f92186086e29c6bc5a1fad6ec9a31137abf9a404abde7750890ae71555b3228b1bd627e87306703be8672d70d1ab57075228a9f46ed9bd1f08fb8191bbab2dc51de3a61f0868afc4294859323e7a45319f18101288d139bd3da230ed05a8fe64680b0a3f9f2dd704e4214de5946912d6c98cd1a9fbe1e7d58c08acaf30235b9100000000a55f74a23641f61f2d5b308cf0d031b0c7f0ced69993e9960ff5f76015e6009756237badf4e7965bbe2777e808fcba821aa8e8c5c39609ff854356cb4900000000000000000000000000c1fee30a3f7a85d1b29e58c776f4b4ce07e1c6fa66fcfc7a228805f76785efc0ceb1c8e5729c66418d169fc03aa18854693ad2a182068e1e3a0e2505bc7f41019645466ac96e0d4b3bc19faa5449209b083dbd334b47f067bbab40743b2a428f1da1f68df75cf43f8ecc8d3726602111b40e761fd21081920382f14d12ca3c3431ee97471c7868dcda7e478950aa69eb7f7f80572fdd11bb1d0d1280fbc22bf73468788df51710d7d31c632fc5ed1762eb0b428ee751c47d8e894f745a868404a0bf35f0121008b722b1eaa6aedfa1bf2e7ccb2d61d5d76331945e20fa26b8471d42645288d7226bbd9c9e9e1cc9eb3d541e407cc2dae5e690cd628ab848753203b458b97ec1afb079b4b4ba686fcdf240430a537a395dc73bda367bf12cb7d81691a5fe8c47be395656a297e9df0e71f96756ea5cce7db3c4be290159f6bcd75f0dda9de5532e71ae9e48b0ed1254a83100000000f6fbb869604d51a36a54c832e45b2569dc0d90b075225fde44c4e0973171ad47d6c30ebc660309e1e245b0fdf9743af932cd6db49a47613808bad959719c0000000000378ac2e24c7e800003c9e8095e02985f28e678f66422436f949e2ab8f162d7e3f855e378f4a1f40b0c6fb2d4b205a800b6d713acebc5b014e61a543a5a194f9ac18d76b5440e3b1a569e7397f6ca0400966d7ba19e720413267a6ccea9c439671d2c680f2753ca184eeeb843450368acb4383a01d25eb3d1e23e0f2645d1cdfa9fa410632f95a5f622f851c66ee7e3030108000000000000c4f93c0984b5c2d4523497e4d64f95f08493564a1df87111c9bffef97dcecc467ace456597685c5870d25f88a0f463db88d377442e1349acaf766218b54a9d624778e1c4cba6e6390a9f302c6eb2df7766411bef0ebb5000000000006065d6735eb7a00e127c0000000000000000000000bfb0bba79344643b1d8daa9f38e4b62c1e2af68c6f5054b078acd74b4a9c944e4505da485a3a4154387a0a88372091cd397b09c5888a06431df3f68abf0b366c4d5f8bea7b29c257ed756dff7a21c6b661cbdd43de65afd7f661d5c84f915c90e3d6ea012b68b787eb01d8320000000000000060176dacba0ec503a37fae6b472ec369c79ee6a420c0fd8d8d82fe136d5af6c30bfeb0a7275babfdb96a127aa9386e0671c6454245a18c1c8c49552cff5d27b547cdc34c0858c77a47a9ff86ee9fbd9ceda428716a4218821176d8067997527230fa67d26950d3e4f2750fa7c872874ad3a2d11f9f6eb08e6d7b6fa257b04d8ce36360f524e3dfd2211641f3d2637d86b80681eca50ce0eecafdd22d41fa515c15591e70ded4b70efac3cb42fb352d82e8f7573e8ed8248da356fa91a252976d3a4d8c1843a8d5bb7f5f1028453a0562a3ea93117076dd4940b7df50d78289fe66197525f6095f8662d232970bef61b03fa83027963a1a2e07cfee30c0d0b4c5877f93b3637ca21eab5afcf5d4638dfe8f9202aaad51c979049dd76d65368cbd4187d9f74257c7c4a23ac4a34eec5aa17e78c5167216f5e72138d20f8325dd5f8f96c32189c904eaef580987f1ce601a7cdc35461db9981ac42f9e24b0699bbe4e3d986e38952b0b7938eefd9e7a292bbb66367ad77045fdc18855c81c031dedd185c723238373fc698d676791d04f1ff5f0825a6619e844882f31ed190233d58ecee949e310bf2b1a51b8a33ae65a06d2b6ad386bf8dc49dd328bcd75d1843a13d68560175a18af7efc3c0f20e32f84f6aaaf000000000000000000000013a6c66bce74a8fb9092023df695da2714a7933d699d42de2bc4a85e0a0e22228290a7a7553ab93a16e42453ed86869a02df2f47d4088fac1772d3cd955c81cbf91c2ca7942942f61723b558079b82547844f92df2499c4b2c2ef2539e5daa8d8727baaa6b5755e6f83bbfca00000000000000000000007925d0f1256330b9e2aa9a18cea8e009116f63c6c7d8f7f95bf0f6731e5eb1dcdc534f357b9f08e7a9a3aebeca145d695053b5bef004ca24e6c57ed10f01488d38b8b0b68d93e3cf630837915d518fde2115e66615786fe7b9216de958119cf762cac77ac829a02f48e72c0d2841880b2c"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x8, &(0x7f0000000000), 0x0, 0x10, &(0x7f0000000000), 0xffffffffffffff7e}, 0x48) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000140)={&(0x7f0000000080)='sched_switch\x00', r2}, 0x10) socket$nl_netfilter(0x10, 0x3, 0xc) socket$nl_netfilter(0x10, 0x3, 0xc) socket(0x10, 0x3, 0x0) r3 = bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000009c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) r4 = bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x1e, 0xf, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r3, @ANYBLOB="0000000000000000b70200001400000bb7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f00000005c0)='syzkaller\x00', 0xfffffffe, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000200)={&(0x7f0000000700)='kfree\x00', r4}, 0x18) r5 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x8401) ioctl$BLKTRACESETUP(r5, 0xc0481273, &(0x7f00000002c0)={'\x00', 0x7ff, 0xfffffff9, 0xc, 0xfffffffffffffffd, 0x5a0, 0xffffffffffffffff}) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f00000007c0)=ANY=[@ANYBLOB="1b0000000000000000000000000004"], 0x48) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000002c0)=ANY=[@ANYBLOB="180100000000001c000000000000ea04850000007b00000095"], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x78) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000001c0)='memory.events\x00', 0x275a, 0x0) r6 = socket$inet_tcp(0x2, 0x1, 0x0) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000002c0)={0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x86, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x50) ioctl$sock_SIOCGIFINDEX(r6, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) r8 = bpf$MAP_CREATE(0x0, &(0x7f0000000600)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x50) r9 = bpf$MAP_CREATE(0x0, &(0x7f00000001c0)=@base={0xe, 0x4, 0x8, 0x1}, 0x48) r10 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x6, 0x10, &(0x7f0000000280)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b702000002000000850000008600000018110000", @ANYRES32=r9, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bca2000000000000a6020000f8ffffffb703000008000000b704000000000000850000003300000095"], &(0x7f0000000180)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @xdp, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) r11 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000580)='memory.events\x00', 0x100002, 0x0) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, &(0x7f0000000400)={{r9}, &(0x7f0000000240), &(0x7f00000003c0)=r11}, 0x20) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000000)={r10, r7, 0x25, 0x2, @void}, 0x10) syz_emit_ethernet(0x1a, &(0x7f0000000040)={@local, @remote, @val={@void, {0x8100, 0x0, 0x1, 0x4}}, {@llc_tr={0x11, {@snap={0x1, 0xaa, "a7", "bab435", 0x16}}}}}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x20008008b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) 8.313414549s ago: executing program 4 (id=4861): sendmsg$key(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=ANY=[@ANYBLOB="020e000010000000000000000004830008001200000001000000ff000000400000001ea0abff7f00000000000000d41f9ab9000100700000ebdf000008000000c4fc0000100000000000e2ffff1c004f030006000020"], 0x80}}, 0x4814) sendmsg$nl_route_sched(0xffffffffffffffff, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000001c0)=@newqdisc={0x6c, 0x24, 0xf0b, 0x70bd2b, 0x4, {0x0, 0x0, 0x12, 0x0, {0xfff1, 0x4}, {0xffff, 0xffff}, {0x2}}, [@qdisc_kind_options=@q_cake={{0x9}, {0x3c, 0x2, [@TCA_CAKE_MEMORY={0x8, 0xa, 0x9}, @TCA_CAKE_NAT={0x8}, @TCA_CAKE_DIFFSERV_MODE={0x8, 0x3, 0x3}, @TCA_CAKE_OVERHEAD={0x8, 0x6, 0xc8}, @TCA_CAKE_MPU={0x8, 0xe, 0xb8}, @TCA_CAKE_MEMORY={0x8, 0xa, 0x888}, @TCA_CAKE_FWMARK={0x8, 0x12, 0x6}]}}]}, 0x6c}}, 0x4000) r0 = socket$inet_udp(0x2, 0x2, 0x0) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000080)='memory.events\x00', 0x275a, 0x0) r1 = openat$cgroup_ro(0xffffffffffffff9c, &(0x7f0000000140)='memory.events\x00', 0x7a05, 0x1700) write$cgroup_int(r1, &(0x7f0000000200), 0xf000) mmap(&(0x7f0000000000/0x3000)=nil, 0x3000, 0x1, 0x12, r0, 0x8000) prctl$PR_TASK_PERF_EVENTS_ENABLE(0x120) setsockopt$IPT_SO_SET_REPLACE(r0, 0x4000000000000, 0x40, &(0x7f0000000000)=@raw={'raw\x00', 0x8, 0x3, 0x208, 0x98, 0x8, 0xfa04, 0x98, 0x6c02, 0x1e0, 0x194, 0x194, 0x1e0, 0x194, 0x3, 0x0, {[{{@ip={@broadcast, @broadcast, 0x0, 0x0, 'veth0_to_hsr\x00', 'veth0_virt_wifi\x00', {}, {}, 0x6}, 0x0, 0x70, 0x98, 0x0, {0x0, 0x74020000}}, @common=@inet=@TCPMSS={0x28}}, {{@ip={@multicast2, @dev, 0x0, 0x0, '\x00', 'batadv_slave_0\x00'}, 0x0, 0x70, 0xd8}, @unspec=@CT2={0x68, 'CT\x00', 0x2, {0x0, 0x0, 0x0, 0x0, 'snmp\x00', 'syz0\x00'}}}], {{'\x00', 0x0, 0x70, 0x98}, {0x28}}}}, 0x268) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000200)=@ipv4_newrule={0x24, 0x20, 0x301, 0x70bd2c, 0x25dfdbff, {0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1}, [@FRA_GENERIC_POLICY=@FRA_SPORT_RANGE={0x8, 0x17, {0x4e24, 0x4e24}}]}, 0x24}, 0x1, 0x0, 0x0, 0x240480d4}, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r3, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000200)=ANY=[@ANYBLOB="2800000021000100"], 0x28}}, 0x0) ioctl$VIDIOC_S_DV_TIMINGS(r1, 0xc0845657, &(0x7f00000002c0)={0x0, @bt={0x9, 0x5, 0x1, 0x2, 0xfffffffffffffffa, 0xfffffffb, 0x5, 0xbe08, 0x1000, 0x6, 0x5a, 0x5, 0x101, 0x1, 0x2, 0x38, {0x1000, 0xc9}, 0x50, 0x1}}) r4 = io_uring_setup(0x1e2b, &(0x7f0000004bc0)={0x0, 0xb07b, 0x42, 0x2, 0x3b8}) io_uring_register$IORING_REGISTER_RESTRICTIONS(r4, 0xb, 0x0, 0x0) 7.872859102s ago: executing program 4 (id=4863): syz_usb_connect(0x2, 0x5a, 0x0, 0x0) sched_setscheduler(0x0, 0x6, 0x0) sched_setaffinity(0x0, 0x0, 0x0) r0 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r0, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=ANY=[@ANYBLOB="c4000000190001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000200000000000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d54900000000000000000000000000000000000000000000000000000000000000000000000000000001"], 0xc4}}, 0x0) r1 = socket$nl_xfrm(0x10, 0x3, 0x6) sendmsg$nl_xfrm(r1, &(0x7f0000000480)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000004c0)=@updpolicy={0xb8, 0x19, 0x1, 0x0, 0x0, {{@in6=@empty, @in=@private, 0x0, 0x0, 0x0, 0x0, 0x2}, {}, {}, 0x20, 0x9, 0x1}}, 0xb8}}, 0x0) ioctl$PTP_SYS_OFFSET_EXTENDED(0xffffffffffffffff, 0xc4c03d09, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) setsockopt$inet_tcp_int(r3, 0x6, 0x16, 0x0, 0x0) add_key(0x0, &(0x7f0000000280)={'syz', 0x1}, &(0x7f00000002c0)="1d", 0x1, 0xfffffffffffffffe) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, 0x0}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x2) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00000, 0x17) r6 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(0xffffffffffffffff, 0x8933, &(0x7f0000000000)={'bridge0\x00', 0x0}) sendmsg$nl_route(0xffffffffffffffff, 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000740)=ANY=[@ANYBLOB="50000000100003040000000000000000f2000000", @ANYRES32=0x0, @ANYBLOB="00000000000000002800128009000100766c616e000000001800028006000100010000000c000200540a00001800000008000500", @ANYRES32=r7], 0x50}, 0x1, 0xba01}, 0x0) r8 = socket(0x10, 0x3, 0x0) write(r8, &(0x7f0000000000)="2400000011005f0414f9f40700090400810000000d0000000000000008000f0001000000", 0x24) 6.924005773s ago: executing program 9 (id=4865): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={0x0, r0}, 0x18) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000000000040f30454070000000000010902240001000040b109040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000080)={0x0, 0x6, 0x8, {0x8, 0x11, "46ff4490d70a"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hidraw(&(0x7f0000000280), 0x82, 0x2) 5.140170458s ago: executing program 2 (id=4868): prlimit64(0x0, 0xe, &(0x7f0000000200)={0x8, 0x8a}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x3) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) epoll_create1(0x0) r1 = socket$inet6(0xa, 0x80002, 0x0) connect$inet6(r1, 0x0, 0x0) r2 = syz_open_dev$sg(&(0x7f00000060c0), 0x0, 0x8002) ioctl$SG_IO(r2, 0x2285, 0x0) r3 = fcntl$dupfd(r2, 0x0, r2) write$sndseq(r3, &(0x7f0000000180)=[{0x80, 0x47, 0x0, 0x0, @tick, {0x40, 0xff}, {0x0, 0x9}, @queue={0xee, {0x7, 0xc9a}}}], 0x1c) write$uinput_user_dev(0xffffffffffffffff, &(0x7f0000000400)={'syz0\x00', {0x3, 0x2, 0x6, 0xfffa}, 0x3a, [0x8000, 0xc95a, 0x100f, 0x8, 0x80, 0x10000, 0x3, 0x7f, 0x20000006, 0x4d, 0x6, 0x5f, 0x9, 0x5, 0xffff2d37, 0xffffff01, 0x6, 0x3, 0x0, 0x5, 0x4, 0x0, 0x9, 0x3c5b, 0x1, 0x24, 0x6, 0x1, 0x5, 0xffffffff, 0xe661, 0x4, 0xa, 0x3, 0x8, 0x4c74, 0x9, 0x242, 0x9, 0xe, 0x0, 0x80008071, 0x7, 0x17, 0x1, 0x7, 0x5, 0x3e, 0x8f, 0x4006, 0x6, 0x0, 0x5, 0x4, 0x8, 0x80, 0x80, 0x0, 0x5, 0x6, 0x8, 0x4, 0xfffffffe, 0x40], [0x10000007, 0x9, 0x10000, 0xa, 0x5, 0x6, 0x129432e6, 0xc8, 0xf9, 0xe, 0x2bf, 0x6c7, 0x9, 0xfffffffc, 0xffffffff, 0x0, 0x0, 0x5, 0x2f, 0xe, 0x312, 0x78, 0xea4, 0x0, 0x204, 0x7, 0x7fff, 0x9, 0x420, 0x401, 0x6, 0x1, 0xff, 0x5, 0x1000005, 0x5f31, 0xd, 0x4e0, 0x2, 0x1, 0xb, 0x4, 0x9, 0x8, 0x9, 0xb, 0x47, 0x8000, 0x1, 0xfe000000, 0xffff, 0x2, 0x4, 0x9, 0x7ff, 0x3, 0x9, 0x1, 0x3, 0x3, 0xbc45, 0x1, 0x44, 0x6], [0x7, 0x408, 0x4, 0x5, 0xfffffffe, 0x100, 0x8d2, 0x9, 0x0, 0x2, 0x0, 0x5, 0xb, 0x4, 0x9, 0x5, 0x0, 0x1ef, 0x5, 0x8, 0x10000, 0x3, 0x5, 0x3e7, 0xb, 0x5, 0x2, 0x10, 0x3, 0x20000008, 0x4, 0x6d01, 0x6, 0x3b, 0x800003, 0x200, 0x80, 0x5, 0x4, 0x2950bfaf, 0xffe, 0x800a2, 0x5, 0xa6, 0x5, 0x9, 0xac8, 0xbf, 0xc, 0x3, 0x7ff, 0x12b, 0x4, 0x1, 0x0, 0x0, 0x5, 0x1c, 0x120000, 0x3, 0x2006, 0x80a2f1, 0x4, 0x25], [0x9, 0xbb33, 0x7, 0x80b, 0x5, 0x938, 0x6, 0x6, 0x0, 0xb9, 0xce7, 0x9, 0x2, 0x57, 0x5, 0x3, 0x101, 0xf142, 0x4, 0x7fff, 0xffff, 0x2000a620, 0x2, 0x5, 0x1, 0x2, 0x5, 0xe7, 0x6, 0x16, 0xffffffff, 0x5, 0x5, 0x4, 0xc8, 0x9, 0xfffff000, 0x10000, 0x3, 0x7e, 0x100, 0x9602, 0x7, 0xaf, 0x8, 0x6, 0x10000226, 0x6, 0x5, 0x8, 0x30b1d693, 0xa1f, 0xf40, 0x7, 0x1, 0x6c1b, 0x3, 0x4, 0x5, 0xb1e, 0xd7, 0x1fd, 0xffff343e, 0xfff]}, 0x45c) ppoll(&(0x7f00000000c0)=[{}, {}], 0x20000000000000dc, 0x0, 0x0, 0x0) bpf$MAP_LOOKUP_ELEM(0x1, &(0x7f0000000e80)={0xffffffffffffffff, &(0x7f0000000d40), 0x0}, 0x20) writev(0xffffffffffffffff, &(0x7f0000000b00)=[{&(0x7f0000002000)}], 0x1) ioctl$DRM_IOCTL_MODE_CREATE_DUMB(0xffffffffffffffff, 0xc02064b2, &(0x7f0000000040)={0x5, 0x6576, 0x9}) epoll_create1(0x0) r4 = openat$tun(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) close(r4) openat$ppp(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) 4.5636734s ago: executing program 6 (id=4870): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r0, &(0x7f000000c2c0)={0x0, 0x0, &(0x7f0000000280)={&(0x7f00000003c0)=ANY=[@ANYBLOB="140000001000000000000000000400000000000a28000000000a0101000000005e1affd5020000000900010073797a300000000008000240000000032c000000030a01030000e6ff00000000020000000900010073797a30000000000900030073797a320000000014000000110001"], 0x7c}}, 0x0) sendmsg$NFT_BATCH(r0, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000006c0)=ANY=[@ANYBLOB="140000001000010000000000000000000500000a64000000060a0b0400000000000000000200000038000480340001800b000100746172676574000024000280090001004d41524b000000000c00030002b51112d439c59208000240000000020900010073797a30000000000900020073797a320000000014000000110001"], 0x8c}}, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r1, &(0x7f0000000080)={0x0, 0x0, &(0x7f0000000500)={&(0x7f00000000c0)=ANY=[@ANYBLOB="380000001000390400"/20, @ANYRES32, @ANYBLOB="01980000000000001800128008000100677265"], 0x38}}, 0x0) close_range(r0, 0xffffffffffffffff, 0x0) 4.561893266s ago: executing program 2 (id=4871): sendmsg$IPCTNL_MSG_CT_GET_DYING(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x875c10ab44cdd0b1, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) 4.508897075s ago: executing program 8 (id=4872): r0 = socket$inet(0x2, 0x4000000000000001, 0x0) setsockopt$inet_tcp_int(r0, 0x6, 0x2, &(0x7f00000004c0)=0x79, 0x4) bind$inet(r0, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) setsockopt$SO_ATTACH_FILTER(r0, 0x1, 0x1a, &(0x7f0000000140)={0x1, &(0x7f0000000280)=[{0x6, 0x0, 0x0, 0xe4}]}, 0x10) sendto$inet(r0, 0x0, 0x0, 0x200007fd, &(0x7f0000e68000)={0x2, 0x4e23, @local}, 0x10) sendmmsg$inet(r0, &(0x7f00000008c0)=[{{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000002c0)="9c", 0x1}], 0x1, 0x0, 0x0, 0x4002}}, {{0x0, 0x0, &(0x7f0000000400)=[{&(0x7f0000001880)="4b4f7046f9e28a71586b2b199a5f8d0abf285d6649f83f0f72c6e297b6401189813a4f22b5375d4e7cb489c0d190065bfc73503fc1d6dfc9d21aa6db4acf3041298edf642c37e7fb6d82a4783f65c9597b4879d0c2c6812a843cdccb1cb601aa52ef555329e828e882d2cbd3bde6b22faa1d461abeb91e6c4181a3b70cf4c4577328197ba371614a674ca065af8bdb6c39f98ed034570631e05a3ccc35188030dca73e0746da24af060a02339303586dd92dbc420924a9d9c6d9f2b178420444c8906da033e1ae28b20fb5652034871b68cd26a0fd2ac8b2adda08defe8697f9eee3607c60cc4ec918ff3ddebf07c31b5893246864409c4b5cfa2a74bea88dcd977637e7502d4acce0ace3068728a966e3e837bbc0597a902f3facf362c9f773a3e86cbe8f061fe154c1609a1a816d8c826990abd42bfdfb9a419fb219391ea94d8e1bf094518c4f5825d2908f84d75b3bc2c7d25cea61cceb45b3a3c7a907fd88c67b98fe5df24b8ed850ccef57baf4daee5c82dcb2618089da429f25e6cf16ddffe90386679eb48526515f005b9c8eb2cb3508b0e59f9624ad654aea287e56c08175b740c09b1f7fed4d80308fe069def7bd8662e59eb948590b8026b7bfcf0d824beaacff9225d87545c5e732e6a8c9efe3a2532d88642205c49b676b94da0e6d302ea2af52a682df53c019025a01d3e9ae4df74efc61996f1271a4ca4a0750c642f92fc9aba24c6622111befc2902fe1caa7b634dacdd72750acfbc0b9fad767e07b57abd4a0d55b732efc5556d5000dd53b0dbd6b785505cc983ed00225a87ceeeb6c09891da3dd23d3605ff8231c28e5879c79fe2392b130d8329a0e22aaac09c0b5e65bb937165e4d0355b3c626e62dc4903d6d65117170060d00e13b2f291012b93a01de35139a142f2b41cc892d3fabda663171cf2b019b2e309dc61c922f623f97e10d19c825a5b0b481fa9f3a52387ec1eb205b5cb96a3631393259334be66f8bcd218b142cc866d8e669ed539d0aa4ca6cd3a77b2d52baac8959d1e26a8713b578efb0c26b732743d8ced39c3d6586a8e03200bfac89d89a3237a911f0f4281bfe026b9ba3a674fd3724350d094b1dd9a2717b3f179b541f338b209c82fe88645d8cdc8d8d71e183db22c8fd08dea5205d817bdd3971b4934f45b9608936085b87847792e38b9f01eb5ab9cde4532b0854e618cd52e27bee2d8f99531036b5e646dfd075b8b700db00f10ae168c91a2f778bf9e30ac017fac957ae93a4bdcbb01fc226720c8b887a8d63a4bfd4e53db7359b1fd4c6b34d4ed48f5ba51ed3fc66b68997a1bc9120068cd889e4658c4ca164cc52cc6ced4eb7b10ac11ad25095710c7af9ab28a9c1f0251321b6b62798d10c57fbceb351ae36eec369d6572472437ef1f9f8da2dad573a3c2506ea1b6cb24c9d9d150d559ca699985049547e2522c760204e3fdc18b804112e669753d9c7d4475b771bc95e34cd45a681f8b54bb0fe7be7c004ffce3bc8fc7a033fd62c11c98091a028f4dc755eea8ff82caa8df7c6e060cf9e53730f95222e67ad818504bc20f38a048856ea093b21fbc6141cd7aaa04c3bde6dd23d7e5c7163fbc66a8fb31d062022b378bad6d859eb5dc075eed04ce76c1207166ed0c96484ceb17b372875c7f30a4a5b8aa036df93ab40eec7d5d87943a726124671f1b8412cba4dfa8a483bc879ee2c2f29378592a51a72a85a9ce3b11a6f43027dd8f0eede638e03d61eeb69b236aaa32c543c32c870629aaf416a96e2e37df00377f1a982318ba3b54d1cfb94095e4b1d57cf55682ab34dc06566c2babd0a1da038d3a381d23f114223bcdab8760e51eb5d45794c07dea7e8605b883f82a1449dba98448b9c7fb783a5f61412bfab589599dfe58b528ba4017943fd145037b4443286cd5db3536d29c79f0c5876eea6463e331f5bd69d830628bb963078858e0e3e492a47e4edbf4826e064d7328d06c89ef9f462842bc81b90ab9491033754dc9ed662ca02e0d2704b2a20ddc69a65b38929eebad70d02bb9f07aa7faa4c46e55904c3e6d74942adeea5cb25221540d50b45c877e1a094d95abef3807ac92c213419ed5cbf4ae9335480ed7131690c592c6b94abaa13aec5fd90f8f43ab13806d114111706279736ce15304a3031527f5f1d0f7d7e98412d4deed98cb510eb24a63b34e1b5cb171a1332d2b00974bb276253a6f317444c8b3ccfe5837a6733650d14fba1e5d8eafee42f0fdaeeb990080791f069fee0fea87c9ed142c016e695baa0ca00f705d7429e8e5053b0f6d14d947bda4b83d51bce4a16dee9712ef2b775a4cb72359d72ca629fd75f8ead53d3b5bf42e09394eb3a30e7e563a56e560343a238ca8e95f448ad31d4896e79953e6c97030c57f9a7b3d01ac87451d62f88e1f1d77040dbca22af2a0b32d59455820655cbd703aef4e3fa298438f860939c476e408fe27054b2e07be0a7f8349f057a1f76add1ae1a361ac192f4889f3ad5bdb13a4627e13b238cf09a4250c5516ee564bf5206cdfd70af12bc575d76a34438a149c9ca79238a681568c7b9e43922a939e04f545d26b4fdc44d41f30bf29418503209821a1a6a77a6811b2d1d9388a13fdc6b037f882b697b12f258dfbd07f9b01322f4a2954cc57833dba00c333d641009f4b345c53da860490e5dce970a2037fcad8a94183e8a24cf55f7c31a50fdeff0d350dd86d326ebdf5a01d34b0d6cf94bde5f4a17913145faa40ffe03efe2282d8a5633966d8baa4624c122bdc7c439f5b660c5236e52dd733f62f81c6dbc014cad0dc3e2f2de455a84b864a293cc309cafc5c3f71ac45e01b7c5fe2932953bd1c5bbaa8ce55d750de4de4c103edcdce9788da41e65613b9f588fed53c4ffac6c1154299cdb2b3670458e97aaab73a94b969b497beb167a37df6c9d4cae8900182b6a5f537d485b95e391e5056d3b96959f993e907a34eb367fab00651fffacfcdc1d31df18fb6f9bbccc6524649db257e2939bb5564199c54224aa5f1d25092d92ba36cfe23b9e05e8eb8b30da7898f2bec0cb60d9707b11528319f6f95dc72b13f1d620540d70a749bc2b282764f890d6ab3adb6b0235c5ce1391db529f5c6249bf5ef3942f0387babbf593bd90ad2925902d7534fcdcfef71b927052429f84788c7b936d8431c6e46d55af92118773824b7f8e4592b5a5e9320b3758530e102f44b0fe2701a9c2a7251b016cd4cd065f5baff3391631fe7b5e738a7dd5dfe941723557ef802ab0f02fbe7634b5d61caced1e4c4b06376946d9e31ab1013e814f44902d75149ab2303f0039931dca90fb9cbf1234f929038d1731eb808db143674eb375ab3cc6e0be1ee6d522d039f323be59556b0896b2eb821ed409c95c045daf900b6568fdf122b9c7ee97be6ed2f80cdec138f7a366becc25aed91359e7461ce67f5d9dbdbc055e75ad0e4a8fd0ae2e0c4198fb8f8bd5674fb3", 0x99e}, {&(0x7f0000000300)="21b5b923a0ac8e957eb6b8566c0249e11ee93f67047d6427e45258de8e11053508612b8f07dbfed9735f99f90b518bb6d4939d4cab49a3b3453790f04f130a49dc2487e2b3d3eab7961d37426b85d895fd0dcf2afaabce5657f5677abdf25b919fd69f961171e0504ded5c60b38e99d128d5f59b4bb5bc83d8455f97ec11800034d6912f744f88c3e2803c593b228c6c3b2ff7986dcf32e2994785c02f045675a5c4eee5337e04f0fc2808edb16a206b679bbfb97d892b1c22d89e73613f98348e86cc58f1d0b4539e170e58f04978f71338d4c9486f1fda2be8eccbb49256dfa85c515a96626aad021d359241e3c2b27d9d59c3fec223b4dad4", 0xfa}, {&(0x7f0000000500)="732c3442f3235025291354e9c7f3f7642b361bc6c7e7009b67d2cddc445814c71c9bd20d265db2b304b4c237ad3f93649fa83cc240d66910015f2191c41c24b1eec360cd39e77fa37add60d8dfade5ebbf5e37a4f160add118f70909adbb7c1c3be3655980329ec1c72244b0403215f372ecd5ea589991cd8670e68da56e438d173575014d1bdb1f5c21e735499c9b509f4f0f6f3324c68da3368888c095c345e6d9d0ae4753f28ac0ed83611f6c31ef3a29e4bd9fa02ebaf52a149626317427098a57297ada028ba73aace1", 0xcc}, {&(0x7f0000000180)="6950c6b5148f5b4b6a2012a3d0fa272c15730140046fc66f2ef8c2c9b1b59aed41bdb1e063777fdfc8b0bdc941ccbb0fec5406a9d1d63bc3b544fad6ef581d8b2d2e60af44ea94adfb8db81df73ed016dfae61f0720731783846c97e48ca33284ef5b43890ad553b8fb835e22dea0d", 0x6f}, {&(0x7f0000000040)="0a77463932b2eaa3485cdd599cc1af28275350890e21c455957884762d59e35ab980ed5e15015a60ae76c0c104287e661c024f99e8361b25ee0697081f", 0x3d}, {&(0x7f00000000c0)="15e8a16c", 0x4}, {&(0x7f0000000600)="992a244accc9bb5c35b1a09a457701f286e502c1dbb32c1e1625b7482a12f141bbc081ea50fa8ca6bed09af3e4f5230c53634fa2df3d70fb08343f60da5b103675c9f1983256a4515db25dcda0baf249b96d7a0cbf6d45918fb94ce1611dae8dcc7fcac562ef351142867dafe057340697c06057a5742946d17ae75821f5673496e7baa5d55d95e107ec9e", 0x8b}], 0x7}}], 0x2, 0x4004894) 4.43320031s ago: executing program 2 (id=4873): r0 = socket$inet6(0xa, 0x3, 0xff) r1 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000000)=@newtaction={0x48, 0x30, 0xb, 0x0, 0x0, {}, [{0x34, 0x1, [@m_skbmod={0x30, 0x1, 0x0, 0x0, {{0xb}, {0x4}, {0x4}, {0xc}, {0xc}}}]}]}, 0x48}}, 0x0) setsockopt$inet6_int(r0, 0x29, 0x16, &(0x7f00000001c0)=0x7f, 0x4) 4.400431423s ago: executing program 6 (id=4874): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x11, 0x4, &(0x7f00000009c0)=ANY=[@ANYBLOB="18010000000000000000000000000000850000006d00000095"], &(0x7f0000000300)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={&(0x7f0000000000)='sched_switch\x00', r0}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r1 = getpid() sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbee2, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs={0x0, 0x0, 0x4e24}, 0x6e) sendmmsg$unix(r3, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket$inet(0x2, 0x6, 0x8) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) r4 = syz_init_net_socket$bt_sco(0x1f, 0x5, 0x2) r5 = dup2(r4, r4) getsockopt$inet_IP_IPSEC_POLICY(r5, 0x0, 0x10, &(0x7f0000000500)={{{@in6}}, {{@in=@multicast1}, 0x0, @in=@empty}}, &(0x7f0000002f00)=0xe8) socket$inet_udp(0x2, 0x2, 0x0) 4.369654011s ago: executing program 4 (id=4875): socket$nl_route(0x10, 0x3, 0x0) r0 = socket$nl_route(0x10, 0x3, 0x0) r1 = socket$vsock_stream(0x28, 0x1, 0x0) bind$vsock_stream(r1, &(0x7f0000000040)={0x28, 0x0, 0x2710, @local}, 0x10) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000000)={0x1, &(0x7f0000000180)=[{0x200000000006, 0x0, 0x0, 0x7ffc0001}]}) alarm(0x81) listen(r1, 0x0) connect$vsock_stream(r1, &(0x7f0000000080)={0x28, 0x0, 0x2710, @host}, 0x10) seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0xc, 0x0) syz_open_dev$sndctrl(0x0, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) r3 = syz_genetlink_get_family_id$batadv(&(0x7f0000000080), 0xffffffffffffffff) ioctl$ifreq_SIOCGIFINDEX_batadv_mesh(r2, 0x8933, &(0x7f0000000000)={'batadv0\x00', 0x0}) sendmsg$BATADV_CMD_GET_NEIGHBORS(r2, &(0x7f0000004340)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000380)=ANY=[@ANYRESHEX=r2, @ANYRES16=r3, @ANYRES64, @ANYRES32=r4, @ANYRESHEX=0x0, @ANYBLOB="52a7178803ecb25b37ce08af844852b27d7b9107b44de8a7332f48d86df94c0e416772ba13e938578ae540d863a85c9b0a0714480c2670856ee3ce8ab1a52e95ce538de5de531a07cdfa4a2af35a51e47eb052c61b1c9e8efdf0", @ANYRES16=r2, @ANYRESHEX=r0], 0x1c}}, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f00000000c0)=0xa) socket$nl_xfrm(0x10, 0x3, 0x6) prctl$PR_SCHED_CORE(0x3e, 0x100000001, 0x0, 0x2, 0x0) r5 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r5, &(0x7f0000019680)=""/102392, 0x18ff8) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) r6 = openat$vnet(0xffffffffffffff9c, &(0x7f0000000180), 0x2, 0x0) ioctl$int_in(r6, 0x40000000af01, 0x0) ioctl$VHOST_SET_VRING_ADDR(r6, 0x4028af11, &(0x7f0000000200)={0x1, 0x1, 0x0, &(0x7f0000000100)=""/56, 0x0, 0xeeef0000}) r7 = socket$packet(0x11, 0x3, 0x300) ioctl$VHOST_SET_MEM_TABLE(r6, 0x4008af03, &(0x7f0000000240)) r8 = dup(r7) ioctl$VHOST_NET_SET_BACKEND(r6, 0x4008af30, &(0x7f0000000000)={0x1, r8}) 4.288950257s ago: executing program 2 (id=4876): ioctl$UFFDIO_API(0xffffffffffffffff, 0xc018aa3f, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000640)=0x6) r0 = getpid() sched_setscheduler(r0, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) sched_setaffinity(0x0, 0x8, &(0x7f0000000280)=0x2) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) msync(&(0x7f0000ffe000/0x2000)=nil, 0x2000, 0x1) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setaffinity(0x0, 0x8, &(0x7f0000000080)=0x2) r3 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$IP6T_SO_SET_REPLACE(r3, 0x29, 0x40, &(0x7f0000000f40)=@filter={'filter\x00', 0x4, 0x4, 0x3a0, 0xffffffff, 0x0, 0x0, 0xe4, 0xfeffffff, 0xffffffff, 0x390, 0x390, 0x390, 0xffffffff, 0x4, 0x0, {[{{@uncond, 0x2f2, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x0, 0x4}}}, {{@ipv6={@private2, @empty, [], [], 'sit0\x00', 'batadv_slave_1\x00'}, 0x0, 0xa8, 0xe8}, @common=@unspec=@RATEEST={0x40, 'RATEEST\x00', 0x0, {'syz1\x00', 0x2, 0x57, {0x2000000}}}}, {{@ipv6={@empty, @mcast1, [], [], 'ip6tnl0\x00', 'dvmrp0\x00'}, 0x0, 0xd8, 0x100, 0x0, {}, [@common=@unspec=@realm={{0x30}, {0x1, 0xdd8}}]}, @REJECT={0x28}}], {{'\x00', 0x0, 0xa8, 0xd0}, {0x28}}}}, 0x400) r4 = syz_open_dev$vbi(&(0x7f0000000340), 0x0, 0x2) ioctl$VIDIOC_S_INPUT(r4, 0xc0045627, &(0x7f00000000c0)=0x3) ioctl$VIDIOC_SUBDEV_S_DV_TIMINGS(r4, 0xc0845657, &(0x7f0000000480)={0x0, @bt={0x556, 0x93, 0x1, 0x1, 0xd59f80, 0x19ef, 0x7, 0x19ef, 0x3, 0x9, 0x27fe, 0x2800, 0x2, 0xbb6, 0x4, 0x2c, {0x8, 0xfffffeff}, 0xd0, 0x9}}) 3.328370588s ago: executing program 9 (id=4877): r0 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f00000013c0)={0x18, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000280)={0x0, r0}, 0x18) r1 = syz_usb_connect$hid(0x2, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="1201000000000040f30454070000000000010902240001000040b109040000010300010009210101000122050009058103"], 0x0) syz_usb_control_io(r1, 0x0, 0x0) syz_usb_control_io(r1, &(0x7f0000000340)={0x2c, &(0x7f0000000080)={0x0, 0x6, 0x9, {0x9, 0x11, "46ff4490d70a1e"}}, 0x0, 0x0, 0x0, 0x0}, 0x0) syz_open_dev$hidraw(0x0, 0x82, 0x2) 3.308369491s ago: executing program 2 (id=4878): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r0, &(0x7f0000000040)={0xa, 0x4e22, 0x0, @empty}, 0x1c) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x3}, 0x20, 0x0, 0x0) rseq(&(0x7f0000000040)={0x0, 0x0, 0x0, 0x7}, 0xfe44, 0x0, 0x0) r1 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r1, &(0x7f0000000080)={0x2, 0x4e21, @multicast1}, 0x10) connect$inet(r1, &(0x7f0000000180)={0x2, 0x4e21, @empty}, 0x10) sendto$inet(r1, &(0x7f0000000000), 0xfffffffffffffd74, 0x40004, 0x0, 0x0) setsockopt$inet_tcp_TCP_CONGESTION(r1, 0x6, 0xd, &(0x7f00000000c0)='hybla\x00', 0x6) recvfrom$inet(r1, &(0x7f0000000080)=""/8, 0xfffffffffffffd0b, 0xc9100120, 0x0, 0xfffffffffffffd25) listen(r0, 0x0) sendmsg$NFT_BATCH(0xffffffffffffffff, 0x0, 0x0) io_uring_setup(0x30d3, &(0x7f0000000000)={0x0, 0x371b, 0x0, 0x3, 0x38d}) sched_setaffinity(0x0, 0xfffffdca, &(0x7f0000000200)=0x400000bce) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) r2 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r2, &(0x7f0000019680)=""/102392, 0x18ff8) socket$inet6_tcp(0xa, 0x1, 0x0) openat$vim2m(0xffffffffffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$TCSETSF(0xffffffffffffffff, 0x5404, 0x0) r3 = bpf$PROG_LOAD_XDP(0x5, 0x0, 0x0) sched_setscheduler(0x0, 0x2, 0x0) r4 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000240)=ANY=[@ANYBLOB, @ANYRESDEC=r3], 0x28}}, 0x200080c0) sendmsg$IPSET_CMD_ADD(r4, &(0x7f00000005c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=ANY=[@ANYBLOB="38000000090601020000000000000140e00000020c000280080001400300000000ff7f000000"], 0x38}, 0x1, 0x0, 0x0, 0x800}, 0x40c00c8) setsockopt$sock_int(0xffffffffffffffff, 0x1, 0x9, &(0x7f0000000100)=0x40000002, 0xd) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x0, &(0x7f0000006680)) 2.574506621s ago: executing program 6 (id=4879): r0 = bpf$MAP_CREATE(0x0, &(0x7f00000000c0)=@base={0x1b, 0x0, 0x0, 0x8000}, 0x48) r1 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x11, 0xf, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018", @ANYRES32=r0, @ANYBLOB="0000000000000000b702000014000800b7030000000000008500000083000000bf0900000000000055090100000000009500000000000000bf91000000000000b7020000000000008500000084000000b70000000000000095"], &(0x7f0000000200)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000740)={&(0x7f00000006c0)='sched_switch\x00', r1}, 0x10) connect$qrtr(0xffffffffffffffff, &(0x7f0000000040)={0x2a, 0x3, 0x8000}, 0xc) getsockname$packet(0xffffffffffffffff, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000340)=0x14) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={0x0, 0xa0}}, 0x0) sendmsg$NFULNL_MSG_CONFIG(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000440)={0x24, 0x1, 0x4, 0x201, 0x0, 0x0, {0x3}, [@NFULA_CFG_FLAGS={0x6, 0x6, 0x1, 0x0, 0xf}, @NFULA_CFG_CMD={0x5, 0x1, 0x2}]}, 0x24}, 0x1, 0x0, 0x0, 0x44041}, 0x0) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r2 = getpid() sched_setscheduler(r2, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f04ebbeea, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) openat$fuse(0xffffffffffffff9c, 0x0, 0x2, 0x0) r5 = openat$sndtimer(0xffffffffffffff9c, &(0x7f0000000000), 0x0) ioctl$SNDRV_TIMER_IOCTL_TREAD_OLD(r5, 0x40045402, &(0x7f0000000140)=0x1) read(r5, &(0x7f0000000040)=""/46, 0x2e) ioctl$SNDRV_TIMER_IOCTL_SELECT(r5, 0x40345410, &(0x7f00000083c0)={{0x1}}) ioctl$SNDRV_TIMER_IOCTL_PARAMS(r5, 0x40505412, &(0x7f00000000c0)={0x7, 0x9dc5, 0x0, 0x0, 0xf}) ioctl$SNDRV_TIMER_IOCTL_CONTINUE(r5, 0x54a2) ioctl$FUSE_DEV_IOC_CLONE(0xffffffffffffffff, 0x8004e500, 0x0) r6 = openat$cgroup_ro(0xffffffffffffff9c, 0x0, 0x275a, 0x0) write$tun(r6, 0x0, 0x38) syz_init_net_socket$802154_raw(0x24, 0x3, 0x0) sendmmsg(0xffffffffffffffff, &(0x7f0000000000), 0x4000000000001f2, 0x0) 1.827058808s ago: executing program 8 (id=4880): r0 = syz_init_net_socket$nl_rdma(0x10, 0x3, 0x10) sendmsg$netlink(r0, &(0x7f0000000040), 0x0) 1.826385602s ago: executing program 8 (id=4881): syz_genetlink_get_family_id$nl80211(&(0x7f0000000040), 0xffffffffffffffff) pipe2$9p(0x0, 0x0) write$P9_RVERSION(0xffffffffffffffff, &(0x7f0000000180)=ANY=[@ANYBLOB="1500000065ffff09"], 0x15) r0 = dup(0xffffffffffffffff) write$FUSE_BMAP(r0, &(0x7f0000000100)={0x18}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x1, 0x8b}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000080)=0x8) r1 = openat(0xffffffffffffff9c, &(0x7f000000c380)='./file0\x00', 0x40, 0x0) io_setup(0x2, &(0x7f0000000200)=0x0) io_submit(r2, 0x2, &(0x7f0000000580)=[&(0x7f0000000180)={0x0, 0x0, 0x0, 0x0, 0x4, r1, 0x0, 0x0, 0x8, 0x0, 0x0, r1}, &(0x7f0000000280)={0x0, 0x0, 0x0, 0x1, 0x6, r1, 0x0, 0x0, 0xfffffffffffffffc, 0x0, 0x0, r1}]) r3 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) sched_setscheduler(r3, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r5, &(0x7f0000000000), 0x651, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r6 = bpf$PROG_LOAD(0x5, &(0x7f0000000780)={0x11, 0xb, &(0x7f0000000180)=ANY=[@ANYBLOB="18000000000000000000000000000000180100002020702500000000002020207b1af8ff00000000bfa100000000000007010000f8ffffffb702000000000000b7030000ddffffff850000002d00000095"], &(0x7f0000000040)='GPL\x00', 0x0, 0x0, 0x0, 0x41100, 0x0, '\x00', 0x0, @fallback, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x90) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f00000002c0)={&(0x7f0000000300)='sched_switch\x00', r6}, 0x10) r7 = socket$inet(0x2, 0x4000000000000001, 0x0) bind$inet(r7, &(0x7f0000000080)={0x2, 0x4e23, @local}, 0x10) sendto$inet(r7, 0x0, 0x0, 0x200047fc, &(0x7f0000e68000)={0x2, 0x4e23, @multicast1}, 0x10) sendto$inet(r7, &(0x7f0000000580), 0x0, 0x10008095, 0x0, 0x0) r8 = bpf$MAP_CREATE(0x0, &(0x7f00000005c0)=ANY=[@ANYBLOB="1600000000000000040000000700000000000000", @ANYRES32=0x1, @ANYBLOB="00400012107fde414b13f4cb0000000000000000002000000000a26848000000", @ANYRES32=0x0, @ANYRES32, @ANYBLOB='\x00'/28], 0x50) bpf$PROG_LOAD_XDP(0x5, &(0x7f00000004c0)={0x3, 0xc, &(0x7f0000000440)=ANY=[@ANYBLOB="1800000000000000000000e6cd00000018110000", @ANYRES32=r8, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000000000000b704000000000000850000005700000095"], 0x0}, 0x94) bpf$PROG_LOAD_XDP(0x5, &(0x7f0000000a40)={0x3, 0x2000000000000081, &(0x7f0000000440)=ANY=[], 0x0, 0x0, 0x0, 0x0, 0x41000, 0x0, '\x00', 0x0, 0x25, r1}, 0x94) r9 = bpf$PROG_LOAD(0x5, &(0x7f0000000380)={0x11, 0xc, &(0x7f0000000440)=ANY=[], &(0x7f0000000240)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000f40)={&(0x7f0000000300)='fib_table_lookup\x00', r9}, 0x10) socket$nl_generic(0x10, 0x3, 0x10) 1.74697617s ago: executing program 4 (id=4882): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) prlimit64(0x0, 0xe, &(0x7f00000003c0)={0x4, 0x80100008b}, 0x0) sched_setaffinity(0x0, 0x11, &(0x7f0000000180)=0x1400200bce) sched_setscheduler(0x0, 0x1, &(0x7f0000002200)=0x1) r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_MSG_GETOBJ(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="140065e40c14fecfd2dbec75a4a20000130a0300"], 0x14}}, 0x4000040) socket$inet6_tcp(0xa, 0x1, 0x0) socket$inet(0x2, 0x1, 0x100) socket$inet6_udplite(0xa, 0x2, 0x88) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x7) r1 = getpid() sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r2 = bpf$PROG_LOAD(0x5, &(0x7f00000000c0)={0x3, 0xc, &(0x7f00000001c0)=ANY=[@ANYRESDEC=r0], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$BPF_PROG_TEST_RUN(0xa, &(0x7f00000004c0)={r2, 0x18000000000002a0, 0x7, 0x0, &(0x7f00000002c0)="d2ff0300600100", 0x0, 0xd5b1, 0x60000000, 0x0, 0x0, 0x0, 0x0}, 0x50) sched_setscheduler(r1, 0x2, &(0x7f0000000200)=0x4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeef, 0x8031, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r4, &(0x7f0000000000), 0x400000000000041, 0x0) sched_setaffinity(r1, 0x8, &(0x7f0000000240)=0x2) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r5 = gettid() r6 = openat$iommufd(0xffffffffffffff9c, &(0x7f0000000080), 0x0, 0x0) ioctl$IOMMU_IOAS_ALLOC(r6, 0x3b81, &(0x7f0000000000)={0xc, 0x0, 0x0}) bpf$PROG_LOAD(0x5, &(0x7f0000000580)={0x11, 0xd, &(0x7f0000000240)=ANY=[@ANYBLOB="1800000000000000000000000000000018110000", @ANYRES32=r6, @ANYBLOB="0000000000000000b7080000000000007b8af8ff00000000bfa200000000000007020000f8ffffffb703000008000000b7040000000400008500000001"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x6, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN(r6, 0x3ba0, &(0x7f0000000100)={0x48, 0x2, r7, 0x0, 0x0}) ioctl$IOMMU_TEST_OP_MOCK_DOMAIN_REPLACE(r6, 0x3ba0, &(0x7f0000000280)={0x48, 0x12, r8, 0x2000000, r7}) tkill(r5, 0xb) 1.631691537s ago: executing program 6 (id=4883): sendmsg$IPCTNL_MSG_CT_GET_DYING(0xffffffffffffffff, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000580)={&(0x7f0000000040)={0x14, 0x6, 0x1, 0x875c10ab44cdd0b1, 0x0, 0x0, {0x3, 0x0, 0x4}}, 0x14}, 0x1, 0x0, 0x0, 0x2404c031}, 0x20000000) 912.965511ms ago: executing program 6 (id=4884): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) r1 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000280)={0x18, 0x5, &(0x7f0000000040)=ANY=[@ANYBLOB="180100002100000000000000000000008500000075000000a50000002300000095"], &(0x7f00000000c0)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x8}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000100)={&(0x7f00000001c0)='mmap_lock_acquire_returned\x00', r1}, 0x10) madvise(&(0x7f0000000000/0x3000)=nil, 0x7fffffffffffffff, 0x3) r2 = bpf$BPF_PROG_WITH_BTFID_LOAD(0x5, 0x0, 0x0) r3 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000200)={0x18, 0x4, &(0x7f00000002c0)=ANY=[@ANYRES32=0x0], &(0x7f0000000100)='GPL\x00', 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, 0x2}, 0x94) bpf$BPF_RAW_TRACEPOINT_OPEN(0x11, &(0x7f0000000080)={0x0, r3}, 0x18) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x88}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000240)=0x7) r4 = getpid() sched_setscheduler(r4, 0x2, &(0x7f0000000200)=0x7) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb635773f06ebbeee, 0x8031, 0xffffffffffffffff, 0x0) syz_open_procfs$pagemap(r4, &(0x7f0000000040)) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r5, &(0x7f0000000380)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r6, &(0x7f0000000000), 0x651, 0x0) fcntl$F_GET_RW_HINT(r2, 0x40b, 0x0) recvmmsg(r5, &(0x7f00000000c0), 0x10106, 0x2, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000000)=0x6) mprotect(&(0x7f0000ffd000/0x3000)=nil, 0x3000, 0x0) r7 = syz_open_dev$loop(&(0x7f0000000000), 0x2, 0x62d40) ioctl$LOOP_SET_FD(r7, 0x4c00, 0xffffffffffffffff) ioctl$BLKTRACESETUP(r7, 0xc0481273, 0x0) mprotect(&(0x7f0000ffc000/0x4000)=nil, 0x4000, 0xf) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_genetlink_get_family_id$ipvs(0x0, 0xffffffffffffffff) sendmsg$IPVS_CMD_FLUSH(r8, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f00000000c0)=ANY=[@ANYBLOB="ac000000", @ANYRES16=r9, @ANYBLOB="04002abd7000fcdbdf251100000008000400606800002400038008000500ac1414bb08000300030000000800030903000000080001000000000000010001000c00028008000400030000000800060003000000"], 0xac}, 0x1, 0x0, 0x0, 0x48040}, 0x40050) bind$bt_hci(r0, &(0x7f0000000000)={0x1f, 0xffff, 0x3}, 0x6) syz_open_procfs(0x0, &(0x7f0000000000)='fd/3\x00') write(r0, &(0x7f0000000340)="41000000010001", 0x7) 748.460825ms ago: executing program 4 (id=4885): r0 = syz_init_net_socket$bt_hci(0x1f, 0x3, 0x1) bind$bt_hci(r0, &(0x7f00000003c0)={0x1f, 0xffffffffffffffff, 0x5}, 0x6) r1 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x6, &(0x7f0000000400)={0x1, &(0x7f0000000200)=[{0x6, 0x0, 0x0, 0x7fffffff}]}) r2 = openat$dma_heap(0xffffffffffffff9c, &(0x7f0000000000), 0x0, 0x0) ioctl$DMA_HEAP_IOCTL_ALLOC(r2, 0xc0184800, &(0x7f0000000100)={0x4, r1}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) sched_setscheduler(0x0, 0x1, &(0x7f0000000080)=0x8) bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, 0x0, 0x0) r3 = socket(0x25, 0x5, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) openat$sequencer(0xffffffffffffff9c, 0x0, 0x0, 0x0) r4 = syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x141102) getsockopt$llc_int(r3, 0x10c, 0x3, 0x0, 0x0) writev(r4, &(0x7f0000000840)=[{&(0x7f00000002c0)="94", 0xf000}, {0x0}], 0x2) socket$inet6_tcp(0xa, 0x1, 0x0) unshare(0x68040200) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x3, 0x8031, 0xffffffffffffffff, 0xfffff000) r5 = socket(0x2, 0x80805, 0x0) r6 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r6, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000002c0)=@newlink={0x3c, 0x10, 0x403, 0x0, 0x0, {}, [@IFLA_LINKINFO={0x1c, 0x12, 0x0, 0x1, @bridge={{0xb}, {0xc, 0x2, 0x0, 0x1, [@IFLA_BR_MCAST_IGMP_VERSION={0x5, 0x2b, 0x3}]}}}]}, 0x3c}, 0x1, 0xffffffea, 0x0, 0x4804}, 0x0) setsockopt$sock_linger(r5, 0x1, 0xd, &(0x7f0000000240)={0x0, 0x7}, 0x8) r7 = openat$cgroup_ro(0xffffffffffffffff, &(0x7f0000000000)='blkio.bfq.io_wait_time_recursive\x00', 0x0, 0x0) ioctl$I2C_SLAVE(r7, 0x703, 0x26b) syz_open_procfs(0x0, &(0x7f0000000000)='pagemap\x00') r8 = socket$inet6_udp(0xa, 0x2, 0x0) getsockopt$IP6T_SO_GET_INFO(r8, 0x29, 0x40, &(0x7f0000000140)={'mangle\x00', 0x0, [0x7ff, 0x4000105, 0x38e, 0x3, 0x82]}, &(0x7f0000000400)=0x54) pselect6(0x40, &(0x7f00000001c0)={0x200, 0x14000000000000, 0x3, 0xfffffffffffffffd, 0x0, 0x0, 0x0, 0x8}, 0x0, &(0x7f00000002c0)={0x3ff, 0x0, 0x0, 0x9, 0x7, 0x0, 0x7fffffff, 0x2}, 0x0, 0x0) syz_emit_ethernet(0x82, &(0x7f0000000100)=ANY=[@ANYBLOB="bbbbbbbbbbbbaaaaaaaaaabb08004500007400f5000004019078ac1e0001ac1414aa03019078036100004600000000004000141410ac1414bb44440001000086dd0000dc02ffffffff00000000ac14143200000000000000000000004fe0000002000000007f00000111000e00ac1414aa00000004e000000100000000"], 0x0) 11.64434ms ago: executing program 6 (id=4886): socket$igmp(0x2, 0x3, 0x2) bpf$PROG_LOAD(0x5, 0x0, 0x0) setsockopt$MRT_ADD_VIF(0xffffffffffffffff, 0x0, 0xca, 0x0, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, 0x0) socket$inet6(0xa, 0x3, 0x4) prctl$PR_SET_SYSCALL_USER_DISPATCH_ON(0x3b, 0x1, 0x0, 0x5, &(0x7f0000006680)) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$vim2m_VIDIOC_S_FMT(0xffffffffffffffff, 0xc0d05605, &(0x7f0000000140)={0x2, @pix={0xa2, 0x7, 0x32314d48, 0x8, 0xa592, 0x6, 0x9, 0x7, 0x0, 0x8, 0x0, 0x1}}) prlimit64(0x0, 0xe, &(0x7f0000000140)={0x8, 0x8b}, 0x0) timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) sched_setscheduler(0x0, 0x2, &(0x7f0000000180)=0x4) sched_setaffinity(0x0, 0x8, &(0x7f00000002c0)=0x2) r0 = syz_open_dev$MSR(&(0x7f00000001c0), 0x0, 0x0) read$msr(r0, &(0x7f0000019680)=""/102392, 0x18ff8) socket$nl_xfrm(0x10, 0x3, 0x6) openat$snapshot(0xffffffffffffff9c, &(0x7f00000000c0), 0xc2d41, 0x0) (fail_nth: 9) 0s ago: executing program 2 (id=4887): r0 = socket$inet6(0xa, 0x2, 0x0) bind$inet6(r0, &(0x7f0000000480)={0xa, 0x4e20, 0x0, @mcast1={0xff, 0x5}, 0x6}, 0x1c) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1002, 0x0) r1 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000000), 0x40082, 0x0) ioctl$PPPIOCNEWUNIT(r1, 0xc004743e, &(0x7f0000000140)) ioctl$PPPIOCSFLAGS1(r1, 0x40047459, &(0x7f0000000080)=0x40) pwritev(r1, &(0x7f0000000040)=[{&(0x7f00000000c0)="80fd02000040", 0x42}], 0x1, 0x0, 0xc87) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000080), 0x400, 0x0) r2 = syz_open_dev$vcsn(&(0x7f00000000c0), 0xa13f, 0x21a000) sendmsg$inet(r2, &(0x7f0000001900)={&(0x7f0000000240)={0x2, 0x4e23, @broadcast}, 0x10, 0x0}, 0x200004a4) unshare(0x40600) socketpair$tipc(0x1e, 0x1, 0x0, &(0x7f0000000000)={0xffffffffffffffff, 0xffffffffffffffff}) recvmsg(r3, &(0x7f00000003c0)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f00000002c0)=""/241, 0xf1}], 0x1}, 0x10033) sendmsg$tipc(r4, &(0x7f0000000240)={0x0, 0xfffffff5, &(0x7f0000000200)=[{&(0x7f0000000140)="a2", 0x6e9c84f3}], 0x1}, 0x0) r5 = mq_open(&(0x7f00005a1ffb)='eth0\x00', 0x42, 0x0, 0x0) mq_getsetattr(r5, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f00000054c0)={0xe, 0x16, &(0x7f0000001900)=ANY=[@ANYBLOB="611080ff000000006113740000000000bfa00000000000000700000008ffffffd503010017740040950000000000000069163a0000000000bf67000000000000350602000fff07201706000020191800160600000ee60060bf050000000000007b650000000000006507f9ff01000000070700004d83dde4c375000000000000bf54000000000000070400000400f9ffad4301000000000095000000000000001500000000000000950000000000000032ed3c12dc8c27df8ecf264e0f84f9f17d3c30e32f17540faf80250aa20c669a5e12814cb1cea5d4601d295c45a6a0b9bdb7dd399703cac4f6f3be4b369226066812b8e007e733a9a4f1b0af3dda82ee45a010fb94fe9de57b9d8a814261bdb94a05000400c6c60bf70d742a81762bab8395fa64810b5b40d893ea8fe0185473d51b546cad3f1d5ab2af27546e7c955ccefa1f6ab689b555202da2e0ec2871b4a7e65836429a527dc47ebe84a423b6c8d345dc8da3085b0ab71ca1b901627b562ed04ae76002d4519af619e3cca4d69e0dee5eb106774a8f3e6916dfec88158f0200000000c8fb730a5c1bf2b2bb71a629361997a75fd552bdc206438b8ef4901fd03c16dfda44221b235c8ac86d8a297dff0445a15f21dce431e56723888fb126a163f16f920ae2fb494059bba8e3b680324a188076eb685d55c4e9b2ad9bc1172ba7cbebe174aba210d739a018f9bbec63222d20ceddf4d03723f1c932b3a6aa57f1ad2e99e0e67ab93716d20000009f0f53acbb40b4f8e2738270b31562ed834f2af97787f696649a462e7ee4bcf8b07a10fd7ed6735154beb4000000000000000000000000004000bc00f6746a9709e7e78f4ddc211bc3ebe6bd9d42ca0140a7afaab43176e65ec1118d50d1e827f3472f4445d253887a5ad103649afa17690884f800031e03a651bb96589a7e2e509bcc1d161347623cb5e7ac4629c8ab04871bc47287cd31cc43ea0ffb567b40407d000000210000000000000000005f37d8703f37ca364a601ae899a56715a0a62a34c1d926a0f6a5480a55c22fe3a5ac00000000000000000000000500002000000000fb79ea00000000000000000000e4007be511fe32fbc90e2364a55e9bb66ac64423d2d00fea2594e14d90deae46e26c596f84eba90000000000000000fffb0000000082fb0d3cc3aa39ee4b1386bab561cda886fa642994cacd473b543ccb5f0d7b63924f17c67b13631d22a11dc3c693962895496d4f6e9cc54db6c7205a6b06ff7f0000000000007f31d7c8cc5d325c5379b0363ce8bd1f61b007e1ff5f1be1969a1ba791ad46d800000000c7f26a1f37302f3b41eae59809fd05d12f6106f117b062df67d3a6473265dd1410eea68208a3f26b2989b832d8b34a34a4f08b34b3042065acaa10856e858d27adee7daf32903d3fc78700d429a2d4c8b6d803eb83eecfe4c7ff9e6ab5a52e83d089e0b1c23c0f3cdad7a8710e0254f1b11cced7bc3c8da0c44d2ebf9f6f3ff3be4d1458077c2253b0c7c7a1a9fdd63bf910dc20e5cb2a88e59febc47f1212a21f631d22bad050e9856b48ae3a03a497c37758537650fe6db89da3c41fdc3d78e046f6160e1741299e8dc29906870e6431ed1eab5d067a183f064b060a8ec12725d42e3a74863d66bee966b1574f8e01b3f34a267ff0af1cb3f1f815f8989d78854ca4d3116dbc7e2bf2402a75fd7a55733360040855ed5d1c0d634fc5fb38f84d9d87b27f8a5d91217b728f13e3ee20e69e0ffb2780b1a7af137ff7b4c6ea9604faf0453bedf0c5d744b5272b44c23488b2bdbff947c4dfa108cbb88202eeb81f428a5b3c29984864961a57ff52f657a67463d7dbf85ae9321fc2cc17dc4a29b9cba8ded5de8206c812439ab129ae818837ee15620789c524b3baf49a09d8be0fc5beecf153236c19740be9bb7d958d5e87c6c09bf71a894bad62934782cc308e936d7637e07c4a2b4dc87b0da20000d9ef418cf19e7a8c4c328be0ce91798adc2dca87ddd9d064e081383409ed2912c811ae63f03212a5331c2a4ead000000000000000000000000000000000000000000000000001386866b311bd144bc32e059658c9f8342c90c1ade31b78072841b8b5a943d62a44cea6b050c42e3c205fad6a23fb43c93da0f49d911877265e6ee443e37397ecf89021e7f579e8d3a74c12b52938d91e9de07fc8eeeb9505f4a9c26266bf5449484ccc1317c7476"], &(0x7f0000000100)='GPL\x00', 0xb, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sk_skb}, 0x48) write(r0, &(0x7f0000000000)="70deab0cb2fd364ac1aecb18e0eedf39c42d6d300cb2c11b093f99cb499ab6ba7f93c1c18dba6bc5fcd5af32f8db5695a81726ad6739ba2e9242547b70ea835c94c6ac74cede7bfda29f62a67cf850f55e5735", 0x53) semget$private(0x0, 0x2, 0x1a0) clock_gettime(0x0, &(0x7f0000001b00)={0x0, 0x0}) recvmmsg(r4, &(0x7f0000001a40)=[{{0x0, 0x0, &(0x7f0000000100)=[{&(0x7f00000004c0)=""/200, 0xc8}, {&(0x7f00000005c0)=""/4096, 0x1000}], 0x2, &(0x7f00000015c0)=""/182, 0xb6}, 0xc128}, {{&(0x7f0000000180)=@qipcrtr, 0x80, &(0x7f0000000280)}}, {{&(0x7f0000000400)=@pppoe, 0x80, &(0x7f0000001840)=[{&(0x7f0000001680)=""/106, 0x6a}, {&(0x7f0000001700)=""/83, 0x53}, {&(0x7f0000001780)=""/85, 0x55}, {&(0x7f0000001800)=""/48, 0x30}, {&(0x7f0000001940)=""/251, 0xfb}], 0x5, &(0x7f00000018c0)=""/29, 0x1d}, 0x7fffffff}], 0x3, 0x80000002, &(0x7f0000001b40)={r6, r7+60000000}) kernel console output (not intermixed with test programs): evice found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 1330.885876][ T10] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1330.961774][ T10] usb 10-1: config 0 descriptor?? [ 1331.016629][T21915] FAULT_INJECTION: forcing a failure. [ 1331.016629][T21915] name failslab, interval 1, probability 0, space 0, times 0 [ 1331.046928][T21915] CPU: 1 UID: 0 PID: 21915 Comm: syz.4.4341 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1331.046956][T21915] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1331.046966][T21915] Call Trace: [ 1331.046972][T21915] [ 1331.046979][T21915] dump_stack_lvl+0x16c/0x1f0 [ 1331.047008][T21915] should_fail_ex+0x512/0x640 [ 1331.047031][T21915] ? __kmalloc_noprof+0xbf/0x510 [ 1331.047057][T21915] ? ovl_lookup+0x1243/0x21a0 [ 1331.047077][T21915] should_failslab+0xc2/0x120 [ 1331.047103][T21915] __kmalloc_noprof+0xd2/0x510 [ 1331.047130][T21915] ovl_lookup+0x1243/0x21a0 [ 1331.047152][T21915] ? find_held_lock+0x2b/0x80 [ 1331.047172][T21915] ? __pfx_ovl_lookup+0x10/0x10 [ 1331.047186][T21915] ? d_alloc_parallel+0x6ae/0x12e0 [ 1331.047204][T21915] ? register_lock_class+0x41/0x4c0 [ 1331.047220][T21915] ? lockdep_init_map_type+0x5c/0x280 [ 1331.047234][T21915] __lookup_slow+0x251/0x460 [ 1331.047247][T21915] ? __pfx___lookup_slow+0x10/0x10 [ 1331.047272][T21915] ? lookup_fast+0x156/0x610 [ 1331.047288][T21915] walk_component+0x353/0x5b0 [ 1331.047303][T21915] path_lookupat+0x142/0x6d0 [ 1331.047319][T21915] filename_lookup+0x224/0x5f0 [ 1331.047333][T21915] ? do_syscall_64+0xcd/0x4c0 [ 1331.047350][T21915] ? __pfx_filename_lookup+0x10/0x10 [ 1331.047382][T21915] do_linkat+0x14c/0x5a0 [ 1331.047400][T21915] ? __pfx_do_linkat+0x10/0x10 [ 1331.047417][T21915] ? strncpy_from_user+0x203/0x2e0 [ 1331.047433][T21915] ? getname_flags.part.0+0x1c5/0x550 [ 1331.047448][T21915] __x64_sys_linkat+0xea/0x130 [ 1331.047465][T21915] do_syscall_64+0xcd/0x4c0 [ 1331.047482][T21915] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1331.047494][T21915] RIP: 0033:0x7f26d298e929 [ 1331.047504][T21915] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1331.047515][T21915] RSP: 002b:00007f26d3817038 EFLAGS: 00000246 ORIG_RAX: 0000000000000109 [ 1331.047526][T21915] RAX: ffffffffffffffda RBX: 00007f26d2bb5fa0 RCX: 00007f26d298e929 [ 1331.047533][T21915] RDX: 0000000000000003 RSI: 0000200000000100 RDI: ffffffffffffff9c [ 1331.047540][T21915] RBP: 00007f26d3817090 R08: 0000000000000000 R09: 0000000000000000 [ 1331.047546][T21915] R10: 0000200000000240 R11: 0000000000000246 R12: 0000000000000001 [ 1331.047553][T21915] R13: 0000000000000000 R14: 00007f26d2bb5fa0 R15: 00007ffc4cda3138 [ 1331.047566][T21915] [ 1331.282961][ C1] vkms_vblank_simulate: vblank timer overrun [ 1331.313833][ T8459] usb 10-1: USB disconnect, device number 34 [ 1331.533077][ T8459] usb 9-1: USB disconnect, device number 51 [ 1331.619626][T12277] usb 3-1: new full-speed USB device number 18 using dummy_hcd [ 1332.554539][T12277] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1332.567235][T12277] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1332.580973][T12277] usb 3-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1332.593706][T12277] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1332.658656][T12277] usb 3-1: config 0 descriptor?? [ 1332.704605][T12277] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1332.710302][T12330] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1332.938158][T21941] SELinux: syz.6.4350 (21941) set checkreqprot to 1. This is no longer supported. [ 1334.821977][T21963] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1334.831694][T21963] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4352'. [ 1335.235146][T12277] usb 3-1: USB disconnect, device number 18 [ 1335.340754][T21965] syzkaller0: entered promiscuous mode [ 1335.370989][T21965] syzkaller0: entered allmulticast mode [ 1335.659437][T12277] usb 3-1: new high-speed USB device number 19 using dummy_hcd [ 1335.819641][T12277] usb 3-1: Using ep0 maxpacket: 16 [ 1335.853726][T12277] usb 3-1: config 0 has an invalid interface number: 67 but max is 0 [ 1335.871518][T12277] usb 3-1: config 0 has no interface number 0 [ 1335.888139][T12277] usb 3-1: config 0 interface 67 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1335.889315][T21972] FAULT_INJECTION: forcing a failure. [ 1335.889315][T21972] name failslab, interval 1, probability 0, space 0, times 0 [ 1335.928177][T12277] usb 3-1: config 0 interface 67 altsetting 0 bulk endpoint 0xE has invalid maxpacket 64 [ 1335.934474][T21972] CPU: 0 UID: 0 PID: 21972 Comm: syz.4.4357 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1335.934502][T21972] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1335.934511][T21972] Call Trace: [ 1335.934517][T21972] [ 1335.934524][T21972] dump_stack_lvl+0x16c/0x1f0 [ 1335.934550][T21972] should_fail_ex+0x512/0x640 [ 1335.934571][T21972] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 1335.934595][T21972] should_failslab+0xc2/0x120 [ 1335.934618][T21972] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1335.934639][T21972] ? vm_area_dup+0x27/0x8d0 [ 1335.934661][T21972] vm_area_dup+0x27/0x8d0 [ 1335.934681][T21972] __split_vma+0x18e/0x1070 [ 1335.934704][T21972] ? __pfx___split_vma+0x10/0x10 [ 1335.934728][T21972] ? mas_find+0x2f6/0x530 [ 1335.934751][T21972] ? validate_mm+0x40a/0x570 [ 1335.934773][T21972] vms_gather_munmap_vmas+0x1c2/0x1310 [ 1335.934791][T21972] ? lockdep_hardirqs_on+0x7c/0x110 [ 1335.934816][T21972] ? __pfx_vms_gather_munmap_vmas+0x10/0x10 [ 1335.934835][T21972] ? kmem_cache_free+0x16d/0x4d0 [ 1335.934853][T21972] ? __sanitizer_cov_trace_switch+0x54/0x90 [ 1335.934872][T21972] ? percpu_counter_add_batch+0xb8/0x1f0 [ 1335.934890][T21972] ? __mt_destroy+0xa8/0x3e0 [ 1335.934911][T21972] ? vms_complete_munmap_vmas+0x667/0x970 [ 1335.934936][T21972] do_vmi_align_munmap+0x27c/0x7d0 [ 1335.934965][T21972] ? __pfx_do_vmi_align_munmap+0x10/0x10 [ 1335.935021][T21972] do_vmi_munmap+0x204/0x3e0 [ 1335.935044][T21972] shrink_vma+0x1cc/0x380 [ 1335.935065][T21972] ? __pfx_shrink_vma+0x10/0x10 [ 1335.935082][T21972] ? __pfx_do_munmap+0x10/0x10 [ 1335.935103][T21972] ? __pfx_down_write_killable+0x10/0x10 [ 1335.935136][T21972] __do_sys_mremap+0x1036/0x1590 [ 1335.935159][T21972] ? __pfx___do_sys_mremap+0x10/0x10 [ 1335.935180][T21972] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 1335.935205][T21972] ? __pfx___mutex_unlock_slowpath+0x10/0x10 [ 1335.935231][T21972] ? __fget_files+0x20e/0x3c0 [ 1335.935272][T21972] do_syscall_64+0xcd/0x4c0 [ 1335.935296][T21972] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1335.935312][T21972] RIP: 0033:0x7f26d298e929 [ 1335.935326][T21972] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1335.935340][T21972] RSP: 002b:00007f26d3817038 EFLAGS: 00000246 ORIG_RAX: 0000000000000019 [ 1335.935356][T21972] RAX: ffffffffffffffda RBX: 00007f26d2bb5fa0 RCX: 00007f26d298e929 [ 1335.935367][T21972] RDX: 0000000000002000 RSI: 0000000000003000 RDI: 0000200000ffc000 [ 1335.935376][T21972] RBP: 00007f26d3817090 R08: 000020000026f000 R09: 0000000000000000 [ 1335.935386][T21972] R10: 0000000000000003 R11: 0000000000000246 R12: 0000000000000001 [ 1335.935395][T21972] R13: 0000000000000000 R14: 00007f26d2bb5fa0 R15: 00007ffc4cda3138 [ 1335.935416][T21972] [ 1336.534139][ T9] usb 9-1: new high-speed USB device number 52 using dummy_hcd [ 1336.693198][ T9] usb 9-1: Using ep0 maxpacket: 16 [ 1336.709900][ T9] usb 9-1: New USB device found, idVendor=05d1, idProduct=2001, bcdDevice= 2.00 [ 1336.721027][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1336.751904][ T9] usb 9-1: config 0 descriptor?? [ 1336.774393][ T9] ftdi_sio 9-1:0.0: FTDI USB Serial Device converter detected [ 1336.903040][T12277] usb 3-1: config 0 interface 67 altsetting 0 has a duplicate endpoint with address 0xE, skipping [ 1336.941532][T12277] usb 3-1: New USB device found, idVendor=17cc, idProduct=1978, bcdDevice= 1.34 [ 1336.969467][T12277] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1336.987634][ T9] usb 9-1: Detected FT232B [ 1337.000496][T12277] usb 3-1: Product: syz [ 1337.009394][T12277] usb 3-1: Manufacturer: syz [ 1337.014009][T12277] usb 3-1: SerialNumber: syz [ 1337.037333][T12277] usb 3-1: config 0 descriptor?? [ 1337.043912][T21967] raw-gadget.0 gadget.2: fail, usb_ep_enable returned -22 [ 1337.104206][T12277] snd-usb-caiaq 3-1:0.67: can't set alt interface. [ 1337.137327][T12277] usb 3-1: unable to init card! (ret=-5) [ 1337.150203][T12277] snd-usb-caiaq 3-1:0.67: probe with driver snd-usb-caiaq failed with error -5 [ 1337.188211][ T9] ftdi_sio ttyUSB0: Unable to read latency timer: -32 [ 1337.198261][ T9] usb 9-1: FTDI USB Serial Device converter now attached to ttyUSB0 [ 1337.400308][T21983] netlink: 'syz.4.4360': attribute type 4 has an invalid length. [ 1337.408104][T21983] netlink: 17 bytes leftover after parsing attributes in process `syz.4.4360'. [ 1337.854753][T21977] netlink: 'syz.8.4356': attribute type 4 has an invalid length. [ 1337.867001][T21977] netlink: 17 bytes leftover after parsing attributes in process `syz.8.4356'. [ 1338.059937][T12277] usb 3-1: USB disconnect, device number 19 [ 1340.297137][T21995] lo speed is unknown, defaulting to 1000 [ 1340.337195][T22004] SELinux: syz.6.4364 (22004) set checkreqprot to 1. This is no longer supported. [ 1340.371597][T12277] usb 9-1: USB disconnect, device number 52 [ 1340.540147][T12277] ftdi_sio ttyUSB0: FTDI USB Serial Device converter now disconnected from ttyUSB0 [ 1340.569750][T12277] ftdi_sio 9-1:0.0: device disconnected [ 1342.349529][T12281] usb 10-1: new high-speed USB device number 35 using dummy_hcd [ 1342.965933][T12281] usb 10-1: config 0 has an invalid interface number: 84 but max is 0 [ 1343.088625][T22029] lo speed is unknown, defaulting to 1000 [ 1344.652638][T12281] usb 10-1: config 0 has an invalid interface descriptor of length 6, skipping [ 1344.662409][T12281] usb 10-1: config 0 has no interface number 0 [ 1344.668655][T12281] usb 10-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 1560, setting to 64 [ 1344.679760][T12281] usb 10-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1344.715724][T12281] usb 10-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 1344.729720][T12281] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1344.750106][T12281] usb 10-1: Product: syz [ 1344.750122][ T8459] usb 5-1: new high-speed USB device number 121 using dummy_hcd [ 1344.754356][T12281] usb 10-1: Manufacturer: syz [ 1344.769820][T12281] usb 10-1: SerialNumber: syz [ 1344.776571][T12281] usb 10-1: config 0 descriptor?? [ 1344.802027][T12281] ljca 10-1:0.84: bulk endpoints not found [ 1344.921662][ T8459] usb 5-1: Using ep0 maxpacket: 16 [ 1344.928346][ T8459] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1344.938183][ T8459] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1345.032572][ T10] usb 10-1: USB disconnect, device number 35 [ 1345.120002][T22047] input: syz1 as /devices/virtual/input/input91 [ 1345.533340][ T8459] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1345.545598][ T8459] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1345.563450][ T8459] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1345.584857][ T8459] usb 5-1: Product: syz [ 1345.589083][ T8459] usb 5-1: Manufacturer: syz [ 1345.594799][ T8459] usb 5-1: SerialNumber: syz [ 1345.999232][ T8459] usb 5-1: 0:2 : does not exist [ 1346.014070][ T8459] usb 5-1: USB disconnect, device number 121 [ 1346.109911][ T10] usb 3-1: new full-speed USB device number 20 using dummy_hcd [ 1346.129573][T14270] usb 9-1: new high-speed USB device number 53 using dummy_hcd [ 1346.285628][ T10] usb 3-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1346.296571][ T10] usb 3-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1346.310536][T14270] usb 9-1: config 0 has no interfaces? [ 1346.316006][T14270] usb 9-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1346.325607][ T10] usb 3-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1346.335042][T14270] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1346.345100][ T10] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1346.356378][T14270] usb 9-1: config 0 descriptor?? [ 1346.366101][ T10] usb 3-1: config 0 descriptor?? [ 1346.375318][ T10] usbhid 3-1:0.0: couldn't find an input interrupt endpoint [ 1348.848542][ T10] usb 9-1: USB disconnect, device number 53 [ 1349.530606][ T10] usb 3-1: USB disconnect, device number 20 [ 1351.191740][T22104] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1351.200612][T22104] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4388'. [ 1351.698202][T22093] lo speed is unknown, defaulting to 1000 [ 1351.706675][T22073] lo speed is unknown, defaulting to 1000 [ 1351.719481][T12281] usb 9-1: new high-speed USB device number 54 using dummy_hcd [ 1351.870902][T12281] usb 9-1: config 0 has an invalid interface number: 84 but max is 0 [ 1351.920800][T12281] usb 9-1: config 0 has an invalid interface descriptor of length 6, skipping [ 1352.014493][T12281] usb 9-1: config 0 has no interface number 0 [ 1352.069786][T12281] usb 9-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 1560, setting to 64 [ 1352.126343][T12281] usb 9-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1352.151775][T12281] usb 9-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 1352.166799][T12281] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1352.182354][T12281] usb 9-1: Product: syz [ 1352.193009][T12281] usb 9-1: Manufacturer: syz [ 1352.197709][T12281] usb 9-1: SerialNumber: syz [ 1352.220814][T12281] usb 9-1: config 0 descriptor?? [ 1352.228032][T12281] ljca 9-1:0.84: bulk endpoints not found [ 1352.349902][T14270] usb 7-1: new high-speed USB device number 104 using dummy_hcd [ 1352.612660][ T10] usb 9-1: USB disconnect, device number 54 [ 1352.625128][T14270] usb 7-1: config 0 has an invalid interface number: 199 but max is 1 [ 1352.633796][T14270] usb 7-1: config 0 has no interface number 1 [ 1352.640442][T14270] usb 7-1: config 0 interface 199 altsetting 0 endpoint 0xA has invalid wMaxPacketSize 0 [ 1352.652845][T14270] usb 7-1: config 0 interface 0 altsetting 0 has an invalid descriptor for endpoint zero, skipping [ 1352.670007][T14270] usb 7-1: New USB device found, idVendor=0002, idProduct=0000, bcdDevice= 0.00 [ 1352.700042][T14270] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=3 [ 1352.729791][T14270] usb 7-1: SerialNumber: syz [ 1352.747290][T14270] usb 7-1: config 0 descriptor?? [ 1352.766288][T14270] usb 7-1: Found UVC 0.00 device (0002:0000) [ 1352.780435][T14270] usb 7-1: No valid video chain found. [ 1352.976993][T22111] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1352.985820][T22111] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1353.259734][T12282] usb 5-1: new high-speed USB device number 122 using dummy_hcd [ 1353.602248][T22111] binder: 22110:22111 unknown command 0 [ 1353.636063][T22111] binder: 22110:22111 ioctl c0306201 200000000c40 returned -22 [ 1353.775321][T14270] usb 7-1: USB disconnect, device number 104 [ 1354.239068][T22131] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1354.279454][T12282] usb 5-1: Using ep0 maxpacket: 16 [ 1354.286104][T12282] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1354.295033][T12282] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1354.305368][T12282] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1354.317168][T12282] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1354.327382][T12282] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1354.335530][T12282] usb 5-1: Product: syz [ 1354.339903][T12282] usb 5-1: Manufacturer: syz [ 1354.344598][T12282] usb 5-1: SerialNumber: syz [ 1354.350093][T22131] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4395'. [ 1354.676532][T14270] usb 10-1: new full-speed USB device number 36 using dummy_hcd [ 1355.043504][T14270] usb 10-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 1355.066393][T14270] usb 10-1: config 0 interface 0 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 1355.088738][T14270] usb 10-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1355.108120][T14270] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1355.504212][T12282] usb 5-1: 0:2 : does not exist [ 1355.513724][T12282] usb 5-1: USB disconnect, device number 122 [ 1355.551484][T22146] FAULT_INJECTION: forcing a failure. [ 1355.551484][T22146] name failslab, interval 1, probability 0, space 0, times 0 [ 1355.571402][T22146] CPU: 1 UID: 0 PID: 22146 Comm: syz.2.4401 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1355.571420][T22146] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1355.571427][T22146] Call Trace: [ 1355.571431][T22146] [ 1355.571436][T22146] dump_stack_lvl+0x16c/0x1f0 [ 1355.571456][T22146] should_fail_ex+0x512/0x640 [ 1355.571471][T22146] ? fs_reclaim_acquire+0xae/0x150 [ 1355.571484][T22146] ? tomoyo_encode2+0x100/0x3e0 [ 1355.571500][T22146] should_failslab+0xc2/0x120 [ 1355.571517][T22146] __kmalloc_noprof+0xd2/0x510 [ 1355.571535][T22146] tomoyo_encode2+0x100/0x3e0 [ 1355.571552][T22146] tomoyo_encode+0x29/0x50 [ 1355.571567][T22146] tomoyo_realpath_from_path+0x18f/0x6e0 [ 1355.571585][T22146] ? tomoyo_profile+0x47/0x60 [ 1355.571605][T22146] tomoyo_path_number_perm+0x245/0x580 [ 1355.571617][T22146] ? tomoyo_path_number_perm+0x237/0x580 [ 1355.571632][T22146] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1355.571647][T22146] ? find_held_lock+0x2b/0x80 [ 1355.571674][T22146] ? find_held_lock+0x2b/0x80 [ 1355.571687][T22146] ? hook_file_ioctl_common+0x145/0x410 [ 1355.571701][T22146] ? __fget_files+0x20e/0x3c0 [ 1355.571719][T22146] security_file_ioctl+0x9b/0x240 [ 1355.571735][T22146] __x64_sys_ioctl+0xb7/0x210 [ 1355.571750][T22146] do_syscall_64+0xcd/0x4c0 [ 1355.571767][T22146] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1355.571778][T22146] RIP: 0033:0x7fe79f78e929 [ 1355.571788][T22146] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1355.571800][T22146] RSP: 002b:00007fe7a05f8038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1355.571811][T22146] RAX: ffffffffffffffda RBX: 00007fe79f9b5fa0 RCX: 00007fe79f78e929 [ 1355.571818][T22146] RDX: 00002000000000c0 RSI: 00000000000089e1 RDI: 0000000000000003 [ 1355.571825][T22146] RBP: 00007fe7a05f8090 R08: 0000000000000000 R09: 0000000000000000 [ 1355.571831][T22146] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1355.571838][T22146] R13: 0000000000000000 R14: 00007fe79f9b5fa0 R15: 00007ffc4da2d5d8 [ 1355.571852][T22146] [ 1355.571862][T22146] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1355.589134][T14270] usb 10-1: config 0 descriptor?? [ 1355.837217][T14270] usbhid 10-1:0.0: couldn't find an input interrupt endpoint [ 1355.869572][T12277] usb 7-1: new high-speed USB device number 105 using dummy_hcd [ 1356.153432][T12277] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1356.613024][T22153] lo speed is unknown, defaulting to 1000 [ 1357.048371][T12277] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1357.066576][T12277] usb 7-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1357.075815][T12277] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1357.135439][T12277] usb 7-1: config 0 descriptor?? [ 1357.376517][T22163] netlink: 4 bytes leftover after parsing attributes in process `syz.8.4405'. [ 1357.387538][T22163] FAULT_INJECTION: forcing a failure. [ 1357.387538][T22163] name failslab, interval 1, probability 0, space 0, times 0 [ 1357.407413][T22163] CPU: 0 UID: 0 PID: 22163 Comm: syz.8.4405 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1357.407439][T22163] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1357.407449][T22163] Call Trace: [ 1357.407456][T22163] [ 1357.407463][T22163] dump_stack_lvl+0x16c/0x1f0 [ 1357.407492][T22163] should_fail_ex+0x512/0x640 [ 1357.407514][T22163] ? __kmalloc_noprof+0xbf/0x510 [ 1357.407540][T22163] ? nft_obj_init+0x1c6/0x370 [ 1357.407564][T22163] should_failslab+0xc2/0x120 [ 1357.407589][T22163] __kmalloc_noprof+0xd2/0x510 [ 1357.407611][T22163] ? __nla_parse+0x40/0x60 [ 1357.407628][T22163] ? __pfx_nft_limit_obj_select_ops+0x10/0x10 [ 1357.407650][T22163] nft_obj_init+0x1c6/0x370 [ 1357.407676][T22163] nf_tables_newobj+0xaa8/0x15b0 [ 1357.407705][T22163] ? __pfx_nf_tables_newobj+0x10/0x10 [ 1357.407732][T22163] ? __nla_parse+0x40/0x60 [ 1357.407751][T22163] nfnetlink_rcv_batch+0x18ed/0x2330 [ 1357.407786][T22163] ? __pfx_nfnetlink_rcv_batch+0x10/0x10 [ 1357.407819][T22163] ? avc_has_perm_noaudit+0x149/0x3b0 [ 1357.407860][T22163] ? __nla_parse+0x40/0x60 [ 1357.407878][T22163] nfnetlink_rcv+0x3c1/0x430 [ 1357.407895][T22163] ? __pfx_nfnetlink_rcv+0x10/0x10 [ 1357.407918][T22163] netlink_unicast+0x58a/0x850 [ 1357.407936][T22163] ? __pfx_netlink_unicast+0x10/0x10 [ 1357.407957][T22163] netlink_sendmsg+0x8d1/0xdd0 [ 1357.407976][T22163] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1357.408000][T22163] ____sys_sendmsg+0xa95/0xc70 [ 1357.408017][T22163] ? copy_msghdr_from_user+0x10a/0x160 [ 1357.408037][T22163] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1357.408063][T22163] ___sys_sendmsg+0x134/0x1d0 [ 1357.408084][T22163] ? __pfx____sys_sendmsg+0x10/0x10 [ 1357.408101][T22163] ? __lock_acquire+0x622/0x1c90 [ 1357.408148][T22163] __sys_sendmsg+0x16d/0x220 [ 1357.408168][T22163] ? __pfx___sys_sendmsg+0x10/0x10 [ 1357.408204][T22163] do_syscall_64+0xcd/0x4c0 [ 1357.408226][T22163] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1357.408240][T22163] RIP: 0033:0x7f8212b8e929 [ 1357.408253][T22163] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1357.408267][T22163] RSP: 002b:00007f8213993038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1357.408284][T22163] RAX: ffffffffffffffda RBX: 00007f8212db5fa0 RCX: 00007f8212b8e929 [ 1357.408294][T22163] RDX: 0000000000000000 RSI: 0000200000000840 RDI: 0000000000000003 [ 1357.408303][T22163] RBP: 00007f8213993090 R08: 0000000000000000 R09: 0000000000000000 [ 1357.408312][T22163] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1357.408320][T22163] R13: 0000000000000000 R14: 00007f8212db5fa0 R15: 00007fff339c9d98 [ 1357.408340][T22163] [ 1357.411681][T12285] usb 10-1: USB disconnect, device number 36 [ 1358.359832][T14270] usb 9-1: new high-speed USB device number 55 using dummy_hcd [ 1358.359934][T12285] usb 10-1: new high-speed USB device number 37 using dummy_hcd [ 1358.542023][T14270] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1358.573865][T14270] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1358.657061][T14270] usb 9-1: New USB device found, idVendor=256c, idProduct=006d, bcdDevice= 0.00 [ 1358.660475][T12285] usb 10-1: config 0 has an invalid interface number: 84 but max is 0 [ 1358.833071][T14270] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1358.833168][T12285] usb 10-1: config 0 has an invalid interface descriptor of length 6, skipping [ 1358.852124][T12285] usb 10-1: config 0 has no interface number 0 [ 1359.244964][T14270] usb 9-1: config 0 descriptor?? [ 1359.257692][T12285] usb 10-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 1560, setting to 64 [ 1359.295430][T12285] usb 10-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1359.360114][T12285] usb 10-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 1359.370239][T12285] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1359.378399][T12285] usb 10-1: Product: syz [ 1359.384387][T12285] usb 10-1: Manufacturer: syz [ 1359.389136][T12285] usb 10-1: SerialNumber: syz [ 1359.484944][T12285] usb 10-1: config 0 descriptor?? [ 1359.516896][T12285] ljca 10-1:0.84: bulk endpoints not found [ 1359.788094][ T8459] usb 10-1: USB disconnect, device number 37 [ 1359.873299][T22168] FAULT_INJECTION: forcing a failure. [ 1359.873299][T22168] name failslab, interval 1, probability 0, space 0, times 0 [ 1359.888854][T22168] CPU: 0 UID: 0 PID: 22168 Comm: syz.8.4407 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1359.888879][T22168] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1359.888890][T22168] Call Trace: [ 1359.888896][T22168] [ 1359.888906][T22168] dump_stack_lvl+0x16c/0x1f0 [ 1359.888934][T22168] should_fail_ex+0x512/0x640 [ 1359.888953][T22168] ? kmem_cache_alloc_lru_noprof+0x5f/0x3b0 [ 1359.888979][T22168] should_failslab+0xc2/0x120 [ 1359.889002][T22168] kmem_cache_alloc_lru_noprof+0x72/0x3b0 [ 1359.889025][T22168] ? __d_alloc+0x31/0xaa0 [ 1359.889049][T22168] __d_alloc+0x31/0xaa0 [ 1359.889065][T22168] ? __pfx_selinux_inode_init_security_anon+0x10/0x10 [ 1359.889083][T22168] d_alloc_pseudo+0x1c/0xc0 [ 1359.889096][T22168] alloc_file_pseudo+0xcf/0x230 [ 1359.889113][T22168] ? __pfx_alloc_file_pseudo+0x10/0x10 [ 1359.889131][T22168] ? security_inode_init_security_anon+0x79/0x240 [ 1359.889159][T22168] secretmem_file_create.constprop.0+0x89/0x270 [ 1359.889185][T22168] __x64_sys_memfd_secret+0xc5/0x1a0 [ 1359.889202][T22168] do_syscall_64+0xcd/0x4c0 [ 1359.889220][T22168] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1359.889232][T22168] RIP: 0033:0x7f8212b8e929 [ 1359.889241][T22168] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1359.889255][T22168] RSP: 002b:00007f8213993038 EFLAGS: 00000246 ORIG_RAX: 00000000000001bf [ 1359.889272][T22168] RAX: ffffffffffffffda RBX: 00007f8212db5fa0 RCX: 00007f8212b8e929 [ 1359.889283][T22168] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 1359.889292][T22168] RBP: 00007f8213993090 R08: 0000000000000000 R09: 0000000000000000 [ 1359.889302][T22168] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1359.889312][T22168] R13: 0000000000000000 R14: 00007f8212db5fa0 R15: 00007fff339c9d98 [ 1359.889331][T22168] [ 1360.076439][T12277] usb 7-1: string descriptor 0 read error: -71 [ 1360.086958][T12277] uclogic 0003:256C:006D.0021: failed retrieving string descriptor #200: -71 [ 1360.097938][T12277] uclogic 0003:256C:006D.0021: failed retrieving pen parameters: -71 [ 1360.114079][T12277] uclogic 0003:256C:006D.0021: failed probing pen v2 parameters: -71 [ 1360.124522][T12277] uclogic 0003:256C:006D.0021: failed probing parameters: -71 [ 1360.380486][T12277] uclogic 0003:256C:006D.0021: probe with driver uclogic failed with error -71 [ 1360.610174][T22182] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1360.624458][T12277] usb 7-1: USB disconnect, device number 105 [ 1360.728131][T22182] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4409'. [ 1361.353334][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1361.667520][T22200] netlink: 'syz.4.4415': attribute type 10 has an invalid length. [ 1361.758230][T22200] team0: Device lo is loopback device. Loopback devices can't be added as a team port [ 1361.840625][T22200] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 1361.870205][ T974] usb 7-1: new high-speed USB device number 106 using dummy_hcd [ 1362.033863][ T974] usb 7-1: Using ep0 maxpacket: 16 [ 1362.041912][ T974] usb 7-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1362.113873][ T974] usb 7-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1362.153301][ T974] usb 7-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1362.198940][ T974] usb 7-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1362.227669][ T974] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1362.277240][ T974] usb 7-1: Product: syz [ 1362.295107][ T974] usb 7-1: Manufacturer: syz [ 1362.309954][ T974] usb 7-1: SerialNumber: syz [ 1362.539222][T14270] usb 9-1: string descriptor 0 read error: -71 [ 1362.580862][T14270] uclogic 0003:256C:006D.0022: failed retrieving string descriptor #200: -71 [ 1362.611378][T14270] uclogic 0003:256C:006D.0022: failed retrieving pen parameters: -71 [ 1362.655288][T14270] uclogic 0003:256C:006D.0022: failed probing pen v2 parameters: -71 [ 1362.692416][T14270] uclogic 0003:256C:006D.0022: failed probing parameters: -71 [ 1362.830282][T14270] uclogic 0003:256C:006D.0022: probe with driver uclogic failed with error -71 [ 1362.952694][T14270] usb 9-1: USB disconnect, device number 55 [ 1364.142860][ T974] usb 7-1: 0:2 : does not exist [ 1364.154755][ T974] usb 7-1: USB disconnect, device number 106 [ 1365.331666][T22243] lo speed is unknown, defaulting to 1000 [ 1367.688452][T22260] netlink: 56 bytes leftover after parsing attributes in process `syz.2.4427'. [ 1367.948759][T22259] netlink: 'syz.4.4428': attribute type 14 has an invalid length. [ 1368.220266][T22267] netlink: 'syz.8.4430': attribute type 10 has an invalid length. [ 1368.484100][T22267] bridge0: port 3(vlan2) entered disabled state [ 1370.012013][T22293] ucma_write: process 939 (syz.9.4439) changed security contexts after opening file descriptor, this is not allowed. [ 1370.589565][T22304] netlink: 'syz.8.4443': attribute type 10 has an invalid length. [ 1371.572037][T22326] netlink: 48 bytes leftover after parsing attributes in process `syz.8.4451'. [ 1371.668140][T22332] zonefs (nbd4) ERROR: Not a zoned block device [ 1372.613612][T22348] netlink: 'syz.4.4456': attribute type 10 has an invalid length. [ 1373.631758][T22364] bridge0: port 2(bridge_slave_1) entered disabled state [ 1373.638932][T22364] bridge0: port 1(bridge_slave_0) entered disabled state [ 1373.850929][T14270] usb 7-1: new high-speed USB device number 107 using dummy_hcd [ 1373.907465][T22364] batman_adv: batadv0: Interface deactivated: batadv_slave_0 [ 1373.924750][T22364] batman_adv: batadv0: Interface deactivated: batadv_slave_1 [ 1374.019916][T14270] usb 7-1: Using ep0 maxpacket: 16 [ 1374.026642][T14270] usb 7-1: config 0 has an invalid interface number: 132 but max is 0 [ 1374.039011][T14270] usb 7-1: config 0 has no interface number 0 [ 1374.097647][T14270] usb 7-1: New USB device found, idVendor=05ac, idProduct=0291, bcdDevice=43.25 [ 1374.108846][T14270] usb 7-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1374.132932][T22364] netdevsim netdevsim2 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1374.134342][T14270] usb 7-1: Product: syz [ 1374.167503][T14270] usb 7-1: Manufacturer: syz [ 1374.175278][T14270] usb 7-1: SerialNumber: syz [ 1374.181865][T14270] usb 7-1: config 0 descriptor?? [ 1374.188019][T14270] hub 7-1:0.132: bad descriptor, ignoring hub [ 1374.194608][T14270] hub 7-1:0.132: probe with driver hub failed with error -5 [ 1374.203711][T14270] input: bcm5974 as /devices/platform/dummy_hcd.6/usb7/7-1/7-1:0.132/input/input93 [ 1374.220984][T22364] netdevsim netdevsim2 netdevsim1: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1374.236447][T22364] netdevsim netdevsim2 netdevsim2: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1374.253799][T22364] netdevsim netdevsim2 netdevsim3: unset [1, 0] type 2 family 0 port 6081 - 0 [ 1374.341123][T22364] vlan2: left promiscuous mode [ 1374.345930][T22364] bridge0: left promiscuous mode [ 1374.357433][T18515] lo speed is unknown, defaulting to 1000 [ 1374.371682][T18515] syz0: Port: 1 Link DOWN [ 1374.557511][ T30] audit: type=1400 audit(1752387360.355:3013): avc: denied { append } for pid=22370 comm="syz.6.4463" name="cachefiles" dev="devtmpfs" ino=4 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:cachefiles_device_t tclass=chr_file permissive=1 [ 1375.377919][ T30] audit: type=1326 audit(1752387361.175:3014): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1375.423667][ T30] audit: type=1326 audit(1752387361.175:3015): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1375.537650][ T30] audit: type=1326 audit(1752387361.175:3016): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1375.564251][ T30] audit: type=1326 audit(1752387361.175:3017): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1375.746837][ T9] usb 7-1: USB disconnect, device number 107 [ 1375.767934][ T30] audit: type=1326 audit(1752387361.175:3018): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1376.170982][ T30] audit: type=1326 audit(1752387361.175:3019): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1376.211051][ T30] audit: type=1326 audit(1752387361.175:3020): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1376.236696][ T30] audit: type=1326 audit(1752387361.175:3021): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=321 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1376.263366][ T30] audit: type=1326 audit(1752387361.175:3022): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=22370 comm="syz.6.4463" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7fcf58b8e929 code=0x7ffc0000 [ 1378.117031][T22422] pim6reg: entered allmulticast mode [ 1379.840101][T14270] usb 5-1: new high-speed USB device number 123 using dummy_hcd [ 1380.083087][T14270] usb 5-1: config 0 has an invalid interface number: 84 but max is 0 [ 1380.232223][T14270] usb 5-1: config 0 has an invalid interface descriptor of length 8, skipping [ 1380.241778][T14270] usb 5-1: config 0 has no interface number 0 [ 1380.251595][T14270] usb 5-1: config 0 interface 84 altsetting 0 endpoint 0x4 has invalid maxpacket 1560, setting to 64 [ 1380.263229][T14270] usb 5-1: config 0 interface 84 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 3 [ 1380.297522][T14270] usb 5-1: New USB device found, idVendor=8086, idProduct=0b63, bcdDevice=ca.f3 [ 1380.307381][T14270] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1380.741964][T14270] usb 5-1: Product: syz [ 1380.746165][T14270] usb 5-1: Manufacturer: syz [ 1380.779068][T14270] usb 5-1: SerialNumber: syz [ 1380.805325][T14270] usb 5-1: config 0 descriptor?? [ 1380.820288][T14270] ljca 5-1:0.84: bulk endpoints not found [ 1381.039939][ T974] usb 9-1: new high-speed USB device number 56 using dummy_hcd [ 1381.285416][ T974] usb 9-1: Using ep0 maxpacket: 16 [ 1381.299948][T18515] usb 7-1: new high-speed USB device number 108 using dummy_hcd [ 1382.027597][T12277] usb 5-1: USB disconnect, device number 123 [ 1382.189393][T18515] usb 7-1: Using ep0 maxpacket: 8 [ 1382.682096][ T974] usb 9-1: config 0 has an invalid interface number: 107 but max is 0 [ 1383.002505][ T974] usb 9-1: config 0 has no interface number 0 [ 1383.008629][ T974] usb 9-1: config 0 interface 107 altsetting 0 endpoint 0x88 has invalid wMaxPacketSize 0 [ 1383.030030][ T974] usb 9-1: config 0 interface 107 altsetting 0 bulk endpoint 0x88 has invalid maxpacket 0 [ 1383.042348][ T974] usb 9-1: New USB device found, idVendor=06cd, idProduct=0131, bcdDevice=16.60 [ 1383.206114][ T974] usb 9-1: New USB device strings: Mfr=175, Product=2, SerialNumber=3 [ 1383.231048][T18515] usb 7-1: unable to read config index 0 descriptor/start: -71 [ 1383.238651][T18515] usb 7-1: can't read configurations, error -71 [ 1383.277337][T22460] smc: net device bond0 applied user defined pnetid SYZ0 [ 1383.323391][T22471] veth0_macvtap: left promiscuous mode [ 1383.369966][ T974] usb 9-1: Product: syz [ 1383.402778][ T974] usb 9-1: Manufacturer: syz [ 1383.407400][ T974] usb 9-1: SerialNumber: syz [ 1383.414764][ T974] usb 9-1: config 0 descriptor?? [ 1384.215136][ T974] keyspan 9-1:0.107: Keyspan 4 port adapter converter detected [ 1384.454754][ T974] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 81 [ 1384.470922][ T974] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 1 [ 1384.480897][ T974] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB0 [ 1384.491011][ T974] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 2 [ 1384.500661][ T974] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB1 [ 1384.511574][ T974] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 4 [ 1384.524838][ T974] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB2 [ 1384.534685][ T974] keyspan 9-1:0.107: found no endpoint descriptor for endpoint 6 [ 1384.549173][ T974] usb 9-1: Keyspan 4 port adapter converter now attached to ttyUSB3 [ 1384.562558][ T974] usb 9-1: USB disconnect, device number 56 [ 1384.571472][ T974] keyspan_4 ttyUSB0: Keyspan 4 port adapter converter now disconnected from ttyUSB0 [ 1384.583207][ T974] keyspan_4 ttyUSB1: Keyspan 4 port adapter converter now disconnected from ttyUSB1 [ 1384.595511][ T974] keyspan_4 ttyUSB2: Keyspan 4 port adapter converter now disconnected from ttyUSB2 [ 1384.607664][ T974] keyspan_4 ttyUSB3: Keyspan 4 port adapter converter now disconnected from ttyUSB3 [ 1384.618984][ T974] keyspan 9-1:0.107: device disconnected [ 1385.341540][ T30] kauditd_printk_skb: 61 callbacks suppressed [ 1385.341554][ T30] audit: type=1400 audit(1752387371.149:3084): avc: denied { ioctl } for pid=22492 comm="syz.9.4490" path="/dev/input/mouse0" dev="devtmpfs" ino=1000 ioctlcmd=0xaf13 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:mouse_device_t tclass=chr_file permissive=1 [ 1385.640064][ T9] usb 3-1: new high-speed USB device number 21 using dummy_hcd [ 1385.842782][ T9] usb 3-1: Using ep0 maxpacket: 32 [ 1385.849993][ T974] usb 9-1: new high-speed USB device number 57 using dummy_hcd [ 1385.884621][ T9] usb 3-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 1385.933740][ T9] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1386.002044][ T9] usb 3-1: config 0 descriptor?? [ 1386.056712][ T9] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 1386.073213][ T974] usb 9-1: Using ep0 maxpacket: 32 [ 1386.088605][ T974] usb 9-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 1386.154122][ T974] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1386.169108][ T9] input: xirlink-cit as /devices/platform/dummy_hcd.2/usb3/3-1/input/input94 [ 1386.269019][ T974] usb 9-1: config 0 descriptor?? [ 1386.323468][ T9] usb 3-1: USB disconnect, device number 21 [ 1386.356140][ T974] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 1386.459093][ T974] input: xirlink-cit as /devices/platform/dummy_hcd.8/usb9/9-1/input/input95 [ 1386.730220][T14270] usb 7-1: new high-speed USB device number 110 using dummy_hcd [ 1386.900407][T14270] usb 7-1: Using ep0 maxpacket: 8 [ 1386.922025][T14270] usb 7-1: config index 0 descriptor too short (expected 6427, got 27) [ 1386.943900][T14270] usb 7-1: config 0 has an invalid interface number: 21 but max is 0 [ 1386.958693][T14270] usb 7-1: config 0 has no interface number 0 [ 1386.977587][T14270] usb 7-1: config 0 interface 21 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1387.016413][T14270] usb 7-1: config 0 interface 21 altsetting 0 endpoint 0x8F has an invalid bInterval 255, changing to 11 [ 1387.088984][T14270] usb 7-1: config 0 interface 21 altsetting 0 endpoint 0x8F has invalid maxpacket 59391, setting to 1024 [ 1387.186917][T14270] usb 7-1: New USB device found, idVendor=06cd, idProduct=0202, bcdDevice=92.d4 [ 1387.255001][T22503] team0: Port device bond0 removed [ 1387.266958][T14270] usb 7-1: New USB device strings: Mfr=0, Product=1, SerialNumber=0 [ 1387.358229][T14270] usb 7-1: Product: syz [ 1387.396081][T22503] bond1: (slave geneve2): Releasing active interface [ 1387.427649][ T974] videodev: could not get a free minor [ 1387.500401][ T974] gspca_main: video_register_device err -23 [ 1387.545416][T22504] team0: Mode changed to "loadbalance" [ 1387.557830][T14270] usb 7-1: config 0 descriptor?? [ 1387.620152][T22508] raw-gadget.0 gadget.6: fail, usb_ep_enable returned -22 [ 1387.638086][ T974] xirlink-cit 9-1:0.0: probe with driver xirlink-cit failed with error -23 [ 1387.739123][ T974] usb 9-1: USB disconnect, device number 57 [ 1388.175379][T14270] usb 7-1: USB disconnect, device number 110 [ 1388.348532][T22521] netlink: 20 bytes leftover after parsing attributes in process `syz.9.4497'. [ 1388.429393][T12277] usb 3-1: new high-speed USB device number 22 using dummy_hcd [ 1388.609565][T12277] usb 3-1: Using ep0 maxpacket: 8 [ 1388.621426][T14270] usb 7-1: new high-speed USB device number 111 using dummy_hcd [ 1388.900755][T12277] usb 3-1: config 6 has an invalid interface number: 2 but max is 0 [ 1388.931455][T12277] usb 3-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 1388.949974][ T9] usb 9-1: new high-speed USB device number 58 using dummy_hcd [ 1388.970915][T14270] usb 7-1: config 0 has no interfaces? [ 1388.976385][T14270] usb 7-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1388.985863][T14270] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1388.995324][T14270] usb 7-1: config 0 descriptor?? [ 1389.043284][T12277] usb 3-1: config 6 has no interface number 0 [ 1389.081972][T12277] usb 3-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1389.110971][ T9] usb 9-1: Using ep0 maxpacket: 8 [ 1389.135115][ T9] usb 9-1: config 6 has an invalid interface number: 2 but max is 0 [ 1389.146472][ T9] usb 9-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 1389.162194][T12277] usb 3-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 1389.179839][T12277] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.249970][ T9] usb 9-1: config 6 has no interface number 0 [ 1389.256736][ T9] usb 9-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1389.303322][T22535] fuse: Bad value for 'fd' [ 1389.333754][T12277] usb 3-1: Product: syz [ 1389.337958][T12277] usb 3-1: Manufacturer: syz [ 1389.342611][T12277] usb 3-1: SerialNumber: syz [ 1389.889067][T22537] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1389.902930][T12277] hso 3-1:6.2: Failed to find INT IN ep [ 1389.907623][T22537] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4500'. [ 1389.920055][ T9] usb 9-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 1389.944520][ T9] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1389.968442][ T9] usb 9-1: Product: syz [ 1390.005648][ T9] usb 9-1: Manufacturer: syz [ 1390.025723][ T9] usb 9-1: SerialNumber: syz [ 1390.044122][ T9] hso 9-1:6.2: Failed to find INT IN ep [ 1390.853572][T18515] usb 9-1: USB disconnect, device number 58 [ 1390.876384][ T9] usb 3-1: USB disconnect, device number 22 [ 1391.370013][ T9] usb 7-1: USB disconnect, device number 111 [ 1391.739431][T18515] usb 5-1: new high-speed USB device number 124 using dummy_hcd [ 1392.000078][ T9] usb 9-1: new high-speed USB device number 59 using dummy_hcd [ 1392.171368][T18515] usb 5-1: Using ep0 maxpacket: 32 [ 1392.358108][T18515] usb 5-1: New USB device found, idVendor=0545, idProduct=8080, bcdDevice= 3.01 [ 1392.368307][T18515] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.383749][T18515] usb 5-1: config 0 descriptor?? [ 1392.399469][T18515] gspca_main: xirlink-cit-2.14.0 probing 0545:8080 [ 1392.411718][T18515] input: xirlink-cit as /devices/platform/dummy_hcd.4/usb5/5-1/input/input97 [ 1392.581535][ T9] usb 9-1: config 0 has no interfaces? [ 1392.587069][ T9] usb 9-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1392.605506][T14270] usb 5-1: USB disconnect, device number 124 [ 1392.617688][T22568] ptrace attach of "./syz-executor exec"[16438] was attempted by "./syz-executor exec"[22568] [ 1392.628202][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1392.643415][ T9] usb 9-1: config 0 descriptor?? [ 1392.730250][T22570] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4510'. [ 1392.821575][T22555] tipc: Started in network mode [ 1392.828696][T22555] tipc: Node identity 4, cluster identity 4711 [ 1392.834911][T22555] tipc: Node number set to 4 [ 1392.949507][T18515] usb 3-1: new high-speed USB device number 23 using dummy_hcd [ 1393.557271][T22575] fuse: Bad value for 'fd' [ 1393.561869][T18515] usb 3-1: Using ep0 maxpacket: 8 [ 1393.570924][T18515] usb 3-1: config 179 has an invalid interface number: 65 but max is 0 [ 1393.579194][T18515] usb 3-1: config 179 has no interface number 0 [ 1393.590200][T18515] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1393.601663][T18515] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1393.630043][T18515] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 102, changing to 10 [ 1393.641637][T18515] usb 3-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 24624, setting to 1024 [ 1393.653506][T18515] usb 3-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1393.666914][T18515] usb 3-1: config 179 interface 65 has no altsetting 0 [ 1393.692953][T18515] usb 3-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1393.714134][T22579] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4514'. [ 1393.726170][T22579] dummy0: entered promiscuous mode [ 1393.733199][T22579] dummy0: entered allmulticast mode [ 1393.861101][T18515] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1393.897048][T18515] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.2/usb3/3-1/3-1:179.65/input/input98 [ 1394.351391][T22584] FAULT_INJECTION: forcing a failure. [ 1394.351391][T22584] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1394.370347][T22584] CPU: 0 UID: 0 PID: 22584 Comm: syz.6.4516 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1394.370377][T22584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1394.370388][T22584] Call Trace: [ 1394.370395][T22584] [ 1394.370402][T22584] dump_stack_lvl+0x16c/0x1f0 [ 1394.370431][T22584] should_fail_ex+0x512/0x640 [ 1394.370459][T22584] _copy_to_user+0x32/0xd0 [ 1394.370486][T22584] simple_read_from_buffer+0xcb/0x170 [ 1394.370512][T22584] proc_fail_nth_read+0x197/0x270 [ 1394.370536][T22584] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1394.370559][T22584] ? rw_verify_area+0xcf/0x680 [ 1394.370580][T22584] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 1394.370601][T22584] vfs_read+0x1e1/0xc60 [ 1394.370627][T22584] ? __pfx___mutex_lock+0x10/0x10 [ 1394.370652][T22584] ? __pfx_vfs_read+0x10/0x10 [ 1394.370681][T22584] ? __fget_files+0x20e/0x3c0 [ 1394.370718][T22584] ksys_read+0x12a/0x250 [ 1394.370740][T22584] ? __pfx_ksys_read+0x10/0x10 [ 1394.370771][T22584] do_syscall_64+0xcd/0x4c0 [ 1394.370797][T22584] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1394.370816][T22584] RIP: 0033:0x7fcf58b8d33c [ 1394.370830][T22584] Code: ec 28 48 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 99 93 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 31 c0 0f 05 <48> 3d 00 f0 ff ff 77 34 44 89 c7 48 89 44 24 08 e8 ef 93 02 00 48 [ 1394.370846][T22584] RSP: 002b:00007fcf59aa8030 EFLAGS: 00000246 ORIG_RAX: 0000000000000000 [ 1394.370864][T22584] RAX: ffffffffffffffda RBX: 00007fcf58db5fa0 RCX: 00007fcf58b8d33c [ 1394.370876][T22584] RDX: 000000000000000f RSI: 00007fcf59aa80a0 RDI: 0000000000000004 [ 1394.370886][T22584] RBP: 00007fcf59aa8090 R08: 0000000000000000 R09: 0000000000000000 [ 1394.370897][T22584] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1394.370908][T22584] R13: 0000000000000000 R14: 00007fcf58db5fa0 R15: 00007ffc01575bf8 [ 1394.370933][T22584] [ 1394.442154][ T5186] input input98: unable to receive magic message: -110 [ 1394.447509][ C0] vkms_vblank_simulate: vblank timer overrun [ 1394.863168][T14270] usb 9-1: USB disconnect, device number 59 [ 1395.774383][ T5186] input input98: unable to receive magic message: -32 [ 1395.950758][ T5186] input input98: unable to receive magic message: -32 [ 1396.539103][ T5186] input input98: unable to receive magic message: -32 [ 1396.866219][ C0] vxcan1: j1939_tp_rxtimer: 0xffff888076091400: rx timeout, send abort [ 1396.875569][ C0] vxcan1: j1939_xtp_rx_abort_one: 0xffff888076091400: 0x1ff01: (3) A timeout occurred and this is the connection abort to close the session. [ 1397.073158][T14270] usb 3-1: USB disconnect, device number 23 [ 1397.073256][ C1] xpad 3-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1397.967849][T22613] lo speed is unknown, defaulting to 1000 [ 1398.855758][T22632] sp0: Synchronizing with TNC [ 1399.032890][T22634] netlink: 28 bytes leftover after parsing attributes in process `syz.6.4531'. [ 1399.072527][ T30] audit: type=1400 audit(1752387384.879:3085): avc: denied { link } for pid=22630 comm="syz.4.4530" name="#32" dev="tmpfs" ino=1572 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1400.963560][ T30] audit: type=1400 audit(1752387384.879:3086): avc: denied { rename } for pid=22630 comm="syz.4.4530" name="#33" dev="tmpfs" ino=1572 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=chr_file permissive=1 [ 1400.985991][ C0] vkms_vblank_simulate: vblank timer overrun [ 1400.997004][T22638] fuse: Bad value for 'fd' [ 1401.072653][T22639] FAULT_INJECTION: forcing a failure. [ 1401.072653][T22639] name failslab, interval 1, probability 0, space 0, times 0 [ 1401.085901][T22639] CPU: 0 UID: 0 PID: 22639 Comm: syz.8.4532 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1401.085928][T22639] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1401.085939][T22639] Call Trace: [ 1401.085945][T22639] [ 1401.085953][T22639] dump_stack_lvl+0x16c/0x1f0 [ 1401.085983][T22639] should_fail_ex+0x512/0x640 [ 1401.086005][T22639] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 1401.086032][T22639] should_failslab+0xc2/0x120 [ 1401.086058][T22639] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1401.086082][T22639] ? security_file_alloc+0x34/0x2b0 [ 1401.086112][T22639] security_file_alloc+0x34/0x2b0 [ 1401.086139][T22639] init_file+0x93/0x4c0 [ 1401.086157][T22639] alloc_empty_file+0x73/0x1e0 [ 1401.086176][T22639] path_openat+0xda/0x2cb0 [ 1401.086198][T22639] ? entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1401.086226][T22639] ? __pfx_path_openat+0x10/0x10 [ 1401.086252][T22639] ? __lock_acquire+0xb8a/0x1c90 [ 1401.086273][T22639] do_filp_open+0x20b/0x470 [ 1401.086298][T22639] ? __pfx_do_filp_open+0x10/0x10 [ 1401.086340][T22639] ? alloc_fd+0x471/0x7d0 [ 1401.086378][T22639] do_sys_openat2+0x11b/0x1d0 [ 1401.086396][T22639] ? __pfx_do_sys_openat2+0x10/0x10 [ 1401.086416][T22639] ? __pfx___schedule+0x10/0x10 [ 1401.086438][T22639] ? rcu_is_watching+0x12/0xc0 [ 1401.086460][T22639] ? irqentry_exit+0x3b/0x90 [ 1401.086488][T22639] __x64_sys_openat+0x174/0x210 [ 1401.086506][T22639] ? __pfx___x64_sys_openat+0x10/0x10 [ 1401.086534][T22639] do_syscall_64+0xcd/0x4c0 [ 1401.086561][T22639] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1401.086578][T22639] RIP: 0033:0x7f8212b8e929 [ 1401.086593][T22639] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1401.086610][T22639] RSP: 002b:00007f8213972038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1401.086627][T22639] RAX: ffffffffffffffda RBX: 00007f8212db6080 RCX: 00007f8212b8e929 [ 1401.086638][T22639] RDX: 0000000000000002 RSI: 0000200000000000 RDI: ffffffffffffff9c [ 1401.086650][T22639] RBP: 00007f8213972090 R08: 0000000000000000 R09: 0000000000000000 [ 1401.086660][T22639] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1401.086669][T22639] R13: 0000000000000000 R14: 00007f8212db6080 R15: 00007fff339c9d98 [ 1401.086693][T22639] [ 1401.314724][ C0] vkms_vblank_simulate: vblank timer overrun [ 1401.473506][T22642] FAULT_INJECTION: forcing a failure. [ 1401.473506][T22642] name failslab, interval 1, probability 0, space 0, times 0 [ 1401.486831][T22642] CPU: 0 UID: 0 PID: 22642 Comm: syz.2.4534 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1401.486857][T22642] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1401.486869][T22642] Call Trace: [ 1401.486876][T22642] [ 1401.486884][T22642] dump_stack_lvl+0x16c/0x1f0 [ 1401.486914][T22642] should_fail_ex+0x512/0x640 [ 1401.486937][T22642] ? kmem_cache_alloc_node_noprof+0x5e/0x3b0 [ 1401.486964][T22642] should_failslab+0xc2/0x120 [ 1401.486991][T22642] kmem_cache_alloc_node_noprof+0x71/0x3b0 [ 1401.487015][T22642] ? __alloc_skb+0x2b2/0x380 [ 1401.487039][T22642] ? __alloc_skb+0x86/0x380 [ 1401.487062][T22642] __alloc_skb+0x2b2/0x380 [ 1401.487085][T22642] ? __pfx___alloc_skb+0x10/0x10 [ 1401.487110][T22642] ? __pfx_netlink_autobind.isra.0+0x10/0x10 [ 1401.487144][T22642] netlink_alloc_large_skb+0x69/0x130 [ 1401.487163][T22642] netlink_sendmsg+0x6a1/0xdd0 [ 1401.487186][T22642] ? __pfx_netlink_sendmsg+0x10/0x10 [ 1401.487214][T22642] ____sys_sendmsg+0xa95/0xc70 [ 1401.487233][T22642] ? copy_msghdr_from_user+0x10a/0x160 [ 1401.487257][T22642] ? __pfx_____sys_sendmsg+0x10/0x10 [ 1401.487280][T22642] ? __lock_acquire+0xb8a/0x1c90 [ 1401.487305][T22642] ___sys_sendmsg+0x134/0x1d0 [ 1401.487330][T22642] ? __pfx____sys_sendmsg+0x10/0x10 [ 1401.487360][T22642] ? __lock_acquire+0x622/0x1c90 [ 1401.487409][T22642] __sys_sendmsg+0x16d/0x220 [ 1401.487434][T22642] ? __pfx___sys_sendmsg+0x10/0x10 [ 1401.487476][T22642] do_syscall_64+0xcd/0x4c0 [ 1401.487503][T22642] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1401.487522][T22642] RIP: 0033:0x7fe79f78e929 [ 1401.487537][T22642] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1401.487554][T22642] RSP: 002b:00007fe7a05f8038 EFLAGS: 00000246 ORIG_RAX: 000000000000002e [ 1401.487572][T22642] RAX: ffffffffffffffda RBX: 00007fe79f9b5fa0 RCX: 00007fe79f78e929 [ 1401.487584][T22642] RDX: 0000000000040010 RSI: 0000200000000100 RDI: 0000000000000003 [ 1401.487595][T22642] RBP: 00007fe7a05f8090 R08: 0000000000000000 R09: 0000000000000000 [ 1401.487605][T22642] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1401.487615][T22642] R13: 0000000000000000 R14: 00007fe79f9b5fa0 R15: 00007ffc4da2d5d8 [ 1401.487640][T22642] [ 1401.712895][ C0] vkms_vblank_simulate: vblank timer overrun [ 1401.887596][ T30] audit: type=1400 audit(1752387387.669:3087): avc: denied { setattr } for pid=22645 comm="syz.6.4535" name="seq" dev="devtmpfs" ino=1285 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:sound_device_t tclass=chr_file permissive=1 [ 1402.165074][T22653] 9pnet_fd: Insufficient options for proto=fd [ 1403.972003][T22686] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4539'. [ 1404.628509][T22691] overlayfs: invalid origin (00000000d1d3e81a820eee8a94416592a5356da96db48150eae08457fbc30ece5e7e7e318cb2b4b2f8bddb73e65c239a40942f00000000000000000000000000) [ 1406.177591][T22701] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1409.099975][ T9] usb 7-1: new high-speed USB device number 112 using dummy_hcd [ 1409.109664][T12277] usb 9-1: new high-speed USB device number 60 using dummy_hcd [ 1409.251724][ T9] usb 7-1: config 0 has no interfaces? [ 1409.257802][ T9] usb 7-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1409.267855][T22746] tipc: Enabled bearer , priority 0 [ 1409.275192][ T9] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1409.286154][ T9] usb 7-1: config 0 descriptor?? [ 1409.294112][T22746] syzkaller0: entered promiscuous mode [ 1409.299690][T12277] usb 9-1: Using ep0 maxpacket: 16 [ 1409.303564][T12277] usb 9-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1409.305477][ T30] audit: type=1400 audit(1752387395.099:3088): avc: denied { setopt } for pid=22745 comm="syz.2.4557" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1409.333482][ C0] vkms_vblank_simulate: vblank timer overrun [ 1409.341900][T22746] syzkaller0: entered allmulticast mode [ 1409.343692][T12277] usb 9-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1409.373199][T12277] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1409.386102][T22746] binder: BC_ATTEMPT_ACQUIRE not supported [ 1409.392409][T22746] binder: 22745:22746 ioctl c0306201 200000000640 returned -22 [ 1409.406505][T12277] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1409.413318][T22746] syzkaller0: mtu greater than device maximum [ 1410.213656][T12277] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1410.370793][T12277] usb 9-1: Product: syz [ 1410.374999][T12277] usb 9-1: Manufacturer: syz [ 1410.379624][T12277] usb 9-1: SerialNumber: syz [ 1410.413640][T22745] tipc: Resetting bearer [ 1410.524291][T22745] tipc: Disabling bearer [ 1412.114980][ T974] usb 7-1: USB disconnect, device number 112 [ 1412.168771][T22769] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1412.589430][T12277] usb 9-1: 0:2 : does not exist [ 1412.618429][T12277] usb 9-1: USB disconnect, device number 60 [ 1413.578474][T22783] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1417.279982][ T974] usb 10-1: new high-speed USB device number 38 using dummy_hcd [ 1417.486926][ T974] usb 10-1: Using ep0 maxpacket: 16 [ 1417.822135][T22837] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1417.844323][T22837] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4573'. [ 1418.050424][ T974] usb 10-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1418.059954][ T974] usb 10-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1418.191944][ T974] usb 10-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1418.291654][ T974] usb 10-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1418.534017][ T974] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1418.555935][ T974] usb 10-1: Product: syz [ 1418.570926][ T974] usb 10-1: Manufacturer: syz [ 1418.611518][ T974] usb 10-1: SerialNumber: syz [ 1418.954298][T22853] FAULT_INJECTION: forcing a failure. [ 1418.954298][T22853] name failslab, interval 1, probability 0, space 0, times 0 [ 1418.967422][T22853] CPU: 1 UID: 0 PID: 22853 Comm: syz.4.4580 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1418.967448][T22853] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1418.967459][T22853] Call Trace: [ 1418.967465][T22853] [ 1418.967472][T22853] dump_stack_lvl+0x16c/0x1f0 [ 1418.967501][T22853] should_fail_ex+0x512/0x640 [ 1418.967524][T22853] ? __kvmalloc_node_noprof+0x124/0x620 [ 1418.967549][T22853] should_failslab+0xc2/0x120 [ 1418.967575][T22853] __kvmalloc_node_noprof+0x137/0x620 [ 1418.967598][T22853] ? io_alloc_cache_init+0x33/0x170 [ 1418.967627][T22853] ? io_alloc_cache_init+0x33/0x170 [ 1418.967648][T22853] io_alloc_cache_init+0x33/0x170 [ 1418.967673][T22853] io_uring_setup+0x63b/0x2120 [ 1418.967696][T22853] ? __pfx_io_uring_setup+0x10/0x10 [ 1418.967715][T22853] ? avc_has_perm_noaudit+0x117/0x3b0 [ 1418.967738][T22853] ? avc_has_perm_noaudit+0x149/0x3b0 [ 1418.967766][T22853] ? ksys_write+0x1ac/0x250 [ 1418.967795][T22853] __x64_sys_io_uring_setup+0xc2/0x170 [ 1418.967817][T22853] do_syscall_64+0xcd/0x4c0 [ 1418.967843][T22853] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1418.967861][T22853] RIP: 0033:0x7f26d298e929 [ 1418.967876][T22853] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1418.967892][T22853] RSP: 002b:00007f26d37d4fc8 EFLAGS: 00000246 ORIG_RAX: 00000000000001a9 [ 1418.967910][T22853] RAX: ffffffffffffffda RBX: 00007f26d2bb6160 RCX: 00007f26d298e929 [ 1418.967921][T22853] RDX: 0000000000000000 RSI: 00002000000006c0 RDI: 000000000000126b [ 1418.967932][T22853] RBP: 00002000000006c0 R08: 0000000000000000 R09: 0000000000000000 [ 1418.967942][T22853] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1418.967953][T22853] R13: 0000200000000140 R14: 000000000000126b R15: 0000000000000000 [ 1418.967976][T22853] [ 1419.153734][ C1] vkms_vblank_simulate: vblank timer overrun [ 1419.708348][ T974] usb 10-1: 0:2 : does not exist [ 1419.725802][ T974] usb 10-1: USB disconnect, device number 38 [ 1419.977921][T22865] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1421.134911][T22875] lo speed is unknown, defaulting to 1000 [ 1422.383436][T22883] netlink: 44 bytes leftover after parsing attributes in process `syz.6.4586'. [ 1422.399876][T22883] netlink: 67 bytes leftover after parsing attributes in process `syz.6.4586'. [ 1422.552816][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1422.589898][ T974] usb 3-1: new full-speed USB device number 24 using dummy_hcd [ 1422.910114][ T974] usb 3-1: config 0 has an invalid interface number: 133 but max is 0 [ 1422.931835][ T974] usb 3-1: config 0 has no interface number 0 [ 1423.341424][ T974] usb 3-1: New USB device found, idVendor=06cd, idProduct=0121, bcdDevice=dd.3d [ 1423.367293][ T974] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1423.432967][ T974] usb 3-1: Product: syz [ 1423.457007][ T974] usb 3-1: Manufacturer: syz [ 1423.498071][ T974] usb 3-1: SerialNumber: syz [ 1423.529004][ T974] usb 3-1: config 0 descriptor?? [ 1423.765920][ T974] keyspan 3-1:0.133: Keyspan 1 port adapter converter detected [ 1423.774843][ T974] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 81 [ 1423.784041][ T974] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 1 [ 1423.792734][ T974] keyspan 3-1:0.133: found no endpoint descriptor for endpoint 2 [ 1423.803198][ T974] usb 3-1: Keyspan 1 port adapter converter now attached to ttyUSB0 [ 1423.990410][T12282] usb 7-1: new full-speed USB device number 113 using dummy_hcd [ 1424.015724][T22910] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1424.251141][T12282] usb 7-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1424.265825][T12282] usb 7-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1424.281471][T12282] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1424.296785][T12282] usb 7-1: config 0 descriptor?? [ 1424.366132][T12282] usbhid 7-1:0.0: couldn't find an input interrupt endpoint [ 1424.691721][T12277] usb 3-1: USB disconnect, device number 24 [ 1424.701811][T12277] keyspan_1 ttyUSB0: Keyspan 1 port adapter converter now disconnected from ttyUSB0 [ 1424.719768][T12277] keyspan 3-1:0.133: device disconnected [ 1424.732313][T22919] netlink: 'syz.4.4596': attribute type 10 has an invalid length. [ 1424.766341][T22919] bond0: (slave wlan1): Enslaving as an active interface with an up link [ 1424.791682][T22912] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1424.799035][T22920] netlink: 'syz.4.4596': attribute type 10 has an invalid length. [ 1424.819796][T22912] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4594'. [ 1424.930104][T18515] usb 9-1: new high-speed USB device number 61 using dummy_hcd [ 1425.095312][T18515] usb 9-1: New USB device found, idVendor=1c40, idProduct=0534, bcdDevice=6d.cc [ 1425.114577][T18515] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1425.127381][T18515] usb 9-1: Product: syz [ 1425.133707][T18515] usb 9-1: Manufacturer: syz [ 1425.138453][T18515] usb 9-1: SerialNumber: syz [ 1425.146436][T18515] usb 9-1: config 0 descriptor?? [ 1425.156168][T18515] i2c-tiny-usb 9-1:0.0: version 6d.cc found at bus 009 address 061 [ 1425.619823][T18515] (null): failure reading functionality [ 1425.705990][T18515] i2c i2c-1: failure reading functionality [ 1425.735595][T18515] i2c i2c-1: connected i2c-tiny-usb device [ 1425.944084][T22917] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1425.974328][T22942] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1426.007457][T22917] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1426.072903][T14270] usb 9-1: USB disconnect, device number 61 [ 1426.362923][T22946] nbd: couldn't find a device at index 1703936 [ 1426.375795][T22946] binder: 22945:22946 ioctl 40489426 200000000240 returned -22 [ 1426.386251][T22946] binder_alloc: 22945: binder_alloc_buf, no vma [ 1429.951388][T12277] usb 7-1: USB disconnect, device number 113 [ 1430.239775][T14270] usb 3-1: new high-speed USB device number 25 using dummy_hcd [ 1430.289460][T12282] usb 9-1: new high-speed USB device number 62 using dummy_hcd [ 1430.391006][T14270] usb 3-1: config 0 has no interfaces? [ 1430.396569][T14270] usb 3-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1430.406055][T14270] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1430.415625][T14270] usb 3-1: config 0 descriptor?? [ 1430.450988][T12282] usb 9-1: Using ep0 maxpacket: 8 [ 1430.457440][T12282] usb 9-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1430.467278][T12282] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1430.477270][T12282] usb 9-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 200 [ 1430.487486][T12282] usb 9-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1430.502212][T12282] usb 9-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1430.528925][T12282] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1430.781362][T12282] usb 9-1: GET_CAPABILITIES returned 0 [ 1430.786880][T12282] usbtmc 9-1:16.0: can't read capabilities [ 1431.360180][T22974] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4608'. [ 1432.093360][T22988] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4610'. [ 1432.763365][T22992] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1432.779008][T22992] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4612'. [ 1433.051336][T12282] usb 3-1: USB disconnect, device number 25 [ 1433.120790][T14270] usb 9-1: USB disconnect, device number 62 [ 1433.503752][T12282] usb 3-1: new high-speed USB device number 26 using dummy_hcd [ 1433.587127][T23005] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1433.643407][T23005] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4615'. [ 1433.718848][T12282] usb 3-1: config 0 has an invalid interface number: 156 but max is 0 [ 1433.834615][T12282] usb 3-1: config 0 has no interface number 0 [ 1433.851287][T12282] usb 3-1: New USB device found, idVendor=abcd, idProduct=cdee, bcdDevice= 5.b9 [ 1433.869415][T12282] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1433.869887][T14270] usb 9-1: new high-speed USB device number 63 using dummy_hcd [ 1433.886630][T12282] usb 3-1: config 0 descriptor?? [ 1434.003497][T12282] gspca_main: spca561-2.14.0 probing abcd:cdee [ 1434.474748][T22994] batman_adv: batadv0: Adding interface: vxlan0 [ 1434.510051][T14270] usb 9-1: Using ep0 maxpacket: 16 [ 1434.518796][T14270] usb 9-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1434.533945][T22994] batman_adv: batadv0: The MTU of interface vxlan0 is too small (1500) to handle the transport of batman-adv packets. Packets going over this interface will be fragmented on layer2 which could impact the performance. Setting the MTU to 1560 would solve the problem. [ 1434.564645][T14270] usb 9-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1434.581195][T14270] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1434.595687][T12282] spca561 3-1:0.156: probe with driver spca561 failed with error -22 [ 1434.612113][T14270] usb 9-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1434.612436][T12282] usb 3-1: Quirk or no altset; falling back to MIDI 1.0 [ 1434.635198][T22994] batman_adv: batadv0: Not using interface vxlan0 (retrying later): interface not active [ 1434.654892][T12282] usb 3-1: MIDIStreaming interface descriptor not found [ 1434.654996][T14270] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1434.702140][T14270] usb 9-1: Product: syz [ 1434.712837][T14270] usb 9-1: Manufacturer: syz [ 1434.791957][T12282] usb 3-1: USB disconnect, device number 26 [ 1434.798853][T14270] usb 9-1: SerialNumber: syz [ 1435.050233][ T974] usb 5-1: new high-speed USB device number 125 using dummy_hcd [ 1435.210686][ T974] usb 5-1: Using ep0 maxpacket: 32 [ 1435.238189][ T974] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1435.253903][ T974] usb 5-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1435.296781][ T974] usb 5-1: config 1 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 2 [ 1435.387832][ T974] usb 5-1: New USB device found, idVendor=05ac, idProduct=020f, bcdDevice= 0.22 [ 1435.397275][ T974] usb 5-1: New USB device strings: Mfr=1, Product=130, SerialNumber=131 [ 1435.407313][ T974] usb 5-1: Product: syz [ 1435.413541][ T974] usb 5-1: Manufacturer: syz [ 1435.422756][ T974] usb 5-1: SerialNumber: syz [ 1435.485278][ T974] input: appletouch as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:1.0/input/input99 [ 1435.722655][T23017] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1435.766318][T12282] usb 5-1: USB disconnect, device number 125 [ 1435.772602][T12285] usb 3-1: new high-speed USB device number 27 using dummy_hcd [ 1435.790585][T12282] appletouch 5-1:1.0: input: appletouch disconnected [ 1435.832131][T14270] usb 9-1: 0:2 : does not exist [ 1435.930864][T14270] usb 9-1: USB disconnect, device number 63 [ 1436.032192][T12285] usb 3-1: config 0 has no interfaces? [ 1436.439416][T12285] usb 3-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1436.674093][T12285] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1436.749393][T12285] usb 3-1: config 0 descriptor?? [ 1438.787999][T12282] usb 3-1: USB disconnect, device number 27 [ 1438.812340][T23058] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4629'. [ 1439.264362][T23066] netlink: 'syz.4.4631': attribute type 13 has an invalid length. [ 1439.674262][T23060] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 1439.700873][T23060] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 1439.752274][T23060] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 1439.760969][T23060] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 1439.944094][T23071] fuse: Bad value for 'fd' [ 1440.060027][T23060] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 1440.066060][T23060] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1440.155814][T23060] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 1440.370043][ T30] audit: type=1400 audit(1752387426.169:3089): avc: denied { map } for pid=23074 comm="syz.4.4633" path="" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1440.489348][ T30] audit: type=1400 audit(1752387426.169:3090): avc: denied { execute } for pid=23074 comm="syz.4.4633" path="/dev/comedi4" dev="devtmpfs" ino=1280 scontext=root:sysadm_r:sysadm_t tcontext=system_u:object_r:device_t tclass=chr_file permissive=1 [ 1440.939954][T14270] usb 5-1: new full-speed USB device number 126 using dummy_hcd [ 1440.951613][T12330] Bluetooth: hci0: command 0x0406 tx timeout [ 1441.101048][T14270] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1441.125758][T14270] usb 5-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1441.164661][T14270] usb 5-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1441.216568][T14270] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1441.243480][T14270] usb 5-1: config 0 descriptor?? [ 1441.661674][T14270] usbhid 5-1:0.0: can't add hid device: -71 [ 1441.667664][T14270] usbhid 5-1:0.0: probe with driver usbhid failed with error -71 [ 1441.750415][ T5829] Bluetooth: hci1: command 0x0406 tx timeout [ 1441.756483][T12330] Bluetooth: hci4: command 0x0c1a tx timeout [ 1441.782100][T14270] usb 5-1: USB disconnect, device number 126 [ 1441.831190][T12330] Bluetooth: hci3: command 0x0406 tx timeout [ 1442.149690][T12330] Bluetooth: hci2: command 0x0c1a tx timeout [ 1442.370527][ T30] audit: type=1400 audit(1752387428.179:3091): avc: denied { create } for pid=23098 comm="syz.6.4642" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=appletalk_socket permissive=1 [ 1442.480508][ T9] usb 9-1: new high-speed USB device number 64 using dummy_hcd [ 1442.761152][ T9] usb 9-1: config 0 has no interfaces? [ 1442.766670][ T9] usb 9-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1442.787762][ T9] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1442.931609][ T9] usb 9-1: config 0 descriptor?? [ 1444.291173][T12330] Bluetooth: hci2: command 0x0c1a tx timeout [ 1445.476604][T12277] usb 9-1: USB disconnect, device number 64 [ 1446.140135][ T974] usb 5-1: new high-speed USB device number 127 using dummy_hcd [ 1446.310007][T12330] Bluetooth: hci2: command 0x0c1a tx timeout [ 1446.858425][ T974] usb 5-1: config 0 has no interfaces? [ 1446.864738][ T974] usb 5-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1446.886461][ T974] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1446.918236][ T974] usb 5-1: config 0 descriptor?? [ 1447.294160][T12285] usb 3-1: new high-speed USB device number 28 using dummy_hcd [ 1448.022284][T12285] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1448.045918][T12285] usb 3-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1448.056869][T12285] usb 3-1: New USB device found, idVendor=27b8, idProduct=01ed, bcdDevice= 0.00 [ 1448.155046][T12285] usb 3-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1448.164538][T12285] usb 3-1: config 0 descriptor?? [ 1448.298899][T23150] netlink: 24 bytes leftover after parsing attributes in process `syz.6.4655'. [ 1448.990764][T12285] hid-led 0003:27B8:01ED.0023: hidraw0: USB HID v0.00 Device [HID 27b8:01ed] on usb-dummy_hcd.2-1/input0 [ 1449.106680][T12282] usb 5-1: USB disconnect, device number 127 [ 1449.127377][T12285] hid-led 0003:27B8:01ED.0023: ThingM blink(1) initialized [ 1449.187978][T23137] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1449.196948][T23137] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1449.220352][T12285] usb 3-1: USB disconnect, device number 28 [ 1449.225005][T23164] netlink: 68 bytes leftover after parsing attributes in process `syz.9.4660'. [ 1449.359860][T14270] usb 7-1: new high-speed USB device number 114 using dummy_hcd [ 1449.479547][T12282] usb 5-1: new high-speed USB device number 2 using dummy_hcd [ 1449.736718][T14270] usb 7-1: config 0 has no interfaces? [ 1449.742693][T14270] usb 7-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1449.779679][T14270] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1449.839823][T12282] usb 5-1: Using ep0 maxpacket: 16 [ 1449.954729][T14270] usb 7-1: config 0 descriptor?? [ 1449.964780][T12282] usb 5-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1450.095719][T12282] usb 5-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1450.151052][T12282] usb 5-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1451.092721][T23177] lo speed is unknown, defaulting to 1000 [ 1452.406746][T14270] usb 7-1: USB disconnect, device number 114 [ 1452.633450][T12282] usb 5-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1452.715009][T12282] usb 5-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1453.409038][T12282] usb 5-1: can't set config #1, error -71 [ 1453.427215][T12282] usb 5-1: USB disconnect, device number 2 [ 1454.373461][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.388533][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.417454][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.436157][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.447923][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.456164][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.464317][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.472467][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.480610][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1454.546368][T23201] netlink: 'syz.6.4668': attribute type 3 has an invalid length. [ 1455.003397][T12282] usb 3-1: new high-speed USB device number 29 using dummy_hcd [ 1455.032416][ T30] audit: type=1400 audit(1752387440.839:3092): avc: denied { setopt } for pid=23211 comm="syz.6.4672" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=mctp_socket permissive=1 [ 1455.581736][T12282] usb 3-1: Using ep0 maxpacket: 16 [ 1455.600184][T12282] usb 3-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 1455.608898][T12282] usb 3-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 1455.634675][T23198] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1455.642930][T23198] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4669'. [ 1455.658750][T12282] usb 3-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 1455.672002][T12282] usb 3-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 1455.694342][T12282] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1455.707391][T12282] usb 3-1: Product: syz [ 1455.713109][T12282] usb 3-1: Manufacturer: syz [ 1455.718410][T12282] usb 3-1: SerialNumber: syz [ 1456.341145][T23228] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4675'. [ 1457.263402][T12282] usb 3-1: 0:2 : does not exist [ 1457.853077][ T9] usb 10-1: new high-speed USB device number 39 using dummy_hcd [ 1458.062272][T23243] lo speed is unknown, defaulting to 1000 [ 1458.090041][ T9] usb 10-1: Using ep0 maxpacket: 8 [ 1458.095353][T12282] usb 3-1: USB disconnect, device number 29 [ 1458.112928][ T9] usb 10-1: config 6 has an invalid interface number: 2 but max is 0 [ 1458.143752][ T9] usb 10-1: config 6 has an invalid descriptor of length 0, skipping remainder of the config [ 1459.267884][ T9] usb 10-1: config 6 has no interface number 0 [ 1459.274546][ T9] usb 10-1: config 6 interface 2 altsetting 0 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 1459.292769][ T9] usb 10-1: New USB device found, idVendor=0af0, idProduct=7271, bcdDevice=88.91 [ 1459.302381][ T9] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1459.311128][ T9] usb 10-1: Product: syz [ 1459.315454][ T9] usb 10-1: Manufacturer: syz [ 1459.515676][ T9] usb 10-1: SerialNumber: syz [ 1459.640431][ T9] usb 10-1: can't set config #6, error -71 [ 1459.758663][ T9] usb 10-1: USB disconnect, device number 39 [ 1460.310058][ T9] usb 5-1: new high-speed USB device number 3 using dummy_hcd [ 1460.378458][T23270] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1460.819891][ T9] usb 5-1: Using ep0 maxpacket: 8 [ 1460.829899][ T9] usb 5-1: config 179 has an invalid interface number: 65 but max is 0 [ 1460.857507][ T9] usb 5-1: config 179 has no interface number 0 [ 1460.867348][ T9] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has an invalid bInterval 63, changing to 9 [ 1460.889107][ T9] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0xF has invalid maxpacket 57605, setting to 1024 [ 1460.909656][ T9] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has an invalid bInterval 55, changing to 9 [ 1460.926694][ T9] usb 5-1: config 179 interface 65 altsetting 12 endpoint 0x83 has invalid maxpacket 8496, setting to 1024 [ 1460.951846][T23263] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4685'. [ 1460.962333][ T9] usb 5-1: config 179 interface 65 altsetting 12 has 2 endpoint descriptors, different from the interface descriptor's value: 23 [ 1460.977597][ T9] usb 5-1: config 179 interface 65 has no altsetting 0 [ 1460.990599][ T9] usb 5-1: New USB device found, idVendor=12ab, idProduct=0004, bcdDevice= 0.00 [ 1461.011418][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1461.089492][T12282] usb 9-1: new high-speed USB device number 65 using dummy_hcd [ 1461.141504][ T9] input: Honey Bee Xbox360 dancepad as /devices/platform/dummy_hcd.4/usb5/5-1/5-1:179.65/input/input100 [ 1461.230070][ T5186] input input100: unable to receive magic message: -110 [ 1461.265178][T12282] usb 9-1: config 1 has too many interfaces: 66, using maximum allowed: 32 [ 1461.277244][T12282] usb 9-1: config 1 has an invalid descriptor of length 55, skipping remainder of the config [ 1461.289997][T12282] usb 9-1: config 1 has 1 interface, different from the descriptor's value: 66 [ 1461.406195][T12277] usb 5-1: USB disconnect, device number 3 [ 1461.406239][ C0] xpad 5-1:179.65: xpad_irq_out - usb_submit_urb failed with result -19 [ 1461.421308][ C0] dummy_hcd dummy_hcd.4: timer fired with no URBs pending? [ 1461.453183][T12282] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 55, changing to 9 [ 1461.662716][T12282] usb 9-1: config 1 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 8496, setting to 1024 [ 1461.851439][T12282] usb 9-1: New USB device found, idVendor=7d25, idProduct=a415, bcdDevice= 0.40 [ 1461.861967][T12282] usb 9-1: New USB device strings: Mfr=1, Product=4, SerialNumber=0 [ 1461.882069][T12282] usb 9-1: Product: syz [ 1461.886263][T12282] usb 9-1: Manufacturer: syz [ 1461.980204][T12282] cdc_wdm 9-1:1.0: skipping garbage [ 1461.987459][T12282] cdc_wdm 9-1:1.0: skipping garbage [ 1462.131230][T12282] cdc_wdm 9-1:1.0: cdc-wdm0: USB WDM device [ 1462.223686][ T30] audit: type=1400 audit(1752387448.019:3093): avc: denied { attach_queue } for pid=23273 comm="syz.8.4687" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tun_socket permissive=1 [ 1462.243648][ C0] vkms_vblank_simulate: vblank timer overrun [ 1462.245777][T12282] cdc_wdm 9-1:1.0: Unknown control protocol [ 1462.265970][T12282] usb 9-1: USB disconnect, device number 65 [ 1462.337259][T23286] SELinux: unrecognized netlink message: protocol=0 nlmsg_type=62480 sclass=netlink_route_socket pid=23286 comm=syz.2.4691 [ 1462.371126][T23288] netlink: 8 bytes leftover after parsing attributes in process `syz.6.4692'. [ 1462.501163][T23296] xt_CT: You must specify a L4 protocol and not use inversions on it [ 1462.651458][T12277] usb 3-1: new high-speed USB device number 30 using dummy_hcd [ 1462.829321][T12277] usb 3-1: config 1 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 1462.853992][T12277] usb 3-1: New USB device found, idVendor=0525, idProduct=a4a1, bcdDevice= 0.40 [ 1462.864885][T12277] usb 3-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1463.235952][T12277] usb 3-1: Product: syz [ 1463.241671][T12277] usb 3-1: Manufacturer: syz [ 1463.246560][T12277] usb 3-1: SerialNumber: syz [ 1463.379836][T23306] fuse: Bad value for 'group_id' [ 1463.384973][T23306] fuse: Bad value for 'group_id' [ 1463.756146][T23316] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4700'. [ 1464.092292][T12277] cdc_ncm 3-1:1.0: bind() failure [ 1464.108890][T12277] cdc_ncm 3-1:1.1: CDC Union missing and no IAD found [ 1464.119715][ T974] usb 10-1: new full-speed USB device number 40 using dummy_hcd [ 1464.142740][T12277] cdc_ncm 3-1:1.1: bind() failure [ 1464.155275][T12277] usb 3-1: USB disconnect, device number 30 [ 1464.405027][ T974] usb 10-1: config 0 has 1 interface, different from the descriptor's value: 15 [ 1464.414585][ T974] usb 10-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xFF, changing to 0x8F [ 1464.426841][ T974] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has an invalid bInterval 0, changing to 10 [ 1464.438689][ T974] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x8F has invalid maxpacket 65535, setting to 64 [ 1464.452199][ T974] usb 10-1: New USB device found, idVendor=077d, idProduct=04aa, bcdDevice=5b.d8 [ 1464.461775][ T974] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1464.469981][ T974] usb 10-1: Product: syz [ 1464.474314][ T974] usb 10-1: Manufacturer: syz [ 1464.479451][ T974] usb 10-1: SerialNumber: syz [ 1464.506487][ T974] usb 10-1: config 0 descriptor?? [ 1464.517574][T23318] raw-gadget.1 gadget.9: fail, usb_ep_enable returned -22 [ 1464.559608][T12282] usb 7-1: new high-speed USB device number 115 using dummy_hcd [ 1464.639925][ T9] usb 5-1: new high-speed USB device number 4 using dummy_hcd [ 1464.739412][T12282] usb 7-1: Using ep0 maxpacket: 8 [ 1464.740098][ T974] powermate: Expected payload of 3--6 bytes, found 64 bytes! [ 1464.745803][T12282] usb 7-1: config 16 interface 0 altsetting 0 endpoint 0x5 has invalid wMaxPacketSize 0 [ 1464.762789][T12282] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x5 has invalid maxpacket 0 [ 1464.775110][T12282] usb 7-1: config 16 interface 0 altsetting 0 bulk endpoint 0x8B has invalid maxpacket 200 [ 1464.785248][T12282] usb 7-1: config 16 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 1464.807772][T23332] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1464.855205][T12282] usb 7-1: New USB device found, idVendor=ee8d, idProduct=db1a, bcdDevice=61.23 [ 1464.856110][ T974] input: Griffin SoundKnob as /devices/platform/dummy_hcd.9/usb10/10-1/10-1:0.0/input/input101 [ 1464.933763][ T9] usb 5-1: config 0 has no interfaces? [ 1464.936292][T12282] usb 7-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1464.939355][ T9] usb 5-1: New USB device found, idVendor=1a34, idProduct=0802, bcdDevice= 0.00 [ 1464.939380][ T9] usb 5-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1464.942891][ T9] usb 5-1: config 0 descriptor?? [ 1464.978437][ C0] powermate: config urb returned -71 [ 1464.984150][ C0] powermate: config urb returned -71 [ 1464.990083][ C0] powermate: config urb returned -71 [ 1464.995691][ C0] powermate: config urb returned -71 [ 1465.006734][ T974] usb 10-1: USB disconnect, device number 40 [ 1465.006777][ C0] powermate 10-1:0.0: powermate_irq - usb_submit_urb failed with result: -19 [ 1465.264128][T12282] usb 7-1: usb_control_msg returned -71 [ 1465.274969][T12282] usbtmc 7-1:16.0: can't read capabilities [ 1465.296718][T12282] usb 7-1: USB disconnect, device number 115 [ 1466.358670][T23358] bridge0: port 1(bridge_slave_0) entered disabled state [ 1466.371052][T23358] bridge0: port 2(bridge_slave_1) entered disabled state [ 1467.402459][T18515] usb 5-1: USB disconnect, device number 4 [ 1470.499927][ T974] usb 9-1: new high-speed USB device number 66 using dummy_hcd [ 1470.613755][ T30] audit: type=1400 audit(1752387456.419:3094): avc: denied { read } for pid=23401 comm="syz.9.4725" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=nfc_socket permissive=1 [ 1470.613772][T23402] FAULT_INJECTION: forcing a failure. [ 1470.613772][T23402] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1470.646968][T23402] CPU: 0 UID: 0 PID: 23402 Comm: syz.9.4725 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1470.647000][T23402] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1470.647011][T23402] Call Trace: [ 1470.647018][T23402] [ 1470.647025][T23402] dump_stack_lvl+0x16c/0x1f0 [ 1470.647054][T23402] should_fail_ex+0x512/0x640 [ 1470.647081][T23402] _copy_from_user+0x2e/0xd0 [ 1470.647108][T23402] copy_msghdr_from_user+0x98/0x160 [ 1470.647132][T23402] ? __pfx_copy_msghdr_from_user+0x10/0x10 [ 1470.647160][T23402] ? kfree+0x24f/0x4d0 [ 1470.647179][T23402] ? __lock_acquire+0x622/0x1c90 [ 1470.647201][T23402] ___sys_recvmsg+0xdb/0x1a0 [ 1470.647225][T23402] ? __pfx____sys_recvmsg+0x10/0x10 [ 1470.647261][T23402] ? __pfx___might_resched+0x10/0x10 [ 1470.647289][T23402] do_recvmmsg+0x2fe/0x750 [ 1470.647316][T23402] ? __pfx_do_recvmmsg+0x10/0x10 [ 1470.647345][T23402] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 1470.647377][T23402] ? __fget_files+0x20e/0x3c0 [ 1470.647407][T23402] __x64_sys_recvmmsg+0x22a/0x280 [ 1470.647434][T23402] ? __pfx___x64_sys_recvmmsg+0x10/0x10 [ 1470.647467][T23402] do_syscall_64+0xcd/0x4c0 [ 1470.647494][T23402] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1470.647512][T23402] RIP: 0033:0x7fd50c98e929 [ 1470.647527][T23402] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1470.647543][T23402] RSP: 002b:00007fd50d728038 EFLAGS: 00000246 ORIG_RAX: 000000000000012b [ 1470.647560][T23402] RAX: ffffffffffffffda RBX: 00007fd50cbb5fa0 RCX: 00007fd50c98e929 [ 1470.647571][T23402] RDX: 03fffffffffffff2 RSI: 0000200000004400 RDI: 0000000000000007 [ 1470.647582][T23402] RBP: 00007fd50d728090 R08: 0000000000000000 R09: 0000000000000000 [ 1470.647593][T23402] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1470.647602][T23402] R13: 0000000000000000 R14: 00007fd50cbb5fa0 R15: 00007fffa2bc4bc8 [ 1470.647623][T23402] [ 1470.859945][ T974] usb 9-1: Using ep0 maxpacket: 32 [ 1470.865262][T23403] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1470.865549][ T974] usb 9-1: no configurations [ 1470.876939][ T974] usb 9-1: can't read configurations, error -22 [ 1470.930814][T23403] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4722'. [ 1471.065925][ T974] usb 9-1: new high-speed USB device number 67 using dummy_hcd [ 1471.361143][ T974] usb 9-1: Using ep0 maxpacket: 32 [ 1471.373045][ T974] usb 9-1: no configurations [ 1471.377679][ T974] usb 9-1: can't read configurations, error -22 [ 1471.569895][ T974] usb usb9-port1: attempt power cycle [ 1471.929417][ T974] usb 9-1: new high-speed USB device number 68 using dummy_hcd [ 1472.387777][ T974] usb 9-1: Using ep0 maxpacket: 32 [ 1472.394228][ T974] usb 9-1: no configurations [ 1472.398836][ T974] usb 9-1: can't read configurations, error -22 [ 1472.567395][ T974] usb 9-1: new high-speed USB device number 69 using dummy_hcd [ 1472.801247][ T974] usb 9-1: device not accepting address 69, error -71 [ 1472.808618][ T974] usb usb9-port1: unable to enumerate USB device [ 1472.886405][T23432] FAULT_INJECTION: forcing a failure. [ 1472.886405][T23432] name failslab, interval 1, probability 0, space 0, times 0 [ 1472.899729][T23432] CPU: 1 UID: 0 PID: 23432 Comm: syz.8.4731 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1472.899755][T23432] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1472.899766][T23432] Call Trace: [ 1472.899773][T23432] [ 1472.899780][T23432] dump_stack_lvl+0x16c/0x1f0 [ 1472.899810][T23432] should_fail_ex+0x512/0x640 [ 1472.899833][T23432] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 1472.899861][T23432] should_failslab+0xc2/0x120 [ 1472.899887][T23432] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1472.899909][T23432] ? __io_alloc_req_refill+0x27d/0x500 [ 1472.899926][T23432] ? getname_flags.part.0+0x4c/0x550 [ 1472.899951][T23432] getname_flags.part.0+0x4c/0x550 [ 1472.899972][T23432] getname_flags+0x93/0xf0 [ 1472.899995][T23432] io_symlinkat_prep+0x18e/0x350 [ 1472.900024][T23432] io_submit_sqes+0x835/0x2580 [ 1472.900059][T23432] __do_sys_io_uring_enter+0xd6a/0x1630 [ 1472.900083][T23432] ? __pfx___schedule+0x10/0x10 [ 1472.900106][T23432] ? __fget_files+0x20e/0x3c0 [ 1472.900131][T23432] ? __pfx___do_sys_io_uring_enter+0x10/0x10 [ 1472.900156][T23432] ? fput+0x70/0xf0 [ 1472.900174][T23432] ? xfd_validate_state+0x61/0x180 [ 1472.900208][T23432] do_syscall_64+0xcd/0x4c0 [ 1472.900235][T23432] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1472.900254][T23432] RIP: 0033:0x7f8212b8e929 [ 1472.900270][T23432] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1472.900286][T23432] RSP: 002b:00007f8213972038 EFLAGS: 00000246 ORIG_RAX: 00000000000001aa [ 1472.900304][T23432] RAX: ffffffffffffffda RBX: 00007f8212db6080 RCX: 00007f8212b8e929 [ 1472.900315][T23432] RDX: 0000000000000000 RSI: 0000000000007277 RDI: 0000000000000006 [ 1472.900326][T23432] RBP: 00007f8213972090 R08: 0000000000000000 R09: 0000000000000000 [ 1472.900337][T23432] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1472.900347][T23432] R13: 0000000000000000 R14: 00007f8212db6080 R15: 00007fff339c9d98 [ 1472.900372][T23432] [ 1474.076861][ T6426] Bluetooth: hci5: Frame reassembly failed (-84) [ 1474.091134][T23436] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 1474.417595][T23448] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4737'. [ 1474.599252][T23448] lo speed is unknown, defaulting to 1000 [ 1475.031452][T23460] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4738'. [ 1475.171084][T23462] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1475.178803][T23462] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4739'. [ 1475.564861][ T30] audit: type=1326 audit(1752387461.369:3095): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1475.588321][ C1] vkms_vblank_simulate: vblank timer overrun [ 1475.602092][ T30] audit: type=1326 audit(1752387461.369:3096): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1475.646071][ T30] audit: type=1326 audit(1752387461.379:3097): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=334 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1475.670391][ C1] vkms_vblank_simulate: vblank timer overrun [ 1475.751572][T23474] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1476.590911][ T30] audit: type=1326 audit(1752387461.379:3098): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1476.636073][T12330] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1476.769999][ T30] audit: type=1326 audit(1752387461.379:3099): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1476.798982][ T30] audit: type=1326 audit(1752387461.379:3100): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=37 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1476.822373][ C1] vkms_vblank_simulate: vblank timer overrun [ 1476.907028][ T30] audit: type=1326 audit(1752387461.379:3101): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1477.253738][ T30] audit: type=1326 audit(1752387461.379:3102): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1477.437559][T23488] Bluetooth: hci5: received HCILL_GO_TO_SLEEP_ACK in state 2 [ 1477.502611][ T30] audit: type=1326 audit(1752387461.379:3103): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1477.580880][T22955] Bluetooth: hci5: Frame reassembly failed (-84) [ 1477.594103][ T30] audit: type=1326 audit(1752387461.379:3104): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1477.618095][ T30] audit: type=1326 audit(1752387461.379:3105): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1477.643268][ T30] audit: type=1326 audit(1752387461.379:3106): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23471 comm="syz.4.4743" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1478.314293][T23502] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1478.350247][T23501] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1479.288911][T23513] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4753'. [ 1479.348400][T23514] xt_physdev: --physdev-out and --physdev-is-out only supported in the FORWARD and POSTROUTING chains with bridged traffic [ 1479.434782][T23516] FAULT_INJECTION: forcing a failure. [ 1479.434782][T23516] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1479.448677][T23516] CPU: 0 UID: 0 PID: 23516 Comm: syz.4.4754 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1479.448703][T23516] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1479.448714][T23516] Call Trace: [ 1479.448720][T23516] [ 1479.448728][T23516] dump_stack_lvl+0x16c/0x1f0 [ 1479.448756][T23516] should_fail_ex+0x512/0x640 [ 1479.448783][T23516] _copy_from_user+0x2e/0xd0 [ 1479.448809][T23516] __sys_bpf+0x21d/0x4d80 [ 1479.448838][T23516] ? __pfx___sys_bpf+0x10/0x10 [ 1479.448862][T23516] ? ksys_write+0x190/0x250 [ 1479.448889][T23516] ? __mutex_unlock_slowpath+0x161/0x6a0 [ 1479.448937][T23516] ? fput+0x70/0xf0 [ 1479.448953][T23516] ? ksys_write+0x1ac/0x250 [ 1479.448975][T23516] ? __pfx_ksys_write+0x10/0x10 [ 1479.449001][T23516] __x64_sys_bpf+0x78/0xc0 [ 1479.449024][T23516] ? lockdep_hardirqs_on+0x7c/0x110 [ 1479.449047][T23516] do_syscall_64+0xcd/0x4c0 [ 1479.449074][T23516] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1479.449092][T23516] RIP: 0033:0x7f26d298e929 [ 1479.449107][T23516] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1479.449124][T23516] RSP: 002b:00007f26d3817038 EFLAGS: 00000246 ORIG_RAX: 0000000000000141 [ 1479.449141][T23516] RAX: ffffffffffffffda RBX: 00007f26d2bb5fa0 RCX: 00007f26d298e929 [ 1479.449153][T23516] RDX: 0000000000000050 RSI: 0000200000000780 RDI: 000000000000000a [ 1479.449164][T23516] RBP: 00007f26d3817090 R08: 0000000000000000 R09: 0000000000000000 [ 1479.449174][T23516] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1479.449184][T23516] R13: 0000000000000000 R14: 00007f26d2bb5fa0 R15: 00007ffc4cda3138 [ 1479.449209][T23516] [ 1479.627439][ T5829] Bluetooth: hci5: Opcode 0x1003 failed: -110 [ 1480.659343][T23524] binder: 23523:23524 ioctl c0306201 2000000001c0 returned -14 [ 1481.064580][T23529] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1481.503019][T23537] netlink: 16 bytes leftover after parsing attributes in process `syz.4.4758'. [ 1481.701271][T23539] FAULT_INJECTION: forcing a failure. [ 1481.701271][T23539] name failslab, interval 1, probability 0, space 0, times 0 [ 1481.842633][T23539] CPU: 1 UID: 0 PID: 23539 Comm: syz.9.4761 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1481.842662][T23539] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1481.842673][T23539] Call Trace: [ 1481.842680][T23539] [ 1481.842687][T23539] dump_stack_lvl+0x16c/0x1f0 [ 1481.842718][T23539] should_fail_ex+0x512/0x640 [ 1481.842741][T23539] ? fs_reclaim_acquire+0xae/0x150 [ 1481.842760][T23539] ? tomoyo_realpath_from_path+0xc2/0x6e0 [ 1481.842784][T23539] should_failslab+0xc2/0x120 [ 1481.842809][T23539] __kmalloc_noprof+0xd2/0x510 [ 1481.842839][T23539] tomoyo_realpath_from_path+0xc2/0x6e0 [ 1481.842867][T23539] ? tomoyo_profile+0x47/0x60 [ 1481.842896][T23539] tomoyo_path_number_perm+0x245/0x580 [ 1481.842917][T23539] ? tomoyo_path_number_perm+0x237/0x580 [ 1481.842940][T23539] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 1481.842962][T23539] ? find_held_lock+0x2b/0x80 [ 1481.842989][T23539] ? __pfx___schedule+0x10/0x10 [ 1481.843021][T23539] ? rcu_is_watching+0x12/0xc0 [ 1481.843043][T23539] ? irqentry_exit+0x3b/0x90 [ 1481.843063][T23539] ? lockdep_hardirqs_on+0x7c/0x110 [ 1481.843086][T23539] ? hook_file_ioctl_common+0x145/0x410 [ 1481.843107][T23539] ? __x64_sys_ioctl+0x94/0x210 [ 1481.843125][T23539] ? security_file_ioctl+0x18/0x240 [ 1481.843150][T23539] security_file_ioctl+0x9b/0x240 [ 1481.843174][T23539] __x64_sys_ioctl+0xb7/0x210 [ 1481.843194][T23539] do_syscall_64+0xcd/0x4c0 [ 1481.843219][T23539] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1481.843236][T23539] RIP: 0033:0x7fd50c98e929 [ 1481.843250][T23539] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1481.843267][T23539] RSP: 002b:00007fd50d728038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1481.843284][T23539] RAX: ffffffffffffffda RBX: 00007fd50cbb5fa0 RCX: 00007fd50c98e929 [ 1481.843295][T23539] RDX: 0000200000000480 RSI: 00000000c4c85512 RDI: 0000000000000003 [ 1481.843306][T23539] RBP: 00007fd50d728090 R08: 0000000000000000 R09: 0000000000000000 [ 1481.843316][T23539] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1481.843325][T23539] R13: 0000000000000000 R14: 00007fd50cbb5fa0 R15: 00007fffa2bc4bc8 [ 1481.843348][T23539] [ 1481.843355][T23539] ERROR: Out of memory at tomoyo_realpath_from_path. [ 1482.362571][T23543] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1482.648380][T23555] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1483.056511][T23535] mac80211_hwsim: wmediumd released netlink socket, switching to perfect channel medium [ 1484.116132][ T1297] ieee802154 phy1 wpan1: encryption failed: -22 [ 1484.149193][T23570] loop6: detected capacity change from 0 to 63 [ 1484.159208][T23570] Buffer I/O error on dev loop6, logical block 0, async page read [ 1484.174179][T23570] Buffer I/O error on dev loop6, logical block 0, async page read [ 1484.182462][T23570] Buffer I/O error on dev loop6, logical block 0, async page read [ 1484.191663][T23572] FAULT_INJECTION: forcing a failure. [ 1484.191663][T23572] name failslab, interval 1, probability 0, space 0, times 0 [ 1484.204857][T23572] CPU: 1 UID: 0 PID: 23572 Comm: syz.9.4768 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1484.204883][T23572] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1484.204894][T23572] Call Trace: [ 1484.204900][T23572] [ 1484.204907][T23572] dump_stack_lvl+0x16c/0x1f0 [ 1484.204934][T23572] should_fail_ex+0x512/0x640 [ 1484.204950][T23572] ? kmem_cache_alloc_noprof+0x5a/0x3b0 [ 1484.204968][T23572] should_failslab+0xc2/0x120 [ 1484.204985][T23572] kmem_cache_alloc_noprof+0x6d/0x3b0 [ 1484.205000][T23572] ? __kernfs_new_node+0xd2/0x8e0 [ 1484.205020][T23572] __kernfs_new_node+0xd2/0x8e0 [ 1484.205037][T23572] ? kernfs_add_one+0x37d/0x840 [ 1484.205047][T23572] ? __pfx___kernfs_new_node+0x10/0x10 [ 1484.205067][T23572] ? find_held_lock+0x2b/0x80 [ 1484.205083][T23572] ? kernfs_root+0xee/0x2a0 [ 1484.205102][T23572] kernfs_new_node+0x13c/0x1e0 [ 1484.205115][T23572] __kernfs_create_file+0x53/0x350 [ 1484.205131][T23572] sysfs_add_file_mode_ns+0x207/0x3c0 [ 1484.205150][T23572] sysfs_create_file_ns+0x13d/0x1d0 [ 1484.205166][T23572] ? __pfx_sysfs_create_file_ns+0x10/0x10 [ 1484.205181][T23572] ? down_read+0x13d/0x480 [ 1484.205198][T23572] ? __pfx___up_read+0x10/0x10 [ 1484.205210][T23572] ? acpi_device_notify+0x351/0x480 [ 1484.205228][T23572] device_create_file+0xf2/0x1e0 [ 1484.205242][T23572] device_add+0x2bf/0x1a70 [ 1484.205254][T23572] ? __pfx_device_add+0x10/0x10 [ 1484.205266][T23572] ? lockdep_init_map_type+0x5c/0x280 [ 1484.205280][T23572] input_register_device+0x7e8/0x1130 [ 1484.205298][T23572] uinput_ioctl_handler.isra.0+0x1357/0x1df0 [ 1484.205318][T23572] ? __pfx_uinput_ioctl_handler.isra.0+0x10/0x10 [ 1484.205336][T23572] ? __pfx_ioctl_has_perm.constprop.0.isra.0+0x10/0x10 [ 1484.205362][T23572] ? selinux_file_ioctl+0x180/0x270 [ 1484.205377][T23572] ? selinux_file_ioctl+0xb4/0x270 [ 1484.205393][T23572] ? __pfx_uinput_ioctl+0x10/0x10 [ 1484.205411][T23572] __x64_sys_ioctl+0x18e/0x210 [ 1484.205426][T23572] do_syscall_64+0xcd/0x4c0 [ 1484.205443][T23572] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1484.205455][T23572] RIP: 0033:0x7fd50c98e929 [ 1484.205465][T23572] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1484.205476][T23572] RSP: 002b:00007fd50d728038 EFLAGS: 00000246 ORIG_RAX: 0000000000000010 [ 1484.205488][T23572] RAX: ffffffffffffffda RBX: 00007fd50cbb5fa0 RCX: 00007fd50c98e929 [ 1484.205495][T23572] RDX: 0000000000000000 RSI: 0000000000005501 RDI: 0000000000000003 [ 1484.205502][T23572] RBP: 00007fd50d728090 R08: 0000000000000000 R09: 0000000000000000 [ 1484.205509][T23572] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1484.205515][T23572] R13: 0000000000000000 R14: 00007fd50cbb5fa0 R15: 00007fffa2bc4bc8 [ 1484.205529][T23572] [ 1484.500399][T23570] Buffer I/O error on dev loop6, logical block 0, async page read [ 1484.509235][T23573] Buffer I/O error on dev loop6, logical block 0, lost async page write [ 1484.518277][T23573] Buffer I/O error on dev loop6, logical block 1, lost async page write [ 1484.781012][T23570] loop6: unable to read partition table [ 1484.788227][T23570] loop_reread_partitions: partition scan of loop6 (3Ÿ ¾‚³˜) failed (rc=-5) [ 1484.960111][T23573] Buffer I/O error on dev loop6, logical block 2, lost async page write [ 1485.035578][T23573] Buffer I/O error on dev loop6, logical block 3, lost async page write [ 1485.208624][T23590] x_tables: arp_tables: CLASSIFY target: used from hooks INPUT, but only usable from FORWARD/OUTPUT [ 1485.251922][T23573] Buffer I/O error on dev loop6, logical block 4, lost async page write [ 1485.325222][T23573] Buffer I/O error on dev loop6, logical block 5, lost async page write [ 1486.272560][T23602] netlink: 84 bytes leftover after parsing attributes in process `syz.9.4775'. [ 1488.061009][ T30] kauditd_printk_skb: 26 callbacks suppressed [ 1488.061026][ T30] audit: type=1800 audit(1752387473.759:3133): pid=23617 uid=0 auid=4294967295 ses=4294967295 subj=root:sysadm_r:sysadm_t op=collect_data cause=failed comm="syz.6.4777" name="SYSV00000000" dev="hugetlbfs" ino=0 res=0 errno=0 [ 1488.819322][T18515] usb 10-1: new high-speed USB device number 41 using dummy_hcd [ 1489.175218][T18515] usb 10-1: New USB device found, idVendor=20b7, idProduct=1540, bcdDevice=b7.5a [ 1489.184425][T18515] usb 10-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 1489.199306][T18515] usb 10-1: Product: syz [ 1489.203581][T18515] usb 10-1: Manufacturer: syz [ 1489.208264][T18515] usb 10-1: SerialNumber: syz [ 1489.259994][ T9] usb 7-1: new high-speed USB device number 116 using dummy_hcd [ 1489.410189][ T9] usb 7-1: device descriptor read/64, error -71 [ 1489.711763][T18515] usb 10-1: config 0 descriptor?? [ 1489.721660][ T9] usb 7-1: new high-speed USB device number 117 using dummy_hcd [ 1489.862918][ T9] usb 7-1: device descriptor read/64, error -71 [ 1489.970461][ T9] usb usb7-port1: attempt power cycle [ 1490.390963][ T9] usb 7-1: new high-speed USB device number 118 using dummy_hcd [ 1490.460260][ T9] usb 7-1: device descriptor read/8, error -71 [ 1490.908388][ T9] usb 7-1: new high-speed USB device number 119 using dummy_hcd [ 1490.916193][T18515] usb 10-1: non-Atmel transceiver xxxx08e5 [ 1491.301359][ T9] usb 7-1: device descriptor read/8, error -71 [ 1491.332346][T23658] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1491.379715][T18515] usb 10-1: Firmware version (0.0) predates our first public release. [ 1491.381458][T23621] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 1491.388223][T18515] usb 10-1: Please update to version 0.2 or newer [ 1491.586828][ T9] usb usb7-port1: unable to enumerate USB device [ 1491.594461][T23621] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 1491.851307][T18515] usb 10-1: atusb_probe: initialization failed, error = -19 [ 1491.862158][T18515] usb 10-1: USB disconnect, device number 41 [ 1492.939945][T23676] netlink: 404 bytes leftover after parsing attributes in process `syz.2.4790'. [ 1495.311217][T23719] input: syz1 as /devices/virtual/input/input103 [ 1495.318743][T23719] input: failed to attach handler leds to device input103, error: -6 [ 1495.507483][T23730] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1495.510506][T17726] nci: nci_rf_discover_ntf_packet: unsupported rf_tech_and_mode 0x54 [ 1495.777508][T23735] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1496.856951][T23740] netlink: 8 bytes leftover after parsing attributes in process `syz.9.4803'. [ 1497.155032][T23752] netlink: 1068 bytes leftover after parsing attributes in process `syz.4.4807'. [ 1498.144778][T23772] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4808'. [ 1498.179721][T23779] netlink: 24 bytes leftover after parsing attributes in process `syz.9.4810'. [ 1499.034193][ T30] audit: type=1400 audit(1752387484.839:3134): avc: denied { setopt } for pid=23784 comm="syz.6.4813" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=netlink_xfrm_socket permissive=1 [ 1499.137270][T23785] netlink: 4 bytes leftover after parsing attributes in process `syz.6.4813'. [ 1501.035617][T23808] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1501.150090][T23806] netlink: 24 bytes leftover after parsing attributes in process `syz.4.4817'. [ 1501.339911][ T30] audit: type=1400 audit(1752387487.139:3135): avc: denied { getopt } for pid=23814 comm="syz.8.4820" scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=tipc_socket permissive=1 [ 1502.084329][T23824] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1503.153485][T23840] FAULT_INJECTION: forcing a failure. [ 1503.153485][T23840] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 1503.167235][T23840] CPU: 0 UID: 0 PID: 23840 Comm: syz.2.4826 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1503.167262][T23840] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1503.167272][T23840] Call Trace: [ 1503.167278][T23840] [ 1503.167285][T23840] dump_stack_lvl+0x16c/0x1f0 [ 1503.167313][T23840] should_fail_ex+0x512/0x640 [ 1503.167339][T23840] _copy_from_user+0x2e/0xd0 [ 1503.167365][T23840] kstrtouint_from_user+0xd6/0x1d0 [ 1503.167384][T23840] ? __pfx_kstrtouint_from_user+0x10/0x10 [ 1503.167402][T23840] ? __lock_acquire+0xb8a/0x1c90 [ 1503.167429][T23840] proc_fail_nth_write+0x83/0x250 [ 1503.167452][T23840] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1503.167480][T23840] ? __pfx_proc_fail_nth_write+0x10/0x10 [ 1503.167499][T23840] vfs_write+0x2a0/0x1150 [ 1503.167526][T23840] ? __pfx___mutex_lock+0x10/0x10 [ 1503.167550][T23840] ? __pfx_vfs_write+0x10/0x10 [ 1503.167578][T23840] ? __fget_files+0x20e/0x3c0 [ 1503.167608][T23840] ksys_write+0x12a/0x250 [ 1503.167629][T23840] ? __pfx_ksys_write+0x10/0x10 [ 1503.167657][T23840] do_syscall_64+0xcd/0x4c0 [ 1503.167688][T23840] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1503.167705][T23840] RIP: 0033:0x7fe79f78d3df [ 1503.167720][T23840] Code: 89 54 24 18 48 89 74 24 10 89 7c 24 08 e8 f9 92 02 00 48 8b 54 24 18 48 8b 74 24 10 41 89 c0 8b 7c 24 08 b8 01 00 00 00 0f 05 <48> 3d 00 f0 ff ff 77 31 44 89 c7 48 89 44 24 08 e8 4c 93 02 00 48 [ 1503.167736][T23840] RSP: 002b:00007fe7a05f8030 EFLAGS: 00000293 ORIG_RAX: 0000000000000001 [ 1503.167753][T23840] RAX: ffffffffffffffda RBX: 0000000000000000 RCX: 00007fe79f78d3df [ 1503.167764][T23840] RDX: 0000000000000001 RSI: 00007fe7a05f80a0 RDI: 0000000000000004 [ 1503.167774][T23840] RBP: 00007fe7a05f8090 R08: 0000000000000000 R09: 0000000000000000 [ 1503.167784][T23840] R10: 0000000000000000 R11: 0000000000000293 R12: 0000000000000001 [ 1503.167793][T23840] R13: 0000000000000000 R14: 00007fe79f9b5fa0 R15: 00007ffc4da2d5d8 [ 1503.167817][T23840] [ 1504.688361][T23863] netlink: 24 bytes leftover after parsing attributes in process `syz.8.4827'. [ 1505.285964][T23872] xt_TPROXY: Can be used only with -p tcp or -p udp [ 1505.296768][T23872] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4831'. [ 1507.159660][ T30] audit: type=1400 audit(1752387492.959:3136): avc: denied { ioctl } for pid=23896 comm="syz.8.4839" path="socket:[97768]" dev="sockfs" ino=97768 ioctlcmd=0x89f3 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=smc_socket permissive=1 [ 1509.233496][T23925] program syz.4.4846 is using a deprecated SCSI ioctl, please convert it to SG_IO [ 1509.407565][ T30] audit: type=1400 audit(1752387495.209:3137): avc: denied { mounton } for pid=23923 comm="syz.4.4846" path="/368/file0" dev="tmpfs" ino=1951 scontext=root:sysadm_r:sysadm_t tcontext=root:object_r:user_tmpfs_t tclass=blk_file permissive=1 [ 1509.460172][T23930] netlink: 60 bytes leftover after parsing attributes in process `syz.4.4846'. [ 1511.034091][T23952] netlink: 20 bytes leftover after parsing attributes in process `syz.6.4848'. [ 1513.122120][T14270] usb 10-1: new high-speed USB device number 42 using dummy_hcd [ 1513.859755][T14270] usb 10-1: Using ep0 maxpacket: 8 [ 1513.873601][ T30] audit: type=1326 audit(1752387499.679:3138): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=23981 comm="syz.6.4858" exe="/root/syz-executor" sig=31 arch=c000003e syscall=202 compat=0 ip=0x7fcf58b8e929 code=0x0 [ 1513.913555][T14270] usb 10-1: New USB device found, idVendor=041e, idProduct=2801, bcdDevice= 0.00 [ 1513.925086][T14270] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1513.951056][T14270] usb 10-1: config 0 descriptor?? [ 1514.306353][T23986] validate_nla: 43 callbacks suppressed [ 1514.306371][T23986] netlink: 'syz.6.4858': attribute type 1 has an invalid length. [ 1514.789191][ T30] audit: type=1400 audit(1752387500.589:3139): avc: denied { map } for pid=23994 comm="syz.4.4861" path="socket:[97984]" dev="sockfs" ino=97984 scontext=root:sysadm_r:sysadm_t tcontext=root:sysadm_r:sysadm_t tclass=udp_socket permissive=1 [ 1514.888099][T24002] netlink: 12 bytes leftover after parsing attributes in process `syz.4.4863'. [ 1515.262357][T24002] netlink: 4 bytes leftover after parsing attributes in process `syz.4.4863'. [ 1515.808964][T14270] usbhid 10-1:0.0: can't add hid device: -71 [ 1515.815977][T14270] usbhid 10-1:0.0: probe with driver usbhid failed with error -71 [ 1515.841769][T14270] usb 10-1: USB disconnect, device number 42 [ 1516.189880][T14270] usb 10-1: new full-speed USB device number 43 using dummy_hcd [ 1516.750836][T14270] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1516.790124][T14270] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1516.836989][T14270] usb 10-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1516.856883][T14270] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1516.878296][T14270] usb 10-1: config 0 descriptor?? [ 1517.782271][T14270] hid-generic 0003:04F3:0754.0024: unknown main item tag 0x1 [ 1517.795456][T14270] hid-generic 0003:04F3:0754.0024: item fetching failed at offset 3/5 [ 1518.035426][T14270] hid-generic 0003:04F3:0754.0024: probe with driver hid-generic failed with error -22 [ 1518.048559][T14270] usb 10-1: USB disconnect, device number 43 [ 1518.255715][T24029] netlink: 12 bytes leftover after parsing attributes in process `syz.6.4870'. [ 1518.462271][ T30] audit: type=1326 audit(1752387504.259:3140): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1518.534919][ T30] audit: type=1326 audit(1752387504.259:3141): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.201534][ T30] audit: type=1326 audit(1752387504.269:3142): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=37 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.225853][ T30] audit: type=1326 audit(1752387504.269:3143): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.289733][ T30] audit: type=1326 audit(1752387504.269:3144): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.372892][ T30] audit: type=1326 audit(1752387504.269:3145): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=50 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.502145][ T30] audit: type=1326 audit(1752387504.269:3146): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.547748][ T30] audit: type=1326 audit(1752387504.269:3147): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.589894][ T30] audit: type=1326 audit(1752387504.269:3148): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=42 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.616146][ T30] audit: type=1326 audit(1752387504.269:3149): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.920784][ T30] audit: type=1326 audit(1752387504.269:3150): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=202 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1519.949437][T12277] usb 10-1: new full-speed USB device number 44 using dummy_hcd [ 1520.008263][ T30] audit: type=1326 audit(1752387504.269:3151): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=root:sysadm_r:sysadm_t pid=24036 comm="syz.4.4875" exe="/root/syz-executor" sig=0 arch=c000003e syscall=317 compat=0 ip=0x7f26d298e929 code=0x7ffc0000 [ 1520.035802][T24056] netlink: 24 bytes leftover after parsing attributes in process `syz.2.4878'. [ 1520.133534][T12277] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 10 [ 1520.818791][T12277] usb 10-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 1520.829313][T12277] usb 10-1: New USB device found, idVendor=04f3, idProduct=0754, bcdDevice= 0.00 [ 1520.846054][T12277] usb 10-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 1520.900003][T12277] usb 10-1: config 0 descriptor?? [ 1521.379643][T24073] iommufd_mock iommufd_mock0: Adding to iommu group 0 [ 1521.798913][T12277] hid-generic 0003:04F3:0754.0025: failed to start in urb: -90 [ 1521.835006][T12277] hid-generic 0003:04F3:0754.0025: hidraw0: USB HID v1.01 Device [HID 04f3:0754] on usb-dummy_hcd.9-1/input0 [ 1522.500408][T12277] usb 10-1: USB disconnect, device number 44 [ 1522.544553][T24079] lo speed is unknown, defaulting to 1000 [ 1522.983857][T24088] random: crng reseeded on system resumption [ 1522.992675][T24088] FAULT_INJECTION: forcing a failure. [ 1522.992675][T24088] name failslab, interval 1, probability 0, space 0, times 0 [ 1523.008018][T24088] CPU: 0 UID: 0 PID: 24088 Comm: syz.6.4886 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1523.008042][T24088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1523.008053][T24088] Call Trace: [ 1523.008059][T24088] [ 1523.008066][T24088] dump_stack_lvl+0x16c/0x1f0 [ 1523.008088][T24088] should_fail_ex+0x512/0x640 [ 1523.008105][T24088] should_failslab+0xc2/0x120 [ 1523.008123][T24088] __kmalloc_cache_noprof+0x6a/0x3e0 [ 1523.008136][T24088] ? do_raw_spin_lock+0x12c/0x2b0 [ 1523.008149][T24088] ? find_held_lock+0x2b/0x80 [ 1523.008162][T24088] ? async_schedule_node_domain+0x54/0x120 [ 1523.008180][T24088] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 1523.008196][T24088] async_schedule_node_domain+0x54/0x120 [ 1523.008214][T24088] dev_cache_fw_image+0x38e/0x490 [ 1523.008228][T24088] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 1523.008243][T24088] ? dev_cache_fw_image+0x398/0x490 [ 1523.008259][T24088] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 1523.008273][T24088] dpm_for_each_dev+0x5d/0xb0 [ 1523.008286][T24088] fw_pm_notify+0x81/0x150 [ 1523.008297][T24088] notifier_call_chain+0xbc/0x410 [ 1523.008312][T24088] ? __pfx_fw_pm_notify+0x10/0x10 [ 1523.008328][T24088] blocking_notifier_call_chain_robust+0xc8/0x160 [ 1523.008346][T24088] ? __pfx_blocking_notifier_call_chain_robust+0x10/0x10 [ 1523.008369][T24088] pm_notifier_call_chain_robust+0x27/0x60 [ 1523.008381][T24088] snapshot_open+0x218/0x2b0 [ 1523.008397][T24088] ? __pfx_snapshot_open+0x10/0x10 [ 1523.008414][T24088] misc_open+0x35d/0x420 [ 1523.008427][T24088] ? __pfx_misc_open+0x10/0x10 [ 1523.008439][T24088] chrdev_open+0x231/0x6a0 [ 1523.008457][T24088] ? __pfx_chrdev_open+0x10/0x10 [ 1523.008474][T24088] ? file_set_fsnotify_mode_from_watchers+0x163/0x640 [ 1523.008493][T24088] do_dentry_open+0x741/0x1c10 [ 1523.008509][T24088] ? __pfx_chrdev_open+0x10/0x10 [ 1523.008529][T24088] vfs_open+0x82/0x3f0 [ 1523.008541][T24088] path_openat+0x1de4/0x2cb0 [ 1523.008563][T24088] ? __pfx_path_openat+0x10/0x10 [ 1523.008579][T24088] ? __lock_acquire+0xb8a/0x1c90 [ 1523.008591][T24088] do_filp_open+0x20b/0x470 [ 1523.008607][T24088] ? __pfx_do_filp_open+0x10/0x10 [ 1523.008634][T24088] ? alloc_fd+0x471/0x7d0 [ 1523.008654][T24088] do_sys_openat2+0x11b/0x1d0 [ 1523.008664][T24088] ? __pfx_do_sys_openat2+0x10/0x10 [ 1523.008676][T24088] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 1523.008694][T24088] __x64_sys_openat+0x174/0x210 [ 1523.008706][T24088] ? __pfx___x64_sys_openat+0x10/0x10 [ 1523.008720][T24088] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 1523.008736][T24088] do_syscall_64+0xcd/0x4c0 [ 1523.008753][T24088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1523.008764][T24088] RIP: 0033:0x7fcf58b8e929 [ 1523.008774][T24088] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1523.008785][T24088] RSP: 002b:00007fcf59a66038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1523.008796][T24088] RAX: ffffffffffffffda RBX: 00007fcf58db6160 RCX: 00007fcf58b8e929 [ 1523.008803][T24088] RDX: 00000000000c2d41 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 1523.008810][T24088] RBP: 00007fcf59a66090 R08: 0000000000000000 R09: 0000000000000000 [ 1523.008817][T24088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1523.008823][T24088] R13: 0000000000000001 R14: 00007fcf58db6160 R15: 00007ffc01575bf8 [ 1523.008837][T24088] [ 1523.463325][T24088] [ 1523.465661][T24088] ============================================ [ 1523.471781][T24088] WARNING: possible recursive locking detected [ 1523.477914][T24088] 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 Not tainted [ 1523.484989][T24088] -------------------------------------------- [ 1523.491109][T24088] syz.6.4886/24088 is trying to acquire lock: [ 1523.497141][T24088] ffffffff8f5154e8 (fw_lock){+.+.}-{4:4}, at: assign_fw+0x4e/0x640 [ 1523.505026][T24088] [ 1523.505026][T24088] but task is already holding lock: [ 1523.512369][T24088] ffffffff8f5154e8 (fw_lock){+.+.}-{4:4}, at: fw_pm_notify+0x69/0x150 [ 1523.520538][T24088] [ 1523.520538][T24088] other info that might help us debug this: [ 1523.528579][T24088] Possible unsafe locking scenario: [ 1523.528579][T24088] [ 1523.536010][T24088] CPU0 [ 1523.539279][T24088] ---- [ 1523.542543][T24088] lock(fw_lock); [ 1523.546256][T24088] lock(fw_lock); [ 1523.549968][T24088] [ 1523.549968][T24088] *** DEADLOCK *** [ 1523.549968][T24088] [ 1523.558093][T24088] May be due to missing lock nesting notation [ 1523.558093][T24088] [ 1523.566395][T24088] 5 locks held by syz.6.4886/24088: [ 1523.571574][T24088] #0: ffffffff8f302ca8 (misc_mtx){+.+.}-{4:4}, at: misc_open+0x63/0x420 [ 1523.580003][T24088] #1: ffffffff8e488368 (system_transition_mutex){+.+.}-{4:4}, at: lock_system_sleep+0x87/0xa0 [ 1523.590344][T24088] #2: ffffffff8e4c8a50 ((pm_chain_head).rwsem){++++}-{4:4}, at: blocking_notifier_call_chain_robust+0xa8/0x160 [ 1523.602163][T24088] #3: ffffffff8f5154e8 (fw_lock){+.+.}-{4:4}, at: fw_pm_notify+0x69/0x150 [ 1523.610761][T24088] #4: ffffffff8f50fee8 (dpm_list_mtx){+.+.}-{4:4}, at: dpm_for_each_dev+0x2d/0xb0 [ 1523.620055][T24088] [ 1523.620055][T24088] stack backtrace: [ 1523.625925][T24088] CPU: 1 UID: 0 PID: 24088 Comm: syz.6.4886 Not tainted 6.16.0-rc5-syzkaller-00266-g3f31a806a62e #0 PREEMPT(full) [ 1523.625946][T24088] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 05/07/2025 [ 1523.625955][T24088] Call Trace: [ 1523.625960][T24088] [ 1523.625966][T24088] dump_stack_lvl+0x116/0x1f0 [ 1523.625987][T24088] print_deadlock_bug+0x1e9/0x240 [ 1523.626009][T24088] __lock_acquire+0x1106/0x1c90 [ 1523.626024][T24088] ? __kasan_slab_free+0x51/0x70 [ 1523.626045][T24088] lock_acquire+0x179/0x350 [ 1523.626057][T24088] ? assign_fw+0x4e/0x640 [ 1523.626073][T24088] ? __pfx___might_resched+0x10/0x10 [ 1523.626092][T24088] ? do_sys_openat2+0x11b/0x1d0 [ 1523.626105][T24088] ? __x64_sys_openat+0x174/0x210 [ 1523.626117][T24088] ? do_syscall_64+0xcd/0x4c0 [ 1523.626138][T24088] __mutex_lock+0x199/0xb90 [ 1523.626157][T24088] ? assign_fw+0x4e/0x640 [ 1523.626173][T24088] ? assign_fw+0x4e/0x640 [ 1523.626188][T24088] ? __pfx___mutex_lock+0x10/0x10 [ 1523.626210][T24088] ? kasan_quarantine_put+0x10a/0x240 [ 1523.626227][T24088] ? lockdep_hardirqs_on+0x7c/0x110 [ 1523.626247][T24088] ? assign_fw+0x4e/0x640 [ 1523.626266][T24088] assign_fw+0x4e/0x640 [ 1523.626280][T24088] ? _request_firmware+0x957/0x1470 [ 1523.626298][T24088] _request_firmware+0x988/0x1470 [ 1523.626317][T24088] ? __pfx__request_firmware+0x10/0x10 [ 1523.626333][T24088] ? dump_stack_lvl+0x197/0x1f0 [ 1523.626352][T24088] ? dump_stack_lvl+0x1a3/0x1f0 [ 1523.626372][T24088] __async_dev_cache_fw_image+0xb1/0x340 [ 1523.626390][T24088] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 1523.626408][T24088] ? mark_held_locks+0x49/0x80 [ 1523.626420][T24088] ? _raw_spin_unlock_irqrestore+0x52/0x80 [ 1523.626438][T24088] ? __pfx___async_dev_cache_fw_image+0x10/0x10 [ 1523.626456][T24088] async_schedule_node_domain+0xd4/0x120 [ 1523.626477][T24088] dev_cache_fw_image+0x38e/0x490 [ 1523.626493][T24088] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 1523.626510][T24088] ? dev_cache_fw_image+0x398/0x490 [ 1523.626525][T24088] ? __pfx_dev_cache_fw_image+0x10/0x10 [ 1523.626540][T24088] dpm_for_each_dev+0x5d/0xb0 [ 1523.626555][T24088] fw_pm_notify+0x81/0x150 [ 1523.626569][T24088] notifier_call_chain+0xbc/0x410 [ 1523.626589][T24088] ? __pfx_fw_pm_notify+0x10/0x10 [ 1523.626606][T24088] blocking_notifier_call_chain_robust+0xc8/0x160 [ 1523.626627][T24088] ? __pfx_blocking_notifier_call_chain_robust+0x10/0x10 [ 1523.626652][T24088] pm_notifier_call_chain_robust+0x27/0x60 [ 1523.626666][T24088] snapshot_open+0x218/0x2b0 [ 1523.626686][T24088] ? __pfx_snapshot_open+0x10/0x10 [ 1523.626706][T24088] misc_open+0x35d/0x420 [ 1523.626723][T24088] ? __pfx_misc_open+0x10/0x10 [ 1523.626738][T24088] chrdev_open+0x231/0x6a0 [ 1523.626758][T24088] ? __pfx_chrdev_open+0x10/0x10 [ 1523.626778][T24088] ? file_set_fsnotify_mode_from_watchers+0x163/0x640 [ 1523.626799][T24088] do_dentry_open+0x741/0x1c10 [ 1523.626818][T24088] ? __pfx_chrdev_open+0x10/0x10 [ 1523.626839][T24088] vfs_open+0x82/0x3f0 [ 1523.626852][T24088] path_openat+0x1de4/0x2cb0 [ 1523.626874][T24088] ? __pfx_path_openat+0x10/0x10 [ 1523.626893][T24088] ? __lock_acquire+0xb8a/0x1c90 [ 1523.626906][T24088] do_filp_open+0x20b/0x470 [ 1523.626924][T24088] ? __pfx_do_filp_open+0x10/0x10 [ 1523.626949][T24088] ? alloc_fd+0x471/0x7d0 [ 1523.626969][T24088] do_sys_openat2+0x11b/0x1d0 [ 1523.626983][T24088] ? __pfx_do_sys_openat2+0x10/0x10 [ 1523.626997][T24088] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 1523.627016][T24088] __x64_sys_openat+0x174/0x210 [ 1523.627030][T24088] ? __pfx___x64_sys_openat+0x10/0x10 [ 1523.627045][T24088] ? trace_irq_enable.constprop.0+0x2f/0x120 [ 1523.627063][T24088] do_syscall_64+0xcd/0x4c0 [ 1523.627082][T24088] entry_SYSCALL_64_after_hwframe+0x77/0x7f [ 1523.627097][T24088] RIP: 0033:0x7fcf58b8e929 [ 1523.627109][T24088] Code: ff ff c3 66 2e 0f 1f 84 00 00 00 00 00 0f 1f 40 00 48 89 f8 48 89 f7 48 89 d6 48 89 ca 4d 89 c2 4d 89 c8 4c 8b 4c 24 08 0f 05 <48> 3d 01 f0 ff ff 73 01 c3 48 c7 c1 a8 ff ff ff f7 d8 64 89 01 48 [ 1523.627122][T24088] RSP: 002b:00007fcf59a66038 EFLAGS: 00000246 ORIG_RAX: 0000000000000101 [ 1523.627135][T24088] RAX: ffffffffffffffda RBX: 00007fcf58db6160 RCX: 00007fcf58b8e929 [ 1523.627145][T24088] RDX: 00000000000c2d41 RSI: 00002000000000c0 RDI: ffffffffffffff9c [ 1523.627154][T24088] RBP: 00007fcf59a66090 R08: 0000000000000000 R09: 0000000000000000 [ 1523.627163][T24088] R10: 0000000000000000 R11: 0000000000000246 R12: 0000000000000001 [ 1523.627171][T24088] R13: 0000000000000001 R14: 00007fcf58db6160 R15: 00007ffc01575bf8 [ 1523.627185][T24088] [ 1524.559333][ T5829] Bluetooth: hci0: Opcode 0x0401 failed: -110 [ 1524.559736][T12330] Bluetooth: hci0: command 0x0406 tx timeout