last executing test programs: 7m24.692537485s ago: executing program 4 (id=222): r0 = syz_usb_connect(0x4, 0x1cb, &(0x7f0000000000)=ANY=[@ANYRESOCT], 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) r2 = socket$alg(0x26, 0x5, 0x0) bind$alg(r2, &(0x7f0000000100)={0x26, 'hash\x00', 0x0, 0x0, 'md5\x00'}, 0x58) r3 = accept4(r2, 0x0, 0x0, 0x0) sendto$packet(r3, &(0x7f00000002c0)="48357e0287af48ffa745b497a54e0eec1bf2c69011f35b48339d15afaef1bd7efe075ff441b16e244b8b05fe09e29583ad142567826dfa5cbc6f979b050015bde8c4441cd0fa6be03213181bfe84743015ec12ced8b1aa8f44e5c30afac6f9fd2ab1303be0d1b2c02533bcc97cce7da9b507b053b11821323590d379e9e350a3291fbedb6382de878b7a56e4e38c7f746d0424029f5d49b04697a4", 0xfffffffffffffcf6, 0x0, 0x0, 0x0) sendmsg$ETHTOOL_MSG_COALESCE_SET(r1, 0x0, 0x20000050) mknodat(0xffffffffffffff9c, &(0x7f00000000c0)='./file2\x00', 0x81c0, 0x800) r4 = bpf$BPF_BTF_GET_FD_BY_ID(0x13, 0x0, 0x0) bpf$MAP_CREATE_RINGBUF(0x0, &(0x7f0000000240)={0x1b, 0x0, 0x0, 0x0, 0x0, 0xffffffffffffffff, 0x3, '\x00', 0x0, r4, 0x4, 0x5, 0x1}, 0x50) r5 = syz_usb_connect$hid(0x3, 0x36, &(0x7f0000000240)={{0x12, 0x1, 0x0, 0x0, 0x0, 0x0, 0x40, 0x1e7d, 0x2d50, 0x0, 0x0, 0x0, 0x0, 0x1, [{{0x9, 0x2, 0x24, 0x1, 0x0, 0x0, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x0, 0x5, 0x3, 0x0, 0x2, 0x0, {0x9, 0x21, 0x0, 0x33, 0x1, {0x22, 0x5}}, {{{0x9, 0x5, 0x81, 0x3, 0x0, 0xc, 0x0, 0x7}}}}}]}}]}}, 0x0) syz_usb_control_io(r5, 0x0, 0x0) syz_usb_control_io(r5, &(0x7f00000003c0)={0x2c, &(0x7f0000001300)=ANY=[@ANYBLOB="000457"], 0x0, 0x0, 0x0, 0x0}, 0x0) syz_usb_control_io$hid(r5, 0x0, 0x0) syz_usb_control_io(r5, 0x0, &(0x7f0000000780)={0x84, &(0x7f0000000000)=ANY=[@ANYBLOB="5400000f"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) mknod$loop(&(0x7f0000000140)='./bus\x00', 0x2000, 0x0) syz_usb_control_io$rtl8150(r0, 0x0, 0x0) 7m21.800553236s ago: executing program 4 (id=227): r0 = socket$inet_tcp(0x2, 0x1, 0x0) bind$inet(r0, &(0x7f0000000300)={0x2, 0x4e21, @multicast1}, 0x10) setsockopt$inet_tcp_int(r0, 0x6, 0x210000000013, &(0x7f00000000c0)=0x100000001, 0x4) fcntl$setown(r0, 0x8, 0x0) connect$inet(r0, &(0x7f0000000180)={0x2, 0x4e21, @local}, 0x10) setsockopt$inet_tcp_TCP_REPAIR(r0, 0x6, 0x13, &(0x7f0000000100), 0x4) sendto$inet(r0, &(0x7f00000004c0), 0x0, 0x805, 0x0, 0x0) 7m21.462631981s ago: executing program 4 (id=228): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@file={0x0, './file0\x00'}, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(0xffffffffffffffff, 0x0, 0x0) write$RDMA_USER_CM_CMD_JOIN_MCAST(0xffffffffffffffff, 0x0, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffffffffffe, 0x0, 0xffffffff}, 0x0) r2 = syz_genetlink_get_family_id$ethtool(&(0x7f0000000280), 0xffffffffffffffff) bpf$BPF_GET_MAP_INFO(0xf, &(0x7f0000000380)={0x1, 0x58, &(0x7f0000000400)={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, ""/16, 0x0}}, 0x10) ioctl$sock_ipv4_tunnel_SIOCADDTUNNEL(0xffffffffffffffff, 0x89f1, &(0x7f0000000540)={'gretap0\x00', &(0x7f0000000480)={'syztnl1\x00', 0x0, 0x700, 0x7, 0xfffffffd, 0x101, {{0x1c, 0x4, 0x2, 0x34, 0x70, 0x66, 0x0, 0x4, 0x29, 0x0, @rand_addr=0x64010101, @broadcast, {[@noop, @cipso={0x86, 0x35, 0x0, [{0x2, 0xe, "9416d6f400608f9cf3fed8c1"}, {0x6, 0x12, "fa843e5f6822111c521001dcb8842e63"}, {0x0, 0xf, "d7e80753be265087df1ab8ee36"}]}, @timestamp={0x44, 0xc, 0xd1, 0x0, 0x6, [0x5, 0x1]}, @cipso={0x86, 0x8, 0x0, [{0x1, 0x2}]}, @noop, @rr={0x7, 0xf, 0xc8, [@local, @remote, @private=0xa010102]}]}}}}}) sendmsg$ETHTOOL_MSG_STRSET_GET(0xffffffffffffffff, &(0x7f0000000680)={&(0x7f0000000140)={0x10, 0x0, 0x0, 0x80000000}, 0xc, &(0x7f0000000640)={&(0x7f0000000580)={0xc0, r2, 0x400, 0x70bd2d, 0x25dfdbfc, {}, [@ETHTOOL_A_STRSET_HEADER={0x4c, 0x1, 0x0, 0x1, [@ETHTOOL_A_HEADER_FLAGS={0x8}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6tnl0\x00'}, @ETHTOOL_A_HEADER_DEV_INDEX={0x8, 0x1, r4}, @ETHTOOL_A_HEADER_FLAGS={0x8, 0x3, 0x3}, @ETHTOOL_A_HEADER_DEV_NAME={0x14, 0x2, 'ip6gretap0\x00'}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x28, 0x2, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x4}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x6}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x7}]}]}, @ETHTOOL_A_STRSET_STRINGSETS={0x38, 0x2, 0x0, 0x1, [{0x34, 0x1, 0x0, 0x1, [@ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x5}, @ETHTOOL_A_STRINGSET_ID={0x8, 0x1, 0x8}]}]}]}, 0xc0}, 0x1, 0x0, 0x0, 0x20000080}, 0x8841) bpf$MAP_UPDATE_ELEM_TAIL_CALL(0x2, 0x0, 0x0) r5 = socket$igmp(0x2, 0x3, 0x2) ioctl$sock_inet_SIOCSARP(0xffffffffffffffff, 0x8955, &(0x7f0000000a80)={{0x2, 0x0, @empty}, {0x0, @link_local}, 0x4a, {}, 'lo\x00'}) ioctl$sock_inet_SIOCSARP(r5, 0x8955, &(0x7f00000002c0)={{0x2, 0xffff, @broadcast}, {0x0, @broadcast}, 0x8, {0x2, 0x0, @empty}, 'veth1_to_batadv\x00'}) r6 = socket$netlink(0x10, 0x3, 0x0) r7 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r7, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f00000001c0)={{0x14}, [@NFT_MSG_NEWTABLE={0x20, 0x0, 0xa, 0x5, 0x0, 0x0, {0x5, 0x0, 0x8}, [@NFTA_TABLE_NAME={0x9, 0x1, 'syz0\x00'}]}, @NFT_MSG_NEWCHAIN={0x28, 0x3, 0xa, 0x3, 0x0, 0x0, {0x5}, [@NFTA_CHAIN_ID={0x8, 0xb, 0x1, 0x0, 0x4}, @NFTA_CHAIN_NAME={0x9, 0x3, 'syz0\x00'}]}, @NFT_MSG_NEWRULE={0x50, 0x6, 0xa, 0x401, 0x0, 0x0, {0x5, 0x0, 0x4000}, [@NFTA_RULE_CHAIN_ID={0x8}, @NFTA_RULE_EXPRESSIONS={0x28, 0x4, 0x0, 0x1, [{0x24, 0x1, 0x0, 0x1, @tunnel={{0xb}, @val={0x14, 0x2, 0x0, 0x1, [@NFTA_TUNNEL_KEY={0x8}, @NFTA_TUNNEL_DREG={0x8, 0x2, 0x1, 0x0, 0xc}]}}}]}, @NFTA_RULE_TABLE={0x9, 0x1, 'syz0\x00'}]}], {0x14}}, 0xc0}}, 0x0) writev(r6, &(0x7f00000003c0)=[{&(0x7f0000000180)="390000001300034700bb65e1c3e4ffff01000000010000005600000025000000190004000400000007fd17e5ffff0800040000000000000000", 0x39}], 0x1) madvise(&(0x7f0000000000/0xc00000)=nil, 0xc00304, 0x15) r8 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r8, 0xc01864c6, &(0x7f0000000040)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_REVOKE_LEASE(r8, 0xc00464c9, &(0x7f0000000040)={r9}) ioctl$SECCOMP_IOCTL_NOTIF_RECV(0xffffffffffffffff, 0x5452, 0x0) socket$inet6(0xa, 0x3, 0x6) r10 = socket(0xf, 0x3, 0x2) write(r10, 0x0, 0x0) sendmsg$NL80211_CMD_SET_QOS_MAP(0xffffffffffffffff, &(0x7f0000000340)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x1000000}, 0xc, 0x0, 0x1, 0x0, 0x0, 0x20000000}, 0x20000000) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x4e2b, 0x7, @empty, 0x7ff}, 0x1c) 7m17.875105036s ago: executing program 4 (id=236): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) setsockopt$inet6_IPV6_RTHDR(r0, 0x29, 0x39, 0x0, 0x0) socket$inet6_sctp(0xa, 0x1, 0x84) socket$nl_audit(0x10, 0x3, 0x9) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r1, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0xc1105511, 0x0) sendmmsg$unix(r3, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r4 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec29, 0x0, 0x1, 0x40000337}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r5, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r5, r6, &(0x7f0000000200)=@IORING_OP_READV=@use_registered_buffer={0x1, 0x0, 0x0, @fd_index=0x6, 0x3, 0x0, 0x0, 0x8}) syz_emit_ethernet(0x3e, &(0x7f0000000280)=ANY=[@ANYRES8], 0x0) openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$KVM_XEN_HVM_CONFIG(0xffffffffffffffff, 0x4038ae7a, &(0x7f0000000100)={0x0, 0x847, &(0x7f0000000300)="c978fb", 0x0, 0x3}) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x105082, 0x0) r7 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r7, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0xffff1000, 0x0, 0x0, 0x80, 0x0, 0x0, 0x3, 0x0, 0x7, 0x6}, {0xffff1000, 0xeeef0000, 0xf, 0x9, 0x2, 0x0, 0xa, 0x0, 0x7, 0xff}, {0x2000, 0x8080000, 0xc, 0x0, 0x4, 0xc4, 0x2, 0x0, 0x48, 0x3, 0x0, 0xfc}, {0xd000, 0x33331000, 0xc, 0x80, 0x1, 0x0, 0x9, 0x0, 0x8, 0x0, 0x4}, {0x6000, 0x6000, 0xe, 0x3, 0x51, 0x4, 0x12, 0x0, 0x0, 0x8}, {0x100000, 0xdddd0000, 0xd, 0x78, 0x5, 0x9, 0x2, 0x0, 0x0, 0x0, 0xff, 0xf4}, {0x0, 0xffff1000, 0xa, 0x4, 0x0, 0x0, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x1000, 0x1000, 0x0, 0x0, 0x0, 0x6, 0x8, 0x40, 0x26, 0x8, 0x0, 0x3}, {0x80a0000, 0x8cc}, {}, 0xddf8ffdb, 0x0, 0x3000, 0x110, 0x80000000000, 0x5801, 0x0, [0x80000001, 0x0, 0x1, 0x4]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) io_uring_enter(r4, 0x847ba, 0x0, 0xe, 0x0, 0x0) 7m15.847723473s ago: executing program 4 (id=240): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff}) futex(&(0x7f000000cffc), 0x0, 0x0, 0x0, 0x0, 0x0) futex(&(0x7f000000cffc), 0x3, 0x801, 0x0, 0x0, 0x0) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) socketpair$unix(0x1, 0x3, 0x0, &(0x7f00000000c0)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = userfaultfd(0x80001) ioctl$UFFDIO_API(r3, 0xc018aa3f, &(0x7f00000000c0)={0xaa, 0x309}) ioctl$UFFDIO_REGISTER(r3, 0xc020aa00, &(0x7f0000000080)={{&(0x7f000057c000/0x2000)=nil, 0x2000}, 0x1}) r4 = socket$alg(0x26, 0x5, 0x0) bind$alg(r4, &(0x7f0000000140)={0x26, 'hash\x00', 0x0, 0x0, 'cmac(camellia-asm)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r4, 0x117, 0x1, &(0x7f0000000000)="adcd1a9a3fc36e961ed00fe41b0cd695", 0x20) accept4$alg(r4, 0x0, 0x0, 0x0) readv(r3, &(0x7f00000002c0)=[{0x0}], 0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) ioctl$sock_kcm_SIOCKCMATTACH(0xffffffffffffffff, 0x89e0, 0x0) mlock2(&(0x7f000027f000/0x2000)=nil, 0x2000, 0x1) openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_INIT_CONTEXT(r5, 0x7a0, &(0x7f0000000000)={@local}) r6 = openat$vmci(0xffffffffffffff9c, &(0x7f0000000140), 0x2, 0x0) ioctl$IOCTL_VMCI_QUEUEPAIR_ALLOC(r6, 0x7a8, 0x0) 7m11.889758234s ago: executing program 4 (id=247): mkdirat(0xffffffffffffffff, 0x0, 0x80) socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@map, 0xffffffffffffffff, 0x1f}, 0x20) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x6, 0x2, @scatter={0x0, 0x3, 0x0}, &(0x7f0000000240)="458d7acda0b2", 0x0, 0x1, 0x1, 0x0, 0x0}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000004c00)=[{{0x0, 0x0, &(0x7f0000000240)}, 0x2ca998c3}], 0x4000032, 0x40000021, 0x0) recvmsg$can_raw(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000340)=""/197, 0xc5}], 0x1}, 0x1) 6m56.486861098s ago: executing program 32 (id=247): mkdirat(0xffffffffffffffff, 0x0, 0x80) socket$netlink(0x10, 0x3, 0x0) sendmsg$NL80211_CMD_NEW_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000040)={&(0x7f0000000000)={0x1c, 0x0, 0x0, 0x0, 0x0, {{}, {@val={0x8}, @void}}}, 0x1c}}, 0x4000004) mremap(&(0x7f0000ffa000/0x3000)=nil, 0x3000, 0x2000, 0x3, &(0x7f0000ffb000/0x2000)=nil) bpf$BPF_PROG_DETACH(0x9, &(0x7f0000000340)={@map, 0xffffffffffffffff, 0x1f}, 0x20) r0 = syz_open_dev$sg(&(0x7f0000000000), 0x0, 0x0) ioctl$SG_IO(r0, 0x2285, &(0x7f00000005c0)={0x53, 0x20, 0x6, 0x2, @scatter={0x0, 0x3, 0x0}, &(0x7f0000000240)="458d7acda0b2", 0x0, 0x1, 0x1, 0x0, 0x0}) r1 = socket$alg(0x26, 0x5, 0x0) bind$alg(r1, &(0x7f00000001c0)={0x26, 'aead\x00', 0x0, 0x0, 'gcm(aes)\x00'}, 0x4c) setsockopt$ALG_SET_KEY(r1, 0x117, 0x1, &(0x7f0000000300)="c99b57381801238c09d05c164a534308", 0x10) r2 = accept4(r1, 0x0, 0x0, 0x0) recvmmsg(r2, &(0x7f0000004c00)=[{{0x0, 0x0, &(0x7f0000000240)}, 0x2ca998c3}], 0x4000032, 0x40000021, 0x0) recvmsg$can_raw(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000006c0)=[{&(0x7f0000000340)=""/197, 0xc5}], 0x1}, 0x1) 3m38.71069837s ago: executing program 2 (id=1001): prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) io_uring_register$IORING_REGISTER_PERSONALITY(r0, 0x9, 0x0, 0x0) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x61, 0x4007, @fd=r0, 0x9, &(0x7f0000000140)=[{&(0x7f0000000100)}, {&(0x7f00000002c0)=""/196, 0xc4}], 0x2, 0x19}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) r3 = creat(&(0x7f0000000000)='./file0\x00', 0x11) ioctl$FS_IOC_FSSETXATTR(r3, 0x401c5820, &(0x7f0000000040)={0x1000, 0xfffffffa, 0xfffff, 0x10, 0x8000}) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 3m36.974748271s ago: executing program 2 (id=1005): r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$nl_generic(r0, &(0x7f0000000140)={0x0, 0x3f, &(0x7f0000001ac0)={&(0x7f0000000000)={0x1c, 0x2d, 0x1, 0x70bd26, 0x25dfdbfc, {0x4}, [@typed={0x5, 0xb, 0x0, 0x0, @str='\xed'}]}, 0x1c}, 0x1, 0x0, 0x0, 0x4000d}, 0x20000000) 3m36.726742303s ago: executing program 2 (id=1006): ioperm(0x5c5, 0x0, 0x6) (async) ioperm(0x5c5, 0x0, 0x6) r0 = syz_usb_connect(0x1, 0x2d, &(0x7f0000000000)=ANY=[@ANYBLOB="12012000f1048108cd060202d4920000000109021b1901000000d40904150001da40df0009058202"], 0x0) syz_usb_control_io$uac1(r0, 0x0, 0x0) (async) syz_usb_control_io$uac1(r0, 0x0, 0x0) syz_usb_control_io$hid(r0, 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) (async) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) (async) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCSPTLCK(0xffffffffffffffff, 0x40045431, 0x0) r3 = socket(0x10, 0x3, 0x0) write(r3, &(0x7f0000000040)="1400000052004f030e789e7e27286d000a4149f3", 0x14) r4 = openat$sndseq(0xffffffffffffff9c, &(0x7f00000000c0), 0x62181) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r4, 0xc08c5332, &(0x7f00000001c0)={0x0, 0x0, 0x0, 'queue0\x00'}) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) (async) close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, 0x0, 0x0) (async) sendmsg$nl_route(r5, 0x0, 0x0) shutdown(0xffffffffffffffff, 0x1) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000000040)=@fragment={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x8) (async) setsockopt$inet6_opts(0xffffffffffffffff, 0x29, 0x3b, &(0x7f0000000040)=@fragment={0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2}, 0x8) r6 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000100)=ANY=[@ANYBLOB="6000000002060108000000000000000000000000140007801140000000000500150000000000050005000a000000050001000700000005000400000000000900020073797a310000000014000300686173683a69702c706f72742c69f0c03464650024ab382b994e25307000ad9226bc698af00721c0b9f86e2a40bc4e86734c20f32845a0e064b8af5ae7"], 0x60}}, 0x0) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) bind$inet6(r7, 0x0, 0x0) sendto$inet6(r7, 0x0, 0x0, 0x20000045, &(0x7f00000001c0)={0xa, 0x2, 0x3, @initdev={0xfe, 0x88, '\x00', 0x1, 0x0}, 0x3}, 0x1c) setsockopt$inet6_tcp_TCP_CONGESTION(r7, 0x6, 0xd, &(0x7f0000000440)='cubic', 0x5) shutdown(r7, 0x1) (async) shutdown(r7, 0x1) openat$zero(0xffffffffffffff9c, &(0x7f0000000f40), 0x101002, 0x0) (async) r8 = openat$zero(0xffffffffffffff9c, &(0x7f0000000f40), 0x101002, 0x0) r9 = syz_io_uring_setup(0x232, &(0x7f0000000080)={0x0, 0x0, 0x400, 0x0, 0xfffffffe, 0x0, r8}, &(0x7f0000000000)=0x0, &(0x7f0000000040)=0x0) syz_io_uring_submit(r10, r11, &(0x7f00000009c0)=@IORING_OP_FADVISE={0x18, 0x1b, 0x0, @fd=r8, 0x0, 0x0, 0x24, 0x5, 0x1}) io_uring_enter(r9, 0x5370, 0x0, 0x0, 0x0, 0x4e) 3m32.87836365s ago: executing program 3 (id=1015): r0 = socket$packet(0x11, 0x2, 0x300) r1 = dup(r0) sendmmsg(r1, &(0x7f0000000380)=[{{&(0x7f0000000080)=@tipc=@name={0x1e, 0x2, 0x3, {{0x41}, 0x3}}, 0x80, 0x0, 0x0, &(0x7f0000000400)=ANY=[@ANYBLOB="94000000"], 0x94}}, {{&(0x7f0000000240)=@llc={0x1a, 0x30c, 0x9, 0x9, 0xfb, 0x2, @local}, 0x80, 0x0}}], 0x2, 0x4000000) (fail_nth: 2) 3m32.646763615s ago: executing program 2 (id=1016): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x5, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}, {0x7, 0xd9, 0xc2, 0x8}, {0x4, 0x5, 0x6, 0x5}, {0x0, 0x5, 0x1, 0x2}, {0x4, 0xd8, 0x0, 0x9}]}) r0 = open(&(0x7f0000000080)='./file0/../file0/../file0/../file0\x00', 0x10000, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20b3a000000a05000000000000000000010000d68200000073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073dac6ca259e57fa4c000000060a010480200001800700010072740000140002800800024000000002080001400000000308000b40000000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xd4}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000002900)={0x110, 0x5f, 0x101, 0x0, 0x25dfdbff, "", [@nested={0x100, 0x50, 0x0, 0x1, [@nested={0x75, 0x87, 0x0, 0x1, [@generic="9909b9a3556a23ac132da78ad50ddbaa9297c73d4757c1a8d8f277b2329eebef8b0dca3c3a876e267a7343a855eb06e2d9d4588b14839b21a9172f9906bbbc78a6b3d01b1fc87230a0cd617814b9949b235ab272f4f54b9cb3df0d9dd526002f5cd158f87c65ed129fc6f70729a527015c"]}, @generic="47e3b9708db25322e01bdc6b7f694fe1beb0ebfeaeb8aba7698c5de50637fbdb7cd6ce33317694ca210f9e118ce2cc7bc8ab42b979233442dcb2ebfa85274d92617080ae72d77583845f590c3c72084a6d930695c3fbd26fdd89ae827d55240034e97f185635d504e7ec283dd9bda165aaac4aaacc4e2f456e458f8ea3dd746bdb1b0e0e"]}]}, 0x110}], 0x1}, 0x0) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f00000001c0)={&(0x7f0000000640)=[r6, r6], 0x2, 0x80800}) close(0x3) umount2(&(0x7f0000000200)='./file0/../file0/../file0/../file0\x00', 0x1) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 3m32.223304697s ago: executing program 2 (id=1019): setsockopt$inet6_int(0xffffffffffffffff, 0x29, 0x18, 0x0, 0x500) r0 = socket$inet6_tcp(0xa, 0x1, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f0000000300)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r2, &(0x7f0000000180)={0x0, 0x0, 0x0}, 0x0) r3 = syz_open_dev$usbfs(0x0, 0x76, 0x101301) r4 = openat$audio(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) r5 = socket$nl_generic(0x10, 0x3, 0x10) r6 = openat$tun(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000000)={0x26, 'hash\x00', 0x0, 0x0, 'ghash-generic\x00'}, 0x58) write$binfmt_aout(0xffffffffffffffff, &(0x7f0000000380)=ANY=[], 0x20) splice(0xffffffffffffffff, &(0x7f0000000040), 0xffffffffffffffff, 0x0, 0x807, 0x0) sendmsg$can_bcm(0xffffffffffffffff, &(0x7f00000003c0)={&(0x7f0000000100), 0x10, &(0x7f0000000380)={&(0x7f0000000440)=ANY=[@ANYBLOB="8f040000000100000002000000", @ANYRES32=0x77359400, @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="040000200100000003000060070100002b73046aa761f02b"], 0x34}, 0x1, 0x0, 0x0, 0x10}, 0x800) r8 = accept4(r7, 0x0, 0x0, 0x0) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000200)="ad56b6cc0400aeb995298992ea5400c2", 0x10) recvmmsg$unix(0xffffffffffffffff, &(0x7f0000002a40)=[{{0x0, 0x0, &(0x7f0000000e00)=[{0x0}, {0x0}, {0x0}, {0x0}, {&(0x7f0000000680)=""/144, 0x90}], 0x5}}], 0x1, 0x20, 0x0) sendmmsg$unix(r8, &(0x7f0000000680), 0x4924924924925c6, 0x0) ioctl$TUNSETIFF(r6, 0x400454ca, &(0x7f00000000c0)={'syzkaller1\x00', 0x4c02}) sendfile64(r3, r0, 0x0, 0x0) readv(r6, &(0x7f00000002c0)=[{&(0x7f0000001400)=""/227, 0xe3}], 0x1) ioctl$sock_SIOCSIFVLAN_ADD_VLAN_CMD(r5, 0x8983, 0x0) ioctl$SIOCSIFHWADDR(0xffffffffffffffff, 0x8914, &(0x7f0000000000)={'syzkaller1\x00', @link_local}) ioctl$vim2m_VIDIOC_REQBUFS(0xffffffffffffffff, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(0xffffffffffffffff, 0xc058560f, &(0x7f0000000180)=@multiplanar_fd={0x593, 0x0, 0x4, 0x4, 0x1, {}, {0x5, 0x0, 0x6, 0xb7, 0xe, 0xf8, "48b3dafa"}, 0xe0ed, 0x4, {&(0x7f0000000240)=[{0x81, 0x5e4a, {}, 0x6}, {0x81, 0x9, {}, 0x1ff}]}, 0x30d}) ioctl$vim2m_VIDIOC_STREAMOFF(0xffffffffffffffff, 0x40045612, &(0x7f0000000080)=0x2) close_range(r4, 0xffffffffffffffff, 0x0) 3m32.126571189s ago: executing program 3 (id=1020): bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000440)={0x8, 0xf, &(0x7f0000000200)=ANY=[@ANYBLOB="1800"], 0x0, 0x7ff, 0x0, 0x0, 0x40f00, 0x0, '\x00', 0x0, 0x0, 0xffffffffffffffff, 0x8, 0x0, 0x0, 0x10, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10, 0x6}, 0x94) r0 = syz_io_uring_setup(0x74d, &(0x7f0000000100)={0x0, 0x11f8, 0x800, 0x1000, 0x5cc}, &(0x7f0000000340)=0x0, &(0x7f0000000080)) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) io_uring_register$IORING_REGISTER_BUFFERS(r0, 0x0, &(0x7f0000000740)=[{0x0}], 0x1) r2 = syz_open_procfs(0x0, &(0x7f0000000080)='fdinfo/3\x00') read$eventfd(r2, &(0x7f0000000100), 0xfffffd79) r3 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000000), 0x200, 0x0) r4 = ioctl$KVM_CREATE_VM(r3, 0xae01, 0x0) r5 = socket$pppl2tp(0x18, 0x1, 0x1) connect$pppl2tp(r5, &(0x7f0000000000)=@pppol2tp={0x18, 0x1, {0x0, 0xffffffffffffffff, {}, 0x2, 0x4}}, 0x26) r6 = dup(r5) r7 = socket$inet6_sctp(0xa, 0x5, 0x84) r8 = socket$inet6_sctp(0xa, 0x5, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r8, 0x84, 0x6f, &(0x7f0000000040)={0x0, 0x10, &(0x7f0000000000)=[@in={0x2, 0x0, @private=0xa018101}]}, &(0x7f0000000080)=0xc) getsockopt$inet_sctp6_SCTP_GET_ASSOC_ID_LIST(r8, 0x84, 0x1d, &(0x7f0000000140)={0x1, [0x0]}, &(0x7f0000000240)=0x8) getsockopt$inet_sctp6_SCTP_RTOINFO(r7, 0x84, 0x0, &(0x7f0000000080)={r9, 0xcf2, 0x84, 0x2}, &(0x7f00000000c0)=0x10) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0x1000006, 0x28011, r6, 0x0) clock_gettime(0x0, &(0x7f0000000080)={0x0, 0x0}) capset(&(0x7f0000000100)={0x20080522}, &(0x7f0000000140)) r12 = socket$kcm(0x10, 0x2, 0x4) writev(r12, &(0x7f0000000780)=[{&(0x7f0000000340)="580000001400192340834b80040d8c5602117436c379000000000000000058000b4824ca945f6400940f6a0325010ebc000000000000008000f0fffeffe809005300fff5dd000000100001000c0c100000000000224e0000", 0x58}], 0x1) sendmsg$can_bcm(r6, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000180)={0x7, 0x110, 0x0, {r10, r11/1000+60000}, {0x77359400}, {0x4, 0x1, 0x0, 0x1}, 0x1, @canfd={{0x4, 0x1, 0x1, 0x1}, 0xc, 0x0, 0x0, 0x0, "f521337a3b024390b7b4be43ad773c2147d50c80e717dffbd7eb5fe0f1c674d115fb8c4018469744a37395dc73d5dfca04d31fafe3dd8ab1bc69912538401a73"}}, 0x6c}, 0x1, 0x0, 0x0, 0x10}, 0x0) setsockopt$inet_MCAST_JOIN_GROUP(r6, 0x0, 0x2a, &(0x7f0000000500)={0x4, {{0x2, 0x4e24, @empty}}}, 0x84) r13 = ioctl$KVM_CREATE_VCPU(r4, 0xae41, 0x0) ioctl$KVM_SET_CPUID2(r13, 0x4008ae90, &(0x7f0000000140)=ANY=[@ANYRES8=r13]) ioctl$KVM_RUN(r13, 0xae80, 0x0) ioctl$KVM_SET_CPUID2(r13, 0x4008ae90, &(0x7f0000000900)=ANY=[@ANYRES32=r14]) r15 = socket$inet_tcp(0x2, 0x1, 0x0) getsockopt$inet_tcp_TCP_REPAIR_WINDOW(r15, 0x6, 0x23, &(0x7f0000000040), &(0x7f0000000200)=0x38) socket$inet6_mptcp(0xa, 0x1, 0x106) 3m31.714879282s ago: executing program 2 (id=1023): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001000090c00000000000073aa34e5828241000800000000301c2d6455ba8927bed3f8dc0a7988e146a09a689b8fc8ca13e39e140b5ea7068bca02e9678306ddd83f2ccaf9c9424ae56ee0b6009cb48aeef09256958a54229cf185c899ea8d1e173533f8310e5dbf79", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100677265746170000004000280"], 0x34}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES16=0x0], 0x104}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="701500003c0007010300000000000000017c0000040042800c00018006000600843b00004c150280081514"], 0x1570}, 0x1, 0x0, 0x0, 0x20000000}, 0xc800) 3m31.364743592s ago: executing program 33 (id=1023): sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000000c0)=ANY=[@ANYBLOB="340000001000090c00000000000073aa34e5828241000800000000301c2d6455ba8927bed3f8dc0a7988e146a09a689b8fc8ca13e39e140b5ea7068bca02e9678306ddd83f2ccaf9c9424ae56ee0b6009cb48aeef09256958a54229cf185c899ea8d1e173533f8310e5dbf79", @ANYRES32=0x0, @ANYBLOB="0000000000000000140012800b000100677265746170000004000280"], 0x34}}, 0x0) r0 = socket$nl_generic(0x10, 0x3, 0x10) sendmsg$NFT_BATCH(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000040)=ANY=[@ANYRES16=0x0], 0x104}}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000080)=ANY=[@ANYBLOB="701500003c0007010300000000000000017c0000040042800c00018006000600843b00004c150280081514"], 0x1570}, 0x1, 0x0, 0x0, 0x20000000}, 0xc800) 3m31.103407974s ago: executing program 3 (id=1029): r0 = socket$inet_tcp(0x2, 0x1, 0x0) r1 = socket(0x10, 0x803, 0x0) syz_genetlink_get_family_id$tipc(0x0, r1) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000080)={'ipvs\x00'}, &(0x7f00000000c0)=0x1e) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'wg1\x00', {0x2, 0x4e22, @broadcast}}) r2 = ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000000)) socket$inet_tcp(0x2, 0x1, 0x0) (async) socket(0x10, 0x803, 0x0) (async) syz_genetlink_get_family_id$tipc(0x0, r1) (async) getsockopt$IPT_SO_GET_REVISION_TARGET(r1, 0x0, 0x43, &(0x7f0000000080)={'ipvs\x00'}, &(0x7f00000000c0)=0x1e) (async) ioctl$sock_inet_SIOCSIFADDR(r0, 0x8916, &(0x7f0000000040)={'wg1\x00', {0x2, 0x4e22, @broadcast}}) (async) ioctl$KVM_CREATE_VCPU(0xffffffffffffffff, 0xae41, 0x1) (async) ioctl$KVM_GET_VCPU_EVENTS(r2, 0x8040ae9f, &(0x7f0000000000)) (async) 3m30.742514496s ago: executing program 3 (id=1030): seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x5, &(0x7f0000000040)=[{0x6, 0x0, 0x0, 0x7fff0000}, {0x7, 0xd9, 0xc2, 0x8}, {0x4, 0x5, 0x6, 0x5}, {0x0, 0x5, 0x1, 0x2}, {0x4, 0xd8, 0x0, 0x9}]}) r0 = open(&(0x7f0000000080)='./file0/../file0/../file0/../file0\x00', 0x10000, 0x40) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$NFT_BATCH(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000440)=ANY=[@ANYBLOB="140000001000010000000000000000000000000a20b3a000000a05000000000000000000010000d68200000073797a300000000040000000030a01010000000000000000010000000900030073797a310000000014000480080002400000000008000140000000000900010073dac6ca259e57fa4c000000060a010480200001800700010072740000140002800800024000000002080001400000000308000b40000000000900010073797a3000000000140000001100010000000000000000000000000a"], 0xd4}}, 0x0) mkdirat(0xffffffffffffff9c, &(0x7f0000000100)='./file0\x00', 0x0) r2 = open_tree(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x89901) move_mount(r2, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000180)='./file0\x00', 0x0) r3 = open_tree(0xffffffffffffff9c, &(0x7f0000000640)='\x00', 0x89901) move_mount(r3, &(0x7f0000000140)='.\x00', 0xffffffffffffff9c, &(0x7f0000000300)='./file0\x00', 0x41) r4 = socket$netlink(0x10, 0x3, 0x0) sendmsg$netlink(r4, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000002900)={0x110, 0x5f, 0x101, 0x0, 0x25dfdbff, "", [@nested={0x100, 0x50, 0x0, 0x1, [@nested={0x75, 0x87, 0x0, 0x1, [@generic="9909b9a3556a23ac132da78ad50ddbaa9297c73d4757c1a8d8f277b2329eebef8b0dca3c3a876e267a7343a855eb06e2d9d4588b14839b21a9172f9906bbbc78a6b3d01b1fc87230a0cd617814b9949b235ab272f4f54b9cb3df0d9dd526002f5cd158f87c65ed129fc6f70729a527015c"]}, @generic="47e3b9708db25322e01bdc6b7f694fe1beb0ebfeaeb8aba7698c5de50637fbdb7cd6ce33317694ca210f9e118ce2cc7bc8ab42b979233442dcb2ebfa85274d92617080ae72d77583845f590c3c72084a6d930695c3fbd26fdd89ae827d55240034e97f185635d504e7ec283dd9bda165aaac4aaacc4e2f456e458f8ea3dd746bdb1b0e0e"]}]}, 0x110}], 0x1}, 0x0) r5 = syz_open_dev$dri(&(0x7f00000000c0), 0x1ff, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r5, 0xc04064a0, &(0x7f00000003c0)={0x0, &(0x7f0000000300)=[0x0], &(0x7f0000000340)=[0x0], 0x0, 0x0, 0x1, 0x1}) ioctl$DRM_IOCTL_MODE_CREATE_LEASE(r3, 0xc01864c6, &(0x7f00000001c0)={&(0x7f0000000640)=[r6, r6], 0x2, 0x80800}) close(0x3) umount2(&(0x7f0000000200)='./file0/../file0/../file0/../file0\x00', 0x1) getdents(r0, &(0x7f0000001fc0)=""/184, 0xb8) 3m30.535295834s ago: executing program 3 (id=1031): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r1, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r2 = socket$netlink(0x10, 0x3, 0x0) r3 = socket$nl_route(0x10, 0x3, 0x0) r4 = socket$nl_route(0x10, 0x3, 0x0) r5 = socket$netlink(0x10, 0x3, 0x0) r6 = socket(0x10, 0x3, 0x0) sendmsg$nl_route_sched(r6, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={0x0, 0x14}}, 0x0) getsockname$packet(r6, &(0x7f00000002c0)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000100)=0x14) sendmsg$nl_route(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f00000008c0)=ANY=[@ANYBLOB="480000001000050700000086d7c0d6c878f064eb", @ANYRES32=r7, @ANYBLOB="0000000000000000280012000c00010076657468"], 0x48}}, 0x0) sendmsg$nl_route_sched(r5, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000004c0)={&(0x7f0000000900)=@newqdisc={0x30, 0x24, 0xf1d, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {}, {0xfff1, 0xffff}}, [@qdisc_kind_options=@q_ingress={0xc}]}, 0x30}}, 0x0) sendmsg$nl_route_sched(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000240)={&(0x7f0000000940)=@delchain={0x64, 0x64, 0xf31, 0x0, 0x0, {0x0, 0x0, 0x0, r7, {0x9}, {0x10, 0xffff}}, [@filter_kind_options=@f_flower={{0xb}, {0x34, 0x2, [@TCA_FLOWER_KEY_ENC_IPV6_DST_MASK={0x14, 0x22, [0xffff00, 0xffffffff, 0xffffff00, 0xff]}, @TCA_FLOWER_KEY_ENC_IPV6_DST={0x14, 0x21, @empty}, @TCA_FLOWER_KEY_ENC_KEY_ID={0x8, 0x1a, 0x3596}]}}]}, 0x64}}, 0x4040004) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r3, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000280)=@newqdisc={0x48, 0x24, 0x4ee4e6a52ff56541, 0x70bd26, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_htb={{0x8}, {0x1c, 0x2, [@TCA_HTB_INIT={0x18, 0x2, {0x3, 0x8, 0x4}}]}}]}, 0x48}}, 0x20040084) sendmsg$nl_route_sched(r2, &(0x7f0000000000)={0x0, 0x49, &(0x7f0000000540)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r9, {0xffff}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x3, 0x7, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x3, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) r10 = socket$netlink(0x10, 0x3, 0x0) r11 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r11, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r10, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000200)={&(0x7f00000008c0)=@newqdisc={0x8c, 0x28, 0x4ee4e6a52ff56541, 0x4001, 0xfffffdfc, {0x0, 0x0, 0x0, r12, {}, {0xffff, 0xffff}, {0x2, 0x1}}, [@qdisc_kind_options=@q_taprio={{0xb}, {0x5c, 0x2, [@TCA_TAPRIO_ATTR_PRIOMAP={0x56, 0x1, {0x4, [0xc, 0x5, 0x0, 0xf, 0x10, 0x2, 0x4, 0x2, 0xf, 0x6, 0x6, 0x5, 0x8, 0x4, 0x10, 0x4], 0x3, [0xb, 0x101, 0xad1e, 0x2002, 0x1, 0x4, 0x2, 0xd06, 0xff05, 0x2, 0xb, 0x3, 0x5, 0x6, 0xd, 0x100], [0xfff1, 0x5, 0xffff, 0xfff5, 0x4, 0x8, 0x1, 0x9, 0x5, 0x2, 0xc, 0x40, 0xfffc, 0x3, 0x1]}}]}}]}, 0x8c}, 0x1, 0x0, 0x0, 0x400dc}, 0x0) sendmsg$nl_route_sched(r1, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x7c, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r9, {0x0, 0x5}, {0xffff, 0x2}, {0x10, 0xfff3}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x4c, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xffffffed, 0x6}, [@TCA_NETEM_LATENCY64={0xc}, @TCA_NETEM_REORDER={0xc, 0x3, {0x4874, 0xff}}, @TCA_NETEM_REORDER={0xc, 0x3, {0xf21, 0x1000fff}}, @TCA_NETEM_REORDER={0xc, 0x3, {0xd6f3, 0x6f}}]}}}]}, 0x7c}, 0x1, 0x0, 0x0, 0x20000001}, 0x0) 3m27.918805688s ago: executing program 3 (id=1037): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x20, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}}, 0x0) 3m26.825383942s ago: executing program 34 (id=1037): r0 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r0, &(0x7f0000000040)={0x0, 0x0, &(0x7f00000044c0)={&(0x7f0000000080)={0x5c, 0x2, 0x6, 0x5, 0x0, 0x20, {}, [@IPSET_ATTR_DATA={0xc, 0x7, 0x0, 0x1, [@IPSET_ATTR_TIMEOUT={0x8}]}, @IPSET_ATTR_PROTOCOL={0x5, 0x1, 0x6}, @IPSET_ATTR_FAMILY={0x5, 0x5, 0x2}, @IPSET_ATTR_REVISION={0x5}, @IPSET_ATTR_SETNAME={0x9, 0x2, 'syz1\x00'}, @IPSET_ATTR_TYPENAME={0x15, 0x3, 'hash:ip,port,net\x00'}]}, 0x5c}}, 0x0) 2m49.533484743s ago: executing program 6 (id=1133): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000001400), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000000c0)={0x0, 0x18, 0xfa00, {0x3, &(0x7f0000000080)={0xffffffffffffffff}, 0x111}}, 0x20) write$RDMA_USER_CM_CMD_RESOLVE_IP(r0, &(0x7f0000000100)={0x3, 0x40, 0xfa00, {{0xa, 0x0, 0x2, @empty, 0xa098}, {0xa, 0x2, 0xfffffffe, @dev={0xfe, 0x80, '\x00', 0x1c}}, r1, 0x40099d}}, 0x48) writev(r0, &(0x7f0000000040)=[{&(0x7f0000000100), 0x86}], 0x2) r2 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x0, 0x7fff0000}]}) close_range(r2, 0xffffffffffffffff, 0x40000000) 2m49.199957011s ago: executing program 6 (id=1135): syz_usb_connect$cdc_ecm(0x0, 0x4d, &(0x7f0000000600)={{0x12, 0x1, 0x300, 0x2, 0x0, 0x0, 0x8, 0x525, 0xa4a1, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x3b, 0x1, 0x1, 0x2, 0x0, 0x0, [{{0x9, 0x4, 0x0, 0x7, 0x2, 0x2, 0x6, 0x0, 0x8, {{0x5}, {0x5, 0x24, 0x0, 0x282}, {0xd, 0x24, 0xf, 0x1, 0x8000, 0x9, 0x7fff, 0x2}}, {[], {{0x9, 0x5, 0x82, 0x2, 0x40, 0x4, 0xc, 0x81}}, {{0x9, 0x5, 0x3, 0x2, 0x10, 0x1, 0x0, 0x7}}}}}]}}]}}, &(0x7f00000008c0)={0x0, 0x0, 0x0, 0x0, 0x2, [{0x4, &(0x7f0000000740)=@lang_id={0x4, 0x3, 0x5f}}, {0x6, &(0x7f0000000780)=@string={0x6, 0x3, "d9d82edc"}}]}) r0 = openat$audio1(0xffffff9c, &(0x7f0000000000), 0x2000, 0x0) munmap(&(0x7f0000001000/0x3000)=nil, 0x3000) r1 = openat$udambuf(0xffffffffffffff9c, &(0x7f0000000040), 0x2) r2 = memfd_create(&(0x7f0000000140)='y\x105\xfb\xf7u\x83%:r\xc2\xb9x\xa4q\xc1\xea_\x8cZ7\xe7a\x9b\x11x\x0e\xa1\xcf\x1a\x98S7\xc9\x00\x00\x00\x00\x00\x00\a\x00\x00\x00\x00\x00\x00\x04\x879\xa2\xff\xff\xff\xff\xde\xb2\xd3\xcbZJoa\xc4\x1acB\xaa\xc1\xfb Q\xd4\xf4\x01\xa52\xe2DG\xd4\xbd{\x9f\xa9\x97\x9b@\xdbU\xb1\xe1br\xb6\x008\xe3\x10\xff\xc2\x9d\r2\x9e\x8e\x04sF\x1b\xb7\xb3\xa2\xc9<\x80E\x1a\xbc\xc7W\xda9VsA\xaf\xc6\xcf\xe1\xa1\xb5M\xa2\x85\xa6y\xc4J\xf1\xf7\xfcD\x95\xe3\xeb\xc7\xbc\x91\x10\xf5\xe5\xbas\xf6\xee\xaa\xa8\x9eo\xebF(\x9dL!vRk\xaacB\x04\xa7I\v\x9bEZ\x96\xd5\x14O\xf8\xb5C\x1f\xb6b8b\x06A2@D\\\xe8R\xe4\xcd\xec\xfa\xd1\x0fre\xe86\xcd\xeb\xc4$\x98\x06J\xd6dD\x8d_U`ji{\xab\x97\xaf;l\x1f\xaf\xb38U\xcb\xfa\xb3j\x92\f\x81\xa0\xa2-g\b\x99\x0e\x8d\x8d\x16+<\xd9w\\\xf8\xce\xb0j\x9d\'\x93\xef\x1d\xa0H\xd9\xbd\xd9\xaf\x12$\x8d\x16%\x8b\x00\x88\xd1\x1eQB\x18\xc1-\xc4\x8fK\xf8\xfa\xb6\xf8\v;\xaa\x8fW\xcc\n\x17\x7f\x98\xb7\xcdqV\xd4\xf0)\xfa\x0fG\xc8\xbf\xfd\xe8>K\f\xcd+\xb0\x99Q\xba/\xa8\xb9`k\b\xd1\xcc\xfc\xeaA\"\v=\x9afC\x90%\xa1d\x91\xf8:\x16<\xad\xc2\x18\xdf\x01\xe2\x96\xfcj\xe9\xa4\x065m\x03}\x9c\xee\xb3>0\xed~\xd0\xbe\xf5\x05\xda\xab\xb9f;\x1a\xb4\xb7Lu\x9fb0^\f\xb25\xed^s\x9c\xd3\x8b\x97\xc8\xbc&\xfb\x8a\x1f3I\xe0\xa6|I\xffi\x9c\x18\xe6t\xd6e\x1d\x05L_\x817\x85\x95\x13\xc8_\x7f;\x06=\x0e$D\v\xf9a\xe7[\x8c\xa1W\xa2R\x18\x92\xbc\tl\"\xeb\xad\xd8&\x10\xc4\x03\xd8\x7fmY\xb5>8\x98ekr\x1e\x0eU\xcf\x83\x10\x13\x0f\xa0\x9cE-s\x8b', 0x6) mmap(&(0x7f0000000000/0xfff000)=nil, 0xfff002, 0x0, 0x32, 0xffffffffffffffff, 0x0) fcntl$addseals(r2, 0x409, 0x7) ioctl$UDMABUF_CREATE(r1, 0x40187542, &(0x7f0000000100)={r2, 0x0, 0x0, 0x1000}) add_key$user(&(0x7f00000003c0), &(0x7f0000000440), &(0x7f00000000c0), 0x3751, 0xfffffffffffffffd) ioctl$SNDCTL_DSP_GETFMTS(r0, 0x8004500b, &(0x7f0000000040)=0x4) 2m46.389970498s ago: executing program 6 (id=1147): syz_open_dev$sndmidi(&(0x7f00000004c0), 0x2, 0x2) r0 = syz_io_uring_setup(0x1e1e, &(0x7f0000000200)={0x0, 0x86f7, 0x10100, 0x10000, 0x2000000}, &(0x7f0000002000)=0x0, &(0x7f0000000000)=0x0) syz_io_uring_submit(r1, r2, &(0x7f00000001c0)=@IORING_OP_READ=@pass_buffer={0x16, 0x0, 0x0, @fd_index=0x3, 0xffffffffffffffff, 0x0, 0x0, 0x22}) io_uring_enter(r0, 0x48e9, 0x0, 0x2, 0x0, 0x0) r3 = syz_usb_connect(0x0, 0x2d, &(0x7f0000000100)=ANY=[@ANYBLOB="12010000d5e9bd40eb030200c0ba050000010902115c01000000000904000001b504b100090581"], 0x0) syz_usb_control_io$hid(r3, 0x0, &(0x7f0000000580)={0x2c, &(0x7f0000000080)=ANY=[], 0x0, 0x0, 0x0, 0x0}) syz_usb_control_io$cdc_ncm(r3, 0x0, &(0x7f0000000ac0)={0x24, &(0x7f0000000880)={0x0, 0x20, 0x4, "bb92b7f2"}, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}) socket(0x2, 0x804, 0x8) 2m43.668510548s ago: executing program 6 (id=1156): openat$uinput(0xffffffffffffff9c, &(0x7f0000000000), 0x802, 0x0) (async) openat$binderfs(0xffffffffffffff9c, &(0x7f00000000c0)='./binderfs/binder1\x00', 0x1802, 0x0) openat$fuse(0xffffffffffffff9c, &(0x7f0000000040), 0x42, 0x0) (async) syz_usb_connect(0x0, 0x6b, &(0x7f00000002c0)=ANY=[@ANYBLOB="1201000385352608f20446b76e8e01020301090259000104e90009090493ff030e0100ff0a2401020005028a010209240603040001a53011240606040508000400050006000100050924030506030501f90924070a020005cbad09240306"], &(0x7f0000000000)={0x0, 0x0, 0x0, 0x0}) (async) openat$fuse(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) getsockopt$inet_sctp6_SCTP_SOCKOPT_CONNECTX3(r0, 0x84, 0x6f, &(0x7f0000000280)={0x0, 0x1c, &(0x7f0000000100)=[@in6={0xa, 0x4e23, 0x4, @dev={0xfe, 0x80, '\x00', 0x38}, 0x9}]}, &(0x7f0000000040)=0x10) (async) r1 = socket$nl_netfilter(0x10, 0x3, 0xc) (async) r2 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r2, &(0x7f00000002c0)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000140)=ANY=[@ANYBLOB="44000000100001040400"/20, @ANYRES32=0x0, @ANYBLOB="030500000200000000240012800b000100677265746170000014000280060010004e23000006000f000a0000"], 0x44}, 0x1, 0x0, 0x0, 0x24044800}, 0x4040040) (async) r3 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$nl80211(&(0x7f0000000080), r3) (async) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000300)={0x0, 0x0, &(0x7f00000002c0)={&(0x7f00000009c0)=ANY=[@ANYBLOB="2400000001040102000000c9fd0000000000000008000340000100000500010001"], 0x24}}, 0x0) (async) sendmsg$NFULNL_MSG_CONFIG(r1, &(0x7f0000000400)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000040)=ANY=[@ANYBLOB="1c000000010401010000000000000000000404000500010001000000"], 0x1c}}, 0x0) (async) close_range(r1, r1, 0x0) 2m43.422601768s ago: executing program 6 (id=1157): creat(&(0x7f00000001c0)='./file0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x22000, 0x0) io_uring_setup(0x2ed3, &(0x7f0000000380)={0x0, 0x5f41, 0x4, 0x1, 0x279}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f00000001c0)) r3 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r3, &(0x7f0000000b00)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000240)="a905000000007464000100000000000000e5c0", 0x13}, {&(0x7f0000000300)="82d903bfcb8484b98931c6c599ed9cf57c", 0x11}], 0x2}}, {{&(0x7f0000000340)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10, 0x0, 0x0, &(0x7f0000000a00)=ANY=[@ANYRES8=r3], 0xc4}}], 0x2, 0x2404c0e4) r4 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r4, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x140, 0x800, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x4}, {0xffffffff}, {0x0, 0x4}, {0x0, 0x4, 0x8}, 0x0, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x1, 0x12, 0x100, 0x2, 0xc}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0xfffffffffffffef9) socket$nl_netfilter(0x10, 0x3, 0xc) r5 = socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(r5, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[], 0x60}}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r6 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a40)="64534fab878cf649bcdd26417e0bceb60a954c47b0454861899211c81dfd04003e02c2df8b27473432adf341dfe8af70a5712bf65907cdee1d22bc5505fe362b3ecb465bdee94e7d4f1c0000000000000000000000000000000000070000000000", 0x61}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb71658bda99b49720fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) recvmsg$kcm(r6, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/55, 0x37}, 0x202) sendmsg$NL80211_CMD_SET_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x22008000) sendmsg$NL80211_CMD_START_AP(r3, &(0x7f00000009c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000440)={0x4ac, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffe, 0x30}}}}, [@NL80211_ATTR_HIDDEN_SSID={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8b}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x155}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}], @beacon=[@NL80211_ATTR_IE_PROBE_RESP={0x57, 0x7f, [@link_id={0x65, 0x12, {@initial, @device_a, @device_b}}, @mic={0x8c, 0x10, {0x622, "00400300dd00", @short="da3cc88d1f5a39e9"}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x5, 0x2, @device_b, 0x4e09, @value=@device_b, 0x4, 0xf1, @broadcast, 0x8}}, @ibss={0x6, 0x2, 0x7}, @supported_rates]}, @NL80211_ATTR_BEACON_HEAD={0x1a2, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}, {0x9}, @broadcast, @broadcast, @initial, {0x4, 0x7}}, 0x8, @random=0xa698, 0xb808, @val={0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x6, [{0x6c}, {0x12, 0x1}, {0x5}, {0x12, 0x1}, {0xb}, {0x60}]}, @val={0x3, 0x1, 0x34}, @void, @void, @val={0x5, 0x54, {0x1, 0xf0, 0x6, "9ce215ee877c43297e1d97e92d8b8a088d3b4f35a290fe2724adebc6ee79bab0630923efb225c33d3b91f7ad2c6fea06ff687be6269ea1c2c88a8270384f542753577e5defd23e84f2488d06424417fd9f"}}, @val={0x25, 0x0, {0x1, 0x8, 0x70}}, @val={0x2a, 0x1, {0x1, 0x1}}, @void, @val={0x2d, 0x1a, {0x2000, 0x0, 0x6, 0x0, {0xfffffeffffffffff, 0x5, 0x0, 0x6, 0x0, 0x0, 0x1, 0x1}, 0x6, 0x48f, 0x8}}, @val={0x72, 0x6}, @void, @val={0x76, 0x0, {0x80, 0x9, 0x3e, 0x81}}}}, @NL80211_ATTR_BEACON_TAIL={0x0, 0xf, [@dsss={0x3, 0x0, 0xa5}, @sec_chan_ofs, @rann={0x7e, 0x0, {{}, 0xf5, 0x2, @device_b, 0x99c, 0xfffffff8, 0x4}}, @tim={0x5, 0x0, {0x6, 0x78, 0x8, "d054"}}, @peer_mgmt={0x75, 0x0, {0x1, 0x6, @void, @void, @val="97b679d74ed89c6e16ba4eb2fc93a42d"}}, @tim={0x5, 0x0, {0xd, 0xd8, 0x3, "14669f987118228cb61269a705b90fb6d144d8b814e93b608ae6d0b3ffb847ffb802040737de2cccf82f3335c28dad4c64353387882d31b59dc8ad845a6680ecf8f2d5dae1f22a2d0be7df4dc115a044dc3b433d4d908d44792fe72d4e124c2c528dcee3198a03a2411e8e9d3a11fb5fc61bd17ad3a51479f5a306948cef5f5321d813e1e57b376c2172"}}, @mesh_chsw={0x76, 0x0, {0x3, 0x9, 0x6, 0x6}}, @dsss={0x3, 0x0, 0xb6}]}], @NL80211_ATTR_PBSS={0x4}]}, 0x4ac}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) 2m42.432788484s ago: executing program 6 (id=1164): r0 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0, 0x0, 0x1}, {0x0, 0x0, 0xffff}, {0x0}, {0x0, 0xfffffffffffffe4c, 0x8}]}, 0x4, 0x4000}, 0x1) r3 = socket(0x10, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_SEND={0x1a, 0x20, 0x0, r3, 0x0, 0x0, 0xfffffd49, 0x20044080, 0x1}) io_uring_enter(r0, 0x27e2, 0x0, 0x0, 0x0, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = add_key$fscrypt_v1(&(0x7f00000002c0), &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "69dcaf20127e9a854529f45826cb35be51682e30944313e2080000000000000080221daeccfda5eb75cfe2bad94f000066b2ddab614fec2236da7d88ea07c9ee", 0x8}, 0x48, 0xfffffffffffffffe) keyctl$search(0xa, r5, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0) setsockopt$inet_tcp_int(r4, 0x29, 0x3, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000900)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48284b70043dc6124d877142a48448b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d4023f210fa34b63a715a74e802a0dc6bf25d8a242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767192361446479b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f01000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb796ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccf1f9f2b82830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab04000000ffe760e717a04becff0f719197724f4fce1093b62d7e8c7123d890decace0200f404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37fea3b7d32470879b16a4b06445c9a1dd26290a402adab06d2c0f06fa770da0db3620ee12177432a5bfd8577ba623bb053a50a3d"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14}, 0x94) r6 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) fcntl$lock(r6, 0x24, &(0x7f0000000500)={0x1, 0x0, 0x8000010}) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000002f40), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="7a634189dc97b958da50a8aaa5f1fe083ee1715d34a803b6438231d659c414ab110a8ed18713d909d3037ff1c9f82cd0a180d8d6fbbc436b605ced1dfe1e823707189491a8cb435ed8f36b25457d0a7bc551a508a75a89def19198c3a4966bd87eae3f04e55f82b9021ebfcf39b82b79916992829a78c163cbd52bee274080932648630ca44213f9c37dfaab26f5f0909f7d75ed33b6b932578a994f968e4faed9f6e26c8814b84163f1d7b5aebf8b2174d80e08fc", @ANYRES16=r7, @ANYBLOB="53892abd7000fcdbdf2503000000080006007f00000108000800ac141419"], 0x24}, 0x1, 0x0, 0x0, 0x44050}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r9, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r10 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r10, 0x707, &(0x7f0000000200)={&(0x7f0000000280)=[{0xd2f3, 0xe3b61685ee249bb1, 0x0, 0x0}, {0xfd, 0x3000, 0x0, 0x0}], 0x2}) r11 = syz_open_dev$vim2m(&(0x7f0000000700), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r11, 0xc0405602, &(0x7f0000000000)={0x2b, 0x1, 0x2, "f0d204866053730830e76d09d6c183ec8853d4759db58e9dbcce89fd1aab1ad4", 0x80056632}) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r13, 0x84, 0x2, &(0x7f00000000c0)={0x7, 0x4, 0xd99c, 0xfffd}, 0x8) sendto$inet6(r13, &(0x7f0000000580)="81", 0x1, 0x4040040, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r13, 0x84, 0x1b, 0x0, &(0x7f00000001c0)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r12) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) 2m26.953396423s ago: executing program 35 (id=1164): r0 = syz_io_uring_setup(0x82e, &(0x7f0000000300)={0x0, 0x0, 0x10100}, &(0x7f0000000100)=0x0, &(0x7f0000000080)=0x0) io_uring_register$IORING_REGISTER_PBUF_RING(r0, 0x16, &(0x7f0000000380)={&(0x7f0000001000)={[{0x0, 0x0, 0x1}, {0x0, 0x0, 0xffff}, {0x0}, {0x0, 0xfffffffffffffe4c, 0x8}]}, 0x4, 0x4000}, 0x1) r3 = socket(0x10, 0x3, 0x0) syz_io_uring_submit(r1, r2, &(0x7f00000003c0)=@IORING_OP_SEND={0x1a, 0x20, 0x0, r3, 0x0, 0x0, 0xfffffd49, 0x20044080, 0x1}) io_uring_enter(r0, 0x27e2, 0x0, 0x0, 0x0, 0x0) r4 = socket$inet_mptcp(0x2, 0x1, 0x106) r5 = add_key$fscrypt_v1(&(0x7f00000002c0), &(0x7f0000000040)={'fscrypt:', @desc1}, &(0x7f0000000080)={0x0, "69dcaf20127e9a854529f45826cb35be51682e30944313e2080000000000000080221daeccfda5eb75cfe2bad94f000066b2ddab614fec2236da7d88ea07c9ee", 0x8}, 0x48, 0xfffffffffffffffe) keyctl$search(0xa, r5, &(0x7f0000000180)='asymmetric\x00', &(0x7f0000000100)={'syz', 0x0}, 0x0) setsockopt$inet_tcp_int(r4, 0x29, 0x3, 0x0, 0x0) bpf$PROG_LOAD(0x5, &(0x7f0000000080)={0x11, 0x8, &(0x7f0000000900)=ANY=[@ANYBLOB="620af8ffa1dc0021bfa100000000000007010000f8ffffffb702000007000000bd120000000000008500000010000000b70000000000000095000000000000003faf4f2aa3d9b18ed812a2e2c49e8020a6f4e0e4a9446c7670568982b4e020f698393aa0f3881f9c24561f1b2607995daa56f151905ea23c22624c9f87f9793f50bb546040677b0c5077da80fb982c1e9400e693146cea484a415b76966118b64b751a0f241b072e90080008002d75593a286cecc93e64c227c95aa0b784625704f07372c29184ff7f4a7c0000070000006056feb4cc664c0af9360a1f7a5e6b607130c89f18c0c1089d8b8588d72ec29c48284b70043dc6124d877142a48448b45e0000000000000401d01aa27ae8b09e00e79ab20b0b8ed8fb7a68af2ad0810000000000006fa03c6468978089b302d7ff6023cdcedb5e0125ebbcebdde510cb2364149215108337719acd97cfa107d4023f210fa34b63a715a74e802a0dc6bf25d8a242bc6099ad2300000480006ef6c1ff0900000000000010c63a949e8b7955394ffaff03000000000000ab87b1bfeda7be586602d985430cea080000000000000026abfb0767192361446479b05d96a703a660581eecdbf5bcd3de227a167ca17a0faf60fd6ad9b97aa5fa68480366c9c6fd6fa5043aa3926b81e3b59c9b081d6a08000000ea2b1a52496dfcaf99431412fd134a996382a1a04d5bb924cfe5f3185418d605ffff9c4d2ec7c32f2095e63c80aff9fa740b6c7632d5933a1c1fa5605bd7603f2ba2a790d62d6faec2fed44da4928b30142ba1fde5c5d50b83bae616b5054d1e7c13b1355d6f4a8245ffa4997da9c77af4c0cb97fca585ec6bf58351d578be00d952aab9c71764b0a8a7583c90b3433b809bdb9fbd48fc877505ebf6c9d13330ca006bce1a84521f14518c9b476fccbd6c712016219848624b87cec2dbe98223d8d9e86c5ea06d108d8f80a0eb4fa39f6b5c02e6d6d90756ff578f01000000009700cf0b4b8bc229413300000000000000000003000000000000000000000000001000000000559711e6e8fcffffffffffffffb2d02edc3e01dd271c896249ed85b980680b09000000000f0000169cdcacc413b48dafb796ffffffd897ef3b7cda42f93d53046da21b40216e14ba2d6af8656b01e17addaedab25b30002abbba7fa725f38400be7c1f001b2cd317902f19e385be9e48dccf1f9f2b82830689da6b53b263339863297771d74732d400003341bf4a00fc9fec2271ff01589646efd1cf870cd7bb2366fde4a594290c405ff870ce5dfd3467decb05cfd9fcb32c8ed1dbd9d30a64c108285e71b5565b1768ee58969c41595229df17bcad70fb4021428ce970275d13b78249788f11f761038b75d4fe32b561d46ea3abe0fa4d30dc94ef241875f3b4b6ab04000000ffe760e717a04becff0f719197724f4fce1093b62d7e8c7123d890decace0200f404e4e1f74b7eed82571be54c72d978cf906df0042e36acd37d7f9e109f2c06f815312e0cfe222a06f56dd022c074eb8a322fb0bf47c0a8d154b405c37fea3b7d32470879b16a4b06445c9a1dd26290a402adab06d2c0f06fa770da0db3620ee12177432a5bfd8577ba623bb053a50a3d"], 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x14}, 0x94) r6 = syz_open_dev$ndb(&(0x7f0000000040), 0x0, 0x0) fcntl$lock(r6, 0x24, &(0x7f0000000500)={0x1, 0x0, 0x8000010}) r7 = syz_genetlink_get_family_id$fou(&(0x7f0000002f40), 0xffffffffffffffff) sendmsg$FOU_CMD_GET(0xffffffffffffffff, &(0x7f0000000200)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000400)=ANY=[@ANYBLOB="7a634189dc97b958da50a8aaa5f1fe083ee1715d34a803b6438231d659c414ab110a8ed18713d909d3037ff1c9f82cd0a180d8d6fbbc436b605ced1dfe1e823707189491a8cb435ed8f36b25457d0a7bc551a508a75a89def19198c3a4966bd87eae3f04e55f82b9021ebfcf39b82b79916992829a78c163cbd52bee274080932648630ca44213f9c37dfaab26f5f0909f7d75ed33b6b932578a994f968e4faed9f6e26c8814b84163f1d7b5aebf8b2174d80e08fc", @ANYRES16=r7, @ANYBLOB="53892abd7000fcdbdf2503000000080006007f00000108000800ac141419"], 0x24}, 0x1, 0x0, 0x0, 0x44050}, 0x0) r8 = socket$nl_generic(0x10, 0x3, 0x10) r9 = syz_usb_connect(0x0, 0x24, &(0x7f00000001c0)=ANY=[@ANYBLOB="120100009dea7840b418fbff7bdc01020301090212000100000000090401"], 0x0) syz_usb_control_io$cdc_ecm(r9, 0x0, &(0x7f00000008c0)={0x1c, &(0x7f0000000100)=ANY=[@ANYBLOB="00000100000001"], 0x0, 0x0}) r10 = syz_open_dev$I2C(&(0x7f0000000000), 0x1, 0x402) ioctl$I2C_RDWR(r10, 0x707, &(0x7f0000000200)={&(0x7f0000000280)=[{0xd2f3, 0xe3b61685ee249bb1, 0x0, 0x0}, {0xfd, 0x3000, 0x0, 0x0}], 0x2}) r11 = syz_open_dev$vim2m(&(0x7f0000000700), 0x7, 0x2) ioctl$vim2m_VIDIOC_ENUM_FMT(r11, 0xc0405602, &(0x7f0000000000)={0x2b, 0x1, 0x2, "f0d204866053730830e76d09d6c183ec8853d4759db58e9dbcce89fd1aab1ad4", 0x80056632}) ioctl$sock_SIOCGIFINDEX_80211(r8, 0x8933, &(0x7f00000000c0)={'wlan1\x00'}) r12 = socket$nl_generic(0x10, 0x3, 0x10) r13 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r13, 0x84, 0x2, &(0x7f00000000c0)={0x7, 0x4, 0xd99c, 0xfffd}, 0x8) sendto$inet6(r13, &(0x7f0000000580)="81", 0x1, 0x4040040, &(0x7f0000000280)={0xa, 0x0, 0x0, @loopback, 0x81}, 0x1c) getsockopt$inet_sctp6_SCTP_LOCAL_AUTH_CHUNKS(r13, 0x84, 0x1b, 0x0, &(0x7f00000001c0)) syz_genetlink_get_family_id$nl80211(&(0x7f0000000100), r12) socket$nl_route(0x10, 0x3, 0x0) syz_open_dev$usbfs(&(0x7f0000000240), 0x75, 0x109301) 12.903079041s ago: executing program 1 (id=1723): r0 = socket$inet6(0xa, 0x3, 0x8000000003c) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@file={0x1, './file0\x00'}, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sendmsg(r0, 0x0, 0x4) syz_open_dev$vbi(0x0, 0x1, 0x2) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000480)={0xffffffffffffffff, 0x0, 0x25, 0x2, @val=@uprobe_multi={0x0, 0x0, 0x0, 0x6, 0x0, 0x1}}, 0x40) r3 = openat$vhost_vsock(0xffffffffffffff9c, &(0x7f00000015c0), 0x2, 0x0) ioctl$VHOST_SET_VRING_BASE(r3, 0xaf01, 0x0) r4 = eventfd(0xffffffff) bpf$PROG_LOAD(0x5, &(0x7f0000000b00)={0x11, 0xf, &(0x7f0000000340)=ANY=[@ANYBLOB="1800000000000000000000080000000018110000", @ANYRES32, @ANYBLOB="0000000000000000b702000014000000b7030000000000008500000083000000bf0900000000000055090100000000009500"], 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback, 0xffffffffffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) ioctl$VHOST_SET_LOG_FD(r3, 0x4004af07, &(0x7f0000000240)=r4) ioctl$VHOST_SET_VRING_KICK(r3, 0x4008af20, &(0x7f0000000040)={0x1, r4}) ioctl$VHOST_SET_LOG_BASE(r3, 0x4008af04, &(0x7f00000002c0)=&(0x7f0000000180)) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000580)={0x0, 0x0, 0x0, &(0x7f0000000500)=""/67, 0x0}) ioctl$VHOST_SET_VRING_ADDR(r3, 0x4028af11, &(0x7f0000000280)={0x1, 0x1, &(0x7f0000000380)=""/247, &(0x7f00000000c0)=""/87, &(0x7f0000000480)=""/74}) ioctl$VHOST_SET_MEM_TABLE(r3, 0x4008af03, &(0x7f0000000680)={0x1, 0x0, [{0x0, 0xfffffeac, &(0x7f00000001c0)=""/115}]}) ioctl$VHOST_VSOCK_SET_RUNNING(r3, 0x4004af61, &(0x7f0000000000)=0x1) io_uring_enter(0xffffffffffffffff, 0x47ba, 0x3e80, 0x0, 0x0, 0x0) munmap(&(0x7f0000ffd000/0x1000)=nil, 0x1000) socket$inet6(0x10, 0x3, 0x0) sendmsg$nl_route(0xffffffffffffffff, &(0x7f0000000140)={0x0, 0x0, &(0x7f0000000100)={&(0x7f0000000000)=ANY=[@ANYBLOB="2c000000190001000000000000000000021800000000fd000000ed0008000100ac1414000800080004"], 0x2c}}, 0x0) r5 = socket$rds(0x15, 0x5, 0x0) setsockopt$SO_RDS_MSG_RXPATH_LATENCY(r5, 0x114, 0xa, &(0x7f0000000300)=ANY=[@ANYBLOB="1a68bc55"], 0x4) sendto$inet6(0xffffffffffffffff, &(0x7f00000005c0)='s', 0xffffffffffffff73, 0x400080c, 0x0, 0x0) r6 = userfaultfd(0x801) ioctl$UFFDIO_API(r6, 0xc018aa3f, &(0x7f00000000c0)) ioctl$UFFDIO_COPY(r6, 0xc028aa05, &(0x7f0000000000)={&(0x7f0000779000/0x2000)=nil, &(0x7f0000ffd000/0x3000)=nil, 0x2000}) 11.198977896s ago: executing program 1 (id=1726): syz_open_dev$sg(&(0x7f00000002c0), 0x0, 0x40283) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000340)={0x38, 0x6, 0x8, 0x8001, 0x0, 0x9, 0x0, 0x5, 0xfa11, 0x8}, 0x0) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mkdirat$cgroup_root(0xffffffffffffff9c, &(0x7f0000000000)='./cgroup.cpu/syz0\x00', 0x1ff) r2 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_SET_MSRS(0xffffffffffffffff, 0xc008ae88, &(0x7f0000000300)=ANY=[@ANYBLOB="020000000000000082000040"]) r3 = openat$cgroup_ro(0xffffffffffffffff, 0x0, 0x0, 0x0) openat$cgroup_netprio_ifpriomap(r3, &(0x7f0000000040), 0x2, 0x0) sendfile(0xffffffffffffffff, r3, 0x0, 0x17) r4 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) bind$inet6(r4, &(0x7f00000000c0)={0xa, 0x4e24, 0x3, @private2, 0xbf}, 0x1c) sendmsg$IPCTNL_MSG_EXP_NEW(0xffffffffffffffff, &(0x7f0000000100)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000280)=ANY=[@ANYBLOB="b00000000002010400000000000000000700000608000940ffffffff08000440000000810800084000000003200001"], 0xb0}, 0x1, 0x0, 0x0, 0x8004}, 0x10) sendmsg$nl_generic(0xffffffffffffffff, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000280)=ANY=[@ANYBLOB="440000003e000701feffffff00000000017c0000040042800c00018006000600800a0000200002801c00068018"], 0x44}, 0x1, 0x0, 0x0, 0x40040c0}, 0xc000) r5 = openat$ptmx(0xffffffffffffff9c, &(0x7f0000000140), 0x0, 0x0) ioctl$TIOCSETD(r5, 0x5423, &(0x7f0000000080)=0x3) bpf$PROG_LOAD(0x5, &(0x7f0000000180)={0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @fallback=0x20}, 0x94) r6 = openat$ppp(0xffffffffffffff9c, &(0x7f0000000040), 0x1a01, 0x0) ioctl$EVIOCGPROP(r6, 0x40047438, &(0x7f0000000180)=""/246) ioctl$PPPIOCSMRU1(r6, 0x40047452, &(0x7f00000003c0)=0xa) mkdirat(0xffffffffffffff9c, &(0x7f0000000380)='./file0\x00', 0x955a7adaa9d5093d) lremovexattr(&(0x7f0000000180)='./file0\x00', &(0x7f00000001c0)=@known='system.posix_acl_default\x00') socket$nl_route(0x10, 0x3, 0x0) 8.593495547s ago: executing program 0 (id=1735): creat(&(0x7f00000001c0)='./file0\x00', 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet_icmp_raw(0x2, 0x3, 0x1) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r1, &(0x7f0000000400)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x0, 0x0, 0x0, 0xb45, 0x100000000009, 0xa, 0x0, 0x3}, 0x0) openat$vga_arbiter(0xffffffffffffff9c, 0x0, 0x22000, 0x0) r3 = io_uring_setup(0x2ed3, &(0x7f0000000380)={0x0, 0x5f41, 0x4, 0x1, 0x279}) setsockopt$inet6_tcp_int(0xffffffffffffffff, 0x6, 0x13, 0x0, 0x0) connect$inet6(0xffffffffffffffff, &(0x7f0000000080)={0xa, 0x0, 0x0, @ipv4={'\x00', '\xff\xff', @broadcast}}, 0x1c) ioctl$sock_TIOCINQ(r2, 0x541b, &(0x7f00000001c0)) r4 = socket(0x840000000002, 0x3, 0xff) sendmmsg$inet(r4, &(0x7f0000000b00)=[{{&(0x7f00000001c0)={0x2, 0x0, @remote}, 0x10, &(0x7f0000000000)=[{&(0x7f0000000240)="a905000000007464000100000000000000e5c0", 0x13}, {&(0x7f0000000300)="82d903bfcb8484b98931c6c599ed9cf57c", 0x11}], 0x2}}, {{&(0x7f0000000340)={0x2, 0x4e21, @rand_addr=0x64010102}, 0x10, 0x0, 0x0, &(0x7f0000000a00)=ANY=[@ANYRES8=r4], 0xc4}}], 0x2, 0x2404c0e4) r5 = openat$fb0(0xffffffffffffff9c, &(0x7f0000000040), 0x0, 0x0) ioctl$FBIOPUT_VSCREENINFO(r5, 0x4601, &(0x7f0000000100)={0x400, 0x300, 0x140, 0x800, 0x3ff, 0x0, 0x0, 0x0, {0x4, 0x4}, {0xffffffff}, {0x0, 0x4}, {0x0, 0x4, 0x8}, 0x0, 0x3f0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x1, 0x0, 0x0, 0x0, 0x1, 0x12, 0x100, 0x2, 0xc}) setsockopt$inet6_tcp_TCP_ULP(0xffffffffffffffff, 0x6, 0x1f, 0x0, 0xfffffffffffffef9) socket$nl_netfilter(0x10, 0x3, 0xc) sendmsg$IPSET_CMD_CREATE(0xffffffffffffffff, &(0x7f00000002c0)={0x0, 0x0, &(0x7f00000000c0)={&(0x7f0000000300)=ANY=[], 0x60}}, 0x0) setsockopt$inet6_tcp_TCP_REPAIR_WINDOW(0xffffffffffffffff, 0x6, 0x1d, 0x0, 0x0) r6 = socket$kcm(0x21, 0x2, 0x2) sendmsg$kcm(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000a40)="64534fab878cf649bcdd26417e0bceb60a954c47b0454861899211c81dfd04003e02c2df8b27473432adf341dfe8af70a5712bf65907cdee1d22bc5505fe362b3ecb465bdee94e7d4f1c0000000000000000000000000000000000070000000000", 0x61}], 0x1, &(0x7f0000001a00)=ANY=[@ANYBLOB="180000000000000010010000010000007d95df16a39b1a6c900000000000000001000005040500002b24ec10064b6f2f000000fb71658bda99b49720fdda5b00000009860f5878c37ffe36e1165814d435be5b317c6c8189767d2f97879f07a515bb7c169f46933d9338f4ab04834e6f618988c5944741afe403461323110f62055394412158e7a3adb164d641aa40d4ab077fe34232aa8b319d7666d0998a61d7da0c86d70000001010"], 0x10b8}, 0x0) recvmsg$kcm(r6, &(0x7f0000000240)={0x0, 0x0, 0x0, 0x0, &(0x7f0000000140)=""/55, 0x37}, 0x202) sendmsg$NL80211_CMD_SET_KEY(0xffffffffffffffff, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000000)={0x28, 0x0, 0x1, 0x70bd2b, 0x25dfdbfc, {{}, {@val={0x8}, @void}}, [@NL80211_ATTR_KEY_IDX={0x5, 0x8, 0x4}, @NL80211_ATTR_KEY_DEFAULT_MGMT={0x4}]}, 0x28}, 0x1, 0x0, 0x0, 0x1}, 0x22008000) sendmsg$NL80211_CMD_START_AP(r4, &(0x7f00000009c0)={&(0x7f0000000200)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000980)={&(0x7f0000000440)={0x4ac, 0x0, 0x100, 0x70bd2a, 0x25dfdbfc, {{}, {@val={0x8}, @val={0xc, 0x99, {0xfffffffe, 0x30}}}}, [@NL80211_ATTR_HIDDEN_SSID={0x8}, @chandef_params=[@NL80211_ATTR_WIPHY_CHANNEL_TYPE={0x8, 0x27, 0x1}, @NL80211_ATTR_CHANNEL_WIDTH={0x8, 0x9f, 0x4}, @NL80211_ATTR_CENTER_FREQ2={0x8, 0xa1, 0x8b}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0xd}, @NL80211_ATTR_WIPHY_FREQ_OFFSET={0x8, 0x122, 0x155}, @NL80211_ATTR_WIPHY_FREQ={0x8}, @NL80211_ATTR_WIPHY_EDMG_BW_CONFIG={0x5, 0x119, 0x6}], @beacon=[@NL80211_ATTR_IE_PROBE_RESP={0x57, 0x7f, [@link_id={0x65, 0x12, {@initial, @device_a, @device_b}}, @mic={0x8c, 0x10, {0x622, "00400300dd00", @short="da3cc88d1f5a39e9"}}, @prep={0x83, 0x25, {{0x0, 0x1}, 0x5, 0x2, @device_b, 0x4e09, @value=@device_b, 0x4, 0xf1, @broadcast, 0x8}}, @ibss={0x6, 0x2, 0x7}, @supported_rates]}, @NL80211_ATTR_BEACON_HEAD={0x1a2, 0xe, {{{0x0, 0x0, 0x8, 0x0, 0x0, 0x1, 0x1, 0x1, 0x1}, {0x9}, @broadcast, @broadcast, @initial, {0x4, 0x7}}, 0x8, @random=0xa698, 0xb808, @val={0x0, 0x6, @default_ibss_ssid}, @val={0x1, 0x6, [{0x6c}, {0x12, 0x1}, {0x5}, {0x12, 0x1}, {0xb}, {0x60}]}, @val={0x3, 0x1, 0x34}, @void, @void, @val={0x5, 0x54, {0x1, 0xf0, 0x6, "9ce215ee877c43297e1d97e92d8b8a088d3b4f35a290fe2724adebc6ee79bab0630923efb225c33d3b91f7ad2c6fea06ff687be6269ea1c2c88a8270384f542753577e5defd23e84f2488d06424417fd9f"}}, @val={0x25, 0x0, {0x1, 0x8, 0x70}}, @val={0x2a, 0x1, {0x1, 0x1}}, @void, @val={0x2d, 0x1a, {0x2000, 0x0, 0x6, 0x0, {0xfffffeffffffffff, 0x5, 0x0, 0x6, 0x0, 0x0, 0x1, 0x1}, 0x6, 0x48f, 0x8}}, @val={0x72, 0x6}, @void, @val={0x76, 0x0, {0x80, 0x9, 0x3e, 0x81}}}}, @NL80211_ATTR_BEACON_TAIL={0x0, 0xf, [@dsss={0x3, 0x0, 0xa5}, @sec_chan_ofs, @rann={0x7e, 0x0, {{}, 0xf5, 0x2, @device_b, 0x99c, 0xfffffff8, 0x4}}, @tim={0x5, 0x0, {0x6, 0x78, 0x8, "d054"}}, @peer_mgmt={0x75, 0x0, {0x1, 0x6, @void, @void, @val="97b679d74ed89c6e16ba4eb2fc93a42d"}}, @tim={0x5, 0x0, {0xd, 0xd8, 0x3, "14669f987118228cb61269a705b90fb6d144d8b814e93b608ae6d0b3ffb847ffb802040737de2cccf82f3335c28dad4c64353387882d31b59dc8ad845a6680ecf8f2d5dae1f22a2d0be7df4dc115a044dc3b433d4d908d44792fe72d4e124c2c528dcee3198a03a2411e8e9d3a11fb5fc61bd17ad3a51479f5a306948cef5f5321d813e1e57b376c2172"}}, @mesh_chsw={0x76, 0x0, {0x3, 0x9, 0x6, 0x6}}, @dsss={0x3, 0x0, 0xb6}]}], @NL80211_ATTR_PBSS={0x4}]}, 0x4ac}, 0x1, 0x0, 0x0, 0x80}, 0x20000000) write$binfmt_script(0xffffffffffffffff, &(0x7f00000000c0)={'#! ', './file0'}, 0xb) close_range(r3, 0xffffffffffffffff, 0x0) 8.222777746s ago: executing program 1 (id=1737): r0 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000180), 0x4240, 0x0) ioctl$BLKPG(r0, 0x1269, &(0x7f00000001c0)={0x3, 0x0, 0x0, 0x0}) r1 = openat$vimc1(0xffffff9c, &(0x7f0000000000), 0x2, 0x0) ioctl$VIDIOC_TRY_FMT(r1, 0xc0cc5640, &(0x7f00000000c0)={0xa, @win={{0x0, 0x3, 0xa7, 0x3}, 0x0, 0xfffffff9, 0x0, 0xfffffffd, 0x0, 0x4}}) unshare(0xc040400) bpf$OBJ_GET_PROG(0x7, &(0x7f0000000040)=@generic={&(0x7f0000000000)='./file0\x00', 0x0, 0x18}, 0x14) getsockopt$inet6_int(0xffffffffffffffff, 0x29, 0xb, 0x0, &(0x7f0000016440)) r2 = openat$kvm(0x0, &(0x7f0000000040), 0x0, 0x0) r3 = ioctl$KVM_CREATE_VM(r2, 0xae01, 0x0) ioctl$KVM_CREATE_VCPU(r3, 0xae41, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r4, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r5, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r4, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x1, 0x0) sendmsg(r5, &(0x7f0000000280)={0x0, 0x0, 0x0}, 0x0) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x6, 0x48, 0x0, 0x0, 0xb4b, 0x9, 0x10000004, 0xffff, 0x400003}, 0x0) syz_usb_connect(0x0, 0x5f, 0x0, 0x0) syz_clone(0x11, 0x0, 0x0, 0x0, 0x0, 0x0) openat$6lowpan_control(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) openat$snapshot(0xffffffffffffff9c, &(0x7f0000000680), 0x40000, 0x19) r6 = socket$inet6(0xa, 0x3, 0x5) setsockopt$inet6_IPV6_FLOWLABEL_MGR(r6, 0x29, 0x20, &(0x7f00000000c0)={@rand_addr=' \x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x01', 0x800, 0x0, 0x3, 0x9}, 0x20) r7 = syz_open_dev$vbi(&(0x7f0000003dc0), 0x3, 0x2) ioctl$VIDIOC_S_FMT(r7, 0xc0d05605, &(0x7f0000003f40)={0x7, @win={{0x65c6, 0x6, 0x5, 0x2}, 0x8, 0x7, 0x0, 0x0, 0x0, 0x7}}) setsockopt$inet6_IPV6_DSTOPTS(r6, 0x29, 0x3b, &(0x7f0000000200)=ANY=[], 0x8) sendmmsg(r6, &(0x7f0000002b00)=[{{&(0x7f0000000180)=@l2tp6={0xa, 0x500, 0x80000, @mcast1}, 0x80, 0x0}, 0x5b4}], 0x1, 0x0) r8 = syz_open_dev$I2C(&(0x7f0000000000), 0x0, 0x0) pread64(r8, 0x0, 0x0, 0x3) 6.878271539s ago: executing program 5 (id=1739): r0 = seccomp$SECCOMP_SET_MODE_FILTER_LISTENER(0x1, 0x0, &(0x7f0000000000)={0x1, &(0x7f0000000100)=[{0x6, 0x8, 0x0, 0x7fff0000}]}) r1 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_TCP_REPAIR(r1, 0x6, 0x13, &(0x7f00000021c0)=0x1, 0x4) setsockopt(r1, 0x1, 0x10000000000009, &(0x7f00000000c0)="f5c89e1e", 0x4) connect$inet6(r1, &(0x7f0000000080)={0xa, 0x4e22, 0x5, @ipv4={'\x00', '\xff\xff', @remote}, 0x4}, 0x1c) close_range(r0, 0xffffffffffffffff, 0x0) 6.439271219s ago: executing program 5 (id=1741): r0 = openat$kvm(0xffffffffffffff9c, &(0x7f0000000200), 0x0, 0x0) r1 = ioctl$KVM_CREATE_VM(r0, 0xae01, 0x0) r2 = openat$vimc2(0xffffffffffffff9c, &(0x7f0000001e80), 0x2, 0x0) ioctl$VIDIOC_STREAMOFF(r2, 0x40045613, &(0x7f0000001fc0)=0xa) ioctl$KVM_CREATE_IRQCHIP(r1, 0xae60) ioctl$KVM_CREATE_PIT2(r1, 0x4040ae77, &(0x7f0000000040)) ioctl$KVM_SET_REGS(0xffffffffffffffff, 0x4090ae82, &(0x7f0000000000)={[0x35, 0x91f9, 0x1000, 0x180, 0x3ff, 0x10, 0xf1, 0x50, 0x12, 0x2000000007ff, 0x0, 0x26, 0x0, 0x6, 0x0, 0x7ffffffffffffffc], 0xffff1001, 0x43000}) r3 = ioctl$KVM_CREATE_VCPU(r1, 0xae41, 0x0) r4 = syz_open_dev$evdev(&(0x7f0000000000), 0x2, 0x0) ioctl$EVIOCGMASK(r4, 0x80104592, &(0x7f0000000300)={0x0, 0xffffffffffffff36, &(0x7f0000000200)="952bb3e006ae9a4c3a"}) ioctl$EVIOCGRAB(r4, 0x40044590, &(0x7f0000000080)=0x4) ioctl$EVIOCGRAB(r4, 0x40044590, &(0x7f0000000140)=0x3) ioctl$KVM_SET_USER_MEMORY_REGION(r1, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_SET_REGS(r3, 0x4090ae82, &(0x7f00000003c0)={[0x60000000002, 0x1000000000, 0x0, 0x43, 0x2000001, 0x0, 0x2004cb, 0x0, 0x1000000, 0x68ff, 0x5, 0x9, 0x3], 0xeeee8000, 0x202}) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f00000001c0)={{0x8080000, 0xeeee0000, 0x8, 0x8, 0xb, 0xe4, 0x40, 0x0, 0x0, 0x2e, 0x80}, {0x5000, 0x4000, 0x3, 0x0, 0x42, 0x5, 0x7d, 0x6, 0x15, 0x3, 0x2, 0x87}, {0x6000, 0xdddd0000, 0xe, 0x5, 0x3, 0x7, 0x0, 0x9, 0x1, 0xa4, 0x5, 0x5}, {0x1, 0xeeee0000, 0xd, 0x6, 0x4, 0x42, 0xb, 0xff, 0x8, 0x7, 0xe}, {0xeeee0000, 0xd000, 0xf, 0x3, 0x15, 0x7, 0xab, 0x8, 0x9, 0x83, 0xf7, 0x83}, {0x1000, 0x3909e40c33606d9c, 0xe, 0xa0, 0xb1, 0x8, 0x1, 0xa0, 0x82, 0xf, 0x1, 0x7}, {0x3000, 0x3000, 0x4, 0x5, 0x7, 0x5, 0x7, 0x3, 0x8, 0x81, 0x40, 0x70}, {0xd000, 0x4000, 0xe, 0x5, 0xcd, 0x7, 0x1, 0x9, 0x2, 0xc, 0xb0, 0x9}, {0xeeef0000, 0x30}, {0x8000000, 0x7}, 0x80000031, 0x0, 0x0, 0x2024, 0x2, 0x1500, 0x3000, [0x6800000000000000, 0x4, 0x5e, 0x8]}) connect$pppl2tp(0xffffffffffffffff, &(0x7f0000000000)=@pppol2tpv3={0x18, 0x1, {0x3, 0xffffffffffffffff, {0x2, 0x0, @dev}, 0x2}}, 0x2e) ioctl$KVM_RUN(r3, 0xae80, 0x0) 6.341815663s ago: executing program 0 (id=1742): r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet6_IPV6_RTHDRDSTOPTS(r0, 0x29, 0x37, &(0x7f0000000000)=ANY=[], 0x8) openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) ioctl$SNDRV_CTL_IOCTL_PCM_PREFER_SUBDEVICE(0xffffffffffffffff, 0xc1105511, 0x0) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec29, 0x0, 0x1, 0x40000337}, &(0x7f0000000dc0)=0x0, &(0x7f00000001c0)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, 0x0) syz_emit_ethernet(0x3e, &(0x7f0000000280)=ANY=[@ANYRES8], 0x0) openat$kvm(0xffffffffffffff9c, &(0x7f0000000240), 0x105082, 0x0) r6 = ioctl$KVM_CREATE_VM(0xffffffffffffffff, 0xae01, 0x0) ioctl$KVM_SET_USER_MEMORY_REGION(r6, 0x4020ae46, &(0x7f0000000180)={0x0, 0x0, 0x0, 0x2000, &(0x7f0000000000/0x2000)=nil}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) ioctl$KVM_SET_SREGS(0xffffffffffffffff, 0x4138ae84, &(0x7f0000000100)={{0xd000, 0xffff1000, 0x0, 0x0, 0x80, 0x0, 0x0, 0x3, 0x0, 0x7, 0x6}, {0xffff1000, 0xeeef0000, 0xf, 0x9, 0x2, 0x0, 0xa, 0x0, 0x7, 0xff}, {0x2000, 0x8080000, 0xc, 0x0, 0x4, 0xc4, 0x2, 0x0, 0x48, 0x3, 0x0, 0xfc}, {0xd000, 0x33331000, 0xc, 0x80, 0x1, 0x0, 0x9, 0x0, 0x8, 0x0, 0x4}, {0x6000, 0x6000, 0xe, 0x3, 0x51, 0x4, 0x12, 0x0, 0x0, 0x8}, {0x100000, 0xdddd0000, 0xd, 0x78, 0x5, 0x9, 0x2, 0x0, 0x0, 0x0, 0xff, 0xf4}, {0x0, 0xffff1000, 0xa, 0x4, 0x0, 0x0, 0xa1, 0x20, 0x0, 0x0, 0x8}, {0x1000, 0x1000, 0x0, 0x0, 0x0, 0x6, 0x8, 0x40, 0x26, 0x8, 0x0, 0x3}, {0x80a0000, 0x8cc}, {}, 0xddf8ffdb, 0x0, 0x3000, 0x110, 0x80000000000, 0x5801, 0x0, [0x80000001, 0x0, 0x1, 0x4]}) ioctl$KVM_RUN(0xffffffffffffffff, 0xae80, 0x0) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 5.985346069s ago: executing program 8 (id=1744): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x100, 0x0) close(r3) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xfffffff9, 0x40000006}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0xba, 0x4, 0x9, 0x8, 0x8, 0x8}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2000c040}, 0x4880) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56f41, 0x1070b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0xe}, {0x8, 0xb}, {0xd, 0xb}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x14, 0x2, [@TCA_HHF_QUANTUM={0x8, 0x2, 0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8, 0x3, 0x5}]}}]}, 0x40}}, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 5.564079335s ago: executing program 8 (id=1745): munlockall() socket$unix(0x1, 0x2, 0x0) socket$inet6(0xa, 0x2, 0x0) socket$nl_netfilter(0x10, 0x3, 0xc) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) r0 = socket$nl_generic(0x10, 0x3, 0x10) socket$inet(0x2, 0x1, 0x9) socket$xdp(0x2c, 0x3, 0x0) r1 = socket$nl_generic(0x10, 0x3, 0x10) r2 = syz_genetlink_get_family_id$tipc2(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$TIPC_NL_KEY_SET(r1, &(0x7f0000000100)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000140)={0x14, r2, 0x1}, 0x14}, 0x1, 0x0, 0x0, 0x4}, 0x0) sendmsg$TIPC_NL_NODE_GET(r0, &(0x7f0000000080)={&(0x7f0000000000)={0x10, 0x0, 0x0, 0x800000}, 0xc, &(0x7f0000000040)={&(0x7f0000000400)={0x110, r2, 0x300, 0x70bd28, 0x25dfdbfd, {}, [@TIPC_NLA_LINK={0x3c, 0x4, 0x0, 0x1, [@TIPC_NLA_LINK_PROP={0x34, 0x7, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x7}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x3}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x6}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0xa}]}, @TIPC_NLA_LINK_PROP={0x4}]}, @TIPC_NLA_MEDIA={0xa4, 0x5, 0x0, 0x1, [@TIPC_NLA_MEDIA_PROP={0x1c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x9}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0xfffffff7}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0x1a}]}, @TIPC_NLA_MEDIA_PROP={0x24, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x6}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xb}, @TIPC_NLA_PROP_PRIO={0x8, 0x1, 0xf}]}, @TIPC_NLA_MEDIA_PROP={0x34, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0x59b2}, @TIPC_NLA_PROP_TOL={0x8}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x3ef}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x8}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x7}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x1aa4}]}, @TIPC_NLA_MEDIA_PROP={0x2c, 0x2, 0x0, 0x1, [@TIPC_NLA_PROP_WIN={0x8, 0x3, 0xf}, @TIPC_NLA_PROP_TOL={0x8, 0x2, 0x80000000}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x2}, @TIPC_NLA_PROP_WIN={0x8, 0x3, 0x9}, @TIPC_NLA_PROP_MTU={0x8, 0x4, 0x80}]}]}, @TIPC_NLA_MON={0x1c, 0x9, 0x0, 0x1, [@TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x6}, @TIPC_NLA_MON_REF={0x8, 0x2, 0x20000}, @TIPC_NLA_MON_ACTIVATION_THRESHOLD={0x8, 0x1, 0x100000}]}]}, 0x110}, 0x1, 0x0, 0x0, 0xc010}, 0xc0c1) socket$inet6(0xa, 0x80001, 0x0) socket$nl_rdma(0x10, 0x3, 0x14) r3 = socket$inet_udplite(0x2, 0x2, 0x88) r4 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r4, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f00000013c0)=ANY=[@ANYBLOB="640000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="e5fda988000000002800128009000100766c616e00000000180002800c000200200000001f000000060001000000000008000500", @ANYRES32=r3, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x64}}, 0x0) 5.203599502s ago: executing program 5 (id=1746): socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000200)) socketpair$unix(0x1, 0x5, 0x0, &(0x7f00000001c0)) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc}, 0x8) sendto$inet6(r0, &(0x7f00000004c0)='W', 0x1, 0x0, &(0x7f0000000000)={0xa, 0x4e20, 0x0, @loopback, 0x8}, 0x1c) getsockopt$inet_sctp6_SCTP_ADAPTATION_LAYER(r0, 0x84, 0x7, &(0x7f0000000140), &(0x7f0000001300)=0x4) syz_clone(0x100411, 0x0, 0x0, 0x0, 0x0, 0x0) syz_io_uring_setup(0x10d, &(0x7f0000000380)={0x0, 0x25b9, 0x100, 0x0, 0x215}, 0x0, 0x0) socket$inet6(0xa, 0x1, 0x0) r1 = socket$nl_route(0x10, 0x3, 0x0) socketpair$nbd(0x1, 0x1, 0x0, &(0x7f0000000a80)) r2 = socket$inet6(0xa, 0x1, 0x0) setsockopt$inet6_int(r2, 0x29, 0x2, 0x0, 0x0) r3 = syz_open_dev$swradio(&(0x7f0000000100), 0x1, 0x2) r4 = openat$nullb(0xffffffffffffff9c, &(0x7f0000000080), 0x4000000004002, 0x0) r5 = dup(r4) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xb, 0x13, r5, 0x2000) pipe2$watch_queue(&(0x7f0000000180)={0xffffffffffffffff, 0xffffffffffffffff}, 0x80) ioctl$VIDIOC_PREPARE_BUF(r3, 0xc04c565d, &(0x7f0000000400)=@multiplanar_fd={0x401, 0x8, 0x4, 0x20, 0x2, {}, {0x0, 0x2, 0xff, 0x2, 0x27, 0xe, "4a219794"}, 0x4, 0x4, {&(0x7f00000002c0)=[{0x200, 0x1, {r5}, 0x7}, {0x400, 0xffff8000, {}, 0x38000000}]}, 0x5, 0x0, r6}) r7 = syz_io_uring_setup(0x18b, &(0x7f0000000140)={0x0, 0x1, 0x2, 0x0, 0x801}, &(0x7f0000000100), &(0x7f00000001c0)) r8 = syz_io_uring_setup(0x10d2, &(0x7f0000000680)={0x0, 0x6bf6, 0x400, 0x5, 0x3da}, &(0x7f0000000240), &(0x7f0000000300)) r9 = io_uring_register$IORING_REGISTER_PERSONALITY(r8, 0x9, 0x0, 0x0) io_uring_register$IORING_UNREGISTER_PERSONALITY(r7, 0xa, 0x0, r9) userfaultfd(0x1) socket$kcm(0x21, 0x2, 0x2) socket$nl_generic(0x10, 0x3, 0x10) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)) sendmsg$nl_route(r1, &(0x7f0000000280)={0x0, 0x0, &(0x7f0000000140)={&(0x7f0000000040)=ANY=[@ANYBLOB="4800000010000304000000000400000000007400", @ANYRES32=0x0, @ANYBLOB="0000000003120100280012800b00010062726964676500001800028005002c00020000000c002e"], 0x48}, 0x1, 0x0, 0x0, 0x20040884}, 0x0) 5.066285268s ago: executing program 1 (id=1747): r0 = socket$nl_generic(0x10, 0x3, 0x10) bpf$MAP_CREATE(0x0, &(0x7f0000000180)=@base={0x0, 0x4}, 0x48) socketpair(0x1e, 0x80005, 0x0, &(0x7f0000000000)={0x0, 0x0}) close(r1) setsockopt$sock_attach_bpf(r2, 0x10f, 0x87, &(0x7f0000000180), 0x127) r3 = socket$kcm(0x1e, 0x4, 0x0) setsockopt$sock_attach_bpf(r3, 0x10f, 0x87, &(0x7f00000008c0), 0x43) sendmsg$kcm(r3, &(0x7f0000000100)={&(0x7f0000001540)=@tipc=@name={0x1e, 0x2, 0x0, {{0x0, 0x4}}}, 0x80, 0x0}, 0x0) sendmsg$nl_generic(r0, &(0x7f0000000180)={0x0, 0x0, &(0x7f0000000200)={&(0x7f0000000300)=ANY=[@ANYBLOB="18000000240001030000000000000000010000000400ae"], 0x18}, 0x1, 0x0, 0x0, 0x8001}, 0x4000) recvmmsg(r0, &(0x7f0000000dc0)=[{{0x0, 0x0, 0x0}, 0x1feffe}, {{0x0, 0x0, 0x0}, 0x5}, {{0x0, 0x0, 0x0}, 0x1}, {{0x0, 0x0, &(0x7f0000000380)=[{&(0x7f0000000740)=""/183, 0xb7}, {&(0x7f0000000900)=""/219, 0xdb}, {&(0x7f0000003e00)=""/4098, 0x1002}, {&(0x7f0000000540)=""/229, 0xe5}], 0x4}, 0x101}, {{0x0, 0x0, 0x0}, 0xfff}, {{0x0, 0x0, 0x0}, 0x9}, {{0x0, 0x0, &(0x7f0000000240)=[{&(0x7f00000006c0)=""/108, 0x6c}, {&(0x7f00000003c0)=""/215, 0xd7}, {&(0x7f0000004e40)=""/4109, 0x100d}, {&(0x7f0000006080)=""/4084, 0xff4}, {&(0x7f00000004c0)=""/100, 0x64}], 0x5}, 0x4db}, {{0x0, 0x0, 0x0}, 0x7}], 0x8, 0x40010022, 0x0) 4.999745414s ago: executing program 8 (id=1748): r0 = socket$igmp(0x2, 0x3, 0x2) setsockopt$MRT_INIT(r0, 0x0, 0xc8, &(0x7f0000003d40), 0x4) setsockopt$MRT_ADD_VIF(r0, 0x0, 0xca, 0x0, 0x0) socket$inet_icmp_raw(0x2, 0x3, 0x1) pipe(0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) openat$ttyS3(0xffffffffffffff9c, &(0x7f0000001840), 0x21800, 0x0) r3 = socket$inet6_icmp_raw(0xa, 0x3, 0x3a) ioctl$sock_SIOCGIFINDEX(r3, 0x8933, 0x0) add_key$user(&(0x7f0000000140), &(0x7f0000000180)={'syz', 0x0}, &(0x7f00000002c0)="00147167cc5745bf66c109b429963bf976a107a35753021bbb55e6bf0f33ba28fdbe58f595feefc4636d1d3006f26963e6248b47749d7d7bcab7ada59b7427976048040c059429fec135235e56d46527cbb6f6f7ee0462dcb36a2f84bdde34ec3e2f7d796b608f1dffc2b03324f7ae3f1a7365c06e8f5b", 0x77, 0xfffffffffffffffd) r4 = syz_open_dev$vim2m(&(0x7f0000000000), 0x0, 0x2) ioctl$vim2m_VIDIOC_REQBUFS(r4, 0xc0145608, &(0x7f00000000c0)={0x1, 0x2, 0x1}) ioctl$vim2m_VIDIOC_QBUF(r4, 0xc058560f, &(0x7f0000000180)=@multiplanar_mmap={0x0, 0x2, 0x4, 0x0, 0x5, {0x0, 0xea60}, {0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 'y)\x00'}, 0x0, 0x1, {0x0}, 0xea}) ioctl$vim2m_VIDIOC_STREAMOFF(r4, 0x40045612, &(0x7f0000000080)=0x2) socket$inet_sctp(0x2, 0x5, 0x84) close_range(r4, 0xffffffffffffffff, 0x0) r5 = syz_open_dev$sndpcmc(&(0x7f0000000a00), 0x0, 0x0) add_key(&(0x7f0000000040)='cifs.idmap\x00', &(0x7f0000000380)={'syz', 0x0}, 0x0, 0x0, 0x0) ioctl$SNDRV_PCM_IOCTL_HW_REFINE(r5, 0xc25c4110, &(0x7f0000000100)={0x4, [[0x6266, 0x9, 0x0, 0x0, 0x0, 0x0, 0x80, 0x4b79f124], [0x800, 0x2, 0x7aa, 0xfffffffa, 0xa7, 0x1, 0x0, 0x2], [0xfffffffb, 0x0, 0x2, 0x0, 0xffffffff, 0x800, 0x0, 0xa584]], '\x00', [{0x0, 0xc278}, {0x0, 0x1, 0x0, 0x1}, {0xfffffc00, 0x0, 0x0, 0x1}, {0x100, 0xfffffffc}, {}, {}, {0x0, 0x20000000}, {}, {0x0, 0x2}, {0x0, 0x2700}, {0x1, 0x700}, {0x7ef2}], '\x00', 0x6b0}) r6 = add_key$fscrypt_v1(0x0, &(0x7f0000000280)={'fscrypt:', @desc2}, &(0x7f0000000500)={0x0, "f1a1173fb9462d3509e67197f90be6e423ceb0ab4912f9f6a31854ec7ff0fbcb566a0982f8938caa52dd8d39af14c31ed56ad59300"}, 0x48, 0xffffffffffffffff) keyctl$setperm(0x5, r6, 0x10200300) add_key$user(&(0x7f00000001c0), &(0x7f0000000200)={'syz', 0x2}, &(0x7f0000001880)="cc5b6108dbfd2effb4735f06292cc3dd71f44b3a4623c3e735012020d95372ebfa9d3d7f73422a3c9f5fc59dcb4bcf7693a4dd2235e74640fc0f668aabe35e1aaae55f4b69c053492ffc97e6c8cdb2276b1389dc327d801a1ff0d4484e85ef3689eaf8d801a5bb871cda2d076257bd66b60a95b39522e78c55e692d6cc9a2b3ba9c6e7beeb83241829e5dbf2ffff6944b330a7e427d641efa9843e18902cb3d59e796952b275e4c872f50333ae7f62bf40ebbeb4977d8eee6916f0d41e01c7acb76321e105d14b3d5bb239b2ba12d17e45dd289a036450cddd537b6d5fda817aa1c402dab079ef73d2193002bece740844ecd676eb995e9bcb401653fcd5f319779b1655ac1c04ef6c5d0f5a7531a78f317e5fb00f0b9a96da84e743f0b8c1ec24445cf8d56e6ab2c8ac229b9e9cde410321c6c3e1bfcd4595ab8f55cc7da25cffd7faa3175d10f7a442033a9987d9d75b804f3927fba2ce5ae260dfb3d8e1f1ea61ccd6686d20599f430b975111c3fbd581d765d4ad8cc5d4b7603d86304a0f5a764d5dd41bca11ec2a74761dc6644bea5a519eb5f8b59076d9408cb88e3e888fe7c3ce08bd345f5b94c911624a3dad97981f2283ac05a7c6fc97c674428ae94ed1bc60ff4b044c8684d687612de5e868ae98bf3dec9ef3a7ed1287bb155e12aeeb2ee726f0ce95da5553149edcfd83180574e7dd3e102c8a9eebc51a7b3ab325ca3aa2ae3941d8cf2f2def510cf0c70c5f328ab48f24a5fb8b7801d64a4e8d81982d879640488613c89fbafe9ed304e5becaf7f285ec05f067575bffe4275ab821ec13743c70477985e6b296b02e431e8f2c3868f2409d334628c25c2c8ba533bc892a3756fa5641bae88a0c76b653e5369b12fa2c54555abf64e5eac3fcbe9812014ba8ffe92c259a552b8856a6deb4389983451b5cc62152b4205a7be00e314aa6bb5f0942e58d0ebf09596ab6a99b18c4f54b89d8544f2fdd17975281c7978f7020c83f342281f404f91d32a840f3e4845182e7d75a32185aa3228c698faf506c84436105c8d983df1286245a114356cf55be68df7819186ee34051b29cfc8158275cc10783228dd299457d3a7a9ee47fd11f3d27aaefc0034bf119b8a72a2e41375b00cd7f58353e3313a8c9946baa3230ebe60d26da8f36ff95801975c8e7987a71e1f8bf1f2169162974ed6c468f97d8add3d73b8790d9e2878acaa6de35e5d8556ce2acfb43a09ef303bcbc24926d9836d2ecd4db29fdd843cd63da97412e708164de1c027d5a0381c90400df5ed6e20a75447ed7b4ef21a92bb2a6b5afdcb1e055120109248c4da733533c8f8084ceb701d79cc7eeee72e13b5ba00a67ef2c636ce277975ac62e285a4d57496ff545cd540408d9e2318a29684203b64142596d4df8c484a78f786a86d754ea01ee227df9f27ba1190f97a1c5ace9f90624d713f3c73a0ce22ad02e7efe49351ba4dcd36269cd7fb95347dccf66884b5a447e1c2389ad2fc5486579d6012156c3ed7e24f9f3756c6bbdf94872bb778099925821ba7ce77b2da3d4db9203317a3dcf76b9820e835e0be784916327123780314511eeaba76ab4802aef7751d70511bf9a687912de37744477e842913d54511903d97f59ff9d7be3fc7716d24999623920f66e6ace835ad85ae8a923bc21cb724a1f7abcbe04be6686d1d86ed036e2e844a320f3464732e6e97933d986f918abbc24b1571956b078fae9978e41d7a57aea59b7c13d37fb3fb1f12418e56a4aba9d44b78029a22e0db9e0d046f73b50c48774ca13191638c8eaf44a94099e90bc4d2cbfde7f8a61236902576e4702bdfc7061eb47166aeaf9c122af4696d9a63c6c1b0784ebc184b3717985105a6dd0acc765f47dbcc68a686af1e365b171c34730df29c2cdf84b7e441ea283fecd4fef50c000329600e910e4258e2f00b3d3642b38c005301130a52d01ccddc5f7b651508339999a686e007143a81f7c0546481a9a36f86b1476a7581fb1d6fce8878205eae7a6348ed37a797c908b9a3132dcaa02ef2d8af0ed7002ced5156a4bb9a41f1df7b5434fdda1ed119c7e4c061bbb3db186cdee8ae8d0d9ed36f0fd1966b1e28f108633425488bbc84d7226830516fc4f37d4c4bb91ffc17af625f744402dc412893558dd924fb7e49376fca61701a5dc87cb1d3ea386701e47872389235e744e035ba66d78d404a45ef878aff2ea5fdc4363df713118221c6f068f05ceeb09c11f105ecdf20eddd9bb88c79caf2a19145eb802645502d2f1c9374fb260e5c52ad1a564e708e31f09ca8c7d04f2270244883b3f782bba3e6324d7641c58af378ea18e85ea657881fd685529203c356e730ce6c860b0d37a4845c97640f3c46d148eab65d6d170f0cadb2956967ae0a3c067ce216132a8560b80c206d800a8952c10728c96d7720265f5e84cea7cffb50ec99e20f8d00890656373835dc6b524b6c4640463ce60b91b7e73454f336a8a62e81024ae265000d29a970b88bc260d6ab906581e93ebe76a9eb347c3b68b4c3fce483a174319218f5364acde8e5ca4c6cfce1350248d00a3f7ce803c35df8225a61cb256e573be9c329fcf1e2adc44179e809adbb1e20a47355570dabf6b30c04149b38cdbacefad20b2c41760369fe42878cf3a2c40f61d85d2d6df6fad118508502fc50a71e57677128e3b016288ee8c9ea62972ecddeea9bab00a58c4ca3f138d4f099dd6f1060dc2c2facc039a63f1c9ac52c91bc55dadf63b398824a396d65ba4b054158e934ed9f6a685cba1a4f3fdcf0b7217cde43b8176d93c2ce056324183bd3b0573ce42bbdf023ccc82eea764078ff9414c3885df79caa6e14f5aaf2f787b0a27806bf27b5cccd2395471081d9ef8299fcd905d35c83d656728fc9744f6458e95babc7f08fe0067d6a944f5129817b8312abe0da06ac89acb0e2b93be58fc20fe7a3693f5e8e6ed176e93abda5f06dfa13b0c0f5922d535262b7beb623b2bda725d006c2d99b107847dbaf6992645dc929183241c59dc18061226b046b673c19c5e3ea5a95cf93ee3fc15e0aebea89a0e15446ef0c28026603ecc516b10d74294094df539c07ef66286ea4f715a42187ab0ad8fd45e7124e517f91cf32d02559b0d8e95fda99b1f4d4e753c3a42ad94731e591fcbdee8cd881029e03276fac6b17bf1bc9f9dce8874bb82e4b72be835bd02db246cdb1c38ab408ed570c4b863738a9202fc1f6c8f14f5de0614054aebfbf25b944811d7ad76f9bb40297ed1a080ab4e52640dc9e6fb94396e23daceb791fbb0a4ccf37bff1de473e3160b682049978d3291fe307dbe82d28f9821275cd91af9aad9451b51787a57a3cf888656df73d6a31ae1dffb4390e5814380cf17c1dcfcb4b3f1503d54c44b0231b16a5ffe21e4e7d1fbe738bdcce2f4c396db00c13f550c25e691d9c108a3329205a41b58ab48e33e0fed5c6a77dd4deb46c1b94cdc3fa2661380ea2623c73302fe36ef0727d06053ebbfa7c4ca4072eb2e59434bb992606bdd184931d256c56b004d1e7aea956cad07df4b56769cc8865ce8e7a3a025ac6daaf69353b3ce0f34c0c8be27c4109ee666a71fd30e315882c28dd428d138893d35a89032aacc3aabc5595f7a8e40348bef97a24e1becb91035f1e96d65e7cfc83e49f6c751c67bf2e015d32b603e6b84cf3048810c8cd7eaa504aa6c821d6dab5ba511cd19320208132b4edc440c7506a61754a5ea827442c8b226236fd10b6c584746243f282978880f65d27e5c05b2b35927e798b95e9a48699c8abc2f85529995b346e860a04dbfb6d97af7d34bf40cd4a94854b47d9199e4455764baa10613441488e5633f89172134174d486c3c181b0467e01a615a48dac8808b4cecb93004c6baea7a86285feff6a1895e3cbd651bfb4546b30583149a5c34be59862e2d2d408a22c807d85d9f7df1f0955e6ceba059193d023f6a76d8436ed453e4fd588b8d37cc2b2585851729e1b6663532d954f5dea8e6077d5859cd7ed3ad0c1274bc1fb377fb1f2f0bfba3645f21866d97c7bdb149367ea7da16d2d60684aa46a007db8810e1fc9ca2087834fe84198d17eab907ac20470752ff264137d95587de538e4e612bacf3136833d272c23519353e42db5eae4c044640a160822328f82eb3760b5a7ccf690269b33417eec183821754351977f8c1741c90f474a1ad90105d4c239ff7840618efc3b82d08d583e60f87a56d67a6bf582fe3101401fc5d8c556fc9b3e34b12c5a7d9ea65721de8a068c1939cdf3d1c045fb136f79684224e3edc03e878460b2830f3077da297951c8a97b8676fb34e9a17eb5a3093fb72ecd6c77de171043ea165e06b3f35a7d0bd004f57773e1754dfc863e37417d1134a2285c8356d5207ca77d4b7143f5a13f2bf13964f3f827c18f29f43890b8e31642a1a717f596a3e6f993d96e6a56b11eec0daeaba6864be2a7731496c87c24f35a81d64d4e6cb0c61b279b4816b64441e80a1a93a1b3be1e4fdd698b9418b74632b0594a1d9a02d19196b019eeda8f729763483973266756eadd5355285991d2894e46d681b800cedc3f8d500e9a853a8650337a514394cb83e13328939742dcb2d34c7ce97df2fcfbe01626d19b4b0b6b43c0882117e947c6231951aebc4b77e53afa9f33c2dfdd3dedaa809428a90f7f88631b8650adfef6d8757c21fa9abda30137d1ba6f8cb6fce2f39a39ccf138df13da89742cb4c186ae66cb72ceed7d5", 0xd20, 0xfffffffffffffffb) keyctl$dh_compute(0x17, 0x0, &(0x7f00000003c0)=""/84, 0x54, 0x0) socket(0x1d, 0x2, 0x6) openat$dsp(0xffffffffffffff9c, &(0x7f0000000000), 0x42, 0x0) 4.961723911s ago: executing program 7 (id=1749): lsetxattr$system_posix_acl(&(0x7f0000000000)='./file1\x00', &(0x7f0000000340)='system.posix_acl_default\x00', 0x0, 0x0, 0x0) 4.710208409s ago: executing program 7 (id=1750): r0 = socket$inet6_tcp(0xa, 0x1, 0x0) r1 = landlock_create_ruleset(&(0x7f0000000100)={0x2, 0x3}, 0x18, 0x0) landlock_restrict_self(r1, 0x5) r2 = landlock_create_ruleset(&(0x7f0000000080)={0x8048, 0x1}, 0x18, 0x0) landlock_restrict_self(r2, 0x6) mprotect(&(0x7f0000000000/0x4000)=nil, 0x4000, 0x1) connect$inet6(r0, &(0x7f0000000000)={0xa, 0x4e22, 0x7, @ipv4={'\x00', '\xff\xff', @rand_addr=0x64010100}, 0x106}, 0x1c) syz_open_dev$usbfs(&(0x7f00000000c0), 0x204, 0x2) r3 = epoll_create1(0x0) mmap(&(0x7f00005b9000/0x1000)=nil, 0x1000, 0x200000f, 0x11012, r3, 0x68255000) 4.596094082s ago: executing program 1 (id=1751): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x22, 0x2, 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)=0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x0, 0x0, 0x8000000000000004, 0x0, 0xfffffffffffffffc, 0xfffffffe, 0x7}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) listen(0xffffffffffffffff, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) writev(0xffffffffffffffff, 0x0, 0x0) shutdown(r3, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x6, 0x0, 0x0, r5}) r6 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001500)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01000000000000000000450000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008810000000000004f58f025e012b9b24b36f93e8c6be708b9769cf9b84a26096064f7ca9302d8dc0b423ea9f8dc0d34d3f76df35e7969c4f44849b250279cf6ff6c280970e5f6e0538f41e0bd64c331a7f87ec0bb3dabf667405924bcc202fc17d3a53516c8ca8c870f72141832a3aca6ffb13c59d06487ca93ac5edc"], 0x3c}}, 0x0) socket$tipc(0x1e, 0x2, 0x0) syz_open_dev$midi(0x0, 0x500, 0x0) 4.457050226s ago: executing program 7 (id=1752): r0 = getpid() r1 = syz_pidfd_open(r0, 0x0) process_madvise(r1, &(0x7f00000015c0)=[{0x0}, {&(0x7f0000001000)="7f", 0x1}, {&(0x7f0000001280)="04", 0x1}], 0x3, 0x17, 0x0) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_io_uring_submit(0x0, 0x0, &(0x7f00000002c0)=@IORING_OP_POLL_ADD={0x6, 0x0, 0x0, @fd_index=0x3, 0x0, 0x0, 0x0, {}, 0x1}) r3 = syz_open_dev$midi(&(0x7f0000000180), 0x2, 0x2) madvise(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x15) ioctl$SNDRV_RAWMIDI_IOCTL_INFO(r3, 0xc0305720, &(0x7f00000002c0)) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r5 = socket$nl_route(0x10, 0x3, 0x0) sendmsg$nl_route(r5, &(0x7f0000000680)={0x0, 0x0, &(0x7f0000000080)={&(0x7f0000000500)=ANY=[@ANYRESDEC=r5, @ANYRES32=r4, @ANYBLOB="06001500070000000c00168008000100", @ANYRES32=r2], 0x38}}, 0x10) 4.415494572s ago: executing program 0 (id=1753): sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x2, 0x0, 0x0, 0xb49, 0x9, 0x8, 0x0, 0x3}, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) r2 = socket$inet6(0xa, 0x5, 0x0) setsockopt$inet6_buf(r2, 0x29, 0x39, &(0x7f0000e86000)="0022040000ffffebfffffffeffffff0700000000ff000207835eeb1317b208feefaf234b4ff8b4cc4c39bdc8451792b903f4b7d8c8cf2153622652328c19ef68234f905557c4070000008735e9ab2f77c62e0a5cdd2cf9984c0704000000000000", 0x61) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = socket$inet_udp(0x2, 0x2, 0x0) bind$inet(r3, &(0x7f00000001c0)={0x2, 0x0, @local}, 0x16) r4 = socket$inet_tcp(0x2, 0x1, 0x0) r5 = bpf$BPF_PROG_RAW_TRACEPOINT_LOAD(0x5, &(0x7f0000000100)={0x6, 0x4, &(0x7f0000000200)=ANY=[], &(0x7f00000002c0)='syzkaller\x00', 0x0, 0x0, 0x0, 0x0, 0x20}, 0x94) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000180)={'syz_tun\x00', 0x0}) bpf$BPF_LINK_CREATE_XDP(0x1c, &(0x7f0000000340)={r5, r6, 0x25, 0x0, @val=@iter={0x0}}, 0x20) connect$inet(r3, &(0x7f0000000000)={0x2, 0x0, @multicast2}, 0x10) r7 = socket$inet6_tcp(0xa, 0x1, 0x0) setsockopt$inet6_tcp_int(r7, 0x6, 0x13, &(0x7f0000000000)=0x100000001, 0x4) connect$inet6(r7, &(0x7f0000000200)={0xa, 0x0, 0x0, @loopback}, 0x1c) bpf$MAP_CREATE_CONST_STR(0x0, &(0x7f00000006c0)=ANY=[@ANYRESOCT=r3, @ANYRES32, @ANYBLOB="0600"/20, @ANYRES32=r6, @ANYRES32, @ANYBLOB="0100000005000093eeeb7676c900000000000000000000000000000040df223330b35d3978808a7e24f808f58291f0f300c81b736bf8487b1b4fbe425be4db088af230bbdc863126698e765c2ce62294faa9d6ed312618b2a8d5cff0b7929b570536e77a16b513b3df5fb0a13168205b4ea3d2ccf636864dfe38de266400c6c700022f83b1e6e7dc3fc4fd7bd72c31b1963053d1068358ce13d1b3843fa2ef681d9003d99f87b95845bff4ae0778b486febce50b1a73d90c0cccc16d2759d6a496378b5bb18dad060f7d368ecc5e5c87fce02afe239a7982634ec5a20266a314c00c4949a2ab4bc0e8ca4a5c8980f6fb09843d160c1b68c5ceffd6eeb03204053a3bb08e6ce0f393b8d50643dfb72b80b8f900000000851702af39d2849746c8bec950876781cafbb35ff0a383de593fa6d535c10f39124d1fb01808131f46864801cdfe4df80cf521418d"], 0x50) r8 = syz_open_dev$sg(&(0x7f0000000040), 0x0, 0x800) ioctl$SG_GET_VERSION_NUM(r8, 0x2284, &(0x7f0000000080)) setsockopt$inet6_tcp_TCP_ULP(r7, 0x6, 0x1f, &(0x7f00000000c0), 0x4) setsockopt$inet6_tcp_TLS_TX(r7, 0x11a, 0x1, &(0x7f0000000500)=@gcm_128={{0x303}, "a95972fc5ec50719", "8e083700daf38a6d69e9b5e9c2f133d7", "6a3a05b9", "00001800"}, 0x28) shutdown(r7, 0x1) openat$cgroup_ro(0xffffffffffffff9c, &(0x7f00000002c0)='freezer.state\x00', 0x275a, 0x0) lsm_set_self_attr(0x68, &(0x7f0000000800)={0x68, 0x4b, 0x20}, 0x20, 0x0) mmap(&(0x7f0000000000/0xb36000)=nil, 0xb36000, 0xf, 0x4008032, 0xffffffffffffffff, 0x0) openat$nullb(0xffffffffffffff9c, &(0x7f0000000040), 0x4a2000, 0x0) socketpair$unix(0x1, 0x2, 0x0, &(0x7f0000000340)={0xffffffffffffffff}) connect$unix(r9, &(0x7f000057eff8)=@abs, 0x6e) 3.908981715s ago: executing program 7 (id=1754): r0 = syz_open_dev$sg(&(0x7f0000001600), 0x8, 0x801) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) r1 = socket$kcm(0x10, 0x2, 0x10) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) recvmmsg(r1, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000380)=""/123, 0x7b}, {&(0x7f0000000180)=""/256, 0x100}, {&(0x7f0000001a00)=""/4099, 0x1003}, {&(0x7f0000000340)=""/19, 0x13}, {&(0x7f0000000100)=""/113, 0x71}, {&(0x7f0000000040)=""/22, 0x16}, {&(0x7f00000004c0)=""/189, 0xbd}], 0x7}, 0x60}], 0x1, 0x10042, 0x0) r2 = socket$kcm(0x2, 0x5, 0x84) setsockopt$sock_attach_bpf(r2, 0x84, 0x85, &(0x7f0000000000), 0x90) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000280)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000580)={0xa29a, 0x2, 0x1, 'queue1\x00', 0x653}) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000380)={0x0, 0x12f, 0x20a46}) syz_open_dev$sg(&(0x7f0000001600), 0x8, 0x801) (async) mprotect(&(0x7f0000000000/0xf000)=nil, 0xf000, 0x1) (async) socket$kcm(0x10, 0x2, 0x10) (async) sendmsg$kcm(r1, &(0x7f00000000c0)={0x0, 0x0, &(0x7f0000000480)=[{&(0x7f0000000000)="1400000010003507d25a806f8c6394f90324fc60", 0x14}], 0x1}, 0x0) (async) recvmmsg(r1, &(0x7f0000000080)=[{{0x0, 0x0, &(0x7f0000001980)=[{&(0x7f0000000380)=""/123, 0x7b}, {&(0x7f0000000180)=""/256, 0x100}, {&(0x7f0000001a00)=""/4099, 0x1003}, {&(0x7f0000000340)=""/19, 0x13}, {&(0x7f0000000100)=""/113, 0x71}, {&(0x7f0000000040)=""/22, 0x16}, {&(0x7f00000004c0)=""/189, 0xbd}], 0x7}, 0x60}], 0x1, 0x10042, 0x0) (async) socket$kcm(0x2, 0x5, 0x84) (async) setsockopt$sock_attach_bpf(r2, 0x84, 0x85, &(0x7f0000000000), 0x90) (async) ioctl$AUTOFS_DEV_IOCTL_OPENMOUNT(0xffffffffffffffff, 0xc0189374, &(0x7f0000000280)={{0x1, 0x1, 0x18, r1, {0x8}}, './file0\x00'}) (async) ioctl$SNDRV_SEQ_IOCTL_CREATE_QUEUE(r3, 0xc08c5332, &(0x7f0000000580)={0xa29a, 0x2, 0x1, 'queue1\x00', 0x653}) (async) ioctl$SCSI_IOCTL_SEND_COMMAND(r0, 0x1, &(0x7f0000000380)={0x0, 0x12f, 0x20a46}) (async) 3.626225686s ago: executing program 7 (id=1755): r0 = openat(0xffffffffffffff9c, &(0x7f0000000000)='./file0\x00', 0x600003, 0x12) read$hidraw(r0, &(0x7f0000000040)=""/119, 0x77) r1 = openat$vim2m(0xffffff9c, &(0x7f00000000c0), 0x2, 0x0) ioctl$vim2m_VIDIOC_PREPARE_BUF(r1, 0xc04c565d, &(0x7f0000000200)=@multiplanar_userptr={0x7, 0x3, 0x4, 0x800, 0xa17, {}, {0x4, 0x2, 0xb, 0x2, 0x2, 0xf, "31bdbaa8"}, 0x7f, 0x2, {&(0x7f0000000180)=[{0x7, 0xa, {&(0x7f0000000100)}, 0x2}, {0x8, 0x8001, {&(0x7f0000000140)}, 0x76c}]}, 0x7, 0x0, r0}) r3 = syz_open_dev$I2C(&(0x7f0000000280), 0xfffffffc, 0x200) ioctl$I2C_RDWR(r3, 0x707, &(0x7f0000000540)={&(0x7f0000000500)=[{0x1, 0x0, 0x5f, &(0x7f00000002c0)="c76dc99522b76335420845d3975bd8535fa56fc3714168f0f6faed7b023654df7445d69636e3971943684c45a142cacaa3a2585e0b91b333ea10e6045e338200def29ae9659daed9ce72459403ec05f937677507bcf75dfc42747c821e9fd9"}, {0x58e7, 0x8000, 0xda, &(0x7f0000000340)="31507d3febe04cebdaee822ce8337dbc8c27ed460040a77d80c7f10ec15547b1197b7b7481633199956ede958b77767eceb9fd4deb0dc903404204c0b18d9ab9c51a4b93d426f7fba98ff67b7d0f431be04680f5d625245a759d0d1fc93efd39dad793296cfbe92bb5b88e2c95522bef9eb01665312e313426e716839674eaa7af2b874a4d2326e57879cfd22229e062880c2ac1dbb46e9d97aa6f8ff73ff90a8dec8525acce08f8a3135f1cf620871c7512758f0d8a826bce9f93614587b14d8d339bb8415f87a4d44cddab36aeafffea3426e54d2815c1468e"}, {0x9, 0x400, 0x4f, &(0x7f0000000440)="a0612bb0b3dcbc64517b72dd5363368733c2c9171c8359b3cd8f91ba5b285132d0e9f0f512abb90e127b4e275f2f9f0f8cd5f59c72d9b94481010288db07e68487504e1d38adff2a31c97fd3b2e69d"}, {0x6, 0x1200, 0xd, &(0x7f00000004c0)="2d542a9fa7d3955f6fb0eb8293"}], 0x4}) setsockopt$inet_sctp_SCTP_I_WANT_MAPPED_V4_ADDR(r0, 0x84, 0xc, &(0x7f0000000580)=0x7fff, 0x4) ioctl$EVIOCGABS0(r0, 0x80184540, &(0x7f00000005c0)=""/67) ioctl$SNDRV_CTL_IOCTL_SUBSCRIBE_EVENTS(r0, 0xc0045516, &(0x7f0000000640)=0xfff) sendmsg$RDMA_NLDEV_CMD_GET_CHARDEV(r2, &(0x7f0000000740)={&(0x7f0000000680)={0x10, 0x0, 0x0, 0x20000000}, 0xc, &(0x7f0000000700)={&(0x7f00000006c0)={0x24, 0x140f, 0x14, 0x70bd27, 0x25dfdbff, "", [@RDMA_NLDEV_ATTR_CHARDEV_TYPE={0x9, 0x45, 'issm\x00'}, @RDMA_NLDEV_ATTR_PORT_INDEX={0x8, 0x3, 0x1}]}, 0x24}, 0x1, 0x0, 0x0, 0x4040001}, 0x4000000) ioctl$LOOP_CONFIGURE(r0, 0x4c0a, &(0x7f0000000780)={r0, 0x5, {0x0, 0x0, 0x0, 0x4, 0x2, 0x0, 0x12, 0x1b, 0x12, "9cbbfafba55cb922749cebed79b5c053fa96e32024b3f861983e868fa94399cb67b717f83cfb526c824b7b4dc5481af87a0e01423e5ef3b0a8f10b834a331c3a", "13d2258f22875df7ecc23a0b5b03f2618760b0159444724cf354763690a0188d865145930b261d052f52c76b5e27034b67b1e855e9652400ba56732286caa340", "d9a273e7853fe5f58aae680e7dc879296e67ccf478b5e2ace2e8f57729f6b98f", [0x19, 0x7ff]}}) ioctl$ifreq_SIOCGIFINDEX_wireguard(r0, 0x8933, &(0x7f00000008c0)={'wg0\x00'}) socket$nl_route(0x10, 0x3, 0x0) r4 = syz_usb_connect$hid(0x5, 0x3f, &(0x7f0000000900)={{0x12, 0x1, 0x200, 0x0, 0x0, 0x0, 0x8, 0x5ac, 0x252, 0x40, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x10, 0x80, 0xbd, [{{0x9, 0x4, 0x0, 0x2, 0x2, 0x3, 0x1, 0x2, 0x5, {0x9, 0x21, 0x3, 0x82, 0x1, {0x22, 0x29a}}, {{{0x9, 0x5, 0x81, 0x3, 0x20, 0x1, 0x4, 0x78}}, [{{0x9, 0x5, 0x2, 0x3, 0x20, 0x81, 0x4, 0x9}}]}}}]}}]}}, &(0x7f0000000b40)={0xa, &(0x7f0000000940)={0xa, 0x6, 0x101, 0x4, 0x9, 0x4, 0x10, 0xff}, 0x30, &(0x7f0000000980)={0x5, 0xf, 0x30, 0x2, [@wireless={0xb, 0x10, 0x1, 0x8, 0x91, 0x4, 0x3, 0x2e5, 0x3}, @ssp_cap={0x20, 0x10, 0xa, 0x1, 0x5, 0x9, 0xf, 0x4, [0xffc0c0, 0xff3f00, 0xff00, 0xc000, 0xff3f00]}]}, 0x6, [{0x3d, &(0x7f00000009c0)=@string={0x3d, 0x3, "a7f8ae704412d9950e46f6c543905c51fa964118dbc8966a9b19dbb3d343d06a50de76548f0632702b3bc9028a5afec87cf35874ec4dfc5f09c427"}}, {0x4, &(0x7f0000000a00)=@lang_id={0x4, 0x3, 0x2401}}, {0x35, &(0x7f0000000a40)=@string={0x35, 0x3, "8b18db47262ee463096e513a1e08752380ff2643ab03421ef4535dad2a92c8b786391b2d10fdb2b4929abcf18d414ec280ec7a"}}, {0x29, &(0x7f0000000a80)=@string={0x29, 0x3, "762aa9d1283c72f1aa1508eac850c3d89f6f39ec088b24945074e1e8b9bf80d81b07f07bff5c08"}}, {0x4, &(0x7f0000000ac0)=@lang_id={0x4, 0x3, 0x425}}, {0x4, &(0x7f0000000b00)=@lang_id={0x4, 0x3, 0x42a}}]}) syz_usb_control_io$hid(r4, &(0x7f0000000d80)={0x14, &(0x7f0000000bc0)={0x20, 0x24, 0x6a, {0x6a, 0x5, "7d356e76a23d9e0122d235d27aa1fbcc3d3507222c8c12b8378abdd9c109471f049270d59da1f10de05d3479f18349dbc366eaad4e37617c43d24fff70d494de2c9633fd28b630b9a480d6f5dfac761737ce1dc9a435fc954b14b00d01f507afd42436553f8127fa"}}, &(0x7f0000000c40)={0x0, 0x3, 0xb3, @string={0xb3, 0x3, "6c0ae22a6a4c1066f8d11707d9d526fec3389600068c715bef45702568da4d9d3eece3cb671c653c2a9a51748966907ea9c84831671c8a4d7a9aeee701fda45f48c40ddcf29c0c28bac8b6156205d61f7b0ab418673b4d1ed7c7f5c0f0b0836e00ee863f50fbd8c4e172f707276ef462d0b873225c293820e1c1e4e0b80afaa232dcfa201322b7d52db47c4ff7df481d741634c754a7713e0378209d4ffcbfc3189df993f8eb1d393ea51cd598e58c27bc"}}, &(0x7f0000000d00)={0x0, 0x22, 0x3, {[@global=@item_012={0x0, 0x1, 0x8}, @global=@item_012={0x1, 0x1, 0x5, "d6"}]}}, &(0x7f0000000d40)={0x0, 0x21, 0x9, {0x9, 0x21, 0x4, 0x6, 0x1, {0x22, 0xc85}}}}, &(0x7f0000001040)={0x18, &(0x7f0000000dc0)={0x20, 0x15, 0xa1, "e72b081fb2e6e947a8b0854dc2a8d3f149c186730762536a7f46329a2ff6df214fd86daaef9ea9d1ecb6e93ac7624f103f5b037c6fafee5168fed9f4fa57a00776b30c9c35e36bf2f7558f827263ab7360cad5803d73e782d05c56c239259a2cfd5da229423059821ad958328b94782dd11361b8c0fb26409dced8a9d5097c955a93c20a25c354cab5d7385cae93911aea214c4ff94d3e2d5653586b3e09ad4064"}, &(0x7f0000000e80)={0x0, 0xa, 0x1, 0x2}, &(0x7f0000000ec0)={0x0, 0x8, 0x1, 0x3}, &(0x7f0000000f00)={0x20, 0x1, 0xda, "4aa6ea6e5b67cfaa60f592fcb00ed2255496f633bef0f33e36f8cb36edc16e22d06adcc74f478fe5255bbe2b96f6fffee1432049183eb4932db4f1c0cc6705965602ec651bd0e8e1aa8af4a11fcee8513fa9f7681bcd629e48b4f240dabd30e72e938969a620d5b81e1a23528119ffdedb14754d982b3eec1144404f79b934884ff7ed795fb8cffcde4add3a32168bc93abe8e9365f8b3823d50d9d26ed327edd3049e6a3c56da6342e8d6010699a931c83c0400d2168987978fd2525d710d4ad0823cdfca23db1182ac28456314b6fec53d370c32cfc7d5fb67"}, &(0x7f0000001000)={0x20, 0x3, 0x1, 0xfb}}) r5 = openat$cgroup_ro(r0, &(0x7f0000001080)='blkio.throttle.io_service_bytes\x00', 0x0, 0x0) ioctl$sock_netdev_private(r0, 0x89f0, &(0x7f00000010c0)="301a95dda4622c4456cea437117d31af36140d0764273960a2b4cdfbb3b0e3eeba66cc24") socket$packet(0x11, 0x2, 0x300) setsockopt$inet_sctp_SCTP_RECVNXTINFO(r0, 0x84, 0x21, &(0x7f0000001100)=0xff, 0x4) fcntl$F_SET_RW_HINT(r5, 0x40c, &(0x7f0000001140)=0x5) pwrite64(r0, &(0x7f0000001180)="fbe03b6ab19b07770bddd45128d24bccc80ec3f66e9eaa42e065766e1e6ad4b7d21972987305b608b8d910b32d5ea827937a9a180fc42b918fef07f37e470b97d1bd2cb4353a4aa22885209243d4ff0dbe1d223f220cf36e23c4ae6d9b7a89c27707346af406dec26c8254512f99a8efe7cf69cdacfe3896630dc663c63e2041b47ce2bd193dfa41908d67e0dd86bc1252b8ebe73d2385a7d58888eaed5c7955a78a5a88f1a701159736464e9d6e286ddc5b26e94a03fd884c20711d90fd58b886653237bdcf7d0ebde310e1bc93f464bff3be087a99c6f2c37ab8051ba93ef67fb788857c0da7", 0xe7, 0x589) syz_open_dev$video4linux(&(0x7f0000001280), 0x2, 0x40001) r6 = syz_usb_connect$sierra_net(0x6, 0x3f, &(0x7f00000012c0)={{0x12, 0x1, 0x200, 0xff, 0xff, 0xff, 0x40, 0x1199, 0x68a3, 0x0, 0x1, 0x2, 0x3, 0x1, [{{0x9, 0x2, 0x2d, 0x1, 0x1, 0x0, 0x80, 0xfa, {{0x9, 0x4, 0x7, 0x0, 0x3, 0xff, 0x0, 0x0, 0x0, "", {{0x9, 0x5, 0x9, 0x2, 0x10, 0x9, 0x1, 0x7f}, {0x9, 0x5, 0x0, 0x2, 0x8, 0x3, 0x6, 0x8}, {0x9, 0x5, 0xb, 0x3, 0x3ff, 0x2, 0x8, 0xcd}}}}}}]}}, 0x0) syz_usb_control_io$sierra_net(r6, &(0x7f0000001440)={0xc, &(0x7f0000001300)={0x20, 0x23, 0xf9, {0xf9, 0x31, "d75aa345217b38472d3b26b6dda12687224f9f9e65abf7db73c979998f9e84ccb3a7ac2f64fa6a16ccaf63b455b4e225274fa8934f2a26f987ad6f32b9b329607928be13e11f807954720844901f1fab08380036386bf72c42eb61d770e2ce3564eb562d0733256b0f1ffdb921e9c349786d3b3eea3891ebdd1702f4b4b39bd08bdd1f255f2a3ae2a393dd3e5e822472de6d94abdc48da427f1f930d02b3288e47b343fd1af1b5e961f7bd9fc3d98d87bce05a9bb7685b103363d9ce0a14cbc26d4d635e55fc3688ebbae2efbf9d6ac58c2acc2f3aa4ee7e1a149ba7f75f17076427dc82433db742228504f41451e40f3a54ee08d16505"}}, &(0x7f0000001400)={0x0, 0x3, 0x4, @lang_id={0x4, 0x3, 0x480a}}}, &(0x7f00000019c0)={0x10, &(0x7f0000001480)={0x0, 0x5, 0xb7, "f81e67c2f0cd3cb8263241ff074bdae43b494e1a9de9b8ae29d7886b62d06d17d7a91c9e71d361659f440c3e52cff6f829b3efe34471e8b55c1d941c4b5cdccd343cecd8805d2808e8fd43e6d6c75a7429c70f92d7a1cde236a48d8f50b1c59dae020fe9e1cd1346452d66fb9d86de96a7a6d69b3158227b0dbd38c0659fede2102df1771537a816072c507adad92bdbccaa924e3a947ef5e045638fa090b09d000ce015ace57bbbe96fc4a644089e5b57cef246af9e63"}, &(0x7f0000001540)={0xa1, 0x1, 0x400, "d3ad1cdfeab353c14124d5e8da63a3a9b1b9a79a498063e1ca6f1ef0d9628f2f6dc5ea0a78b7029339e5101e021890a79b990f7ddfe73fcab6252767a97bcc43c705b4495870881fc036141ff02ad7df57e70fdbfb44833d37d3bed402e01daa161fe5f2e4148757927d01657c48e2a538ca3a29a03f161dcf3c919e5e4fcdcf8a2407d6b7ce881ca4c1364d47f28c6383590fea267d2514477bc67ea440302b7e0c8da4fb9bb0ea5e32760678d912185708e94063227bb5b79610320db05bfa165e51db9379cccd2544c4a84da20744e6309859a00b71a619352918c7978180c2821f694afb78b2cb4e70cceaed0c884ff07701936b3671cb6bd9edaee1557fe3a4fd2a881fa0465f81ee899ca83c0b65d6a2d0938583de9e614a34131545473c8ff7051c6ef3414e5e1afa38b4a40f4e00d2edbea04549467de22a10b801f19f5938d3576c6ffcaa10c1dfd0058cffa6a1d4be5e2433f56d2394691b27b2c29a3ad7cf78660910670302f878f05f38beb2c6dd52fb1beb7e6f0044a2338b042a3dbe4e7a854e5071be45630463b00538dd5ae5b0c472af931b9697c750719d0eea05f2e244e4e70515b77fa5d6813032cae671e045eacb8748ea242f4f627d7a277500170d3f19278bf775d152bd9a4ce55449054769af11972d79046a362390420c668dddf84926765d3101c5da68578add9393120a0b896c1c53038e7a9bd800b515b0957b1f52987e2032db47501c6a8394d12ff63b77b7a46a9759e1fd7104c384e1c077fbf4d509613c4065bf2115bad2d2c601417be3dd10da7e1833afdfb170eeca815af62cf89e14807ca836a8f7942a265eb6ac4974d82ffe5360adc380be72b1e6741a420c6eccbed0647b41d5204fdb47d48085f3dc5a0820ccfda9bd3f94548f55d08e8e025d33db269e3aba9d36ba4f05769926efdfd0a7770bec27b35538e432e5a83b87c29e30c9841dc5013666811cbac3e9ba5fc280984f18bdcb85679c7d4888ad666d12f49b47b55016402e2a0e56b82955c49e2248be53bc0c188e630d7148e4746b91cdba7d9f2c33e3b3f13fc4ecf5027231f15974e42ed82e43fd693dff73942d15a6d1a4c24118372b4b33b562cb8cd08ed55daf6e46160e9efc1b803b5ff10c9e9ec72d095d6390526691301eeed1f9bdc02842407e05cd4a79cc90ecb0c7fde706672427e144dc243c4cc5d01aa67f69ff604d34d280b4cb6dbd389ad210806b0ab8374f931344f69084d664771f8412060cf37347f18e421d96339b802c90ff176fcdd0967bdfd99ed5d2b3b99eba5e257a7fd60e120aa6b6f9153878f6f46bd04d19dfab85d8892e5156791257ae7561ca035bec3e674077e91fbdbc62aabffb3f4a16f60fc6a1521bec48cd5099f8161fd80603ca9c8e7f9ccd9b1c2db975a45a2519386cd08b3df72907e0abc4dc2edc"}, &(0x7f0000001980)={0x21, 0x0, 0x2, "77c8"}}) ioctl$LOOP_GET_STATUS64(r0, 0x4c05, &(0x7f0000001a00)) ioctl$vim2m_VIDIOC_QBUF(r0, 0xc04c560f, &(0x7f0000001b80)=@multiplanar_mmap={0x80000000, 0x2, 0x4, 0x2000, 0x4, {0x0, 0xea60}, {0x5, 0x0, 0xb, 0x0, 0x0, 0xa, "bcfad475"}, 0x6, 0x1, {&(0x7f0000001b00)=[{0x7f, 0x7, {0xfffffff9}, 0x3}, {0x7, 0x1, {0x2}, 0x1000}]}, 0x80000001, 0x0, r0}) r7 = openat$full(0xffffff9c, &(0x7f0000001c00), 0x80000, 0x0) ioctl$KVM_SET_MSRS(r7, 0x4008ae89, &(0x7f0000001c40)={0x3, 0x0, [{0xb55, 0x0, 0xa699}, {0x3fc, 0x0, 0x80}, {0x95f, 0x0, 0xe66}]}) syz_open_dev$sndpcmp(&(0x7f0000001c80), 0xb, 0x2) ioctl$SNDRV_CTL_IOCTL_ELEM_REPLACE(r7, 0xc1105518, &(0x7f0000001d00)={{0x5, 0x5, 0xb25, 0x10001, 'syz0\x00', 0x1}, 0x6, 0x10, 0x7ff, 0x0, 0x5, 0x3, 'syz0\x00', &(0x7f0000001cc0)=['{,^^]\x00', '\x00', '(\x1a)%\x00', '\x00', '\x00'], 0xe}) 3.15328027s ago: executing program 5 (id=1756): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000100), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x2}) r1 = openat$tun(0xffffffffffffff9c, &(0x7f0000000400), 0x0, 0x0) close(r1) r2 = socket$nl_generic(0x10, 0x3, 0x10) syz_genetlink_get_family_id$tipc(&(0x7f00000000c0), r2) ioctl$SIOCSIFHWADDR(r1, 0x8914, &(0x7f0000002280)={'syzkaller0\x00', @multicast}) r3 = openat$tun(0xffffffffffffff9c, &(0x7f00000004c0), 0x100, 0x0) close(r3) r4 = socket$unix(0x1, 0x1, 0x0) r5 = socket$nl_route(0x10, 0x3, 0x0) ioctl$sock_SIOCGIFINDEX(r4, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r5, &(0x7f0000000000)={0x0, 0x0, &(0x7f0000000180)={&(0x7f0000000300)=@newqdisc={0x78, 0x24, 0x4ee4e6a52ff56541, 0x0, 0x0, {0x0, 0x0, 0x0, r6, {0x0, 0xb}, {0xffff, 0xffff}, {0xfff3, 0xe}}, [@qdisc_kind_options=@q_netem={{0xa}, {0x48, 0x2, {{0x100, 0x7, 0x6361, 0x5, 0xfffffff9, 0x40000006}, [@TCA_NETEM_SLOT={0x2c, 0xc, {0xba, 0x4, 0x9, 0x8, 0x8, 0x8}}]}}}]}, 0x78}, 0x1, 0x0, 0x0, 0x2000c040}, 0x4880) sendmsg$nl_route_sched(r5, &(0x7f0000000080)={0x0, 0x0, &(0x7f00000001c0)={&(0x7f0000000140)=@newqdisc={0x40, 0x24, 0x4ee4e6a52ff56f41, 0x1070b923, 0x80000, {0x0, 0x0, 0x0, r6, {0x0, 0xe}, {0x8, 0xb}, {0xd, 0xb}}, [@qdisc_kind_options=@q_hhf={{0x8}, {0x14, 0x2, [@TCA_HHF_QUANTUM={0x8, 0x2, 0x8}, @TCA_HHF_HH_FLOWS_LIMIT={0x8, 0x3, 0x5}]}}]}, 0x40}}, 0x10) ioctl$SIOCSIFHWADDR(r3, 0x8922, &(0x7f0000002280)={'syzkaller0\x00', @random="2b0100004ec6"}) 2.957470305s ago: executing program 8 (id=1757): r0 = socket$packet(0x11, 0x3, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f0000000200)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r3, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r1], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) sendto$packet(r0, &(0x7f0000000240)="3f6dc38a8d4e715114c3888479ec07e15fb1c5fc5bcd5758129d88fa61ec4d05610319a1341a60557523", 0x2a, 0x8040, &(0x7f0000000180)={0x11, 0x8100, r3, 0x1, 0xa2}, 0x14) 2.702385731s ago: executing program 8 (id=1758): mmap$IORING_OFF_SQ_RING(&(0x7f0000400000/0xc00000)=nil, 0xc00000, 0x0, 0x50, 0xffffffffffffffff, 0x0) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) syz_genetlink_get_family_id$ethtool(0x0, 0xffffffffffffffff) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000080)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x2, 0x7ffc0002}]}) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket(0x10, 0x80002, 0x0) socket$nl_generic(0x10, 0x3, 0x10) sendmmsg$inet6(0xffffffffffffffff, &(0x7f0000000040), 0x0, 0x0) r3 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) writev(r3, &(0x7f0000000000)=[{0x0}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e", 0xb61}], 0x2) r4 = socket$kcm(0x10, 0x2, 0x4) sendmsg$inet(r4, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000000100)="4c00000014006b03000000d86e6c1d001000250002000f2c000017d34460bc24feb556a705251e6182949a369f3d3b48dfd8cdbf9367b4fa51f60a64c9f4d4938037e786a6d0bdd700000000", 0x4c}], 0x1, 0x0, 0x0, 0x1f00c00e}, 0x0) ioctl$BTRFS_IOC_SUBVOL_GETFLAGS(r0, 0x80089419, &(0x7f0000000140)) bind$netlink(r2, &(0x7f0000000180)={0x10, 0x0, 0x25dfdbfe, 0x40}, 0xc) ioctl$TUNSETIFF(0xffffffffffffffff, 0x400454ca, &(0x7f0000000040)={'veth0_to_team\x00', 0x7133}) r5 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r5, 0x8933, &(0x7f0000000100)={'syzkaller0\x00'}) r6 = gettid() timer_create(0x0, &(0x7f0000533fa0)={0x0, 0x21, 0x800000000004, @tid=r6}, &(0x7f0000bbdffc)) timer_settime(0x0, 0x0, &(0x7f0000000080)={{0x0, 0x989680}, {0x0, 0x989680}}, 0x0) r7 = openat$uinput(0xffffffffffffff9c, &(0x7f00000000c0), 0x2, 0x0) write$uinput_user_dev(r7, &(0x7f00000024c0)={'syz1\x00', {}, 0x3, [0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x1003, 0x0, 0x0, 0x0, 0x40, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x100, 0x0, 0x4, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x2, 0x0, 0x0, 0x0, 0x3, 0xe, 0x721a2d63, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0xffffffff, 0x0, 0x6], [0x2, 0x0, 0x0, 0x0, 0x10000003, 0x0, 0x8, 0x7f, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xb72, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x289, 0x0, 0x0, 0x0, 0x10001, 0x0, 0x0, 0xffffffff, 0xa46, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8003, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x200000, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x5], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x80000, 0xfffffffe, 0x0, 0x0, 0x3, 0x0, 0x655, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x10], [0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1000008, 0xc7, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x749, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x10000, 0x0, 0x2, 0xfffffffe, 0x0, 0x0, 0x0, 0x400]}, 0x45c) ioctl$UI_DEV_SETUP(r7, 0x5501, 0x0) r8 = socket$inet(0xa, 0x801, 0x84) connect$inet(r8, &(0x7f0000004cc0)={0x2, 0x0, @remote={0xac, 0x14, 0xffffffffffffffff}}, 0x10) listen(r8, 0x8) 2.636949688s ago: executing program 5 (id=1759): socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r0, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r1, 0x0, 0x0, 0x0) recvmmsg(r0, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) setsockopt$IPT_SO_SET_REPLACE(0xffffffffffffffff, 0x0, 0x40, &(0x7f0000000080)=@raw={'raw\x00', 0x8, 0x3, 0x280, 0x128, 0x11, 0x148, 0x0, 0x10, 0x1ec, 0x2a8, 0x2a8, 0x1ec, 0x2a8, 0xac, 0x0, {[{{@uncond, 0x10, 0xcc, 0x128, 0x1c, {}, [@common=@ttl={{0x24}, {0x1, 0x3}}, @common=@unspec=@statistic={{0x38}, {0x1, 0x0, 0x96, 0xffff8733, 0x7, {0x800}}}]}, @common=@inet=@HMARK={0x24, 'HMARK\x00', 0x0, {@ipv4=@multicast1, [0xffffffff, 0xff, 0x63ed1e6f422d753a, 0xffffff00], 0x4e20, 0x4e26, 0x4e21, 0x4e20, 0x5, 0x6, 0x8, 0x7, 0x3}}}, {{@ip={@private, @rand_addr=0x64010100, 0xff, 0x0, 'wlan0\x00', 'ip_vti0\x00', {}, {}, 0x6}, 0x0, 0x9c, 0xc4, 0x0, {}, [@common=@addrtype={{0x2c}, {0x854, 0x90, 0x1, 0x3}}]}, @common=@inet=@SET1={0x28, 'SET\x00', 0x1, {{}, {0xffffffffffffffff}}}}], {{'\x00', 0xc8, 0x70, 0x94}, {0x24}}}}, 0x2dc) syz_genetlink_get_family_id$batadv(&(0x7f0000000000), 0xffffffffffffffff) sched_setattr(0x0, &(0x7f0000000280)={0x38, 0x5, 0x8, 0x8001, 0x0, 0x9, 0x0, 0xfffffe0000000001, 0xfa11, 0xffffffff}, 0x0) r2 = socket$can_raw(0x1d, 0x3, 0x1) getsockopt$CAN_RAW_FILTER(r2, 0x65, 0x1, 0x0, &(0x7f0000000000)=0x56) r3 = socket$l2tp6(0xa, 0x2, 0x73) madvise(&(0x7f0000a93000/0x4000)=nil, 0x4000, 0x80000000e) mremap(&(0x7f0000a96000/0x1000)=nil, 0x1000, 0x800000, 0x3, &(0x7f0000130000/0x800000)=nil) mlock(&(0x7f0000000000/0x800000)=nil, 0x800000) mremap(&(0x7f000054e000/0x1000)=nil, 0x1000, 0x3000, 0x3, &(0x7f000022c000/0x3000)=nil) r4 = socket$nl_generic(0x10, 0x3, 0x10) r5 = syz_genetlink_get_family_id$devlink(&(0x7f0000000380), r3) sendmsg$DEVLINK_CMD_RATE_NEW(r4, &(0x7f0000000400)={&(0x7f0000000040)={0x10, 0x0, 0x0, 0x80}, 0xc, &(0x7f00000003c0)={&(0x7f0000000580)=ANY=[@ANYBLOB="e4e5f63d0c5a57dbb1104b00e3ff", @ANYRES16=r5, @ANYBLOB="02002abd7000fddbdf254c0000000e0001006e657464657673696d0000000f0002006e657464657673696d3000000c00a7000500000000000000a400a90056596f794abb826306d131a35e9998e48cff78e997fb7a8d470ce930fb4ed91ccf7029bf8e77cca075c348644de0e75c0cd8671d9d54703fbba2bd664e4682c06bce88178225f12b9b258133c90ff5192bfbe1e92063929191d162c62a7fa10eeec5635949159a073c5018fec9544ec58c5e21187ab7ff2c4052aba7b80be572d56a1cdfed710b5bfb2b75216f75cddee1111ac2341ec7a6a7739b817e6d2340"], 0xe4}, 0x1, 0x0, 0x0, 0x8}, 0x40) bpf$BPF_BTF_LOAD(0x12, 0x0, 0x0) mmap(&(0x7f0000000000/0xff5000)=nil, 0xff5000, 0x1000002, 0x200000005c831, 0xffffffffffffffff, 0x0) bpf$PROG_LOAD(0x5, 0x0, 0x0) remap_file_pages(&(0x7f0000800000/0x800000)=nil, 0x800000, 0x0, 0x0, 0x0) r6 = socket(0x10, 0x3, 0x0) r7 = openat$ppp(0xffffffffffffff9c, &(0x7f00000000c0), 0x0, 0x0) sendmsg$nl_route(r6, &(0x7f0000000040)={0x0, 0x0, &(0x7f0000000000)={&(0x7f0000000100)=ANY=[@ANYBLOB="400000001000030400"/20, @ANYRES32=0x0, @ANYBLOB="00000000000000001800128008000100707070000c00028008000100", @ANYRES32=r7, @ANYBLOB='\b\x00\n\x00', @ANYRES32], 0x40}}, 0x0) preadv(r7, &(0x7f0000001380)=[{&(0x7f0000000080)=""/64, 0x40}], 0x1, 0x9, 0x401) madvise(&(0x7f0000000000/0x600000)=nil, 0x600002, 0x9) syz_open_dev$video(&(0x7f0000000440), 0x8, 0x0) fsopen(&(0x7f0000000240)='jfs\x00', 0x1) 2.016443861s ago: executing program 0 (id=1760): bpf$PROG_LOAD(0x5, &(0x7f0000000200)={0xc, 0xe, 0x0, 0x0}, 0x94) r0 = syz_io_uring_setup(0x10d2, &(0x7f0000000480)={0x0, 0x7734, 0x80, 0x0, 0x34f}, &(0x7f00000000c0)=0x0, &(0x7f0000000080)=0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r1, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) mprotect(&(0x7f0000000000/0x800000)=nil, 0x800000, 0x5) syz_io_uring_submit(r1, r2, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x61, 0x4007, @fd=r0, 0x9, &(0x7f0000000140)=[{&(0x7f0000000100)}, {&(0x7f00000002c0)=""/196, 0xc4}], 0x2, 0x19}) io_uring_enter(r0, 0x47bc, 0x0, 0x0, 0x0, 0x0) mmap(&(0x7f0000000000/0x400000)=nil, 0x400000, 0x2, 0xc3072, 0xffffffffffffffff, 0x200000) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r3, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r4, &(0x7f00000bd000), 0x318, 0x0) recvmmsg(r3, &(0x7f00000000c0), 0x10106, 0x2, 0x0) 1.675118368s ago: executing program 5 (id=1761): r0 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000006c0), 0x2}}, 0x20) fsopen(&(0x7f0000000040)='cifs\x00', 0x1) r1 = syz_open_dev$dri(&(0x7f0000000080), 0x1, 0x0) ioctl$DRM_IOCTL_SET_CLIENT_CAP(r1, 0x4010640d, &(0x7f0000000000)={0x3, 0x2}) ioctl$DRM_IOCTL_MODE_GETPLANERESOURCES(r1, 0xc01064b5, &(0x7f0000000140)={&(0x7f0000000100)=[0x0], 0x1}) ioctl$DRM_IOCTL_MODE_OBJ_GETPROPERTIES(r1, 0xc02064b9, &(0x7f0000000300)={&(0x7f0000000240)=[0x0, 0x0, 0x0, 0x0], &(0x7f0000000200), 0x4, r2}) syz_usb_connect(0x2, 0x24, &(0x7f0000000280)=ANY=[@ANYBLOB="9a0f2bb173621201100331872c08ca0768a89c2a0102030109021200010900e008090408b369f55e14f556ed3bff532770e156d13514ccc5b2b61eb2885781936e323ab1fb6ee1043d0b31f7c34ad5"], &(0x7f00000007c0)={0x0, 0x0, 0x0, 0x0}) ioctl$DRM_IOCTL_MODE_ATOMIC(r1, 0xc03864bc, &(0x7f0000000500)={0x200, 0x1, &(0x7f0000000180)=[r2], &(0x7f0000000200), &(0x7f0000000580)=[r3], &(0x7f0000000040)}) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000b40), 0x106}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000900), 0x111}}, 0x20) r4 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r0, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000780), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100), 0x111}}, 0x20) writev(r0, &(0x7f0000000000)=[{&(0x7f0000000080), 0x62}, {&(0x7f0000000100)="06010000246837f73199aee6fdb9291b3091ec1a06000000975ad8ec030f5919f397867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1efbd46f600dc964231e3257bf358448fddf894c0cdfa9115adbe5b19bc912fcbc8aac7719b649b1ff1267491da", 0x682c}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e7c13bd62f221ae1ac04dca3d8d58a13c130557ecf5f36184c7366d3852d0cbd6ca42f2a971d87c0bb204097af1a3abdab7b95d07fcdbf5f42607695dedcd26e30b8fc5cfd7b333a95f3ee69d5ba7911dadb1394285c437a0f26fc027737ba5ee7d63333f80acb59f1a7faf2ec3031c6533107502bffc92d8726a48ce00cdb5f1258d85ff8eb72bfb162e122022f1f3e8a72b41d2689d5228b1130fbc946384401f3bbe726314bb09d430333ad78de07b3cec5c18a4f4abb69507b6451ca4e610b8fc988c983426e0cc3b9d15393026eb75d3d08634b8a7495cef69aab83d27ea1b5b41f40b996dd10023d81f77d61192930ffc25cae1e149412322fcb0aa47bee3afc44ec3dda96c9294854e2cbaebfea6f9a90f0b3797d5f505824b4de964151569f881f87f9dd9d30a2a2f9ed01059a909cba157902903c77f2f3d056231e7c7483a3f35e04360e084f0d3f94a92c92c77b3f06479fbc417366d7fe87ddfcdfd86274f87a5f817b0f947924cbe2329f16f6b00c8a0ab96164f7b35fed38a388380af05c3600abc37a944c9e75a691728c26896ac3615297766f406aeb0f2fd147d68fad3fb3b032880280ebb4bf89252a36b0d9eb393daae72829b8da870b886676244897d5322b32703fcf138b66eedeb3024666a88fd99d8962f696ab7b34e19ced1bd27488aa2ffe5bfa11f8f9289bd8c052d4e88316cc33b0255ef1bfca4c17067d7f78175c56db481fe8dc6f73b1cbdf9d5823f115c9e03f2dfd07bc1ad88564d48b18cd9a30d83cbd5e6a3eedcb0ee86e5dd47f32820cb74dcf730b2052b31297b529e5e24f042335d13915e4048132fe1a101841e919c7870bb680eddead9a6111394bc12e274fbd88abaf2d254721c42e82abf4d1e319a631794ed6ce319ddd844ac5e9b1fc96dd9aaad42f2e087abe1b85430c4a00631970e3e74a6ed923f49e0df75685e044fae3fcea0af4dbfeebe0a9c2e73e8a89b89603a75f585e3ebba5453ae595da1469ea90ea3c9fb6a22411c56c58dfbf504caa629dbfc73ebbedc91669f2babf8b8215c525edf8feb366f104ffa9eb2bb79232660aece4730ef1ae8585c629ffe1390356a58e900da145b83ad177c7bb2d125e59d7ff4d3a8562efc620b4cf9b33c2305bbf1957e0f8b06f0fbe9c80db73b08fdd0be4a1ea4f91f52af47160040424aed8ac3c10251fb0b5d9be08247edf3dda5d1750d0597d60c8a0d9418a4e0c9325bb90f0886f9e5dda9e88ac1942ec1e53da0cf5ccad66b9cdfc2fdca784dd06a73713ef73785706d024873ddca5ccfcf0b91748a2c1fbd8c241934b5b473007b29d76aec5addf7b945a5f7abd6ddeccc8d0ccb26d69d4793b7224c27ba7bf45aac8a2be56086ab8c65ea69fdd593a01a29e2912378002d824bd98e6ed1c5dd5f33be529e640997f5f1bbde051fb2a669145966db4889bf32aa13777ac6c077c51bb8b2523954cea3adc307cfe53b8cbb00edf0c04c456392aea6613e8078a309dc538a6a24f80fc1b7f9fce3e3291ca6dab8090a634fcdb24e7a9de8aecd595b988f597cd623d148a8841b0a5203953166ea2e85316928f28dd2604d37c9ec80a49c0d91cbfe6d584b9b6a321b97bf99ae1d67985fd441976a828c97456003a7892c7c7f4a51bb49e3d3ea1e95ec29c89a2676", 0x1001}], 0x3) r5 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000440), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f0000000700)={0x0, 0x18, 0xfa00, {0x1, &(0x7f0000000580), 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000680)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000400), 0x106}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000b80)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000b40), 0x106}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r4, &(0x7f00000003c0)={0x0, 0x18, 0xfa00, {0x2, &(0x7f0000000900), 0x111, 0x1}}, 0x20) r6 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000040), 0x2, 0x0) bpf$MAP_CREATE(0x0, &(0x7f0000000bc0)=ANY=[@ANYBLOB="1a000000041000000000000001000000001d0008d4fcf55676c35718b9646d91c8417772181a40a53c0b0facab8f3fd480a4cf91816dcf17f3906b0ed964962e075307932c43c5db13d4a2b5fd964789b10ae5e8ceb3bde2fd0250a0ef76f5175dcfc369c491b1376c61fb902f2fdd371e40487467682a7363186fb29f0e18442deb8c02fcb9d919382fb05d2392085bdaf7347e54d38aed220030a50d61a7f3ccef729065f11b3a38eca8bba2e6ddb9e522bed4dce3d3591556f6077cc66ca0532eea85921e5869866e5f18aecf50a9d59ab11a99517904d7a9396a3997ef4ecaf5845151826fa8f93e1fa81ad4e2a04b9c4d21a3ca96d4", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000001f7500"/28], 0x48) r7 = openat$rdma_cm(0xffffffffffffff9c, &(0x7f0000000240), 0x2, 0x0) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000a00)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000009c0), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000000)={0x0, 0x18, 0xfa00, {0x0, &(0x7f00000000c0), 0x2}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r5, &(0x7f0000000200)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000780), 0x13f}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r6, &(0x7f0000000080)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000100), 0x111}}, 0x20) write$RDMA_USER_CM_CMD_CREATE_ID(r7, &(0x7f0000000640)={0x0, 0x18, 0xfa00, {0x0, &(0x7f0000000600), 0x13f}}, 0x20) writev(r5, &(0x7f0000000000)=[{&(0x7f0000000080), 0x62}, {&(0x7f0000000100)="06010000246837f73199aee6fdb9291b3091ec1a06160000975ad8ec030f5919f397867997f9c0efa9c9092a31cdbb98ea272787afda0af59a320709c3a59ef05c6f40ceafec53f48d6186e7d8409e35306221caf67b370d875eff3191932728e5ab6c9a3acf6ccee3e352c898f5744abaedfb53f92c37acb126bd143f3e9cdfcf25a8d6129fcc3a141c3f5ab6db772f87c787817a9b699dd60732d952716b103bc1e91ac5b1ed92f35389580994bb0df9bce07e7a80921888f984139f488d256a67fec0cbb5c4e93d5c151d97f676ab93b1efbd46f600dc964231e3257bf358448fddf894c0cdfa9115adbe5b19bc912fcbc8aac7719b649b1ff1267491da", 0x682c}, {&(0x7f0000001480)="d1ffacd516de50ac9d15bc75316da4defa1e72f65a65cdd26dcc389aacf7856da9aecf3765d4c032e1960faf25bad906b7d3440b6e71a82f1d8f8b8db35b6091f3af94c6b46b9ab10fe3923f268771078d2668be7bd3eb941d4bb5baa8547e36283a065ce5766cbff3a8fc37fc4507643d3786bbf231d3ed88cb8b01eab14e4372cf4f89bd1b853caa5d9f07f523b9dfa8cc09053ff36fde08e96fb6b3acc196b1bd1e2d3a6c65f585df7e2b8b17439a7ab29a7dfe642c2f0ac7a81eca8073b559663f2daf7a0832b2b09557794a21bf114831f8e6db3922d0cd169e5a8b4adc95d7322ee75944de15f57780b88fef7f3d9b256705ccfa2125b43ce8e3aacaead963cdd7f792f14c9b24493f9f830f6de8da93bbd4357095631adec14224dd9bb049e826f3a49624393e6a031103faff0902ba88ae30af4a61caa77ff956214196fcf3c5536d823284306f367afcb46fb43231911cc53091671e7d853ebf015241b18e9fb6ac6d9a7a1b05dfd6d9e56a51567cd8837dd045abf6b85550f0dd8dded43147ab9bfadc18b9984699d5d875cb21a95a7f584d8c466d033df75193f9ae58b85cfacc54f6c6e12a0debe40ee361a839563bc2cb64271672a55370c2b035b482074ce2487ef8a3bc1c68856e6e09539276d961a0c647f1ee3237496fc99623e8fd33faf7797d86a88dcee152d15e10739bcbbd6077b76867e291f350d999024c12faf81f83792f48f7f6dd66aa6854e460ef7f8c755f3a6dd76509ea0d2db39057a5129185b2fb11546cd5d6cc59f640e9028ae6c7075fba5e5b5593d7f79ec387833f465d09bde464112821eaec5e6e8f2aee8d7358f9c14afe2018856f610848706c71cda62493aef2e39efb71b4a8e804847eda66b2b5b1d75b478f19208ee1ac43afb2dbbba5dd0f29f6946022e09fb853cb176ca3474ba2fa67cb245fe85ec61a095d6fd9ac2ac5685920201617342fe56072427b9bd3626a1a371e67041fcda781be0c234d6feb5ad500e8bc7074381fd0d04983a4a6cdb6c8e03d59dc50925e9e4b24e6f8e455f02818959f2927f0a2d9ff62ec3c5c399077048f7d3dad0830b2e6563693f2f9d48eca8c34804a7626282a4a214d13786993c011a88194dbf7b23e25f592e62186c9fb565fac7632de356153c89a6be0b6b26ba48c2427424769fcbd7ee072ed4bd4d0731d06c8537d616b1145a6c70edb13fb4dba3565221b3a2897a23861cd0e8e0060021cdd7de002d5e785e5d6d3d07f4e445ada9c8d9ba8b819d0b5c7b5d15a5192d3a83c125c8e117c823a9e33316b8c9154e7330d3a865048dbd9c14757691bfe56f10423f6ab717bec5eebeac6ba9ad1aeb6cde09d7fda8e475a71ac48d46b8d9a40879c9dec2db5c4799e5fc8e8b3d419031c1033fce88ae2c93d7ca62c9302e6b45ca8dfebe5b92724f035e8e9d7704efb23f445999fe08cfa28404874d8acc8d37870d394d9fcc8dbe763bc85c37f0f3bcc2cbea420cd073db598e7d89c14a31e5bf57cbefa301427c93091505f1f3e5cdf712958b2e8fc56684d3388107c1728f0e5a3be2164246071653e256ed3bf3000c17301da9a5a3d9ca475867c4f311a24e5ae909a62047a9e6bb71cbcb4f159c2ef0f66b4d0f9da51aba99cd9448443dd277362af18d32f111c48a952ef555b2c7c58b997ce61e74cc7551b57eaffe411219baddf490926d8e260dcd87c069e617195c352950f9b51ce88c12c4f7997ba515f77e68d44f831cdf4d7ee8b1b7cedcb4c4fc7e85ba288c8555d49d5b4b9bb70dc4b688bd12e6b38e37150f3ea457a76b23d5abe6551ea598e090aed87822b0954b8db1a7c605c925b7f9240b0e7a020f292a1fd4a37c74139bc6e7ff08373ebfc8feea371ae0b6c61c715f6f1f4b0b994c7e2e129f87db959aae6ff48664d824b29ba9f255890f9c537178db9c5302097891557f8175a46f308b1a2530aa726ea9d4cfce76db50637369724d0c5f51c97edb58ff5eb9b2434b3721b61688ba12471b97c6a65ba085e15406568ac852590701f2ef8451c5cf1191d70f51eaea9ddc4cbdd7428f627db5069111f65062d5cc34581826af3e670613dda99e31c42736aabd87be56e214ed606862a152455f91891b7430bae03284569c234588f495a5ecc4a23fad6ba34e2ee9ebde8c7f5f62c9344659375c2a1fe6fa6e4ef68712223b9471c513bb11429dbb8a45463c8882f462275ee0da567c60c2d8038843e0c20486676e9978f2aec9187820c94a6e7e519d06daf2ab198f5cafcab4d9c90a479800906192d66a3301a34fa6c5a931cea0a479a4d98d86d9de3e061323504b57186dd33df7a16ccb688c0de203666cb0a6b543a9d069dded44a3b432cbb71da921dcab6be1c2d7494d3b07841d9b4f9d659b5d3d3b2ed916f91588d589128e4b2d4448e6aab5a8160eddca0f6e022abb85e251a11cd6bae57a09b2c434ab5bdf6264afb20d5ab022d152e345bd32ba9283aa5b3cd9118bd271a8ac9083c98b8a83064e65428f7ad7b35bf1d60d4e703f22d2d316fc12bd68bcced82cf0962a3d5769c6a3d75d59f7a7b76454661fd3574b8c8e26d20c372407854505ea6c2406fbd8a1ba7bb017c565228aa6d03d18ed309a308ffb1ecec73c246413e7c70f25070eafed9e70d22e9e8b44125c44eceff37e65bf073bc6fad1ea2b72675af4bf70586a8f7e0f35700de94c802522897576ed115fa21b3d23a367844520b33f5b9aedc0245096765f4cb3b2ff4e54f39bd7346c2347875d75a931b17c6c424ddb4767e0e63cc7725a8fc4b1dbe7929b2f909cc5be8b09e63330341e6471dcac0f8b44693d01805a1467b71612260e2a273861b3697440a5f75497796bffcf79d62a4a50a6ed5ef2efe8c83374f2ecd08d8d628aa03b01a11caeb2bdecc0ab2abcecfa15627979d7c3f9dec5389fc6625e957f8075e23e636dd5514596189d568e14d33ae518e6e9978c6a36a74b49fdbd1260095c9abe447e618878039b75e305b1d2c9ddeb9e5cedb11802e0833739d8595d57d749c890c9290cca4aa96e6718747543796a187e54a66c2f71beefddf911a7a74b59c48ba642d5ecd4d415f48dfbde5baac8a4ba063c1b985d9f9f3180e8a1c8b2cf6a25c2ff17688cc858ac8b9c67960f09a1ca5f28f8e877159e00fe7fb10cca73b391508895e7e52c22f9b38d73dabd6ff7c55ebf4e1611daee8d52b4ceee49a6df7daeb81bf9d1c943a74c03d3dda52c5b99f3225c1b87074f5cef6187878bc5b665ec0561adcc9781280dd1c6592555d327afea78b21beeeb66a0af3eab3249245f41cdbca309d3fba5d4b345319dd0a26134c0c896f2c8d32fda28600013f6a4c95b4038faba70d6c480b360c55bdc0595f7ca636e85521ba505d894f9c5f0a90719bc9944f386ad7491422ff12f34a3c048708d51305a8cc5b2a502ac1575a14c75e9fb7219ede2f6d9c1b362230b6189e0d8cd8ccd11fd0325182c6e46c9977bf63aa02f7024aeb4389f989f5733a198b45e4329c4c1a538a009f216ad3ac09cac39547b4fd21a5d7146ea307ad9b9339f39d5161d17b59860a0aed38cd89d1b68c6438346d51a3a283074e34ee01d2eca527b1b3836ccdf7e807007152c79d14324e3d887c9551a9447527db4434810f5b0b73d855f32a0c89aa784e43f4c1657d408dd33f88aeae1e5186bbcc2a348b708e3cec9080e12ee3676beb5ee86a9b5cc4a3496c242b95a248906ed62f984b22373bdfd97515441f34e01006d8d1244aa88403f207cd8820ffe07634fc86d00f871c1e4c9e8fc1a00d295e36d98119599b62379cda10ada85efe7b50c5f38d8d010a2cd53db900939db1ffce14feffb7940d12842f4f2b507e1fa49e526752d1e3d80a0c2a75e870d85f77fd91fc46ac1b1288dd33338cdad154d6b80b5a925431868d62a3fb0036f28fe259a3f555f767526a9ea230c33843efc49ac3182a357845ea122d606ab22c9f937b2b905e02dd1cb07d380e3486be6167f00b6e6d90a3c1d6aee15da439a55542ce177e498998ba8ac69a848e63e4c7564e4dc04aad595fa1ab81275edafa0d352029c304200d2f2c5881cbf5a26b2141bdb117879cc11e7c13bd62f221ae1ac04dca3d8d58a13c130557ecf5f36184c7366d3852d0cbd6ca42f2a971d87c0bb204097af1a3abdab7b95d07fcdbf5f42607695dedcd26e30b8fc5cfd7b333a95f3ee69d5ba7911dadb1394285c437a0f26fc027737ba5ee7d63333f80acb59f1a7faf2ec3031c6533107502bffc92d8726a48ce00cdb5f1258d85ff8eb72bfb162e122022f1f3e8a72b41d2689d5228b1130fbc946384401f3bbe726314bb09d430333ad78de07b3cec5c18a4f4abb69507b6451ca4e610b8fc988c983426e0cc3b9d15393026eb75d3d08634b8a7495cef69aab83d27ea1b5b41f40b996dd10023d81f77d61192930ffc25cae1e149412322fcb0aa47bee3afc44ec3dda96c9294854e2cbaebfea6f9a90f0b3797d5f505824b4de964151569f881f87f9dd9d30a2a2f9ed01059a909cba157902903c77f2f3d056231e7c7483a3f35e04360e084f0d3f94a92c92c77b3f06479fbc417366d7fe87ddfcdfd86274f87a5f817b0f947924cbe2329f16f6b00c8a0ab96164f7b35fed38a388380af05c3600abc37a944c9e75a691728c26896ac3615297766f406aeb0f2fd147d68fad3fb3b032880280ebb4bf89252a36b0d9eb393daae72829b8da870b886676244897d5322b32703fcf138b66eedeb3024666a88fd99d8962f696ab7b34e19ced1bd27488aa2ffe5bfa11f8f9289bd8c052d4e88316cc33b0255ef1bfca4c17067d7f78175c56db481fe8dc6f73b1cbdf9d5823f115c9e03f2dfd07bc1ad88564d48b18cd9a30d83cbd5e6a3eedcb0ee86e5dd47f32820cb74dcf730b2052b31297b529e5e24f042335d13915e4048132fe1a101841e919c7870bb680eddead9a6111394bc12e274fbd88abaf2d254721c42e82abf4d1e319a631794ed6ce319ddd844ac5e9b1fc96dd9aaad42f2e087abe1b85430c4a00631970e3e74a6ed923f49e0df75685e044fae3fcea0af4dbfeebe0a9c2e73e8a89b89603a75f585e3ebba5453ae595da1469ea90ea3c9fb6a22411c56c58dfbf504caa629dbfc73ebbedc91669f2babf8b8215c525edf8feb366f104ffa9eb2bb79232660aece4730ef1ae8585c629ffe1390356a58e900da145b83ad177c7bb2d125e59d7ff4d3a8562efc620b4cf9b33c2305bbf1957e0f8b06f0fbe9c80db73b08fdd0be4a1ea4f91f52af47160040424aed8ac3c10251fb0b5d9be08247edf3dda5d1750d0597d60c8a0d9418a4e0c9325bb90f0886f9e5dda9e88ac1942ec1e53da0cf5ccad66b9cdfc2fdca784dd06a73713ef73785706d024873ddca5ccfcf0b91748a2c1fbd8c241934b5b473007b29d76aec5addf7b945a5f7abd6ddeccc8d0ccb26d69d4793b7224c27ba7bf45aac8a2be56086ab8c65ea69fdd593a01a29e2912378002d824bd98e6ed1c5dd5f33be529e640997f5f1bbde051fb2a669145966db4889bf32aa13777ac6c077c51bb8b2523954cea3adc307cfe53b8cbb00edf0c04c456392aea6613e8078a309dc538a6a24f80fc1b7f9fce3e3291ca6dab8090a634fcdb24e7a9de8aecd595b988f597cd623d148a8841b0a5203953166ea2e85316928f28dd2604d37c9ec80a49c0d91cbfe6d584b9b6a321b97bf99ae1d67985fd441976a828c97456003a7892c7c7f4a51bb49e3d3ea1e95ec29c89a2676", 0x1001}], 0x3) 1.01413873s ago: executing program 0 (id=1762): r0 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) ioctl$TUNSETIFF(r0, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r1 = socket(0x400000000010, 0x3, 0x0) renameat2(0xffffffffffffffff, 0x0, 0xffffffffffffffff, 0x0, 0x9f93a01936cca86c) write$cgroup_int(0xffffffffffffffff, &(0x7f0000000280)=0xd, 0x12) r2 = socket$unix(0x1, 0x1, 0x0) socket$inet6_sctp(0xa, 0x801, 0x84) r3 = openat$tun(0xffffffffffffff9c, &(0x7f0000000240), 0x0, 0x0) r4 = socket$netlink(0x10, 0x3, 0x0) bind$netlink(r4, &(0x7f0000514ff4)={0x10, 0x0, 0x0, 0x2ffffffff}, 0xc) ioctl$TUNSETIFF(r3, 0x400454ca, &(0x7f0000000040)={'syzkaller0\x00', 0x7101}) r5 = syz_open_procfs(0xffffffffffffffff, &(0x7f0000000040)='setgroups\x00') ioctl$IOCTL_VMCI_CTX_SET_CPT_STATE(0xffffffffffffffff, 0x7b2, &(0x7f0000001680)={&(0x7f0000000680)=[0x100000, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffff00, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x70, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x3, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80000001, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8f1, 0x0, 0x40000000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x400, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xe, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6680, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x80, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x7fc, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x401, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x1, 0x0, 0x29, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x44, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x3, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xc80, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x20000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x0, 0x0, 0x0, 0x10000000, 0x1000, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0xcf, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200004, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000000, 0x0, 0x3ff, 0x0, 0x0, 0x0, 0x0, 0x7, 0x800, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x8, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x800000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x7, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x5, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x9, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x200000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x101, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffe, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x1, 0x0, 0x0, 0x0, 0x0, 0x0, 0x389, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x4, 0x0, 0x0, 0x0, 0x6, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x10000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x8000, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xffffffff, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x0, 0x0, 0x0, 0x0, 0xfffffffd, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x2, 0x2, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0xfffffffc, 0x4], 0x1, 0x400}) openat$sequencer(0xffffffffffffff9c, &(0x7f0000000040), 0xa842, 0x0) r6 = syz_open_dev$sndmidi(0x0, 0x2, 0x141101) dup(r6) openat$vga_arbiter(0xffffffffffffff9c, &(0x7f0000000000), 0x80082, 0x0) ioctl$sock_ipv6_tunnel_SIOCDEL6RD(r5, 0x89fa, &(0x7f0000000200)={'sit0\x00', &(0x7f00000001c0)={@mcast1, @loopback, 0x6, 0xd}}) r7 = socket(0x400000000010, 0x3, 0x0) r8 = socket$unix(0x1, 0x1, 0x0) ioctl$sock_SIOCGIFINDEX(r8, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r7, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2a, 0xffffffff, {0x0, 0x0, 0x0, r9, {0x0, 0xfff1}, {0xffff, 0xffff}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8}}]}, 0x38}}, 0x0) ioctl$sock_SIOCGIFINDEX(r2, 0x8933, &(0x7f0000000100)={'syzkaller0\x00', 0x0}) sendmsg$nl_route_sched(r1, &(0x7f00000012c0)={0x0, 0x0, &(0x7f0000000080)={&(0x7f00000005c0)=@newqdisc={0x38, 0x24, 0x4ee4e6a52ff56541, 0x70bd2d, 0xffffffff, {0x0, 0x0, 0x0, r10, {0x0, 0xfff1}, {0xffff, 0xffff}, {0x1, 0xf}}, [@qdisc_kind_options=@q_multiq={{0xb}, {0x8, 0x2, {0x28}}}]}, 0x38}}, 0x0) 781.571342ms ago: executing program 8 (id=1763): r0 = socket$packet(0x11, 0x2, 0x300) r1 = socket$nl_route(0x10, 0x3, 0x0) r2 = socket(0x10, 0x803, 0x0) sendmsg$nl_route(r2, &(0x7f00000006c0)={0x0, 0x0, &(0x7f0000000680)={0x0, 0x18}}, 0x0) r3 = socket$inet6(0xa, 0x8000000000080001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x0, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_MCAST_JOIN_GROUP(r3, 0x29, 0x2a, &(0x7f0000000000)={0x1, {{0xa, 0x0, 0x0, @mcast2}}}, 0x88) setsockopt$inet6_MCAST_MSFILTER(r3, 0x29, 0x30, &(0x7f0000000180)={0x1, {{0xa, 0x4604, 0x7, @mcast1, 0xfffffffa}}, 0x1}, 0x8c) getsockname$packet(r2, &(0x7f0000000100)={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, &(0x7f00000001c0)=0x14) sendmsg$nl_route(r1, &(0x7f0000000140)={0x0, 0xffffffffffffff6e, &(0x7f0000000000)={&(0x7f0000000080)=ANY=[@ANYBLOB="5000000010008105e9c51c000000000000000000", @ANYRES32=r4, @ANYBLOB="01000000000000002800128009000100766c616e000000001800028006000100000000000c0002000c0000000d00000008000500", @ANYRES64=r1], 0x50}, 0x1, 0x0, 0x0, 0x80}, 0x0) syz_usb_connect(0x0, 0x36, &(0x7f0000000240)=ANY=[@ANYBLOB="12015002858ba310fd0b0c01c4bb57020301090224000102fee00209047c640293ea4b0529050502080000020809050a020002040c00803017bc01001000000000006fedbc5d93a9e995bb097e9820d043fd6a24f25ce194aacf85c3fcc56abf76b96aec7a55fed8519cae8aec3aaa84d549886930a024bf52d1b51b1dd663aab6a03071ad0b72f6f4d1c1393fc01b44c4d9ac69c85af5b267a506f81305551f4c9219c1d3ccff646be4925c56c1d957123b0b93a36681860d608c2a4e575671bfb7d4a07e1d07122b8a4fcfbee051ec27d0a1b3c824598ed7c3892050f6d53eb691e22ed1321cafec376dce8a06eecc5158387e17aaa846fa2994615d4cc168b0dece0f4ff34d96eadc70848ec51f112fb82dfdb6b728d868719678702ff53a6e2cadeccd572ecafd3697d374263131c582a588ce07c59b2d85b39e79b22d1556f445aab593f72c93df58cebd123269d7863914fa81cd677133a253e6a7e8096d0a92be3cad3fb134cb8ca92c0d4b5b41c0c2f5d02dbeacfe556814ab79c69949c368ba6dd35f10a2f36b0dbdf75c62cf402f5a868f27a2aa5f3f5bb8ca2842240c7ddc8ec2d753285694f567a5510c261cd953a16ec3aea401e4631be23c9f7152a12b367e84797c93dfe337ed97202c6596ca56026eba73f8486d50bb2c6c9260e0a9187ec60e5875905aceff5830b015416f94082fe8d481f499d544b5ed2103cce7a8dd786c42dfb60f3cb58b3837618e9a470879d1ae9f665420e8029cafc3e92fbe73d89a16ed8d7c191e32ea8b4e8766fd2327920314edea49dbd193fc0ad77b1a2c2f6d24a639d05cbe15afb69ea8b6c3b936719f3d295b8fbca44cdd00c8c775f583a084fedf498cec0d6ad6f8c6a4447e41fd5e198a18ae12fead2c6a58115bf23c57c9e5ca98629570dd40a57e60a7590b62ea703a77e9083aa868cd2200"/686], &(0x7f0000000200)={0x0, 0x0, 0x0, 0x0}) sendto$packet(r0, &(0x7f0000000040)="3f6dc38a8d4e715114c3888479ec07e15fb1c5fcec4d05610319a1341a60557523000000000000000000", 0x2a, 0x40001, &(0x7f0000000180)={0x11, 0x19, r4, 0x1, 0x2, 0x6, @broadcast}, 0x14) 734.868546ms ago: executing program 0 (id=1764): socket$inet6(0xa, 0x2, 0x0) openat$drirender128(0xffffffffffffff9c, &(0x7f0000000040), 0x101800, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) timer_create(0x0, &(0x7f0000000080)={0x0, 0x11, 0x0, @thr={0x0, 0x0}}, &(0x7f0000000000)) r0 = socket$inet6(0xa, 0x80001, 0x0) setsockopt$inet6_MCAST_JOIN_GROUP(r0, 0x29, 0x2a, &(0x7f0000fca000)={0x100000001, {{0xa, 0x3, 0x0, @mcast1}}}, 0x88) setsockopt$inet6_group_source_req(r0, 0x29, 0x2f, &(0x7f0000000200)={0x1, {{0xa, 0x4e22, 0x0, @mcast1={0xff, 0x7}, 0xac3}}, {{0xa, 0x4e22, 0x0, @private2}}}, 0x108) timer_settime(0x0, 0x0, &(0x7f0000000240)={{0x0, 0x8}, {0x0, 0x9}}, 0x0) prctl$PR_SET_SECCOMP(0x16, 0x2, &(0x7f0000000180)={0x1, &(0x7f0000000040)=[{0x200000000006, 0x0, 0x0, 0x7ffc0002}]}) finit_module(0xffffffffffffffff, 0x0, 0x2) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x0, 0x810) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r3 = syz_io_uring_setup(0xbdc, &(0x7f0000000640)={0x0, 0xec25, 0x400, 0x1, 0x40000333}, &(0x7f00000006c0)=0x0, &(0x7f00000001c0)=0x0) sendmmsg(0xffffffffffffffff, 0x0, 0x0, 0x50) r6 = syz_io_uring_setup(0x43b9, &(0x7f00000006c0)={0x0, 0x42f5, 0x13408, 0x2, 0x330}, &(0x7f0000000340)=0x0, &(0x7f0000000280)=0x0) syz_io_uring_submit(r7, r8, &(0x7f00000002c0)=@IORING_OP_ACCEPT={0xd, 0x0, 0x5, r6, 0x0, 0x0, 0x0, 0x80800}) io_uring_enter(r6, 0x3516, 0xc2de, 0x8, 0x0, 0x0) syz_memcpy_off$IO_URING_METADATA_GENERIC(r4, 0x4, &(0x7f0000000180)=0xfffffffc, 0x0, 0x4) syz_io_uring_submit(r4, r5, &(0x7f0000000200)=@IORING_OP_READV=@pass_iovec={0x1, 0x0, 0x0, @fd_index=0x4, 0x0, 0x0}) io_uring_enter(r3, 0x847ba, 0x0, 0xe, 0x0, 0x0) 3.310806ms ago: executing program 1 (id=1765): r0 = openat$ttyS3(0xffffffffffffff9c, &(0x7f0000000000), 0x80000, 0x0) fcntl$setstatus(r0, 0x4, 0x42000) userfaultfd(0x801) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) connect$unix(r1, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r2, &(0x7f00000bd000), 0x218, 0x0) recvmmsg(r1, &(0x7f00000000c0), 0x10106, 0x2, 0x0) socket(0x22, 0x2, 0x24) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) ioctl$TIOCSPTLCK(r0, 0x40045431, &(0x7f0000000180)=0x1) sched_setattr(0x0, &(0x7f0000000100)={0x38, 0x5, 0x4, 0x0, 0x0, 0x8000000000000004, 0x0, 0xfffffffffffffffc, 0xfffffffe, 0x7}, 0x0) socket$inet_udp(0x2, 0x2, 0x0) listen(0xffffffffffffffff, 0x0) r3 = socket$inet_mptcp(0x2, 0x1, 0x106) bind$inet(r3, &(0x7f0000000080)={0x2, 0x4e24, @multicast2}, 0x10) writev(0xffffffffffffffff, 0x0, 0x0) shutdown(r3, 0x0) r4 = syz_open_dev$dri(&(0x7f0000000100), 0x1f, 0x0) ioctl$DRM_IOCTL_MODE_GETRESOURCES(r4, 0xc04064a0, &(0x7f00000001c0)={0x0, 0x0, &(0x7f0000000140)=[0x0], 0x0, 0x0, 0x0, 0x1}) ioctl$DRM_IOCTL_MODE_GETCONNECTOR(r4, 0xc05064a7, &(0x7f0000000a00)={0x0, 0x0, &(0x7f0000000000)=[0x0, 0x0, 0x0, 0x0, 0x0, 0x0], 0x0, 0x0, 0x6, 0x0, 0x0, r5}) r6 = socket$inet6(0x10, 0x3, 0x0) sendmsg(r6, &(0x7f0000000000)={0x0, 0x0, &(0x7f00000000c0)=[{&(0x7f0000001500)="5500000020007fafb72d13b2a4a2719302000000030b43026c26236925000400fe7f0000bd2dca8a9848a3c728f1c46b7b31afdc1338d509000000000100005ae583de0dd7d8319f98af84fda542e718f94b929ade", 0x55}], 0x1}, 0x0) syz_usb_connect(0x0, 0x36, 0x0, 0x0) r7 = socket$nl_generic(0x10, 0x3, 0x10) r8 = syz_genetlink_get_family_id$devlink(&(0x7f0000000040), 0xffffffffffffffff) sendmsg$DEVLINK_CMD_TRAP_POLICER_GET(r7, &(0x7f00000007c0)={0x0, 0x0, &(0x7f0000000780)={&(0x7f0000000280)=ANY=[@ANYBLOB='<\x00\x00\x00', @ANYRES16=r8, @ANYBLOB="01000000000000000000450000000e0001006e657464657673696d0000000f0002006e657464657673696d30000008810000000000004f58f025e012b9b24b36f93e8c6be708b9769cf9b84a26096064f7ca9302d8dc0b423ea9f8dc0d34d3f76df35e7969c4f44849b250279cf6ff6c280970e5f6e0538f41e0bd64c331a7f87ec0bb3dabf667405924bcc202fc17d3a53516c8ca8c870f72141832a3aca6ffb13c59d06487ca93ac5edc"], 0x3c}}, 0x0) openat$sequencer2(0xffffffffffffff9c, &(0x7f0000000240), 0xc2882, 0x0) syz_open_dev$midi(0x0, 0x500, 0x0) 0s ago: executing program 7 (id=1766): close_range(0xffffffffffffffff, 0xffffffffffffffff, 0x2) r0 = socket$inet6_sctp(0xa, 0x1, 0x84) recvmmsg(r0, &(0x7f0000002a80)=[{{&(0x7f0000000040)=@ax25={{0x3, @rose}, [@remote, @remote, @netrom, @netrom, @null, @default, @null, @null]}, 0x80, &(0x7f00000014c0)=[{&(0x7f00000002c0)=""/220, 0xdc}, {&(0x7f0000000100)=""/23, 0x17}, {&(0x7f0000000140)=""/51, 0x33}, {&(0x7f0000000180)=""/44, 0x2c}, {&(0x7f00000003c0)=""/4096, 0x1000}, {&(0x7f00000013c0)=""/244, 0xf4}, {&(0x7f0000000200)=""/112, 0x70}], 0x7, &(0x7f0000001500)=""/73, 0x49}, 0x7fff}, {{0x0, 0x0, &(0x7f0000001680)=[{&(0x7f0000001580)=""/251, 0xfb}], 0x1, &(0x7f00000016c0)=""/240, 0xf0}, 0xb18}, {{0x0, 0x0, &(0x7f00000029c0), 0x0, &(0x7f0000002a00)=""/117, 0x75}, 0x4}], 0x3, 0x40000040, &(0x7f0000002b00)={0x77359400}) setsockopt$inet_sctp6_SCTP_INITMSG(r0, 0x84, 0x2, &(0x7f00000000c0)={0xfffc, 0x2}, 0x8) r1 = socket$can_j1939(0x1d, 0x2, 0x7) socketpair$unix(0x1, 0x3, 0x0, &(0x7f0000000080)={0xffffffffffffffff, 0xffffffffffffffff}) r4 = openat(0xffffffffffffff9c, &(0x7f0000000040)='./file1\x00', 0x8042, 0x0) fcntl$setlease(r4, 0x400, 0x0) unlink(&(0x7f0000000180)='./file1\x00') connect$unix(r2, &(0x7f000057eff8)=@abs, 0x6e) sendmmsg$unix(r3, &(0x7f000000a280)=[{{0x0, 0x0, &(0x7f0000000000)=[{&(0x7f0000001840)="1253fa74466381f90c6e66a4dc27e1a862f8347264a38d908ef17f3ce753cd18e97a93a929e7b7d28c4ae62c013267098c0835a7334f8719a4928d869f8b69b64dd0bc4e3cedbea64988141f4894330bde6c223b7aeed830e359fe9d70d8a4bb1e6a40ea96a1b22927312f525eecdbd633c9c6e78c1bf8c4765e77bf83fa40a60ab9315adb789ea639f97473a003ea14a7020a8c30fc1ee182aa441a71888f62404329494479c582e3781ed168b4cfeaf829284a2efbfa18efa0cbe4d176c55f15abdcda648a2f25a01443195fdecfcddb440e1b145766e86f4accc43832da368b973f368038142e7435c88dbe5e116a3134b00ad46de244", 0xf8}, {&(0x7f0000001940)="ca1850be6a3701c07b030b4eb5ae2febdc0ca46dc5b3fd361a9fbf0453831887a45af580ecd86cc41950db0cde8ef5a6624a512654b9552aa1128dc72e3d1254f2", 0x41}, {&(0x7f00000019c0)="08c5d8b07dbe115910bbb34853e2c73a2d24bd2eab72d5df536f112952802253aa0ce5d99975211c324ac658d5547ede6269b81bc6f323e1408a536f7c624e3380c004a7cc7908572875e84d0efae9d8d2fb36c17e5be554e4b886e83f4499e1e8040c6e298296a3801d9f1f6994661f7fd915b3ff5594a84793712d13a5a98ae7514e44fb4057", 0x87}], 0x3, &(0x7f0000001c40)=[@rights={{0x1c, 0x1, 0x1, [r2, r2, r1, r1]}}, @rights={{0x14, 0x1, 0x1, [r0, 0xffffffffffffffff]}}, @cred={{0x18, 0x1, 0x2, {0x0, 0x0, 0xee01}}}, @cred={{0x18, 0x1, 0x2, {0x0, 0x0, 0xee01}}}, @rights={{0x28, 0x1, 0x1, [r3, 0xffffffffffffffff, r0, r1, r0, r4, r3]}}, @rights={{0x1c, 0x1, 0x1, [0xffffffffffffffff, r0, r3, 0xffffffffffffffff]}}], 0xa4, 0x4000}}, {{0x0, 0x0, &(0x7f0000001ec0)=[{&(0x7f0000001d00)="02d1bbdab14f1b35003af32cb38ae6427eb4d8a01a64a5e80d3cfed98a7857ecc68627e4835f1a2c4affae1a7192ad9a0af3f77162c3ee4e0582de723cc7f524f04650c107bd7c930b993f6c1f1b04aca63f9a87b81de34498615f19bd94745dc2821f89c713d66c4a4ba0a49041aa49ea711218fbd4cdfc317ba72f79f3338a410be309353ba55c0637384fccb60888f0c5bd931eddbcd7ce9a39c1200467d52c65d020b14817d80b9fc44b40f7e0b773bd01", 0xb3}, {&(0x7f0000001dc0)="daca77c0c347b964f8fa01a887a6813698277cd8cfde629096f00c93d6ad6e330d79ab91ee85d8fba7b2fd5677d38fbfc863399e13178194635a9242cfe20a68365f8e16572d249ba5bcf6df5a4b01ca8ee0d3351bb6ed2529d2820e14aed597c62a97ba1ad8290ed3e807ad33f577807ec76a0c42d35816ca985570251a5bee91261469fe23b411ab8704ff7a8f515568", 0x91}, {&(0x7f0000001e80)="72ececcb632ffe9cb120ac71", 0xc}], 0x3, &(0x7f0000001f00)=[@cred={{0x18}}], 0x18, 0x14}}, {{&(0x7f0000001f40)=@abs={0x1, 0x0, 0xc6}, 0x6e, &(0x7f0000008f80)=[{&(0x7f0000001fc0)="b48e3ba7fa34a87c3c45dd9f5f92c3a76601d153af17996b25c6183dc66090dbe63c1502bd6b7a5b09ababe673037818427bad6ff32ffa542c", 0x39}, {&(0x7f0000002000)="dff6bb030283b65d08f93e572e8ed3bd5b9401a859d77450dbc5881ed08e5aef100307397a1761afb3807dcc7c74bb2902b66f5a0ff7d54b2eaa0d55a8f481b66151c560826e269939cc3254ab5a2f5133a89d0b01907a97a25b52cbbe27d965e6aa18972cbec86df4edd9b20798a2aa79157e6601b9766270c7a7cf9bacb744", 0x80}, {&(0x7f0000006200)="02beab2f13635d86ded4c2b9e69c9330f867daba608f7aaa611c430e663b529d04f12a2666a02bcc1580fde7820e1821", 0x30}, {&(0x7f0000008e80)="2bbc60dce97320fb0cadc686e51a86a9365d5ca08e52a5bd1c90803fac54bcd41802bbd0a0f2c7dcea6ee00adbae19781acc287d14cbe7ccf69131faebd1e6c9464a3e63c7809342fa779d7b8c69ddff0fcc4daf07c8ef65a8a78547cce868d2a368a61fd249f7f2d913b43c4b75665a52abe1b58fffdf94d5135408fd09e102bde2e64ba8f9a54b531db998a67beee6a5447f3b23b8e7977a59b20904c2b7fa41b658022f6bf2bf71b1e69702304ed17385ffd8bae1e21654fd008b670f778709c93783cdad", 0xc6}, {&(0x7f0000006240)="90d0a2e7017516674cfa36f13f8ab685e152788c37b0f2a1a693e125f0eb169611fd662b86688cf5154e21a1beca1b66c278e7d9a1046cb977bc085f8122f2e9d34d72472084bfe6d72d2f3ea2fe", 0x4e}], 0x5, &(0x7f0000001a80)=ANY=[@ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="2c0000000100000001000000", @ANYRES32=r4, @ANYRES32, @ANYRES32=r2, @ANYRES32=r3, @ANYRES32=r1, @ANYRES32=r1, @ANYRES32, @ANYRES32, @ANYBLOB="4301000000000000000200005dc6f93040e70ec280cec7e3bcdc965c0dd43b8d00e5417a5a9bd052aa323e24a34a9cbd7c62faea585d9516b1a6bc8d338c3f535ff6a643eaae21736ffe76b753d56622c40c00cb5271dde0dabdc6c092e02a938cb0bae3b206e8bfc76556fb58ead7083cf162b6b7c98358058a9e2022b3e33e2cc6e5cfb1e4bed2453314602a574d42f25e2869527d7b18d3cfb31eb32e4b653e3f0c4cb6694599f972282fdaec385fbd15ee", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0, @ANYBLOB="180000000100000002000000", @ANYRES32=0x0, @ANYRES32=0x0, @ANYRES32=0x0], 0xa4, 0x4010}}], 0x3, 0x4) recvmmsg(r2, &(0x7f00000000c0), 0x10106, 0x2, 0x0) prctl$PR_SCHED_CORE(0x3e, 0x1, 0x0, 0x2, 0x0) r5 = syz_io_uring_setup(0x497, &(0x7f0000000400)={0x0, 0x7079, 0x24009, 0x14, 0xc2}, &(0x7f00000005c0)=0x0, 0x0) r7 = socket$alg(0x26, 0x5, 0x0) bind$alg(r7, &(0x7f0000000080)={0x26, 'skcipher\x00', 0x0, 0x0, 'lrw(ecb-aes-aesni)\x00'}, 0x58) setsockopt$ALG_SET_KEY(r7, 0x117, 0x1, &(0x7f0000000040), 0x0) close(0x3) syz_memcpy_off$IO_URING_METADATA_GENERIC(r6, 0x4, &(0x7f0000000080)=0xfffffffc, 0x0, 0x4) bpf$MAP_CREATE(0x0, &(0x7f00000017c0)=ANY=[@ANYBLOB="0100000004000000e27f00000100000000000000", @ANYRES32, @ANYBLOB='\x00'/20, @ANYRES32=0x0, @ANYRES32, @ANYBLOB="00000000000000000000000000000000000000665844f000cf19c2cb000000000000000000"], 0x50) r8 = bpf$PROG_LOAD(0x2, &(0x7f0000000380)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000780)='GPL\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0}, 0x94) bpf$PROG_LOAD(0x2, &(0x7f0000000680)={0x3, 0x3, &(0x7f0000000740)=ANY=[], &(0x7f0000000580)='syzkaller\x00', 0x1, 0x0, 0x0, 0x0, 0x0, '\x00', 0x0, @sched_cls, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, r8, 0x0, 0x0, 0x0, 0x0, 0x40}, 0x94) io_uring_enter(r5, 0x3516, 0x0, 0x0, 0x0, 0x0) r9 = socket(0x10, 0x2, 0x0) write(r9, &(0x7f0000000040)="1c0000001a009b8a140000003b9b301f00"/28, 0x1c) recvmmsg(r9, &(0x7f0000002ec0), 0x400000000000ec0, 0x2, &(0x7f00000001c0)={0x77359400}) madvise(&(0x7f0000000000/0x600000)=nil, 0x600000, 0x15) recvmsg$can_j1939(r1, &(0x7f00000000c0)={&(0x7f0000000380)=@ll={0x11, 0x0, 0x0, 0x1, 0x0, 0x6, @broadcast}, 0x80, &(0x7f0000000000), 0x0, &(0x7f00000004c0)=""/66, 0x42}, 0x0) memfd_create(&(0x7f0000000540)=':\x91!/\x00', 0x1) syz_usb_connect(0x5, 0x2d, &(0x7f0000000080)=ANY=[@ANYBLOB="120100000cb768405e0483020b9901e4020109021b00010000000009"], 0x0) kernel console output (not intermixed with test programs): 493.744879][T11287] ? __pfx_do_sys_openat2+0x10/0x10 [ 493.744906][T11287] ? ksys_write+0x22a/0x250 [ 493.744940][T11287] __ia32_compat_sys_openat+0x131/0x160 [ 493.744970][T11287] __do_fast_syscall_32+0xb6/0x2b0 [ 493.744995][T11287] ? asm_int80_emulation+0x1a/0x20 [ 493.745013][T11287] ? do_int80_emulation+0x1f3/0x390 [ 493.745042][T11287] do_fast_syscall_32+0x34/0x80 [ 493.745066][T11287] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 493.745090][T11287] RIP: 0023:0xf7fe3539 [ 493.745108][T11287] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 493.745126][T11287] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 493.745147][T11287] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 0000000080000000 [ 493.745162][T11287] RDX: 000000000000035c RSI: 0000000000000000 RDI: 0000000000000000 [ 493.745175][T11287] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 493.745187][T11287] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 493.745199][T11287] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 493.745228][T11287] [ 494.032557][ C0] vkms_vblank_simulate: vblank timer overrun [ 494.705747][ T5925] usb 1-1: new high-speed USB device number 41 using dummy_hcd [ 495.057956][ T5156] Bluetooth: hci4: command tx timeout [ 495.178813][ T5925] usb 1-1: Using ep0 maxpacket: 8 [ 495.202949][ T5925] usb 1-1: config index 0 descriptor too short (expected 30, got 18) [ 495.228547][ T5925] usb 1-1: New USB device found, idVendor=1660, idProduct=0932, bcdDevice=80.ea [ 495.242390][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 495.314097][ T5925] usb 1-1: Product: syz [ 495.318318][ T5925] usb 1-1: Manufacturer: syz [ 495.336359][ T5925] usb 1-1: SerialNumber: syz [ 495.374766][ T5925] usb 1-1: config 0 descriptor?? [ 495.403615][ T5925] dvb-usb: found a 'Medion MD95700 (MDUSBTV-HYBRID)' in warm state. [ 495.422612][ T5925] usb 1-1: setting power ON [ 495.442799][ T5925] dvb-usb: bulk message failed: -22 (2/0) [ 495.725223][ T5925] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 495.727144][T11205] netdevsim netdevsim8 netdevsim0: renamed from eth0 [ 495.754547][ T5925] dvbdev: DVB: registering new adapter (Medion MD95700 (MDUSBTV-HYBRID)) [ 495.793843][ T5925] usb 1-1: media controller created [ 495.838675][ T5925] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 495.846536][T11205] netdevsim netdevsim8 netdevsim1: renamed from eth1 [ 495.887951][T11205] netdevsim netdevsim8 netdevsim2: renamed from eth2 [ 495.954975][T11205] netdevsim netdevsim8 netdevsim3: renamed from eth3 [ 495.956769][ T5925] usb 1-1: selecting invalid altsetting 6 [ 496.033759][ T5925] usb 1-1: digital interface selection failed (-22) [ 496.074615][ T5925] dvb-usb: no frontend was attached by 'Medion MD95700 (MDUSBTV-HYBRID)' [ 496.118319][ T5925] usb 1-1: setting power OFF [ 496.122974][ T5925] dvb-usb: bulk message failed: -22 (2/0) [ 496.134584][ T30] audit: type=1326 audit(1759561488.776:423): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11326 comm="syz.7.1301" exe="/root/syz-executor" sig=31 arch=40000003 syscall=240 compat=1 ip=0xf7f22539 code=0x0 [ 496.164794][ T5925] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully initialized and connected. [ 496.174790][ T5925] (NULL device *): no alternate interface [ 496.229094][ T5925] dvb-usb: Medion MD95700 (MDUSBTV-HYBRID) successfully deinitialized and disconnected. [ 496.291266][ T5925] usb 1-1: USB disconnect, device number 41 [ 496.546583][T11205] 8021q: adding VLAN 0 to HW filter on device bond0 [ 496.577050][T11205] 8021q: adding VLAN 0 to HW filter on device team0 [ 496.603597][ T36] bridge0: port 1(bridge_slave_0) entered blocking state [ 496.610795][ T36] bridge0: port 1(bridge_slave_0) entered forwarding state [ 496.668852][ T36] bridge0: port 2(bridge_slave_1) entered blocking state [ 496.676104][ T36] bridge0: port 2(bridge_slave_1) entered forwarding state [ 496.760530][T11205] hsr0: Slave B (hsr_slave_1) is not up; please bring it up to get a fully working HSR network [ 496.771111][ T5925] usb 1-1: new full-speed USB device number 42 using dummy_hcd [ 496.783374][T11338] FAULT_INJECTION: forcing a failure. [ 496.783374][T11338] name failslab, interval 1, probability 0, space 0, times 0 [ 496.800891][T11338] CPU: 1 UID: 0 PID: 11338 Comm: syz.1.1305 Not tainted syzkaller #0 PREEMPT(full) [ 496.800921][T11338] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 496.800935][T11338] Call Trace: [ 496.800943][T11338] [ 496.800952][T11338] dump_stack_lvl+0x189/0x250 [ 496.800982][T11338] ? __pfx____ratelimit+0x10/0x10 [ 496.801004][T11338] ? __pfx_dump_stack_lvl+0x10/0x10 [ 496.801029][T11338] ? __pfx__printk+0x10/0x10 [ 496.801065][T11338] ? __pfx___might_resched+0x10/0x10 [ 496.801088][T11338] ? fs_reclaim_acquire+0x7d/0x100 [ 496.801124][T11338] should_fail_ex+0x414/0x560 [ 496.801160][T11338] should_failslab+0xa8/0x100 [ 496.801194][T11338] kmem_cache_alloc_node_noprof+0x77/0x710 [ 496.801223][T11338] ? __alloc_skb+0x112/0x2d0 [ 496.801259][T11338] __alloc_skb+0x112/0x2d0 [ 496.801287][T11338] netlink_sendmsg+0x5c6/0xb30 [ 496.801322][T11338] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.801350][T11338] ? __import_iovec+0x5d4/0x7f0 [ 496.801374][T11338] ? aa_sock_msg_perm+0xf1/0x1d0 [ 496.801396][T11338] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 496.801415][T11338] ? __pfx_netlink_sendmsg+0x10/0x10 [ 496.801450][T11338] __sock_sendmsg+0x219/0x270 [ 496.801474][T11338] ____sys_sendmsg+0x505/0x830 [ 496.801507][T11338] ? __pfx_____sys_sendmsg+0x10/0x10 [ 496.801552][T11338] ___sys_sendmsg+0x21f/0x2a0 [ 496.801583][T11338] ? __pfx____sys_sendmsg+0x10/0x10 [ 496.801649][T11338] ? __fget_files+0x2a/0x420 [ 496.801678][T11338] ? __fget_files+0x3a0/0x420 [ 496.801719][T11338] __sys_sendmsg+0x164/0x220 [ 496.801749][T11338] ? __pfx___sys_sendmsg+0x10/0x10 [ 496.801793][T11338] ? lockdep_hardirqs_on+0x9c/0x150 [ 496.801819][T11338] __do_fast_syscall_32+0xb6/0x2b0 [ 496.801844][T11338] ? lockdep_hardirqs_on+0x9c/0x150 [ 496.801870][T11338] do_fast_syscall_32+0x34/0x80 [ 496.801894][T11338] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 496.801919][T11338] RIP: 0023:0xf7fe3539 [ 496.801936][T11338] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 496.801954][T11338] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 496.801976][T11338] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080003740 [ 496.801990][T11338] RDX: 0000000028008004 RSI: 0000000000000000 RDI: 0000000000000000 [ 496.802003][T11338] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 496.802015][T11338] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 496.802028][T11338] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 496.802058][T11338] [ 497.095762][T11205] 8021q: adding VLAN 0 to HW filter on device batadv0 [ 497.124503][ T5156] Bluetooth: hci4: command tx timeout [ 497.136336][T11205] veth0_vlan: entered promiscuous mode [ 497.151350][T11205] veth1_vlan: entered promiscuous mode [ 497.233779][ T5925] usb 1-1: device descriptor read/64, error -71 [ 497.242944][T11205] veth0_macvtap: entered promiscuous mode [ 497.270786][T11205] veth1_macvtap: entered promiscuous mode [ 497.298697][T11205] batman_adv: batadv0: Interface activated: batadv_slave_0 [ 497.311004][T11205] batman_adv: batadv0: Interface activated: batadv_slave_1 [ 497.347654][ T12] netdevsim netdevsim8 netdevsim0: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.367049][ T12] netdevsim netdevsim8 netdevsim1: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.416359][ T12] netdevsim netdevsim8 netdevsim2: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.430560][ T12] netdevsim netdevsim8 netdevsim3: set [1, 0] type 2 family 0 port 6081 - 0 [ 497.485279][ T5925] usb 1-1: new full-speed USB device number 43 using dummy_hcd [ 497.633905][ T5925] usb 1-1: device descriptor read/64, error -71 [ 497.685128][ T59] wlan0: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 497.780966][ T59] wlan0: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 497.805601][ T5925] usb usb1-port1: attempt power cycle [ 497.839865][ T5938] wlan1: Created IBSS using preconfigured BSSID 50:50:50:50:50:50 [ 497.852078][ T5938] wlan1: Creating new IBSS network, BSSID 50:50:50:50:50:50 [ 498.175959][T11351] binder: BINDER_SET_CONTEXT_MGR already set [ 498.201114][ T5925] usb 1-1: new full-speed USB device number 44 using dummy_hcd [ 498.209037][T11351] binder: 11347:11351 ioctl 4018620d 80000040 returned -16 [ 498.340859][ T5925] usb 1-1: device descriptor read/8, error -71 [ 498.654004][ T5925] usb 1-1: new full-speed USB device number 45 using dummy_hcd [ 498.718367][ T5925] usb 1-1: device descriptor read/8, error -71 [ 498.793265][T11351] syz.7.1310 (11351): drop_caches: 2 [ 498.848066][ T5925] usb usb1-port1: unable to enumerate USB device [ 499.768846][T11372] dvmrp6: entered allmulticast mode [ 499.873830][ T5924] usb 1-1: new high-speed USB device number 46 using dummy_hcd [ 500.569347][ T5924] usb 1-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 500.733226][T11384] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1317'. [ 500.742617][ T5924] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 500.781937][ T5924] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 500.928991][ T5924] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 500.945434][ T5924] usb 1-1: Product: 犌窑炛ꗀï¹ä¢¬â¬«êµ§ë´‹î½î˜…ᩒ늌컚ã›åˆË [ 501.064270][ T5924] usb 1-1: Manufacturer: 碗潨쬋枺Чèë‡áŸ˜î’žìœé‚µë¨„첮ij໅çŸå©•è—½í‰éªä½¦åŠ‡Ì¿ã”˜í‹äŠå©·ë¸éŽ„Ȭ郚䱮ᤜëží‚±äˆé—˜ä±á¯²à³·à£´å‰…éªèŠá’žç³‰ãš¬ï¸î•é í€±Ó“⦾溰寫ᵊᆳ䮆즮ーã¹È‘꘣ય㰈푄î¬çš„醳擞킅ⶭ롶ì¶íŽåº³Ñœã‡‹î¾ç³ï•¸à©‰ïµ­éŠ°ï¸ƒà¾•æ…¼î­ [ 501.067274][T11387] netlink: 28 bytes leftover after parsing attributes in process `syz.1.1319'. [ 501.092281][ C0] vkms_vblank_simulate: vblank timer overrun [ 501.128568][T11387] netlink: 'syz.1.1319': attribute type 7 has an invalid length. [ 501.143718][T11387] netlink: 'syz.1.1319': attribute type 8 has an invalid length. [ 501.204308][T11387] netlink: 4 bytes leftover after parsing attributes in process `syz.1.1319'. [ 501.273937][ T5924] usb 1-1: SerialNumber: syz [ 501.497303][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 501.504160][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 502.062645][ T5924] usb 1-1: 0:2 : does not exist [ 502.109066][T11394] tipc: Enabled bearer , priority 0 [ 502.117299][T11394] syzkaller0: entered promiscuous mode [ 502.122892][T11394] syzkaller0: entered allmulticast mode [ 502.154128][ T5924] usb 1-1: USB disconnect, device number 46 [ 502.249175][T11394] tipc: Resetting bearer [ 502.309871][T11393] tipc: Resetting bearer [ 502.459402][T11393] tipc: Disabling bearer [ 502.644287][ T7945] usb 9-1: new high-speed USB device number 2 using dummy_hcd [ 502.720568][ T5924] usb 6-1: new high-speed USB device number 21 using dummy_hcd [ 502.810372][T11411] fuse: Unknown parameter '' [ 502.827510][ T7945] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 502.840945][ T7945] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 502.878773][ T7945] usb 9-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 502.895955][ T5924] usb 6-1: config 0 interface 0 has no altsetting 0 [ 502.913576][ T7945] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 502.920305][ T5924] usb 6-1: New USB device found, idVendor=056a, idProduct=0003, bcdDevice= 0.00 [ 502.948639][ T7945] usb 9-1: config 0 descriptor?? [ 502.951220][ T5924] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 503.024439][ T5924] usb 6-1: config 0 descriptor?? [ 503.534050][T11405] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 503.548967][T11405] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 503.812951][ T7941] usb 6-1: USB disconnect, device number 21 [ 503.860549][ T7945] usbhid 9-1:0.0: can't add hid device: -71 [ 503.866695][ T7945] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 503.907105][ T7945] usb 9-1: USB disconnect, device number 2 [ 504.413815][ T7945] usb 9-1: new high-speed USB device number 3 using dummy_hcd [ 504.774782][ T7945] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 504.785978][ T7945] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 504.820630][ T7945] usb 9-1: New USB device found, idVendor=10c4, idProduct=ea90, bcdDevice= 0.00 [ 504.830172][ T7945] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 504.846765][ T7945] usb 9-1: config 0 descriptor?? [ 505.111204][T11422] FAULT_INJECTION: forcing a failure. [ 505.111204][T11422] name failslab, interval 1, probability 0, space 0, times 0 [ 505.130268][T11422] CPU: 1 UID: 0 PID: 11422 Comm: syz.8.1330 Not tainted syzkaller #0 PREEMPT(full) [ 505.130295][T11422] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 505.130308][T11422] Call Trace: [ 505.130315][T11422] [ 505.130324][T11422] dump_stack_lvl+0x189/0x250 [ 505.130356][T11422] ? __pfx____ratelimit+0x10/0x10 [ 505.130378][T11422] ? __pfx_dump_stack_lvl+0x10/0x10 [ 505.130402][T11422] ? __pfx__printk+0x10/0x10 [ 505.130450][T11422] ? __pfx___might_resched+0x10/0x10 [ 505.130473][T11422] ? fs_reclaim_acquire+0x7d/0x100 [ 505.130507][T11422] should_fail_ex+0x414/0x560 [ 505.130543][T11422] should_failslab+0xa8/0x100 [ 505.130576][T11422] kmem_cache_alloc_node_noprof+0x77/0x710 [ 505.130602][T11422] ? __alloc_skb+0x112/0x2d0 [ 505.130625][T11422] ? netlink_autobind+0xdb/0x300 [ 505.130660][T11422] __alloc_skb+0x112/0x2d0 [ 505.130688][T11422] netlink_sendmsg+0x5c6/0xb30 [ 505.130722][T11422] ? __pfx_netlink_sendmsg+0x10/0x10 [ 505.130756][T11422] ? __import_iovec+0x5d4/0x7f0 [ 505.130781][T11422] ? aa_sock_msg_perm+0xf1/0x1d0 [ 505.130802][T11422] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 505.130820][T11422] ? __pfx_netlink_sendmsg+0x10/0x10 [ 505.130845][T11422] __sock_sendmsg+0x219/0x270 [ 505.130868][T11422] ____sys_sendmsg+0x505/0x830 [ 505.130900][T11422] ? __pfx_____sys_sendmsg+0x10/0x10 [ 505.130943][T11422] ___sys_sendmsg+0x21f/0x2a0 [ 505.130972][T11422] ? __pfx____sys_sendmsg+0x10/0x10 [ 505.131033][T11422] ? __fget_files+0x2a/0x420 [ 505.131062][T11422] ? __fget_files+0x3a0/0x420 [ 505.131102][T11422] __sys_sendmsg+0x164/0x220 [ 505.131131][T11422] ? __pfx___sys_sendmsg+0x10/0x10 [ 505.131174][T11422] ? lockdep_hardirqs_on+0x9c/0x150 [ 505.131199][T11422] __do_fast_syscall_32+0xb6/0x2b0 [ 505.131231][T11422] do_fast_syscall_32+0x34/0x80 [ 505.131256][T11422] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 505.131280][T11422] RIP: 0023:0xf7f74539 [ 505.131296][T11422] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 505.131314][T11422] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 505.131335][T11422] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000080000000 [ 505.131349][T11422] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 505.131361][T11422] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 505.131372][T11422] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 505.131385][T11422] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 505.131412][T11422] [ 505.636444][ T7945] usbhid 9-1:0.0: can't add hid device: -71 [ 505.642447][ T7945] usbhid 9-1:0.0: probe with driver usbhid failed with error -71 [ 505.654885][ T7945] usb 9-1: USB disconnect, device number 3 [ 505.833875][ T5924] usb 2-1: new high-speed USB device number 42 using dummy_hcd [ 506.004882][ T5924] usb 2-1: Using ep0 maxpacket: 16 [ 506.013395][ T5924] usb 2-1: config 1 has an invalid descriptor of length 0, skipping remainder of the config [ 506.030488][ T5924] usb 2-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 506.044294][ T5924] usb 2-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 506.063710][ T5924] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 506.083377][ T5924] usb 2-1: Product: syz [ 506.095902][ T5924] usb 2-1: Manufacturer: syz [ 506.100526][ T5924] usb 2-1: SerialNumber: syz [ 506.485938][ T5924] usb 2-1: Audio class v2/v3 interfaces need an interface association [ 506.529038][T11458] tipc: Enabled bearer , priority 0 [ 506.570474][ T5924] snd-usb-audio 2-1:1.0: probe with driver snd-usb-audio failed with error -22 [ 506.582955][ T5924] usb 2-1: USB disconnect, device number 42 [ 506.607426][T11458] syzkaller0: entered promiscuous mode [ 506.673830][T11458] syzkaller0: entered allmulticast mode [ 506.766975][T11458] tipc: Resetting bearer [ 506.780344][T11457] tipc: Resetting bearer [ 506.808280][T11457] tipc: Disabling bearer [ 508.510469][T11478] bridge0: port 2(bridge_slave_1) entered disabled state [ 508.518653][T11478] bridge0: port 1(bridge_slave_0) entered disabled state [ 508.588506][T11473] net_ratelimit: 23 callbacks suppressed [ 508.588531][T11473] IPVS: fo: UDP 224.0.0.2:0 - no destination available [ 508.993770][ T88] usb 6-1: new high-speed USB device number 22 using dummy_hcd [ 509.099178][T11492] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1351'. [ 509.144873][ T88] usb 6-1: Using ep0 maxpacket: 16 [ 509.165070][ T88] usb 6-1: New USB device found, idVendor=1397, idProduct=00bd, bcdDevice=c5.66 [ 509.182441][ T88] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 509.216057][ T88] usb 6-1: config 0 descriptor?? [ 509.252098][ T88] usb 6-1: invalid MIDI EP [ 509.264494][ T88] usb 6-1: snd-bcd2000: error during probing [ 509.277244][ T88] snd-bcd2000 6-1:0.0: probe with driver snd-bcd2000 failed with error -22 [ 509.440585][ T88] usb 6-1: USB disconnect, device number 22 [ 509.877587][T11506] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1356'. [ 510.582631][T11512] FAULT_INJECTION: forcing a failure. [ 510.582631][T11512] name failslab, interval 1, probability 0, space 0, times 0 [ 510.610387][T11512] CPU: 0 UID: 0 PID: 11512 Comm: syz.5.1359 Not tainted syzkaller #0 PREEMPT(full) [ 510.610418][T11512] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 510.610431][T11512] Call Trace: [ 510.610440][T11512] [ 510.610449][T11512] dump_stack_lvl+0x189/0x250 [ 510.610479][T11512] ? __pfx____ratelimit+0x10/0x10 [ 510.610502][T11512] ? __pfx_dump_stack_lvl+0x10/0x10 [ 510.610527][T11512] ? __pfx__printk+0x10/0x10 [ 510.610563][T11512] ? __pfx___might_resched+0x10/0x10 [ 510.610584][T11512] ? fs_reclaim_acquire+0x7d/0x100 [ 510.610620][T11512] should_fail_ex+0x414/0x560 [ 510.610658][T11512] should_failslab+0xa8/0x100 [ 510.610691][T11512] __kmalloc_noprof+0xcb/0x7f0 [ 510.610718][T11512] ? genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 510.610758][T11512] genl_family_rcv_msg_attrs_parse+0xa3/0x2a0 [ 510.610796][T11512] genl_family_rcv_msg_doit+0xb8/0x300 [ 510.610832][T11512] ? __pfx_genl_family_rcv_msg_doit+0x10/0x10 [ 510.610870][T11512] ? apparmor_capable+0x137/0x1b0 [ 510.610895][T11512] ? bpf_lsm_capable+0x9/0x20 [ 510.610919][T11512] ? security_capable+0x7e/0x2e0 [ 510.610955][T11512] genl_rcv_msg+0x60e/0x790 [ 510.611000][T11512] ? __pfx_genl_rcv_msg+0x10/0x10 [ 510.611028][T11512] ? __pfx_nl80211_pre_doit+0x10/0x10 [ 510.611048][T11512] ? __pfx_nl80211_new_station+0x10/0x10 [ 510.611070][T11512] ? __pfx_nl80211_post_doit+0x10/0x10 [ 510.611105][T11512] netlink_rcv_skb+0x208/0x470 [ 510.611126][T11512] ? __lock_acquire+0xab9/0xd20 [ 510.611147][T11512] ? __pfx_genl_rcv_msg+0x10/0x10 [ 510.611176][T11512] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 510.611218][T11512] ? down_read+0x1ad/0x2e0 [ 510.611253][T11512] genl_rcv+0x28/0x40 [ 510.611278][T11512] netlink_unicast+0x82c/0x9e0 [ 510.611308][T11512] ? __pfx_netlink_unicast+0x10/0x10 [ 510.611332][T11512] ? netlink_sendmsg+0x642/0xb30 [ 510.611353][T11512] ? skb_put+0x11b/0x210 [ 510.611381][T11512] netlink_sendmsg+0x805/0xb30 [ 510.611416][T11512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 510.611442][T11512] ? __import_iovec+0x5d4/0x7f0 [ 510.611465][T11512] ? aa_sock_msg_perm+0xf1/0x1d0 [ 510.611486][T11512] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 510.611504][T11512] ? __pfx_netlink_sendmsg+0x10/0x10 [ 510.611528][T11512] __sock_sendmsg+0x219/0x270 [ 510.611552][T11512] ____sys_sendmsg+0x505/0x830 [ 510.611584][T11512] ? __pfx_____sys_sendmsg+0x10/0x10 [ 510.611629][T11512] ___sys_sendmsg+0x21f/0x2a0 [ 510.611659][T11512] ? __pfx____sys_sendmsg+0x10/0x10 [ 510.611723][T11512] ? __fget_files+0x2a/0x420 [ 510.611751][T11512] ? __fget_files+0x3a0/0x420 [ 510.611792][T11512] __sys_sendmsg+0x164/0x220 [ 510.611821][T11512] ? __pfx___sys_sendmsg+0x10/0x10 [ 510.611864][T11512] ? lockdep_hardirqs_on+0x9c/0x150 [ 510.611889][T11512] __do_fast_syscall_32+0xb6/0x2b0 [ 510.611913][T11512] ? lockdep_hardirqs_on+0x9c/0x150 [ 510.611938][T11512] do_fast_syscall_32+0x34/0x80 [ 510.611962][T11512] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 510.611985][T11512] RIP: 0023:0xf702e539 [ 510.612004][T11512] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 510.612020][T11512] RSP: 002b:00000000f541e55c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 510.612042][T11512] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080001080 [ 510.612056][T11512] RDX: 0000000000004814 RSI: 0000000000000000 RDI: 0000000000000000 [ 510.612068][T11512] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 510.612079][T11512] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 510.612091][T11512] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 510.612120][T11512] [ 511.077672][T11516] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1361'. [ 511.095346][T11516] netlink: 12 bytes leftover after parsing attributes in process `syz.5.1361'. [ 511.773775][ T5904] usb 1-1: new full-speed USB device number 47 using dummy_hcd [ 511.925809][ T5904] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid maxpacket 1023, setting to 64 [ 511.939311][ T5904] usb 1-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 511.969951][ T5904] usb 1-1: New USB device found, idVendor=046a, idProduct=0023, bcdDevice= 0.00 [ 511.993436][ T5904] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 512.084609][ T5904] usb 1-1: config 0 descriptor?? [ 512.095145][T11533] raw-gadget.2 gadget.0: fail, usb_ep_enable returned -22 [ 512.684446][ T5904] cherry 0003:046A:0023.002F: unbalanced collection at end of report description [ 512.700569][ T5904] cherry 0003:046A:0023.002F: probe with driver cherry failed with error -22 [ 512.900419][T11550] binder: 11537:11550 ioctl c018620c 80000380 returned -22 [ 512.909510][ T5904] usb 1-1: USB disconnect, device number 47 [ 513.565487][T11558] netlink: 'syz.8.1373': attribute type 4 has an invalid length. [ 513.573294][T11558] netlink: 17 bytes leftover after parsing attributes in process `syz.8.1373'. [ 513.767166][T11562] netlink: 'syz.1.1374': attribute type 4 has an invalid length. [ 513.782482][T11562] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1374'. [ 514.292253][T11553] delete_channel: no stack [ 514.546716][T11556] delete_channel: no stack [ 514.752106][T11579] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1380'. [ 514.777523][T11579] tc_dump_action: action bad kind [ 515.723775][ T7941] usb 9-1: new high-speed USB device number 4 using dummy_hcd [ 515.913031][ T7941] usb 9-1: Using ep0 maxpacket: 8 [ 515.920707][ T7941] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0xE has invalid wMaxPacketSize 0 [ 515.938503][ T7941] usb 9-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xB3, changing to 0x83 [ 515.981960][ T7941] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 255, changing to 11 [ 516.075548][ T7941] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x83 has invalid maxpacket 59391, setting to 1024 [ 516.230226][ T7941] usb 9-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.10 [ 516.243803][ T7941] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 516.251973][ T7941] usb 9-1: Product: syz [ 516.256554][ T7941] usb 9-1: Manufacturer: syz [ 516.261212][ T7941] usb 9-1: SerialNumber: syz [ 516.275144][ T7941] usb 9-1: config 0 descriptor?? [ 516.287704][T11594] raw-gadget.0 gadget.8: fail, usb_ep_enable returned -22 [ 516.339417][ T7941] radioshark2 9-1:0.0: Invalid radioSHARK2 device [ 516.377907][ T7941] radioshark2 9-1:0.0: probe with driver radioshark2 failed with error -22 [ 516.416420][T11603] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1389'. [ 516.484261][T11603] netlink: 16 bytes leftover after parsing attributes in process `syz.1.1389'. [ 516.557839][ T7941] usb 9-1: USB disconnect, device number 4 [ 517.044153][ T5924] usb 2-1: new high-speed USB device number 43 using dummy_hcd [ 517.253738][ T5924] usb 2-1: Using ep0 maxpacket: 16 [ 517.273287][ T5924] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 517.297677][ T5924] usb 2-1: New USB device found, idVendor=4752, idProduct=0011, bcdDevice=32.4f [ 517.324189][ T5924] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 517.343353][ T5924] usb 2-1: Product: syz [ 517.353482][ T5924] usb 2-1: Manufacturer: syz [ 517.373888][ T5924] usb 2-1: SerialNumber: syz [ 517.391007][ T5924] usb 2-1: config 0 descriptor?? [ 517.406128][ T5924] hub 2-1:0.0: bad descriptor, ignoring hub [ 517.426225][ T5924] hub 2-1:0.0: probe with driver hub failed with error -5 [ 517.467880][ T5924] usb 2-1: Quirk or no altset; falling back to MIDI 1.0 [ 517.484008][ T7945] usb 1-1: new high-speed USB device number 48 using dummy_hcd [ 517.554015][ T7941] usb 9-1: new high-speed USB device number 5 using dummy_hcd [ 517.636382][ T5924] snd-usb-audio 2-1:0.0: probe with driver snd-usb-audio failed with error -2 [ 517.650977][ T7945] usb 1-1: config 0 has an invalid interface number: 87 but max is 0 [ 517.663774][ T7945] usb 1-1: config 0 has no interface number 0 [ 517.688716][ T7945] usb 1-1: too many endpoints for config 0 interface 87 altsetting 28: 204, using maximum allowed: 30 [ 517.714967][ T5924] usb 2-1: USB disconnect, device number 43 [ 517.724395][ T7941] usb 9-1: Using ep0 maxpacket: 16 [ 517.736053][ T7945] usb 1-1: config 0 interface 87 altsetting 28 endpoint 0x2 has an invalid bInterval 0, changing to 7 [ 517.748354][T11621] FAULT_INJECTION: forcing a failure. [ 517.748354][T11621] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 517.762508][ T7945] usb 1-1: config 0 interface 87 altsetting 28 has 1 endpoint descriptor, different from the interface descriptor's value: 204 [ 517.776280][T11621] CPU: 1 UID: 0 PID: 11621 Comm: syz.7.1391 Not tainted syzkaller #0 PREEMPT(full) [ 517.776308][T11621] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 517.776321][T11621] Call Trace: [ 517.776330][T11621] [ 517.776338][T11621] dump_stack_lvl+0x189/0x250 [ 517.776374][T11621] ? __pfx____ratelimit+0x10/0x10 [ 517.776396][T11621] ? __pfx_dump_stack_lvl+0x10/0x10 [ 517.776420][T11621] ? __pfx__printk+0x10/0x10 [ 517.776451][T11621] ? __might_fault+0xb0/0x130 [ 517.776490][T11621] should_fail_ex+0x414/0x560 [ 517.776527][T11621] _copy_from_user+0x2d/0xb0 [ 517.776555][T11621] get_compat_msghdr+0xad/0x4a0 [ 517.776589][T11621] ? __pfx_get_compat_msghdr+0x10/0x10 [ 517.776617][T11621] ? ___sys_recvmsg+0x1c4/0x510 [ 517.776644][T11621] ? kfree+0x4d/0x6d0 [ 517.776682][T11621] ___sys_recvmsg+0x17f/0x510 [ 517.776715][T11621] ? __pfx____sys_recvmsg+0x10/0x10 [ 517.776767][T11621] ? __fget_files+0x3a0/0x420 [ 517.776809][T11621] do_recvmmsg+0x36a/0x770 [ 517.776846][T11621] ? __pfx_do_recvmmsg+0x10/0x10 [ 517.776886][T11621] ? __pfx_vfs_write+0x10/0x10 [ 517.776930][T11621] __sys_recvmmsg+0x19d/0x280 [ 517.776961][T11621] ? __pfx___sys_recvmmsg+0x10/0x10 [ 517.776987][T11621] ? ksys_write+0x22a/0x250 [ 517.777022][T11621] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 517.777051][T11621] __do_fast_syscall_32+0xb6/0x2b0 [ 517.777076][T11621] ? lockdep_hardirqs_on+0x9c/0x150 [ 517.777101][T11621] do_fast_syscall_32+0x34/0x80 [ 517.777125][T11621] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 517.777149][T11621] RIP: 0023:0xf7f22539 [ 517.777167][T11621] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 517.777185][T11621] RSP: 002b:00000000f53f555c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 517.777207][T11621] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800000c0 [ 517.777220][T11621] RDX: 0000000000010106 RSI: 0000000000000002 RDI: 0000000000000000 [ 517.777232][T11621] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 517.777244][T11621] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 517.777256][T11621] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 517.777285][T11621] [ 517.780346][ T7941] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 518.017646][ T7945] usb 1-1: config 0 interface 87 has no altsetting 0 [ 518.074244][ T7945] usb 1-1: New USB device found, idVendor=13b1, idProduct=0042, bcdDevice=8c.f4 [ 518.083372][ T7945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 518.096341][ T7945] usb 1-1: Product: syz [ 518.100557][ T7945] usb 1-1: Manufacturer: syz [ 518.113814][ T7945] usb 1-1: SerialNumber: syz [ 518.125544][ T7945] usb 1-1: config 0 descriptor?? [ 518.159753][ T7945] usb 1-1: Warning: ath10k USB support is incomplete, don't expect anything to work! [ 518.234299][ T7941] usb 9-1: config 0 interface 0 altsetting 2 has 0 endpoint descriptors, different from the interface descriptor's value: 1 [ 518.263749][ T7941] usb 9-1: config 0 interface 0 has no altsetting 0 [ 518.270694][ T7941] usb 9-1: New USB device found, idVendor=060b, idProduct=500a, bcdDevice= 0.00 [ 518.279881][ T7941] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 518.299239][ T7941] usb 9-1: config 0 descriptor?? [ 518.315546][ T7941] usbhid 9-1:0.0: couldn't find an input interrupt endpoint [ 518.355634][ T7945] usb 1-1: USB disconnect, device number 48 [ 518.364971][ T1164] usb 1-1: Failed to submit usb control message: -71 [ 518.388562][ T1164] usb 1-1: unable to send the bmi data to the device: -71 [ 518.400754][ T1164] usb 1-1: unable to get target info from device [ 518.407614][ T1164] usb 1-1: could not get target info (-71) [ 518.414208][ T1164] usb 1-1: could not probe fw (-71) [ 518.726472][T11630] netlink: 'syz.1.1396': attribute type 4 has an invalid length. [ 518.734604][T11630] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1396'. [ 518.766639][T11631] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1397'. [ 518.942802][T11633] netlink: 101 bytes leftover after parsing attributes in process `syz.7.1397'. [ 518.969949][ T13] netdevsim netdevsim7 netdevsim0: unset [1, 0] type 2 family 0 port 6081 - 0 [ 519.712203][T11625] delete_channel: no stack [ 521.103101][ T5924] usb 9-1: USB disconnect, device number 5 [ 522.884786][T11666] tipc: Enabled bearer , priority 0 [ 522.929873][T11666] syzkaller0: entered promiscuous mode [ 522.949857][T11666] syzkaller0: entered allmulticast mode [ 523.025213][T11666] tipc: Resetting bearer [ 523.078626][T11663] tipc: Resetting bearer [ 523.242535][T11663] tipc: Disabling bearer [ 524.333758][ T7945] usb 1-1: new full-speed USB device number 49 using dummy_hcd [ 524.513760][ T7945] usb 1-1: device descriptor read/64, error -71 [ 524.602956][T11693] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1409'. [ 524.683866][T11696] netlink: 16 bytes leftover after parsing attributes in process `syz.8.1409'. [ 524.783856][ T7945] usb 1-1: new full-speed USB device number 50 using dummy_hcd [ 525.093039][ T7945] usb 1-1: device descriptor read/64, error -71 [ 525.182285][T11700] FAULT_INJECTION: forcing a failure. [ 525.182285][T11700] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 525.196259][ T7945] usb usb1-port1: attempt power cycle [ 525.254164][T11700] CPU: 1 UID: 0 PID: 11700 Comm: syz.8.1412 Not tainted syzkaller #0 PREEMPT(full) [ 525.254184][T11700] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 525.254193][T11700] Call Trace: [ 525.254199][T11700] [ 525.254205][T11700] dump_stack_lvl+0x189/0x250 [ 525.254226][T11700] ? __pfx____ratelimit+0x10/0x10 [ 525.254242][T11700] ? __pfx_dump_stack_lvl+0x10/0x10 [ 525.254259][T11700] ? __pfx__printk+0x10/0x10 [ 525.254280][T11700] ? __might_fault+0xb0/0x130 [ 525.254307][T11700] should_fail_ex+0x414/0x560 [ 525.254332][T11700] _copy_to_iter+0x404/0x1790 [ 525.254358][T11700] ? rcu_is_watching+0x15/0xb0 [ 525.254375][T11700] ? __pfx__copy_to_iter+0x10/0x10 [ 525.254389][T11700] ? trace_contention_end+0x39/0x120 [ 525.254412][T11700] ? __mutex_lock+0x335/0x1350 [ 525.254429][T11700] ? do_raw_spin_lock+0x121/0x290 [ 525.254456][T11700] __skb_datagram_iter+0x41a/0x990 [ 525.254479][T11700] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 525.254506][T11700] skb_copy_datagram_iter+0xc5/0x230 [ 525.254529][T11700] unix_stream_read_actor+0x6c/0xb0 [ 525.254546][T11700] unix_stream_read_generic+0xac3/0x2470 [ 525.254582][T11700] ? __pfx_unix_stream_read_generic+0x10/0x10 [ 525.254596][T11700] ? __pfx_autoremove_wake_function+0x10/0x10 [ 525.254617][T11700] ? __page_table_check_zero+0x406/0x530 [ 525.254636][T11700] ? __page_table_check_zero+0xba/0x530 [ 525.254663][T11700] ? post_alloc_hook+0x253/0x2a0 [ 525.254688][T11700] unix_stream_recvmsg+0x15d/0x1b0 [ 525.254705][T11700] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 525.254719][T11700] ? __pfx_unix_stream_read_actor+0x10/0x10 [ 525.254744][T11700] ? aa_sock_msg_perm+0xda/0x1d0 [ 525.254758][T11700] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 525.254771][T11700] ? security_socket_recvmsg+0x7e/0x2e0 [ 525.254795][T11700] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 525.254810][T11700] sock_recvmsg+0x229/0x270 [ 525.254828][T11700] ____sys_recvmsg+0x1c9/0x460 [ 525.254854][T11700] ? __pfx_____sys_recvmsg+0x10/0x10 [ 525.254871][T11700] ? get_compat_msghdr+0x37e/0x4a0 [ 525.254906][T11700] ___sys_recvmsg+0x1b5/0x510 [ 525.254930][T11700] ? __pfx____sys_recvmsg+0x10/0x10 [ 525.254967][T11700] ? __fget_files+0x3a0/0x420 [ 525.254995][T11700] do_recvmmsg+0x36a/0x770 [ 525.255021][T11700] ? __pfx_do_recvmmsg+0x10/0x10 [ 525.255054][T11700] ? __pfx_vfs_write+0x10/0x10 [ 525.255086][T11700] __sys_recvmmsg+0x19d/0x280 [ 525.255107][T11700] ? __pfx___sys_recvmmsg+0x10/0x10 [ 525.255125][T11700] ? ksys_write+0x22a/0x250 [ 525.255151][T11700] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 525.255174][T11700] __do_fast_syscall_32+0xb6/0x2b0 [ 525.255195][T11700] ? lockdep_hardirqs_on+0x9c/0x150 [ 525.255213][T11700] do_fast_syscall_32+0x34/0x80 [ 525.255229][T11700] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 525.255247][T11700] RIP: 0023:0xf7f74539 [ 525.255259][T11700] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 525.255271][T11700] RSP: 002b:00000000f546655c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 525.255286][T11700] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 00000000800034c0 [ 525.255295][T11700] RDX: 000000000000013c RSI: 0000000000000700 RDI: 0000000000000000 [ 525.255304][T11700] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 525.255324][T11700] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 525.255331][T11700] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 525.255349][T11700] [ 525.605611][ C1] vkms_vblank_simulate: vblank timer overrun [ 525.953755][ T7945] usb 1-1: new full-speed USB device number 51 using dummy_hcd [ 525.984555][ T7945] usb 1-1: device descriptor read/8, error -71 [ 526.263831][ T7945] usb 1-1: new full-speed USB device number 52 using dummy_hcd [ 526.337704][ T7945] usb 1-1: device descriptor read/8, error -71 [ 526.468167][ T7945] usb usb1-port1: unable to enumerate USB device [ 528.749676][T11667] syz.1.1404 (11667): drop_caches: 1 [ 528.768931][T11665] syz.1.1404 (11665): drop_caches: 1 [ 530.120301][ T30] audit: type=1326 audit(1759561522.726:424): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 530.374164][ T30] audit: type=1326 audit(1759561522.726:425): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 530.396378][ C1] vkms_vblank_simulate: vblank timer overrun [ 530.681090][ T30] audit: type=1326 audit(1759561522.726:426): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 530.924732][ T30] audit: type=1326 audit(1759561522.726:427): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 530.946771][ C1] vkms_vblank_simulate: vblank timer overrun [ 530.957397][ T30] audit: type=1326 audit(1759561522.726:428): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 530.979397][ C1] vkms_vblank_simulate: vblank timer overrun [ 530.993731][ T30] audit: type=1326 audit(1759561522.726:429): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 531.038862][ T30] audit: type=1326 audit(1759561522.726:430): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 531.061024][ C1] vkms_vblank_simulate: vblank timer overrun [ 531.217511][T11751] netlink: 'syz.7.1423': attribute type 10 has an invalid length. [ 531.228241][T11751] netlink: 40 bytes leftover after parsing attributes in process `syz.7.1423'. [ 531.311811][T11751] team0: Port device geneve0 added [ 531.393757][ T30] audit: type=1326 audit(1759561522.726:431): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 531.464213][ T30] audit: type=1326 audit(1759561522.726:432): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 531.600387][ T30] audit: type=1326 audit(1759561522.736:433): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=11737 comm="syz.0.1420" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf70ce539 code=0x7ffc0000 [ 532.234537][ T5924] usb 2-1: new high-speed USB device number 44 using dummy_hcd [ 532.380392][T11770] ip6tnl1: entered promiscuous mode [ 532.414193][ T5924] usb 2-1: Using ep0 maxpacket: 16 [ 532.450631][T11770] ip6tnl1: entered allmulticast mode [ 532.450890][ T5924] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 532.482665][T11770] team0: Device ip6tnl1 is of different type [ 532.513918][ T5924] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x82 has an invalid bInterval 0, changing to 7 [ 532.528757][ T5924] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x2 has invalid wMaxPacketSize 0 [ 532.583679][ T5924] usb 2-1: config 0 interface 0 altsetting 0 bulk endpoint 0x2 has invalid maxpacket 0 [ 532.604519][ T5924] usb 2-1: config 0 interface 0 altsetting 0 has 2 endpoint descriptors, different from the interface descriptor's value: 3 [ 532.629615][ T5924] usb 2-1: New USB device found, idVendor=2040, idProduct=b138, bcdDevice= 1.42 [ 532.641863][ T5924] usb 2-1: New USB device strings: Mfr=4, Product=0, SerialNumber=0 [ 532.712167][ T5924] usb 2-1: Manufacturer: syz [ 532.752771][ T5924] usb 2-1: config 0 descriptor?? [ 533.384045][T11759] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=2142054965 (4284109930 ns) > initial count (2850433972 ns). Using initial count to start timer. [ 533.703965][ T5925] usb 1-1: new high-speed USB device number 53 using dummy_hcd [ 533.893740][ T5925] usb 1-1: Using ep0 maxpacket: 8 [ 533.903809][ T5925] usb 1-1: config 1 contains an unexpected descriptor of type 0x1, skipping [ 533.942590][ T5925] usb 1-1: config 1 has an invalid descriptor of length 1, skipping remainder of the config [ 534.213807][ T5925] usb 1-1: config 1 has 1 interface, different from the descriptor's value: 3 [ 534.362101][ T5925] usb 1-1: New USB device found, idVendor=1d6b, idProduct=0101, bcdDevice= 0.40 [ 534.402600][ T5925] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 534.461375][ T5925] usb 1-1: Product: syz [ 534.513082][ T5925] usb 1-1: Manufacturer: syz [ 534.534378][ T5925] usb 1-1: SerialNumber: syz [ 534.841526][T11790] UDC core: USB Raw Gadget: couldn't find an available UDC or it's busy [ 534.853022][T11790] misc raw-gadget: fail, usb_gadget_register_driver returned -16 [ 535.154587][ T5924] rc_core: IR keymap rc-hauppauge not found [ 535.160685][ T5924] Registered IR keymap rc-empty [ 535.167468][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.210214][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.239903][ T5924] rc rc0: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0 [ 535.305861][ T5924] input: Conexant Hybrid TV (cx231xx) MCE IR no TX as /devices/platform/dummy_hcd.1/usb2/2-1/2-1:0.0/rc/rc0/input22 [ 535.339268][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.379870][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.413831][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.445791][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.473830][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.566914][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.606092][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.624690][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.753181][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.784061][ T5924] mceusb 2-1:0.0: Error: mce write submit urb error = -90 [ 535.879306][ T5924] mceusb 2-1:0.0: Registered with mce emulator interface version 1 [ 535.888062][ T5924] mceusb 2-1:0.0: 2 tx ports (0x0 cabled) and 2 rx sensors (0x0 active) [ 535.974224][ T5924] usb 2-1: USB disconnect, device number 44 [ 536.394755][ T5925] usb 1-1: 0:2 : does not exist [ 536.544055][ T5925] usb 1-1: USB disconnect, device number 53 [ 536.644056][ T5924] usb 2-1: new high-speed USB device number 45 using dummy_hcd [ 536.884239][ T5924] usb 2-1: New USB device found, idVendor=9710, idProduct=7730, bcdDevice=96.33 [ 537.213712][ T5924] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 537.220293][T11828] tipc: Enabled bearer , priority 0 [ 537.345511][T11829] syzkaller0: entered promiscuous mode [ 537.346874][ T5924] usb 2-1: config 0 descriptor?? [ 537.351018][T11829] syzkaller0: entered allmulticast mode [ 537.459511][T11828] tipc: Resetting bearer [ 537.540242][T11827] tipc: Resetting bearer [ 537.585098][ T5924] usb 2-1: Cannot set MAC address [ 537.617906][ T5924] MOSCHIP usb-ethernet driver 2-1:0.0: probe with driver MOSCHIP usb-ethernet driver failed with error -71 [ 537.652017][T11827] tipc: Disabling bearer [ 537.715225][ T5924] usb 2-1: USB disconnect, device number 45 [ 537.724704][T11835] FAULT_INJECTION: forcing a failure. [ 537.724704][T11835] name failslab, interval 1, probability 0, space 0, times 0 [ 537.789430][T11835] CPU: 1 UID: 0 PID: 11835 Comm: syz.1.1448 Not tainted syzkaller #0 PREEMPT(full) [ 537.789458][T11835] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 537.789470][T11835] Call Trace: [ 537.789478][T11835] [ 537.789487][T11835] dump_stack_lvl+0x189/0x250 [ 537.789518][T11835] ? __pfx____ratelimit+0x10/0x10 [ 537.789542][T11835] ? __pfx_dump_stack_lvl+0x10/0x10 [ 537.789567][T11835] ? __pfx__printk+0x10/0x10 [ 537.789602][T11835] ? __pfx___might_resched+0x10/0x10 [ 537.789624][T11835] ? fs_reclaim_acquire+0x7d/0x100 [ 537.789659][T11835] should_fail_ex+0x414/0x560 [ 537.789697][T11835] should_failslab+0xa8/0x100 [ 537.789741][T11835] kmem_cache_alloc_node_noprof+0x77/0x710 [ 537.789769][T11835] ? __alloc_skb+0x112/0x2d0 [ 537.789800][T11835] __alloc_skb+0x112/0x2d0 [ 537.789829][T11835] netlink_dump+0x1b7/0xe90 [ 537.789866][T11835] ? __pfx_netlink_dump+0x10/0x10 [ 537.789907][T11835] ? netlink_recvmsg+0x5b2/0xa30 [ 537.789929][T11835] ? kmem_cache_free+0x19b/0x690 [ 537.789964][T11835] netlink_recvmsg+0x676/0xa30 [ 537.790000][T11835] ? __pfx_netlink_recvmsg+0x10/0x10 [ 537.790039][T11835] ? __pfx_netlink_recvmsg+0x10/0x10 [ 537.790065][T11835] sock_recvmsg_nosec+0x186/0x1c0 [ 537.790091][T11835] ____sys_recvmsg+0x3aa/0x460 [ 537.790129][T11835] ? __pfx_____sys_recvmsg+0x10/0x10 [ 537.790154][T11835] ? get_compat_msghdr+0x37e/0x4a0 [ 537.790193][T11835] ? ___sys_recvmsg+0x1c4/0x510 [ 537.790219][T11835] ? kfree+0x4d/0x6d0 [ 537.790250][T11835] ___sys_recvmsg+0x1b5/0x510 [ 537.790284][T11835] ? __pfx____sys_recvmsg+0x10/0x10 [ 537.790340][T11835] ? __fget_files+0x3a0/0x420 [ 537.790382][T11835] do_recvmmsg+0x36a/0x770 [ 537.790420][T11835] ? __pfx_do_recvmmsg+0x10/0x10 [ 537.790462][T11835] ? __pfx_vfs_write+0x10/0x10 [ 537.790515][T11835] __sys_recvmmsg+0x19d/0x280 [ 537.790547][T11835] ? __pfx___sys_recvmmsg+0x10/0x10 [ 537.790572][T11835] ? ksys_write+0x22a/0x250 [ 537.790610][T11835] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 537.790643][T11835] __do_fast_syscall_32+0xb6/0x2b0 [ 537.790668][T11835] ? lockdep_hardirqs_on+0x9c/0x150 [ 537.790695][T11835] do_fast_syscall_32+0x34/0x80 [ 537.790718][T11835] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 537.790748][T11835] RIP: 0023:0xf7fe3539 [ 537.790765][T11835] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 537.790782][T11835] RSP: 002b:00000000f54b555c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 537.790803][T11835] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000a00 [ 537.790816][T11835] RDX: 0000000000000008 RSI: 0000000040010020 RDI: 0000000000000000 [ 537.790828][T11835] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 537.790840][T11835] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 537.790851][T11835] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 537.790879][T11835] [ 538.082195][ C1] vkms_vblank_simulate: vblank timer overrun [ 538.813749][ T7945] usb 9-1: new high-speed USB device number 6 using dummy_hcd [ 538.978475][ T7945] usb 9-1: Using ep0 maxpacket: 16 [ 538.988455][ T7945] usb 9-1: config 0 has an invalid interface number: 206 but max is 0 [ 539.007774][ T7945] usb 9-1: config 0 has no interface number 0 [ 539.036167][ T7945] usb 9-1: New USB device found, idVendor=077d, idProduct=627a, bcdDevice= 0.10 [ 539.046390][ T7945] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 539.054712][ T7945] usb 9-1: Product: syz [ 539.059439][ T7945] usb 9-1: Manufacturer: syz [ 539.067028][ T7945] usb 9-1: SerialNumber: syz [ 539.101759][ T7945] usb 9-1: config 0 descriptor?? [ 539.117625][ T7945] radioshark2 9-1:0.206: Invalid radioSHARK2 device [ 539.129221][ T7945] radioshark2 9-1:0.206: probe with driver radioshark2 failed with error -22 [ 539.160109][ T7945] usbhid 9-1:0.206: couldn't find an input interrupt endpoint [ 539.495796][ T7945] usb 9-1: USB disconnect, device number 6 [ 540.481016][T11880] tipc: Enabled bearer , priority 0 [ 540.508508][T11880] syzkaller0: entered promiscuous mode [ 540.514219][T11880] syzkaller0: entered allmulticast mode [ 541.038942][T11889] tipc: Resetting bearer [ 541.090109][T11879] tipc: Resetting bearer [ 541.208761][T11879] tipc: Disabling bearer [ 541.344178][T11869] netlink: 24 bytes leftover after parsing attributes in process `syz.0.1456'. [ 544.455967][T11937] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 544.950890][T11942] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1473'. [ 546.006901][T11953] tipc: Enabled bearer , priority 0 [ 546.038121][T11953] syzkaller0: entered promiscuous mode [ 546.067124][T11953] syzkaller0: entered allmulticast mode [ 546.264455][T11953] tipc: Resetting bearer [ 546.279045][T11952] tipc: Resetting bearer [ 546.325318][T11952] tipc: Disabling bearer [ 549.608428][T11988] Bluetooth: hci0: command 0x0406 tx timeout [ 549.647648][ T30] kauditd_printk_skb: 25 callbacks suppressed [ 549.647666][ T30] audit: type=1326 audit(1759561542.296:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 549.793884][ T30] audit: type=1326 audit(1759561542.326:460): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.000509][ T30] audit: type=1326 audit(1759561542.326:461): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=370 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.059110][ T30] audit: type=1326 audit(1759561542.326:462): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.089368][ T30] audit: type=1326 audit(1759561542.326:463): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.433713][ T30] audit: type=1326 audit(1759561542.326:464): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.587214][ C0] vkms_vblank_simulate: vblank timer overrun [ 550.623799][ T7927] usb 9-1: new high-speed USB device number 7 using dummy_hcd [ 550.671885][ T30] audit: type=1326 audit(1759561542.326:465): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.785950][ T7927] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 550.803824][ T30] audit: type=1326 audit(1759561542.326:466): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.828108][ T7927] usb 9-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 550.873713][ T7927] usb 9-1: New USB device found, idVendor=054c, idProduct=0df2, bcdDevice=d6.af [ 550.882963][ T7927] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 550.910670][ T30] audit: type=1326 audit(1759561542.326:467): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=54 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 550.984206][ T7927] usb 9-1: config 0 descriptor?? [ 551.052612][ T30] audit: type=1326 audit(1759561542.336:468): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12005 comm="syz.5.1492" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf702e539 code=0x7ffc0000 [ 551.245586][T12027] FAULT_INJECTION: forcing a failure. [ 551.245586][T12027] name failslab, interval 1, probability 0, space 0, times 0 [ 551.288170][T12027] CPU: 0 UID: 0 PID: 12027 Comm: syz.1.1499 Not tainted syzkaller #0 PREEMPT(full) [ 551.288191][T12027] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 551.288200][T12027] Call Trace: [ 551.288207][T12027] [ 551.288213][T12027] dump_stack_lvl+0x189/0x250 [ 551.288234][T12027] ? __pfx____ratelimit+0x10/0x10 [ 551.288251][T12027] ? __pfx_dump_stack_lvl+0x10/0x10 [ 551.288267][T12027] ? __pfx__printk+0x10/0x10 [ 551.288295][T12027] ? __pfx___might_resched+0x10/0x10 [ 551.288310][T12027] ? fs_reclaim_acquire+0x7d/0x100 [ 551.288335][T12027] should_fail_ex+0x414/0x560 [ 551.288361][T12027] should_failslab+0xa8/0x100 [ 551.288385][T12027] __kmalloc_noprof+0xcb/0x7f0 [ 551.288403][T12027] ? tomoyo_encode+0x28b/0x550 [ 551.288422][T12027] tomoyo_encode+0x28b/0x550 [ 551.288440][T12027] tomoyo_realpath_from_path+0x58d/0x5d0 [ 551.288463][T12027] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 551.288482][T12027] tomoyo_path_number_perm+0x1e8/0x5a0 [ 551.288504][T12027] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 551.288536][T12027] ? __lock_acquire+0xab9/0xd20 [ 551.288565][T12027] ? __fget_files+0x2a/0x420 [ 551.288589][T12027] ? __fget_files+0x3a0/0x420 [ 551.288609][T12027] ? __fget_files+0x2a/0x420 [ 551.288634][T12027] security_file_ioctl_compat+0xcb/0x2d0 [ 551.288655][T12027] __ia32_compat_sys_ioctl+0x128/0x840 [ 551.288676][T12027] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 551.288693][T12027] ? __fget_files+0x3a0/0x420 [ 551.288719][T12027] ? fput+0xa0/0xd0 [ 551.288734][T12027] ? ksys_write+0x22a/0x250 [ 551.288762][T12027] ? lockdep_hardirqs_on+0x9c/0x150 [ 551.288788][T12027] __do_fast_syscall_32+0xb6/0x2b0 [ 551.288812][T12027] ? lockdep_hardirqs_on+0x9c/0x150 [ 551.288836][T12027] do_fast_syscall_32+0x34/0x80 [ 551.288859][T12027] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 551.288889][T12027] RIP: 0023:0xf7fe3539 [ 551.288902][T12027] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 551.288914][T12027] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 551.288929][T12027] RAX: ffffffffffffffda RBX: 0000000000000006 RCX: 0000000000007434 [ 551.288939][T12027] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 551.288946][T12027] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 551.288954][T12027] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 551.288963][T12027] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 551.288982][T12027] [ 551.289016][T12027] ERROR: Out of memory at tomoyo_realpath_from_path. [ 551.567695][ T7927] hid_parser_main: 28 callbacks suppressed [ 551.567715][ T7927] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 551.596553][ T7927] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 551.613855][ T7927] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 551.621315][ T7927] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 551.647503][ T7927] playstation 0003:054C:0DF2.0030: unknown main item tag 0x0 [ 551.664199][ T7927] playstation 0003:054C:0DF2.0030: hidraw0: USB HID v1.01 Device [HID 054c:0df2] on usb-dummy_hcd.8-1/input0 [ 551.891980][ T7927] playstation 0003:054C:0DF2.0030: Invalid byte count transferred, expected 20 got 0 [ 552.154042][ T7927] playstation 0003:054C:0DF2.0030: Failed to retrieve DualSense pairing info: -22 [ 552.298567][ T7927] playstation 0003:054C:0DF2.0030: Failed to get MAC address from DualSense [ 552.371246][ T7927] playstation 0003:054C:0DF2.0030: Failed to create dualsense. [ 552.398732][ T7927] playstation 0003:054C:0DF2.0030: probe with driver playstation failed with error -22 [ 554.369635][T12068] tipc: Started in network mode [ 554.383734][T12068] tipc: Node identity 2a0affd37e69, cluster identity 4711 [ 554.559705][T12068] tipc: Enabled bearer , priority 0 [ 554.586947][T12069] syzkaller0: entered promiscuous mode [ 554.592542][T12069] syzkaller0: entered allmulticast mode [ 554.605433][ T7927] usb 9-1: USB disconnect, device number 7 [ 554.664887][T12068] tipc: Resetting bearer [ 554.723864][T11988] Bluetooth: hci2: command 0x0406 tx timeout [ 554.751409][T12067] tipc: Resetting bearer [ 554.872846][T12067] tipc: Disabling bearer [ 555.003249][T12080] netlink: 'syz.0.1511': attribute type 29 has an invalid length. [ 555.025300][T12080] netlink: 4 bytes leftover after parsing attributes in process `syz.0.1511'. [ 555.265120][T12083] netlink: 36 bytes leftover after parsing attributes in process `syz.7.1513'. [ 556.301880][T12096] dvmrp0: entered allmulticast mode [ 557.143875][ T88] usb 9-1: new high-speed USB device number 8 using dummy_hcd [ 557.344105][ T88] usb 9-1: Using ep0 maxpacket: 16 [ 557.364131][ T88] usb 9-1: too many configurations: 16, using maximum allowed: 8 [ 557.378688][ T88] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 557.386549][ T5924] usb 1-1: new high-speed USB device number 54 using dummy_hcd [ 557.394853][ T88] usb 9-1: can't read configurations, error -61 [ 557.543896][ T88] usb 9-1: new high-speed USB device number 9 using dummy_hcd [ 557.553064][ T5924] usb 1-1: New USB device found, idVendor=0813, idProduct=0001, bcdDevice=3a.08 [ 557.572985][ T5924] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 557.587709][ T5924] usb 1-1: config 0 descriptor?? [ 557.626298][ T5924] gspca_main: cpia1-2.14.0 probing 0813:0001 [ 557.737900][ T88] usb 9-1: Using ep0 maxpacket: 16 [ 557.751662][ T88] usb 9-1: too many configurations: 16, using maximum allowed: 8 [ 557.761937][ T88] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 557.806491][ T88] usb 9-1: can't read configurations, error -61 [ 557.813413][ T88] usb usb9-port1: attempt power cycle [ 558.593817][ T88] usb 9-1: new high-speed USB device number 10 using dummy_hcd [ 558.728357][ T7939] usb 6-1: new high-speed USB device number 23 using dummy_hcd [ 558.754161][ T88] usb 9-1: Using ep0 maxpacket: 16 [ 558.771824][ T88] usb 9-1: too many configurations: 16, using maximum allowed: 8 [ 558.792779][ T88] usb 9-1: unable to read config index 0 descriptor/start: -61 [ 558.827329][ T88] usb 9-1: can't read configurations, error -61 [ 558.888418][ T5924] gspca_cpia1: usb_control_msg 01, error -71 [ 558.900468][ T5924] cpia1 1-1:0.0: only firmware version 1 is supported (got: 0) [ 558.934002][ T7939] usb 6-1: Using ep0 maxpacket: 16 [ 558.936854][ T5924] usb 1-1: USB disconnect, device number 54 [ 558.941691][ T7939] usb 6-1: config 0 interface 0 altsetting 0 has an endpoint descriptor with address 0xF3, changing to 0x83 [ 558.959144][ T7939] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x83 has an invalid bInterval 0, changing to 7 [ 559.008126][ T7939] usb 6-1: New USB device found, idVendor=2040, idProduct=0264, bcdDevice=4e.d1 [ 559.014590][ T88] usb 9-1: new high-speed USB device number 11 using dummy_hcd [ 559.036616][ T7939] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 559.045569][ T7939] usb 6-1: Product: syz [ 559.050024][ T7939] usb 6-1: Manufacturer: syz [ 559.054857][ T7939] usb 6-1: SerialNumber: syz [ 559.108529][ T7939] usb 6-1: config 0 descriptor?? [ 559.123532][ T7939] em28xx 6-1:0.0: New device syz syz @ 480 Mbps (2040:0264, interface 0, class 0) [ 559.133571][ T7939] em28xx 6-1:0.0: Audio interface 0 found (Vendor Class) [ 559.638965][ T88] usb 9-1: device descriptor read/8, error -71 [ 559.758211][ T88] usb usb9-port1: unable to enumerate USB device [ 559.833184][T12131] capability: warning: `syz.0.1524' uses deprecated v2 capabilities in a way that may be insecure [ 559.874969][ T7939] em28xx 6-1:0.0: unknown em28xx chip ID (0) [ 559.875919][ T7939] em28xx 6-1:0.0: Config register raw data: 0xfffffffb [ 559.877447][ T7939] em28xx 6-1:0.0: AC97 chip type couldn't be determined [ 559.877468][ T7939] em28xx 6-1:0.0: No AC97 audio processor [ 560.115840][T12138] FAULT_INJECTION: forcing a failure. [ 560.115840][T12138] name failslab, interval 1, probability 0, space 0, times 0 [ 560.115888][T12138] CPU: 0 UID: 0 PID: 12138 Comm: syz.0.1525 Not tainted syzkaller #0 PREEMPT(full) [ 560.115917][T12138] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 560.115928][T12138] Call Trace: [ 560.115936][T12138] [ 560.115944][T12138] dump_stack_lvl+0x189/0x250 [ 560.115972][T12138] ? __pfx____ratelimit+0x10/0x10 [ 560.115994][T12138] ? __pfx_dump_stack_lvl+0x10/0x10 [ 560.116018][T12138] ? __pfx__printk+0x10/0x10 [ 560.116051][T12138] ? __pfx___might_resched+0x10/0x10 [ 560.116071][T12138] ? fs_reclaim_acquire+0x7d/0x100 [ 560.116105][T12138] should_fail_ex+0x414/0x560 [ 560.116141][T12138] should_failslab+0xa8/0x100 [ 560.116175][T12138] __kmalloc_noprof+0xcb/0x7f0 [ 560.116200][T12138] ? tomoyo_encode+0x28b/0x550 [ 560.116227][T12138] tomoyo_encode+0x28b/0x550 [ 560.116253][T12138] tomoyo_realpath_from_path+0x58d/0x5d0 [ 560.116284][T12138] ? tomoyo_path_number_perm+0x1bc/0x5a0 [ 560.116312][T12138] tomoyo_path_number_perm+0x1e8/0x5a0 [ 560.116343][T12138] ? __pfx_tomoyo_path_number_perm+0x10/0x10 [ 560.116387][T12138] ? __lock_acquire+0xab9/0xd20 [ 560.116446][T12138] ? __fget_files+0x2a/0x420 [ 560.116481][T12138] ? __fget_files+0x3a0/0x420 [ 560.116510][T12138] ? __fget_files+0x2a/0x420 [ 560.116534][T12138] security_file_ioctl_compat+0xcb/0x2d0 [ 560.116556][T12138] __ia32_compat_sys_ioctl+0x128/0x840 [ 560.116578][T12138] ? __pfx___ia32_compat_sys_ioctl+0x10/0x10 [ 560.116596][T12138] ? __fget_files+0x3a0/0x420 [ 560.116622][T12138] ? fput+0xa0/0xd0 [ 560.116638][T12138] ? ksys_write+0x22a/0x250 [ 560.116664][T12138] ? lockdep_hardirqs_on+0x9c/0x150 [ 560.116682][T12138] __do_fast_syscall_32+0xb6/0x2b0 [ 560.116700][T12138] ? lockdep_hardirqs_on+0x9c/0x150 [ 560.116718][T12138] do_fast_syscall_32+0x34/0x80 [ 560.116735][T12138] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 560.116753][T12138] RIP: 0023:0xf70ce539 [ 560.116765][T12138] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 560.116778][T12138] RSP: 002b:00000000f54be55c EFLAGS: 00000206 ORIG_RAX: 0000000000000036 [ 560.116793][T12138] RAX: ffffffffffffffda RBX: 0000000000000007 RCX: 0000000000005393 [ 560.116803][T12138] RDX: 0000000080000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 560.116812][T12138] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 560.116820][T12138] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 560.116828][T12138] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 560.116849][T12138] [ 560.116872][T12138] ERROR: Out of memory at tomoyo_realpath_from_path. [ 560.786766][ T5925] usb 6-1: USB disconnect, device number 23 [ 561.038270][ T5925] em28xx 6-1:0.0: Disconnecting em28xx [ 561.044153][ T5925] em28xx 6-1:0.0: Freeing device [ 562.027155][T12159] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1531'. [ 562.318492][ T7941] usb 2-1: new high-speed USB device number 46 using dummy_hcd [ 562.476118][ T7941] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 562.489343][ T7941] usb 2-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 562.503712][ T7941] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 562.521945][ T7941] usb 2-1: Product: syz [ 562.526584][ T7941] usb 2-1: Manufacturer: syz [ 562.531210][ T7941] usb 2-1: SerialNumber: syz [ 562.548137][ T7941] usb 2-1: config 0 descriptor?? [ 562.693738][ T5925] usb 9-1: new full-speed USB device number 12 using dummy_hcd [ 562.766222][ T7941] usb 2-1: probing VID:PID(2201:012C) [ 562.795754][ T7941] usb 2-1: Could not find two sets of bulk-in/out endpoint pairs [ 562.805452][ T7941] vub300 2-1:0.0: probe with driver vub300 failed with error -22 [ 562.816008][ T7941] usb 2-1: USB disconnect, device number 46 [ 562.897835][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 562.901404][ T5925] usb 9-1: New USB device found, idVendor=2040, idProduct=9301, bcdDevice=e4.fb [ 562.905443][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 562.929694][ T5925] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 562.966781][ T5925] dvb-usb: found a 'Hauppauge WinTV-NOVA-T usb2' in warm state. [ 562.985713][ T5925] dvb-usb: bulk message failed: -22 (3/0) [ 563.021201][ T5925] dvb-usb: will use the device's hardware PID filter (table count: 32). [ 563.041103][ T5925] dvbdev: DVB: registering new adapter (Hauppauge WinTV-NOVA-T usb2) [ 563.063805][ T5925] usb 9-1: media controller created [ 563.084154][ T5925] dvb-usb: bulk message failed: -22 (5/0) [ 563.134026][ T5925] dvb-usb: MAC address reading failed. [ 563.148204][ T5925] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 563.170809][ T5925] dvb-usb: bulk message failed: -22 (6/0) [ 563.177218][ T5925] dvb-usb: bulk message failed: -22 (6/0) [ 563.183091][ T5925] dvb-usb: no frontend was attached by 'Hauppauge WinTV-NOVA-T usb2' [ 563.196918][ T5925] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.8/usb9/9-1/input/input24 [ 563.209927][T12164] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1533'. [ 563.231419][ T5925] dvb-usb: schedule remote query interval to 100 msecs. [ 563.240667][ T5925] dvb-usb: Hauppauge WinTV-NOVA-T usb2 successfully initialized and connected. [ 563.292994][T12176] fuse: Bad value for 'fd' [ 563.301908][T12176] kvm: vcpu 0: requested lapic timer restore with starting count register 0x390=680 (1360 ns) > initial count (1048 ns). Using initial count to start timer. [ 563.343810][ T5925] dvb-usb: bulk message failed: -22 (2/0) [ 563.350795][ T5925] dvb-usb: error while querying for an remote control event. [ 563.468015][T12179] netlink: 1076 bytes leftover after parsing attributes in process `syz.1.1537'. [ 563.473799][ T5925] dvb-usb: bulk message failed: -22 (2/0) [ 563.493265][ T5925] dvb-usb: error while querying for an remote control event. [ 563.633057][ T5925] dvb-usb: bulk message failed: -22 (2/0) [ 563.649156][ T5925] dvb-usb: error while querying for an remote control event. [ 563.715414][ T5925] usb 9-1: USB disconnect, device number 12 [ 564.240871][ T5925] dvb-usb: Hauppauge WinTV-NOVA-T usb2 successfully deinitialized and disconnected. [ 566.544785][ T30] kauditd_printk_skb: 28 callbacks suppressed [ 566.544805][ T30] audit: type=1326 audit(1759561559.196:497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 566.692208][ T30] audit: type=1326 audit(1759561559.196:498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=310 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 566.751490][ T30] audit: type=1326 audit(1759561559.196:499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 566.754687][T12214] netlink: 36 bytes leftover after parsing attributes in process `syz.8.1547'. [ 566.829857][ T5925] usb 6-1: new high-speed USB device number 24 using dummy_hcd [ 566.896921][ T30] audit: type=1326 audit(1759561559.196:500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 566.979494][ T30] audit: type=1326 audit(1759561559.196:501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=259 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 567.031062][ T5925] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 567.042399][ T5925] usb 6-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 567.111980][ T30] audit: type=1326 audit(1759561559.196:502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 567.133689][ T5925] usb 6-1: New USB device found, idVendor=1e7d, idProduct=30d4, bcdDevice= 0.00 [ 567.144291][ T5925] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 567.163771][ T7945] usb 9-1: new high-speed USB device number 13 using dummy_hcd [ 567.179308][ T5925] usb 6-1: config 0 descriptor?? [ 567.247171][ T30] audit: type=1326 audit(1759561559.196:503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 567.271925][ T30] audit: type=1326 audit(1759561559.196:504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=260 compat=1 ip=0xf7fe3539 code=0x7ffc0000 [ 567.334808][ T30] audit: type=1326 audit(1759561559.196:505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fe3558 code=0x7ffc0000 [ 567.383793][ T30] audit: type=1326 audit(1759561559.196:506): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12211 comm="syz.1.1546" exe="/root/syz-executor" sig=0 arch=40000003 syscall=119 compat=1 ip=0xf7fe3558 code=0x7ffc0000 [ 567.387986][ T7945] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 567.420900][T12210] netlink: 28 bytes leftover after parsing attributes in process `syz.5.1545'. [ 567.430045][T12210] netlink: 'syz.5.1545': attribute type 7 has an invalid length. [ 567.503795][T12210] netlink: 'syz.5.1545': attribute type 8 has an invalid length. [ 567.533215][T12210] netlink: 4 bytes leftover after parsing attributes in process `syz.5.1545'. [ 567.537016][ T7945] usb 9-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 567.552931][T12219] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1549'. [ 567.561942][ T7945] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 567.573886][ T7945] usb 9-1: Product: syz [ 567.578178][ T7945] usb 9-1: Manufacturer: syz [ 567.590396][ T7945] usb 9-1: SerialNumber: syz [ 567.603223][ T7945] usb 9-1: config 0 descriptor?? [ 567.735461][ T5925] arvo 0003:1E7D:30D4.0031: unbalanced collection at end of report description [ 567.805166][ T5925] arvo 0003:1E7D:30D4.0031: parse failed [ 567.840307][ T5925] arvo 0003:1E7D:30D4.0031: probe with driver arvo failed with error -22 [ 567.850869][ T7945] usb 9-1: probing VID:PID(2201:012C) [ 567.860080][ T7945] usb 9-1: Could not find two sets of bulk-in/out endpoint pairs [ 567.880827][ T7945] vub300 9-1:0.0: probe with driver vub300 failed with error -22 [ 567.917963][ T7945] usb 9-1: USB disconnect, device number 13 [ 567.957063][ T5925] usb 6-1: USB disconnect, device number 24 [ 568.363812][ T7939] usb 2-1: new full-speed USB device number 47 using dummy_hcd [ 569.301618][T12246] tipc: Started in network mode [ 569.333929][T12246] tipc: Node identity 423ec2c228f8, cluster identity 4711 [ 569.344228][T12246] tipc: Enabled bearer , priority 0 [ 569.394335][T12247] syzkaller0: entered promiscuous mode [ 569.425612][T12247] syzkaller0: entered allmulticast mode [ 569.603276][T12245] tipc: Resetting bearer [ 569.784947][T12245] tipc: Disabling bearer [ 571.220148][ T7939] usb 2-1: new high-speed USB device number 48 using dummy_hcd [ 571.374275][ T7939] usb 2-1: Using ep0 maxpacket: 16 [ 571.381502][ T7939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 571.408165][ T7939] usb 2-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 571.436487][ T7939] usb 2-1: config 0 interface 0 altsetting 0 has 1 endpoint descriptor, different from the interface descriptor's value: 9 [ 571.477788][ T7939] usb 2-1: New USB device found, idVendor=045e, idProduct=07da, bcdDevice= 0.00 [ 571.495708][ T7945] usb 1-1: new high-speed USB device number 55 using dummy_hcd [ 571.513742][ T7939] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 571.568850][ T7939] usb 2-1: config 0 descriptor?? [ 571.753756][ T7945] usb 1-1: Using ep0 maxpacket: 32 [ 571.977981][ T7945] usb 1-1: config 0 has an invalid interface number: 64 but max is 1 [ 571.992090][ T7945] usb 1-1: config 0 has no interface number 1 [ 572.114658][ T7945] usb 1-1: New USB device found, idVendor=1630, idProduct=0042, bcdDevice=1c.a5 [ 572.131206][ T7945] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 572.160153][ T7945] usb 1-1: Product: syz [ 572.167919][ T7945] usb 1-1: Manufacturer: syz [ 572.178067][ T7945] usb 1-1: SerialNumber: syz [ 572.214559][ T7945] usb 1-1: config 0 descriptor?? [ 572.225748][ T7945] usb 1-1: bad CDC descriptors [ 572.589452][ T88] usb 1-1: USB disconnect, device number 55 [ 572.973843][T12287] netlink: 8 bytes leftover after parsing attributes in process `syz.5.1566'. [ 574.592491][ T7939] usbhid 2-1:0.0: can't add hid device: -71 [ 574.623786][ T7939] usbhid 2-1:0.0: probe with driver usbhid failed with error -71 [ 574.714335][ T7939] usb 2-1: USB disconnect, device number 48 [ 575.093711][ T7939] usb 2-1: new high-speed USB device number 49 using dummy_hcd [ 575.296719][ T7939] usb 2-1: Using ep0 maxpacket: 8 [ 575.342282][ T7939] usb 2-1: New USB device found, idVendor=1557, idProduct=7720, bcdDevice=b7.eb [ 575.367150][ T7939] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 575.407670][ T7939] usb 2-1: config 0 descriptor?? [ 575.678946][ T7939] asix 2-1:0.0 (unnamed net_device) (uninitialized): invalid hw address, using random [ 575.740291][T12322] netlink: 'syz.8.1576': attribute type 4 has an invalid length. [ 575.748331][T12322] netlink: 17 bytes leftover after parsing attributes in process `syz.8.1576'. [ 575.794619][T12326] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1576'. [ 576.092216][T12335] vivid-000: ================= START STATUS ================= [ 576.103408][T12335] vivid-000: Test Pattern: 75% Colorbar [ 576.109367][T12335] vivid-000: Fill Percentage of Frame: 100 [ 576.115663][T12335] vivid-000: Horizontal Movement: Move Left Fast [ 576.123409][T12335] vivid-000: Vertical Movement: No Movement [ 576.129551][T12335] vivid-000: OSD Text Mode: All [ 576.134530][T12335] vivid-000: Show Border: false [ 576.140131][T12335] vivid-000: Show Square: false [ 576.145175][T12335] vivid-000: Sensor Flipped Horizontally: false [ 576.151474][T12335] vivid-000: Sensor Flipped Vertically: false [ 576.157690][T12335] vivid-000: Insert SAV Code in Image: false [ 576.163977][T12335] vivid-000: Insert EAV Code in Image: false [ 576.170019][T12335] vivid-000: Insert Video Guard Band: false [ 576.176059][T12335] vivid-000: Reduced Framerate: false [ 576.181484][T12335] vivid-000: HDMI 000-0 Is Connected To: Test Pattern Generator [ 576.292965][T12335] vivid-000: S-Video 000-0 Is Connected To: Test Pattern Generator [ 576.301011][T12335] vivid-000: Enable Capture Cropping: true grabbed [ 576.307684][T12335] vivid-000: Enable Capture Composing: true grabbed [ 576.314407][T12335] vivid-000: Enable Capture Scaler: true grabbed [ 576.321173][T12335] vivid-000: Timestamp Source: End of Frame [ 576.327479][T12335] vivid-000: Colorspace: sRGB [ 576.332339][T12335] vivid-000: Transfer Function: Default [ 576.338001][T12335] vivid-000: Y'CbCr Encoding: Default [ 576.343441][T12335] vivid-000: HSV Encoding: Hue 0-179 [ 576.348901][T12335] vivid-000: Quantization: Default [ 576.354183][T12335] vivid-000: Apply Alpha To Red Only: false [ 576.360125][T12335] vivid-000: Standard Aspect Ratio: 4x3 [ 576.365789][T12335] vivid-000: DV Timings Signal Mode: Current DV Timings inactive [ 576.373768][T12335] vivid-000: DV Timings: 640x480p59 inactive [ 576.379823][T12335] vivid-000: DV Timings Aspect Ratio: Source Width x Height [ 576.387250][T12335] vivid-000: Maximum EDID Blocks: 2 [ 576.392594][T12335] vivid-000: Limited RGB Range (16-235): false [ 576.398854][T12335] vivid-000: Rx RGB Quantization Range: Automatic [ 576.406011][T12335] vivid-000: Power Present: 0x00000001 [ 576.412899][T12335] tpg source WxH: 320x240 (Y'CbCr) [ 576.418135][T12335] tpg field: 1 [ 576.421911][T12335] tpg crop: (0,0)/320x240 [ 576.426678][T12335] tpg compose: (0,0)/320x240 [ 576.431312][T12335] tpg colorspace: 8 [ 576.435209][T12335] tpg transfer function: 0/0 [ 576.439836][T12335] tpg Y'CbCr encoding: 0/0 [ 576.444327][T12335] tpg quantization: 0/0 [ 576.448553][T12335] tpg RGB range: 0/2 [ 576.452480][T12335] vivid-000: ================== END STATUS ================== [ 577.134001][ T7939] asix 2-1:0.0 (unnamed net_device) (uninitialized): Failed to read reg index 0x0000: -32 [ 577.160383][ T7939] asix 2-1:0.0: probe with driver asix failed with error -32 [ 577.728280][ T7939] usb 2-1: USB disconnect, device number 49 [ 578.228413][T12352] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1582'. [ 578.371051][T12354] loop6: detected capacity change from 0 to 7 [ 578.398540][T12354] Dev loop6: unable to read RDB block 7 [ 578.435435][T12354] loop6: unable to read partition table [ 578.456650][T12354] loop6: partition table beyond EOD, truncated [ 578.486231][T12354] loop_reread_partitions: partition scan of loop6 (þ被xü—ŸÑà– ) failed (rc=-5) [ 578.556007][ T88] usb 1-1: new high-speed USB device number 56 using dummy_hcd [ 578.886314][ T88] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 578.899039][ T88] usb 1-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 578.911538][ T88] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 578.929640][ T88] usb 1-1: Product: syz [ 578.938410][ T88] usb 1-1: Manufacturer: syz [ 578.949003][ T88] usb 1-1: SerialNumber: syz [ 578.962950][ T88] usb 1-1: config 0 descriptor?? [ 579.461356][ T88] usb 1-1: probing VID:PID(2201:012C) [ 579.502504][ T88] usb 1-1: Could not find two sets of bulk-in/out endpoint pairs [ 579.534265][ T88] vub300 1-1:0.0: probe with driver vub300 failed with error -22 [ 579.550551][ T88] usb 1-1: USB disconnect, device number 56 [ 579.560034][T12320] delete_channel: no stack [ 579.757742][T12366] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1586'. [ 579.792865][T12366] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1586'. [ 580.107662][T12367] tipc: Enabled bearer , priority 0 [ 580.166656][T12369] syzkaller0: entered promiscuous mode [ 580.172225][T12369] syzkaller0: entered allmulticast mode [ 580.225891][T12367] tipc: Resetting bearer [ 580.269013][T12365] tipc: Resetting bearer [ 580.366956][T12365] tipc: Disabling bearer [ 581.664700][T12394] FAULT_INJECTION: forcing a failure. [ 581.664700][T12394] name failslab, interval 1, probability 0, space 0, times 0 [ 581.701290][T12394] CPU: 1 UID: 0 PID: 12394 Comm: syz.1.1592 Not tainted syzkaller #0 PREEMPT(full) [ 581.701318][T12394] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 581.701330][T12394] Call Trace: [ 581.701338][T12394] [ 581.701346][T12394] dump_stack_lvl+0x189/0x250 [ 581.701375][T12394] ? __pfx____ratelimit+0x10/0x10 [ 581.701397][T12394] ? __pfx_dump_stack_lvl+0x10/0x10 [ 581.701420][T12394] ? __pfx__printk+0x10/0x10 [ 581.701451][T12394] ? __pfx___might_resched+0x10/0x10 [ 581.701473][T12394] ? fs_reclaim_acquire+0x7d/0x100 [ 581.701509][T12394] should_fail_ex+0x414/0x560 [ 581.701544][T12394] should_failslab+0xa8/0x100 [ 581.701577][T12394] __kmalloc_cache_noprof+0x6f/0x6f0 [ 581.701605][T12394] ? ethnl_tsinfo_start+0x8d/0x2c0 [ 581.701637][T12394] ethnl_tsinfo_start+0x8d/0x2c0 [ 581.701661][T12394] ? genl_start+0x4a3/0x6c0 [ 581.701693][T12394] genl_start+0x4c0/0x6c0 [ 581.701732][T12394] __netlink_dump_start+0x466/0x7e0 [ 581.701766][T12394] genl_family_rcv_msg_dumpit+0x1e7/0x2c0 [ 581.701802][T12394] ? __pfx_genl_family_rcv_msg_dumpit+0x10/0x10 [ 581.701831][T12394] ? genl_get_cmd+0x67f/0x910 [ 581.701867][T12394] ? __pfx_genl_start+0x10/0x10 [ 581.701893][T12394] ? __pfx_genl_dumpit+0x10/0x10 [ 581.701920][T12394] ? __pfx_genl_done+0x10/0x10 [ 581.701964][T12394] genl_rcv_msg+0x5da/0x790 [ 581.702002][T12394] ? __pfx_genl_rcv_msg+0x10/0x10 [ 581.702030][T12394] ? __pfx_ethnl_tsinfo_start+0x10/0x10 [ 581.702053][T12394] ? __pfx_ethnl_tsinfo_dumpit+0x10/0x10 [ 581.702075][T12394] ? __pfx_ethnl_tsinfo_done+0x10/0x10 [ 581.702101][T12394] ? __asan_memcpy+0x40/0x70 [ 581.702125][T12394] ? __pfx_ref_tracker_free+0x10/0x10 [ 581.702155][T12394] netlink_rcv_skb+0x208/0x470 [ 581.702185][T12394] ? __lock_acquire+0xab9/0xd20 [ 581.702206][T12394] ? __pfx_genl_rcv_msg+0x10/0x10 [ 581.702238][T12394] ? __pfx_netlink_rcv_skb+0x10/0x10 [ 581.702283][T12394] ? down_read+0x1ad/0x2e0 [ 581.702311][T12394] genl_rcv+0x28/0x40 [ 581.702338][T12394] netlink_unicast+0x82c/0x9e0 [ 581.702370][T12394] ? __pfx_netlink_unicast+0x10/0x10 [ 581.702393][T12394] ? netlink_sendmsg+0x642/0xb30 [ 581.702415][T12394] ? skb_put+0x11b/0x210 [ 581.702444][T12394] netlink_sendmsg+0x805/0xb30 [ 581.702479][T12394] ? __pfx_netlink_sendmsg+0x10/0x10 [ 581.702506][T12394] ? __import_iovec+0x5d4/0x7f0 [ 581.702530][T12394] ? aa_sock_msg_perm+0xf1/0x1d0 [ 581.702551][T12394] ? bpf_lsm_socket_sendmsg+0x9/0x20 [ 581.702570][T12394] ? __pfx_netlink_sendmsg+0x10/0x10 [ 581.702595][T12394] __sock_sendmsg+0x219/0x270 [ 581.702618][T12394] ____sys_sendmsg+0x505/0x830 [ 581.702651][T12394] ? __pfx_____sys_sendmsg+0x10/0x10 [ 581.702694][T12394] ___sys_sendmsg+0x21f/0x2a0 [ 581.702724][T12394] ? __pfx____sys_sendmsg+0x10/0x10 [ 581.702792][T12394] ? __fget_files+0x2a/0x420 [ 581.702821][T12394] ? __fget_files+0x3a0/0x420 [ 581.702862][T12394] __sys_sendmsg+0x164/0x220 [ 581.702892][T12394] ? __pfx___sys_sendmsg+0x10/0x10 [ 581.702937][T12394] ? lockdep_hardirqs_on+0x9c/0x150 [ 581.702963][T12394] __do_fast_syscall_32+0xb6/0x2b0 [ 581.702989][T12394] ? lockdep_hardirqs_on+0x9c/0x150 [ 581.703015][T12394] do_fast_syscall_32+0x34/0x80 [ 581.703038][T12394] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 581.703062][T12394] RIP: 0023:0xf7fe3539 [ 581.703079][T12394] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 581.703095][T12394] RSP: 002b:00000000f54d655c EFLAGS: 00000206 ORIG_RAX: 0000000000000172 [ 581.703116][T12394] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 0000000080000240 [ 581.703130][T12394] RDX: 0000000000000000 RSI: 0000000000000000 RDI: 0000000000000000 [ 581.703142][T12394] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 581.703154][T12394] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 581.703166][T12394] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 581.703203][T12394] [ 582.087657][ C1] vkms_vblank_simulate: vblank timer overrun [ 582.820547][T12407] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1598'. [ 582.883979][T12407] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1598'. [ 583.303134][T12413] netlink: 'syz.5.1599': attribute type 4 has an invalid length. [ 583.311426][T12413] netlink: 17 bytes leftover after parsing attributes in process `syz.5.1599'. [ 584.270976][T12423] tipc: Enabled bearer , priority 0 [ 584.374085][T12424] syzkaller0: entered promiscuous mode [ 584.379618][T12424] syzkaller0: entered allmulticast mode [ 584.520987][T12423] tipc: Resetting bearer [ 584.630659][T12422] tipc: Resetting bearer [ 584.974904][T12422] tipc: Disabling bearer [ 585.786434][T12436] FAULT_INJECTION: forcing a failure. [ 585.786434][T12436] name fail_page_alloc, interval 1, probability 0, space 0, times 0 [ 585.824513][T12436] CPU: 0 UID: 0 PID: 12436 Comm: syz.0.1605 Not tainted syzkaller #0 PREEMPT(full) [ 585.824542][T12436] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 585.824554][T12436] Call Trace: [ 585.824562][T12436] [ 585.824571][T12436] dump_stack_lvl+0x189/0x250 [ 585.824600][T12436] ? __pfx____ratelimit+0x10/0x10 [ 585.824622][T12436] ? __pfx_dump_stack_lvl+0x10/0x10 [ 585.824645][T12436] ? __pfx__printk+0x10/0x10 [ 585.824677][T12436] ? fs_reclaim_acquire+0x7d/0x100 [ 585.824715][T12436] should_fail_ex+0x414/0x560 [ 585.824752][T12436] prepare_alloc_pages+0x213/0x610 [ 585.824793][T12436] __alloc_frozen_pages_noprof+0x123/0x370 [ 585.824830][T12436] ? __pfx___alloc_frozen_pages_noprof+0x10/0x10 [ 585.824872][T12436] ? policy_nodemask+0x27c/0x720 [ 585.824908][T12436] alloc_pages_mpol+0x232/0x4a0 [ 585.824945][T12436] alloc_pages_noprof+0xa9/0x190 [ 585.824979][T12436] pte_alloc_one+0x23/0x310 [ 585.825001][T12436] ? __handle_mm_fault+0x1d74/0x5400 [ 585.825030][T12436] __handle_mm_fault+0x2767/0x5400 [ 585.825073][T12436] ? __pfx___handle_mm_fault+0x10/0x10 [ 585.825128][T12436] ? find_vma+0xe7/0x160 [ 585.825154][T12436] ? __pfx_find_vma+0x10/0x10 [ 585.825182][T12436] handle_mm_fault+0x40a/0x8e0 [ 585.825219][T12436] do_user_addr_fault+0x764/0x1380 [ 585.825257][T12436] exc_page_fault+0x76/0xf0 [ 585.825282][T12436] asm_exc_page_fault+0x26/0x30 [ 585.825302][T12436] RIP: 0010:rep_movs_alternative+0xf/0x90 [ 585.825333][T12436] Code: c4 10 e9 84 0d 04 00 cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 48 83 f9 40 73 44 83 f9 08 73 25 85 c9 74 0f <8a> 06 88 07 48 ff c7 48 ff c6 48 ff c9 75 f1 e9 4d 0d 04 00 66 2e [ 585.825351][T12436] RSP: 0018:ffffc9001ad27d58 EFLAGS: 00050202 [ 585.825370][T12436] RAX: 00007ffffffff001 RBX: 0000000000000004 RCX: 0000000000000004 [ 585.825384][T12436] RDX: 0000000000000001 RSI: 0000000080000000 RDI: ffffc9001ad27dc0 [ 585.825397][T12436] RBP: ffffc9001ad27e38 R08: 0000000000000003 R09: 0000000000000004 [ 585.825410][T12436] R10: dffffc0000000000 R11: fffff520035a4fb8 R12: ffff88802f97b000 [ 585.825426][T12436] R13: dffffc0000000000 R14: ffffc9001ad27dc0 R15: 0000000080000000 [ 585.825460][T12436] _copy_from_user+0x7a/0xb0 [ 585.825489][T12436] j1939_sk_setsockopt+0x38f/0x9f0 [ 585.825521][T12436] ? __pfx_aa_sk_perm+0x10/0x10 [ 585.825552][T12436] ? __pfx_j1939_sk_setsockopt+0x10/0x10 [ 585.825583][T12436] ? aa_sock_opt_perm+0xff/0x1b0 [ 585.825607][T12436] ? bpf_lsm_socket_setsockopt+0x9/0x20 [ 585.825626][T12436] ? __pfx_j1939_sk_setsockopt+0x10/0x10 [ 585.825659][T12436] do_sock_setsockopt+0x17c/0x1b0 [ 585.825692][T12436] __ia32_sys_setsockopt+0x13f/0x1b0 [ 585.825725][T12436] __do_fast_syscall_32+0xb6/0x2b0 [ 585.825750][T12436] ? lockdep_hardirqs_on+0x9c/0x150 [ 585.825776][T12436] do_fast_syscall_32+0x34/0x80 [ 585.825801][T12436] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 585.825829][T12436] RIP: 0023:0xf70ce539 [ 585.825846][T12436] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 585.825863][T12436] RSP: 002b:00000000f54be55c EFLAGS: 00000206 ORIG_RAX: 000000000000016e [ 585.825883][T12436] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 000000000000006b [ 585.825897][T12436] RDX: 0000000000000003 RSI: 0000000080000000 RDI: 0000000000000004 [ 585.825909][T12436] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 585.825922][T12436] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 585.825933][T12436] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 585.825963][T12436] [ 585.832825][ T5156] Bluetooth: hci1: ISO packet too small [ 586.252828][T12412] delete_channel: no stack [ 586.613835][ T7939] usb 6-1: new high-speed USB device number 25 using dummy_hcd [ 586.768726][ T7939] usb 6-1: device descriptor read/64, error -71 [ 586.850707][T12452] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1610'. [ 586.871756][T12452] netlink: 24 bytes leftover after parsing attributes in process `syz.8.1610'. [ 587.103700][ T7939] usb 6-1: new high-speed USB device number 26 using dummy_hcd [ 587.313695][ T7939] usb 6-1: device descriptor read/64, error -71 [ 587.451349][ T7939] usb usb6-port1: attempt power cycle [ 587.698392][T12461] netlink: 36 bytes leftover after parsing attributes in process `syz.8.1614'. [ 587.721707][T12462] IPv6: NLM_F_CREATE should be specified when creating new route [ 587.793749][ T7939] usb 6-1: new high-speed USB device number 27 using dummy_hcd [ 587.824461][ T7939] usb 6-1: device descriptor read/8, error -71 [ 587.974491][ T5925] usb 9-1: new high-speed USB device number 14 using dummy_hcd [ 587.978818][T12467] 8021q: VLANs not supported on gre0 [ 588.063832][ T7939] usb 6-1: new high-speed USB device number 28 using dummy_hcd [ 588.084504][ T7939] usb 6-1: device descriptor read/8, error -71 [ 588.142220][ T5925] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 588.186402][ T5925] usb 9-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 588.198667][ T7939] usb usb6-port1: unable to enumerate USB device [ 588.207916][ T5925] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 588.235750][T12471] netlink: 'syz.0.1618': attribute type 4 has an invalid length. [ 588.246105][T12471] netlink: 17 bytes leftover after parsing attributes in process `syz.0.1618'. [ 588.260474][ T5925] usb 9-1: Product: syz [ 588.277188][ T5925] usb 9-1: Manufacturer: syz [ 588.293749][ T5925] usb 9-1: SerialNumber: syz [ 588.304866][ T5925] usb 9-1: config 0 descriptor?? [ 588.367776][T12472] netlink: 8 bytes leftover after parsing attributes in process `syz.0.1618'. [ 588.587441][ T5925] usb 9-1: probing VID:PID(2201:012C) [ 588.599468][ T5925] usb 9-1: Could not find two sets of bulk-in/out endpoint pairs [ 588.630932][ T5925] vub300 9-1:0.0: probe with driver vub300 failed with error -22 [ 588.650761][ T5925] usb 9-1: USB disconnect, device number 14 [ 590.681456][T12488] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1622'. [ 590.695089][T12488] netlink: 24 bytes leftover after parsing attributes in process `syz.1.1622'. [ 591.624018][T12470] delete_channel: no stack [ 594.255189][T12531] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1633'. [ 594.289513][T12531] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1633'. [ 596.229563][T12552] netlink: 'syz.1.1638': attribute type 4 has an invalid length. [ 596.237600][T12552] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1638'. [ 596.262376][T12552] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1638'. [ 597.200940][T12559] netlink: 4 bytes leftover after parsing attributes in process `syz.7.1640'. [ 597.920234][T12567] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1644'. [ 597.976771][T12567] netlink: 24 bytes leftover after parsing attributes in process `syz.5.1644'. [ 598.994601][T12584] FAULT_INJECTION: forcing a failure. [ 598.994601][T12584] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 599.022910][T12584] CPU: 0 UID: 0 PID: 12584 Comm: syz.5.1647 Not tainted syzkaller #0 PREEMPT(full) [ 599.022938][T12584] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 599.022960][T12584] Call Trace: [ 599.022968][T12584] [ 599.022978][T12584] dump_stack_lvl+0x189/0x250 [ 599.023012][T12584] ? __pfx____ratelimit+0x10/0x10 [ 599.023037][T12584] ? __pfx_dump_stack_lvl+0x10/0x10 [ 599.023064][T12584] ? __pfx__printk+0x10/0x10 [ 599.023095][T12584] ? __might_fault+0xb0/0x130 [ 599.023135][T12584] should_fail_ex+0x414/0x560 [ 599.023177][T12584] _copy_to_iter+0x404/0x1790 [ 599.023215][T12584] ? rcu_is_watching+0x15/0xb0 [ 599.023240][T12584] ? __pfx__copy_to_iter+0x10/0x10 [ 599.023260][T12584] ? trace_contention_end+0x39/0x120 [ 599.023288][T12584] ? __mutex_lock+0x335/0x1350 [ 599.023311][T12584] ? do_raw_spin_lock+0x121/0x290 [ 599.023350][T12584] __skb_datagram_iter+0x41a/0x990 [ 599.023383][T12584] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 599.023422][T12584] skb_copy_datagram_iter+0xc5/0x230 [ 599.023456][T12584] unix_stream_read_actor+0x6c/0xb0 [ 599.023479][T12584] unix_stream_read_generic+0xac3/0x2470 [ 599.023534][T12584] ? __pfx_unix_stream_read_generic+0x10/0x10 [ 599.023556][T12584] ? __pfx_autoremove_wake_function+0x10/0x10 [ 599.023591][T12584] ? __page_table_check_zero+0x406/0x530 [ 599.023617][T12584] ? __page_table_check_zero+0xba/0x530 [ 599.023647][T12584] ? post_alloc_hook+0x253/0x2a0 [ 599.023681][T12584] unix_stream_recvmsg+0x15d/0x1b0 [ 599.023706][T12584] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 599.023726][T12584] ? __pfx_unix_stream_read_actor+0x10/0x10 [ 599.023761][T12584] ? aa_sock_msg_perm+0xda/0x1d0 [ 599.023781][T12584] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 599.023798][T12584] ? security_socket_recvmsg+0x7e/0x2e0 [ 599.023822][T12584] ? __pfx_unix_stream_recvmsg+0x10/0x10 [ 599.023843][T12584] sock_recvmsg+0x229/0x270 [ 599.023868][T12584] ____sys_recvmsg+0x1c9/0x460 [ 599.023903][T12584] ? __pfx_____sys_recvmsg+0x10/0x10 [ 599.023929][T12584] ? get_compat_msghdr+0x37e/0x4a0 [ 599.023999][T12584] ___sys_recvmsg+0x1b5/0x510 [ 599.024039][T12584] ? __pfx____sys_recvmsg+0x10/0x10 [ 599.024091][T12584] ? __fget_files+0x3a0/0x420 [ 599.024130][T12584] do_recvmmsg+0x36a/0x770 [ 599.024168][T12584] ? __pfx_do_recvmmsg+0x10/0x10 [ 599.024209][T12584] ? __pfx_vfs_write+0x10/0x10 [ 599.024254][T12584] __sys_recvmmsg+0x19d/0x280 [ 599.024283][T12584] ? __pfx___sys_recvmmsg+0x10/0x10 [ 599.024306][T12584] ? ksys_write+0x22a/0x250 [ 599.024341][T12584] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 599.024370][T12584] __do_fast_syscall_32+0xb6/0x2b0 [ 599.024393][T12584] ? lockdep_hardirqs_on+0x9c/0x150 [ 599.024420][T12584] do_fast_syscall_32+0x34/0x80 [ 599.024442][T12584] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 599.024464][T12584] RIP: 0023:0xf702e539 [ 599.024481][T12584] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 599.024499][T12584] RSP: 002b:00000000f53fd55c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 599.024520][T12584] RAX: ffffffffffffffda RBX: 0000000000000008 RCX: 00000000800034c0 [ 599.024533][T12584] RDX: 000000000000013c RSI: 0000000000000700 RDI: 0000000000000000 [ 599.024545][T12584] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 599.024557][T12584] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 599.024567][T12584] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 599.024594][T12584] [ 599.425954][T12545] delete_channel: no stack [ 600.504130][T12597] ipvlan2: entered promiscuous mode [ 601.103723][ T5924] usb 6-1: new high-speed USB device number 29 using dummy_hcd [ 601.265047][ T5924] usb 6-1: Using ep0 maxpacket: 8 [ 601.273109][ T5924] usb 6-1: New USB device found, idVendor=0ccd, idProduct=0039, bcdDevice=90.7b [ 601.283052][ T5924] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 601.300294][ T5924] pvrusb2: Hardware description: Terratec Grabster AV400 [ 601.366353][T12615] sit0: entered promiscuous mode [ 601.378476][T12615] netlink: 'syz.0.1659': attribute type 1 has an invalid length. [ 601.395915][T12615] netlink: 1 bytes leftover after parsing attributes in process `syz.0.1659'. [ 601.548692][ T5924] pvrusb2: ********** [ 601.562106][ T5924] pvrusb2: ***WARNING*** Support for this device (Terratec Grabster AV400) is experimental. [ 601.599102][ T5924] pvrusb2: Important functionality might not be entirely working. [ 601.645340][ T5924] pvrusb2: Please consider contacting the driver author to help with further stabilization of the driver. [ 601.968775][T12617] netlink: 6 bytes leftover after parsing attributes in process `syz.5.1655'. [ 601.999087][ T5924] pvrusb2: ********** [ 602.012012][T12617] A link change request failed with some changes committed already. Interface lo may have been left with an inconsistent configuration, please check. [ 602.072672][ T2340] pvrusb2: Invalid write control endpoint [ 602.314242][ T5924] usb 6-1: USB disconnect, device number 29 [ 602.415212][ T2340] pvrusb2: Invalid write control endpoint [ 602.439219][ T2340] pvrusb2: ***WARNING*** Detected a wedged cx25840 chip; the device will not work. [ 602.478137][ T2340] pvrusb2: ***WARNING*** Try power cycling the pvrusb2 device. [ 602.486501][ T2340] pvrusb2: ***WARNING*** Disabling further access to the device to prevent other foul-ups. [ 602.503707][ T2340] pvrusb2: Device being rendered inoperable [ 602.509946][ T2340] cx25840 2-0044: Unable to detect h/w, assuming cx23887 [ 602.523780][ T2340] cx25840 2-0044: cx23887 A/V decoder found @ 0x88 (pvrusb2_a) [ 602.541958][ T2340] pvrusb2: Attached sub-driver cx25840 [ 602.550746][ T2340] pvrusb2: ***WARNING*** pvrusb2 device hardware appears to be jammed and I can't clear it. [ 602.561405][ T2340] pvrusb2: You might need to power cycle the pvrusb2 device in order to recover. [ 603.157392][T12635] netlink: 36 bytes leftover after parsing attributes in process `syz.0.1663'. [ 603.364726][T12639] netlink: 'syz.7.1662': attribute type 4 has an invalid length. [ 603.383022][T12639] netlink: 17 bytes leftover after parsing attributes in process `syz.7.1662'. [ 603.393921][ T5904] usb 6-1: new high-speed USB device number 30 using dummy_hcd [ 603.406413][T12639] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1662'. [ 603.443732][ T5924] usb 1-1: new high-speed USB device number 57 using dummy_hcd [ 603.568750][ T5904] usb 6-1: Using ep0 maxpacket: 8 [ 603.606680][ T5904] usb 6-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 603.630236][ T5924] usb 1-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 603.943713][ T5904] usb 6-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 604.116524][ T5924] usb 1-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 604.165598][ T5924] usb 1-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 604.175018][ T5904] usb 6-1: config 0 interface 0 has no altsetting 0 [ 604.181888][ T5904] usb 6-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 604.192829][ T5924] usb 1-1: Product: syz [ 604.198375][ T5924] usb 1-1: Manufacturer: syz [ 604.203398][ T5904] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 604.212818][ T5924] usb 1-1: SerialNumber: syz [ 604.227380][ T5924] usb 1-1: config 0 descriptor?? [ 604.235467][ T5904] usb 6-1: config 0 descriptor?? [ 604.464412][ T5924] usb 1-1: probing VID:PID(2201:012C) [ 604.487968][ T5924] usb 1-1: Could not find two sets of bulk-in/out endpoint pairs [ 604.609438][ T5924] vub300 1-1:0.0: probe with driver vub300 failed with error -22 [ 604.694677][T12637] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=io+mem,decodes=none:owns=io+mem [ 604.725572][ T5904] playstation 0003:054C:09CC.0032: hidraw0: USB HID vff.ed Device [HID 054c:09cc] on usb-dummy_hcd.5-1/input0 [ 604.741242][ T5924] usb 1-1: USB disconnect, device number 57 [ 604.918660][ T5904] playstation 0003:054C:09CC.0032: Failed to retrieve feature with reportID 18: -71 [ 604.929024][ T5904] playstation 0003:054C:09CC.0032: Failed to retrieve DualShock4 pairing info: -71 [ 604.941068][ T5904] playstation 0003:054C:09CC.0032: Failed to get MAC address from DualShock4 [ 604.953211][ T5904] playstation 0003:054C:09CC.0032: Failed to create dualshock4. [ 604.977314][ T5904] playstation 0003:054C:09CC.0032: probe with driver playstation failed with error -71 [ 605.012165][ T5904] usb 6-1: USB disconnect, device number 30 [ 605.135353][ T43] usb 2-1: new high-speed USB device number 50 using dummy_hcd [ 605.293993][ T43] usb 2-1: Using ep0 maxpacket: 8 [ 605.302096][ T43] usb 2-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 605.314022][ T43] usb 2-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 605.336705][ T43] usb 2-1: config 0 interface 0 has no altsetting 0 [ 605.376794][ T43] usb 2-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 605.468228][ T43] usb 2-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 605.600787][ T43] usb 2-1: config 0 descriptor?? [ 605.921615][T12660] FAULT_INJECTION: forcing a failure. [ 605.921615][T12660] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 605.942924][T12660] CPU: 0 UID: 0 PID: 12660 Comm: syz.0.1671 Not tainted syzkaller #0 PREEMPT(full) [ 605.942960][T12660] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 605.942974][T12660] Call Trace: [ 605.942983][T12660] [ 605.942993][T12660] dump_stack_lvl+0x189/0x250 [ 605.943025][T12660] ? __pfx____ratelimit+0x10/0x10 [ 605.943054][T12660] ? __pfx_dump_stack_lvl+0x10/0x10 [ 605.943077][T12660] ? __pfx__printk+0x10/0x10 [ 605.943134][T12660] should_fail_ex+0x414/0x560 [ 605.943171][T12660] _copy_to_user+0x31/0xb0 [ 605.943204][T12660] simple_read_from_buffer+0xe1/0x170 [ 605.943237][T12660] proc_fail_nth_read+0x1b3/0x220 [ 605.943266][T12660] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 605.943300][T12660] ? rw_verify_area+0x2a6/0x4d0 [ 605.943326][T12660] ? rcu_is_watching+0x15/0xb0 [ 605.943354][T12660] ? __pfx_proc_fail_nth_read+0x10/0x10 [ 605.943379][T12660] vfs_read+0x200/0xa30 [ 605.943412][T12660] ? __pfx_preempt_schedule_irq+0x10/0x10 [ 605.943448][T12660] ? __pfx_vfs_read+0x10/0x10 [ 605.943470][T12660] ? irqentry_exit+0x74/0x90 [ 605.943497][T12660] ? lockdep_hardirqs_on+0x9c/0x150 [ 605.943539][T12660] ksys_read+0x145/0x250 [ 605.943568][T12660] ? __pfx_ksys_read+0x10/0x10 [ 605.943600][T12660] ? lockdep_hardirqs_on+0x9c/0x150 [ 605.943626][T12660] __do_fast_syscall_32+0xb6/0x2b0 [ 605.943657][T12660] ? lockdep_hardirqs_on+0x9c/0x150 [ 605.943683][T12660] do_fast_syscall_32+0x34/0x80 [ 605.943706][T12660] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 605.943731][T12660] RIP: 0023:0xf70ce539 [ 605.943748][T12660] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 605.943766][T12660] RSP: 002b:00000000f54be590 EFLAGS: 00000206 ORIG_RAX: 0000000000000003 [ 605.943788][T12660] RAX: ffffffffffffffda RBX: 0000000000000004 RCX: 00000000f54be620 [ 605.943803][T12660] RDX: 000000000000000f RSI: 00000000f7465ff4 RDI: 0000000000000000 [ 605.943815][T12660] RBP: 0000000000000001 R08: 0000000000000000 R09: 0000000000000000 [ 605.943828][T12660] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 605.943840][T12660] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 605.943868][T12660] [ 606.214854][T12648] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 606.368106][ T43] playstation 0003:054C:09CC.0033: hidraw0: USB HID vff.ed Device [HID 054c:09cc] on usb-dummy_hcd.1-1/input0 [ 606.708809][T12664] block device autoloading is deprecated and will be removed. [ 606.905398][ T43] playstation 0003:054C:09CC.0033: Failed to retrieve feature with reportID 18: -71 [ 606.916475][ T43] playstation 0003:054C:09CC.0033: Failed to retrieve DualShock4 pairing info: -71 [ 606.935492][T12638] delete_channel: no stack [ 606.963418][ T43] playstation 0003:054C:09CC.0033: Failed to get MAC address from DualShock4 [ 607.123895][ T43] playstation 0003:054C:09CC.0033: Failed to create dualshock4. [ 607.204703][T12673] A link change request failed with some changes committed already. Interface caif0 may have been left with an inconsistent configuration, please check. [ 607.222813][ T43] playstation 0003:054C:09CC.0033: probe with driver playstation failed with error -71 [ 607.253135][ T43] usb 2-1: USB disconnect, device number 50 [ 607.373778][ T5911] usb 9-1: new high-speed USB device number 15 using dummy_hcd [ 607.480461][T12675] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1676'. [ 607.644049][ T5911] usb 9-1: Using ep0 maxpacket: 8 [ 607.672498][ T5911] usb 9-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 607.694200][ T5911] usb 9-1: New USB device found, idVendor=0e9c, idProduct=0000, bcdDevice=5b.1e [ 607.713066][ T5911] usb 9-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 607.720005][T12679] netlink: 36 bytes leftover after parsing attributes in process `syz.1.1677'. [ 607.743095][ T5911] usb 9-1: Product: syz [ 607.750603][ T5911] usb 9-1: Manufacturer: syz [ 607.757128][ T5911] usb 9-1: SerialNumber: syz [ 607.768868][ T5911] usb 9-1: config 0 descriptor?? [ 607.855416][ T5911] streamzap 9-1:0.0: streamzap_probe: Unexpected desc.bNumEndpoints (0) [ 608.023967][ T43] usb 2-1: new high-speed USB device number 51 using dummy_hcd [ 608.058092][ T5911] usb 9-1: USB disconnect, device number 15 [ 608.199763][ T43] usb 2-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 608.222666][ T43] usb 2-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 608.251931][ T43] usb 2-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 608.275688][ T43] usb 2-1: Product: syz [ 608.294038][ T43] usb 2-1: Manufacturer: syz [ 608.310864][ T43] usb 2-1: SerialNumber: syz [ 608.351008][ T43] usb 2-1: config 0 descriptor?? [ 608.586491][ T43] usb 2-1: probing VID:PID(2201:012C) [ 608.630036][ T43] usb 2-1: Could not find two sets of bulk-in/out endpoint pairs [ 608.698464][ T43] vub300 2-1:0.0: probe with driver vub300 failed with error -22 [ 608.756707][ T43] usb 2-1: USB disconnect, device number 51 [ 608.838026][T12693] FAULT_INJECTION: forcing a failure. [ 608.838026][T12693] name fail_usercopy, interval 1, probability 0, space 0, times 0 [ 608.917469][T12693] CPU: 1 UID: 0 PID: 12693 Comm: syz.7.1684 Not tainted syzkaller #0 PREEMPT(full) [ 608.917515][T12693] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 608.917537][T12693] Call Trace: [ 608.917552][T12693] [ 608.917569][T12693] dump_stack_lvl+0x189/0x250 [ 608.917615][T12693] ? __pfx____ratelimit+0x10/0x10 [ 608.917654][T12693] ? __pfx_dump_stack_lvl+0x10/0x10 [ 608.917697][T12693] ? __pfx__printk+0x10/0x10 [ 608.917748][T12693] ? __might_fault+0xb0/0x130 [ 608.917819][T12693] should_fail_ex+0x414/0x560 [ 608.917884][T12693] _copy_to_iter+0x404/0x1790 [ 608.917932][T12693] ? _raw_spin_unlock_irqrestore+0x85/0x110 [ 608.917963][T12693] ? __pfx__copy_to_iter+0x10/0x10 [ 608.917986][T12693] ? __skb_try_recv_from_queue+0x2b2/0x730 [ 608.918023][T12693] ? __skb_try_recv_datagram+0x3d5/0x4d0 [ 608.918059][T12693] __skb_datagram_iter+0xf8/0x990 [ 608.918092][T12693] ? __pfx_simple_copy_to_iter+0x10/0x10 [ 608.918132][T12693] skb_copy_datagram_iter+0xc5/0x230 [ 608.918167][T12693] netlink_recvmsg+0x2ab/0xa30 [ 608.918204][T12693] ? __pfx_netlink_recvmsg+0x10/0x10 [ 608.918227][T12693] ? __kmalloc_noprof+0x432/0x7f0 [ 608.918254][T12693] ? iovec_from_user+0x87/0x250 [ 608.918284][T12693] ? aa_sock_msg_perm+0xf1/0x1d0 [ 608.918306][T12693] ? bpf_lsm_socket_recvmsg+0x9/0x20 [ 608.918325][T12693] ? security_socket_recvmsg+0x7e/0x2e0 [ 608.918349][T12693] ? __pfx_netlink_recvmsg+0x10/0x10 [ 608.918375][T12693] sock_recvmsg+0x229/0x270 [ 608.918400][T12693] ____sys_recvmsg+0x1c9/0x460 [ 608.918439][T12693] ? __pfx_____sys_recvmsg+0x10/0x10 [ 608.918465][T12693] ? get_compat_msghdr+0x37e/0x4a0 [ 608.918510][T12693] ? ktime_get_ts64+0xa2/0x3d0 [ 608.918546][T12693] ___sys_recvmsg+0x1b5/0x510 [ 608.918581][T12693] ? __pfx____sys_recvmsg+0x10/0x10 [ 608.918637][T12693] ? __fget_files+0x3a0/0x420 [ 608.918679][T12693] do_recvmmsg+0x36a/0x770 [ 608.918718][T12693] ? __pfx_do_recvmmsg+0x10/0x10 [ 608.918761][T12693] ? _copy_from_user+0x94/0xb0 [ 608.918804][T12693] __sys_recvmmsg+0x127/0x280 [ 608.918834][T12693] ? __pfx___sys_recvmmsg+0x10/0x10 [ 608.918859][T12693] ? ksys_write+0x22a/0x250 [ 608.918895][T12693] __ia32_compat_sys_recvmmsg_time32+0xbf/0xe0 [ 608.918964][T12693] __do_fast_syscall_32+0xb6/0x2b0 [ 608.918992][T12693] ? lockdep_hardirqs_on+0x9c/0x150 [ 608.919018][T12693] do_fast_syscall_32+0x34/0x80 [ 608.919042][T12693] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 608.919068][T12693] RIP: 0023:0xf7f22539 [ 608.919085][T12693] Code: 03 74 b4 01 10 07 03 74 b0 01 10 08 03 74 d8 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 52 55 89 e5 0f 34 cd 80 <5d> 5a 59 c3 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 [ 608.919103][T12693] RSP: 002b:00000000f541655c EFLAGS: 00000206 ORIG_RAX: 0000000000000151 [ 608.919137][T12693] RAX: ffffffffffffffda RBX: 0000000000000003 RCX: 00000000800037c0 [ 608.919151][T12693] RDX: 00000000000003b4 RSI: 0000000000002000 RDI: 0000000080003700 [ 608.919164][T12693] RBP: 0000000000000000 R08: 0000000000000000 R09: 0000000000000000 [ 608.919178][T12693] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 608.919190][T12693] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 608.919217][T12693] [ 609.231804][ C1] vkms_vblank_simulate: vblank timer overrun [ 610.241158][T12707] netlink: 'syz.7.1685': attribute type 4 has an invalid length. [ 610.287981][T12707] netlink: 17 bytes leftover after parsing attributes in process `syz.7.1685'. [ 610.544579][T12707] netlink: 8 bytes leftover after parsing attributes in process `syz.7.1685'. [ 611.369715][T11988] Bluetooth: hci4: command 0x0406 tx timeout [ 612.775536][T12707] delete_channel: no stack [ 612.965694][T12749] netlink: 36 bytes leftover after parsing attributes in process `syz.5.1696'. [ 613.165987][T12754] tipc: Enabled bearer , priority 0 [ 613.195778][T12754] syzkaller0: entered promiscuous mode [ 613.201316][T12754] syzkaller0: entered allmulticast mode [ 613.253890][ T5925] usb 6-1: new high-speed USB device number 31 using dummy_hcd [ 613.265870][T12753] tipc: Resetting bearer [ 613.390287][T12753] tipc: Disabling bearer [ 613.447961][ T5925] usb 6-1: config 0 has an invalid descriptor of length 0, skipping remainder of the config [ 613.473354][ T5925] usb 6-1: New USB device found, idVendor=2201, idProduct=012c, bcdDevice=60.d9 [ 613.539030][ T5925] usb 6-1: New USB device strings: Mfr=1, Product=2, SerialNumber=3 [ 613.548171][ T5925] usb 6-1: Product: syz [ 613.557610][ T5925] usb 6-1: Manufacturer: syz [ 613.562244][ T5925] usb 6-1: SerialNumber: syz [ 613.645979][ T5925] usb 6-1: config 0 descriptor?? [ 613.917918][ T5925] usb 6-1: probing VID:PID(2201:012C) [ 613.942449][ T5925] usb 6-1: Could not find two sets of bulk-in/out endpoint pairs [ 613.968647][ T5925] vub300 6-1:0.0: probe with driver vub300 failed with error -22 [ 613.997322][ T5925] usb 6-1: USB disconnect, device number 31 [ 614.835270][ T5925] usb 9-1: new high-speed USB device number 16 using dummy_hcd [ 615.004112][ T5925] usb 9-1: Using ep0 maxpacket: 8 [ 615.029474][ T5925] usb 9-1: config 0 interface 0 altsetting 247 endpoint 0x81 has an invalid bInterval 202, changing to 11 [ 615.158265][ T5925] usb 9-1: config 0 interface 0 altsetting 247 has 1 endpoint descriptor, different from the interface descriptor's value: 4 [ 615.199117][ T5925] usb 9-1: config 0 interface 0 has no altsetting 0 [ 615.217498][ T5925] usb 9-1: New USB device found, idVendor=054c, idProduct=09cc, bcdDevice= 0.00 [ 615.257502][ T5925] usb 9-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 615.297612][ T5925] usb 9-1: config 0 descriptor?? [ 615.521335][T12778] blktrace: Concurrent blktraces are not allowed on nullb0 [ 615.752347][T12766] pci 0000:00:05.0: vgaarb: VGA decodes changed: olddecodes=none,decodes=none:owns=io+mem [ 615.837153][ T5925] playstation 0003:054C:09CC.0034: hidraw0: USB HID vff.ed Device [HID 054c:09cc] on usb-dummy_hcd.8-1/input0 [ 616.070890][ T5925] playstation 0003:054C:09CC.0034: Failed to retrieve feature with reportID 18: -71 [ 616.121182][ T5925] playstation 0003:054C:09CC.0034: Failed to retrieve DualShock4 pairing info: -71 [ 616.284029][ T5925] playstation 0003:054C:09CC.0034: Failed to get MAC address from DualShock4 [ 616.353085][ T5925] playstation 0003:054C:09CC.0034: Failed to create dualshock4. [ 616.479895][ T5925] playstation 0003:054C:09CC.0034: probe with driver playstation failed with error -71 [ 616.562175][ T5925] usb 9-1: USB disconnect, device number 16 [ 617.142200][T12790] netlink: 'syz.8.1707': attribute type 4 has an invalid length. [ 617.150123][T12790] netlink: 17 bytes leftover after parsing attributes in process `syz.8.1707'. [ 617.162939][T12790] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1707'. [ 617.395622][T12782] syz.7.1705 (12782): drop_caches: 2 [ 619.814784][T12809] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 619.864048][T12809] Bluetooth: hci1: Opcode 0x0406 failed: -4 [ 620.134877][T12809] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 620.140951][T12809] Bluetooth: hci3: Opcode 0x0406 failed: -4 [ 620.232516][T12809] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 620.272763][T12809] Bluetooth: hci5: Opcode 0x0406 failed: -4 [ 620.343170][T12809] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 620.413940][T12809] Bluetooth: hci0: Opcode 0x0406 failed: -4 [ 620.443460][T12789] delete_channel: no stack [ 620.473181][T12809] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 620.503463][T12809] Bluetooth: hci2: Opcode 0x0406 failed: -4 [ 620.597781][T12809] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 620.608246][T12809] Bluetooth: hci4: Opcode 0x0406 failed: -4 [ 620.873745][ T43] usb 1-1: new high-speed USB device number 58 using dummy_hcd [ 621.047650][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has an invalid bInterval 0, changing to 7 [ 621.086250][ T43] usb 1-1: config 0 interface 0 altsetting 0 endpoint 0x81 has invalid wMaxPacketSize 0 [ 621.103487][ T43] usb 1-1: New USB device found, idVendor=0e8f, idProduct=0012, bcdDevice= 0.00 [ 621.130363][ T5156] Bluetooth: hci1: command 0x0406 tx timeout [ 621.153655][ T43] usb 1-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 621.179139][ T43] usb 1-1: config 0 descriptor?? [ 621.215355][T12836] netlink: 12 bytes leftover after parsing attributes in process `syz.1.1721'. [ 621.544294][ T5924] usb 6-1: new high-speed USB device number 32 using dummy_hcd [ 622.032920][ T43] usbhid 1-1:0.0: can't add hid device: -71 [ 622.050488][ T43] usbhid 1-1:0.0: probe with driver usbhid failed with error -71 [ 622.105139][ T5924] usb 6-1: Using ep0 maxpacket: 32 [ 622.116034][ T5924] usb 6-1: New USB device found, idVendor=0fd9, idProduct=0025, bcdDevice=29.40 [ 622.119651][ T43] usb 1-1: USB disconnect, device number 58 [ 622.145117][ T5924] usb 6-1: New USB device strings: Mfr=0, Product=0, SerialNumber=0 [ 622.189288][ T5156] Bluetooth: hci3: command 0x0406 tx timeout [ 622.275245][ T5156] Bluetooth: hci5: command 0x0406 tx timeout [ 622.426661][ T5156] Bluetooth: hci0: command 0x0406 tx timeout [ 622.484828][ T5156] Bluetooth: hci2: command 0x0406 tx timeout [ 622.491953][ T5924] usb 6-1: config 0 descriptor?? [ 622.661714][ T5156] Bluetooth: hci4: command 0x0406 tx timeout [ 622.710264][ T5924] dvb-usb: found a 'Elgato EyeTV Sat' in warm state. [ 622.806927][ T5924] dvb-usb: will pass the complete MPEG2 transport stream to the software demuxer. [ 622.894468][ T5924] dvbdev: DVB: registering new adapter (Elgato EyeTV Sat) [ 622.901690][ T5924] usb 6-1: media controller created [ 623.153863][ T5924] dvbdev: dvb_create_media_entity: media entity 'dvb-demux' registered. [ 623.204487][ T5156] Bluetooth: hci1: command 0x0406 tx timeout [ 623.321009][T12862] syzkaller1: entered promiscuous mode [ 623.332500][T12862] syzkaller1: entered allmulticast mode [ 623.398239][T12866] netlink: 'syz.8.1728': attribute type 4 has an invalid length. [ 623.406253][T12866] netlink: 17 bytes leftover after parsing attributes in process `syz.8.1728'. [ 623.448987][T12866] netlink: 8 bytes leftover after parsing attributes in process `syz.8.1728'. [ 623.464220][ T5924] az6027: usb out operation failed. (-71) [ 623.471454][ T5924] stb0899_attach: Driver disabled by Kconfig [ 623.479402][ T5924] az6027: no front-end attached [ 623.479402][ T5924] [ 623.488607][ T5924] az6027: usb out operation failed. (-71) [ 623.494969][ T5924] dvb-usb: no frontend was attached by 'Elgato EyeTV Sat' [ 623.509430][ T5924] input: IR-receiver inside an USB DVB receiver as /devices/platform/dummy_hcd.5/usb6/6-1/input/input25 [ 623.554010][ T5924] dvb-usb: schedule remote query interval to 400 msecs. [ 623.561430][ T5924] dvb-usb: Elgato EyeTV Sat successfully initialized and connected. [ 623.588790][ T5924] usb 6-1: USB disconnect, device number 32 [ 623.702445][ T5924] dvb-usb: Elgato EyeTV Sat successfully deinitialized and disconnected. [ 624.048426][T12871] netlink: 24 bytes leftover after parsing attributes in process `syz.7.1730'. [ 624.329964][ T5156] Bluetooth: hci3: command 0x0406 tx timeout [ 624.339258][ T5156] Bluetooth: hci5: command 0x0406 tx timeout [ 624.349467][ T1299] ieee802154 phy0 wpan0: encryption failed: -22 [ 624.355987][ T1299] ieee802154 phy1 wpan1: encryption failed: -22 [ 624.493214][T11988] Bluetooth: hci0: command 0x0406 tx timeout [ 624.572188][T11988] Bluetooth: hci2: command 0x0406 tx timeout [ 624.723842][T11988] Bluetooth: hci4: command 0x0406 tx timeout [ 624.800520][T12878] can: request_module (can-proto-4) failed. [ 624.958678][T12886] ======================================================= [ 624.958678][T12886] WARNING: The mand mount option has been deprecated and [ 624.958678][T12886] and is ignored by this kernel. Remove the mand [ 624.958678][T12886] option from the mount to silence this warning. [ 624.958678][T12886] ======================================================= [ 627.147483][T12907] Bluetooth: hci1: Opcode 0x0c1a failed: -4 [ 627.289331][T12907] Bluetooth: hci3: Opcode 0x0c1a failed: -4 [ 627.382088][T12907] Bluetooth: hci5: Opcode 0x0c1a failed: -4 [ 627.415377][T12907] Bluetooth: hci0: Opcode 0x0c1a failed: -4 [ 627.432661][T12907] Bluetooth: hci2: Opcode 0x0c1a failed: -4 [ 627.478807][T12907] Bluetooth: hci4: Opcode 0x0c1a failed: -4 [ 627.650455][T12865] delete_channel: no stack [ 628.461439][T12932] syzkaller0: entered promiscuous mode [ 628.470002][T12932] syzkaller0: entered allmulticast mode [ 628.613243][T12933] syz.7.1743 calls setitimer() with new_value NULL pointer. Misfeature support will be removed [ 628.857242][T12937] netlink: 12 bytes leftover after parsing attributes in process `syz.8.1745'. [ 628.881733][T12937] vlan2: entered promiscuous mode [ 628.993758][T12937] bridge0: entered promiscuous mode [ 629.203755][T11988] Bluetooth: hci1: command 0x0406 tx timeout [ 629.363854][T11988] Bluetooth: hci3: command 0x0406 tx timeout [ 629.448816][T11988] Bluetooth: hci2: command 0x0406 tx timeout [ 629.454983][ T5156] Bluetooth: hci0: command 0x0406 tx timeout [ 629.461398][ T5156] Bluetooth: hci5: command 0x0406 tx timeout [ 629.531375][T12950] Bluetooth: hci4: command 0x0406 tx timeout [ 630.514658][T12963] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1751'. [ 631.386706][T12975] syzkaller0: entered promiscuous mode [ 631.392282][T12975] syzkaller0: entered allmulticast mode [ 631.762555][T12985] input: syz1 as /devices/virtual/input/input26 [ 631.769834][ T30] kauditd_printk_skb: 989 callbacks suppressed [ 631.769853][ T30] audit: type=1326 audit(1759561624.386:1496): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 631.944051][ T30] audit: type=1326 audit(1759561624.386:1497): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=351 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.006299][ T30] audit: type=1326 audit(1759561624.386:1498): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.074111][ T30] audit: type=1326 audit(1759561624.386:1499): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.096286][ C0] vkms_vblank_simulate: vblank timer overrun [ 632.150836][ T30] audit: type=1326 audit(1759561624.386:1500): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.196487][ T30] audit: type=1326 audit(1759561624.386:1501): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=359 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.249212][ T30] audit: type=1326 audit(1759561624.386:1502): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.333146][ T30] audit: type=1326 audit(1759561624.386:1503): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=345 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.379993][ T30] audit: type=1326 audit(1759561624.396:1504): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=240 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.491255][ T30] audit: type=1326 audit(1759561624.396:1505): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=unconfined pid=12980 comm="syz.8.1758" exe="/root/syz-executor" sig=0 arch=40000003 syscall=295 compat=1 ip=0xf7f74539 code=0x7ffc0000 [ 632.513395][ C0] vkms_vblank_simulate: vblank timer overrun [ 633.053780][ T5904] usb 6-1: new full-speed USB device number 33 using dummy_hcd [ 633.193853][ T5904] usb 6-1: device descriptor read/64, error -71 [ 633.434089][ T5904] usb 6-1: new full-speed USB device number 34 using dummy_hcd [ 633.564111][ T5904] usb 6-1: device descriptor read/64, error -71 [ 633.632679][T12957] delete_channel: no stack [ 633.698520][ T5904] usb usb6-port1: attempt power cycle [ 633.784421][ T5925] usb 9-1: new high-speed USB device number 17 using dummy_hcd [ 633.963686][ T5925] usb 9-1: Using ep0 maxpacket: 16 [ 633.972690][ T5925] usb 9-1: unable to get BOS descriptor or descriptor too short [ 633.988646][ T5925] usb 9-1: config 2 has an invalid interface number: 124 but max is 0 [ 633.998973][ T5925] usb 9-1: config 2 has an invalid descriptor of length 41, skipping remainder of the config [ 634.014193][ T5925] usb 9-1: config 2 has no interface number 0 [ 634.023258][ T5925] usb 9-1: config 2 interface 124 altsetting 100 has 0 endpoint descriptors, different from the interface descriptor's value: 2 [ 634.038263][ T5925] usb 9-1: config 2 interface 124 has no altsetting 0 [ 634.056283][ T5925] usb 9-1: New USB device found, idVendor=0bfd, idProduct=010c, bcdDevice=bb.c4 [ 634.068968][ T5925] usb 9-1: New USB device strings: Mfr=87, Product=2, SerialNumber=3 [ 634.073702][ T5904] usb 6-1: new full-speed USB device number 35 using dummy_hcd [ 634.092149][ T5925] usb 9-1: Product: syz [ 634.099729][ T5925] usb 9-1: Manufacturer: syz [ 634.104663][ T5904] usb 6-1: device descriptor read/8, error -71 [ 634.116346][ T5925] usb 9-1: SerialNumber: syz [ 634.344875][ T5904] usb 6-1: new full-speed USB device number 36 using dummy_hcd [ 634.374799][ T5904] usb 6-1: device descriptor read/8, error -71 [ 634.375542][ T5925] kvaser_usb 9-1:2.124: error -ENODEV: Cannot get usb endpoint(s) [ 634.459115][T13009] netlink: 'syz.1.1765': attribute type 4 has an invalid length. [ 634.467406][T13009] netlink: 17 bytes leftover after parsing attributes in process `syz.1.1765'. [ 634.484853][T13009] netlink: 8 bytes leftover after parsing attributes in process `syz.1.1765'. [ 634.566446][ T31] INFO: task kworker/0:3:5837 blocked for more than 143 seconds. [ 634.574922][ T31] Not tainted syzkaller #0 [ 634.582247][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 634.637551][ T5925] usb 9-1: USB disconnect, device number 17 [ 634.657755][ T31] task:kworker/0:3 state:D stack:21928 pid:5837 tgid:5837 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 634.700040][ T5904] usb usb6-port1: unable to enumerate USB device [ 634.767041][ T31] Workqueue: usb_hub_wq hub_event [ 634.778210][ T31] Call Trace: [ 634.786399][ T31] [ 634.795115][ T31] __schedule+0x1798/0x4cc0 [ 634.853214][ T31] ? __pfx___schedule+0x10/0x10 [ 634.858330][ T31] ? schedule+0x91/0x360 [ 634.865071][ T31] schedule+0x165/0x360 [ 634.877070][ T31] schedule_timeout+0x9a/0x270 [ 634.885258][ T31] ? __pfx_schedule_timeout+0x10/0x10 [ 634.895918][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 634.905446][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 634.912856][ T31] ? wait_for_completion+0x267/0x5d0 [ 634.946103][ T31] wait_for_completion+0x2bf/0x5d0 [ 634.960737][ T31] ? __pfx_wait_for_completion+0x10/0x10 [ 634.973916][ T31] i2c_del_adapter+0x581/0x6e0 [ 634.988630][ T31] ? __pfx_i2c_del_adapter+0x10/0x10 [ 634.998126][ T31] ? dvb_usbv2_exit+0x85a/0x9e0 [ 635.009136][ T31] dvb_usbv2_probe+0x4ae/0x41a0 [ 635.042517][ T31] ? __pfx_dvb_usbv2_probe+0x10/0x10 [ 635.059319][ T31] ? __pm_runtime_set_status+0x785/0xa50 [ 635.072979][ T31] usb_probe_interface+0x665/0xc30 [ 635.082704][ T31] ? __pfx_usb_probe_interface+0x10/0x10 [ 635.091290][ T31] really_probe+0x26d/0x9e0 [ 635.132782][ T31] __driver_probe_device+0x18c/0x2f0 [ 635.149752][ T31] driver_probe_device+0x4f/0x430 [ 635.168242][ T31] __device_attach_driver+0x2ce/0x530 [ 635.174038][ T31] bus_for_each_drv+0x24e/0x2e0 [ 635.180547][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 635.187340][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 635.192943][ T31] __device_attach+0x2b8/0x400 [ 635.213007][ T31] ? __pfx___device_attach+0x10/0x10 [ 635.237181][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 635.245494][ T31] bus_probe_device+0x185/0x260 [ 635.262139][ T31] device_add+0x7b6/0xb50 [ 635.275237][ T31] usb_set_configuration+0x1a87/0x20e0 [ 635.291451][ T31] usb_generic_driver_probe+0x8d/0x150 [ 635.311252][ T31] usb_probe_device+0x1c4/0x390 [ 635.328804][ T31] ? __pfx_usb_probe_device+0x10/0x10 [ 635.342110][ T31] really_probe+0x26d/0x9e0 [ 635.355127][ T31] __driver_probe_device+0x18c/0x2f0 [ 635.366544][ T31] driver_probe_device+0x4f/0x430 [ 635.381617][ T31] __device_attach_driver+0x2ce/0x530 [ 635.398581][ T31] bus_for_each_drv+0x24e/0x2e0 [ 635.411124][ T31] ? __pfx___device_attach_driver+0x10/0x10 [ 635.432981][ T31] ? __pfx_bus_for_each_drv+0x10/0x10 [ 635.446470][ T31] __device_attach+0x2b8/0x400 [ 635.456250][ T31] ? __pfx___device_attach+0x10/0x10 [ 635.468584][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 635.484095][ T31] bus_probe_device+0x185/0x260 [ 635.495347][ T31] device_add+0x7b6/0xb50 [ 635.508480][ T31] usb_new_device+0xa39/0x16f0 [ 635.522100][ T31] ? __pfx_usb_new_device+0x10/0x10 [ 635.546055][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 635.558858][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 635.572972][ T31] hub_event+0x2958/0x4a20 [ 635.587094][ T31] ? __pfx_hub_event+0x10/0x10 [ 635.609536][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 635.622288][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 635.650205][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 635.710925][ T31] ? process_scheduled_works+0x9ef/0x17b0 [ 635.717207][ T31] process_scheduled_works+0xade/0x17b0 [ 635.724165][ T31] ? __pfx_process_scheduled_works+0x10/0x10 [ 635.731478][ T31] worker_thread+0x8a0/0xda0 [ 635.736422][ T31] ? __pfx__raw_spin_unlock_irqrestore+0x10/0x10 [ 635.745875][ T31] ? __kthread_parkme+0x7b/0x200 [ 635.751839][ T31] kthread+0x70e/0x8a0 [ 635.757805][ T31] ? __pfx_worker_thread+0x10/0x10 [ 635.763150][ T31] ? __pfx_kthread+0x10/0x10 [ 635.768543][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 635.775675][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 635.781373][ T31] ? __pfx_kthread+0x10/0x10 [ 635.787811][ T31] ret_from_fork+0x436/0x7d0 [ 635.792730][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 635.799627][ T31] ? __switch_to_asm+0x39/0x70 [ 635.837540][ T31] ? __switch_to_asm+0x33/0x70 [ 635.867724][ T31] ? __pfx_kthread+0x10/0x10 [ 635.881641][ T31] ret_from_fork_asm+0x1a/0x30 [ 635.893165][ T31] [ 635.900226][ T31] INFO: task syz.6.1164:10853 blocked for more than 144 seconds. [ 635.911506][ T31] Not tainted syzkaller #0 [ 635.917220][ T31] "echo 0 > /proc/sys/kernel/hung_task_timeout_secs" disables this message. [ 635.926036][ T31] task:syz.6.1164 state:D stack:25032 pid:10853 tgid:10852 ppid:10130 task_flags:0x400040 flags:0x10080002 [ 635.938406][ T31] Call Trace: [ 635.941843][ T31] [ 635.945061][ T31] __schedule+0x1798/0x4cc0 [ 635.950115][ T31] ? __pfx___schedule+0x10/0x10 [ 635.955244][ T31] ? schedule+0x91/0x360 [ 635.959848][ T31] schedule+0x165/0x360 [ 635.966574][ T31] schedule_preempt_disabled+0x13/0x30 [ 635.972372][ T31] __mutex_lock+0x7e6/0x1350 [ 635.977326][ T31] ? __mutex_lock+0x5bb/0x1350 [ 635.982327][ T31] ? usbdev_open+0x16e/0x760 [ 635.987167][ T31] ? __pfx___mutex_lock+0x10/0x10 [ 635.992563][ T31] ? bus_find_device+0x273/0x2b0 [ 635.997829][ T31] ? __pfx_bus_find_device+0x10/0x10 [ 636.003326][ T31] ? __lock_acquire+0xab9/0xd20 [ 636.008801][ T31] usbdev_open+0x16e/0x760 [ 636.013437][ T31] ? __pfx_usbdev_open+0x10/0x10 [ 636.019523][ T31] ? do_raw_spin_unlock+0x122/0x240 [ 636.025126][ T31] chrdev_open+0x4cc/0x5e0 [ 636.029708][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 636.034994][ T31] ? fsnotify_open_perm_and_set_mode+0x113/0x610 [ 636.041527][ T31] ? __pfx_chrdev_open+0x10/0x10 [ 636.046665][ T31] do_dentry_open+0x953/0x13f0 [ 636.051806][ T31] vfs_open+0x3b/0x340 [ 636.056193][ T31] ? path_openat+0x2ecd/0x3830 [ 636.061158][ T31] path_openat+0x2ee5/0x3830 [ 636.066188][ T31] ? __pfx_path_openat+0x10/0x10 [ 636.071316][ T31] do_filp_open+0x1fa/0x410 [ 636.077432][ T31] ? __lock_acquire+0xab9/0xd20 [ 636.082612][ T31] ? __pfx_do_filp_open+0x10/0x10 [ 636.088007][ T31] ? _raw_spin_unlock+0x28/0x50 [ 636.093021][ T31] ? alloc_fd+0x64c/0x6c0 [ 636.097594][ T31] do_sys_openat2+0x121/0x1c0 [ 636.102748][ T31] ? __pfx_do_sys_openat2+0x10/0x10 [ 636.108278][ T31] __ia32_compat_sys_openat+0x131/0x160 [ 636.114199][ T31] __do_fast_syscall_32+0xb6/0x2b0 [ 636.119478][ T31] do_fast_syscall_32+0x34/0x80 [ 636.125182][ T31] entry_SYSENTER_compat_after_hwframe+0x84/0x8e [ 636.131919][ T31] RIP: 0023:0xf7ff6539 [ 636.136338][ T31] RSP: 002b:00000000f54e6100 EFLAGS: 00000206 ORIG_RAX: 0000000000000127 [ 636.145112][ T31] RAX: ffffffffffffffda RBX: 00000000ffffff9c RCX: 00000000f54e6150 [ 636.153379][ T31] RDX: 0000000000109301 RSI: 0000000000000000 RDI: 00000000f7485ff4 [ 636.161556][ T31] RBP: 0000000000109301 R08: 0000000000000000 R09: 0000000000000000 [ 636.169667][ T31] R10: 0000000000000000 R11: 0000000000000206 R12: 0000000000000000 [ 636.177785][ T31] R13: 0000000000000000 R14: 0000000000000000 R15: 0000000000000000 [ 636.186187][ T31] [ 636.189665][ T31] [ 636.189665][ T31] Showing all locks held in the system: [ 636.197533][ T31] 2 locks held by kworker/u8:1/13: [ 636.202664][ T31] #0: ffff888146af9948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 636.239190][ T31] #1: ffffc90000127bc0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 636.253934][ T31] 1 lock held by khungtaskd/31: [ 636.258908][ T31] #0: ffffffff8dd3b160 (rcu_read_lock){....}-{1:3}, at: debug_show_all_locks+0x2e/0x180 [ 636.271340][ T31] 3 locks held by kworker/u8:4/59: [ 636.276691][ T31] #0: ffff888146af9948 ((wq_completion)iou_exit){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 636.288450][ T31] #1: ffffc9000210fbc0 ((work_completion)(&ctx->exit_work)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 636.306281][ T31] #2: ffffffff8dd40bf8 (rcu_state.exp_mutex){+.+.}-{4:4}, at: synchronize_rcu_expedited+0x2f6/0x730 [ 636.317591][ T31] 2 locks held by getty/5598: [ 636.322543][ T31] #0: ffff88814d9fa0a0 (&tty->ldisc_sem){++++}-{0:0}, at: tty_ldisc_ref_wait+0x25/0x70 [ 636.335123][ T31] #1: ffffc900036be2f0 (&ldata->atomic_read_lock){+.+.}-{4:4}, at: n_tty_read+0x43e/0x1400 [ 636.345926][ T31] 5 locks held by kworker/0:3/5837: [ 636.351248][ T31] #0: ffff888020edb948 ((wq_completion)usb_hub_wq){+.+.}-{0:0}, at: process_scheduled_works+0x9b4/0x17b0 [ 636.363049][ T31] #1: ffffc90003d6fbc0 ((work_completion)(&hub->events)){+.+.}-{0:0}, at: process_scheduled_works+0x9ef/0x17b0 [ 636.375682][ T31] #2: ffff888144fc7198 (&dev->mutex){....}-{4:4}, at: hub_event+0x184/0x4a20 [ 636.384752][ T31] #3: ffff88807d8a9198 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 636.394189][ T31] #4: ffff88807d8af160 (&dev->mutex){....}-{4:4}, at: __device_attach+0x88/0x400 [ 636.403470][ T31] 4 locks held by udevd/5885: [ 636.408574][ T31] #0: ffff88806bc62540 (&p->lock){+.+.}-{4:4}, at: seq_read_iter+0xb7/0xe20 [ 636.418580][ T31] #1: ffff88805231e888 (&of->mutex#2){+.+.}-{4:4}, at: kernfs_seq_start+0x5c/0x420 [ 636.428743][ T31] #2: ffff88807dbd75a8 (kn->active#28){++++}-{0:0}, at: kernfs_seq_start+0xb2/0x420 [ 636.438562][ T31] #3: ffff88807d8a9198 (&dev->mutex){....}-{4:4}, at: manufacturer_show+0x26/0xa0 [ 636.448038][ T31] 1 lock held by syz.6.1164/10853: [ 636.453160][ T31] #0: ffff888144fc7198 (&dev->mutex){....}-{4:4}, at: usbdev_open+0x16e/0x760 [ 636.464797][ T31] [ 636.467164][ T31] ============================================= [ 636.467164][ T31] [ 636.476033][ T31] NMI backtrace for cpu 1 [ 636.476050][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 636.476074][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 636.476087][ T31] Call Trace: [ 636.476096][ T31] [ 636.476106][ T31] dump_stack_lvl+0x189/0x250 [ 636.476139][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 636.476165][ T31] ? __pfx__printk+0x10/0x10 [ 636.476210][ T31] nmi_cpu_backtrace+0x39e/0x3d0 [ 636.476246][ T31] ? __pfx_nmi_cpu_backtrace+0x10/0x10 [ 636.476279][ T31] ? __pfx__printk+0x10/0x10 [ 636.476315][ T31] ? __pfx_nmi_raise_cpu_backtrace+0x10/0x10 [ 636.476351][ T31] nmi_trigger_cpumask_backtrace+0x17a/0x300 [ 636.476386][ T31] watchdog+0xf60/0xfa0 [ 636.476412][ T31] ? watchdog+0x1e2/0xfa0 [ 636.476439][ T31] kthread+0x70e/0x8a0 [ 636.476472][ T31] ? __pfx_watchdog+0x10/0x10 [ 636.476491][ T31] ? __pfx_kthread+0x10/0x10 [ 636.476522][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 636.476542][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 636.476562][ T31] ? __pfx_kthread+0x10/0x10 [ 636.476592][ T31] ret_from_fork+0x436/0x7d0 [ 636.476617][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 636.476666][ T31] ? __switch_to_asm+0x39/0x70 [ 636.476692][ T31] ? __switch_to_asm+0x33/0x70 [ 636.476719][ T31] ? __pfx_kthread+0x10/0x10 [ 636.476748][ T31] ret_from_fork_asm+0x1a/0x30 [ 636.476792][ T31] [ 636.476800][ T31] Sending NMI from CPU 1 to CPUs 0: [ 636.622535][ C0] NMI backtrace for cpu 0 [ 636.622555][ C0] CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted syzkaller #0 PREEMPT(full) [ 636.622575][ C0] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 636.622587][ C0] RIP: 0010:pv_native_safe_halt+0x13/0x20 [ 636.622611][ C0] Code: cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 f3 0f 1e fa 66 90 0f 00 2d f3 0a 15 00 f3 0f 1e fa fb f4 88 e6 02 00 cc cc cc cc cc cc cc cc 90 90 90 90 90 90 90 90 90 [ 636.622627][ C0] RSP: 0018:ffffffff8da07d80 EFLAGS: 000002c2 [ 636.622645][ C0] RAX: b6b5f48564065100 RBX: ffffffff81954a27 RCX: b6b5f48564065100 [ 636.622659][ C0] RDX: 0000000000000001 RSI: ffffffff8d50da07 RDI: ffffffff8b9ec260 [ 636.622672][ C0] RBP: ffffffff8da07eb8 R08: ffff8880b8832fdb R09: 1ffff110171065fb [ 636.622686][ C0] R10: dffffc0000000000 R11: ffffed10171065fc R12: ffffffff8f5b9130 [ 636.622700][ C0] R13: 0000000000000000 R14: 0000000000000000 R15: 1ffffffff1b52a40 [ 636.622713][ C0] FS: 0000000000000000(0000) GS:ffff888126396000(0000) knlGS:0000000000000000 [ 636.622727][ C0] CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033 [ 636.622740][ C0] CR2: 00000000317f8ffc CR3: 000000007850c000 CR4: 00000000003526f0 [ 636.622756][ C0] Call Trace: [ 636.622765][ C0] [ 636.622772][ C0] default_idle+0x13/0x20 [ 636.622794][ C0] default_idle_call+0x73/0xb0 [ 636.622816][ C0] do_idle+0x1e7/0x510 [ 636.622836][ C0] ? asm_sysvec_reschedule_ipi+0x1a/0x20 [ 636.622855][ C0] ? lockdep_hardirqs_on+0x9c/0x150 [ 636.622874][ C0] ? __pfx_do_idle+0x10/0x10 [ 636.622905][ C0] ? do_idle+0xc/0x510 [ 636.622924][ C0] cpu_startup_entry+0x44/0x60 [ 636.622943][ C0] rest_init+0x2de/0x300 [ 636.622966][ C0] start_kernel+0x3ae/0x410 [ 636.622995][ C0] x86_64_start_reservations+0x24/0x30 [ 636.623017][ C0] x86_64_start_kernel+0x143/0x1c0 [ 636.623038][ C0] common_startup_64+0x13e/0x147 [ 636.623070][ C0] [ 636.828942][ T31] Kernel panic - not syncing: hung_task: blocked tasks [ 636.835836][ T31] CPU: 1 UID: 0 PID: 31 Comm: khungtaskd Not tainted syzkaller #0 PREEMPT(full) [ 636.844950][ T31] Hardware name: Google Google Compute Engine/Google Compute Engine, BIOS Google 08/18/2025 [ 636.855032][ T31] Call Trace: [ 636.858317][ T31] [ 636.861252][ T31] dump_stack_lvl+0x99/0x250 [ 636.866027][ T31] ? __asan_memcpy+0x40/0x70 [ 636.870625][ T31] ? __pfx_dump_stack_lvl+0x10/0x10 [ 636.875829][ T31] ? __pfx__printk+0x10/0x10 [ 636.880435][ T31] vpanic+0x237/0x6d0 [ 636.884452][ T31] ? __pfx_vpanic+0x10/0x10 [ 636.888967][ T31] ? preempt_schedule_common+0x83/0xd0 [ 636.894436][ T31] panic+0xb9/0xc0 [ 636.898185][ T31] ? __pfx_panic+0x10/0x10 [ 636.902611][ T31] ? preempt_schedule_thunk+0x16/0x30 [ 636.907991][ T31] ? nmi_trigger_cpumask_backtrace+0x2bb/0x300 [ 636.914160][ T31] watchdog+0xf9f/0xfa0 [ 636.918321][ T31] ? watchdog+0x1e2/0xfa0 [ 636.922652][ T31] kthread+0x70e/0x8a0 [ 636.926735][ T31] ? __pfx_watchdog+0x10/0x10 [ 636.931436][ T31] ? __pfx_kthread+0x10/0x10 [ 636.936066][ T31] ? _raw_spin_unlock_irq+0x23/0x50 [ 636.941291][ T31] ? lockdep_hardirqs_on+0x9c/0x150 [ 636.946491][ T31] ? __pfx_kthread+0x10/0x10 [ 636.951113][ T31] ret_from_fork+0x436/0x7d0 [ 636.955706][ T31] ? __pfx_ret_from_fork+0x10/0x10 [ 636.960823][ T31] ? __switch_to_asm+0x39/0x70 [ 636.965595][ T31] ? __switch_to_asm+0x33/0x70 [ 636.970367][ T31] ? __pfx_kthread+0x10/0x10 [ 636.974960][ T31] ret_from_fork_asm+0x1a/0x30 [ 636.979741][ T31] [ 636.983091][ T31] Kernel Offset: disabled [ 636.987419][ T31] Rebooting in 86400 seconds..